dsh-switchman 1.11.6 → 1.11.7

package/host/context-trim/state.js

@@ -523,8 +523,9 @@ export function ledgerFoldedTokens(messages, ledger) {
 }
 
 /** Ladder census of one ledger: the ACTIVE tier-1 and tier-2 populations
- * (id + summary mass estimate + approxTokens) the trigger and the ladder
- * ship pass read. Pure; never throws. */
+ * (id + summary mass estimate + approxTokens). Test/inspection helper —
+ * NOT read by the trigger: production uses index.js ladderRunsOf, which
+ * also collects tier-3 runs for T3 planning. Pure; never throws. */
 export function ladderCensusOf(ledger, countTokens = null) {
 	const estimate = typeof countTokens === "function"
 		? countTokens

package/host/context-trim/surface.js

@@ -1334,7 +1334,11 @@ export function createSurfaceFoldPass(deps = {}) {
 				const sessionId = sessionIdOfAgent(payload?.agent);
 				if (sessionId === null) return;
 				const hint = payload?.agent !== null && typeof payload?.agent === "object" ? payload.agent.session : null;
-				void sweep(sessionId, "turn-stopping", hint);
+				void sweep(sessionId, "turn-stopping", hint).catch(() => {
+					/* sweep is fire-and-forget on this boundary; a rejection must not
+					   surface as an unhandledRejection (the listener's own try only
+					   covers synchronous throws — async rejects bypass it). */
+				});
 			} catch {
 				/* listener must never throw */
 			}

package/host/context-watch.js

@@ -136,8 +136,8 @@ function isRoot(ctx, agent) {
 function readThresholds(config) {
 	return {
 		soft: readNumber(config.wmSoftTokens, 80000),
-		hard: readNumber(config.wmHardTokens, 95000),
-		force: readNumber(config.wmForceTokens, 150000),
+		hard: readNumber(config.wmHardTokens, 100000),
+		force: readNumber(config.wmForceTokens, 200000),
 	};
 }
 
@@ -154,8 +154,9 @@ export function measureNow(ctx, agent) {
 		// longer receives — high bias), while the bare view never counts the
 		// system/tool sections (low bias). max(view, wire) fixes both and puts
 		// the watermark tiers (soft/hard/force + read budget) on the SAME
-		// boundary as the fold engine — wmHardTokens 95k ≈ trim pressure
-		// 97.5k (65% of the 150k window) — holds in units, not just in
+		// boundary as the fold engine — wmHardTokens 100k = trimAdvisoryPercent
+		// 50% × the 200k cap, and wmForceTokens 200k = the cap itself — holds
+		// in units, not just in
 		// numbers. Strictly additive +
 		// fail-open: any trim failure falls back to the stored measure.
 		try {
@@ -207,7 +208,11 @@ const PAUSED_LINE =
 function renderRootWatermark(level, status) {
 	if (level === "ok") return "";
 	if (level === "soft") return "[SWITCHMAN:WATERMARK] soft tier: prefer delegating lightweight work (subagent/workflow) over reading more context yourself.";
-	if (level === "hard") return "[SWITCHMAN:WATERMARK] hard tier: stop broad reading (read/glob/grep are budget-limited this turn) and start wrapping up.";
+	if (level === "hard")
+		return (
+			"[SWITCHMAN:WATERMARK] hard tier: stop broad reading (read/glob/grep are budget-limited this turn) and start wrapping up. " +
+			"If a fold or handover was committed within the last turn, this tier may reflect pre-fold pressure — the next turn carries the reduced history; do not re-verify with broad reads."
+		);
 	const lines = ["[SWITCHMAN:WATERMARK] force tier: MANDATORY wrap-up now — produce the final answer from what you already hold."];
 	const phase = status?.phase;
 	if (phase === "backup") {
@@ -904,7 +909,7 @@ function applyContextWatch(ctx, config) {
 			if (sessionId !== null && ACCOUNT_TOOLS.has(exec?.name ?? "")) {
 				const entry = accountRead(state, sessionId, resultTokens(result));
 				if (GATED_TOOLS.has(exec.name) && !state.paused.has(sessionId)) {
-					const budget = readNumber(config.wmReadBudgetTokens, 3000);
+					const budget = readNumber(config.wmReadBudgetTokens, 3500);
 					const ceiling = budget * CEILING_MULTIPLE;
 					const used = measureNow(ctx, exec.agent);
 					const th = readThresholds(config);
@@ -950,7 +955,7 @@ function applyContextWatch(ctx, config) {
 			if (!GATED_TOOLS.has(exec?.name ?? "")) return next();
 			const sessionId = sessionIdOf(exec?.agent);
 			if (sessionId === null || state.paused.has(sessionId)) return next();
-			const budget = readNumber(config.wmReadBudgetTokens, 3000);
+			const budget = readNumber(config.wmReadBudgetTokens, 3500);
 			if (turnUsed(state, sessionId) < budget * CEILING_MULTIPLE) return next();
 			const used = measureNow(ctx, exec.agent);
 			if (used === null) return next();

package/host/intent.js

@@ -144,9 +144,9 @@ function routeOf(value) {
  *  handover off the user's raw window is respected as-is — they opted out
  *  of the handover pipeline, so the 0.8 line may sit wherever they put it. */
 export function effectiveContextWindow(config) {
-	const user = Math.max(1024, Math.round(readNumber(config.intentContextWindow, 200000)));
+	const user = Math.max(1024, Math.round(readNumber(config.intentContextWindow, 250000)));
 	if (!readBool(config.wmAutoHandover)) return user;
-	const floor = Math.ceil(readNumber(config.wmForceTokens, 150000) / 0.8);
+	const floor = Math.ceil(readNumber(config.wmForceTokens, 200000) / 0.8);
 	return Math.max(user, floor);
 }
 
@@ -553,6 +553,38 @@ async function classifyOnce(ctx, config, route, system, input, turnSignal) {
 	}
 }
 
+/** Whether a classifier endpoint URL may receive conversation excerpts.
+ *  The systemone channel is meant for a LOCAL/LAN decision endpoint
+ *  (ollama); an arbitrary URL would turn the setting into an
+ *  exfiltration channel — any settings writer could aim the per-turn
+ *  excerpt (recent conversation text) at a public server. Allowed:
+ *  http/https URLs whose host is loopback (localhost, 127/8, ::1) or
+ *  private-network (RFC1918 10/8, 172.16/12, 192.168/16, link-local
+ *  169.254/16, fe80::/10, unique-local fc00::/7). Everything else is
+ *  rejected before any byte leaves the process; the classifier then
+ *  fails open to the fallback chain. Exported for tests. */
+export function isAllowedClassifierEndpoint(endpoint) {
+	if (typeof endpoint !== "string") return false;
+	let url;
+	try {
+		url = new URL(endpoint.trim());
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	const host = url.hostname.toLowerCase().replace(/^\[|\]$/gu, "");
+	if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) return true;
+	const parts = host.split(".");
+	if (parts.length === 4 && parts.every((p) => /^\d{1,3}$/u.test(p))) {
+		const octets = parts.map(Number);
+		if (octets.some((n) => n > 255)) return false;
+		const [a, b] = octets;
+		return a === 127 || a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254);
+	}
+	// IPv6 (brackets stripped): loopback, link-local fe80::/10, unique-local fc00::/7.
+	return host === "::1" || host.startsWith("fe80:") || /^[fF][cCdD][0-9a-fA-F]{2}:/.test(host);
+}
+
 /**
  * Classify via an ollama /v1/systemone decision endpoint (direct HTTP —
  * no llm-service provider registration needed; the model name comes from
@@ -567,6 +599,8 @@ async function classifyOnce(ctx, config, route, system, input, turnSignal) {
 export async function classifySystemone(ctx, config, candidates, current, excerpt, turnSignal) {
 	const endpoint = readField(config.intentClassifierEndpoint).trim();
 	if (endpoint === "") throw new Error("systemone endpoint unset (intentClassifierEndpoint)");
+	if (!isAllowedClassifierEndpoint(endpoint))
+		throw new Error(`systemone endpoint refused (loopback/private URLs only): ${endpoint}`);
 	const model = readField(config.intentClassifierSystemoneModel).trim();
 	if (model === "") throw new Error("systemone model unset (intentClassifierSystemoneModel)");
 	if (candidates.length === 0) throw new Error("no candidates");
@@ -603,6 +637,9 @@ export async function classifySystemone(ctx, config, candidates, current, excerp
 	const signal = turnSignal instanceof AbortSignal ? AbortSignal.any([controller.signal, turnSignal]) : controller.signal;
 	try {
 		signal.throwIfAborted();
+		// Auditable egress record: the classifier ships a conversation excerpt
+		// off-process — every send is logged with the destination host.
+		ctx?.logger?.info?.(`dsh-switchman: intent systemone classifier POST ${new URL(endpoint).host} (excerpt ~${excerpt.length} chars)`);
 		const response = await fetch(endpoint, {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
@@ -766,7 +803,7 @@ export async function intentStateOf(ctx, config, sessionId = null) {
 			}
 		}
 	}
-	const forceTokens = readNumber(config.wmForceTokens, 150000);
+	const forceTokens = readNumber(config.wmForceTokens, 200000);
 	return {
 		enabled,
 		autoSelected: selection?.provider === AUTO_PROVIDER,
@@ -774,7 +811,7 @@ export async function intentStateOf(ctx, config, sessionId = null) {
 		// catalog route must not mark the feature unconfigured.
 		configured:
 			(kind === "systemone"
-				? readField(config.intentClassifierEndpoint).trim() !== "" &&
+				? isAllowedClassifierEndpoint(readField(config.intentClassifierEndpoint).trim()) &&
 					readField(config.intentClassifierSystemoneModel).trim() !== ""
 				: classifier !== null) &&
 			candidates.length > 0,

package/host/lang.js

@@ -55,10 +55,12 @@ const PROJECT_FILE = "lang.json";
 /** How long a cached settings-describe locale stays fresh (ms). */
 const LOCALE_CACHE_MS = 10_000;
 
-/** Normalize one language value: trim and bound the length; anything else → null. */
+/** Normalize one language value: trim, collapse internal whitespace (newlines
+ *  would break the single-line [SWITCHMAN:LANG] anchor and could smuggle extra
+ *  protocol lines into the system prompt), bound the length; anything else → null. */
 function normalizeLangValue(value) {
 	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
+	const trimmed = value.trim().replace(/\s+/gu, " ");
 	if (trimmed.length === 0 || trimmed.length > MAX_LANG_LEN) return null;
 	return trimmed;
 }