switchroom 0.17.10 → 0.18.6

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.17.10",
+  "version": "0.18.6",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/_base/settings.json.hbs

@@ -21,8 +21,8 @@
 {
   "permissions": {
     "allow": {{{json permissionAllow}}},
-    "deny": {{{json toolsDeny}}}{{#if defaultModeAcceptEdits}},
-    "defaultMode": "acceptEdits"{{/if}}
+    "deny": {{{json toolsDeny}}},
+    "defaultMode": "{{defaultMode}}"
   }{{#if hindsightEnabled}},
   "autoMemoryEnabled": false{{/if}}{{#if mcpServers}},
   "mcpServers": {{{json mcpServers}}}

package/profiles/_base/start.sh.hbs

@@ -33,6 +33,19 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
   # same path the rest of start.sh + the MCP sidecar expects.
   export TELEGRAM_STATE_DIR="{{agentDir}}/telegram"
 
+  # SWITCHROOM_AGENT_NAME is the canonical "which agent am I" identity. It is
+  # normally supplied by the container env (compose.ts) so it is already
+  # present here, but the authoritative inner-pass export lives at line ~387,
+  # AFTER the gateway fork below. On any runtime where the compose env is NOT
+  # the source (non-docker / local dev), the forked gateway daemon would then
+  # start with the var UNSET — which collapses its worktree-ownership filter
+  # (worktree-watch-cwds.ts) to [], so a worktree-isolated background
+  # sub-agent gets NO live progress feed for its whole run (#1116 / #2893).
+  # Hoist the export here, before the fork, so the gateway ALWAYS has its
+  # identity on the fast path regardless of runtime. Idempotent with the
+  # compose env and the inner-pass export. Pinned by the scaffold-order test.
+  export SWITCHROOM_AGENT_NAME="{{name}}"
+
   # Gateway-consumed env MUST be exported HERE, before the gateway fork
   # below. The gateway daemon reads channels.telegram.* knobs (and any
   # agent env) from process.env at startup — e.g. SWITCHROOM_TG_STREAM_
@@ -57,9 +70,17 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
   # ANTHROPIC_CUSTOM_HEADERS exported BEFORE the gateway fork below, or
   # discoverSrModels() returns [] and /model never shows OpenRouter entries.
   #
-  # Mirrors the INNER block's fail-open logic exactly:
-  #   - missing key   → log + skip export (gateway talks direct OAuth)
-  #   - proxy down    → log + strip ALL routing env (fail-open)
+  # Mirrors the INNER block's split boot contract EXACTLY (see the long note
+  # at the inner block for the full rationale). This OUTER pass runs BEFORE
+  # `exec tmux`, so whatever it does to the routing env is inherited by the
+  # inner pass — which is precisely why the old permanent strip-on-unreachable
+  # was so damaging: it removed SWITCHROOM_LITELLM here, and the inner
+  # self-heal block is gated on SWITCHROOM_LITELLM, so the entire inner fix
+  # was dead on the real docker path. The two boot failure modes:
+  #   - MISSING KEY → log LOUDLY + fail-open (strip routing; gateway direct OAuth)
+  #   - PROXY UNREACHABLE → log LOUDLY + KEEP routing in place (NO strip) so it
+  #     survives into the inner pass and self-heals when litellm returns. Boot
+  #     is non-fatal either way.
   #   - ANTHROPIC_CUSTOM_HEADERS already set → skip (idempotent)
   #
   # SWITCHROOM_AGENT_NAME is injected by compose env (compose.ts:1816)
@@ -67,8 +88,9 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
   if [ -n "${SWITCHROOM_LITELLM:-}" ] && [ -z "$ANTHROPIC_CUSTOM_HEADERS" ] && command -v switchroom >/dev/null 2>&1; then
     sr_ll_key="$(switchroom vault get "litellm/$SWITCHROOM_AGENT_NAME/api-key" 2>/dev/null || true)"
     sr_ll_ok=""
+    sr_ll_unreachable=""
     if [ -z "$sr_ll_key" ]; then
-      echo "litellm(outer): no virtual key for agent '$SWITCHROOM_AGENT_NAME' — gateway will use direct OAuth (no tracking/guardrail)" >&2
+      echo "litellm(outer): WARNING — no virtual key for agent '$SWITCHROOM_AGENT_NAME'; gateway falling back to direct Anthropic OAuth (untracked, unguarded)." >&2
     elif command -v curl >/dev/null 2>&1 && [ -n "$ANTHROPIC_BASE_URL" ]; then
       # Bounded retry probe (co-boot race fix, 2026-07): when the whole stack
       # co-boots, the litellm proxy's heavy Python app is often not yet healthy
@@ -85,7 +107,12 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
         sleep 3
       done
       if [ -z "$sr_ll_up" ]; then
-        echo "litellm(outer): proxy unreachable at ${SWITCHROOM_LITELLM_BASE:-$ANTHROPIC_BASE_URL} after 120s of retries — falling back to direct OAuth (no tracking/guardrail this session)" >&2
+        # Proxy unreachable but the key is present. Do NOT strip: leave routing
+        # pointed at litellm so it survives into the inner (tmux) pass and
+        # self-heals once the proxy is back (socat forwarder reconnects
+        # per-connection). Boot continues.
+        sr_ll_unreachable="1"
+        echo "litellm(outer): WARNING — proxy unreachable at ${SWITCHROOM_LITELLM_BASE:-$ANTHROPIC_BASE_URL} after 120s of retries; gateway discovery will FAIL until it recovers — routing LEFT IN PLACE so it self-heals. NOT falling back to untracked direct Anthropic OAuth." >&2
       else
         sr_ll_ok="1"
       fi
@@ -98,10 +125,17 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
 x-litellm-customer-id: $SWITCHROOM_AGENT_NAME
 x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:-default}"
       export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1
+    elif [ -n "$sr_ll_unreachable" ]; then
+      # Proxy unreachable at boot: routing intentionally LEFT IN PLACE (loud
+      # warning already emitted) so it survives into the inner pass and
+      # self-heals once litellm returns. NO unset — the permanent strip here
+      # was what made the inner self-heal fix inert on docker.
+      :
     else
+      # Missing-key fail-open: gateway talks direct OAuth, unproxied.
       unset ANTHROPIC_BASE_URL ANTHROPIC_SMALL_FAST_MODEL SWITCHROOM_LITELLM SWITCHROOM_LITELLM_BASE
     fi
-    unset sr_ll_key sr_ll_ok
+    unset sr_ll_key sr_ll_ok sr_ll_unreachable
   fi
 
   # Tiny in-process supervisor: runs cmd in a respawn loop with
@@ -911,12 +945,21 @@ fi
 # content-safety guardrails — it never alters the model or Claude's operation.
 # See reference/invariants.md § "Operator-controlled gateway carve-out".
 #
-# FAIL-OPEN (operator decision 2026-06-28): if the key is missing OR the proxy
-# is unreachable at boot, strip the routing env and fall back to the direct
-# broker-OAuth Anthropic path, logging the reason LOUDLY. Availability wins over
-# tracking/guardrails — a proxy outage must never take an agent dark. The
-# tradeoff is an explicit, logged guardrail lapse for that session, not a silent
-# one. Re-probed on every (re)boot, so recovery is automatic.
+# TWO boot failure modes, handled DIFFERENTLY (2026-07-08 — was a single
+# fail-open path that silently took an agent off-proxy for its whole lifetime):
+#   - MISSING KEY (no per-agent virtual key in the vault): fail-open — strip the
+#     routing env and fall back to the direct broker-OAuth Anthropic path,
+#     logging LOUDLY. Without a key there is nothing to authenticate to the
+#     proxy with, so there is no metered route to self-heal into.
+#   - PROXY UNREACHABLE at boot (key present, liveliness probe fails within the
+#     retry window): do NOT strip. Leave ANTHROPIC_BASE_URL / SWITCHROOM_LITELLM*
+#     pointed at the proxy (the socat forwarder at 127.0.0.1:4010 self-heals
+#     per-connection) and emit a LOUD warning. Claude traffic FAILS+retries until
+#     the proxy returns, then routes through it automatically — the metered path
+#     stays the metered path. We deliberately do NOT silently fall back to
+#     untracked direct Anthropic on a transient blip: an agent that boots during
+#     a brief litellm outage previously never routed through litellm again until
+#     a manual restart. Re-probed on every (re)boot.
 #
 # Static tags (x-litellm-customer-id / x-litellm-tags) give per-AGENT
 # attribution in LiteLLM. Per-SESSION is NOT achievable here: claude sends no
@@ -924,11 +967,22 @@ fi
 # per-session cost/issue tracking is handled out-of-band by correlating
 # LiteLLM's request log against switchroom's turn ledger, never by mutating the
 # claude protocol.
+# _LITELLM_OK is read by the session-model-override block below: an sr-*
+# (LiteLLM/OpenRouter) session override must be DROPPED when the proxy is
+# unreachable at boot, or claude would 4xx an unknown model against Anthropic.
+# Empty by default (proxy not confirmed live); set to "1" only on a successful
+# liveliness probe. Deliberately NOT unset with the sr_ll_* scratch vars.
+_LITELLM_OK=""
 if [ -n "${SWITCHROOM_LITELLM:-}" ] && command -v switchroom >/dev/null 2>&1; then
   sr_ll_key="$(switchroom vault get "litellm/$SWITCHROOM_AGENT_NAME/api-key" 2>/dev/null || true)"
   sr_ll_ok=""
+  sr_ll_unreachable=""
   if [ -z "$sr_ll_key" ]; then
-    echo "litellm: no virtual key for agent '$SWITCHROOM_AGENT_NAME' — falling back to direct OAuth (no tracking/guardrail)" >&2
+    echo "==================== litellm FAIL-OPEN ====================" >&2
+    echo "WARNING: no litellm virtual key for agent '$SWITCHROOM_AGENT_NAME'." >&2
+    echo "WARNING: falling back to direct Anthropic OAuth (untracked, unguarded)" >&2
+    echo "WARNING: — cannot authenticate to the proxy without a key." >&2
+    echo "==========================================================" >&2
   elif command -v curl >/dev/null 2>&1 && [ -n "$ANTHROPIC_BASE_URL" ]; then
     # Bounded retry probe (co-boot race fix, 2026-07): when the whole stack
     # co-boots, the litellm proxy's heavy Python app is often not yet healthy
@@ -945,7 +999,16 @@ if [ -n "${SWITCHROOM_LITELLM:-}" ] && command -v switchroom >/dev/null 2>&1; th
       sleep 3
     done
     if [ -z "$sr_ll_up" ]; then
-      echo "litellm: proxy unreachable at ${SWITCHROOM_LITELLM_BASE:-$ANTHROPIC_BASE_URL} after 120s of retries — falling back to direct OAuth (no tracking/guardrail this session)" >&2
+      # Proxy unreachable at boot but the key is present. Do NOT strip routing:
+      # leave it pointed at litellm so the fleet self-heals once the proxy is
+      # back (the socat forwarder at 127.0.0.1:4010 reconnects per-connection).
+      sr_ll_unreachable="1"
+      echo "==================== litellm UNREACHABLE ====================" >&2
+      echo "WARNING: litellm proxy unreachable at ${SWITCHROOM_LITELLM_BASE:-$ANTHROPIC_BASE_URL} after 120s of retries;" >&2
+      echo "WARNING: Claude traffic will FAIL until it recovers — routing LEFT IN PLACE" >&2
+      echo "WARNING: so it self-heals (socat forwarder reconnects per-connection)." >&2
+      echo "WARNING: NOT falling back to untracked direct Anthropic OAuth." >&2
+      echo "============================================================" >&2
     else
       sr_ll_ok="1"
     fi
@@ -954,6 +1017,7 @@ if [ -n "${SWITCHROOM_LITELLM:-}" ] && command -v switchroom >/dev/null 2>&1; th
     sr_ll_ok="1"
   fi
   if [ -n "$sr_ll_ok" ]; then
+    _LITELLM_OK="1"
     # Newline-separated Name: Value pairs (claude CLI ANTHROPIC_CUSTOM_HEADERS format).
     # Tags: agent:<name> for per-agent spend tracking; profile:<profile> for
     # fleet-level cost breakdown by role. Per-turn tags (cron vs telegram) are
@@ -967,24 +1031,109 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
     # models configured in the proxy appear in the /model picker and can be
     # selected via --model. Without this, the CLI only knows its bundled list.
     export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1
+  elif [ -n "$sr_ll_unreachable" ]; then
+    # Proxy unreachable at boot: routing intentionally LEFT IN PLACE (loud
+    # warning already emitted above) so it self-heals when litellm returns.
+    # _LITELLM_OK stays empty so any sr-* session model override is still
+    # dropped below (claude would 4xx an unknown model against a down endpoint).
+    # NO unset here — that permanent strip was the bug this branch fixes.
+    :
   else
-    # Fail-open: drop every routing var so the claude CLI talks to Anthropic
-    # directly on its OAuth credential (subscription path), unproxied.
+    # Missing key fail-open: drop every routing var so the claude CLI talks to
+    # Anthropic directly on its OAuth credential (subscription path), unproxied.
     unset ANTHROPIC_BASE_URL ANTHROPIC_SMALL_FAST_MODEL SWITCHROOM_LITELLM SWITCHROOM_LITELLM_BASE
   fi
-  unset sr_ll_key sr_ll_ok
+  unset sr_ll_key sr_ll_ok sr_ll_unreachable
+fi
+
+# --- Session-only model override (carrier: .session-model-override) ---
+#
+# The Telegram `/model <sr-*>` switch can't use claude's in-REPL `/model`
+# picker for non-Anthropic (LiteLLM/OpenRouter `sr-*`) models — the CLI's
+# native picker rejects unknown ids ("Model not found"). Instead the gateway
+# writes the chosen model token to `.session-model-override` and gracefully
+# restarts the agent; THIS boot picks it up and launches `claude --model
+# <token>` directly (no picker validation at launch — LiteLLM routes it).
+#
+# One-shot + session-only: the carrier is consumed (rm) on this one boot
+# regardless of validity, so the next restart reverts to the configured
+# default `{{{modelQ}}}`. Mirrors the `.force-fresh-session` marker's
+# gateway↔start.sh round-trip. See telegram-plugin/gateway/model-command.ts.
+# NB {{{modelQ}}} is already shell-single-quoted by the scaffold (it renders as
+# a quoted token, e.g. 'claude-sonnet-5'), so it is assigned BARE here — never
+# inside additional double quotes, which would embed the literal quote chars in
+# the value and break `claude --model`.
+_EFFECTIVE_MODEL={{{modelQ}}}
+if [ -f "{{agentDir}}/.session-model-override" ]; then
+  _override="$(tr -d '[:space:]' < "{{agentDir}}/.session-model-override" 2>/dev/null || true)"
+  rm -f "{{agentDir}}/.session-model-override"
+  # Shape gate — kept aligned with MODEL_ARG_RE in telegram-plugin/gateway/model-command.ts.
+  # `/` is allowed for OpenRouter-style `sr-vendor/model` ids; it is not a shell
+  # metachar inside the double-quoted `claude --model "$_EFFECTIVE_MODEL"` usage below.
+  if printf '%s' "$_override" | grep -Eq '^[A-Za-z0-9][]A-Za-z0-9._[/-]{0,99}$'; then
+    _EFFECTIVE_MODEL="$_override"
+    # LiteLLM-down guard for an sr-* OVERRIDE only (operator decision 2026-07):
+    # with the proxy unreachable at boot there IS a Claude configured default to
+    # fall back to, so DROP the override rather than boot on an unreachable sr-*
+    # model that would 4xx against Anthropic — log LOUDLY and write an alert
+    # sentinel the gateway turns into a Telegram message. (The passthrough→router
+    # repoint for a LIVE sr-* — override OR configured default — is done once,
+    # post-resolution, below.)
+    case "$_override" in
+      sr-*)
+        if [ -z "$_LITELLM_OK" ]; then
+          _EFFECTIVE_MODEL={{{modelQ}}}
+          echo "session-model: LiteLLM proxy unreachable at boot — DROPPING sr-* override '$_override', booting on configured default '$_EFFECTIVE_MODEL' instead (would otherwise 4xx against Anthropic)" >&2
+          echo "session-model: the requested sr-* model is UNAVAILABLE this session; re-issue /model $_override once LiteLLM is reachable" >&2
+          printf 'LiteLLM proxy was unreachable at boot, so the session-only model switch to `%s` was dropped — the agent booted on its configured default `%s` instead. Re-issue /model %s once LiteLLM is reachable.\n' "$_override" "$_EFFECTIVE_MODEL" "$_override" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+        fi
+        ;;
+    esac
+  else
+    echo "session-model: ignoring malformed .session-model-override (failed shape gate) — using configured default '$_EFFECTIVE_MODEL'" >&2
+  fi
+  unset _override
 fi
 
+# sr-* passthrough→router repoint — ONE post-resolution gate covering BOTH the
+# /model override path AND the configured-default path (`model: sr-*` in
+# switchroom.yaml, which has NO override carrier). sr-* (OpenRouter) models route
+# by MODEL NAME through LiteLLM's model-mapped root. The default ANTHROPIC_BASE_URL
+# points at the `/anthropic` PASSTHROUGH (raw byte-forward to api.anthropic.com,
+# chosen to dodge the Opus SSE re-chunk stall for Claude traffic) — but the
+# passthrough is model-agnostic and ships EVERY request to Anthropic regardless of
+# --model, so an sr-* model 4xxs "model not found". Repoint at the LiteLLM router
+# root so claude's /v1/messages hits the model router → OpenRouter. Claude
+# (default/override) sessions are untouched — they keep the passthrough.
+#
+# Guarded on the proxy being reachable at boot ($_LITELLM_OK). If it is NOT, we
+# leave routing exactly as compose/start.sh set it (compose already points a
+# non-Claude default at the router root) and run degraded until litellm returns —
+# there is NO Claude default to fall back to for a persistent sr-* agent, and
+# that (loud-warned, non-fatal) degraded state is the correct behavior.
+case "$_EFFECTIVE_MODEL" in
+  sr-*)
+    if [ -n "$_LITELLM_OK" ] && [ -n "$SWITCHROOM_LITELLM_BASE" ]; then
+      export ANTHROPIC_BASE_URL="$SWITCHROOM_LITELLM_BASE"
+      echo "session-model: effective model '$_EFFECTIVE_MODEL' is sr-* — routing via LiteLLM model router '$SWITCHROOM_LITELLM_BASE' (off /anthropic passthrough) so it reaches OpenRouter" >&2
+    fi
+    ;;
+esac
+# Record the EFFECTIVE launched model so the gateway can re-hydrate its
+# in-memory session-model state after this restart, keeping /status and the
+# welcome card honest. Overwrite (not consumed) — the gateway reads it at boot.
+printf '%s\n' "$_EFFECTIVE_MODEL" > "{{agentDir}}/.active-session-model" 2>/dev/null || true
+
 {{#if useSwitchroomPlugin}}
 if [ -n "$APPEND_PROMPT" ]; then
-  exec claude $CONTINUE_FLAG --dangerously-load-development-channels server:switchroom-telegram --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG{{#if modelQ}} --model {{{modelQ}}}{{/if}}{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}} --append-system-prompt "$APPEND_PROMPT"{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
+  exec claude $CONTINUE_FLAG --dangerously-load-development-channels server:switchroom-telegram --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG --model "$_EFFECTIVE_MODEL"{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}} --append-system-prompt "$APPEND_PROMPT"{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
 else
-  exec claude $CONTINUE_FLAG --dangerously-load-development-channels server:switchroom-telegram --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG{{#if modelQ}} --model {{{modelQ}}}{{/if}}{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}}{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
+  exec claude $CONTINUE_FLAG --dangerously-load-development-channels server:switchroom-telegram --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG --model "$_EFFECTIVE_MODEL"{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}}{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
 fi
 {{else}}
 if [ -n "$APPEND_PROMPT" ]; then
-  exec claude $CONTINUE_FLAG --channels plugin:telegram@claude-plugins-official --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG{{#if modelQ}} --model {{{modelQ}}}{{/if}}{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}} --append-system-prompt "$APPEND_PROMPT"{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
+  exec claude $CONTINUE_FLAG --channels plugin:telegram@claude-plugins-official --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG --model "$_EFFECTIVE_MODEL"{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}} --append-system-prompt "$APPEND_PROMPT"{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
 else
-  exec claude $CONTINUE_FLAG --channels plugin:telegram@claude-plugins-official --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG{{#if modelQ}} --model {{{modelQ}}}{{/if}}{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}}{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
+  exec claude $CONTINUE_FLAG --channels plugin:telegram@claude-plugins-official --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG --model "$_EFFECTIVE_MODEL"{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}}{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
 fi
 {{/if}}

package/profiles/coding/CLAUDE.md.hbs

@@ -41,7 +41,7 @@ You are a senior software engineering agent. You write, review, debug, and archi
 Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 
 - `mcp__hindsight__recall` — search past memories. Auto-fires on every message.
-- `mcp__hindsight__retain` — store important facts. Auto-retains transcript every ~10 turns.
+- `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
 - `mcp__hindsight__reflect` — synthesize across memories for complex queries.
 - `mcp__hindsight__create_mental_model` — maintain semantic summaries (e.g. "codebase architecture").
 

package/profiles/default/CLAUDE.md.hbs

@@ -39,7 +39,7 @@ Hindsight is a memory bank with semantic search, knowledge graph, entity resolut
 
 ### Day-to-day tools
 - `mcp__hindsight__recall` — semantic-search the bank for relevant past memories. Auto-fires on every inbound user message via the plugin's UserPromptSubmit hook (you'll see "Relevant memories from past conversations" in your context). Call manually when you need a more specific query than the auto-fired one.
-- `mcp__hindsight__retain` — store a new memory. The plugin automatically retains the conversation transcript every ~10 turns via the Stop hook, so you usually don't need this. Call manually for significant decisions, corrections, or facts you want immediately searchable.
+- `mcp__hindsight__retain` — store a new memory. The plugin auto-retains every turn via the Stop hook, but in chunked mode each retain only processes a small recent window (~3 turns) — so it captures memory promptly and survives restarts without re-sending the whole transcript, and you usually don't need this. Call manually for significant decisions, corrections, or facts you want immediately searchable.
 - `mcp__hindsight__reflect` — Hindsight's LLM-powered "answer this query using the bank's content + directives". Use when the user asks a question that requires synthesis across multiple past memories.
 
 ### Mental Models
@@ -68,7 +68,7 @@ Don't retain:
 - Sensitive content the user explicitly asked you to not remember
 - Things already in a mental model — they'll be re-derived from underlying memories
 
-The plugin's auto-retain (Stop hook) handles transcript-level storage on a 10-turn cadence, so you don't need to manually retain everything. Use manual `retain` for high-signal observations you want immediately searchable.
+The plugin's auto-retain (Stop hook) fires every turn, but in chunked mode each retain only processes a small recent window (~3 turns) — so storage stays prompt and cheap and survives restarts without re-sending the whole transcript, and you don't need to manually retain everything. Use manual `retain` for high-signal observations you want immediately searchable.
 
 ## Sub-Agent Delegation
 

package/profiles/executive-assistant/CLAUDE.md.hbs

@@ -40,7 +40,7 @@ You help the user stay organized, prepared, and focused on high-leverage work. Y
 Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 
 - `mcp__hindsight__recall` — search past memories. Auto-fires every message.
-- `mcp__hindsight__retain` — store important facts. Auto-retains every ~10 turns.
+- `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
 - `mcp__hindsight__create_mental_model` — maintain models for "contacts", "active projects", "user preferences".
 
 Save proactively: contacts and their roles, scheduling preferences, project status, decisions with rationale, communication templates. Only Hindsight memories survive compaction.

package/profiles/health-coach/CLAUDE.md.hbs

@@ -34,7 +34,7 @@ Recommend the user consult a professional for: persistent pain/injury, medical c
 Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 
 - `mcp__hindsight__recall` — search past memories. Auto-fires on every message.
-- `mcp__hindsight__retain` — store important facts. Auto-retains every ~10 turns.
+- `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
 - `mcp__hindsight__create_mental_model` — maintain a "fitness profile" mental model.
 
 Save proactively: workout logs, goals, PRs, preferences, patterns (e.g. "poor sleep on Sundays"), injuries/limitations. Only Hindsight memories survive session compaction.

package/skills/switchroom-release/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: switchroom-release
+description: "Cut and ship a switchroom release end-to-end: CHANGELOG consolidation, tag, npm publish, image build, and the fleet rollout gate. Use when the user says 'cut a release', 'ship a release', 'release vX', 'publish a new version', 'roll out the latest', or otherwise wants the merged work on main to go live for the fleet. This is the ONLY skill that authorizes a fleet rollout, and it enforces the npm-publish + image-build gates that were historically skipped (v0.18.4/v0.18.5 shipped to the fleet but never hit npm). Do NOT use for adding agents (switchroom-manage), diagnostics (switchroom-health), or a plain `switchroom update` on one agent (switchroom-cli)."
+allowed-tools: Bash(git *) Bash(gh *) Bash(npm view *) Bash(npm pack *) Bash(docker manifest inspect *) Bash(docker buildx imagetools inspect *)
+---
+
+# Switchroom release
+
+Cut a release of `switchroom/switchroom` and get it live on the fleet. This is a **gated, ordered checklist** — do not skip steps, do not reorder. The whole point of this skill is that two steps that used to be skipped silently (npm publish, image-build verification) are now **hard gates before rollout**.
+
+## What a release actually is
+
+- A release = a `vX.Y.Z` **git tag** on `main` (the merge commit of the CHANGELOG PR).
+- The tag is the version source of truth (`scripts/build.mjs:resolveVersion()`). `package.json` `version` is a **stale placeholder by design** — never bump it in a commit (the `//version` comment + #2733 discipline). The uncommitted pack-time bump happens in CI now, not by hand.
+- Cutting the tag fires TWO workflows in parallel on tag push: `docker-images` (builds + pushes the 6 ghcr images) and `npm-publish` (builds, packs, verifies, publishes to npm). **Rollout is gated on BOTH going green.**
+
+## Before you start — pre-flight (verify, don't assume)
+
+1. `git fetch origin`, confirm `main` is at the commit you want released.
+2. `gh pr list --state open` — confirm no PR meant for this release is still open. Ask the operator if unsure.
+3. Confirm CI on `main` is green (`gh run list --branch main --limit 3`).
+4. Read `CHANGELOG.md` — the `## Unreleased` section is the staging area for this release's notes. If it's empty, there's nothing to release.
+5. Pick the next version: read the latest tag (`git tag --list 'v*' --sort=-v:refname | head -1`) and bump the patch (or minor if the operator asks). Confirm with the operator which.
+
+## Step 1 — Consolidate the changelog (the release commit is CHANGELOG-only)
+
+- Move the `## Unreleased` entries under a new `## vX.Y.Z — <one-line summary>` heading.
+- The release commit touches **CHANGELOG.md only**. Do NOT bump `package.json` (placeholder discipline).
+- Branch protection blocks direct push to `main`, so: create a `release/vX.Y.Z` branch, push it, open a `chore: release vX.Y.Z` PR (base `main`), arm auto-merge (squash, delete-branch) on green CI.
+
+## Step 2 — Cut the tag (on the merge commit, not the PR branch)
+
+Once the changelog PR is merged:
+- `git fetch origin && git checkout main && git pull --ff-only`
+- Tag the merge commit and create the GitHub Release:
+  - `gh release create vX.Y.Z -R switchroom/switchroom --target main --title 'vX.Y.Z — <summary>' --notes-file <notes-file>`
+- **Notes extraction gotcha (historical):** the naive `awk '/^## vX/,/^## v/' CHANGELOG` range collapses to a single line. Use a start-flag awk: `awk 'f{print} /^## vX\.Y\.Z/{print; f=1} f && /^## v/ && !/^## vX\.Y\.Z/{exit}'` — or extract the section to a temp file by line range.
+- **`gh release create` has been silently dropped in past runs.** After running it, verify: `gh release view vX.Y.Z` must return the release. If it didn't create, re-run.
+
+## Step 3 — Wait for BOTH tag-push workflows (hard gates)
+
+The tag push triggers `docker-images` AND `npm-publish` in parallel. **Do not proceed to rollout until both are green AND verified.**
+
+### Gate A — npm publish (`npm-publish.yml`)
+- `gh run list --workflow=npm-publish.yml --limit 1` — wait for it to reach `completed` / `success`.
+- Verify the publish is live: `npm view switchroom version` must return `X.Y.Z` (not the old version). Retry a few times — npm registry propagation can lag a few seconds.
+- If this workflow fails: **the release is not published.** Do NOT roll. Diagnose (NPM_TOKEN unset? npm 5xx? empty dist?). Re-run via `gh workflow run npm-publish.yml --ref vX.Y.Z` after fixing.
+
+### Gate B — docker images (`docker-images.yml`)
+- `gh run list --workflow=docker-images.yml --limit 1` — wait for `completed` / `success`.
+- Verify all 6 images are published: `docker manifest inspect ghcr.io/switchroom/<image>:vX.Y.Z` for `agent`, `auth-broker`, `kernel`, `broker`, `web`, `hostd`. Each must resolve.
+- If any image is missing: do NOT roll — the rollout canary version-assert fails on an unpublished tag. Wait + re-check.
+
+**Only when Gate A AND Gate B are green + verified** do you proceed.
+
+## Step 4 — Fleet rollout (operator-gated, canary-first)
+
+- Fire the rollout via the hostd rollout path (`mcp__hostd__rollout`), which pops an **approval card**. Do NOT roll without the operator tapping approve.
+- Canary discipline: roll the release-critical canary agent first (the test-harness agent, per CLAUDE.md > Release canary discipline), monitor its logs + a smoke check, then stagger the rest per-agent with a `--version` assertion each (guards the `:latest` pull-race).
+- For a release that changes agent runtime behavior (a CLI pin bump, a behavioral template change), offer the operator a canary-first path (one agent → monitor → sweep) vs all-at-once; let them choose.
+
+## What you must NOT do
+
+- **Never bump `package.json` `version` in a commit.** It's a stale placeholder; the tag is the source of truth and `npm-publish.yml` does the uncommitted pack-time bump.
+- **Never run `npm publish` by hand from the agent container.** You can't reach the operator's npm auth, and the workflow is the reliable path. If the workflow is broken, fix the workflow — don't side-step it.
+- **Never roll the fleet before Gate A (npm) AND Gate B (images) are both green + verified.** A release that's on the fleet but not on npm is the exact regression this skill exists to prevent.
+- **Never push directly to `main`.** The CHANGELOG PR goes through auto-merge on green.
+- **Never force-push `main` or bypass hooks (`--no-verify`).**
+
+## If something goes wrong
+
+- **npm-publish failed but the tag is already pushed:** fix + `gh workflow run npm-publish.yml --ref vX.Y.Z`. Do NOT roll until it's green + `npm view` confirms.
+- **Images failed but npm succeeded:** the npm package is live but the fleet can't roll yet. Fix the image workflow / re-run. (npm being ahead of images is fine — the CLI is published for npm consumers; the fleet waits on images.)
+- **Rollout started before publish verified (the old bug):** abort the rollout, publish, then re-roll. Do not let a half-published release sit on the fleet.
+
+## Operator one-time setup (tell them once, not every release)
+
+The `npm-publish.yml` workflow needs an `NPM_TOKEN` repo secret (automation-scoped npm access token with publish rights on `switchroom`). Set it once in repo settings → Secrets and variables → Actions → `NPM_TOKEN`. Without it, Gate A fails loudly on the first release — that's the design (loud > silent).

package/telegram-plugin/auth-snapshot-format.ts

@@ -273,6 +273,16 @@ export interface SnapshotRenderOpts {
    * Takes precedence over `liveProbedAtMs`.
    */
   staleCachedAtMs?: number;
+  /**
+   * True when the live probe returned no usable data for ANY account (probe
+   * threw / timed out / returned zero rows) AND nothing was served from
+   * cache either. The footer renders `⚠ probe failed — no live data`
+   * instead of a false bare `_Live_`. Subscription-honesty: a "Live" footer
+   * next to "no data" rows is the exact lie this closes. `staleCachedAtMs`
+   * (cache-served data) takes precedence over this; this takes precedence
+   * over the bare-`Live` fallback.
+   */
+  probeFailed?: boolean;
   /**
    * Demo mode (the `/usage demo` / `/auth demo` suffix). When true, every
    * account label is run through `maskEmail` before rendering so a screen
@@ -447,30 +457,27 @@ function pctCells(
 }
 
 /**
- * The Status cell: for a blocked account, when the binding window comes back
- * (`back <when>`); for a healthy/throttling account, when the soonest window
- * refills (`refills <when>`). `<when>` is the tz-aware absolute time (date shown
- * only when not today) plus the concise relative hint in parens.
+ * The per-window reset cell (`5h resets` / `7d resets`): the tz-aware absolute
+ * reset time for THAT specific window (date shown only when not today) plus the
+ * concise relative hint in parens — e.g. `1:20 PM (in 2h)`.
+ *
+ * Degrades in lockstep with `pctCells` so the percentage cell and its reset cell
+ * always agree: no quota → probe-failed message (or `—`); thin probe → `quota
+ * unknown`; missing reset on an otherwise-present window → `—`.
  */
-function statusCell(snap: AccountSnapshot, now: Date, tz: string): string {
+function windowResetCell(
+  snap: AccountSnapshot,
+  now: Date,
+  tz: string,
+  win: '5h' | '7d',
+): string {
   if (!snap.quota) {
-    return snap.quotaError ? `probe failed (${snap.quotaError})` : 'probe failed';
+    return snap.quotaError ? `probe failed (${snap.quotaError})` : '—';
   }
   if (isProbeThin(snap.quota)) return 'quota unknown';
-  const q = snap.quota;
-  const health = classifyHealth(snap, now);
-  if (health === 'blocked') {
-    const win = bindingWindow(q);
-    const reset = win === '5h' ? q.fiveHourResetAt : q.sevenDayResetAt;
-    if (!reset) return 'back — (reset unknown)';
-    return `back ${formatStatusTime(reset, now, tz)} (in ${formatRelative(reset, now)})`;
-  }
-  // healthy / throttling — show the soonest refill across both windows.
-  const fiveIn = q.fiveHourResetAt ? q.fiveHourResetAt.getTime() - now.getTime() : Infinity;
-  const sevenIn = q.sevenDayResetAt ? q.sevenDayResetAt.getTime() - now.getTime() : Infinity;
-  const soonest = fiveIn <= sevenIn ? q.fiveHourResetAt : q.sevenDayResetAt;
-  if (!soonest) return 'refills —';
-  return `refills ${formatStatusTime(soonest, now, tz)} (in ${formatRelative(soonest, now)})`;
+  const reset = win === '5h' ? snap.quota.fiveHourResetAt : snap.quota.sevenDayResetAt;
+  if (!reset) return '—';
+  return `${formatStatusTime(reset, now, tz)} (in ${formatRelative(reset, now)})`;
 }
 
 export function renderAuthSnapshotFormat2(
@@ -495,8 +502,8 @@ export function renderAuthSnapshotFormat2(
 
   if (ordered.length > 0) {
     lines.push('');
-    lines.push('| State | Account | 5h | 7d | Status |');
-    lines.push('| --- | --- | --- | --- | --- |');
+    lines.push('| State | Account | 5h | 5h resets | 7d | 7d resets |');
+    lines.push('| --- | --- | --- | --- | --- | --- |');
     for (const s of ordered) {
       const emoji = HEALTH_EMOJI[classifyHealth(s, now)];
       // Account cell: FULL email, never truncated; active gets a (active) suffix.
@@ -512,9 +519,10 @@ export function renderAuthSnapshotFormat2(
       // tableCell wrap around the finished span.
       const accountCell = `\`${codeSpanSafe(s.isActive ? `${label} (active)` : label)}\``;
       const { five, seven } = pctCells(s, now);
-      const status = statusCell(s, now, tz);
+      const fiveReset = windowResetCell(s, now, tz, '5h');
+      const sevenReset = windowResetCell(s, now, tz, '7d');
       lines.push(
-        `| ${emoji} | ${tableCell(accountCell)} | ${five} | ${seven} | ${tableCell(status)} |`,
+        `| ${emoji} | ${tableCell(accountCell)} | ${five} | ${tableCell(fiveReset)} | ${seven} | ${tableCell(sevenReset)} |`,
       );
     }
   }
@@ -523,11 +531,15 @@ export function renderAuthSnapshotFormat2(
   lines.push(`_${recommendation(snapshots, now, opts.demo ?? false)}_`);
   // #2495 Change 2 — a failed probe-on-open renders an explicit "cached Nm
   // ago" warning, never a false live stamp. The degraded variant takes
-  // precedence over the live stamp.
+  // precedence over the live stamp. A TOTAL probe failure (no rows, no
+  // cache) renders an explicit "probe failed" marker — without it the
+  // bare-else rendered `_Live_` next to no-data rows (the honesty gap).
   if (opts.staleCachedAtMs != null) {
     lines.push(`_⚠ cached ${formatAgeStamp(opts.staleCachedAtMs, now)}_`);
   } else if (opts.liveProbedAtMs != null) {
     lines.push(`_Live · refreshed ${formatAgeStamp(opts.liveProbedAtMs, now)}_`);
+  } else if (opts.probeFailed) {
+    lines.push('_⚠ probe failed — no live data_');
   } else {
     lines.push('_Live_');
   }