switchroom 0.14.60 → 0.14.62

package/dist/cli/switchroom.js

@@ -49452,8 +49452,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.60";
-var COMMIT_SHA = "7a03004e";
+var VERSION = "0.14.62";
+var COMMIT_SHA = "3967bb6f";
 
 // src/cli/agent.ts
 init_source();
@@ -57732,6 +57732,69 @@ function resolveMicrosoftClientId(configClientId) {
   return { clientId: DEFAULT_MICROSOFT_CLIENT_ID, source: "default" };
 }
 
+// src/microsoft/scopes.ts
+var SCOPE_SET_DEFAULT = [
+  "openid",
+  "profile",
+  "email",
+  "offline_access",
+  "User.Read",
+  "Mail.ReadWrite",
+  "Calendars.ReadWrite",
+  "Files.ReadWrite.All"
+];
+var SCOPE_SET_ORG_MODE = [...SCOPE_SET_DEFAULT, "Sites.ReadWrite.All"];
+function selectMicrosoftScopes(orgMode) {
+  return orgMode ? SCOPE_SET_ORG_MODE : SCOPE_SET_DEFAULT;
+}
+
+// src/microsoft/credentials.ts
+init_oauth2();
+function buildMicrosoftCredentials(opts) {
+  const { tokens, clientId, accountEmail, fallbackScope } = opts;
+  const now = opts.now ?? Date.now;
+  let tenantId = "";
+  let accountType = "work";
+  let homeAccountId = "";
+  let resolvedEmail = accountEmail;
+  if (tokens.id_token) {
+    const claims = decodeJwtPayloadUnsafe(tokens.id_token);
+    if (claims) {
+      if (typeof claims.tid === "string")
+        tenantId = claims.tid;
+      if (tenantId)
+        accountType = classifyAccountType(tenantId);
+      const home2 = buildHomeAccountId(claims);
+      if (home2)
+        homeAccountId = home2;
+      if (typeof claims.preferred_username === "string") {
+        resolvedEmail = claims.preferred_username.toLowerCase();
+      } else if (typeof claims.email === "string") {
+        resolvedEmail = claims.email.toLowerCase();
+      }
+    }
+  }
+  const emailMismatch = accountEmail.length > 0 && resolvedEmail.toLowerCase() !== accountEmail.toLowerCase();
+  return {
+    credentials: {
+      microsoftOauth: {
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token ?? "",
+        expiresAt: now() + tokens.expires_in * 1000,
+        scope: tokens.scope ?? fallbackScope,
+        clientId,
+        accountEmail: resolvedEmail,
+        tokenType: "Bearer",
+        tenantId,
+        accountType,
+        homeAccountId
+      }
+    },
+    resolvedEmail,
+    emailMismatch
+  };
+}
+
 // src/cli/auth-microsoft.ts
 function registerAuthMicrosoftSubcommands(program3, authParent) {
   const microsoft = authParent.command("microsoft").description("Manage Microsoft 365 accounts shared across agents (RFC #1873 \u2014 see docs/rfcs/microsoft-workspace.md)");
@@ -57838,23 +57901,6 @@ function registerList2(microsoftParent, program3) {
     console.log();
   }));
 }
-var SCOPE_SET_DEFAULT = [
-  "openid",
-  "profile",
-  "email",
-  "offline_access",
-  "User.Read",
-  "Mail.ReadWrite",
-  "Calendars.ReadWrite",
-  "Files.ReadWrite.All"
-];
-var SCOPE_SET_ORG_MODE = [
-  ...SCOPE_SET_DEFAULT,
-  "Sites.ReadWrite.All"
-];
-function selectMicrosoftScopes(orgMode) {
-  return orgMode ? SCOPE_SET_ORG_MODE : SCOPE_SET_DEFAULT;
-}
 function registerAccountAdd2(accountParent) {
   accountParent.command("add <account>").description("Mint a Microsoft OAuth refresh token for <account> and register with the auth-broker. Uses desktop-loopback by default (or device-code on headless hosts); both work for personal MSA and work/school. --org-mode also requests Sites.ReadWrite.All (SharePoint).").option("--replace", "Overwrite existing credentials for <account> (default refuses if account already registered)", false).option("--org-mode", "Request the SharePoint scope (Sites.ReadWrite.All) in addition to the default set. Useful for work accounts with SharePoint document libraries. Default is OneDrive-only.", false).action(withConfigError(async (account, opts) => {
     const normalizedAccount = validateAndNormalizeAccountEmail2(account);
@@ -57980,7 +58026,7 @@ function registerAccountAdd2(accountParent) {
     if (!tokens.refresh_token) {
       throw new Error("Microsoft did not return a refresh_token \u2014 ensure `offline_access` is in the consented scope set and try again.");
     }
-    const microsoftCreds = buildMicrosoftCredentials({
+    const microsoftCreds = buildMicrosoftCredentials2({
       tokens,
       clientId: clientIdRaw,
       accountEmail: normalizedAccount,
@@ -58095,51 +58141,16 @@ function validateAgentSlugs(agents, config) {
 function pad2(s, width) {
   return s.length >= width ? s : s + " ".repeat(width - s.length);
 }
-function buildMicrosoftCredentials(opts) {
-  const { tokens, clientId, accountEmail, fallbackScope } = opts;
-  const { decodeJwtPayloadUnsafe: decodeJwtPayloadUnsafe2, classifyAccountType: classifyAccountType2, buildHomeAccountId: buildHomeAccountId2 } = (init_oauth2(), __toCommonJS(exports_oauth2));
-  let tenantId = "";
-  let accountType = "work";
-  let homeAccountId = "";
-  let resolvedEmail = accountEmail;
-  if (tokens.id_token) {
-    const claims = decodeJwtPayloadUnsafe2(tokens.id_token);
-    if (claims) {
-      if (typeof claims.tid === "string")
-        tenantId = claims.tid;
-      if (tenantId)
-        accountType = classifyAccountType2(tenantId);
-      const home2 = buildHomeAccountId2(claims);
-      if (home2)
-        homeAccountId = home2;
-      if (typeof claims.preferred_username === "string") {
-        resolvedEmail = claims.preferred_username.toLowerCase();
-      } else if (typeof claims.email === "string") {
-        resolvedEmail = claims.email.toLowerCase();
-      }
-    }
-  }
-  if (resolvedEmail.toLowerCase() !== accountEmail.toLowerCase()) {
+function buildMicrosoftCredentials2(opts) {
+  const built = buildMicrosoftCredentials(opts);
+  if (built.emailMismatch) {
     console.warn();
-    console.warn(`  \u26a0 Account argument was '${accountEmail}' but Microsoft authenticated as '${resolvedEmail}'.`);
-    console.warn(`    The broker will index by '${accountEmail}' (what you typed). If this isn't what`);
-    console.warn(`    you intended (e.g. a typo), 'switchroom auth microsoft account remove ${accountEmail}' to undo.`);
+    console.warn(`  \u26a0 Account argument was '${opts.accountEmail}' but Microsoft authenticated as '${built.resolvedEmail}'.`);
+    console.warn(`    The broker will index by '${opts.accountEmail}' (what you typed). If this isn't what`);
+    console.warn(`    you intended (e.g. a typo), 'switchroom auth microsoft account remove ${opts.accountEmail}' to undo.`);
     console.warn();
   }
-  return {
-    microsoftOauth: {
-      accessToken: tokens.access_token,
-      refreshToken: tokens.refresh_token ?? "",
-      expiresAt: Date.now() + tokens.expires_in * 1000,
-      scope: tokens.scope ?? fallbackScope,
-      clientId,
-      accountEmail: resolvedEmail,
-      tokenType: "Bearer",
-      tenantId,
-      accountType,
-      homeAccountId
-    }
-  };
+  return built.credentials;
 }
 async function readHiddenLine2(prompt) {
   const readline = await import("node:readline");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.60",
+  "version": "0.14.62",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {