switchroom 0.18.11 → 0.18.12

package/dist/host-control/main.js

@@ -15989,7 +15989,7 @@ var require_command = __commonJS((exports2) => {
   var EventEmitter2 = __require("node:events").EventEmitter;
   var childProcess = __require("node:child_process");
   var path2 = __require("node:path");
-  var fs2 = __require("node:fs");
+  var fs3 = __require("node:fs");
   var process2 = __require("node:process");
   var { Argument, humanReadableArgName } = require_argument();
   var { CommanderError } = require_error();
@@ -16510,7 +16510,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
       this.processedArgs = [];
     }
     _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
-      if (fs2.existsSync(executableFile))
+      if (fs3.existsSync(executableFile))
         return;
       const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
       const executableMissing = `'${executableFile}' does not exist
@@ -16525,11 +16525,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
       const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
       function findFile(baseDir, baseName) {
         const localBin = path2.resolve(baseDir, baseName);
-        if (fs2.existsSync(localBin))
+        if (fs3.existsSync(localBin))
           return localBin;
         if (sourceExt.includes(path2.extname(baseName)))
           return;
-        const foundExt = sourceExt.find((ext) => fs2.existsSync(`${localBin}${ext}`));
+        const foundExt = sourceExt.find((ext) => fs3.existsSync(`${localBin}${ext}`));
         if (foundExt)
           return `${localBin}${foundExt}`;
         return;
@@ -16541,7 +16541,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
       if (this._scriptPath) {
         let resolvedScriptPath;
         try {
-          resolvedScriptPath = fs2.realpathSync(this._scriptPath);
+          resolvedScriptPath = fs3.realpathSync(this._scriptPath);
         } catch {
           resolvedScriptPath = this._scriptPath;
         }
@@ -17316,7 +17316,7 @@ var require_commander = __commonJS((exports2) => {
 
 // src/host-control/main.ts
 import { homedir as homedir6 } from "node:os";
-import { existsSync as existsSync11, readdirSync as readdirSync4 } from "node:fs";
+import { existsSync as existsSync12, readdirSync as readdirSync4 } from "node:fs";
 import { join as join11, resolve as resolve9 } from "node:path";
 
 // src/config/loader.ts
@@ -21399,7 +21399,12 @@ var ScheduleEntrySchema = exports_external.object({
 var AgentSoulSchema = exports_external.object({
   name: exports_external.string().describe("Agent persona name (e.g., 'Coach', 'Sage')"),
   style: exports_external.string().describe("Communication style description"),
-  boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers")
+  creature: exports_external.string().optional().describe("Persona creature/form (e.g., 'owl', 'octopus')"),
+  vibe: exports_external.string().optional().describe("One-line personality vibe (e.g., 'calm, precise')"),
+  expertise: exports_external.string().optional().describe("Domain expertise summary rendered into the persona"),
+  emoji: exports_external.string().optional().describe("Signature emoji for the persona (e.g., '\uD83E\uDD89')"),
+  boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers"),
+  shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).default("generalist").describe("Persona-shape discriminator the per-agent CLAUDE.md template can " + "branch on (e.g., 'you are an executive assistant' vs 'a senior " + "engineer'). No runtime behavior yet — template work lands in a " + "later issue. Cascade: override (per-agent wins over default).")
 }).optional();
 var AgentToolsSchema = exports_external.object({
   allow: exports_external.array(exports_external.string()).default([]).describe("Allowed tools (use ['all'] for unrestricted)"),
@@ -21564,6 +21569,11 @@ var TelegramChannelSchema = exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
   }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
+  button_choice_confirmation: exports_external.object({
+    enabled: exports_external.boolean().default(false).describe("When true, tapping an agent-emitted inline_keyboard button annotates " + "the source message body with a '✅ You chose: <label> · HH:MM' line so " + "the chat surface is self-documenting. Only applies to single-use " + "keyboards (re-tappable keyboards are never annotated). Requires the " + "agent's parseMode to be the default 'html'. Opt-in (default false). " + "Limitation: the annotated body is rebuilt from the message's plain " + "text, so any formatting entities (bold, links, code, ...) on the " + "original message are lost when the annotation is applied."),
+    format: exports_external.string().default("✅ You chose: {label} · {time}").describe("Template for the annotation line. `{label}` is replaced with the " + "tapped button's text (newlines stripped, HTML-escaped, trimmed to 60 " + "chars) and `{time}` with HH:MM in the chosen timezone. Note: retap " + "dedup (replacing a prior annotation instead of appending another " + "line) only recognizes the DEFAULT format shape — a custom format " + "accumulates one line per retap."),
+    timezone: exports_external.enum(["gateway", "utc"]).default("gateway").describe("Timezone for the {time} placeholder. 'gateway' uses the gateway " + "process's local time; 'utc' uses UTC. Per-user timezones are out of " + "scope for v1.")
+  }).optional().describe("Auto-confirm 'You chose: X' annotation on inline_keyboard taps (#789). " + "Cascades from defaults.channels.telegram.button_choice_confirmation."),
   webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
   webhook_dispatch: exports_external.object({
     github: exports_external.array(webhookDispatchRule).optional(),
@@ -21712,7 +21722,12 @@ var profileFields = {
   soul: exports_external.object({
     name: exports_external.string().optional(),
     style: exports_external.string().optional(),
-    boundaries: exports_external.string().optional()
+    creature: exports_external.string().optional(),
+    vibe: exports_external.string().optional(),
+    expertise: exports_external.string().optional(),
+    emoji: exports_external.string().optional(),
+    boundaries: exports_external.string().optional(),
+    shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).optional()
   }).optional(),
   tools: exports_external.object({
     allow: exports_external.array(exports_external.string()).optional(),
@@ -21909,7 +21924,8 @@ var VaultConfigSchema = exports_external.object({
     autoUnlockCredentialPath: exports_external.string().default("~/.switchroom/vault-auto-unlock").describe("Path to the machine-bound auto-unlock blob (see " + "src/vault/auto-unlock.ts for the format). Default lives under " + "~/.switchroom so it can be bind-mounted into the vault-broker " + "container by docker compose. Tilde-expansion happens " + "at read time."),
     approvalAuth: exports_external.enum(["passphrase", "telegram-id"]).default("passphrase").describe("Posture for tap-to-Approve on vault grant cards. `passphrase` " + "(default) prompts the operator to type the vault passphrase on " + "every Approve — two-factor (Telegram ID + passphrase). " + "`telegram-id` mints immediately on Approve with no passphrase " + "prompt — single-factor (Telegram ID only); REQUIRES " + "`autoUnlock: true` so the broker already holds the passphrase. " + "Trades a factor of security for smoother UX; opt-in only."),
     postureMintAgents: exports_external.array(exports_external.string().min(1)).default([]).describe("Per-agent opt-in for posture-attested broker calls (`mint_grant` / " + "`list_grants` / `put` with `attest_via_posture: true`). Only agents " + "whose names are in this list can use the silent-mint path under " + "`approvalAuth: telegram-id`. Default `[]` — no agent can self-mint " + "until the operator explicitly opts it in. The request's `agent` " + "field must also equal the calling peer's resolved agent name " + "(broker rejects cross-agent posture mints). When `approvalAuth` is " + "`passphrase` this list is ignored — passphrase attestation still " + "works as before. Each entry is an agent slug exactly as it appears " + "under `agents:` in this config."),
-    adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload).")
+    adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload)."),
+    auditFailClosed: exports_external.boolean().default(false).describe("sec WS10-F3 (#1420) — fail-CLOSED on an audit-append failure. When " + "`false` (default, backward-compatible) the broker fails OPEN: if a " + "vault-audit.log append fails it logs to stderr, bumps the durable " + "fail-open counter, and STILL releases the secret. When `true`, a " + "failed audit append DENIES the secret release with " + "`AUDIT_UNAVAILABLE` — no secret leaves the broker without a durable " + "audit row. The env var `SWITCHROOM_VAULT_AUDIT_FAIL_CLOSED` " + "(`1`/`true` or `0`/`false`) overrides this at runtime. Either way " + "the fail-open counter is surfaced by `switchroom doctor`. Takes " + "effect on broker restart.")
   }).default({}).superRefine((broker, ctx) => {
     if (broker.approvalAuth === "telegram-id" && broker.autoUnlock !== true) {
       ctx.addIssue({
@@ -21948,7 +21964,9 @@ var FleetHealthConfigSchema = exports_external.object({
 });
 var HostdConfigSchema = exports_external.object({
   config_edit_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the `config_propose_edit` hostd verb (RFC " + "admin-agent-config-edit §3). Default false — the verb returns " + "`E_CONFIG_EDIT_DISABLED` until the operator explicitly flips " + "this to true. When true, admin agents can propose unified-diff " + "patches against " + "`/state/config/switchroom.yaml`, gated by an operator approval " + "card in the primary chat. Same trust posture as `update_apply` " + "and `agent_restart`: the human-in-the-loop tap is the security " + "boundary, not the agent's judgement."),
-  config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat.")
+  config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat."),
+  operator_attest_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the operator-passphrase 2nd factor on hostd's " + "mutating verbs (#1841, RFC host-control-daemon.md §5.4). Default " + "false — attestation is ACCEPTED-and-audited whenever present, but " + "no verb REQUIRES it (behaviour is byte-identical to today, so " + "existing fleets and the Telegram approval-card flow are unchanged). " + "When true, the verbs in `operator_attest_required_verbs` demand a " + "valid operator-passphrase attestation IN ADDITION to admin: hostd " + "forwards the passphrase to the vault broker over its own admin-client " + "connection (`/run/switchroom/broker/hostd/sock`) and treats a broker " + "DENIED as a gate failure. hostd never holds the passphrase. Leave " + "this off until BOTH the gateway passphrase-forward and the " + "cross-compose broker socket are deployed, or gated verbs will fail."),
+  operator_attest_required_verbs: exports_external.array(exports_external.string().min(1)).default(["update_apply", "apply", "rollout"]).describe("Which mutating hostd verbs REQUIRE a valid operator-passphrase " + "attestation when `operator_attest_enabled` is true (#1841). Default " + "is the RFC §5.4 fleet-mutation set (`update_apply`, `apply`, " + "`rollout`). Verbs NOT in this list still accept-and-audit an " + "attestation when one is supplied, but never require it. Ignored " + "entirely when `operator_attest_enabled` is false.")
 });
 var CronEgressSchema = exports_external.object({
   allowed_hosts: exports_external.array(exports_external.string().min(1)).default([]).describe("Hosts a poll may reach (exact, https-only). loopback/private/IP-literal are always rejected."),
@@ -22371,6 +22389,11 @@ function mergeAgentConfig(defaultsIn, agentIn) {
       if (v !== undefined)
         combined[k] = v;
     }
+    const baseSoul = base;
+    const overrideSoul = override;
+    if (baseSoul.shape !== undefined && (overrideSoul.shape === undefined || overrideSoul.shape === "generalist")) {
+      combined.shape = baseSoul.shape;
+    }
     merged.soul = combined;
   }
   if (defaults.memory || merged.memory) {
@@ -23230,18 +23253,22 @@ var tails = new Map;
 
 // src/agents/inject.ts
 var INJECT_COMMANDS = new Map([
-  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true }],
-  ["/status", { description: "Show session status", expectsOutput: true, dialog: true }],
-  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true }],
-  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true }],
-  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true }],
-  ["/model", { description: "Open model picker", expectsOutput: true }],
+  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/status", { description: "Show session status", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/help", { description: "Show help / command discovery", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/context", { description: "Show context window usage", expectsOutput: true, argsAllowed: false }],
+  ["/release-notes", { description: "Show release-notes version list", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/model", { description: "Open model picker", expectsOutput: true, argsAllowed: true }],
   [
     "/clear",
     {
       description: "Clear session screen",
       expectsOutput: false,
-      silentNote: "context cleared — fresh slate"
+      silentNote: "context cleared — fresh slate",
+      argsAllowed: false
     }
   ],
   [
@@ -23249,7 +23276,8 @@ var INJECT_COMMANDS = new Map([
     {
       description: "Compact conversation history",
       expectsOutput: false,
-      silentNote: "compaction runs silently"
+      silentNote: "compaction runs silently",
+      argsAllowed: false
     }
   ]
 ]);
@@ -23259,6 +23287,15 @@ var INJECT_BLOCKED = new Map([
   ["/logout", { reason: "would terminate the agent's auth session" }],
   ["/exit", { reason: "would kill the agent process" }],
   ["/quit", { reason: "would kill the agent process" }],
+  ["/upgrade", { reason: "mutates the Claude Code installation" }],
+  ["/init", { reason: "generates/overwrites CLAUDE.md and runs a model turn" }],
+  ["/mcp", { reason: "opens an interactive MCP server management dialog" }],
+  ["/permissions", { reason: "opens an interactive permissions editor that mutates tool policy" }],
+  ["/install-github-app", { reason: "runs a network/OAuth install flow" }],
+  ["/add-dir", { reason: "mutates the session's working-directory set" }],
+  ["/terminal-setup", { reason: "mutates terminal keybinding configuration" }],
+  ["/privacy-settings", { reason: "opens an interactive privacy-settings dialog" }],
+  ["/bug", { reason: "submits a bug report over the network" }],
   [
     "/effort",
     {
@@ -23276,6 +23313,7 @@ var HINDSIGHT_CONSUMER_NAME = "hindsight";
 var HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight";
 var HINDSIGHT_IMAGE = `${HINDSIGHT_IMAGE_REPO}:latest`;
 var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`;
+var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 
@@ -23308,6 +23346,8 @@ var KNOWN_VAULT_ARTIFACT_NAMES = new Set([
 var SCRYPT_MAXMEM = 128 * 1024 * 1024;
 
 // src/vault/broker/client.ts
+import * as net from "node:net";
+import * as fs from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join4 } from "node:path";
 
@@ -23520,7 +23560,8 @@ var ErrorCode = exports_external.enum([
   "DENIED",
   "UNKNOWN_KEY",
   "BAD_REQUEST",
-  "INTERNAL"
+  "INTERNAL",
+  "AUDIT_UNAVAILABLE"
 ]);
 var OkEntryResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -23657,16 +23698,123 @@ var ResponseSchema = exports_external.union([
   OkApprovalConsumeRecordResponseSchema,
   ErrorResponseSchema
 ]);
+function encodeRequest(req) {
+  const json = JSON.stringify(req);
+  if (Buffer.byteLength(json, "utf8") > MAX_FRAME_BYTES) {
+    throw new Error(`Request frame too large (${Buffer.byteLength(json, "utf8")} bytes; max ${MAX_FRAME_BYTES})`);
+  }
+  return json + `
+`;
+}
+function decodeResponse(line) {
+  if (Buffer.byteLength(line, "utf8") > MAX_FRAME_BYTES) {
+    throw new RangeError(`Response frame too large (${Buffer.byteLength(line, "utf8")} bytes; max ${MAX_FRAME_BYTES})`);
+  }
+  const obj = JSON.parse(line);
+  return ResponseSchema.parse(obj);
+}
+
+// src/runtime-mode.ts
+function isDockerRuntime() {
+  return process.env.SWITCHROOM_RUNTIME === "docker";
+}
 
 // src/vault/broker/client.ts
+var DEFAULT_TIMEOUT_MS = 2000;
 var LEGACY_SOCKET_PATH = join4(homedir3(), ".switchroom", "vault-broker.sock");
 var OPERATOR_SOCKET_PATH = join4(homedir3(), ".switchroom", "broker-operator", "sock");
+function defaultBrokerSocketPath() {
+  if (fs.existsSync(OPERATOR_SOCKET_PATH))
+    return OPERATOR_SOCKET_PATH;
+  if (isDockerRuntime())
+    return OPERATOR_SOCKET_PATH;
+  return LEGACY_SOCKET_PATH;
+}
+function resolveBrokerSocketPath(opts) {
+  if (opts?.socket)
+    return opts.socket;
+  const env = process.env.SWITCHROOM_VAULT_BROKER_SOCK;
+  if (env)
+    return env;
+  if (opts?.vaultBrokerSocket)
+    return opts.vaultBrokerSocket;
+  return defaultBrokerSocketPath();
+}
+async function rpcRaw(req, opts) {
+  return rpc(req, opts);
+}
+async function rpc(req, opts) {
+  const socketPath = resolveBrokerSocketPath(opts);
+  const timeoutMs = opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return new Promise((resolve5) => {
+    let settled = false;
+    const settle = (val) => {
+      if (settled)
+        return;
+      settled = true;
+      resolve5(val);
+    };
+    const client = new net.Socket;
+    const timer = setTimeout(() => {
+      client.destroy();
+      settle({ kind: "unreachable", msg: `broker did not respond within ${timeoutMs}ms` });
+    }, timeoutMs);
+    client.on("error", (err) => {
+      clearTimeout(timer);
+      const code = err.code ?? "ERR";
+      let msg;
+      if (code === "ENOENT")
+        msg = "broker socket not found (is the daemon running?)";
+      else if (code === "ECONNREFUSED")
+        msg = "broker socket exists but refused connection";
+      else if (code === "EACCES")
+        msg = "broker socket access denied (wrong UID?)";
+      else
+        msg = `broker connection failed: ${err.message}`;
+      settle({ kind: "unreachable", msg });
+    });
+    let buffer = "";
+    client.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const newlineIdx = buffer.indexOf(`
+`);
+      if (newlineIdx !== -1) {
+        const line = buffer.slice(0, newlineIdx).trimEnd();
+        clearTimeout(timer);
+        client.destroy();
+        try {
+          const resp = decodeResponse(line);
+          settle({ kind: "response", resp });
+        } catch (err) {
+          settle({
+            kind: "unreachable",
+            msg: `unparseable broker response: ${err instanceof Error ? err.message : String(err)}`
+          });
+        }
+      }
+    });
+    client.on("connect", () => {
+      try {
+        client.write(encodeRequest(req));
+      } catch (err) {
+        clearTimeout(timer);
+        client.destroy();
+        settle({
+          kind: "unreachable",
+          msg: `failed to send request: ${err instanceof Error ? err.message : String(err)}`
+        });
+      }
+    });
+    client.connect({ path: socketPath });
+  });
+}
 
 // src/vault/resolver.ts
 var materializedDirs = new Set;
 
 // src/agents/scaffold.ts
 var REPO_ROOT = resolve5(import.meta.dirname, "../..");
+var CLAUDE_MD_YOURS_PLACEHOLDER = "This space is yours. Add per-agent rules, exceptions, or context the " + "Switchroom template doesn't capture. Everything above the marker line is " + "regenerated on every apply; this section is preserved.";
 var SWITCHROOM_OWNED_SETTINGS_KEYS = new Set([
   "permissions",
   "mcpServers",
@@ -23697,8 +23845,8 @@ import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
 import { mkdir, chmod, chown, unlink, appendFile } from "node:fs/promises";
 import {
   readdirSync as readdirSync3,
-  existsSync as existsSync10,
-  readFileSync as readFileSync8,
+  existsSync as existsSync11,
+  readFileSync as readFileSync9,
   writeFileSync as writeFileSync5,
   renameSync as renameSync3,
   mkdirSync as mkdirSync4,
@@ -23719,7 +23867,8 @@ var IDEMPOTENCY_WINDOW_MS = 15000;
 var RequestEnvelope = {
   v: exports_external.literal(1),
   request_id: exports_external.string().min(1).max(128),
-  idempotency_key: exports_external.string().min(1).max(128).optional()
+  idempotency_key: exports_external.string().min(1).max(128).optional(),
+  operator_passphrase: exports_external.string().min(1).max(1024).optional()
 };
 var AgentRestartRequestSchema = exports_external.object({
   ...RequestEnvelope,
@@ -28399,9 +28548,9 @@ class PostHog extends PostHogBackendClient {
 
 // src/analytics/posthog.ts
 import {
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
@@ -28420,8 +28569,8 @@ function getDistinctId() {
     return cachedDistinctId;
   const path = resolveStatePath("analytics-id");
   try {
-    if (existsSync6(path)) {
-      const existing = readFileSync5(path, "utf-8").trim();
+    if (existsSync7(path)) {
+      const existing = readFileSync6(path, "utf-8").trim();
       if (existing) {
         cachedDistinctId = existing;
         return existing;
@@ -29040,7 +29189,7 @@ function redactedMarker(ruleId) {
   return `[REDACTED:${trimmed}]`;
 }
 // src/cli/install-detect.ts
-import * as fs from "node:fs";
+import * as fs2 from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
 var BIN_PATH = "/usr/local/bin/switchroom";
@@ -29054,12 +29203,12 @@ function detectInstallType() {
   try {
     const repoArtifact = sourceArtifactPath();
     const distPrefix = sourceDistPrefix();
-    const binExists = fs.existsSync(BIN_PATH);
-    const repoExists = fs.existsSync(repoArtifact);
+    const binExists = fs2.existsSync(BIN_PATH);
+    const repoExists = fs2.existsSync(repoArtifact);
     if (binExists) {
-      const lst = fs.lstatSync(BIN_PATH);
+      const lst = fs2.lstatSync(BIN_PATH);
       if (lst.isSymbolicLink()) {
-        const target = fs.readlinkSync(BIN_PATH);
+        const target = fs2.readlinkSync(BIN_PATH);
         const resolved = path.isAbsolute(target) ? target : path.resolve(path.dirname(BIN_PATH), target);
         if (resolved.startsWith(distPrefix)) {
           return {
@@ -29096,20 +29245,20 @@ var import_yaml3 = __toESM(require_dist(), 1);
 init_atomic();
 
 // src/cli/resolve-version.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
 import { dirname as dirname4, join as join7 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.18.11";
+var VERSION = "0.18.12";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 12 && dir && dir !== "/"; i++) {
     const p = join7(dir, "package.json");
-    if (existsSync8(p)) {
+    if (existsSync9(p)) {
       try {
-        const pkg = JSON.parse(readFileSync6(p, "utf-8"));
+        const pkg = JSON.parse(readFileSync7(p, "utf-8"));
         if (pkg?.name === "switchroom" && typeof pkg.version === "string") {
           return pkg.version;
         }
@@ -29170,6 +29319,8 @@ function parseAuditLine(line) {
     entry.error = o.error;
   if (typeof o.phase === "string")
     entry.phase = o.phase;
+  if (typeof o.method === "string")
+    entry.method = o.method;
   if (typeof o.stdout_tail === "string")
     entry.stdout_tail = o.stdout_tail;
   if (typeof o.stderr_tail === "string")
@@ -29418,7 +29569,7 @@ function parseUpdateResultLine(stdout) {
 
 // src/host-control/config-edit-validator.ts
 var import_yaml5 = __toESM(require_dist(), 1);
-import { mkdtempSync, writeFileSync as writeFileSync4, rmSync as rmSync2, existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync4, rmSync as rmSync2, existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join9, isAbsolute as isAbsolute2, normalize, basename as basename2 } from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
@@ -29530,17 +29681,44 @@ function validateShape(unifiedDiff, targetPath) {
       };
     }
   }
+  {
+    let inHunk = false;
+    let hunkHasContext = false;
+    const failZeroContext = {
+      ok: false,
+      code: "E_PATCH_INVALID_SHAPE",
+      detail: "zero-context hunk not allowed; regenerate the diff with context " + "lines (git diff default of 3)"
+    };
+    const scanLines = lines.length > 0 && lines[lines.length - 1] === "" ? lines.slice(0, -1) : lines;
+    for (const ln of scanLines) {
+      if (ln.startsWith("@@")) {
+        if (inHunk && !hunkHasContext)
+          return failZeroContext;
+        inHunk = true;
+        hunkHasContext = false;
+      } else if (ln.startsWith("--- ") || ln.startsWith("+++ ")) {
+        if (inHunk && !hunkHasContext)
+          return failZeroContext;
+        inHunk = false;
+      } else if (inHunk) {
+        if (ln.startsWith(" ") || ln === "")
+          hunkHasContext = true;
+      }
+    }
+    if (inHunk && !hunkHasContext)
+      return failZeroContext;
+  }
   return null;
 }
 function applyPatch(unifiedDiff, configPath, gitBin) {
-  if (!existsSync9(configPath)) {
+  if (!existsSync10(configPath)) {
     return {
       ok: false,
       code: "E_PATCH_APPLY_FAILED",
       detail: `target config not found at ${configPath}`
     };
   }
-  const liveContent = readFileSync7(configPath, "utf8");
+  const liveContent = readFileSync8(configPath, "utf8");
   const scratchDir = mkdtempSync(join9(tmpdir(), "config-propose-edit-"));
   try {
     const targetBasename = configPath.split("/").pop() ?? "switchroom.yaml";
@@ -29553,8 +29731,7 @@ function applyPatch(unifiedDiff, configPath, gitBin) {
     const baseArgs = [
       "apply",
       "--whitespace=nowarn",
-      "--recount",
-      "--unidiff-zero"
+      "--recount"
     ];
     const checkP1 = spawnSync2(bin, [...baseArgs.slice(0, 1), "--check", ...baseArgs.slice(1), "-p1", patchFile], { cwd: scratchDir, encoding: "utf8", timeout: 1e4 });
     let pStrip = "-p1";
@@ -29578,7 +29755,7 @@ function applyPatch(unifiedDiff, configPath, gitBin) {
         detail: `git apply failed: ${(real.stderr || "").trim().slice(0, 500)}`
       };
     }
-    const after = readFileSync7(scratchFile, "utf8");
+    const after = readFileSync8(scratchFile, "utf8");
     return { ok: true, after };
   } finally {
     rmSync2(scratchDir, { recursive: true, force: true });
@@ -29776,7 +29953,7 @@ function validateConfigEdit(opts) {
     return schemaErr;
   let beforeData = {};
   try {
-    const beforeRaw = existsSync9(opts.configPath) ? readFileSync7(opts.configPath, "utf8") : "";
+    const beforeRaw = existsSync10(opts.configPath) ? readFileSync8(opts.configPath, "utf8") : "";
     const beforeDoc = import_yaml5.parseDocument(beforeRaw, { merge: false, strict: false });
     beforeData = beforeDoc.toJS();
   } catch {
@@ -30225,12 +30402,12 @@ function collectScheduleEntries(config) {
 // src/agent-scheduler/replay.ts
 var STALE_LOOKBACK_MAX_MIN = 14 * 24 * 60;
 function readRecentFires(jsonlPath) {
-  const fs2 = __require("node:fs");
-  if (!fs2.existsSync(jsonlPath))
+  const fs3 = __require("node:fs");
+  if (!fs3.existsSync(jsonlPath))
     return [];
   let raw;
   try {
-    raw = fs2.readFileSync(jsonlPath, "utf8");
+    raw = fs3.readFileSync(jsonlPath, "utf8");
   } catch {
     return [];
   }
@@ -30248,6 +30425,13 @@ function readRecentFires(jsonlPath) {
 }
 
 // src/host-control/server.ts
+var HOSTD_BROKER_SOCKET_PATH = "/run/switchroom/broker/hostd/sock";
+var DEFAULT_OPERATOR_ATTEST_VERBS = [
+  "update_apply",
+  "apply",
+  "rollout"
+];
+var ATTEST_AUDIT_METHOD = "passphrase-attest";
 function resolveDigests(imageRefs) {
   const out = new Map;
   for (const ref of imageRefs) {
@@ -30272,9 +30456,9 @@ function resolveDigests(imageRefs) {
 function readCachedInstallType(bindRoot) {
   const cacheDir = join10(bindRoot, ".switchroom");
   const cachePath = join10(cacheDir, "install-type.json");
-  if (existsSync10(cachePath)) {
+  if (existsSync11(cachePath)) {
     try {
-      const raw = readFileSync8(cachePath, "utf-8");
+      const raw = readFileSync9(cachePath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed.install_type === "string" && typeof parsed.detected_at === "string") {
         return parsed;
@@ -30323,7 +30507,7 @@ function writeFileInPlacePreservingInode(targetPath, content) {
   } finally {
     closeSync3(fd);
   }
-  const readBack = readFileSync8(targetPath);
+  const readBack = readFileSync9(targetPath);
   if (readBack.length !== buf.length) {
     throw new Error(`in-place write short: wrote ${buf.length} bytes but read back ${readBack.length}`);
   }
@@ -30369,7 +30553,7 @@ class HostdServer {
         await chmod(dir, 493).catch(() => {
           return;
         });
-        if (existsSync10(sockPath))
+        if (existsSync11(sockPath))
           await unlink(sockPath).catch(() => {
             return;
           });
@@ -30406,7 +30590,7 @@ class HostdServer {
           await chmod(dir, 493).catch(() => {
             return;
           });
-          if (existsSync10(sockPath))
+          if (existsSync11(sockPath))
             await unlink(sockPath).catch(() => {
               return;
             });
@@ -30442,11 +30626,11 @@ class HostdServer {
   }
   async reconcileOrphanedFleetMutations() {
     const path2 = this.auditLogPath();
-    if (!existsSync10(path2))
+    if (!existsSync11(path2))
       return;
     let raw;
     try {
-      raw = readFileSync8(path2, "utf-8");
+      raw = readFileSync9(path2, "utf-8");
     } catch {
       return;
     }
@@ -30584,6 +30768,15 @@ class HostdServer {
       socket.end();
       return;
     }
+    const attest = await this.checkOperatorAttest(req, caller);
+    if (attest.denied !== null) {
+      const resp2 = deniedResponse(req.request_id, attest.denied);
+      await this.writeAudit({ caller, req, resp: resp2, method: attest.method });
+      socket.write(encodeResponse(resp2));
+      socket.end();
+      return;
+    }
+    const attestMethod = attest.method;
     const started = Date.now();
     let resp;
     try {
@@ -30642,10 +30835,70 @@ class HostdServer {
       resp = err("E_DISPATCH_FAILED", "hostd dispatch failed").why(msg).op(req.op).caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).build(req.request_id, Date.now() - started);
       resp = { ...resp, error: `hostd dispatch failed: ${msg}` };
     }
-    await this.writeAudit({ caller, req, resp });
+    await this.writeAudit({ caller, req, resp, method: attestMethod });
     socket.write(encodeResponse(resp));
     socket.end();
   }
+  async checkOperatorAttest(req, caller) {
+    const hostdCfg = this.opts.config.hostd;
+    if (hostdCfg?.operator_attest_enabled !== true) {
+      return { denied: null };
+    }
+    if (caller.kind === "operator")
+      return { denied: null };
+    const requiredVerbs = hostdCfg.operator_attest_required_verbs ?? DEFAULT_OPERATOR_ATTEST_VERBS;
+    const required = requiredVerbs.includes(req.op);
+    const passphrase = req.operator_passphrase;
+    if (!required) {
+      if (passphrase === undefined)
+        return { denied: null };
+      const v2 = await this.attestVerifier().verify(passphrase);
+      return v2.ok ? { denied: null, method: ATTEST_AUDIT_METHOD } : {
+        denied: `${req.op} operator-attest failed: ${v2.reason}`,
+        method: ATTEST_AUDIT_METHOD
+      };
+    }
+    if (passphrase === undefined) {
+      return {
+        denied: `${req.op} requires operator-passphrase attestation ` + `(hostd.operator_attest_enabled is on and ${req.op} is in ` + `operator_attest_required_verbs)`,
+        method: ATTEST_AUDIT_METHOD
+      };
+    }
+    const v = await this.attestVerifier().verify(passphrase);
+    return v.ok ? { denied: null, method: ATTEST_AUDIT_METHOD } : {
+      denied: `${req.op} operator-attest failed: ${v.reason}`,
+      method: ATTEST_AUDIT_METHOD
+    };
+  }
+  attestVerifier() {
+    if (this.opts.attestVerifier)
+      return this.opts.attestVerifier;
+    if (!this._defaultAttestVerifier) {
+      this._defaultAttestVerifier = {
+        verify: (passphrase) => this.brokerAttestVerify(passphrase)
+      };
+    }
+    return this._defaultAttestVerifier;
+  }
+  _defaultAttestVerifier;
+  async brokerAttestVerify(passphrase) {
+    const res = await rpcRaw({
+      v: 1,
+      op: "list_grants",
+      agent: "hostd",
+      passphrase
+    }, { vaultBrokerSocket: HOSTD_BROKER_SOCKET_PATH, timeoutMs: 5000 });
+    if (res.kind === "unreachable") {
+      return { ok: false, reason: `broker unreachable: ${res.msg}` };
+    }
+    const resp = res.resp;
+    if (resp.ok === true)
+      return { ok: true };
+    return {
+      ok: false,
+      reason: `broker denied attestation (${resp.code ?? "DENIED"})`
+    };
+  }
   checkGate(req, caller) {
     if (caller.kind === "operator")
       return null;
@@ -30779,7 +31032,7 @@ class HostdServer {
       join10(root, "profiles"),
       join10(root, "profiles", "default"),
       join10(root, "vendor", "hindsight-memory")
-    ].filter((p) => !existsSync10(p));
+    ].filter((p) => !existsSync11(p));
   }
   applyAssetPreflight(request_id, started) {
     const missing = this.missingApplyAssets();
@@ -30889,6 +31142,26 @@ class HostdServer {
     const assetDenied = this.applyAssetPreflight(req.request_id, started);
     if (assetDenied)
       return assetDenied;
+    if (req.args.agents !== undefined) {
+      let validAgents = null;
+      try {
+        const cfg = loadConfig(this.opts.configPath);
+        validAgents = Object.keys(cfg.agents ?? {});
+      } catch {
+        validAgents = null;
+      }
+      if (validAgents !== null) {
+        const buildDenied = (human) => err("E_UNKNOWN_AGENT", human).fixBadInput("agents").op("rollout").caller(caller.kind).agentName(caller.kind === "agent" ? caller.name : undefined).asDenied().build(req.request_id, Date.now() - started);
+        const requested = req.args.agents;
+        if (requested.length === 0) {
+          return buildDenied(`empty agents list — pass at least one agent, ` + `or omit "agents" to roll all. Valid agents: ${validAgents.join(", ")}`);
+        }
+        const unknown = requested.filter((a) => !validAgents.includes(a));
+        if (unknown.length > 0) {
+          return buildDenied(`unknown agent(s): ${unknown.join(", ")}. ` + `Valid agents: ${validAgents.join(", ")}`);
+        }
+      }
+    }
     const entry = this.launchRollout(req.args, req.request_id, caller, started);
     return {
       v: 1,
@@ -30952,10 +31225,10 @@ class HostdServer {
   async beginSelfBump(req, caller, started) {
     const ownVersion = this.opts.selfVersion ?? SWITCHROOM_VERSION;
     const composePath = join10(this.hostdDirPath(), "docker-compose.yml");
-    if (!existsSync10(composePath)) {
+    if (!existsSync11(composePath)) {
       return deniedResponse(req.request_id, `rollout: hostd's CLI (v${ownVersion}) is older than the target ` + `${req.args.pin} and needs a self-bump first, but its compose file ` + `is missing at ${composePath}. Run \`switchroom hostd install ` + `--tag ${req.args.pin}\` on the host, then re-run the roll. ` + `Nothing was changed.`, Date.now() - started);
     }
-    const before = readFileSync8(composePath, "utf8");
+    const before = readFileSync9(composePath, "utf8");
     const bumped = bumpHostdComposeImageTag(before, req.args.pin);
     if (!bumped) {
       return deniedResponse(req.request_id, `rollout: hostd needs a self-bump to ${req.args.pin} but no ` + `switchroom-hostd image line was found in ${composePath} ` + `(hand-edited compose?). Run \`switchroom hostd install --tag ` + `${req.args.pin}\` on the host, then re-run the roll. Nothing ` + `was changed.`, Date.now() - started);
@@ -31086,11 +31359,11 @@ class HostdServer {
   }
   async resumePendingSelfBumpRollout() {
     const markerPath = join10(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
-    if (!existsSync10(markerPath))
+    if (!existsSync11(markerPath))
       return;
     let raw;
     try {
-      raw = readFileSync8(markerPath, "utf8");
+      raw = readFileSync9(markerPath, "utf8");
     } finally {
       try {
         unlinkSync2(markerPath);
@@ -31221,18 +31494,19 @@ class HostdServer {
     if (!verdict.ok) {
       return err(verdict.code, verdict.detail).fixBadInput("unified_diff").op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).build(req.request_id, Date.now() - started);
     }
+    let beforeContent;
+    try {
+      beforeContent = readFileSync9(configPath, "utf-8");
+    } catch {
+      beforeContent = "";
+    }
     if (caller.kind === "agent" && this.opts.config.agents[caller.name]?.admin !== true) {
-      let beforeContent;
-      try {
-        beforeContent = readFileSync8(configPath, "utf-8");
-      } catch {
-        beforeContent = "";
-      }
       const admission = admitSelfScopedNonAdminEdit(beforeContent, verdict.postApplyContent, caller.name);
       if (!admission.ok) {
         return err("E_NOT_SELF_SCOPED", admission.detail).why("non-admin agents may only add rules to their own " + "agents.<self>.tools.allow OR append their own " + "agents.<self>.memory.mental_models via config_propose_edit " + `(mental-model check: ${admission.mentalModelDetail})`).fixBadInput("unified_diff").op("config_propose_edit").caller("agent").agentName(caller.name).asDenied().build(req.request_id, Date.now() - started);
       }
     }
+    const proposedChangedPaths = classifyBlastRadius(beforeContent, verdict.postApplyContent).changedPaths;
     if (!this.opts.approvalGateway) {
       return err("E_NO_APPROVAL_GATEWAY", "validation passed but hostd was started without an approval-gateway wiring; the operator build is missing the telegram-plugin link").fixOperatorAction("infra", [
         "ensure hostd was launched with --approval-gateway / telegram-plugin link"
@@ -31246,23 +31520,42 @@ class HostdServer {
 `);
       return await pending;
     }
-    const rate = this.checkConfigEditRate(callerName, Date.now());
-    if (!rate.ok) {
-      const retryAtIso = new Date(rate.retryAtMs).toISOString();
-      process.stderr.write(`hostd: config_propose_edit — RATE-LIMITED ${callerName} ` + `(>${rate.limit}/hour); next slot ${retryAtIso}
+    const run = this.runConfigProposeRateThenApply(req, caller, callerName, configPath, started, proposedChangedPaths);
+    this.inflightConfigProposals.set(dedupeKey, run);
+    try {
+      return await run;
+    } finally {
+      this.inflightConfigProposals.delete(dedupeKey);
+    }
+  }
+  async runConfigProposeRateThenApply(req, caller, callerName, configPath, started, proposedChangedPaths) {
+    let preApproved = false;
+    try {
+      if (this.opts.approvalGateway.checkPreApproved) {
+        preApproved = await this.opts.approvalGateway.checkPreApproved(callerName, req.args.unified_diff);
+      }
+    } catch {
+      preApproved = false;
+    }
+    if (!preApproved) {
+      const rate = this.checkConfigEditRate(callerName, Date.now());
+      if (!rate.ok) {
+        const retryAtIso = new Date(rate.retryAtMs).toISOString();
+        process.stderr.write(`hostd: config_propose_edit — RATE-LIMITED ${callerName} ` + `(>${rate.limit}/hour); next slot ${retryAtIso}
 `);
-      this.appendAuditRow({
-        ts: new Date().toISOString(),
-        op: "config_propose_edit",
-        phase: "rate_limited",
-        request_id: req.request_id,
-        caller: caller.kind === "agent" ? { kind: "agent", name: caller.name } : { kind: "operator" },
-        result: "denied",
-        exit_code: null,
-        duration_ms: Date.now() - started,
-        error: `E_RATE_LIMITED: >${rate.limit} config_propose_edit cards/hour`
-      });
-      return err("E_RATE_LIMITED", `config_propose_edit rate limit exceeded (max ${rate.limit}/hour for this agent)`).why(`next slot opens at ${retryAtIso}`).fixRetryAfter(retryAtIso).op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).asDenied().build(req.request_id, Date.now() - started);
+        this.appendAuditRow({
+          ts: new Date().toISOString(),
+          op: "config_propose_edit",
+          phase: "rate_limited",
+          request_id: req.request_id,
+          caller: caller.kind === "agent" ? { kind: "agent", name: caller.name } : { kind: "operator" },
+          result: "denied",
+          exit_code: null,
+          duration_ms: Date.now() - started,
+          error: `E_RATE_LIMITED: >${rate.limit} config_propose_edit cards/hour`
+        });
+        return err("E_RATE_LIMITED", `config_propose_edit rate limit exceeded (max ${rate.limit}/hour for this agent)`).why(`next slot opens at ${retryAtIso}`).fixRetryAfter(retryAtIso).op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).asDenied().build(req.request_id, Date.now() - started);
+      }
     }
     this.appendAuditRow({
       ts: new Date().toISOString(),
@@ -31272,15 +31565,10 @@ class HostdServer {
       caller: caller.kind === "agent" ? { kind: "agent", name: caller.name } : { kind: "operator" },
       result: "started",
       exit_code: null,
-      duration_ms: Date.now() - started
+      duration_ms: Date.now() - started,
+      ...preApproved ? { pre_approved: true } : {}
     });
-    const run = this.runConfigProposeApprovalAndApply(req, caller, callerName, configPath, verdict.postApplyContent, started);
-    this.inflightConfigProposals.set(dedupeKey, run);
-    try {
-      return await run;
-    } finally {
-      this.inflightConfigProposals.delete(dedupeKey);
-    }
+    return await this.runConfigProposeApprovalAndApply(req, caller, callerName, configPath, started, proposedChangedPaths);
   }
   inflightConfigProposals = new Map;
   configEditPostTimes = new Map;
@@ -31299,7 +31587,7 @@ class HostdServer {
     this.configEditPostTimes.set(callerName, prior);
     return { ok: true };
   }
-  async runConfigProposeApprovalAndApply(req, caller, callerName, configPath, postApply, started) {
+  async runConfigProposeApprovalAndApply(req, caller, callerName, configPath, started, proposedChangedPaths) {
     const approvalId = (this.opts.generateApprovalId ?? defaultApprovalId)();
     const approval = await this.opts.approvalGateway.requestApproval({
       requestId: approvalId,
@@ -31328,7 +31616,7 @@ class HostdServer {
     try {
       let snapshot;
       try {
-        snapshot = readFileSync8(configPath, "utf-8");
+        snapshot = readFileSync9(configPath, "utf-8");
       } catch (e) {
         await approval.finalize({
           outcome: "reconcile_failed_rolled_back",
@@ -31336,8 +31624,43 @@ class HostdServer {
         });
         return this.reconcileFailedRolledBack(`snapshot read failed: ${e.message}`, req, caller, started);
       }
+      const reverdict = validateConfigEdit({
+        configPath,
+        targetPath: req.args.target_path,
+        unifiedDiff: req.args.unified_diff
+      });
+      if (!reverdict.ok) {
+        const why = `stored diff no longer applies against the current config` + `: ${reverdict.detail}`;
+        await approval.finalize({
+          outcome: "aborted_config_changed",
+          detail: `config changed since proposal — re-propose (${why})`
+        });
+        return this.configChangedSinceProposal(why, req, caller, started);
+      }
+      const postApplyFresh = reverdict.postApplyContent;
+      const applyChangedPaths = classifyBlastRadius(snapshot, postApplyFresh).changedPaths;
+      const sameChangeSet = applyChangedPaths.length === proposedChangedPaths.length && applyChangedPaths.every((p, i) => p === proposedChangedPaths[i]);
+      if (!sameChangeSet) {
+        const why = `re-applied diff changes different config paths than approved ` + `(approved: [${proposedChangedPaths.join(", ")}]; ` + `would change: [${applyChangedPaths.join(", ")}])`;
+        await approval.finalize({
+          outcome: "aborted_config_changed",
+          detail: `config changed since proposal — re-propose (${why})`
+        });
+        return this.configChangedSinceProposal(why, req, caller, started);
+      }
+      if (caller.kind === "agent" && this.opts.config.agents[caller.name]?.admin !== true) {
+        const reAdmission = admitSelfScopedNonAdminEdit(snapshot, postApplyFresh, caller.name);
+        if (!reAdmission.ok) {
+          const why = `re-applied diff is no longer self-scoped for non-admin caller ` + `"${caller.name}": ${reAdmission.detail}`;
+          await approval.finalize({
+            outcome: "aborted_config_changed",
+            detail: `config changed since proposal — re-propose (${why})`
+          });
+          return this.configChangedSinceProposal(why, req, caller, started);
+        }
+      }
       try {
-        writeFileInPlacePreservingInode(configPath, postApply);
+        writeFileInPlacePreservingInode(configPath, postApplyFresh);
       } catch (e) {
         try {
           writeFileInPlacePreservingInode(configPath, snapshot);
@@ -31351,7 +31674,7 @@ class HostdServer {
       const runner = this.opts.runReconcile ?? (async () => this.runSwitchroom(caller.kind === "agent" ? ["apply", "--only", callerName, "--non-interactive"] : ["apply", "--non-interactive"]));
       const recRes = await runner({ requestId: approvalId });
       if (recRes.exit_code === 0) {
-        const blast = classifyBlastRadius(snapshot, postApply);
+        const blast = classifyBlastRadius(snapshot, postApplyFresh);
         await approval.finalize({
           outcome: "applied",
           affectedAgents: blast.agents,
@@ -31389,6 +31712,11 @@ class HostdServer {
       release();
     }
   }
+  configChangedSinceProposal(why, req, caller, started) {
+    const legacy = `E_CONFIG_CHANGED: config changed since proposal — re-propose (${why})`;
+    const built = err("E_CONFIG_CHANGED", "config changed since the proposal was validated; re-propose against the current config").why(why).fixBadInput("unified_diff").op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).asDenied().build(req.request_id, Date.now() - started);
+    return { ...built, error: legacy };
+  }
   reconcileFailedRolledBack(detail, req, caller, started, output) {
     const legacy = `E_RECONCILE_FAILED_ROLLED_BACK: ${detail}`;
     const built = err("E_RECONCILE_FAILED_ROLLED_BACK", "config write or reconcile failed; live file rolled back to snapshot").why(detail).fixOperatorAction("infra", [
@@ -31581,7 +31909,7 @@ ${output.recovery.stderr}` : "";
       return this.opts.imageRefsForDigests();
     try {
       const composePath = join10(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
-      if (!existsSync10(composePath))
+      if (!existsSync11(composePath))
         return [];
       const r = spawnSync3("docker", [
         "compose",
@@ -31720,10 +32048,10 @@ ${output.recovery.stderr}` : "";
   }
   rolloutRowExistsInLog(targetRequestId) {
     const path2 = this.auditLogPath();
-    if (!existsSync10(path2))
+    if (!existsSync11(path2))
       return false;
     try {
-      const raw = readFileSync8(path2, "utf-8");
+      const raw = readFileSync9(path2, "utf-8");
       return latestRolloutRowForRequest(raw, targetRequestId) !== null;
     } catch {
       return false;
@@ -31731,11 +32059,11 @@ ${output.recovery.stderr}` : "";
   }
   rolloutStatusFromLog(responseRequestId, targetRequestId, started) {
     const path2 = this.auditLogPath();
-    if (!existsSync10(path2))
+    if (!existsSync11(path2))
       return null;
     let raw;
     try {
-      raw = readFileSync8(path2, "utf-8");
+      raw = readFileSync9(path2, "utf-8");
     } catch {
       return null;
     }
@@ -31840,6 +32168,7 @@ ${output.recovery.stderr}` : "";
     await this.appendAuditRow({
       ts: new Date().toISOString(),
       op: args.req.op,
+      ...args.method ? { method: args.method } : {},
       caller: args.caller.kind === "agent" ? { kind: "agent", name: args.caller.name } : { kind: "operator" },
       request_id: args.req.request_id,
       result: args.resp.result,
@@ -32068,12 +32397,83 @@ function isSafeExecArgvElement(s) {
 
 // src/host-control/approval-gateway.ts
 import { connect as connect2 } from "node:net";
+import { randomBytes as randomBytes2 } from "node:crypto";
+var PRE_APPROVED_QUERY_TIMEOUT_MS = 2000;
 
 class SocketApprovalGateway {
   opts;
   constructor(opts) {
     this.opts = opts;
   }
+  async checkPreApproved(agentName, unifiedDiff) {
+    const sockPath = this.opts.resolveGatewaySocket(agentName);
+    if (sockPath === null)
+      return false;
+    const log = this.opts.log ?? (() => {});
+    const correlationId = `preapp-${randomBytes2(8).toString("hex")}`;
+    return await new Promise((resolve9) => {
+      let settled = false;
+      const client2 = connect2({ path: sockPath });
+      let buffer = "";
+      const done = (result) => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        try {
+          client2.destroy();
+        } catch {}
+        resolve9(result);
+      };
+      const timer = setTimeout(() => {
+        log(`checkPreApproved timed out after ${PRE_APPROVED_QUERY_TIMEOUT_MS}ms (agent=${agentName}) — failing closed`);
+        done(false);
+      }, PRE_APPROVED_QUERY_TIMEOUT_MS);
+      client2.on("connect", () => {
+        try {
+          client2.write(JSON.stringify({
+            type: "check_pre_approved",
+            agentName,
+            correlationId,
+            unifiedDiff
+          }) + `
+`);
+        } catch (err2) {
+          log(`check_pre_approved write failed (agent=${agentName}): ${err2.message} — failing closed`);
+          done(false);
+        }
+      });
+      client2.on("data", (chunk2) => {
+        buffer += chunk2.toString("utf8");
+        const lines = buffer.split(`
+`);
+        buffer = lines.pop() ?? "";
+        for (const line of lines) {
+          if (!line.trim())
+            continue;
+          let parsed;
+          try {
+            parsed = JSON.parse(line);
+          } catch {
+            done(false);
+            return;
+          }
+          const obj = parsed;
+          if (obj.type === "pre_approved_result" && obj.correlationId === correlationId) {
+            done(obj.preApproved === true);
+            return;
+          }
+          done(false);
+          return;
+        }
+      });
+      client2.on("error", (err2) => {
+        log(`checkPreApproved socket error (agent=${agentName}): ${err2.message} — failing closed`);
+        done(false);
+      });
+      client2.on("close", () => done(false));
+    });
+  }
   async requestApproval(req) {
     const sockPath = this.opts.resolveGatewaySocket(req.agentName);
     if (sockPath === null) {
@@ -32914,7 +33314,7 @@ async function loadConfigResilient() {
       try {
         for (const name of readdirSync4(agentsDir).sort()) {
           const sock = resolve9(agentsDir, name, "telegram", "gateway.sock");
-          if (existsSync11(sock))
+          if (existsSync12(sock))
             out.push({ agent: name, sock });
         }
       } catch {}
@@ -32964,7 +33364,7 @@ async function main() {
   const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join11(homedir6(), ".switchroom", "agents");
   const resolveGatewaySocket = (agentName) => {
     const sock = resolve9(agentsDir, agentName, "telegram", "gateway.sock");
-    return existsSync11(sock) ? sock : null;
+    return existsSync12(sock) ? sock : null;
   };
   const approvalGateway = new SocketApprovalGateway({
     resolveGatewaySocket,
@@ -32992,7 +33392,11 @@ async function main() {
       ])),
       ...config.hostd ? {
         hostd: {
-          ...config.hostd.config_edit_enabled !== undefined ? { config_edit_enabled: config.hostd.config_edit_enabled } : {}
+          ...config.hostd.config_edit_enabled !== undefined ? { config_edit_enabled: config.hostd.config_edit_enabled } : {},
+          ...config.hostd.operator_attest_enabled !== undefined ? { operator_attest_enabled: config.hostd.operator_attest_enabled } : {},
+          ...config.hostd.operator_attest_required_verbs !== undefined ? {
+            operator_attest_required_verbs: config.hostd.operator_attest_required_verbs
+          } : {}
         }
       } : {}
     },