switchroom 0.15.38 → 0.15.39

package/dist/cli/switchroom.js

@@ -31571,6 +31571,13 @@ var init_doctor_notion = __esm(() => {
 });
 
 // src/cli/doctor-mcp-secrets.ts
+function entryScopeDenies(agent, allow, deny) {
+  if (deny.includes(agent))
+    return true;
+  if (allow.length > 0 && !allow.includes(agent))
+    return true;
+  return false;
+}
 function computeMcpSecretRequirements(config) {
   const cfg = config;
   const reqs = [];
@@ -31650,20 +31657,19 @@ async function runMcpSecretChecks(config, deps = {}) {
         });
         continue;
       }
-      if (!acl.allow.includes(r.agent)) {
-        const updated = [...new Set([...acl.allow, r.agent])].sort().join(",");
+      if (entryScopeDenies(r.agent, acl.allow, acl.deny)) {
         results.push({
           name,
           status: "fail",
-          detail: `agent '${r.agent}' loads MCP '${r.server}' but is NOT on the vault ACL for '${key}' \u2014 the broker will deny it at runtime`,
-          fix: `switchroom vault set ${key} --allow ${updated} (vault set overwrites the scope \u2014 re-state the full list including '${r.agent}').`
+          detail: `agent '${r.agent}' loads MCP '${r.server}' but the vault entry scope for '${key}' denies it \u2014 the broker will deny at runtime`,
+          fix: `switchroom vault set ${key} --allow ${[...new Set([...acl.allow, r.agent])].sort().join(",")} (vault set overwrites the scope \u2014 re-state the full list including '${r.agent}'; and drop it from --deny if present).`
         });
         continue;
       }
       results.push({
         name,
         status: "ok",
-        detail: `MCP '${r.server}' \u2192 '${key}' present + ACL-allowed`
+        detail: `MCP '${r.server}' \u2192 '${key}' present + scope-allowed`
       });
     }
   }
@@ -34014,7 +34020,11 @@ function registerDoctorCommand(program3) {
         const { getViaBrokerStructured: getViaBrokerStructured2 } = await Promise.resolve().then(() => (init_client(), exports_client));
         const result = await getViaBrokerStructured2(key);
         if (result.kind === "ok") {
-          return { kind: "ok", allow: result.entry.scope?.allow ?? [] };
+          return {
+            kind: "ok",
+            allow: result.entry.scope?.allow ?? [],
+            deny: result.entry.scope?.deny ?? []
+          };
         }
         if (result.kind === "not_found")
           return { kind: "not_found" };
@@ -50692,8 +50702,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.15.38";
-var COMMIT_SHA = "d28a331f";
+var VERSION = "0.15.39";
+var COMMIT_SHA = "69e5a2e8";
 
 // src/cli/agent.ts
 init_source();
@@ -68599,6 +68609,8 @@ var HINDSIGHT_DEFAULT_MEM_LIMIT = "4g";
 var HINDSIGHT_DEFAULT_MEM_RESERVATION = "2g";
 var HINDSIGHT_DEFAULT_PIDS_LIMIT = 1000;
 var HINDSIGHT_DEFAULT_SHM_SIZE = "2g";
+var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
+var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 function isPortFree(port) {
   return new Promise((resolve28) => {
     const server = createServer4();
@@ -68690,6 +68702,16 @@ function startHindsight(ports) {
     `--memory-reservation=${HINDSIGHT_DEFAULT_MEM_RESERVATION}`,
     `--pids-limit=${HINDSIGHT_DEFAULT_PIDS_LIMIT}`,
     `--shm-size=${HINDSIGHT_DEFAULT_SHM_SIZE}`,
+    "--health-cmd",
+    HINDSIGHT_HEALTHCHECK_CMD,
+    "--health-interval",
+    "30s",
+    "--health-timeout",
+    "5s",
+    "--health-retries",
+    "3",
+    "--health-start-period",
+    "60s",
     "-p",
     `127.0.0.1:${apiPort}:8888`,
     "-p",
@@ -68697,6 +68719,8 @@ function startHindsight(ports) {
     "-v",
     "switchroom-hindsight-data:/home/hindsight/.pg0",
     "-v",
+    "switchroom-hindsight-backups:/backups",
+    "-v",
     `${HINDSIGHT_BROKER_SOCK_VOLUME}:/run/switchroom/auth-broker`,
     "--tmpfs",
     `/run/claude-creds:rw,mode=0700,uid=${HINDSIGHT_DEFAULT_UID},gid=${HINDSIGHT_DEFAULT_UID}`,
@@ -68744,8 +68768,15 @@ function generateHindsightComposeSnippet() {
     `    mem_reservation: ${HINDSIGHT_DEFAULT_MEM_RESERVATION}`,
     `    pids_limit: ${HINDSIGHT_DEFAULT_PIDS_LIMIT}`,
     `    shm_size: ${HINDSIGHT_DEFAULT_SHM_SIZE}`,
+    "    healthcheck:",
+    `      test: ${JSON.stringify(["CMD", "python3", "-c", HINDSIGHT_HEALTHCHECK_PY])}`,
+    "      interval: 30s",
+    "      timeout: 5s",
+    "      retries: 3",
+    "      start_period: 60s",
     "    volumes:",
     "      - switchroom-hindsight-data:/home/hindsight/.pg0",
+    "      - switchroom-hindsight-backups:/backups",
     `      - ${HINDSIGHT_BROKER_SOCK_VOLUME}:/run/switchroom/auth-broker`,
     "    tmpfs:",
     `      - /run/claude-creds:rw,mode=0700,uid=${HINDSIGHT_DEFAULT_UID},gid=${HINDSIGHT_DEFAULT_UID}`,
@@ -68753,6 +68784,7 @@ function generateHindsightComposeSnippet() {
     "",
     "volumes:",
     "  switchroom-hindsight-data:",
+    "  switchroom-hindsight-backups:",
     `  ${HINDSIGHT_BROKER_SOCK_VOLUME}:`,
     "    external: true",
     "    # Bound by the switchroom-auth-broker singleton in the main",
@@ -83273,14 +83305,14 @@ async function computeAgentConnectionIssues(config, agentName, vaultAclReader) {
         });
         continue;
       }
-      if (!acl.allow.includes(agentName)) {
+      if (entryScopeDenies(agentName, acl.allow, acl.deny)) {
         const updated = [...new Set([...acl.allow, agentName])].sort().join(",");
         issues.push({
           server: r.server,
           key,
           kind: "acl",
-          detail: `MCP '${r.server}' not on the vault ACL for '${key}' \u2014 broker will deny at runtime`,
-          fix: `switchroom vault set ${key} --allow ${updated} (re-state the full list)`
+          detail: `MCP '${r.server}' \u2014 vault entry scope for '${key}' denies this agent \u2014 broker will deny at runtime`,
+          fix: `switchroom vault set ${key} --allow ${updated} (re-state the full list; drop from --deny if present)`
         });
       }
     }
@@ -83710,7 +83742,11 @@ Applying switchroom config...
       const { getViaBrokerStructured: getViaBrokerStructured2 } = await Promise.resolve().then(() => (init_client(), exports_client));
       const result = await getViaBrokerStructured2(key);
       if (result.kind === "ok") {
-        return { kind: "ok", allow: result.entry.scope?.allow ?? [] };
+        return {
+          kind: "ok",
+          allow: result.entry.scope?.allow ?? [],
+          deny: result.entry.scope?.deny ?? []
+        };
       }
       if (result.kind === "not_found")
         return { kind: "not_found" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.15.38",
+  "version": "0.15.39",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/default/CLAUDE.md.hbs

@@ -28,6 +28,8 @@ You are operating in the **{{topicName}}** {{#if topicEmoji}}{{topicEmoji}} {{/i
 - Prefer `trash` over `rm` when available (recoverable beats gone forever).
 - Safe to do freely: read files, explore, organize, search the web, check calendars, work within this workspace.
 - Ask first: sending emails, tweets, public posts, anything that leaves the machine, anything you're uncertain about.
+- **Batch foreseeable approvals; don't drip surprises.** When you can already see that several actions will each need the user's approval, tell them up front which approvals are coming and why. Request independent ones together so they can decide once; for dependent ones (one's input comes from another), say what you're doing first and what approval comes next — a permission card should never arrive out of the blue.
+- **A timed-out approval isn't a denial.** If a request came back denied only because the user was away (a timeout, not an explicit "no"), don't silently abandon it. When they're back, remind them it's still pending and re-offer it if they still want it.
 
 ## Execution Bias
 

package/telegram-plugin/dist/gateway/gateway.js

@@ -54519,11 +54519,11 @@ function readTurnActiveMarkerAgeMs(stateDir, now) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.15.38";
-var COMMIT_SHA = "d28a331f";
-var COMMIT_DATE = "2026-06-18T11:43:40+10:00";
+var VERSION = "0.15.39";
+var COMMIT_SHA = "69e5a2e8";
+var COMMIT_DATE = "2026-06-18T12:27:21+10:00";
 var LATEST_PR = null;
-var COMMITS_AHEAD_OF_TAG = 13;
+var COMMITS_AHEAD_OF_TAG = 4;
 
 // gateway/boot-version.ts
 function formatRelativeAgo(iso) {