switchroom 0.14.57 → 0.14.59

package/dist/agent-scheduler/index.js

@@ -11144,7 +11144,7 @@ var GoogleWorkspaceConfigSchema = exports_external.object({
   tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet — see RFC G §5).")
 }).optional();
 var MicrosoftWorkspaceConfigSchema = exports_external.object({
-  microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+  microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
   microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional — public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
   authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
   org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC §6.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false — personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")

package/dist/auth-broker/index.js

@@ -11144,7 +11144,7 @@ var GoogleWorkspaceConfigSchema = exports_external.object({
   tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet — see RFC G §5).")
 }).optional();
 var MicrosoftWorkspaceConfigSchema = exports_external.object({
-  microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+  microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
   microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional — public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
   authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
   org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC §6.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false — personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")
@@ -12954,6 +12954,19 @@ function classifyAsyncError2(err) {
   return { ok: false, kind: "provider_error", detail: msg };
 }
 
+// src/auth/default-oauth-clients.ts
+var DEFAULT_MICROSOFT_CLIENT_ID = "9dff88fa-3126-457b-9d1d-37e58c219019";
+function resolveMicrosoftClientId(configClientId) {
+  const env = process.env.SWITCHROOM_MICROSOFT_CLIENT_ID;
+  if (env !== undefined && env.trim().length > 0) {
+    return { clientId: env.trim(), source: "env" };
+  }
+  if (configClientId !== undefined && configClientId.length > 0) {
+    return { clientId: configClientId, source: "config" };
+  }
+  return { clientId: DEFAULT_MICROSOFT_CLIENT_ID, source: "default" };
+}
+
 // src/auth/broker/google-storage.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync2, readdirSync as readdirSync3, readFileSync as readFileSync4, rmSync as rmSync3, statSync as statSync3 } from "node:fs";
 import { dirname, join as join2, resolve as resolve5 } from "node:path";
@@ -13503,14 +13516,11 @@ class AuthBroker {
         fetcher: opts.fetcher
       }));
     }
-    const microsoftClientId = config.microsoft_workspace?.microsoft_client_id;
-    if (microsoftClientId !== undefined) {
-      this.providers.register(new MicrosoftProvider({
-        clientId: microsoftClientId,
-        clientSecret: config.microsoft_workspace?.microsoft_client_secret,
-        fetcher: opts.fetcher
-      }));
-    }
+    this.providers.register(new MicrosoftProvider({
+      clientId: resolveMicrosoftClientId(config.microsoft_workspace?.microsoft_client_id).clientId,
+      clientSecret: config.microsoft_workspace?.microsoft_client_secret,
+      fetcher: opts.fetcher
+    }));
     this.assertConfigConsistent(config);
   }
   homeRoot() {

package/dist/cli/notion-write-pretool.mjs

@@ -11892,7 +11892,7 @@ var GoogleWorkspaceConfigSchema = exports_external.object({
   tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet \u2014 see RFC G \u00a75).")
 }).optional();
 var MicrosoftWorkspaceConfigSchema = exports_external.object({
-  microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+  microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL \u2014 omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
   microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional \u2014 public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
   authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
   org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC \u00a76.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false \u2014 personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")

package/dist/cli/switchroom.js

@@ -13708,7 +13708,7 @@ var init_schema = __esm(() => {
     tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet \u2014 see RFC G \u00a75).")
   }).optional();
   MicrosoftWorkspaceConfigSchema = exports_external.object({
-    microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+    microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL \u2014 omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
     microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional \u2014 public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
     authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
     org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC \u00a76.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false \u2014 personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")
@@ -30156,23 +30156,12 @@ function checkOAuthClient2(config, anyAgentEnabled) {
   if (!anyAgentEnabled)
     return [];
   const mw = config.microsoft_workspace;
-  if (!mw) {
+  if (!mw || !clientValuePresent2(mw.microsoft_client_id)) {
     return [
       {
         name: "microsoft:oauth-client-configured",
-        status: "fail",
-        detail: "agents have microsoft_workspace.account set but the top-level microsoft_workspace: block is missing",
-        fix: "Add a microsoft_workspace block with microsoft_client_id (and optionally microsoft_client_secret) to switchroom.yaml. See `switchroom auth microsoft account add` error output for the full walkthrough."
-      }
-    ];
-  }
-  if (!clientValuePresent2(mw.microsoft_client_id)) {
-    return [
-      {
-        name: "microsoft:oauth-client-configured",
-        status: "fail",
-        detail: "microsoft_workspace block present but microsoft_client_id is empty",
-        fix: "Register an Entra app at https://entra.microsoft.com \u2192 App registrations \u2192 New. Copy the Application (client) ID and vault it: `switchroom vault set microsoft-oauth-client-id`."
+        status: "ok",
+        detail: "using switchroom's shipped default Microsoft OAuth app (no BYO app configured)"
       }
     ];
   }
@@ -49463,8 +49452,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.57";
-var COMMIT_SHA = "ddb0b353";
+var VERSION = "0.14.59";
+var COMMIT_SHA = "178c6d14";
 
 // src/cli/agent.ts
 init_source();
@@ -57729,6 +57718,21 @@ function pruneEmptyMap(doc, path) {
 
 // src/cli/auth-microsoft.ts
 init_helpers();
+
+// src/auth/default-oauth-clients.ts
+var DEFAULT_MICROSOFT_CLIENT_ID = "9dff88fa-3126-457b-9d1d-37e58c219019";
+function resolveMicrosoftClientId(configClientId) {
+  const env2 = process.env.SWITCHROOM_MICROSOFT_CLIENT_ID;
+  if (env2 !== undefined && env2.trim().length > 0) {
+    return { clientId: env2.trim(), source: "env" };
+  }
+  if (configClientId !== undefined && configClientId.length > 0) {
+    return { clientId: configClientId, source: "config" };
+  }
+  return { clientId: DEFAULT_MICROSOFT_CLIENT_ID, source: "default" };
+}
+
+// src/cli/auth-microsoft.ts
 function registerAuthMicrosoftSubcommands(program3, authParent) {
   const microsoft = authParent.command("microsoft").description("Manage Microsoft 365 accounts shared across agents (RFC #1873 \u2014 see docs/rfcs/microsoft-workspace.md)");
   registerEnable2(microsoft, program3);
@@ -57871,13 +57875,13 @@ function registerAccountAdd2(accountParent) {
     ]);
     const config = loadConfig2();
     const mw = config.microsoft_workspace;
-    if (!mw) {
-      throw new Error(microsoftClientSetupGuidance("switchroom.yaml has no `microsoft_workspace:` block, so there is no Microsoft OAuth app to connect accounts against."));
-    }
-    let clientIdRaw = process.env.SWITCHROOM_MICROSOFT_CLIENT_ID ?? mw.microsoft_client_id;
-    let clientSecretRaw = process.env.SWITCHROOM_MICROSOFT_CLIENT_SECRET ?? mw.microsoft_client_secret;
-    if (!clientIdRaw) {
-      throw new Error(microsoftClientSetupGuidance("The `microsoft_workspace:` block is present but `microsoft_client_id` is empty."));
+    const resolvedClientId = resolveMicrosoftClientId(mw?.microsoft_client_id);
+    let clientIdRaw = resolvedClientId.clientId;
+    let clientSecretRaw = process.env.SWITCHROOM_MICROSOFT_CLIENT_SECRET ?? mw?.microsoft_client_secret;
+    if (resolvedClientId.source === "default") {
+      console.error(source_default.gray(`  Using switchroom's shipped Microsoft OAuth app (zero-config).
+` + "  To use your own Entra app instead, set " + `microsoft_workspace.microsoft_client_id in switchroom.yaml
+` + "  (or the SWITCHROOM_MICROSOFT_CLIENT_ID env var)."));
     }
     const needsVault = isVaultReference2(clientIdRaw) || clientSecretRaw !== undefined && isVaultReference2(clientSecretRaw);
     if (needsVault) {
@@ -57928,7 +57932,7 @@ function registerAccountAdd2(accountParent) {
         clientSecretRaw = await resolveRef(clientSecretRaw, "microsoft_client_secret");
       }
     }
-    const orgMode = opts["orgMode"] ?? mw.org_mode ?? false;
+    const orgMode = opts["orgMode"] ?? mw?.org_mode ?? false;
     const scopes = selectMicrosoftScopes(orgMode);
     const oauthCfg = {
       client_id: clientIdRaw,
@@ -58195,51 +58199,6 @@ async function readHiddenLine2(prompt) {
     process.stdin.on("data", onData);
   });
 }
-function microsoftClientSetupGuidance(reason) {
-  return [
-    reason,
-    "",
-    "Switchroom ships no shared Microsoft OAuth app \u2014 register your own.",
-    "One-time per install:",
-    "",
-    "  1. Go to https://entra.microsoft.com \u2192 App registrations \u2192 New",
-    "     registration",
-    "  2. Supported account types: 'Accounts in any organizational",
-    "     directory AND personal Microsoft accounts' (multi-tenant + MSA)",
-    "  3. Redirect URI: platform 'Mobile and desktop applications',",
-    "     value `http://localhost` (port-agnostic; Microsoft ignores port",
-    "     for loopback URIs)",
-    "  4. Authentication \u2192 Advanced settings \u2192 'Allow public client",
-    "     flows': Yes (enables device-code on personal MSA)",
-    "  5. Copy the Application (client) ID from the Overview page",
-    "  6. Optional: create a client secret in 'Certificates & secrets'",
-    "     (skip if using public-client flow only)",
-    "  7. Vault the credentials:",
-    "",
-    "    switchroom vault set microsoft-oauth-client-id",
-    "    switchroom vault set microsoft-oauth-client-secret  # optional",
-    "",
-    "  8. If your work tenant requires admin consent, your IT admin must",
-    "     grant the requested Graph scopes (Files.ReadWrite.All etc.) at",
-    "     first sign-in. Personal MSA accounts (outlook.com / hotmail.com)",
-    "     don't need this step.",
-    "  9. Add to ~/.switchroom/switchroom.yaml (top level):",
-    "",
-    "    microsoft_workspace:",
-    '      microsoft_client_id: "vault:microsoft-oauth-client-id"',
-    '      microsoft_client_secret: "vault:microsoft-oauth-client-secret"  # omit if public-client',
-    "      authority: https://login.microsoftonline.com/common",
-    "      org_mode: false",
-    "",
-    "Env vars SWITCHROOM_MICROSOFT_CLIENT_ID / _SECRET override the block",
-    "for one-off debugging.",
-    "",
-    "Full walkthrough: docs/microsoft-workspace.md (PR 5 will land this).",
-    "Don't reuse an existing Entra app \u2014 see RFC \u00a74.1 (signInAudience",
-    "mismatch + token-version drift make app sharing brittle)."
-  ].join(`
-`);
-}
 
 // src/cli/auth.ts
 init_auth_active_yaml();

package/dist/host-control/main.js

@@ -13879,7 +13879,7 @@ var GoogleWorkspaceConfigSchema = exports_external.object({
   tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet — see RFC G §5).")
 }).optional();
 var MicrosoftWorkspaceConfigSchema = exports_external.object({
-  microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+  microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
   microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional — public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
   authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
   org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC §6.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false — personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")

package/dist/vault/approvals/kernel-server.js

@@ -11465,7 +11465,7 @@ var init_schema = __esm(() => {
     tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet — see RFC G §5).")
   }).optional();
   MicrosoftWorkspaceConfigSchema = exports_external.object({
-    microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+    microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
     microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional — public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
     authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
     org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC §6.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false — personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")

package/dist/vault/broker/server.js

@@ -11465,7 +11465,7 @@ var init_schema = __esm(() => {
     tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet — see RFC G §5).")
   }).optional();
   MicrosoftWorkspaceConfigSchema = exports_external.object({
-    microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+    microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
     microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional — public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
     authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
     org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC §6.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false — personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.57",
+  "version": "0.14.59",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {