switchroom 0.18.11 → 0.18.12

package/dist/vault/broker/server.js

@@ -4116,7 +4116,12 @@ var init_schema = __esm(() => {
   AgentSoulSchema = exports_external.object({
     name: exports_external.string().describe("Agent persona name (e.g., 'Coach', 'Sage')"),
     style: exports_external.string().describe("Communication style description"),
-    boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers")
+    creature: exports_external.string().optional().describe("Persona creature/form (e.g., 'owl', 'octopus')"),
+    vibe: exports_external.string().optional().describe("One-line personality vibe (e.g., 'calm, precise')"),
+    expertise: exports_external.string().optional().describe("Domain expertise summary rendered into the persona"),
+    emoji: exports_external.string().optional().describe("Signature emoji for the persona (e.g., '\uD83E\uDD89')"),
+    boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers"),
+    shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).default("generalist").describe("Persona-shape discriminator the per-agent CLAUDE.md template can " + "branch on (e.g., 'you are an executive assistant' vs 'a senior " + "engineer'). No runtime behavior yet — template work lands in a " + "later issue. Cascade: override (per-agent wins over default).")
   }).optional();
   AgentToolsSchema = exports_external.object({
     allow: exports_external.array(exports_external.string()).default([]).describe("Allowed tools (use ['all'] for unrestricted)"),
@@ -4281,6 +4286,11 @@ var init_schema = __esm(() => {
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
     }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
+    button_choice_confirmation: exports_external.object({
+      enabled: exports_external.boolean().default(false).describe("When true, tapping an agent-emitted inline_keyboard button annotates " + "the source message body with a '✅ You chose: <label> · HH:MM' line so " + "the chat surface is self-documenting. Only applies to single-use " + "keyboards (re-tappable keyboards are never annotated). Requires the " + "agent's parseMode to be the default 'html'. Opt-in (default false). " + "Limitation: the annotated body is rebuilt from the message's plain " + "text, so any formatting entities (bold, links, code, ...) on the " + "original message are lost when the annotation is applied."),
+      format: exports_external.string().default("✅ You chose: {label} · {time}").describe("Template for the annotation line. `{label}` is replaced with the " + "tapped button's text (newlines stripped, HTML-escaped, trimmed to 60 " + "chars) and `{time}` with HH:MM in the chosen timezone. Note: retap " + "dedup (replacing a prior annotation instead of appending another " + "line) only recognizes the DEFAULT format shape — a custom format " + "accumulates one line per retap."),
+      timezone: exports_external.enum(["gateway", "utc"]).default("gateway").describe("Timezone for the {time} placeholder. 'gateway' uses the gateway " + "process's local time; 'utc' uses UTC. Per-user timezones are out of " + "scope for v1.")
+    }).optional().describe("Auto-confirm 'You chose: X' annotation on inline_keyboard taps (#789). " + "Cascades from defaults.channels.telegram.button_choice_confirmation."),
     webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
     webhook_dispatch: exports_external.object({
       github: exports_external.array(webhookDispatchRule).optional(),
@@ -4429,7 +4439,12 @@ var init_schema = __esm(() => {
     soul: exports_external.object({
       name: exports_external.string().optional(),
       style: exports_external.string().optional(),
-      boundaries: exports_external.string().optional()
+      creature: exports_external.string().optional(),
+      vibe: exports_external.string().optional(),
+      expertise: exports_external.string().optional(),
+      emoji: exports_external.string().optional(),
+      boundaries: exports_external.string().optional(),
+      shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).optional()
     }).optional(),
     tools: exports_external.object({
       allow: exports_external.array(exports_external.string()).optional(),
@@ -4626,7 +4641,8 @@ var init_schema = __esm(() => {
       autoUnlockCredentialPath: exports_external.string().default("~/.switchroom/vault-auto-unlock").describe("Path to the machine-bound auto-unlock blob (see " + "src/vault/auto-unlock.ts for the format). Default lives under " + "~/.switchroom so it can be bind-mounted into the vault-broker " + "container by docker compose. Tilde-expansion happens " + "at read time."),
       approvalAuth: exports_external.enum(["passphrase", "telegram-id"]).default("passphrase").describe("Posture for tap-to-Approve on vault grant cards. `passphrase` " + "(default) prompts the operator to type the vault passphrase on " + "every Approve — two-factor (Telegram ID + passphrase). " + "`telegram-id` mints immediately on Approve with no passphrase " + "prompt — single-factor (Telegram ID only); REQUIRES " + "`autoUnlock: true` so the broker already holds the passphrase. " + "Trades a factor of security for smoother UX; opt-in only."),
       postureMintAgents: exports_external.array(exports_external.string().min(1)).default([]).describe("Per-agent opt-in for posture-attested broker calls (`mint_grant` / " + "`list_grants` / `put` with `attest_via_posture: true`). Only agents " + "whose names are in this list can use the silent-mint path under " + "`approvalAuth: telegram-id`. Default `[]` — no agent can self-mint " + "until the operator explicitly opts it in. The request's `agent` " + "field must also equal the calling peer's resolved agent name " + "(broker rejects cross-agent posture mints). When `approvalAuth` is " + "`passphrase` this list is ignored — passphrase attestation still " + "works as before. Each entry is an agent slug exactly as it appears " + "under `agents:` in this config."),
-      adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload).")
+      adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload)."),
+      auditFailClosed: exports_external.boolean().default(false).describe("sec WS10-F3 (#1420) — fail-CLOSED on an audit-append failure. When " + "`false` (default, backward-compatible) the broker fails OPEN: if a " + "vault-audit.log append fails it logs to stderr, bumps the durable " + "fail-open counter, and STILL releases the secret. When `true`, a " + "failed audit append DENIES the secret release with " + "`AUDIT_UNAVAILABLE` — no secret leaves the broker without a durable " + "audit row. The env var `SWITCHROOM_VAULT_AUDIT_FAIL_CLOSED` " + "(`1`/`true` or `0`/`false`) overrides this at runtime. Either way " + "the fail-open counter is surfaced by `switchroom doctor`. Takes " + "effect on broker restart.")
     }).default({}).superRefine((broker, ctx) => {
       if (broker.approvalAuth === "telegram-id" && broker.autoUnlock !== true) {
         ctx.addIssue({
@@ -4665,7 +4681,9 @@ var init_schema = __esm(() => {
   });
   HostdConfigSchema = exports_external.object({
     config_edit_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the `config_propose_edit` hostd verb (RFC " + "admin-agent-config-edit §3). Default false — the verb returns " + "`E_CONFIG_EDIT_DISABLED` until the operator explicitly flips " + "this to true. When true, admin agents can propose unified-diff " + "patches against " + "`/state/config/switchroom.yaml`, gated by an operator approval " + "card in the primary chat. Same trust posture as `update_apply` " + "and `agent_restart`: the human-in-the-loop tap is the security " + "boundary, not the agent's judgement."),
-    config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat.")
+    config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat."),
+    operator_attest_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the operator-passphrase 2nd factor on hostd's " + "mutating verbs (#1841, RFC host-control-daemon.md §5.4). Default " + "false — attestation is ACCEPTED-and-audited whenever present, but " + "no verb REQUIRES it (behaviour is byte-identical to today, so " + "existing fleets and the Telegram approval-card flow are unchanged). " + "When true, the verbs in `operator_attest_required_verbs` demand a " + "valid operator-passphrase attestation IN ADDITION to admin: hostd " + "forwards the passphrase to the vault broker over its own admin-client " + "connection (`/run/switchroom/broker/hostd/sock`) and treats a broker " + "DENIED as a gate failure. hostd never holds the passphrase. Leave " + "this off until BOTH the gateway passphrase-forward and the " + "cross-compose broker socket are deployed, or gated verbs will fail."),
+    operator_attest_required_verbs: exports_external.array(exports_external.string().min(1)).default(["update_apply", "apply", "rollout"]).describe("Which mutating hostd verbs REQUIRE a valid operator-passphrase " + "attestation when `operator_attest_enabled` is true (#1841). Default " + "is the RFC §5.4 fleet-mutation set (`update_apply`, `apply`, " + "`rollout`). Verbs NOT in this list still accept-and-audit an " + "attestation when one is supplied, but never require it. Ignored " + "entirely when `operator_attest_enabled` is false.")
   });
   CronEgressSchema = exports_external.object({
     allowed_hosts: exports_external.array(exports_external.string().min(1)).default([]).describe("Hosts a poll may reach (exact, https-only). loopback/private/IP-literal are always rejected."),
@@ -4897,6 +4915,11 @@ function mergeAgentConfig(defaultsIn, agentIn) {
       if (v !== undefined)
         combined[k] = v;
     }
+    const baseSoul = base;
+    const overrideSoul = override;
+    if (baseSoul.shape !== undefined && (overrideSoul.shape === undefined || overrideSoul.shape === "generalist")) {
+      combined.shape = baseSoul.shape;
+    }
     merged.soul = combined;
   }
   if (defaults.memory || merged.memory) {
@@ -18064,7 +18087,7 @@ var require_lib = __commonJS((exports, module) => {
 
 // src/vault/broker/server.ts
 import * as net from "node:net";
-import { mkdirSync as mkdirSync6, chmodSync as chmodSync4, chownSync, existsSync as existsSync11, readFileSync as readFileSync9, readdirSync as readdirSync4, statSync as statSync6, unlinkSync as unlinkSync6, writeFileSync as writeFileSync2, renameSync as renameSync6 } from "node:fs";
+import { mkdirSync as mkdirSync6, chmodSync as chmodSync4, chownSync, existsSync as existsSync11, readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync6, unlinkSync as unlinkSync6, writeFileSync as writeFileSync3, renameSync as renameSync6 } from "node:fs";
 
 // src/agents/compose.ts
 import { createHash } from "node:crypto";
@@ -18154,22 +18177,6 @@ function isWebkiteCredentialKeyForAgent(agentConfig, key) {
     return false;
   return true;
 }
-function parseCronUnit(unitName) {
-  const m = unitName.match(/^switchroom-([a-zA-Z0-9_-]+)-cron-(\d+)\.service$/);
-  if (!m)
-    return null;
-  const agentName = m[1];
-  const index = parseInt(m[2], 10);
-  if (!agentName)
-    return null;
-  return { agentName, index };
-}
-function agentSlugFromPeer(peer) {
-  if (peer.systemdUnit === null)
-    return null;
-  const parsed = parseCronUnit(peer.systemdUnit);
-  return parsed?.agentName ?? null;
-}
 function checkEntryScope(scope, agentSlug) {
   if (scope === undefined || scope === null) {
     return { allow: true };
@@ -18192,42 +18199,6 @@ function checkEntryScope(scope, agentSlug) {
   }
   return { allow: true };
 }
-function checkAcl(peer, config, key) {
-  if (peer.systemdUnit !== null) {
-    const parsed = parseCronUnit(peer.systemdUnit);
-    if (parsed === null) {
-      return {
-        allow: false,
-        reason: `systemd unit '${peer.systemdUnit}' does not match switchroom cron unit naming convention`
-      };
-    }
-    const { agentName, index } = parsed;
-    const agentConfig = config.agents?.[agentName];
-    if (!agentConfig) {
-      return { allow: false, reason: `agent '${agentName}' not found in config` };
-    }
-    const schedule = agentConfig.schedule ?? [];
-    if (index >= schedule.length || index < 0) {
-      return {
-        allow: false,
-        reason: `schedule index ${index} out of range for agent '${agentName}' (${schedule.length} entries)`
-      };
-    }
-    const entry = schedule[index];
-    const allowedKeys = entry.secrets ?? [];
-    if (!allowedKeys.includes(key)) {
-      return {
-        allow: false,
-        reason: `key '${key}' not in ACL for ${agentName}/schedule[${index}]`
-      };
-    }
-    return { allow: true };
-  }
-  return {
-    allow: false,
-    reason: "caller is not a switchroom cron unit; use 'switchroom vault get --no-broker' for interactive access"
-  };
-}
 function checkAclByAgent(config, agentName, key) {
   if (!agentName) {
     return { allow: false, reason: "agent name unresolved" };
@@ -18361,18 +18332,22 @@ var tails = new Map;
 
 // src/agents/inject.ts
 var INJECT_COMMANDS = new Map([
-  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true }],
-  ["/status", { description: "Show session status", expectsOutput: true, dialog: true }],
-  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true }],
-  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true }],
-  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true }],
-  ["/model", { description: "Open model picker", expectsOutput: true }],
+  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/status", { description: "Show session status", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/help", { description: "Show help / command discovery", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/context", { description: "Show context window usage", expectsOutput: true, argsAllowed: false }],
+  ["/release-notes", { description: "Show release-notes version list", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/model", { description: "Open model picker", expectsOutput: true, argsAllowed: true }],
   [
     "/clear",
     {
       description: "Clear session screen",
       expectsOutput: false,
-      silentNote: "context cleared — fresh slate"
+      silentNote: "context cleared — fresh slate",
+      argsAllowed: false
     }
   ],
   [
@@ -18380,7 +18355,8 @@ var INJECT_COMMANDS = new Map([
     {
       description: "Compact conversation history",
       expectsOutput: false,
-      silentNote: "compaction runs silently"
+      silentNote: "compaction runs silently",
+      argsAllowed: false
     }
   ]
 ]);
@@ -18390,6 +18366,15 @@ var INJECT_BLOCKED = new Map([
   ["/logout", { reason: "would terminate the agent's auth session" }],
   ["/exit", { reason: "would kill the agent process" }],
   ["/quit", { reason: "would kill the agent process" }],
+  ["/upgrade", { reason: "mutates the Claude Code installation" }],
+  ["/init", { reason: "generates/overwrites CLAUDE.md and runs a model turn" }],
+  ["/mcp", { reason: "opens an interactive MCP server management dialog" }],
+  ["/permissions", { reason: "opens an interactive permissions editor that mutates tool policy" }],
+  ["/install-github-app", { reason: "runs a network/OAuth install flow" }],
+  ["/add-dir", { reason: "mutates the session's working-directory set" }],
+  ["/terminal-setup", { reason: "mutates terminal keybinding configuration" }],
+  ["/privacy-settings", { reason: "opens an interactive privacy-settings dialog" }],
+  ["/bug", { reason: "submits a bug report over the network" }],
   [
     "/effort",
     {
@@ -18407,6 +18392,7 @@ var HINDSIGHT_CONSUMER_NAME = "hindsight";
 var HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight";
 var HINDSIGHT_IMAGE = `${HINDSIGHT_IMAGE_REPO}:latest`;
 var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`;
+var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 
@@ -19354,7 +19340,8 @@ var ErrorCode = exports_external.enum([
   "DENIED",
   "UNKNOWN_KEY",
   "BAD_REQUEST",
-  "INTERNAL"
+  "INTERNAL",
+  "AUDIT_UNAVAILABLE"
 ]);
 var OkEntryResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -19542,6 +19529,7 @@ init_paths();
 
 // src/agents/scaffold.ts
 var REPO_ROOT = resolve6(import.meta.dirname, "../..");
+var CLAUDE_MD_YOURS_PLACEHOLDER = "This space is yours. Add per-agent rules, exceptions, or context the " + "Switchroom template doesn't capture. Everything above the marker line is " + "regenerated on every apply; this section is preserved.";
 var SWITCHROOM_OWNED_SETTINGS_KEYS = new Set([
   "permissions",
   "mcpServers",
@@ -19929,6 +19917,23 @@ function safeAuditLogPath(requestedPath) {
 }
 
 // src/vault/broker/audit-log.ts
+function failOpenStatePath(logPath) {
+  return `${logPath}.failopen`;
+}
+function readFailOpenState(statePath) {
+  try {
+    const raw = fs.readFileSync(statePath, "utf8");
+    const parsed = JSON.parse(raw);
+    const count = Number(parsed.failOpenCount);
+    return {
+      failOpenCount: Number.isFinite(count) && count > 0 ? count : 0,
+      lastFailureTs: typeof parsed.lastFailureTs === "string" ? parsed.lastFailureTs : undefined,
+      lastError: typeof parsed.lastError === "string" ? parsed.lastError : undefined
+    };
+  } catch {
+    return { failOpenCount: 0 };
+  }
+}
 var DEFAULT_AUDIT_MAX_BYTES = 32 * 1024 * 1024;
 var DEFAULT_AUDIT_MAX_FILES = 5;
 function resolveRotation(opts) {
@@ -20009,7 +20014,27 @@ function createAuditLogger(opts = {}) {
   const logPath = safeAuditLogPath(opts.path ?? defaultAuditLogPath());
   let chain = seedChain(logPath);
   const rotation = resolveRotation(opts);
+  const statePath = opts.statePath ?? failOpenStatePath(logPath);
+  let failOpen = readFailOpenState(statePath).failOpenCount;
+  const recordFailOpen = (err) => {
+    failOpen += 1;
+    const state = {
+      failOpenCount: failOpen,
+      lastFailureTs: new Date().toISOString(),
+      lastError: String(err.message).slice(0, 300)
+    };
+    try {
+      fs.writeFileSync(statePath, `${JSON.stringify(state)}
+`, { mode: 384 });
+    } catch (persistErr) {
+      process.stderr.write(`[vault-audit] ERROR: could not persist fail-open counter ${statePath}: ${persistErr.message}
+`);
+    }
+  };
   return {
+    failOpenCount() {
+      return failOpen;
+    },
     write(entry) {
       if (rotation.maxBytes > 0) {
         try {
@@ -20026,14 +20051,18 @@ function createAuditLogger(opts = {}) {
       } catch (err) {
         process.stderr.write(`[vault-audit] ERROR: could not open audit log ${logPath}: ${err.message}
 `);
-        return;
+        recordFailOpen(err);
+        return false;
       }
+      let durable = false;
       try {
         fs.writeSync(fd, line);
         chain = next;
+        durable = true;
       } catch (err) {
         process.stderr.write(`[vault-audit] ERROR: could not write to audit log ${logPath}: ${err.message}
 `);
+        recordFailOpen(err);
       } finally {
         try {
           fs.closeSync(fd);
@@ -20042,6 +20071,7 @@ function createAuditLogger(opts = {}) {
 `);
         }
       }
+      return durable;
     }
   };
 }
@@ -22375,6 +22405,21 @@ class VaultBroker {
       this.grantsDb = openGrantsDb();
     }
   }
+  auditFailClosedEnabled() {
+    const env = process.env.SWITCHROOM_VAULT_AUDIT_FAIL_CLOSED;
+    if (env !== undefined && env !== "") {
+      return env === "1" || env.toLowerCase() === "true";
+    }
+    return this.config?.vault?.broker?.auditFailClosed === true;
+  }
+  auditedReleaseOk(socket, writeAudit, entry) {
+    const durable = writeAudit(entry);
+    if (!durable && this.auditFailClosedEnabled()) {
+      socket.write(encodeResponse(errorResponse("AUDIT_UNAVAILABLE", "secret release denied: audit append failed and broker is in fail-closed mode (vault.broker.auditFailClosed)")));
+      return false;
+    }
+    return true;
+  }
   async start(socketPath, configPath, vaultPath) {
     if (process.platform !== "linux" && process.env.SWITCHROOM_BROKER_ALLOW_NON_LINUX !== "1") {
       throw new Error(`vault-broker is Linux-only (running on ${process.platform}). ` + `The broker's ACL relies on cgroup-based systemd unit identification, ` + `which is not available on this platform. ` + `Use 'switchroom vault get --no-broker' for direct vault access. ` + `If you need to run the broker for development on this platform, ` + `set SWITCHROOM_BROKER_ALLOW_NON_LINUX=1 — but understand that the ` + `broker will accept any same-user caller without per-cron ACL enforcement.`);
@@ -22442,7 +22487,7 @@ class VaultBroker {
       return;
     try {
       if (ready) {
-        writeFileSync2(p, "", { mode: 384 });
+        writeFileSync3(p, "", { mode: 384 });
       } else if (existsSync11(p)) {
         unlinkSync6(p);
       }
@@ -22741,7 +22786,7 @@ class VaultBroker {
     const auditPeerUid = peer?.uid;
     const auditAgentName = agentName ?? undefined;
     const writeAudit = (entry) => {
-      this.auditLogger.write({
+      return this.auditLogger.write({
         ...entry,
         peer_uid: entry.peer_uid ?? auditPeerUid,
         agent_name: entry.agent_name ?? auditAgentName
@@ -22850,8 +22895,8 @@ class VaultBroker {
           return;
         }
       }
-      if (!isOperator && agentName === null && process.platform === "linux" && peer === null) {
-        const reason = "Unable to identify caller (peercred unavailable); denying on Linux";
+      if (!isOperator && agentName === null && process.platform === "linux") {
+        const reason = "Unable to identify caller (no per-agent socket identity); denying on Linux";
         this.auditLogger.write({
           ts: new Date().toISOString(),
           op: "list",
@@ -22863,14 +22908,12 @@ class VaultBroker {
         socket.write(encodeResponse(errorResponse("DENIED", reason)));
         return;
       }
-      const listAgentSlug = agentName ?? (peer !== null ? agentSlugFromPeer(peer) : null);
+      const listAgentSlug = agentName;
       let visibleKeys;
       if (isOperator) {
         visibleKeys = Object.entries(this.secrets).filter(([, entry]) => checkEntryScope(entry.scope, "operator").allow).map(([k]) => k);
       } else if (agentName !== null && this.config !== null) {
         visibleKeys = Object.entries(this.secrets).filter(([key, entry]) => checkAclByAgent(this.config, agentName, key).allow && checkEntryScope(entry.scope, agentName).allow).map(([k]) => k);
-      } else if (peer !== null && this.config !== null) {
-        visibleKeys = Object.entries(this.secrets).filter(([key, entry]) => checkAcl(peer, this.config, key).allow && checkEntryScope(entry.scope, listAgentSlug).allow).map(([k]) => k);
       } else {
         visibleKeys = Object.entries(this.secrets).filter(([, entry]) => checkEntryScope(entry.scope, listAgentSlug).allow).map(([k]) => k);
       }
@@ -22894,6 +22937,21 @@ class VaultBroker {
         const grantResult = await validateGrant(this.grantsDb, req.token, req.key);
         if (grantResult.ok) {
           const grantId = grantResult.grant.id;
+          if (agentName !== null && grantResult.grant.agent_slug !== agentName) {
+            this.auditLogger.write({
+              ts: new Date().toISOString(),
+              op: "get",
+              key: req.key,
+              caller: auditCaller,
+              pid: auditPid,
+              cgroup: auditCgroup,
+              result: "denied:grant-identity-mismatch",
+              method: "grant",
+              grant_id: grantId
+            });
+            socket.write(encodeResponse(errorResponse("DENIED", "grant-identity-mismatch")));
+            return;
+          }
           const entry2 = this.secrets[req.key];
           if (entry2 === undefined) {
             this.auditLogger.write({
@@ -22910,7 +22968,23 @@ class VaultBroker {
             socket.write(encodeResponse(errorResponse("UNKNOWN_KEY", `Key not found: ${req.key}`)));
             return;
           }
-          this.auditLogger.write({
+          const tokenScope = checkEntryScope(entry2.scope, grantResult.grant.agent_slug);
+          if (!tokenScope.allow) {
+            this.auditLogger.write({
+              ts: new Date().toISOString(),
+              op: "get",
+              key: req.key,
+              caller: auditCaller,
+              pid: auditPid,
+              cgroup: auditCgroup,
+              result: `denied:${tokenScope.reason}`,
+              method: "grant",
+              grant_id: grantId
+            });
+            socket.write(encodeResponse(errorResponse("DENIED", tokenScope.reason)));
+            return;
+          }
+          if (!this.auditedReleaseOk(socket, writeAudit, {
             ts: new Date().toISOString(),
             op: "get",
             key: req.key,
@@ -22920,7 +22994,9 @@ class VaultBroker {
             result: "allowed",
             method: "grant",
             grant_id: grantId
-          });
+          })) {
+            return;
+          }
           socket.write(encodeResponse(entryResponse(entry2)));
           return;
         } else if (grantResult.reason === "grant-revoked") {
@@ -22974,23 +23050,8 @@ class VaultBroker {
           socket.write(encodeResponse(errorResponse("DENIED", aclResult.reason)));
           return;
         }
-      } else if (peer !== null && this.config !== null) {
-        const aclResult = checkAcl(peer, this.config, req.key);
-        if (!aclResult.allow) {
-          writeAudit({
-            ts: new Date().toISOString(),
-            op: "get",
-            key: req.key,
-            caller: auditCaller,
-            pid: auditPid,
-            cgroup: auditCgroup,
-            result: `denied:${aclResult.reason}`
-          });
-          socket.write(encodeResponse(errorResponse("DENIED", aclResult.reason)));
-          return;
-        }
-      } else if (process.platform === "linux" && peer === null) {
-        const reason = "Unable to identify caller (peercred unavailable); denying on Linux";
+      } else if (process.platform === "linux" && agentName === null) {
+        const reason = "Unable to identify caller (no per-agent socket identity); denying on Linux";
         this.auditLogger.write({
           ts: new Date().toISOString(),
           op: "get",
@@ -23017,7 +23078,7 @@ class VaultBroker {
         socket.write(encodeResponse(errorResponse("UNKNOWN_KEY", `Key not found: ${req.key}`)));
         return;
       }
-      const getAgentSlug = agentName ?? (peer !== null ? agentSlugFromPeer(peer) : null);
+      const getAgentSlug = agentName;
       const scopeResult = checkEntryScope(entry.scope, getAgentSlug);
       if (!scopeResult.allow) {
         this.auditLogger.write({
@@ -23032,7 +23093,7 @@ class VaultBroker {
         socket.write(encodeResponse(errorResponse("DENIED", scopeResult.reason)));
         return;
       }
-      this.auditLogger.write({
+      if (!this.auditedReleaseOk(socket, writeAudit, {
         ts: new Date().toISOString(),
         op: "get",
         key: req.key,
@@ -23040,7 +23101,9 @@ class VaultBroker {
         pid: auditPid,
         cgroup: auditCgroup,
         result: "allowed"
-      });
+      })) {
+        return;
+      }
       socket.write(encodeResponse(entryResponse(entry)));
       return;
     }
@@ -23448,21 +23511,6 @@ class VaultBroker {
           socket.write(encodeResponse(errorResponse("DENIED", "peercred unavailable; cannot verify operator identity")));
           return;
         }
-        if (peer !== null && peer.systemdUnit !== null) {
-          const parsed = parseCronUnit(peer.systemdUnit);
-          if (parsed !== null) {
-            this.auditLogger.write({
-              ts: new Date().toISOString(),
-              op: req.op,
-              caller: auditCaller,
-              pid: auditPid,
-              cgroup: auditCgroup,
-              result: "denied:cron-cannot-manage-grants"
-            });
-            socket.write(encodeResponse(errorResponse("DENIED", "Grant management ops are operator-only; cron units cannot mint, list, or revoke grants")));
-            return;
-          }
-        }
       }
     }
     if (req.op === "mint_grant") {
@@ -23501,7 +23549,7 @@ class VaultBroker {
         mkdirSync6(tokenDir, { recursive: true });
         const tokenPath = path3.join(tokenDir, ".vault-token");
         const tmpPath = `${tokenPath}.tmp.${process.pid}`;
-        writeFileSync2(tmpPath, mintResult.token, { mode: 384 });
+        writeFileSync3(tmpPath, mintResult.token, { mode: 384 });
         renameSync6(tmpPath, tokenPath);
         try {
           const uid = allocateAgentUid(agent);
@@ -23788,7 +23836,7 @@ class VaultBroker {
   _writePidFile() {
     try {
       const pidPath = resolvePath(PID_FILE_DEFAULT);
-      writeFileSync2(pidPath, String(process.pid) + `
+      writeFileSync3(pidPath, String(process.pid) + `
 `, { mode: 384 });
     } catch {}
   }
@@ -23844,7 +23892,7 @@ class VaultBroker {
     const credPath = `${dir}/vault-passphrase`;
     let passphrase;
     try {
-      passphrase = readFileSync9(credPath, "utf8").replace(/\n+$/, "");
+      passphrase = readFileSync10(credPath, "utf8").replace(/\n+$/, "");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.18.11",
+  "version": "0.18.12",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {
@@ -24,9 +24,9 @@
     "build": "node scripts/build.mjs",
     "build:cli": "node scripts/build.mjs && bun build --compile --target=bun-linux-x64 --minify bin/switchroom.ts --outfile switchroom-linux-amd64",
     "pretest": "npm run build",
-    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
+    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:vitest": "vitest run",
-    "test:bun": "bun test src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
+    "test:bun": "bun test src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:watch": "vitest",
     "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-web-subscription-honest.mjs",
     "lint:tsc": "tsc --noEmit",
@@ -43,7 +43,6 @@
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@secretlint/core": "^12.2.0",
     "@secretlint/secretlint-rule-preset-recommend": "^12.2.0",
-    "@secretlint/types": "^12.2.0",
     "@xterm/headless": "^6.0.0",
     "bcryptjs": "^3.0.3",
     "chalk": "^5.4.0",