@coreplane/switchboard 1.239.0 → 1.240.0

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.239.0",
+  "version": "1.240.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.239.0",
+      "version": "1.240.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -34,6 +34,7 @@
       "devDependencies": {
         "@earendil-works/pi-coding-agent": "0.85.1",
         "@eslint/js": "^10.0.1",
+        "@opencode/cli": "^2.0.3",
         "@opencode/protocol": "2.0.3",
         "@opencode/schema": "2.0.3",
         "@types/node": "^24.0.0",
@@ -6242,6 +6243,209 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@opencode/cli": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli/-/cli-2.0.3.tgz",
+      "integrity": "sha512-FC4+2a5kwdKS2o/pIcGCscpSQB7PuhBObwGMfqnx/2XtoaZBMtSq/99nuEdeDNAFvy1qyK6mp2hwvoiMWsiI4w==",
+      "cpu": [
+        "arm64",
+        "x64"
+      ],
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "os": [
+        "darwin",
+        "linux",
+        "win32"
+      ],
+      "bin": {
+        "opencode": "bin/opencode.exe",
+        "opencode2": "bin/opencode.exe"
+      },
+      "optionalDependencies": {
+        "@opencode/cli-darwin-arm64": "2.0.3",
+        "@opencode/cli-darwin-x64": "2.0.3",
+        "@opencode/cli-darwin-x64-baseline": "2.0.3",
+        "@opencode/cli-linux-arm64": "2.0.3",
+        "@opencode/cli-linux-arm64-musl": "2.0.3",
+        "@opencode/cli-linux-x64": "2.0.3",
+        "@opencode/cli-linux-x64-baseline": "2.0.3",
+        "@opencode/cli-linux-x64-baseline-musl": "2.0.3",
+        "@opencode/cli-linux-x64-musl": "2.0.3",
+        "@opencode/cli-windows-arm64": "2.0.3",
+        "@opencode/cli-windows-x64": "2.0.3",
+        "@opencode/cli-windows-x64-baseline": "2.0.3"
+      }
+    },
+    "node_modules/@opencode/cli-darwin-arm64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-darwin-arm64/-/cli-darwin-arm64-2.0.3.tgz",
+      "integrity": "sha512-2JzNaHmMHUCk2uLXo2kCKCs81KOzErt7V7ypFFp5hUCIXRPjt9D7C5CKsz2GKWfpHRivUKILKrfUS9MpYzfq6A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@opencode/cli-darwin-x64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-darwin-x64/-/cli-darwin-x64-2.0.3.tgz",
+      "integrity": "sha512-dMAH/N5KD10Wlct2BbCa8tEV6SiPgBg1kF9Ud7N7ZUctMEeGoz3fqZTrcGrQz7yoAkyyHhGgq+gmxqobwrAhhg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@opencode/cli-darwin-x64-baseline": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-darwin-x64-baseline/-/cli-darwin-x64-baseline-2.0.3.tgz",
+      "integrity": "sha512-sm9ZjG2KOk/v4ht6WHAo+pAeOfxnnImwT5rFWNIn15fVlXncbWH2QmKWDC3Nf/h7vpgeghZ1UBbBmo8fP3lBCA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-arm64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-arm64/-/cli-linux-arm64-2.0.3.tgz",
+      "integrity": "sha512-q3QhCIW5CxkmJjzKI6GXJ89M0OF9lOsi1e3e4YTvQL6Htv0S7eHyZ+3Wg0UYQaoYqegAf3vBoYiPR3Z9ieIVrQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-arm64-musl": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.0.3.tgz",
+      "integrity": "sha512-cif0oXReK/lVZ9kFplNc3XTNM3uuAKLIgcfcEIVMbjTivLzdHe0O5Dp8y7rakJOdXqQ5yM1k6oP8kP2rfpitxg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-x64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-x64/-/cli-linux-x64-2.0.3.tgz",
+      "integrity": "sha512-H8m5m4g1Z/zkx1O8+pos7euLYpY/zgc5NTdUbZZ7Dh8xQ35qoHCnJjt9H8Y1hnpm4ClNKDVHmEISw/qPiskX5A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-x64-baseline": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-x64-baseline/-/cli-linux-x64-baseline-2.0.3.tgz",
+      "integrity": "sha512-14CFor+PFx7tPAFOB3uEcg2EOQZNB1gK4uit4p8gfN30FK7kwNHBjs/m79QGICPMjwZrCOVdZ3ZiI+AgbjanjA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-x64-baseline-musl": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-x64-baseline-musl/-/cli-linux-x64-baseline-musl-2.0.3.tgz",
+      "integrity": "sha512-AYMNzjwPU63FjqjKLEm61s2tBL7+yipt/lzn+2eMpPHYGggV2urJH9TEME2+mReENeYFfOSItPR7gWLX1p2g5A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-linux-x64-musl": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-linux-x64-musl/-/cli-linux-x64-musl-2.0.3.tgz",
+      "integrity": "sha512-YDZCk0MddTJ8lDwlEmE5bVWF5R13nDpLEQPcCA5IY2njB/y2g6UaAiIVbJE1rVmFd7/Z7JmyB2X3z60uk3C/dA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@opencode/cli-windows-arm64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-windows-arm64/-/cli-windows-arm64-2.0.3.tgz",
+      "integrity": "sha512-WQuojS+6O6YNlRsal9kbePiEEv4hZHVL7l7ILRnlyZSLx7M2ynTOUahtGzC42AbdH9sdIa4OGQDmDwcbfCqHuA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@opencode/cli-windows-x64": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-windows-x64/-/cli-windows-x64-2.0.3.tgz",
+      "integrity": "sha512-4pCiryt3LZG4dCkhvDOiTttzBECE36HUKe5uwCSAu9Ny7Sh2H1iVw1XFKo3QYqh6XdkWa9Uyza0lqLB6SSAGTw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@opencode/cli-windows-x64-baseline": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@opencode/cli-windows-x64-baseline/-/cli-windows-x64-baseline-2.0.3.tgz",
+      "integrity": "sha512-9R6QdvoEd6bxv+Izi2kwg+85Mc3lCoTRgAsTZpNadVaRgAcU8vzEjjgrzFM6gLr8j+65EgG7vtP1gCVhfyQRwg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
     "node_modules/@opencode/protocol": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/@opencode/protocol/-/protocol-2.0.3.tgz",
@@ -20241,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.239.0",
+      "version": "1.240.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.239.0",
+  "version": "1.240.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
@@ -91,6 +91,7 @@
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "0.85.1",
     "@eslint/js": "^10.0.1",
+    "@opencode/cli": "^2.0.3",
     "@opencode/protocol": "2.0.3",
     "@opencode/schema": "2.0.3",
     "@types/node": "^24.0.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.239.0",
-  "commit": "f8a99fe783b535df45b729baf09bf69557962c3a",
-  "builtAt": "2026-09-16T23:24:01.904Z"
+  "version": "1.240.0",
+  "commit": "dd69a6edcfaa523c998ff1059f47b8ef1675ebe9",
+  "builtAt": "2026-09-17T00:22:24.645Z"
 }

package/dist/assets/src/core/authz/actor.ts

@@ -76,6 +76,24 @@ export function resolveActor(input: ActorInput, grantsFor: GrantsLookup): Actor
   return { kind: kindFor(input.surface), id, grants: grantsFor(id), ...(origin ? { origin } : {}) };
 }
 
+/** The identity fields a bound credential's message carries (`IncomingMessage`). */
+interface BoundFields {
+  /** The credential's actor id when the sender is the person it is bound to. */
+  authenticatedAs?: string;
+  userName?: string;
+}
+
+/** The actor id whose grants govern a chat message: the credential that
+ *  authenticated it when it was bound to a person (`authenticatedAs`), else
+ *  the sender. Every `canRunAgent` / `canUseRepo` / `canManageRepos` /
+ *  `canEditChannelConfig` question in the dispatch path asks about THIS id,
+ *  never `msg.userId`: naming the person on a run must not lend the run the
+ *  person's grants (authorization.md item 15). A relayed message (`postedBy`)
+ *  is out of scope here — its gates are item 14's. */
+export function grantsSubject(msg: { userId: string; authenticatedAs?: string }): string {
+  return msg.authenticatedAs ?? msg.userId;
+}
+
 const CHAT_SURFACES: Readonly<Record<string, ActorSurface>> = {
   slack: "slack",
   http: "http",
@@ -89,11 +107,24 @@ const CHAT_SURFACES: Readonly<Record<string, ActorSurface>> = {
  *  A namespace this module does not know stays a `user` with the id as given —
  *  its grants are whatever config names for that id, never a guess. */
 export function resolveChatActor(
-  msg: { userId: string; channelId: string; threadKey: string; postedBy?: string },
+  msg: { userId: string; channelId: string; threadKey: string; postedBy?: string } & BoundFields,
   grantsFor: GrantsLookup,
 ): Actor {
   const person = resolveNamespacedActor(msg.userId, msg, grantsFor);
-  if (msg.postedBy === undefined) return person;
+  if (msg.postedBy === undefined) {
+    if (msg.authenticatedAs === undefined || msg.authenticatedAs === msg.userId) return person;
+    // A credential bound to a person (authorization.md item 15): the adapter
+    // proved the credential and config bound it to the person, so the actor IS
+    // the credential — its kind, its id, its grants, exactly as an unbound
+    // token's — and the person is its `self` and `asUser`, the same
+    // identity-not-authority link a dashboard session carries (record 0042).
+    const credential = resolveNamespacedActor(msg.authenticatedAs, msg, grantsFor);
+    return {
+      ...credential,
+      self: [credential.id, msg.userId],
+      asUser: { id: msg.userId, ...(msg.userName !== undefined ? { name: msg.userName } : {}) },
+    };
+  }
   // A request an app posted for a person (slack-channel.md item 13): the
   // message text named the person, and text is forgeable, so the person's
   // grants alone must never govern. The actor is the app, acting on the

package/dist/assets/src/core/authz/policy.ts

@@ -81,6 +81,12 @@ export const POLICY: readonly Rule[] = [
   // `friction propose` files issues: the repo-management gate, now the `friction:write` grant.
   { action: "friction:write", resource: "command", when: [grant("friction:write")] },
 
+  // ── costs ────────────────────────────────────────────────────────────────
+  // `costs snapshot` reads both billing providers and replaces what every
+  // viewer of the costs page sees: the grant, never a baseline (the admins'
+  // `all` and a named `grants` entry hold it).
+  { action: "costs:write", resource: "command", when: [grant("costs:write")] },
+
   // ── repos ────────────────────────────────────────────────────────────────
   { action: "repo:read", resource: "command", when: [grant("repo:read")] },
   { action: "repo:write", resource: "repo", when: [grant("repo:write")] },

package/dist/assets/src/core/coordinator/contract.ts

@@ -8,6 +8,8 @@
 // parent record the spawn route reads the requester from, and the names the
 // routes decide on.
 //
+import type { AddressSeverity, AddressSeveritySource } from "../ship/coordinator.js";
+
 // A coordinator is a Workflow instance in the shim Worker whose children are
 // ordinary `dispatch()` runs as the requesting user. It holds no credential of
 // its own: every step is a call into the bot with the `coordinator` bearer,
@@ -126,9 +128,12 @@ export function coordinatorFields(tag: CoordinatorTag | undefined): {
 export interface CoordinatorInstance {
   id: string;
   kind: "ship";
-  /** The requesting user (platform-namespaced), whose grants every child is authorized under. */
+  /** The requesting person (platform-namespaced); every child is dispatched as them. */
   userId: string;
   userName?: string;
+  /** The bound credential behind the person (authorization.md item 15), when
+   *  there was one: every child is authorized under ITS grants, as the request was. */
+  authenticatedAs?: string;
   channelId: string;
   channelName?: string;
   /** The requesting thread: where the card lives and where a generated plan's
@@ -153,6 +158,11 @@ export interface CoordinatorInstance {
    *  hand-off, answered by the plan route, checked at the merge door; absent
    *  (a record written before the field existed) reads as `person`. */
   merge?: "runner" | "person";
+  /** The severity to address: resolved once by the hand-off
+   *  (directive > user > channel > org) and written here beside `merge`, so
+   *  the machine reads one value; absent reads as the default (`minor`, org). */
+  addressSeverity?: AddressSeverity;
+  addressSeveritySource?: AddressSeveritySource;
   /** The pipeline's caps as the profile gate clipped them: the rounds cap and the wall clock per unit. */
   caps?: { maxRounds: number; maxMinutes: number };
   /** The status card in the requesting thread, when the channel has one — what
@@ -234,6 +244,7 @@ export function isCoordinatorInstance(v: unknown): v is CoordinatorInstance {
   if (r.kind !== "ship") return false;
   if (!isText(r.userId) || !isText(r.channelId) || !isText(r.threadKey)) return false;
   if (!isOptionalText(r.userName) || !isOptionalText(r.channelName) || !isOptionalText(r.sourceUrl)) return false;
+  if (!isOptionalText(r.authenticatedAs)) return false;
   if (typeof r.repo !== "string" || !REPO_SLUG.test(r.repo)) return false;
   if (!isText(r.branch) || !isOptionalText(r.base)) return false;
   if (!isFinite(r.createdAt)) return false;

package/dist/assets/src/core/coordinator/driver.ts

@@ -46,6 +46,9 @@ import {
   type ChildFacts,
   type MergeReadyFacts,
   type CoordinatorAction,
+  isAddressSeverity,
+  type AddressSeverity,
+  type AddressSeveritySource,
   type PlanGraph,
   type PlanUnitNode,
   type ShipCaps,
@@ -159,6 +162,9 @@ interface PlanFacts {
   planId?: string;
   /** Who merges, as the instance's field has it: the plan route answers it, `person` when absent. */
   merge: "runner" | "person";
+  /** The severity to address, beside `merge`: the level an approve's findings are held to, and which layer set it. */
+  addressSeverity: AddressSeverity;
+  addressSeveritySource: AddressSeveritySource;
   /** The instance's mark as the plan route answers it: a generated one-unit plan (a `plan` with no `path`). */
   generated: boolean;
   repo: string;
@@ -189,6 +195,11 @@ function readPlan(a: BotAnswer): PlanFacts {
   return {
     ...(typeof b.planId === "string" ? { planId: b.planId } : {}),
     merge: b.merge === "runner" ? "runner" : "person",
+    addressSeverity: isAddressSeverity(b.addressSeverity) ? b.addressSeverity : "minor",
+    addressSeveritySource:
+      b.addressSeveritySource === "run" || b.addressSeveritySource === "user" || b.addressSeveritySource === "channel"
+        ? b.addressSeveritySource
+        : "org",
     generated: b.generated === true,
     repo: b.repo,
     base: b.base,
@@ -465,6 +476,8 @@ async function runUnit(
       // seeded plan and `person` on a task, and the door re-checks it — the
       // branch's name never decides.
       merge: plan.merge,
+      addressSeverity: plan.addressSeverity,
+      addressSeveritySource: plan.addressSeveritySource,
       generated: plan.generated,
       ...(resume !== undefined ? { resume } : {}),
       ...(lastPush !== undefined ? { lastPush } : {}),