switchroom 0.14.58 → 0.14.60

package/dist/agent-scheduler/index.js

@@ -11144,7 +11144,7 @@ var GoogleWorkspaceConfigSchema = exports_external.object({
   tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet — see RFC G §5).")
 }).optional();
 var MicrosoftWorkspaceConfigSchema = exports_external.object({
-  microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+  microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
   microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional — public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
   authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
   org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC §6.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false — personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")

package/dist/auth-broker/index.js

@@ -11144,7 +11144,7 @@ var GoogleWorkspaceConfigSchema = exports_external.object({
   tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet — see RFC G §5).")
 }).optional();
 var MicrosoftWorkspaceConfigSchema = exports_external.object({
-  microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+  microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
   microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional — public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
   authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
   org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC §6.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false — personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")
@@ -12954,6 +12954,19 @@ function classifyAsyncError2(err) {
   return { ok: false, kind: "provider_error", detail: msg };
 }
 
+// src/auth/default-oauth-clients.ts
+var DEFAULT_MICROSOFT_CLIENT_ID = "9dff88fa-3126-457b-9d1d-37e58c219019";
+function resolveMicrosoftClientId(configClientId) {
+  const env = process.env.SWITCHROOM_MICROSOFT_CLIENT_ID;
+  if (env !== undefined && env.trim().length > 0) {
+    return { clientId: env.trim(), source: "env" };
+  }
+  if (configClientId !== undefined && configClientId.length > 0) {
+    return { clientId: configClientId, source: "config" };
+  }
+  return { clientId: DEFAULT_MICROSOFT_CLIENT_ID, source: "default" };
+}
+
 // src/auth/broker/google-storage.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync2, readdirSync as readdirSync3, readFileSync as readFileSync4, rmSync as rmSync3, statSync as statSync3 } from "node:fs";
 import { dirname, join as join2, resolve as resolve5 } from "node:path";
@@ -13503,14 +13516,11 @@ class AuthBroker {
         fetcher: opts.fetcher
       }));
     }
-    const microsoftClientId = config.microsoft_workspace?.microsoft_client_id;
-    if (microsoftClientId !== undefined) {
-      this.providers.register(new MicrosoftProvider({
-        clientId: microsoftClientId,
-        clientSecret: config.microsoft_workspace?.microsoft_client_secret,
-        fetcher: opts.fetcher
-      }));
-    }
+    this.providers.register(new MicrosoftProvider({
+      clientId: resolveMicrosoftClientId(config.microsoft_workspace?.microsoft_client_id).clientId,
+      clientSecret: config.microsoft_workspace?.microsoft_client_secret,
+      fetcher: opts.fetcher
+    }));
     this.assertConfigConsistent(config);
   }
   homeRoot() {

package/dist/cli/notion-write-pretool.mjs

@@ -11892,7 +11892,7 @@ var GoogleWorkspaceConfigSchema = exports_external.object({
   tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet \u2014 see RFC G \u00a75).")
 }).optional();
 var MicrosoftWorkspaceConfigSchema = exports_external.object({
-  microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+  microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL \u2014 omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
   microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional \u2014 public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
   authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
   org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC \u00a76.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false \u2014 personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")

package/dist/cli/switchroom.js

@@ -13708,7 +13708,7 @@ var init_schema = __esm(() => {
     tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet \u2014 see RFC G \u00a75).")
   }).optional();
   MicrosoftWorkspaceConfigSchema = exports_external.object({
-    microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+    microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL \u2014 omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
     microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional \u2014 public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
     authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
     org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC \u00a76.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false \u2014 personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")
@@ -30156,23 +30156,12 @@ function checkOAuthClient2(config, anyAgentEnabled) {
   if (!anyAgentEnabled)
     return [];
   const mw = config.microsoft_workspace;
-  if (!mw) {
+  if (!mw || !clientValuePresent2(mw.microsoft_client_id)) {
     return [
       {
         name: "microsoft:oauth-client-configured",
-        status: "fail",
-        detail: "agents have microsoft_workspace.account set but the top-level microsoft_workspace: block is missing",
-        fix: "Add a microsoft_workspace block with microsoft_client_id (and optionally microsoft_client_secret) to switchroom.yaml. See `switchroom auth microsoft account add` error output for the full walkthrough."
-      }
-    ];
-  }
-  if (!clientValuePresent2(mw.microsoft_client_id)) {
-    return [
-      {
-        name: "microsoft:oauth-client-configured",
-        status: "fail",
-        detail: "microsoft_workspace block present but microsoft_client_id is empty",
-        fix: "Register an Entra app at https://entra.microsoft.com \u2192 App registrations \u2192 New. Copy the Application (client) ID and vault it: `switchroom vault set microsoft-oauth-client-id`."
+        status: "ok",
+        detail: "using switchroom's shipped default Microsoft OAuth app (no BYO app configured)"
       }
     ];
   }
@@ -49463,8 +49452,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.58";
-var COMMIT_SHA = "fc4023ed";
+var VERSION = "0.14.60";
+var COMMIT_SHA = "7a03004e";
 
 // src/cli/agent.ts
 init_source();
@@ -57729,6 +57718,21 @@ function pruneEmptyMap(doc, path) {
 
 // src/cli/auth-microsoft.ts
 init_helpers();
+
+// src/auth/default-oauth-clients.ts
+var DEFAULT_MICROSOFT_CLIENT_ID = "9dff88fa-3126-457b-9d1d-37e58c219019";
+function resolveMicrosoftClientId(configClientId) {
+  const env2 = process.env.SWITCHROOM_MICROSOFT_CLIENT_ID;
+  if (env2 !== undefined && env2.trim().length > 0) {
+    return { clientId: env2.trim(), source: "env" };
+  }
+  if (configClientId !== undefined && configClientId.length > 0) {
+    return { clientId: configClientId, source: "config" };
+  }
+  return { clientId: DEFAULT_MICROSOFT_CLIENT_ID, source: "default" };
+}
+
+// src/cli/auth-microsoft.ts
 function registerAuthMicrosoftSubcommands(program3, authParent) {
   const microsoft = authParent.command("microsoft").description("Manage Microsoft 365 accounts shared across agents (RFC #1873 \u2014 see docs/rfcs/microsoft-workspace.md)");
   registerEnable2(microsoft, program3);
@@ -57871,13 +57875,13 @@ function registerAccountAdd2(accountParent) {
     ]);
     const config = loadConfig2();
     const mw = config.microsoft_workspace;
-    if (!mw) {
-      throw new Error(microsoftClientSetupGuidance("switchroom.yaml has no `microsoft_workspace:` block, so there is no Microsoft OAuth app to connect accounts against."));
-    }
-    let clientIdRaw = process.env.SWITCHROOM_MICROSOFT_CLIENT_ID ?? mw.microsoft_client_id;
-    let clientSecretRaw = process.env.SWITCHROOM_MICROSOFT_CLIENT_SECRET ?? mw.microsoft_client_secret;
-    if (!clientIdRaw) {
-      throw new Error(microsoftClientSetupGuidance("The `microsoft_workspace:` block is present but `microsoft_client_id` is empty."));
+    const resolvedClientId = resolveMicrosoftClientId(mw?.microsoft_client_id);
+    let clientIdRaw = resolvedClientId.clientId;
+    let clientSecretRaw = process.env.SWITCHROOM_MICROSOFT_CLIENT_SECRET ?? mw?.microsoft_client_secret;
+    if (resolvedClientId.source === "default") {
+      console.error(source_default.gray(`  Using switchroom's shipped Microsoft OAuth app (zero-config).
+` + "  To use your own Entra app instead, set " + `microsoft_workspace.microsoft_client_id in switchroom.yaml
+` + "  (or the SWITCHROOM_MICROSOFT_CLIENT_ID env var)."));
     }
     const needsVault = isVaultReference2(clientIdRaw) || clientSecretRaw !== undefined && isVaultReference2(clientSecretRaw);
     if (needsVault) {
@@ -57928,7 +57932,7 @@ function registerAccountAdd2(accountParent) {
         clientSecretRaw = await resolveRef(clientSecretRaw, "microsoft_client_secret");
       }
     }
-    const orgMode = opts["orgMode"] ?? mw.org_mode ?? false;
+    const orgMode = opts["orgMode"] ?? mw?.org_mode ?? false;
     const scopes = selectMicrosoftScopes(orgMode);
     const oauthCfg = {
       client_id: clientIdRaw,
@@ -58195,51 +58199,6 @@ async function readHiddenLine2(prompt) {
     process.stdin.on("data", onData);
   });
 }
-function microsoftClientSetupGuidance(reason) {
-  return [
-    reason,
-    "",
-    "Switchroom ships no shared Microsoft OAuth app \u2014 register your own.",
-    "One-time per install:",
-    "",
-    "  1. Go to https://entra.microsoft.com \u2192 App registrations \u2192 New",
-    "     registration",
-    "  2. Supported account types: 'Accounts in any organizational",
-    "     directory AND personal Microsoft accounts' (multi-tenant + MSA)",
-    "  3. Redirect URI: platform 'Mobile and desktop applications',",
-    "     value `http://localhost` (port-agnostic; Microsoft ignores port",
-    "     for loopback URIs)",
-    "  4. Authentication \u2192 Advanced settings \u2192 'Allow public client",
-    "     flows': Yes (enables device-code on personal MSA)",
-    "  5. Copy the Application (client) ID from the Overview page",
-    "  6. Optional: create a client secret in 'Certificates & secrets'",
-    "     (skip if using public-client flow only)",
-    "  7. Vault the credentials:",
-    "",
-    "    switchroom vault set microsoft-oauth-client-id",
-    "    switchroom vault set microsoft-oauth-client-secret  # optional",
-    "",
-    "  8. If your work tenant requires admin consent, your IT admin must",
-    "     grant the requested Graph scopes (Files.ReadWrite.All etc.) at",
-    "     first sign-in. Personal MSA accounts (outlook.com / hotmail.com)",
-    "     don't need this step.",
-    "  9. Add to ~/.switchroom/switchroom.yaml (top level):",
-    "",
-    "    microsoft_workspace:",
-    '      microsoft_client_id: "vault:microsoft-oauth-client-id"',
-    '      microsoft_client_secret: "vault:microsoft-oauth-client-secret"  # omit if public-client',
-    "      authority: https://login.microsoftonline.com/common",
-    "      org_mode: false",
-    "",
-    "Env vars SWITCHROOM_MICROSOFT_CLIENT_ID / _SECRET override the block",
-    "for one-off debugging.",
-    "",
-    "Full walkthrough: docs/microsoft-workspace.md (PR 5 will land this).",
-    "Don't reuse an existing Entra app \u2014 see RFC \u00a74.1 (signInAudience",
-    "mismatch + token-version drift make app sharing brittle)."
-  ].join(`
-`);
-}
 
 // src/cli/auth.ts
 init_auth_active_yaml();

package/dist/host-control/main.js

@@ -13879,7 +13879,7 @@ var GoogleWorkspaceConfigSchema = exports_external.object({
   tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet — see RFC G §5).")
 }).optional();
 var MicrosoftWorkspaceConfigSchema = exports_external.object({
-  microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+  microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
   microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional — public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
   authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
   org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC §6.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false — personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")

package/dist/vault/approvals/kernel-server.js

@@ -11465,7 +11465,7 @@ var init_schema = __esm(() => {
     tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet — see RFC G §5).")
   }).optional();
   MicrosoftWorkspaceConfigSchema = exports_external.object({
-    microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+    microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
     microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional — public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
     authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
     org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC §6.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false — personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")

package/dist/vault/broker/server.js

@@ -11465,7 +11465,7 @@ var init_schema = __esm(() => {
     tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet — see RFC G §5).")
   }).optional();
   MicrosoftWorkspaceConfigSchema = exports_external.object({
-    microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+    microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
     microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional — public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
     authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
     org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC §6.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false — personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.58",
+  "version": "0.14.60",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -23874,7 +23874,7 @@ var init_schema = __esm(() => {
     tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet \u2014 see RFC G \u00a75).")
   }).optional();
   MicrosoftWorkspaceConfigSchema = exports_external.object({
-    microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+    microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL \u2014 omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
     microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional \u2014 public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
     authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
     org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC \u00a76.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false \u2014 personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")
@@ -32729,7 +32729,7 @@ var MIRROR_MAX_LINES = 6;
 function escapeFeedHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function renderActivityFeed(lines, final = false) {
+function renderActivityFeed(lines, final = false, liveSuffix = "") {
   if (lines.length === 0)
     return null;
   const shown = lines.slice(-MIRROR_MAX_LINES);
@@ -32740,7 +32740,7 @@ function renderActivityFeed(lines, final = false) {
   const lastIdx = shown.length - 1;
   shown.forEach((l, i) => {
     const esc = escapeFeedHtml(l);
-    out.push(i === lastIdx && !final ? `<b>\u2192 ${esc}</b>` : `<i>\u2713 ${esc}</i>`);
+    out.push(i === lastIdx && !final ? `<b>\u2192 ${esc}${liveSuffix}</b>` : `<i>\u2713 ${esc}</i>`);
   });
   return out.join(`
 `);
@@ -32748,10 +32748,10 @@ function renderActivityFeed(lines, final = false) {
 var NESTED_MAX_LINES = 4;
 var NESTED_LINE_MAX = 90;
 var NESTED_PREFIX = "   \u21b3 ";
-function renderActivityFeedWithNested(lines, childLines, final = false) {
+function renderActivityFeedWithNested(lines, childLines, final = false, liveSuffix = "") {
   const children = childLines.map((s) => s.trim()).filter((s) => s.length > 0);
   if (children.length === 0)
-    return renderActivityFeed(lines, final);
+    return renderActivityFeed(lines, final, liveSuffix);
   const out = [];
   const shownParent = lines.slice(-MIRROR_MAX_LINES);
   const hiddenParent = lines.length - shownParent.length;
@@ -32767,7 +32767,7 @@ function renderActivityFeedWithNested(lines, childLines, final = false) {
   shownChild.forEach((l, i) => {
     const t = l.length > NESTED_LINE_MAX ? l.slice(0, NESTED_LINE_MAX - 1) + "\u2026" : l;
     const esc = escapeFeedHtml(t);
-    out.push(i === lastChildIdx && !final ? `${NESTED_PREFIX}<b>\u2192 ${esc}</b>` : `${NESTED_PREFIX}<i>${esc}</i>`);
+    out.push(i === lastChildIdx && !final ? `${NESTED_PREFIX}<b>\u2192 ${esc}${liveSuffix}</b>` : `${NESTED_PREFIX}<i>${esc}</i>`);
   });
   return out.length > 0 ? out.join(`
 `) : null;
@@ -47132,6 +47132,92 @@ function createPendingInboundBuffer(opts = {}) {
   };
 }
 
+// gateway/obligation-ledger.ts
+class ObligationLedger {
+  maxRepresents;
+  open = new Map;
+  constructor(maxRepresents = 2) {
+    this.maxRepresents = maxRepresents;
+  }
+  openIfAbsent(input) {
+    if (this.open.has(input.originTurnId))
+      return false;
+    this.open.set(input.originTurnId, { ...input, representCount: 0 });
+    return true;
+  }
+  close(originTurnId) {
+    if (originTurnId == null)
+      return false;
+    return this.open.delete(originTurnId);
+  }
+  isOpen(originTurnId) {
+    return this.open.has(originTurnId);
+  }
+  hasOpen() {
+    return this.open.size > 0;
+  }
+  size() {
+    return this.open.size;
+  }
+  list() {
+    return [...this.open.values()].sort((a, b) => a.openedAt - b.openedAt);
+  }
+  oldest() {
+    let best;
+    for (const o of this.open.values()) {
+      if (best === undefined || o.openedAt < best.openedAt)
+        best = o;
+    }
+    return best;
+  }
+  decideAtIdle() {
+    const o = this.oldest();
+    if (o === undefined)
+      return { action: "none" };
+    if (o.representCount >= this.maxRepresents)
+      return { action: "escalate", obligation: o };
+    return { action: "represent", obligation: o };
+  }
+  resolveCloseTarget(echoedTurnId, liveTurnId) {
+    if (echoedTurnId != null)
+      return echoedTurnId;
+    if (liveTurnId != null && this.open.size === 1 && this.open.has(liveTurnId))
+      return liveTurnId;
+    return null;
+  }
+  markRepresented(originTurnId) {
+    const o = this.open.get(originTurnId);
+    if (o === undefined)
+      return 0;
+    o.representCount += 1;
+    return o.representCount;
+  }
+}
+var REPRESENT_PREVIEW_MAX = 200;
+function buildObligationRepresentInbound(o, now) {
+  const preview = o.text.length > REPRESENT_PREVIEW_MAX ? o.text.slice(0, REPRESENT_PREVIEW_MAX - 1) + "\u2026" : o.text;
+  const topicClause = o.threadId != null ? " in this topic" : "";
+  return {
+    type: "inbound",
+    chatId: o.chatId,
+    ...o.threadId != null ? { threadId: o.threadId } : {},
+    messageId: o.messageId,
+    user: "switchroom",
+    userId: 0,
+    ts: now,
+    text: `You have an earlier message${topicClause} that you started but never actually ` + `answered (you may have set it aside mid-work): "${preview}". Answer it now via the ` + `reply tool \u2014 deliver the real answer, don't just acknowledge it. If you've lost the ` + `surrounding context, call get_recent_messages for this chat${topicClause} first. ` + `That quoted text may be only the first ~200 characters of the original.`,
+    meta: {
+      source: "obligation_represent",
+      origin_turn_id: o.originTurnId,
+      represent_count: String(o.representCount + 1)
+    }
+  };
+}
+function obligationEscalationText(o) {
+  const preview = o.text.length > REPRESENT_PREVIEW_MAX ? o.text.slice(0, REPRESENT_PREVIEW_MAX - 1) + "\u2026" : o.text;
+  return `\u26a0\ufe0f I may have missed an earlier message and I'm not sure I answered it: ` + `"${preview}". If you still need it, please re-send.`;
+}
+
 // gateway/inbound-spool.ts
 function spoolId(msg) {
   if (msg.meta?.source === "subagent_handback" && typeof msg.meta?.subagent_jsonl_id === "string" && msg.meta.subagent_jsonl_id.length > 0) {
@@ -52224,10 +52310,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.58";
-var COMMIT_SHA = "fc4023ed";
-var COMMIT_DATE = "2026-06-04T02:50:15Z";
-var LATEST_PR = 2142;
+var VERSION = "0.14.60";
+var COMMIT_SHA = "7a03004e";
+var COMMIT_DATE = "2026-06-04T07:56:20Z";
+var LATEST_PR = 2148;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -53425,6 +53511,10 @@ var _deliveryTimeoutParsed = _deliveryTimeoutRaw != null && _deliveryTimeoutRaw
 var DELIVERY_CONFIRM_TIMEOUT_MS = Number.isFinite(_deliveryTimeoutParsed) && _deliveryTimeoutParsed > 0 ? _deliveryTimeoutParsed : 15000;
 var DELIVERY_CONFIRM_SWEEP_MS = 5000;
 var deliveryQueue = createDeliveryQueue();
+var OBLIGATION_LEDGER_ENABLED = process.env.SWITCHROOM_OBLIGATION_LEDGER === "1";
+var OBLIGATION_REPRESENT_MAX = 2;
+var OBLIGATION_SWEEP_MS = 5000;
+var obligationLedger = new ObligationLedger(OBLIGATION_REPRESENT_MAX);
 var SERIALIZE_UNTIL_REPLIED_ENABLED = process.env.SWITCHROOM_SERIALIZE_UNTIL_REPLIED !== "0";
 var _noReplyDrainRaw = process.env.SWITCHROOM_SERIALIZE_NOREPLY_DRAIN_MS;
 var _noReplyDrainParsed = _noReplyDrainRaw != null && _noReplyDrainRaw !== "" ? Number(_noReplyDrainRaw) : 2500;
@@ -53433,6 +53523,16 @@ var TURN_ORIGIN_ROUTING_ENABLED = process.env.SWITCHROOM_TURN_ORIGIN_ROUTING !==
 var TOPIC_FRAMING_ENABLED = process.env.SWITCHROOM_TOPIC_FRAMING !== "0";
 var QUEUED_STATUS_UX_ENABLED = process.env.SWITCHROOM_QUEUED_STATUS_UX !== "0";
 var FEED_REOPEN_AFTER_ACK_ENABLED = process.env.SWITCHROOM_FEED_REOPEN_AFTER_ACK !== "0";
+var FEED_HEARTBEAT_ENABLED = process.env.SWITCHROOM_FEED_HEARTBEAT !== "0";
+var FEED_HEARTBEAT_TICK_MS = 6000;
+var FEED_HEARTBEAT_MIN_STALE_MS = 6000;
+function formatFeedElapsed(ms) {
+  const s = Math.floor(ms / 1000);
+  if (s < 60)
+    return `${s}s`;
+  const m = Math.floor(s / 60);
+  return `${m}m${(s % 60).toString().padStart(2, "0")}s`;
+}
 function turnInFlightForGate() {
   return isDeliveryCutoverEnabled() ? isMachineInTurn() : claudeBusyKeys.size > 0;
 }
@@ -53473,6 +53573,37 @@ function findTurnByOriginId(originTurnId) {
     return currentTurn;
   return recentTurnsById.get(originTurnId) ?? null;
 }
+function closeObligationOnSubstantiveReply(args, liveTurn) {
+  if (!OBLIGATION_LEDGER_ENABLED)
+    return;
+  const echoed = findTurnByOriginId(args.origin_turn_id);
+  const target = obligationLedger.resolveCloseTarget(echoed?.turnId, liveTurn?.turnId);
+  if (target != null)
+    obligationLedger.close(target);
+}
+function openObligationFromInbound(inboundMsg, gate) {
+  if (!OBLIGATION_LEDGER_ENABLED)
+    return;
+  if (!shouldTrackDelivery({
+    isSteering: gate.isSteering,
+    isInterrupt: gate.isInterrupt,
+    hasSource: inboundMsg.meta?.source != null,
+    effectiveText: gate.effectiveText
+  })) {
+    return;
+  }
+  const oid = deriveTurnId(inboundMsg.chatId, inboundMsg.threadId, inboundMsg.messageId);
+  if (oid == null)
+    return;
+  obligationLedger.openIfAbsent({
+    originTurnId: oid,
+    chatId: inboundMsg.chatId,
+    threadId: inboundMsg.threadId,
+    messageId: inboundMsg.messageId,
+    text: inboundMsg.text ?? "",
+    openedAt: Date.now()
+  });
+}
 function postQueuedStatus(chatId, bufferedThread, inFlightThread) {
   if (!QUEUED_STATUS_UX_ENABLED)
     return;
@@ -53675,6 +53806,9 @@ function endCurrentTurnAtomic(turn) {
   if (currentTurn !== turn)
     return;
   currentTurn = null;
+  if (OBLIGATION_LEDGER_ENABLED && turn.finalAnswerDelivered) {
+    obligationLedger.close(turn.turnId);
+  }
   if (turn.noReplyDrainTimer != null) {
     clearTimeout(turn.noReplyDrainTimer);
     turn.noReplyDrainTimer = null;
@@ -54748,6 +54882,40 @@ var inboundSpool = STATIC ? undefined : createInboundSpool({
   }
 });
 var pendingInboundBuffer = createPendingInboundBuffer({ spool: inboundSpool });
+function obligationSweep() {
+  if (!OBLIGATION_LEDGER_ENABLED)
+    return;
+  if (!obligationLedger.hasOpen())
+    return;
+  if (turnInFlightForGate())
+    return;
+  const agent = process.env.SWITCHROOM_AGENT_NAME ?? "";
+  if (pendingInboundBuffer.depth(agent) > 0)
+    return;
+  const decision = obligationLedger.decideAtIdle();
+  const o = decision.obligation;
+  if (decision.action === "none" || o == null)
+    return;
+  if (decision.action === "represent") {
+    pendingInboundBuffer.push(agent, buildObligationRepresentInbound(o, Date.now()));
+    const attempt = obligationLedger.markRepresented(o.originTurnId);
+    process.stderr.write(`telegram gateway: obligation re-presented origin=${o.originTurnId} attempt=${attempt}/${OBLIGATION_REPRESENT_MAX}
+`);
+    return;
+  }
+  obligationLedger.close(o.originTurnId);
+  process.stderr.write(`telegram gateway: obligation escalated (exhausted ${OBLIGATION_REPRESENT_MAX} re-presents) origin=${o.originTurnId}
+`);
+  robustApiCall(() => bot.api.sendMessage(o.chatId, obligationEscalationText(o), {
+    ...o.threadId != null ? { message_thread_id: o.threadId } : {}
+  }), { chat_id: o.chatId, ...o.threadId != null ? { threadId: o.threadId } : {}, verb: "obligation.escalate" }).catch((err) => {
+    process.stderr.write(`telegram gateway: obligation escalation send failed: ${err}
+`);
+  });
+}
+if (!STATIC && OBLIGATION_LEDGER_ENABLED) {
+  setInterval(obligationSweep, OBLIGATION_SWEEP_MS).unref();
+}
 if (bootResumeInbound != null) {
   if (inboundSpool != null) {
     inboundSpool.put(bootResumeInbound.agent, bootResumeInbound.msg);
@@ -55724,6 +55892,8 @@ ${url}`;
               text: decision.mergedText,
               disableNotification
             });
+            if (turn2.finalAnswerSubstantive)
+              closeObligationOnSubstantiveReply(args, turn2);
           }
           outboundDedup.record(chat_id, threadId, decision.mergedText, Date.now(), turn2?.registryKey ?? null);
           silentAnchorEditDone = true;
@@ -55925,6 +56095,8 @@ ${url}`;
       turn.finalAnswerDelivered = true;
       turn.finalAnswerSubstantive = isSubstantiveFinalReply({ text: rawText, disableNotification });
       finalizeStatusReaction(chat_id, threadId, "done");
+      if (turn.finalAnswerSubstantive)
+        closeObligationOnSubstantiveReply(args, turn);
     }
     releaseTurnBufferGate(statusKey(chat_id, threadId), turn ?? undefined);
     if (turn?.finalAnswerDelivered === true) {
@@ -56095,6 +56267,8 @@ async function executeStreamReply(args) {
       disableNotification: args.disable_notification === true,
       done: args.done === true
     });
+    if (turn.finalAnswerSubstantive)
+      closeObligationOnSubstantiveReply(args, turn);
     const streamThreadIdForClear = args.message_thread_id != null ? Number(args.message_thread_id) : undefined;
     clearSilentEndState(statusKey(streamChatId, streamThreadIdForClear));
   }
@@ -57086,12 +57260,12 @@ function closeProgressLane(chatId, threadId) {
   }
 }
 var FOREGROUND_SUBAGENT_ACCUM_MAX = 12;
-function composeTurnActivity(turn, final = false) {
+function composeTurnActivity(turn, final = false, liveSuffix = "") {
   const childLines = [];
   for (const narrative of turn.foregroundSubAgents.values()) {
     childLines.push(...narrative);
   }
-  return renderActivityFeedWithNested(turn.mirrorLines, childLines, final);
+  return renderActivityFeedWithNested(turn.mirrorLines, childLines, final, liveSuffix);
 }
 async function drainActivitySummary(turn) {
   try {
@@ -57130,6 +57304,30 @@ async function drainActivitySummary(turn) {
     turn.activityInFlight = null;
   }
 }
+function feedHeartbeatTick() {
+  const turn = currentTurn;
+  if (turn == null)
+    return;
+  if (turn.activityMessageId == null)
+    return;
+  if (turn.finalAnswerDelivered)
+    return;
+  if (turn.lastToolLabelAt == null)
+    return;
+  const elapsed = Date.now() - turn.lastToolLabelAt;
+  if (elapsed < FEED_HEARTBEAT_MIN_STALE_MS)
+    return;
+  const rendered = composeTurnActivity(turn, false, ` \xB7 ${formatFeedElapsed(elapsed)}`);
+  if (rendered == null)
+    return;
+  turn.activityPendingRender = rendered;
+  if (turn.activityInFlight == null) {
+    turn.activityInFlight = drainActivitySummary(turn);
+  }
+}
+if (!STATIC && FEED_HEARTBEAT_ENABLED) {
+  setInterval(feedHeartbeatTick, FEED_HEARTBEAT_TICK_MS).unref();
+}
 function clearActivitySummary(turn, finalHtmlOverride) {
   const chat = turn.sessionChatId;
   const thread = turn.sessionThreadId;
@@ -57314,6 +57512,7 @@ function handleSessionEvent(ev) {
       }
       const rendered = appendActivityLabel(turn.mirrorLines, ev.label);
       if (rendered != null) {
+        turn.lastToolLabelAt = Date.now();
         turn.activityPendingRender = composeTurnActivity(turn) ?? rendered;
         if (turn.activityInFlight == null) {
           turn.activityInFlight = drainActivitySummary(turn);
@@ -58638,6 +58837,11 @@ ${preBlock(write.output)}`;
     }
     return;
   }
+  openObligationFromInbound(inboundMsg, {
+    isSteering,
+    isInterrupt: interrupt.isInterrupt,
+    effectiveText
+  });
   if (decideInboundDelivery({
     turnInFlight: turnInFlightAtReceipt,
     isSteering,