@coreplane/switchboard 1.217.0 → 1.219.0

package/dist/assets/config/config.example.yaml

@@ -473,6 +473,12 @@ workspaceDir: ./workspaces
 #       auth: bearer
 #       tokenEnv: MCP_GITHUB_TOKEN          # static bearer from the bot env (startup fails if unset)
 #       agents: [general, research, coding] # default [general, research]
+#     lake:                                  # a server behind Cloudflare Access: the gate wants a service token,
+#       url: https://vega.example.com/mcp    # not an Authorization header — name the two headers and the bot
+#       auth: none                           # env vars holding them (manifest secrets on Cloudflare); an unset
+#       headersEnv:                          # one makes the server `unavailable` for that run, naming it
+#         CF-Access-Client-Id: MCP_ACCESS_CLIENT_ID
+#         CF-Access-Client-Secret: MCP_ACCESS_CLIENT_SECRET
 # channels:
 #   "slack:C0123":
 #     mcpServers:

package/dist/assets/deploy/cloudflare/worker.ts

@@ -90,6 +90,8 @@ export interface Env {
   ANTHROPIC_ADMIN_KEY?: string; // costs dash (optional): Anthropic Admin API key for the LLM cost report
   MEMORY_TOKEN?: string; // durable memory + friction ledger + schedule firings + MCP registry: bearer for the state Worker
   MCP_CREDENTIAL_KEY?: string; // MCP registry: the bot-only key that seals server credentials before they reach the McpDO
+  MCP_ACCESS_CLIENT_ID?: string; // MCP servers behind Cloudflare Access: the service token's client id, named by a server's `headersEnv`
+  MCP_ACCESS_CLIENT_SECRET?: string; // MCP servers behind Cloudflare Access: the service token's client secret, named by a server's `headersEnv`
   STATE_WORKER_URL?: string; // var: the state Worker's base URL — where this shim records each scheduled firing
   ARTIFACTS_R2_ACCESS_KEY_ID?: string; // artifact store: the bucket-scoped S3 token the bot signs presigned URLs with
   ARTIFACTS_R2_SECRET_ACCESS_KEY?: string; // artifact store: the secret half of that token
@@ -124,6 +126,8 @@ const FORWARDED_OPTIONAL = [
   "BRAVE_SEARCH_API_KEY",
   "MEMORY_TOKEN",
   "MCP_CREDENTIAL_KEY",
+  "MCP_ACCESS_CLIENT_ID",
+  "MCP_ACCESS_CLIENT_SECRET",
   "STATE_WORKER_URL",
   "ARTIFACTS_R2_ACCESS_KEY_ID",
   "ARTIFACTS_R2_SECRET_ACCESS_KEY",

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -46,7 +46,10 @@ import {
   attachmentRefsOf,
   DEFAULT_SESSION_LOG_MAX_BYTES,
   droppedToolResultRow,
+  GAP_MARKER,
+  NOTEPAD_MAX_BYTES,
   planSessionTrim,
+  roleOfStoredRow,
   rowKind,
   sessionsToDrop,
   tailCut,
@@ -80,6 +83,7 @@ import {
   type LiveRunRow,
   type ReclaimedRun,
   type RunState,
+  type SessionHit,
   type StepRecord,
   type StopMode,
   type TranscriptAttachment,
@@ -210,6 +214,10 @@ const FTS_CANDIDATES_FLOOR = 50;
  *  tokens and are untouched; the engine still ranks with the FULL query, so the
  *  cap only shapes which rows can become candidates. */
 const MAX_MATCH_TOKENS = 24;
+/** A `recall` query's size and the most hits one answers (session-log item 10):
+ *  a query is a few words, and the tool's default is five. */
+const MAX_SEARCH_QUERY_BYTES = 1_024;
+const MAX_SEARCH_HITS = 50;
 /** Request body ceiling, checked against Content-Length before parsing. A full
  *  batch (50 × 4000-char texts + keywords + envelope) fits comfortably. */
 const MAX_BODY_BYTES = 512 * 1024;
@@ -2892,18 +2900,65 @@ export class SessionLogDO extends DurableObject<Env> {
     return { ...(await this.read(from)), from };
   }
 
-  /** The rows whose text matches `query`, newest first. */
-  async search(query: string, limit: number): Promise<Array<{ idx: number; part: number; text: string }>> {
+  /** The rows whose text matches `query`, in relevance order (FTS5's bm25 rank,
+   *  the order the memory store's search uses; the newest first among equals),
+   *  each with its turn, part, role, kind and indexed text — what `recall`
+   *  answers (session-log item 10). */
+  async search(query: string, limit: number): Promise<SessionHit[]> {
     const match = ftsMatchExpr(query);
     if (match === null) return [];
     return this.sql
-      .exec<{ idx: number; part: number; text: string }>(
-        `SELECT t.idx, t.part, t.text FROM turns_fts f JOIN turns t ON t.id = f.rowid
-          WHERE turns_fts MATCH ? ORDER BY t.idx DESC, t.part DESC LIMIT ?`,
+      .exec<{ idx: number; part: number; kind: string; json: string; text: string }>(
+        `SELECT t.idx, t.part, t.kind, t.json, t.text FROM turns_fts f JOIN turns t ON t.id = f.rowid
+          WHERE turns_fts MATCH ? ORDER BY f.rank, t.idx DESC, t.part DESC LIMIT ?`,
         match,
         limit,
       )
-      .toArray();
+      .toArray()
+      .map(({ idx, part, kind, json, text }) => {
+        const role = roleOfStoredRow(json);
+        return { idx, part, ...(role !== undefined ? { role } : {}), kind, text };
+      });
+  }
+
+  /** The gap markers (session-log item 9) whose turn lies in `[from, to]`: the
+   *  rows a follow-up appended because the run before it detached, so a search
+   *  whose hits straddle one can say the log ends short between them. */
+  async gapsBetween(from: number, to: number): Promise<number[]> {
+    return this.sql
+      .exec<{ idx: number }>(
+        `SELECT DISTINCT idx FROM turns WHERE idx >= ? AND idx <= ? AND kind = 'text' AND text = ? ORDER BY idx`,
+        from,
+        to,
+        GAP_MARKER,
+      )
+      .toArray()
+      .map((r) => r.idx);
+  }
+
+  /** The notepad, replaced whole by the live run (session-log item 10): the
+   *  same fence as a row write — unknown-run before an owner, fenced for
+   *  another generation — and the write's time kept beside the text. */
+  async writeNotepad(gen: string, text: string, now: number): Promise<FenceResult> {
+    let out: FenceResult = { ok: true };
+    this.ctx.storage.transactionSync(() => {
+      const owner = this.owner();
+      if (owner === undefined) {
+        out = { ok: false, reason: "unknown-run" };
+        return;
+      }
+      if (owner.gen !== gen) {
+        out = { ok: false, reason: "fenced" };
+        return;
+      }
+      this.sql.exec(
+        `INSERT INTO notepad (k, text, updated_at) VALUES (1, ?, ?)
+         ON CONFLICT(k) DO UPDATE SET text = excluded.text, updated_at = excluded.updated_at`,
+        text,
+        now,
+      );
+    });
+    return out;
   }
 
   async bytes(): Promise<number> {
@@ -2968,6 +3023,9 @@ const LEDGER_ROUTES = new Set([
   "/runs/session/read",
   "/runs/session/read-tail",
   "/runs/session/clear-owner",
+  "/runs/session/search",
+  "/runs/session/notepad",
+  "/runs/session/notepad/write",
 ]);
 
 /** Routes whose bodies may carry a record, a transcript chunk, or an event batch. */
@@ -3187,6 +3245,38 @@ async function handleLedger(pathname: string, body: unknown, env: Env): Promise<
       if (!g.ok) return json({ error: g.error }, 400);
       return fenced(await stub.clearOwner(runId.value, g.value));
     }
+    // `recall` (session-log item 10): the hits in relevance order, and the gap
+    // markers that lie between the oldest and the newest of them.
+    if (pathname === "/runs/session/search") {
+      if (
+        typeof b.query !== "string" ||
+        b.query.trim().length === 0 ||
+        utf8ByteLength(b.query) > MAX_SEARCH_QUERY_BYTES
+      )
+        return json({ error: `query must be a non-empty string of at most ${MAX_SEARCH_QUERY_BYTES} bytes` }, 400);
+      const limit = b.limit;
+      if (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1 || limit > MAX_SEARCH_HITS)
+        return json({ error: `limit must be an integer in 1..${MAX_SEARCH_HITS}` }, 400);
+      const hits = await stub.search(b.query, limit);
+      const gaps =
+        hits.length > 1
+          ? await stub.gapsBetween(Math.min(...hits.map((h) => h.idx)), Math.max(...hits.map((h) => h.idx)))
+          : [];
+      console.log(`[runs/session/search] ${key.value} -> ${hits.length} hit(s), ${gaps.length} gap(s)`);
+      return json({ hits, gaps });
+    }
+    if (pathname === "/runs/session/notepad") return json({ notepad: await stub.notepad() });
+    if (pathname === "/runs/session/notepad/write") {
+      const g = gen(b.gen);
+      if (!g.ok) return json({ error: g.error }, 400);
+      if (typeof b.text !== "string") return json({ error: "text must be a string" }, 400);
+      const bytes = utf8ByteLength(b.text);
+      if (bytes > NOTEPAD_MAX_BYTES)
+        return json({ error: `text is ${bytes} bytes; the notepad holds at most ${NOTEPAD_MAX_BYTES}` }, 400);
+      const r = await stub.writeNotepad(g.value, b.text, systemClock());
+      console.log(`[runs/session/notepad/write] ${key.value} <- ${bytes} byte(s), ok=${r.ok}`);
+      return fenced(r);
+    }
     return json({ error: "not found" }, 404);
   }
 

package/dist/assets/deploy/secrets.manifest.json

@@ -99,6 +99,18 @@
       "optional": true,
       "note": "AES-256-GCM key (32 bytes, base64: `openssl rand -base64 32`) the bot seals MCP server credentials with before they go to the state Worker's McpDO (docs/reference/specs/mcp-tools.md). Bot-only by design: the Worker stores ciphertext. Rotation re-seals every credential — not built yet; rotate = users re-run `mcp connect`."
     },
+    {
+      "name": "MCP_ACCESS_CLIENT_ID",
+      "workers": ["bot"],
+      "optional": true,
+      "note": "Client id of the Cloudflare Access service token the bot presents to MCP servers behind Access — a pinned server's `headersEnv` names it under `CF-Access-Client-Id` (docs/reference/specs/mcp-tools.md item 11). Minted in Zero Trust → Access → Service Auth of the account that guards the server, and enrolled on that Access application's policy. Optional: without it such a server is `unavailable` naming the variable."
+    },
+    {
+      "name": "MCP_ACCESS_CLIENT_SECRET",
+      "workers": ["bot"],
+      "optional": true,
+      "note": "Client secret of that service token — `headersEnv` names it under `CF-Access-Client-Secret`. Shown once at creation; rotate by minting a new token, `deploy secrets bot --only` both names, `deploy restart`, then revoke the old one."
+    },
     {
       "name": "MEMORY_TOKEN",
       "workers": ["bot", "resident", "memory"],

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.217.0",
+  "version": "1.219.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.217.0",
+      "version": "1.219.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -16710,7 +16710,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.217.0",
+      "version": "1.219.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.124.0",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.217.0",
+  "version": "1.219.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.217.0",
-  "commit": "9007d5664a8f07d092a33dbf373f5377577adc36",
-  "builtAt": "2026-09-15T00:05:36.819Z"
+  "version": "1.219.0",
+  "commit": "584d81012dc5119229ec5e4ea04a304e3eceb450",
+  "builtAt": "2026-09-15T01:38:10.165Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -202,6 +202,14 @@ Whole files: up to 1 GiB where the artifact store is configured (a recording, a
 Files the person dropped on the thread that were too large to show you inline are already in ./attachments/ in your workspace when the turn's text names them (a video for ffmpeg, a large PDF, a zip); read them from there — never ask for a re-upload.
 Text stays in your message; do not attach what you can say.`;
 
+// Every prompt that can run on the pi harness carries this verbatim
+// (docs/reference/specs/session-log.md item 10; record 0035, "The notepad"): what
+// belongs in the agent's notes for the thread, and why — the one thing sure to
+// survive a compaction and reach the next run there — beside the reach `recall`
+// gives into every earlier turn. Said once so the prompts cannot drift on it.
+const NOTEPAD = `YOUR NOTES AND YOUR REACH BACK. This thread's conversation outlives your context window and this run: every turn — yours, the person's, every tool call and its output, from this run and the runs before it in this thread — is kept in a log you can search with the \`recall\` tool (words → the matching turns with their numbers; a turn number → that turn whole). When something you need is no longer in front of you, recall it instead of redoing the work or guessing.
+Keep notes with the \`notes\` tool: one short document, replaced whole each time, at most 8 KiB — decisions and their reasons, the names of things you found (files, tests, commits, the head your tests were green at), what is not yet proven. They are the one thing sure to survive a compaction and to reach the next run in this thread: they ride your system prompt at its start and come back to you right after a compaction. Write them when you decide something worth keeping, not only at the end.`;
+
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 
 You work inside a dedicated workspace directory with bash, read_file, and write_file tools. ${SANDBOX_TOOLCHAIN}
@@ -231,6 +239,8 @@ ${PR_DESCRIPTION_TEMPLATE}
 
 ${SHOW_FILES}
 
+${NOTEPAD}
+
 Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Clone repo and read the diff", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
 
 If the request doesn't name a repository and you can't infer it, ask for it instead of guessing.
@@ -271,6 +281,8 @@ ${PR_DESCRIPTION_TEMPLATE}
 
 ${SHOW_FILES}
 
+${NOTEPAD}
+
 Maintain the user-facing status card with the update_status tool: right after you decide your plan, post it as a checklist (○ pending items), then update it whenever an item starts (✱) or finishes (✓). Items are short outcomes ("Implement the fix", "Run the test suite"), never commands. Mark an item ✓ only after it has actually happened — never pre-mark reporting/posting steps. This is the only progress the user sees while you work.
 
 Report outcomes faithfully: if tests fail or a step was skipped, say so plainly.
@@ -333,6 +345,8 @@ REVIEW THE PR'S OWN HEAD, NOTHING ELSE: the commit you read must be the PR's hea
 
 ${REVIEW_VERDICT_INSTRUCTION}
 
+${NOTEPAD}
+
 Maintain the user-facing status card with the update_status tool: post your plan as a checklist (○ pending), update as items start (✱) and finish (✓ — only after they actually happened; never pre-mark reporting steps). Items are short outcomes, never commands.
 
 Your final message is posted to Slack. Lead with a one-line verdict, then the findings.`;
@@ -363,6 +377,8 @@ REVIEW THE PR'S OWN HEAD, NOTHING ELSE: the commit you read must be the PR's hea
 
 ${REVIEW_VERDICT_INSTRUCTION}
 
+${NOTEPAD}
+
 Maintain the user-facing status card with the update_status tool: post your plan as a checklist (○ pending), update as items start (✱) and finish (✓ — only after they actually happened; never pre-mark reporting steps). Items are short outcomes, never commands.
 
 Your final message is posted to Slack. Lead with a one-line verdict, then the findings.`;
@@ -419,8 +435,12 @@ TIME. Your budget is up to two hours — less when a boundary or the request's \
 
 READ-ONLY: NEVER open a pull request, and never commit or push — no branch, no \`gh pr create\`, no PR or issue write of any kind. You hold a read credential and your job is to find out, not to change. If the investigation shows a change is needed, say exactly what and where in your write-up and point the user at \`agent:coding\`.
 
+You cannot attach or post files: your whole answer is text. Never say a file is attached or below — name its path in the workspace and describe it (what it shows, its size) instead; a person who needs the file itself asks \`agent:coding\`, which can attach.
+
 Maintain the user-facing status card with the update_status tool: post your plan as a checklist (○ pending) once you have it, and update items as they start (✱) and finish (✓ — only after they actually happened). Items are short outcomes ("Clone and install", "Time the full suite"), never commands.
 
+${NOTEPAD}
+
 Report outcomes faithfully: a check you could not run is "could not check", never a guess. Use Slack-friendly formatting (no markdown headers; *bold*, bullets, code blocks — render the claim table as aligned rows inside a code block). Your final message is posted to Slack: lead with the overall verdict in one line, then the claim table, then what a follow-up should do.`;
 
 // The conductor (docs/reference/specs/agent-conductor.md): a run that starts

package/dist/assets/src/core/runEvents.ts

@@ -387,6 +387,12 @@ export type RunEvent =
    *  `input`, bounded (newest 20 turns / 256 KiB) and gated by
    *  `runHistory.includeContext`. */
   | { type: "context"; text: string; seq?: number; at?: number }
+  /** The agent's notes for this thread as the `notes` tool last wrote them
+   *  (docs/reference/specs/session-log.md item 10; record 0035, "The notepad"):
+   *  the whole notepad, at most `NOTEPAD_MAX_BYTES`, so the record shows what
+   *  the next run of the session starts from. Published by the tool on every
+   *  write; the record's last one is the final text. */
+  | { type: "notes"; text: string; spanId?: string; seq?: number; at?: number }
   /** The model's prose BETWEEN tool calls — text content that rode alongside
    *  tool_use in one completion. Emitted by the runner, redacted, uncapped. The
    *  final text-only completion is NOT one of these (that is the `answer`). */

package/dist/assets/src/core/runFriction.ts

@@ -38,7 +38,8 @@ export type FrictionCategory =
   | "setup_install"
   | "wrap_up"
   | "budget_hit"
-  | "infra_failure";
+  | "infra_failure"
+  | "unkept_promise";
 
 export const FRICTION_CATEGORIES: readonly FrictionCategory[] = [
   "slow_tool",
@@ -49,6 +50,7 @@ export const FRICTION_CATEGORIES: readonly FrictionCategory[] = [
   "wrap_up",
   "budget_hit",
   "infra_failure",
+  "unkept_promise",
 ];
 
 /** Human labels — the verdict line, the report's table and its finding lines. */
@@ -61,6 +63,7 @@ export const CATEGORY_LABEL: Record<FrictionCategory, string> = {
   wrap_up: "agent wind-down",
   budget_hit: "budget hits",
   infra_failure: "infra failures",
+  unkept_promise: "unkept promises",
 };
 
 /** What a category's time is a share OF: tool time for the categories whose
@@ -75,8 +78,17 @@ export const DENOMINATOR_OF: Record<FrictionCategory, "tool" | "run"> = {
   wrap_up: "run",
   budget_hit: "run",
   infra_failure: "run",
+  unkept_promise: "run",
 };
 
+/** The ways a reply tells the person a file is attached — the promise `unkept_promise` holds a run to.
+ *  One deliberate expression, case-insensitive: "attached below/here/above", "see (the) attached",
+ *  "I've/I have attached", "is/are attached", "attachment(s) (is/are) below/here". A path such as
+ *  `./attachments/1-clip.mp4` or the bare word "attachments/" names a place, not a promise, and
+ *  does not match; nor does prose about attaching in an `assistant` turn — only the `answer` counts. */
+export const ATTACHMENT_PROMISE =
+  /\b(?:attached (?:below|here|above)|see (?:the )?attached|i(?:'ve| have) attached|(?:is|are) attached\b|attachments? (?:(?:is|are) )?(?:below|here))/i;
+
 export type FrictionSeverity = "low" | "medium" | "high";
 
 export interface FrictionFinding {
@@ -193,14 +205,16 @@ interface PendingCall {
 }
 
 /** The event types that tell the run's story rather than its steps — the
- *  narrative (`input`/`context`/`assistant`/`answer`) and what the run is about. */
-type NarrativeEvent = Extract<RunEvent, { type: "input" | "context" | "assistant" | "answer" | "run_meta" }>;
+ *  narrative (`input`/`context`/`assistant`/`answer`, the `notes` the agent
+ *  kept) and what the run is about. */
+type NarrativeEvent = Extract<RunEvent, { type: "input" | "context" | "assistant" | "answer" | "notes" | "run_meta" }>;
 function isNarrative(ev: RunEvent): ev is NarrativeEvent {
   return (
     ev.type === "input" ||
     ev.type === "context" ||
     ev.type === "assistant" ||
     ev.type === "answer" ||
+    ev.type === "notes" ||
     ev.type === "run_meta"
   );
 }
@@ -380,6 +394,9 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
   let sideFactEvents = 0; // skill_use / review_artifact / pr_description / pr_opened / review_posted / ship_round / route: facts about the run, not steps
   let spanEvents = 0; // span_start / span_end (docs/reference/specs/tracing.md): timing records, not steps
   let wrapUp: { index: number; at?: number } | undefined;
+  // The reply and the files the run sent out: what `unkept_promise` compares after the loop.
+  let answer: { index: number; text: string } | undefined;
+  let outboundArtifacts = 0;
   events.forEach((ev, index) => {
     flushTurns(index);
     if (isSpanRecord(ev)) {
@@ -388,8 +405,10 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
     }
     if (isNarrative(ev)) {
       narrativeEvents++; // the narrative and `run_meta` are neither steps nor findings
+      if (ev.type === "answer") answer = { index, text: ev.text };
       return;
     }
+    if (ev.type === "artifact" && ev.direction === "out") outboundArtifacts++;
     // Side facts about the run, not steps: skill_use rides beside a use_skill
     // call that already produced its own tool pair, and artifact beside the
     // attach_file call (or the dispatcher's staging) that moved the file;
@@ -580,6 +599,24 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
       f.interval = { start: at, end: Math.max(at, windowEnd) };
     }
   }
+  // The reply promised a file the run never produced: no tool failed (a preset without
+  // attach_file makes no call), so the answer's own words are the only witness. Once per
+  // run, anchored to the answer, no extent; the line that made the promise is quoted.
+  if (answer !== undefined && outboundArtifacts === 0) {
+    const promised = ATTACHMENT_PROMISE.exec(answer.text);
+    if (promised) {
+      const line =
+        answer.text.slice(0, promised.index).split("\n").pop()! + answer.text.slice(promised.index).split("\n")[0]!;
+      const trimmed = line.trim();
+      const quoted = trimmed.length > 120 ? `…${trimmed.slice(trimmed.length - 119)}` : trimmed;
+      findings.push({
+        category: "unkept_promise",
+        severity: "low",
+        summary: `unkept promise: the reply says a file is attached but the run produced none — "${quoted}"`,
+        eventIndex: answer.index,
+      });
+    }
+  }
 
   // ---- totals ----------------------------------------------------------------
   let toolTimeMs: number | undefined;

package/dist/assets/src/core/runLedger/sessionLog.ts

@@ -62,6 +62,28 @@ export function rowKind(json: string): RowKind {
   }
 }
 
+/** Whose turn a stored row is: the role the row's JSON carries; a compaction
+ *  row or an unreadable one has none. What `recall` reports beside a hit. */
+export function roleOfStoredRow(json: string): "user" | "assistant" | undefined {
+  const stored = parseStored(json);
+  if (!stored || "compaction" in stored) return undefined;
+  const role = (stored as { role?: unknown }).role;
+  return role === "user" || role === "assistant" ? role : undefined;
+}
+
+/** The notepad's size (record 0035, "The notepad"): one document per session,
+ *  written whole, at most this many UTF-8 bytes; `notes` refuses over it naming
+ *  the size, and the object's write route does too. */
+export const NOTEPAD_MAX_BYTES = 8_192;
+
+/** The row a follow-up appends when the previous run's record says `broken`
+ *  (session-log item 9): a user text turn saying the log ends short of what
+ *  that run saw. Named here so the object can tell a gap row apart for
+ *  `recall`, which says when a search straddles one. */
+export const GAP_MARKER =
+  "[The log of this conversation ends short of what the previous run saw: its connection to the ledger broke, " +
+  "so its later turns and its final reply are not here.]";
+
 const textOfResultContent = (content: unknown): string => {
   if (typeof content === "string") return content;
   if (!Array.isArray(content)) return "";

package/dist/assets/src/core/runLedger/types.ts

@@ -206,6 +206,23 @@ export interface TranscriptRow {
   json: string;
 }
 
+/** One hit of a session log's full-text search (session-log item 10): the
+ *  row's turn and part, whose turn it is, what kind of row (`rowKind`), and
+ *  the text the index held for it. */
+export interface SessionHit {
+  idx: number;
+  part: number;
+  role?: "user" | "assistant";
+  kind: string;
+  text: string;
+}
+
+/** A session's notepad (record 0035, "The notepad"): the text and when it was last written. */
+export interface Notepad {
+  text: string;
+  updatedAt: number;
+}
+
 /** An externalized attachment: base64 data stored once, referenced from a row. */
 export interface TranscriptAttachment {
   ref: string;

package/dist/assets/src/mcp/registry.ts

@@ -15,13 +15,19 @@ export type McpAuthKind = "none" | "bearer" | "oauth";
 
 /** One server as a scope carries it. `tokenEnv` is the static-config way to
  *  supply a bearer (an env var on the bot); without it a bearer server's token
- *  is the sealed credential the connect page stored. */
+ *  is the sealed credential the connect page stored. `headersEnv` is the
+ *  static-config way to supply any other request header — header name → the
+ *  bot env var holding its value — for a server behind a gate that is not the
+ *  server's own auth (a Cloudflare Access service token: `CF-Access-Client-Id`
+ *  + `CF-Access-Client-Secret`). It composes with every `auth` kind; the
+ *  Authorization header itself is `auth`'s and is refused here. */
 export interface McpServerEntry {
   url: string;
   /** Agents whose runs may see it (default general + research). */
   agents?: string[];
   auth: McpAuthKind;
   tokenEnv?: string;
+  headersEnv?: Record<string, string>;
   /** Who added it at run time (`slack:U…`, `cli:local`); absent for static config. */
   addedBy?: string;
   addedAt?: number;
@@ -126,6 +132,24 @@ export const MCP_SERVERS_PER_SCOPE_MAX = 32;
 const isStr = (v: unknown, max = 4_096): v is string => typeof v === "string" && v.length > 0 && v.length <= max;
 const isNum = (v: unknown): v is number => typeof v === "number" && Number.isFinite(v);
 
+/** At most this many `headersEnv` entries on one server. */
+export const MCP_HEADERS_MAX = 8;
+/** An HTTP header field name (RFC 9110 token), ≤ 64 chars. */
+export const MCP_HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,64}$/;
+
+/** Shape only: a non-empty mapping of header name → env var name, each a
+ *  string (the config layer holds names to `MCP_HEADER_NAME_RE` and refuses
+ *  Authorization). */
+function isHeadersEnv(v: unknown): v is Record<string, string> {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return false;
+  const entries = Object.entries(v as Record<string, unknown>);
+  return (
+    entries.length > 0 &&
+    entries.length <= MCP_HEADERS_MAX &&
+    entries.every(([name, envVar]) => isStr(name, 64) && isStr(envVar, 128))
+  );
+}
+
 function isOutcome(v: unknown): v is NonNullable<McpTicket["outcome"]> {
   if (!v || typeof v !== "object" || Array.isArray(v)) return false;
   const o = v as Record<string, unknown>;
@@ -148,6 +172,7 @@ export function isMcpServerEntry(v: unknown): v is McpServerEntry {
         e.agents.every((a) => isStr(a, 32)))) &&
     (e.auth === "none" || e.auth === "bearer" || e.auth === "oauth") &&
     (e.tokenEnv === undefined || isStr(e.tokenEnv, 128)) &&
+    (e.headersEnv === undefined || isHeadersEnv(e.headersEnv)) &&
     (e.addedBy === undefined || isStr(e.addedBy, 260)) &&
     (e.addedAt === undefined || isNum(e.addedAt))
   );
@@ -194,9 +219,10 @@ export interface McpServerView {
   url: string;
   agents: string[];
   auth: McpAuthKind;
-  /** `static` = bearer from `tokenEnv` on the bot; `connected` = a sealed
-   *  credential is stored (or no credential is needed); `awaiting_credential`
-   *  = bearer, nothing stored yet. */
+  /** `static` = the credential is the bot's environment (`tokenEnv`, or
+   *  `headersEnv` on an `auth: none` server); `connected` = a sealed credential
+   *  is stored (or no credential is needed); `awaiting_credential` = bearer,
+   *  nothing stored yet. */
   state: "connected" | "awaiting_credential" | "static";
   source: "config" | "runtime";
   addedBy?: string;
@@ -212,7 +238,9 @@ export function serverView(
   const parsed = parseMcpScopeKey(scopeKey);
   const state: McpServerView["state"] =
     entry.auth === "none"
-      ? "connected"
+      ? entry.headersEnv
+        ? "static"
+        : "connected"
       : entry.tokenEnv
         ? "static"
         : opts.hasCredential