switchroom 0.14.74 → 0.14.76

package/dist/agent-scheduler/index.js

@@ -10991,6 +10991,7 @@ var AgentToolsSchema = exports_external.object({
 var AgentMemorySchema = exports_external.object({
   collection: exports_external.string().describe("Hindsight collection name for this agent"),
   auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
+  file: exports_external.boolean().default(true).describe("Maintain a curated workspace MEMORY.md file (seeded once, " + "auto-loaded every turn). Set false for hindsight-only memory: " + "the file is not seeded or re-created, so once migrated into " + "Hindsight and deleted it stays gone. Recall + directives carry " + "the memory instead. Cascade: override (per-agent wins over default)."),
   isolation: exports_external.enum(["default", "strict"]).default("default").describe("strict = never shared cross-agent, default = eligible for reflect"),
   bank_mission: exports_external.string().optional().describe("Bank-level mission statement used during recall to contextualize results"),
   retain_mission: exports_external.string().optional().describe("Instructions for the fact extraction LLM during retain"),
@@ -11210,6 +11211,7 @@ var profileFields = {
   memory: exports_external.object({
     collection: exports_external.string().optional(),
     auto_recall: exports_external.boolean().optional(),
+    file: exports_external.boolean().optional(),
     isolation: exports_external.enum(["default", "strict"]).optional(),
     recall: exports_external.object({
       max_memories: exports_external.number().int().min(0).optional(),

package/dist/auth-broker/index.js

@@ -10991,6 +10991,7 @@ var AgentToolsSchema = exports_external.object({
 var AgentMemorySchema = exports_external.object({
   collection: exports_external.string().describe("Hindsight collection name for this agent"),
   auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
+  file: exports_external.boolean().default(true).describe("Maintain a curated workspace MEMORY.md file (seeded once, " + "auto-loaded every turn). Set false for hindsight-only memory: " + "the file is not seeded or re-created, so once migrated into " + "Hindsight and deleted it stays gone. Recall + directives carry " + "the memory instead. Cascade: override (per-agent wins over default)."),
   isolation: exports_external.enum(["default", "strict"]).default("default").describe("strict = never shared cross-agent, default = eligible for reflect"),
   bank_mission: exports_external.string().optional().describe("Bank-level mission statement used during recall to contextualize results"),
   retain_mission: exports_external.string().optional().describe("Instructions for the fact extraction LLM during retain"),
@@ -11210,6 +11211,7 @@ var profileFields = {
   memory: exports_external.object({
     collection: exports_external.string().optional(),
     auto_recall: exports_external.boolean().optional(),
+    file: exports_external.boolean().optional(),
     isolation: exports_external.enum(["default", "strict"]).optional(),
     recall: exports_external.object({
       max_memories: exports_external.number().int().min(0).optional(),
@@ -13890,8 +13892,29 @@ class AuthBroker {
       return override;
     return auth.active ?? null;
   }
-  async opGetCredentials(socket, id, identity2) {
+  servingAccount(identity2) {
     const account = this.callerAccount(identity2);
+    if (identity2.kind !== "consumer")
+      return account;
+    return this.consumerAccountWithFailover(account);
+  }
+  isAccountExhausted(account) {
+    const q = this.quota[account];
+    return q !== undefined && q.exhausted_until > this.now();
+  }
+  consumerAccountWithFailover(pinned) {
+    if (!pinned || !this.isAccountExhausted(pinned))
+      return pinned;
+    for (const cand of this.config.auth?.fallback_order ?? []) {
+      if (cand === pinned || this.isAccountExhausted(cand))
+        continue;
+      if (readAccountCredentials(cand, this.home))
+        return cand;
+    }
+    return pinned;
+  }
+  async opGetCredentials(socket, id, identity2) {
+    const account = this.servingAccount(identity2);
     if (!account) {
       this.audit({ op: "get-credentials", identity: identity2, ok: false, error: "no-active-account" });
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", "no active account configured"));

package/dist/cli/notion-write-pretool.mjs

@@ -11739,6 +11739,7 @@ var AgentToolsSchema = exports_external.object({
 var AgentMemorySchema = exports_external.object({
   collection: exports_external.string().describe("Hindsight collection name for this agent"),
   auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
+  file: exports_external.boolean().default(true).describe("Maintain a curated workspace MEMORY.md file (seeded once, " + "auto-loaded every turn). Set false for hindsight-only memory: " + "the file is not seeded or re-created, so once migrated into " + "Hindsight and deleted it stays gone. Recall + directives carry " + "the memory instead. Cascade: override (per-agent wins over default)."),
   isolation: exports_external.enum(["default", "strict"]).default("default").describe("strict = never shared cross-agent, default = eligible for reflect"),
   bank_mission: exports_external.string().optional().describe("Bank-level mission statement used during recall to contextualize results"),
   retain_mission: exports_external.string().optional().describe("Instructions for the fact extraction LLM during retain"),
@@ -11958,6 +11959,7 @@ var profileFields = {
   memory: exports_external.object({
     collection: exports_external.string().optional(),
     auto_recall: exports_external.boolean().optional(),
+    file: exports_external.boolean().optional(),
     isolation: exports_external.enum(["default", "strict"]).optional(),
     recall: exports_external.object({
       max_memories: exports_external.number().int().min(0).optional(),

package/dist/cli/switchroom.js

@@ -13555,6 +13555,7 @@ var init_schema = __esm(() => {
   AgentMemorySchema = exports_external.object({
     collection: exports_external.string().describe("Hindsight collection name for this agent"),
     auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
+    file: exports_external.boolean().default(true).describe("Maintain a curated workspace MEMORY.md file (seeded once, " + "auto-loaded every turn). Set false for hindsight-only memory: " + "the file is not seeded or re-created, so once migrated into " + "Hindsight and deleted it stays gone. Recall + directives carry " + "the memory instead. Cascade: override (per-agent wins over default)."),
     isolation: exports_external.enum(["default", "strict"]).default("default").describe("strict = never shared cross-agent, default = eligible for reflect"),
     bank_mission: exports_external.string().optional().describe("Bank-level mission statement used during recall to contextualize results"),
     retain_mission: exports_external.string().optional().describe("Instructions for the fact extraction LLM during retain"),
@@ -13774,6 +13775,7 @@ var init_schema = __esm(() => {
     memory: exports_external.object({
       collection: exports_external.string().optional(),
       auto_recall: exports_external.boolean().optional(),
+      file: exports_external.boolean().optional(),
       isolation: exports_external.enum(["default", "strict"]).optional(),
       recall: exports_external.object({
         max_memories: exports_external.number().int().min(0).optional(),
@@ -28938,6 +28940,82 @@ var init_manifest = __esm(() => {
   ]);
 });
 
+// src/cli/doctor-memory.ts
+import { execFileSync as execFileSync17 } from "node:child_process";
+function classifyShmSize(bytes) {
+  const mib = Math.round(bytes / 1024 / 1024);
+  if (bytes < MIN_HINDSIGHT_SHM_BYTES) {
+    return {
+      name: "hindsight shm-size",
+      status: "fail",
+      detail: `${mib}MB \u2014 PostgreSQL needs ~533MB+ for shared segments; writes will ` + `fail with "No space left on device"`,
+      fix: "Recreate hindsight with a larger shm. The launch path now sets " + "--shm-size=2g (#2190); pull a release that includes it and run " + "`switchroom memory --restart`, or recreate the container manually " + "preserving the `switchroom-hindsight-data` volume."
+    };
+  }
+  const gib = (bytes / 1024 / 1024 / 1024).toFixed(bytes % 1024 ** 3 === 0 ? 0 : 1);
+  return { name: "hindsight shm-size", status: "ok", detail: `${gib}g` };
+}
+function classifyExtractionLogs(logs) {
+  const noSpace = /No space left on device|could not resize shared memory/i.test(logs);
+  const llmError = /Claude Code returned an error result|claude_code_llm[\s\S]{0,80}error|Fact extraction failed|Content extraction failed/i.test(logs);
+  const quotaHint = /weekly limit|api_error_status["':\s]+429|\b429\b|hit your[\s\S]{0,24}limit/i.test(logs);
+  const zeroFacts = (logs.match(/Extract facts:\s*0 facts/gi) ?? []).length;
+  const okFacts = (logs.match(/Extract facts:\s*[1-9]\d* facts/gi) ?? []).length;
+  if (noSpace) {
+    return {
+      name: "hindsight extraction",
+      status: "fail",
+      detail: "shared-memory exhaustion in recent logs \u2014 memory writes are failing",
+      fix: "See the `hindsight shm-size` check \u2014 the container's /dev/shm is too small."
+    };
+  }
+  if (llmError && okFacts === 0) {
+    return {
+      name: "hindsight extraction",
+      status: "fail",
+      detail: "fact-extraction LLM calls are failing" + (quotaHint ? " (429 / weekly-limit detected)" : "") + " \u2014 retains are accepted but extract 0 facts, so nothing becomes recallable",
+      fix: "Usually hindsight's `auth.consumers[hindsight].account` is quota-" + "exhausted or its OAuth broke. Repoint it to an account with quota in " + "switchroom.yaml, then `docker restart switchroom-auth-broker` and " + "`docker restart switchroom-hindsight` (single-file config mount needs " + "the broker restart to re-read). Confirm with a headless `claude` run " + "inside the container."
+    };
+  }
+  if (zeroFacts >= 3 && okFacts === 0) {
+    return {
+      name: "hindsight extraction",
+      status: "warn",
+      detail: `${zeroFacts} recent extractions produced 0 facts and none succeeded \u2014 ` + "fact extraction may be failing",
+      fix: "Inspect `docker logs switchroom-hindsight` for the extraction error."
+    };
+  }
+  return {
+    name: "hindsight extraction",
+    status: "ok",
+    detail: okFacts > 0 ? `healthy (${okFacts} recent successful extractions)` : "no recent extraction activity to assess"
+  };
+}
+function checkHindsightContainerHealth(opts) {
+  const name = opts?.containerName ?? "switchroom-hindsight";
+  const exec = opts?.exec ?? ((cmd, args) => execFileSync17(cmd, args, { stdio: ["ignore", "pipe", "ignore"], timeout: 8000 }).toString());
+  const results = [];
+  let shmRaw;
+  try {
+    shmRaw = exec("docker", ["inspect", name, "--format", "{{.HostConfig.ShmSize}}"]).trim();
+  } catch {
+    return [];
+  }
+  const shmBytes = parseInt(shmRaw, 10);
+  if (Number.isFinite(shmBytes) && shmBytes > 0) {
+    results.push(classifyShmSize(shmBytes));
+  }
+  try {
+    const logs = exec("docker", ["logs", "--since", "10m", name]);
+    results.push(classifyExtractionLogs(logs));
+  } catch {}
+  return results;
+}
+var MIN_HINDSIGHT_SHM_BYTES;
+var init_doctor_memory = __esm(() => {
+  MIN_HINDSIGHT_SHM_BYTES = 1024 * 1024 * 1024;
+});
+
 // src/cli/doctor-docker.ts
 import { readFileSync as readFileSync47 } from "node:fs";
 function imageTagOf(ref) {
@@ -31017,7 +31095,7 @@ var init_doctor_agent_smoke = __esm(() => {
 });
 
 // src/cli/doctor-vault-broker-durability.ts
-import { execFileSync as execFileSync17 } from "node:child_process";
+import { execFileSync as execFileSync18 } from "node:child_process";
 import { existsSync as existsSync54, statSync as statSync22 } from "node:fs";
 import { homedir as homedir33 } from "node:os";
 import { join as join55 } from "node:path";
@@ -31079,7 +31157,7 @@ function spawnDockerStat(p) {
 }
 function spawnDockerStatForContainer(containerName2, p) {
   try {
-    const stdout = execFileSync17("docker", ["exec", containerName2, "stat", "-c", "%i %s", p], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
+    const stdout = execFileSync18("docker", ["exec", containerName2, "stat", "-c", "%i %s", p], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
     return { status: 0, stdout, stderr: "", error: null };
   } catch (err) {
     const e = err;
@@ -31153,7 +31231,7 @@ function probeBrokerUnlocked(opts) {
 }
 function defaultBrokerStatusProbe() {
   try {
-    const out = execFileSync17("switchroom", ["vault", "broker", "status"], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
+    const out = execFileSync18("switchroom", ["vault", "broker", "status"], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
     const parsed = JSON.parse(out.trim());
     if (!parsed.running)
       return null;
@@ -31947,6 +32025,7 @@ async function checkHindsight(config) {
     detail: `${probe2.serverName} ${probe2.serverVersion} at ${host}:${port}`
   });
   results.push(checkHindsightConsumer(config));
+  results.push(...checkHindsightContainerHealth());
   for (const [agentName, agentConfig] of Object.entries(config.agents)) {
     const bankId = agentConfig.memory?.collection ?? agentName;
     const hasBankMission = !!agentConfig.memory?.bank_mission;
@@ -33076,6 +33155,7 @@ var init_doctor = __esm(() => {
   init_accounts();
   init_manifest();
   init_hindsight();
+  init_doctor_memory();
   init_doctor_docker();
   init_doctor_auth_broker();
   init_doctor_hostd();
@@ -49601,8 +49681,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.74";
-var COMMIT_SHA = "7e9ebb67";
+var VERSION = "0.14.76";
+var COMMIT_SHA = "e7ab9ec6";
 
 // src/cli/agent.ts
 init_source();
@@ -51112,6 +51192,10 @@ function seedWorkspaceBootstrapFiles(params) {
       }
       if (entry === ".gitkeep")
         continue;
+      if (params.seedMemoryFile === false && relPath.replace(/\.hbs$/, "") === "MEMORY.md") {
+        params.skipped.push(join8(agentWorkspaceDir, "MEMORY.md"));
+        continue;
+      }
       if (entry.endsWith(".hbs")) {
         const destRel = relPath.replace(/\.hbs$/, "");
         const destPath = join8(agentWorkspaceDir, destRel);
@@ -51757,7 +51841,8 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
     context,
     created,
     skipped,
-    rewrittenWithBackup
+    rewrittenWithBackup,
+    seedMemoryFile: agentConfig.memory?.file !== false
   });
   ensureClaudeMdSymlinks(phase5WorkspaceDir, created);
   const persistentHomeDir = join8(agentDir, "home");
@@ -52786,7 +52871,8 @@ ${body}
       context: workspaceContext,
       created: changes,
       skipped: [],
-      rewrittenWithBackup: changes
+      rewrittenWithBackup: changes,
+      seedMemoryFile: agentConfig.memory?.file !== false
     });
     ensureClaudeMdSymlinks(reconcileWorkspaceDir, changes);
   }
@@ -66066,6 +66152,7 @@ var HINDSIGHT_DEFAULT_RECALL_MAX_CONCURRENT = 8;
 var HINDSIGHT_DEFAULT_MEM_LIMIT = "4g";
 var HINDSIGHT_DEFAULT_MEM_RESERVATION = "2g";
 var HINDSIGHT_DEFAULT_PIDS_LIMIT = 1000;
+var HINDSIGHT_DEFAULT_SHM_SIZE = "2g";
 function isPortFree(port) {
   return new Promise((resolve27) => {
     const server = createServer4();
@@ -66156,6 +66243,7 @@ function startHindsight(ports) {
     `--memory=${HINDSIGHT_DEFAULT_MEM_LIMIT}`,
     `--memory-reservation=${HINDSIGHT_DEFAULT_MEM_RESERVATION}`,
     `--pids-limit=${HINDSIGHT_DEFAULT_PIDS_LIMIT}`,
+    `--shm-size=${HINDSIGHT_DEFAULT_SHM_SIZE}`,
     "-p",
     `127.0.0.1:${apiPort}:8888`,
     "-p",
@@ -66209,6 +66297,7 @@ function generateHindsightComposeSnippet() {
     `    mem_limit: ${HINDSIGHT_DEFAULT_MEM_LIMIT}`,
     `    mem_reservation: ${HINDSIGHT_DEFAULT_MEM_RESERVATION}`,
     `    pids_limit: ${HINDSIGHT_DEFAULT_PIDS_LIMIT}`,
+    `    shm_size: ${HINDSIGHT_DEFAULT_SHM_SIZE}`,
     "    volumes:",
     "      - switchroom-hindsight-data:/home/hindsight/.pg0",
     `      - ${HINDSIGHT_BROKER_SOCK_VOLUME}:/run/switchroom/auth-broker`,
@@ -71403,10 +71492,66 @@ async function proposeConfigEditViaHostd(args) {
   }
 }
 
+// src/web/api.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+
+// src/web/microsoft-connect.ts
+init_oauth2();
+init_resolver();
+init_client2();
+async function startMicrosoftConnect(deps = {}) {
+  const resolved = resolveMicrosoftClientId(deps.configClientId);
+  if (isVaultReference(resolved.clientId)) {
+    return { kind: "byo-vault", ref: resolved.clientId };
+  }
+  const scopes = selectMicrosoftScopes(deps.orgMode ?? false);
+  const cfg = { client_id: resolved.clientId, scopes };
+  try {
+    const device = await (deps.requestDeviceCode ?? requestDeviceCode2)(cfg);
+    return { kind: "started", device, clientId: resolved.clientId, scopes, source: resolved.source };
+  } catch (err) {
+    return { kind: "error", message: err.message };
+  }
+}
+async function runMicrosoftConnectPoll(flow, deps = {}) {
+  const now = deps.now ?? Date.now;
+  const cfg = { client_id: flow.clientId, scopes: flow.scopes };
+  let tokens;
+  try {
+    tokens = await (deps.pollDeviceToken ?? pollDeviceToken2)(cfg, flow.device, { now });
+  } catch (err) {
+    return { state: "failed", message: err.message };
+  }
+  const built = buildMicrosoftCredentials({
+    tokens,
+    clientId: flow.clientId,
+    accountEmail: "",
+    fallbackScope: flow.scopes.join(" "),
+    now
+  });
+  if (!built.credentials.microsoftOauth.refreshToken) {
+    return { state: "no-refresh-token" };
+  }
+  const account = built.resolvedEmail;
+  if (!account) {
+    return { state: "failed", message: "Microsoft returned no account identity (no id_token)." };
+  }
+  const addAccount = deps.addAccount ?? ((label, creds) => withAuthBrokerClient((client2) => client2.addAccount(label, creds, true, "microsoft")));
+  try {
+    await addAccount(account, built.credentials);
+  } catch (err) {
+    return { state: "failed", message: err.message };
+  }
+  return {
+    state: "connected",
+    account,
+    accountType: built.credentials.microsoftOauth.accountType
+  };
+}
+
 // src/web/api.ts
 init_account_store();
 init_client2();
-import { randomUUID as randomUUID4 } from "node:crypto";
 
 // telegram-plugin/registry/turns-schema.ts
 import { chmodSync as chmodSync8, mkdirSync as mkdirSync26 } from "fs";
@@ -72017,6 +72162,71 @@ function reapConnectionAccessStatuses(now = Date.now()) {
 function handleGetConnectionAccessStatus(requestId) {
   return connectionAccessStatuses.get(requestId) ?? { state: "unknown" };
 }
+var microsoftConnectStatuses = new Map;
+function reapMicrosoftConnects(now = Date.now()) {
+  for (const [id, s] of microsoftConnectStatuses) {
+    const ttl = s.state === "pending" ? s.expiresInSec * 1000 + 60000 : 30 * 60000;
+    if (now - s.startedAt > ttl)
+      microsoftConnectStatuses.delete(id);
+  }
+}
+async function handleStartMicrosoftConnect(config, deps = {}) {
+  const now = deps.now ?? Date.now;
+  const configClientId = config.microsoft_workspace?.microsoft_client_id;
+  const orgMode = deps.orgMode ?? config.microsoft_workspace?.org_mode === true;
+  const started = await startMicrosoftConnect({ ...deps, configClientId, orgMode });
+  if (started.kind === "byo-vault") {
+    return {
+      ok: false,
+      error: `This install uses a vaulted custom Microsoft app (${started.ref}) the dashboard can't read. ` + `Connect from the host: switchroom auth microsoft account add <email>.`
+    };
+  }
+  if (started.kind === "error") {
+    return { ok: false, error: started.message };
+  }
+  const requestId = randomUUID4();
+  microsoftConnectStatuses.set(requestId, {
+    state: "pending",
+    startedAt: now(),
+    userCode: started.device.user_code,
+    verificationUri: started.device.verification_uri,
+    expiresInSec: started.device.expires_in
+  });
+  reapMicrosoftConnects(now());
+  runMicrosoftConnectPoll({ device: started.device, clientId: started.clientId, scopes: started.scopes }, deps).then((res) => {
+    const startedAt = microsoftConnectStatuses.get(requestId)?.startedAt ?? now();
+    if (res.state === "connected") {
+      microsoftConnectStatuses.set(requestId, {
+        state: "connected",
+        startedAt,
+        account: res.account,
+        accountType: res.accountType
+      });
+      captureEvent("microsoft_connect", { outcome: "connected", source: "web_api" });
+    } else {
+      const reason = res.state === "no-refresh-token" ? "Microsoft returned no refresh token (account would expire in ~1h)." : res.message;
+      microsoftConnectStatuses.set(requestId, { state: "failed", startedAt, reason });
+    }
+  }).catch((err) => {
+    const startedAt = microsoftConnectStatuses.get(requestId)?.startedAt ?? now();
+    microsoftConnectStatuses.set(requestId, {
+      state: "failed",
+      startedAt,
+      reason: err instanceof Error ? err.message : String(err)
+    });
+    captureException(err, { action: "microsoft_connect" });
+  });
+  return {
+    ok: true,
+    requestId,
+    userCode: started.device.user_code,
+    verificationUri: started.device.verification_uri,
+    expiresInSec: started.device.expires_in
+  };
+}
+function handleGetMicrosoftConnectStatus(requestId) {
+  return microsoftConnectStatuses.get(requestId) ?? { state: "unknown" };
+}
 function handleSetConnectionAccess(configPath, config, args, deps = {}) {
   const provider = args.provider;
   if (provider !== "google" && provider !== "microsoft") {
@@ -72800,6 +73010,16 @@ function parseRoute(pathname, method) {
       params: { requestId: decodeURIComponent(accessStatusMatch[1]) }
     };
   }
+  if (method === "POST" && pathname === "/api/connections/microsoft/connect") {
+    return { handler: "startMicrosoftConnect", params: {} };
+  }
+  const msConnectMatch = pathname.match(/^\/api\/connections\/microsoft\/connect\/([^/]+)$/);
+  if (method === "GET" && msConnectMatch) {
+    return {
+      handler: "getMicrosoftConnectStatus",
+      params: { requestId: decodeURIComponent(msConnectMatch[1]) }
+    };
+  }
   if (method === "POST" && pathname === "/api/auth/use") {
     return { handler: "useAccount", params: {} };
   }
@@ -72976,6 +73196,13 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
           }
           case "getConnectionAccessStatus":
             return jsonResponse(handleGetConnectionAccessStatus(route.params.requestId));
+          case "startMicrosoftConnect":
+            return (async () => {
+              const result = await handleStartMicrosoftConnect(freshConfig());
+              return jsonResponse(result, result.ok ? 200 : 400);
+            })();
+          case "getMicrosoftConnectStatus":
+            return jsonResponse(handleGetMicrosoftConnectStatus(route.params.requestId));
           case "refreshQuota": {
             return (async () => {
               let body = {};
@@ -75714,7 +75941,7 @@ import {
 } from "node:fs";
 import { dirname as dirname15, join as join60 } from "node:path";
 import { homedir as homedir35 } from "node:os";
-import { execFileSync as execFileSync18 } from "node:child_process";
+import { execFileSync as execFileSync19 } from "node:child_process";
 
 class PythonEnvError extends Error {
   stderr;
@@ -75761,7 +75988,7 @@ function ensurePythonEnv(opts) {
   }
   mkdirSync33(dirname15(venvDir), { recursive: true });
   try {
-    execFileSync18(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
+    execFileSync19(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
   } catch (err) {
     const e = err;
     throw new PythonEnvError(`Failed to create venv for skill "${skillName}" with ${hostPython}: ${e.message}`, e.stderr?.toString());
@@ -75773,7 +76000,7 @@ function ensurePythonEnv(opts) {
     delete childEnv.PIP_TARGET;
     delete childEnv.PIP_PREFIX;
     delete childEnv.PYTHONUSERBASE;
-    execFileSync18(pipBin, ["install", "--disable-pip-version-check", "-r", requirementsPath], { stdio: "pipe", env: childEnv });
+    execFileSync19(pipBin, ["install", "--disable-pip-version-check", "-r", requirementsPath], { stdio: "pipe", env: childEnv });
   } catch (err) {
     const e = err;
     throw new PythonEnvError(`Failed to install requirements for skill "${skillName}": ${e.message}`, e.stderr?.toString());
@@ -75802,7 +76029,7 @@ import {
 } from "node:fs";
 import { dirname as dirname16, join as join61 } from "node:path";
 import { homedir as homedir36 } from "node:os";
-import { execFileSync as execFileSync19 } from "node:child_process";
+import { execFileSync as execFileSync20 } from "node:child_process";
 
 class NodeEnvError extends Error {
   stderr;
@@ -75886,10 +76113,10 @@ function ensureNodeEnv(opts) {
   try {
     if (installer === "bun") {
       const args = copiedLockfile ? ["install", "--frozen-lockfile"] : ["install"];
-      execFileSync19("bun", args, { cwd: envDir, stdio: "pipe" });
+      execFileSync20("bun", args, { cwd: envDir, stdio: "pipe" });
     } else {
       const args = copiedLockfile ? ["ci"] : ["install"];
-      execFileSync19("npm", args, { cwd: envDir, stdio: "pipe" });
+      execFileSync20("npm", args, { cwd: envDir, stdio: "pipe" });
     }
   } catch (err) {
     const e = err;
@@ -77217,7 +77444,7 @@ function registerDebugCommand(program3) {
 init_source();
 
 // src/worktree/claim.ts
-import { execFileSync as execFileSync20 } from "node:child_process";
+import { execFileSync as execFileSync21 } from "node:child_process";
 import { closeSync as closeSync12, mkdirSync as mkdirSync36, openSync as openSync12, existsSync as existsSync66, unlinkSync as unlinkSync13 } from "node:fs";
 import { join as join66, resolve as resolve42 } from "node:path";
 import { homedir as homedir39 } from "node:os";
@@ -77384,7 +77611,7 @@ async function claimWorktree(input, codeRepos) {
     releaseLock();
   }
   try {
-    execFileSync20("git", ["worktree", "add", "-b", branch, worktreePath], {
+    execFileSync21("git", ["worktree", "add", "-b", branch, worktreePath], {
       cwd: repoPath,
       stdio: "pipe"
     });
@@ -77397,7 +77624,7 @@ async function claimWorktree(input, codeRepos) {
 }
 
 // src/worktree/release.ts
-import { execFileSync as execFileSync21 } from "node:child_process";
+import { execFileSync as execFileSync22 } from "node:child_process";
 import { existsSync as existsSync67 } from "node:fs";
 function releaseWorktree(input) {
   const { id } = input;
@@ -77408,7 +77635,7 @@ function releaseWorktree(input) {
   let gitSuccess = true;
   if (existsSync67(record2.path)) {
     try {
-      execFileSync21("git", ["worktree", "remove", "--force", record2.path], {
+      execFileSync22("git", ["worktree", "remove", "--force", record2.path], {
         cwd: record2.repo,
         stdio: "pipe"
       });
@@ -77444,16 +77671,16 @@ function listWorktrees() {
 }
 
 // src/worktree/reaper.ts
-import { execFileSync as execFileSync22 } from "node:child_process";
+import { execFileSync as execFileSync23 } from "node:child_process";
 import { existsSync as existsSync68 } from "node:fs";
 var STALE_THRESHOLD_MS = 10 * 60 * 1000;
 function isPathInUse(path7) {
   try {
-    execFileSync22("fuser", [path7], { stdio: "pipe" });
+    execFileSync23("fuser", [path7], { stdio: "pipe" });
     return true;
   } catch {}
   try {
-    const out = execFileSync22("lsof", ["-t", path7], {
+    const out = execFileSync23("lsof", ["-t", path7], {
       stdio: ["ignore", "pipe", "ignore"]
     }).toString().trim();
     if (out.length > 0)
@@ -77463,7 +77690,7 @@ function isPathInUse(path7) {
 }
 function hasUncommittedChanges(repoPath, worktreePath) {
   try {
-    const out = execFileSync22("git", ["-C", worktreePath, "status", "--porcelain"], { stdio: "pipe" }).toString();
+    const out = execFileSync23("git", ["-C", worktreePath, "status", "--porcelain"], { stdio: "pipe" }).toString();
     return out.trim().length > 0;
   } catch {
     return false;
@@ -77477,7 +77704,7 @@ function reapRecord(record2) {
       warning = `[worktree-reaper] Reaped worktree with uncommitted changes: ` + `id=${id} branch=${branch} agent=${ownerAgent ?? "unknown"} path=${path7}`;
     }
     try {
-      execFileSync22("git", ["worktree", "remove", "--force", path7], {
+      execFileSync23("git", ["worktree", "remove", "--force", path7], {
         cwd: repo,
         stdio: "pipe"
       });
@@ -78960,7 +79187,7 @@ agents:
 init_resolver();
 import { dirname as dirname21, join as join72, resolve as resolve44 } from "node:path";
 import { homedir as homedir41 } from "node:os";
-import { execFileSync as execFileSync23 } from "node:child_process";
+import { execFileSync as execFileSync24 } from "node:child_process";
 init_vault();
 init_loader();
 init_loader();
@@ -79368,7 +79595,7 @@ async function ensureHostMountSources(config) {
 }
 function detectComposeV2() {
   try {
-    const out = execFileSync23("docker", ["compose", "version"], {
+    const out = execFileSync24("docker", ["compose", "version"], {
       stdio: ["ignore", "pipe", "pipe"],
       encoding: "utf8"
     });

package/dist/cli/ui/index.html

@@ -559,6 +559,51 @@
       }
     }
 
+    // Start an in-browser Microsoft connect: show the device code + link,
+    // then poll until the operator completes sign-in on Microsoft's site.
+    async function connectMicrosoft() {
+      const card = document.getElementById('ms-connect-card');
+      const show = (html) => { if (card) card.innerHTML = html; };
+      show('<div class="loading" style="padding:.8rem">Starting…</div>');
+      try {
+        const res = await fetch(`${API}/api/connections/microsoft/connect`, { method: 'POST', headers: authHeaders() });
+        const data = await res.json();
+        if (!res.ok || !data.ok) { show(''); showError(data.error || `HTTP ${res.status}`); return; }
+        const url = data.verificationUri, code = data.userCode;
+        show(`<div class="account-card" style="border-color:var(--accent)">
+            <div class="account-card-header"><div class="account-label">Connect a Microsoft account</div></div>
+            <div style="padding:.3rem 0;line-height:1.7">
+              1. Open <a href="${escapeHtml(url)}" target="_blank" rel="noopener" style="color:var(--accent)">${escapeHtml(url)}</a><br>
+              2. Enter code: <code style="font-size:1.15rem;letter-spacing:.08em">${escapeHtml(code)}</code><br>
+              3. Approve the requested permissions (Mail, Calendar, Files).
+            </div>
+            <div id="ms-connect-status" style="color:var(--text-dim);margin-top:.3rem">Waiting for sign-in… (this card expires in ~15 min)</div>
+          </div>`);
+        const statusEl = () => document.getElementById('ms-connect-status');
+        const started = Date.now();
+        const poll = async () => {
+          const sres = await fetch(`${API}/api/connections/microsoft/connect/${encodeURIComponent(data.requestId)}`, { headers: authHeaders() });
+          const s = sres.ok ? await sres.json() : { state: 'failed', reason: `HTTP ${sres.status}` };
+          if (s.state === 'pending') {
+            if (Date.now() - started > ((data.expiresInSec || 900) * 1000 + 30000)) { const e = statusEl(); if (e) e.textContent = 'Expired — click Connect to try again.'; return; }
+            setTimeout(poll, 3000);
+            return;
+          }
+          if (s.state === 'connected') {
+            show(`<div class="loading" style="padding:.8rem;color:var(--green)">✓ Connected ${escapeHtml(s.account)} (${escapeHtml(s.accountType)}). Use the access toggles below to grant an agent.</div>`);
+            fetchConnections();
+          } else {
+            show('');
+            showError(s.reason || 'connect failed');
+          }
+        };
+        setTimeout(poll, 3000);
+      } catch (err) {
+        show('');
+        showError(err.message);
+      }
+    }
+
     async function fetchSchedule() {
       try {
         const res = await fetch(`${API}/api/schedule`, { headers: authHeaders() });
@@ -1115,11 +1160,18 @@
         google.map(a => renderOAuthAccountCard(a, { showType: false, provider: 'google', agentNames })).join(''),
       );
 
-      const microsoftSection = _connectionSection(
-        'Microsoft 365',
-        'No Microsoft accounts. Connect one from Telegram with <code>/connect microsoft</code> (admin DM), or <code>switchroom auth microsoft account add</code>.',
-        microsoft.map(a => renderOAuthAccountCard(a, { showType: true, provider: 'microsoft', agentNames })).join(''),
-      );
+      const msCards = microsoft.map(a => renderOAuthAccountCard(a, { showType: true, provider: 'microsoft', agentNames })).join('');
+      const microsoftSection = `
+        <div style="margin-bottom:1.5rem">
+          <h3 style="margin:0 0 .6rem;font-size:.95rem;color:var(--text-dim);text-transform:uppercase;letter-spacing:.04em">
+            Microsoft 365
+            <button onclick="connectMicrosoft()" class="usage-pill primary" style="margin-left:.6rem;cursor:pointer;border:none;text-transform:none;font-weight:600">+ Connect a Microsoft account</button>
+          </h3>
+          <div id="ms-connect-card"></div>
+          ${msCards
+            ? `<div class="accounts-grid">${msCards}</div>`
+            : `<div class="loading" style="padding:.8rem">No Microsoft accounts yet — click <b>Connect a Microsoft account</b> above (or <code>/connect microsoft</code> from Telegram).</div>`}
+        </div>`;
 
       let notionCards = '';
       if (notion.configured) {

package/dist/host-control/main.js

@@ -13726,6 +13726,7 @@ var AgentToolsSchema = exports_external.object({
 var AgentMemorySchema = exports_external.object({
   collection: exports_external.string().describe("Hindsight collection name for this agent"),
   auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
+  file: exports_external.boolean().default(true).describe("Maintain a curated workspace MEMORY.md file (seeded once, " + "auto-loaded every turn). Set false for hindsight-only memory: " + "the file is not seeded or re-created, so once migrated into " + "Hindsight and deleted it stays gone. Recall + directives carry " + "the memory instead. Cascade: override (per-agent wins over default)."),
   isolation: exports_external.enum(["default", "strict"]).default("default").describe("strict = never shared cross-agent, default = eligible for reflect"),
   bank_mission: exports_external.string().optional().describe("Bank-level mission statement used during recall to contextualize results"),
   retain_mission: exports_external.string().optional().describe("Instructions for the fact extraction LLM during retain"),
@@ -13945,6 +13946,7 @@ var profileFields = {
   memory: exports_external.object({
     collection: exports_external.string().optional(),
     auto_recall: exports_external.boolean().optional(),
+    file: exports_external.boolean().optional(),
     isolation: exports_external.enum(["default", "strict"]).optional(),
     recall: exports_external.object({
       max_memories: exports_external.number().int().min(0).optional(),

package/dist/vault/approvals/kernel-server.js

@@ -11312,6 +11312,7 @@ var init_schema = __esm(() => {
   AgentMemorySchema = exports_external.object({
     collection: exports_external.string().describe("Hindsight collection name for this agent"),
     auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
+    file: exports_external.boolean().default(true).describe("Maintain a curated workspace MEMORY.md file (seeded once, " + "auto-loaded every turn). Set false for hindsight-only memory: " + "the file is not seeded or re-created, so once migrated into " + "Hindsight and deleted it stays gone. Recall + directives carry " + "the memory instead. Cascade: override (per-agent wins over default)."),
     isolation: exports_external.enum(["default", "strict"]).default("default").describe("strict = never shared cross-agent, default = eligible for reflect"),
     bank_mission: exports_external.string().optional().describe("Bank-level mission statement used during recall to contextualize results"),
     retain_mission: exports_external.string().optional().describe("Instructions for the fact extraction LLM during retain"),
@@ -11531,6 +11532,7 @@ var init_schema = __esm(() => {
     memory: exports_external.object({
       collection: exports_external.string().optional(),
       auto_recall: exports_external.boolean().optional(),
+      file: exports_external.boolean().optional(),
       isolation: exports_external.enum(["default", "strict"]).optional(),
       recall: exports_external.object({
         max_memories: exports_external.number().int().min(0).optional(),

package/dist/vault/broker/server.js

@@ -11312,6 +11312,7 @@ var init_schema = __esm(() => {
   AgentMemorySchema = exports_external.object({
     collection: exports_external.string().describe("Hindsight collection name for this agent"),
     auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
+    file: exports_external.boolean().default(true).describe("Maintain a curated workspace MEMORY.md file (seeded once, " + "auto-loaded every turn). Set false for hindsight-only memory: " + "the file is not seeded or re-created, so once migrated into " + "Hindsight and deleted it stays gone. Recall + directives carry " + "the memory instead. Cascade: override (per-agent wins over default)."),
     isolation: exports_external.enum(["default", "strict"]).default("default").describe("strict = never shared cross-agent, default = eligible for reflect"),
     bank_mission: exports_external.string().optional().describe("Bank-level mission statement used during recall to contextualize results"),
     retain_mission: exports_external.string().optional().describe("Instructions for the fact extraction LLM during retain"),
@@ -11531,6 +11532,7 @@ var init_schema = __esm(() => {
     memory: exports_external.object({
       collection: exports_external.string().optional(),
       auto_recall: exports_external.boolean().optional(),
+      file: exports_external.boolean().optional(),
       isolation: exports_external.enum(["default", "strict"]).optional(),
       recall: exports_external.object({
         max_memories: exports_external.number().int().min(0).optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.74",
+  "version": "0.14.76",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -23815,6 +23815,7 @@ var init_schema = __esm(() => {
   AgentMemorySchema = exports_external.object({
     collection: exports_external.string().describe("Hindsight collection name for this agent"),
     auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
+    file: exports_external.boolean().default(true).describe("Maintain a curated workspace MEMORY.md file (seeded once, " + "auto-loaded every turn). Set false for hindsight-only memory: " + "the file is not seeded or re-created, so once migrated into " + "Hindsight and deleted it stays gone. Recall + directives carry " + "the memory instead. Cascade: override (per-agent wins over default)."),
     isolation: exports_external.enum(["default", "strict"]).default("default").describe("strict = never shared cross-agent, default = eligible for reflect"),
     bank_mission: exports_external.string().optional().describe("Bank-level mission statement used during recall to contextualize results"),
     retain_mission: exports_external.string().optional().describe("Instructions for the fact extraction LLM during retain"),
@@ -24034,6 +24035,7 @@ var init_schema = __esm(() => {
     memory: exports_external.object({
       collection: exports_external.string().optional(),
       auto_recall: exports_external.boolean().optional(),
+      file: exports_external.boolean().optional(),
       isolation: exports_external.enum(["default", "strict"]).optional(),
       recall: exports_external.object({
         max_memories: exports_external.number().int().min(0).optional(),
@@ -52819,10 +52821,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.74";
-var COMMIT_SHA = "7e9ebb67";
-var COMMIT_DATE = "2026-06-06T02:56:40Z";
-var LATEST_PR = 2189;
+var VERSION = "0.14.76";
+var COMMIT_SHA = "e7ab9ec6";
+var COMMIT_DATE = "2026-06-06T08:50:42Z";
+var LATEST_PR = 2196;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts