switchroom 0.16.47 → 0.17.0

package/dist/cli/ui/index.html

@@ -2392,8 +2392,20 @@
         return;
       }
 
+      // Worst-first posture strip + sort — not-active (down) or auth-failed
+      // agents are the ones that need attention; surface them first.
+      const needsAttention = (a) => a.active !== 'active' || a.auth.authenticated === false;
+      const attnAgents = agents.filter(needsAttention);
+      const cleanAgents = agents.filter(a => !needsAttention(a));
+      const posture = `
+        <div class="ac-posture" style="grid-column:1/-1;margin:0 0 0.4rem;justify-content:flex-start">
+          <span class="ac-stat attn"><span class="n">${attnAgents.length}</span><span class="l">need attention</span></span>
+          <span class="ac-stat clean"><span class="n">${cleanAgents.length}</span><span class="l">running clean</span></span>
+        </div>`;
+      const sortedAgents = attnAgents.concat(cleanAgents);
+
       container.className = 'agents-grid';
-      container.innerHTML = agents.map(a => `
+      container.innerHTML = posture + sortedAgents.map(a => `
         <div class="agent-card" data-agent="${escapeHtml(a.name)}">
           <div class="card-header" onclick="toggleLogs('${escapeHtml(a.name)}')">
             <div class="status-dot ${statusClass(a)}" title="${escapeHtml(a.active)} · bridge heartbeat (not a claude-liveness signal)"></div>
@@ -2731,15 +2743,36 @@
       const updating = h.stale
         ? `<span style="color:var(--text-dim);font-size:.7rem;margin-left:.4rem">(updating…)</span>`
         : '';
+
+      // Worst-first posture strip — same "attention vs clean" pattern as
+      // Fleet Health / Accounts. hostd counts as attention when the audit
+      // log is missing/erroring OR any recent verb actually failed (not
+      // the benign in-flight "started" state).
+      const hostdHasFailure = !!(hd.recent && hd.recent.some(e =>
+        e.result === 'error' || (e.exit_code != null && e.exit_code !== 0)));
+      const services = [
+        { key: 'broker', ok: !!b.reachable, name: 'auth-broker', dotOk: b.reachable,
+          html: `<div class="agent-card"><div class="card-header" style="cursor:default">${dot(b.reachable)}<span class="agent-name">auth-broker</span></div><div style="padding:0 1.25rem 1rem">${brokerBody}</div></div>` },
+        { key: 'hindsight', ok: hs.running !== false, name: 'hindsight', dotOk: hs.running,
+          html: `<div class="agent-card"><div class="card-header" style="cursor:default">${dot(hs.running)}<span class="agent-name">hindsight</span></div><div style="padding:0 1.25rem 1rem">${hindsightBody}</div></div>` },
+      ];
+      const attnCount = services.filter(s => !s.ok).length + (hd.auditLogPresent && !hostdHasFailure ? 0 : 1);
+      const cleanCount = services.length + 1 - attnCount;
+      const posture = `
+        <div class="ac-posture" style="margin:0 0 0.6rem;justify-content:flex-start">
+          <span class="ac-stat attn"><span class="n">${attnCount}</span><span class="l">need attention</span></span>
+          <span class="ac-stat clean"><span class="n">${cleanCount}</span><span class="l">clean</span></span>
+        </div>`;
+      // Sort the service cards worst-first (down services surface before
+      // healthy ones) — the hostd card stays pinned below since it's a
+      // wider table, not part of the two-up grid.
+      const servicesSorted = services.slice().sort((a, b2) => (a.ok === b2.ok) ? 0 : a.ok ? 1 : -1);
+
       container.innerHTML = `
         ${updating ? `<div style="margin-bottom:.4rem">System health ${updating}</div>` : ''}
+        ${posture}
         <div class="agents-grid">
-          <div class="agent-card"><div class="card-header" style="cursor:default">
-            ${dot(b.reachable)}<span class="agent-name">auth-broker</span></div>
-            <div style="padding:0 1.25rem 1rem">${brokerBody}</div></div>
-          <div class="agent-card"><div class="card-header" style="cursor:default">
-            ${dot(hs.running)}<span class="agent-name">hindsight</span></div>
-            <div style="padding:0 1.25rem 1rem">${hindsightBody}</div></div>
+          ${servicesSorted.map(s => s.html).join('')}
         </div>
         <div class="agent-card" style="margin-top:1rem"><div class="card-header" style="cursor:default">
           ${dot(hd.auditLogPresent)}<span class="agent-name">hostd — recent privileged verbs</span></div>
@@ -2848,6 +2881,25 @@
       const linear = data.linear || { configured: false, agents: [] };
       const agentNames = data.agentNames || [];
 
+      // Worst-first: a config-only account (no live broker slot — never
+      // actually connected) is the real "needs attention" signal here. A
+      // brokerKnown account past its (short-lived) access-token expiry is
+      // NOT broken — it auto-refreshes on next use via the refresh token —
+      // so it must NOT be sorted/flagged as an attention item (matches the
+      // "don't alarm on auto-refresh" fix in renderOAuthAccountCard above).
+      const isConnBroken = (a) => a.brokerKnown === false;
+      const worstFirst = (list) => list.slice().sort((a, b) => (isConnBroken(a) === isConnBroken(b)) ? 0 : isConnBroken(a) ? -1 : 1);
+      const googleSorted = worstFirst(google);
+      const microsoftSorted = worstFirst(microsoft);
+      const oauthAttn = google.filter(isConnBroken).length + microsoft.filter(isConnBroken).length;
+      const oauthClean = (google.length + microsoft.length) - oauthAttn;
+      const posture = (google.length + microsoft.length) > 0
+        ? `<div class="ac-posture" style="margin:0 0 1rem;justify-content:flex-start">
+             <span class="ac-stat attn"><span class="n">${oauthAttn}</span><span class="l">need attention</span></span>
+             <span class="ac-stat clean"><span class="n">${oauthClean}</span><span class="l">connected</span></span>
+           </div>`
+        : '';
+
       // When a provider's fetch FAILED (not genuinely empty), its empty-state
       // must say "couldn't load", never "none configured" — otherwise a
       // transient blip reads as "you have no accounts".
@@ -2856,10 +2908,10 @@
         data.googleFailed
           ? "Couldn't load Google accounts — the data source was unreachable (retrying)."
           : 'No Google accounts. Add one under <code>google_accounts:</code> and run <code>switchroom auth google account add</code>.',
-        google.map(a => renderOAuthAccountCard(a, { showType: false, provider: 'google', agentNames })).join(''),
+        googleSorted.map(a => renderOAuthAccountCard(a, { showType: false, provider: 'google', agentNames })).join(''),
       );
 
-      const msCards = microsoft.map(a => renderOAuthAccountCard(a, { showType: true, provider: 'microsoft', agentNames })).join('');
+      const msCards = microsoftSorted.map(a => renderOAuthAccountCard(a, { showType: true, provider: 'microsoft', agentNames })).join('');
       const msEmpty = data.microsoftFailed
         ? "Couldn't load Microsoft accounts — the data source was unreachable (retrying)."
         : 'No Microsoft accounts yet — click <b>Connect a Microsoft account</b> above (or <code>/connect microsoft</code> from Telegram).';
@@ -2957,7 +3009,7 @@
         ? renderProblem(problemFor('connections-unreachable', {}))
         : '';
 
-      container.innerHTML = unreachableBanner + degradedBanner + googleSection + microsoftSection + notionSection + linearSection;
+      container.innerHTML = unreachableBanner + degradedBanner + posture + googleSection + microsoftSection + notionSection + linearSection;
     }
 
     function renderSchedule(data) {
@@ -3050,7 +3102,27 @@
           </div>`;
       };
 
-      const cards = Object.keys(byAgent).sort().map(agent => {
+      // Worst-first: an agent whose most recent fire for ANY of its crons
+      // failed (non-zero exit) needs attention before agents whose fires
+      // are all clean (or unfired). Posture strip mirrors the Fleet
+      // Health / Accounts "need attention vs clean" pattern.
+      const agentHasFailure = (agent) => {
+        const agentFires = recent[agent] || [];
+        return byAgent[agent].some(e => {
+          const latest = agentFires.filter(f => f.promptKey === e.promptKey).slice(-1)[0];
+          return latest && latest.exitCode !== 0;
+        });
+      };
+      const agentNamesSorted = Object.keys(byAgent).sort();
+      const attnAgentNames = agentNamesSorted.filter(agentHasFailure);
+      const cleanAgentNames = agentNamesSorted.filter(a => !agentHasFailure(a));
+      const posture = `
+        <div class="ac-posture" style="margin:0 0 0.8rem;justify-content:flex-start">
+          <span class="ac-stat attn"><span class="n">${attnAgentNames.length}</span><span class="l">need attention</span></span>
+          <span class="ac-stat clean"><span class="n">${cleanAgentNames.length}</span><span class="l">clean</span></span>
+        </div>`;
+
+      const cards = attnAgentNames.concat(cleanAgentNames).map(agent => {
         const agentFires = recent[agent] || [];
         const list = byAgent[agent].map(e => renderCron(e, agentFires)).join('');
         return `
@@ -3062,7 +3134,7 @@
           <div style="padding:.5rem 1.25rem 1rem">${list}</div>
         </div>`;
       }).join('');
-      container.innerHTML = degradedBanner + truncatedNote + cards;
+      container.innerHTML = degradedBanner + truncatedNote + posture + cards;
     }
 
     function renderApprovals(data, grants) {

package/dist/host-control/main.js

@@ -15903,7 +15903,9 @@ var SessionContinuitySchema = exports_external.object({
   enabled: exports_external.boolean().optional().describe("Master switch for the session-handoff briefing (default true)."),
   max_turns_in_briefing: exports_external.number().int().positive().optional().describe("Cap on recent user/assistant turn pairs fed to the summarizer."),
   resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
-  resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale.")
+  resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale."),
+  session_retention_max_count: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): keep at most this many " + "newest session transcripts under .claude/projects; older ones " + "past both this count and the age bound are pruned by the Stop " + "hook. The newest sessions (and the handoff source) are always " + "kept. Default 20; set 0 to disable the count bound."),
+  session_retention_max_age_days: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): prune session transcripts " + "older than this many days (a file is deleted only when it is BOTH " + "over the count bound and older than this). Default 30; set 0 to " + "disable the age bound.")
 }).optional();
 var webhookDispatchRule = exports_external.object({
   description: exports_external.string().optional(),
@@ -17184,6 +17186,36 @@ var CONTAINER_DEFAULT_UTC_ZONES = new Set([
   "Universal"
 ]);
 
+// src/broker-common/peercred-path.ts
+function matchSocketName(socketPath, patterns, maxNameLen) {
+  if (typeof socketPath !== "string" || socketPath.length === 0)
+    return null;
+  let name = null;
+  for (const re of patterns) {
+    const m = socketPath.match(re);
+    if (m && typeof m[1] === "string") {
+      name = m[1];
+      break;
+    }
+  }
+  if (name === null || name.length === 0)
+    return null;
+  if (maxNameLen !== undefined && name.length > maxNameLen)
+    return null;
+  return name;
+}
+function parseSocketIdentity(socketPath, spec) {
+  const name = matchSocketName(socketPath, spec.patterns, spec.maxNameLen);
+  if (name === null)
+    return null;
+  const operatorName = spec.operatorName ?? "operator";
+  if (name === operatorName)
+    return { kind: "operator" };
+  if (spec.reservedNames.has(name))
+    return null;
+  return { kind: "agent", name };
+}
+
 // src/vault/broker/peercred.ts
 var RESERVED_AGENT_NAMES = new Set(["operator", "hostd"]);
 function isReservedAgentName(name) {
@@ -22179,17 +22211,10 @@ var SOCKET_PATH_CONTAINER_SUBDIR_RE = /^\/run\/switchroom\/hostd\/([a-zA-Z0-9][a
 var SOCKET_PATH_HOST_SUBDIR_RE = /\/\.switchroom\/hostd\/([a-zA-Z0-9][a-zA-Z0-9_-]*)\/sock$/;
 var RESERVED_AGENT_NAMES2 = new Set(["operator", "hostd"]);
 function socketPathToIdentity(socketPath) {
-  if (typeof socketPath !== "string" || socketPath.length === 0)
-    return null;
-  const m = socketPath.match(SOCKET_PATH_CONTAINER_SUBDIR_RE) ?? socketPath.match(SOCKET_PATH_HOST_SUBDIR_RE);
-  if (!m)
-    return null;
-  const name = m[1];
-  if (name === "operator")
-    return { kind: "operator" };
-  if (RESERVED_AGENT_NAMES2.has(name))
-    return null;
-  return { kind: "agent", name };
+  return parseSocketIdentity(socketPath, {
+    patterns: [SOCKET_PATH_CONTAINER_SUBDIR_RE, SOCKET_PATH_HOST_SUBDIR_RE],
+    reservedNames: RESERVED_AGENT_NAMES2
+  });
 }
 
 // telegram-plugin/secret-detect/patterns.ts
@@ -22624,7 +22649,7 @@ import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:f
 import { dirname as dirname4, join as join2 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.15.48";
+var VERSION = "0.17.0";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
@@ -24478,19 +24503,30 @@ class HostdServer {
       const recoveryNote = recRes2.exit_code === 0 ? "rolled back successfully" : `rolled back but recovery reconcile also failed (exit ${recRes2.exit_code})`;
       await approval.finalize({
         outcome: "reconcile_failed_rolled_back",
-        detail: recoveryNote
+        detail: `${recoveryNote}; reconcile stderr: ${tail(recRes.stderr, 512) || "(empty)"}`
       });
-      return this.reconcileFailedRolledBack(`reconcile exit ${recRes.exit_code}; ${recoveryNote}`, req, caller, started);
+      return this.reconcileFailedRolledBack(`reconcile exit ${recRes.exit_code}; ${recoveryNote}`, req, caller, started, { primary: recRes, recovery: recRes2 });
     } finally {
       release();
     }
   }
-  reconcileFailedRolledBack(detail, req, caller, started) {
+  reconcileFailedRolledBack(detail, req, caller, started, output) {
     const legacy = `E_RECONCILE_FAILED_ROLLED_BACK: ${detail}`;
     const built = err("E_RECONCILE_FAILED_ROLLED_BACK", "config write or reconcile failed; live file rolled back to snapshot").why(detail).fixOperatorAction("infra", [
       "inspect hostd logs + switchroom apply output to identify the underlying failure"
     ]).op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).build(req.request_id, Date.now() - started);
-    return { ...built, error: legacy };
+    const resp = { ...built, error: legacy };
+    if (output) {
+      const recoveryStdout = output.recovery && output.recovery.exit_code !== 0 ? `
+--- recovery reconcile stdout ---
+${output.recovery.stdout}` : "";
+      const recoveryStderr = output.recovery && output.recovery.exit_code !== 0 ? `
+--- recovery reconcile stderr ---
+${output.recovery.stderr}` : "";
+      resp.stdout_tail = tail(output.primary.stdout + recoveryStdout);
+      resp.stderr_tail = tail(output.primary.stderr + recoveryStderr);
+    }
+    return resp;
   }
   configApplyLock = Promise.resolve();
   async acquireConfigApplyLock() {

package/dist/vault/approvals/kernel-server.js

@@ -4151,7 +4151,9 @@ var init_schema = __esm(() => {
     enabled: exports_external.boolean().optional().describe("Master switch for the session-handoff briefing (default true)."),
     max_turns_in_briefing: exports_external.number().int().positive().optional().describe("Cap on recent user/assistant turn pairs fed to the summarizer."),
     resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
-    resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale.")
+    resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale."),
+    session_retention_max_count: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): keep at most this many " + "newest session transcripts under .claude/projects; older ones " + "past both this count and the age bound are pruned by the Stop " + "hook. The newest sessions (and the handoff source) are always " + "kept. Default 20; set 0 to disable the count bound."),
+    session_retention_max_age_days: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): prune session transcripts " + "older than this many days (a file is deleted only when it is BOTH " + "over the count bound and older than this). Default 30; set 0 to " + "disable the age bound.")
   }).optional();
   webhookDispatchRule = exports_external.object({
     description: exports_external.string().optional(),
@@ -13250,6 +13252,7 @@ function openKernelDb(dbPath) {
     chmodSync(dbPath, 384);
   } catch {}
   db.run("PRAGMA journal_mode=WAL");
+  db.run("PRAGMA busy_timeout=5000");
   db.run("PRAGMA foreign_keys=ON");
   migrateApprovalSchema(db);
   return db;