switchroom 0.18.11 → 0.18.13

package/dist/agent-scheduler/index.js

@@ -11059,7 +11059,12 @@ var ScheduleEntrySchema = exports_external.object({
 var AgentSoulSchema = exports_external.object({
   name: exports_external.string().describe("Agent persona name (e.g., 'Coach', 'Sage')"),
   style: exports_external.string().describe("Communication style description"),
-  boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers")
+  creature: exports_external.string().optional().describe("Persona creature/form (e.g., 'owl', 'octopus')"),
+  vibe: exports_external.string().optional().describe("One-line personality vibe (e.g., 'calm, precise')"),
+  expertise: exports_external.string().optional().describe("Domain expertise summary rendered into the persona"),
+  emoji: exports_external.string().optional().describe("Signature emoji for the persona (e.g., '\uD83E\uDD89')"),
+  boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers"),
+  shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).default("generalist").describe("Persona-shape discriminator the per-agent CLAUDE.md template can " + "branch on (e.g., 'you are an executive assistant' vs 'a senior " + "engineer'). No runtime behavior yet — template work lands in a " + "later issue. Cascade: override (per-agent wins over default).")
 }).optional();
 var AgentToolsSchema = exports_external.object({
   allow: exports_external.array(exports_external.string()).default([]).describe("Allowed tools (use ['all'] for unrestricted)"),
@@ -11224,6 +11229,11 @@ var TelegramChannelSchema = exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
   }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
+  button_choice_confirmation: exports_external.object({
+    enabled: exports_external.boolean().default(false).describe("When true, tapping an agent-emitted inline_keyboard button annotates " + "the source message body with a '✅ You chose: <label> · HH:MM' line so " + "the chat surface is self-documenting. Only applies to single-use " + "keyboards (re-tappable keyboards are never annotated). Requires the " + "agent's parseMode to be the default 'html'. Opt-in (default false). " + "Limitation: the annotated body is rebuilt from the message's plain " + "text, so any formatting entities (bold, links, code, ...) on the " + "original message are lost when the annotation is applied."),
+    format: exports_external.string().default("✅ You chose: {label} · {time}").describe("Template for the annotation line. `{label}` is replaced with the " + "tapped button's text (newlines stripped, HTML-escaped, trimmed to 60 " + "chars) and `{time}` with HH:MM in the chosen timezone. Note: retap " + "dedup (replacing a prior annotation instead of appending another " + "line) only recognizes the DEFAULT format shape — a custom format " + "accumulates one line per retap."),
+    timezone: exports_external.enum(["gateway", "utc"]).default("gateway").describe("Timezone for the {time} placeholder. 'gateway' uses the gateway " + "process's local time; 'utc' uses UTC. Per-user timezones are out of " + "scope for v1.")
+  }).optional().describe("Auto-confirm 'You chose: X' annotation on inline_keyboard taps (#789). " + "Cascades from defaults.channels.telegram.button_choice_confirmation."),
   webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
   webhook_dispatch: exports_external.object({
     github: exports_external.array(webhookDispatchRule).optional(),
@@ -11372,7 +11382,12 @@ var profileFields = {
   soul: exports_external.object({
     name: exports_external.string().optional(),
     style: exports_external.string().optional(),
-    boundaries: exports_external.string().optional()
+    creature: exports_external.string().optional(),
+    vibe: exports_external.string().optional(),
+    expertise: exports_external.string().optional(),
+    emoji: exports_external.string().optional(),
+    boundaries: exports_external.string().optional(),
+    shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).optional()
   }).optional(),
   tools: exports_external.object({
     allow: exports_external.array(exports_external.string()).optional(),
@@ -11569,7 +11584,8 @@ var VaultConfigSchema = exports_external.object({
     autoUnlockCredentialPath: exports_external.string().default("~/.switchroom/vault-auto-unlock").describe("Path to the machine-bound auto-unlock blob (see " + "src/vault/auto-unlock.ts for the format). Default lives under " + "~/.switchroom so it can be bind-mounted into the vault-broker " + "container by docker compose. Tilde-expansion happens " + "at read time."),
     approvalAuth: exports_external.enum(["passphrase", "telegram-id"]).default("passphrase").describe("Posture for tap-to-Approve on vault grant cards. `passphrase` " + "(default) prompts the operator to type the vault passphrase on " + "every Approve — two-factor (Telegram ID + passphrase). " + "`telegram-id` mints immediately on Approve with no passphrase " + "prompt — single-factor (Telegram ID only); REQUIRES " + "`autoUnlock: true` so the broker already holds the passphrase. " + "Trades a factor of security for smoother UX; opt-in only."),
     postureMintAgents: exports_external.array(exports_external.string().min(1)).default([]).describe("Per-agent opt-in for posture-attested broker calls (`mint_grant` / " + "`list_grants` / `put` with `attest_via_posture: true`). Only agents " + "whose names are in this list can use the silent-mint path under " + "`approvalAuth: telegram-id`. Default `[]` — no agent can self-mint " + "until the operator explicitly opts it in. The request's `agent` " + "field must also equal the calling peer's resolved agent name " + "(broker rejects cross-agent posture mints). When `approvalAuth` is " + "`passphrase` this list is ignored — passphrase attestation still " + "works as before. Each entry is an agent slug exactly as it appears " + "under `agents:` in this config."),
-    adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload).")
+    adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload)."),
+    auditFailClosed: exports_external.boolean().default(false).describe("sec WS10-F3 (#1420) — fail-CLOSED on an audit-append failure. When " + "`false` (default, backward-compatible) the broker fails OPEN: if a " + "vault-audit.log append fails it logs to stderr, bumps the durable " + "fail-open counter, and STILL releases the secret. When `true`, a " + "failed audit append DENIES the secret release with " + "`AUDIT_UNAVAILABLE` — no secret leaves the broker without a durable " + "audit row. The env var `SWITCHROOM_VAULT_AUDIT_FAIL_CLOSED` " + "(`1`/`true` or `0`/`false`) overrides this at runtime. Either way " + "the fail-open counter is surfaced by `switchroom doctor`. Takes " + "effect on broker restart.")
   }).default({}).superRefine((broker, ctx) => {
     if (broker.approvalAuth === "telegram-id" && broker.autoUnlock !== true) {
       ctx.addIssue({
@@ -11608,7 +11624,9 @@ var FleetHealthConfigSchema = exports_external.object({
 });
 var HostdConfigSchema = exports_external.object({
   config_edit_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the `config_propose_edit` hostd verb (RFC " + "admin-agent-config-edit §3). Default false — the verb returns " + "`E_CONFIG_EDIT_DISABLED` until the operator explicitly flips " + "this to true. When true, admin agents can propose unified-diff " + "patches against " + "`/state/config/switchroom.yaml`, gated by an operator approval " + "card in the primary chat. Same trust posture as `update_apply` " + "and `agent_restart`: the human-in-the-loop tap is the security " + "boundary, not the agent's judgement."),
-  config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat.")
+  config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat."),
+  operator_attest_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the operator-passphrase 2nd factor on hostd's " + "mutating verbs (#1841, RFC host-control-daemon.md §5.4). Default " + "false — attestation is ACCEPTED-and-audited whenever present, but " + "no verb REQUIRES it (behaviour is byte-identical to today, so " + "existing fleets and the Telegram approval-card flow are unchanged). " + "When true, the verbs in `operator_attest_required_verbs` demand a " + "valid operator-passphrase attestation IN ADDITION to admin: hostd " + "forwards the passphrase to the vault broker over its own admin-client " + "connection (`/run/switchroom/broker/hostd/sock`) and treats a broker " + "DENIED as a gate failure. hostd never holds the passphrase. Leave " + "this off until BOTH the gateway passphrase-forward and the " + "cross-compose broker socket are deployed, or gated verbs will fail."),
+  operator_attest_required_verbs: exports_external.array(exports_external.string().min(1)).default(["update_apply", "apply", "rollout"]).describe("Which mutating hostd verbs REQUIRE a valid operator-passphrase " + "attestation when `operator_attest_enabled` is true (#1841). Default " + "is the RFC §5.4 fleet-mutation set (`update_apply`, `apply`, " + "`rollout`). Verbs NOT in this list still accept-and-audit an " + "attestation when one is supplied, but never require it. Ignored " + "entirely when `operator_attest_enabled` is false.")
 });
 var CronEgressSchema = exports_external.object({
   allowed_hosts: exports_external.array(exports_external.string().min(1)).default([]).describe("Hosts a poll may reach (exact, https-only). loopback/private/IP-literal are always rejected."),
@@ -12020,6 +12038,11 @@ function mergeAgentConfig(defaultsIn, agentIn) {
       if (v !== undefined)
         combined[k] = v;
     }
+    const baseSoul = base;
+    const overrideSoul = override;
+    if (baseSoul.shape !== undefined && (overrideSoul.shape === undefined || overrideSoul.shape === "generalist")) {
+      combined.shape = baseSoul.shape;
+    }
     merged.soul = combined;
   }
   if (defaults.memory || merged.memory) {
@@ -13097,6 +13120,13 @@ var ApprovalLookupRequestSchema = exports_external.object({
   action: exports_external.string().min(1),
   current_approver_set: exports_external.array(exports_external.string())
 });
+var ApprovalLookupByRequestRequestSchema = exports_external.object({
+  v: exports_external.literal(1),
+  op: exports_external.literal("approval_lookup_by_request"),
+  agent_unit: exports_external.string().min(1),
+  request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
+  current_approver_set: exports_external.array(exports_external.string())
+});
 var ApprovalConsumeRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("approval_consume"),
@@ -13151,6 +13181,7 @@ var RequestSchema = exports_external.discriminatedUnion("op", [
   RevokeGrantRequestSchema,
   ApprovalRequestRequestSchema,
   ApprovalLookupRequestSchema,
+  ApprovalLookupByRequestRequestSchema,
   ApprovalConsumeRequestSchema,
   ApprovalRevokeRequestSchema,
   ApprovalListRequestSchema,
@@ -13173,7 +13204,8 @@ var ErrorCode = exports_external.enum([
   "DENIED",
   "UNKNOWN_KEY",
   "BAD_REQUEST",
-  "INTERNAL"
+  "INTERNAL",
+  "AUDIT_UNAVAILABLE"
 ]);
 var OkEntryResponseSchema = exports_external.object({
   ok: exports_external.literal(true),

package/dist/auth-broker/index.js

@@ -7010,6 +7010,41 @@ var require_dist = __commonJS((exports) => {
   exports.visitAsync = visit.visitAsync;
 });
 
+// src/util/atomic.ts
+import { randomBytes } from "node:crypto";
+import { closeSync, constants, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+function atomicWriteFileSync(destPath, contents, mode = 384) {
+  const tmp = `${destPath}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
+  const buf = typeof contents === "string" ? Buffer.from(contents, "utf-8") : contents;
+  let fd = null;
+  try {
+    fd = openSync(tmp, TMP_OPEN_FLAGS, mode);
+    writeSync(fd, buf, 0, buf.length, 0);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    renameSync(tmp, destPath);
+  } catch (err) {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {}
+    }
+    try {
+      rmSync(tmp, { force: true });
+    } catch {}
+    throw err;
+  }
+}
+function atomicWriteJsonSync(destPath, value, mode = 384) {
+  atomicWriteFileSync(destPath, JSON.stringify(value, null, 2) + `
+`, mode);
+}
+var TMP_OPEN_FLAGS;
+var init_atomic = __esm(() => {
+  TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
+});
+
 // node_modules/.bun/handlebars@4.7.9/node_modules/handlebars/dist/cjs/handlebars/utils.js
 var require_utils = __commonJS((exports) => {
   exports.__esModule = true;
@@ -12570,41 +12605,6 @@ var require_lib = __commonJS((exports, module) => {
   }
 });
 
-// src/util/atomic.ts
-import { randomBytes } from "node:crypto";
-import { closeSync, constants, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
-function atomicWriteFileSync(destPath, contents, mode = 384) {
-  const tmp = `${destPath}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
-  const buf = typeof contents === "string" ? Buffer.from(contents, "utf-8") : contents;
-  let fd = null;
-  try {
-    fd = openSync(tmp, TMP_OPEN_FLAGS, mode);
-    writeSync(fd, buf, 0, buf.length, 0);
-    fsyncSync(fd);
-    closeSync(fd);
-    fd = null;
-    renameSync(tmp, destPath);
-  } catch (err) {
-    if (fd !== null) {
-      try {
-        closeSync(fd);
-      } catch {}
-    }
-    try {
-      rmSync(tmp, { force: true });
-    } catch {}
-    throw err;
-  }
-}
-function atomicWriteJsonSync(destPath, value, mode = 384) {
-  atomicWriteFileSync(destPath, JSON.stringify(value, null, 2) + `
-`, mode);
-}
-var TMP_OPEN_FLAGS;
-var init_atomic = __esm(() => {
-  TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
-});
-
 // src/auth/broker/index.ts
 import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
 
@@ -16688,7 +16688,12 @@ var ScheduleEntrySchema = exports_external.object({
 var AgentSoulSchema = exports_external.object({
   name: exports_external.string().describe("Agent persona name (e.g., 'Coach', 'Sage')"),
   style: exports_external.string().describe("Communication style description"),
-  boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers")
+  creature: exports_external.string().optional().describe("Persona creature/form (e.g., 'owl', 'octopus')"),
+  vibe: exports_external.string().optional().describe("One-line personality vibe (e.g., 'calm, precise')"),
+  expertise: exports_external.string().optional().describe("Domain expertise summary rendered into the persona"),
+  emoji: exports_external.string().optional().describe("Signature emoji for the persona (e.g., '\uD83E\uDD89')"),
+  boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers"),
+  shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).default("generalist").describe("Persona-shape discriminator the per-agent CLAUDE.md template can " + "branch on (e.g., 'you are an executive assistant' vs 'a senior " + "engineer'). No runtime behavior yet — template work lands in a " + "later issue. Cascade: override (per-agent wins over default).")
 }).optional();
 var AgentToolsSchema = exports_external.object({
   allow: exports_external.array(exports_external.string()).default([]).describe("Allowed tools (use ['all'] for unrestricted)"),
@@ -16853,6 +16858,11 @@ var TelegramChannelSchema = exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
   }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
+  button_choice_confirmation: exports_external.object({
+    enabled: exports_external.boolean().default(false).describe("When true, tapping an agent-emitted inline_keyboard button annotates " + "the source message body with a '✅ You chose: <label> · HH:MM' line so " + "the chat surface is self-documenting. Only applies to single-use " + "keyboards (re-tappable keyboards are never annotated). Requires the " + "agent's parseMode to be the default 'html'. Opt-in (default false). " + "Limitation: the annotated body is rebuilt from the message's plain " + "text, so any formatting entities (bold, links, code, ...) on the " + "original message are lost when the annotation is applied."),
+    format: exports_external.string().default("✅ You chose: {label} · {time}").describe("Template for the annotation line. `{label}` is replaced with the " + "tapped button's text (newlines stripped, HTML-escaped, trimmed to 60 " + "chars) and `{time}` with HH:MM in the chosen timezone. Note: retap " + "dedup (replacing a prior annotation instead of appending another " + "line) only recognizes the DEFAULT format shape — a custom format " + "accumulates one line per retap."),
+    timezone: exports_external.enum(["gateway", "utc"]).default("gateway").describe("Timezone for the {time} placeholder. 'gateway' uses the gateway " + "process's local time; 'utc' uses UTC. Per-user timezones are out of " + "scope for v1.")
+  }).optional().describe("Auto-confirm 'You chose: X' annotation on inline_keyboard taps (#789). " + "Cascades from defaults.channels.telegram.button_choice_confirmation."),
   webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
   webhook_dispatch: exports_external.object({
     github: exports_external.array(webhookDispatchRule).optional(),
@@ -17001,7 +17011,12 @@ var profileFields = {
   soul: exports_external.object({
     name: exports_external.string().optional(),
     style: exports_external.string().optional(),
-    boundaries: exports_external.string().optional()
+    creature: exports_external.string().optional(),
+    vibe: exports_external.string().optional(),
+    expertise: exports_external.string().optional(),
+    emoji: exports_external.string().optional(),
+    boundaries: exports_external.string().optional(),
+    shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).optional()
   }).optional(),
   tools: exports_external.object({
     allow: exports_external.array(exports_external.string()).optional(),
@@ -17198,7 +17213,8 @@ var VaultConfigSchema = exports_external.object({
     autoUnlockCredentialPath: exports_external.string().default("~/.switchroom/vault-auto-unlock").describe("Path to the machine-bound auto-unlock blob (see " + "src/vault/auto-unlock.ts for the format). Default lives under " + "~/.switchroom so it can be bind-mounted into the vault-broker " + "container by docker compose. Tilde-expansion happens " + "at read time."),
     approvalAuth: exports_external.enum(["passphrase", "telegram-id"]).default("passphrase").describe("Posture for tap-to-Approve on vault grant cards. `passphrase` " + "(default) prompts the operator to type the vault passphrase on " + "every Approve — two-factor (Telegram ID + passphrase). " + "`telegram-id` mints immediately on Approve with no passphrase " + "prompt — single-factor (Telegram ID only); REQUIRES " + "`autoUnlock: true` so the broker already holds the passphrase. " + "Trades a factor of security for smoother UX; opt-in only."),
     postureMintAgents: exports_external.array(exports_external.string().min(1)).default([]).describe("Per-agent opt-in for posture-attested broker calls (`mint_grant` / " + "`list_grants` / `put` with `attest_via_posture: true`). Only agents " + "whose names are in this list can use the silent-mint path under " + "`approvalAuth: telegram-id`. Default `[]` — no agent can self-mint " + "until the operator explicitly opts it in. The request's `agent` " + "field must also equal the calling peer's resolved agent name " + "(broker rejects cross-agent posture mints). When `approvalAuth` is " + "`passphrase` this list is ignored — passphrase attestation still " + "works as before. Each entry is an agent slug exactly as it appears " + "under `agents:` in this config."),
-    adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload).")
+    adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload)."),
+    auditFailClosed: exports_external.boolean().default(false).describe("sec WS10-F3 (#1420) — fail-CLOSED on an audit-append failure. When " + "`false` (default, backward-compatible) the broker fails OPEN: if a " + "vault-audit.log append fails it logs to stderr, bumps the durable " + "fail-open counter, and STILL releases the secret. When `true`, a " + "failed audit append DENIES the secret release with " + "`AUDIT_UNAVAILABLE` — no secret leaves the broker without a durable " + "audit row. The env var `SWITCHROOM_VAULT_AUDIT_FAIL_CLOSED` " + "(`1`/`true` or `0`/`false`) overrides this at runtime. Either way " + "the fail-open counter is surfaced by `switchroom doctor`. Takes " + "effect on broker restart.")
   }).default({}).superRefine((broker, ctx) => {
     if (broker.approvalAuth === "telegram-id" && broker.autoUnlock !== true) {
       ctx.addIssue({
@@ -17237,7 +17253,9 @@ var FleetHealthConfigSchema = exports_external.object({
 });
 var HostdConfigSchema = exports_external.object({
   config_edit_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the `config_propose_edit` hostd verb (RFC " + "admin-agent-config-edit §3). Default false — the verb returns " + "`E_CONFIG_EDIT_DISABLED` until the operator explicitly flips " + "this to true. When true, admin agents can propose unified-diff " + "patches against " + "`/state/config/switchroom.yaml`, gated by an operator approval " + "card in the primary chat. Same trust posture as `update_apply` " + "and `agent_restart`: the human-in-the-loop tap is the security " + "boundary, not the agent's judgement."),
-  config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat.")
+  config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat."),
+  operator_attest_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the operator-passphrase 2nd factor on hostd's " + "mutating verbs (#1841, RFC host-control-daemon.md §5.4). Default " + "false — attestation is ACCEPTED-and-audited whenever present, but " + "no verb REQUIRES it (behaviour is byte-identical to today, so " + "existing fleets and the Telegram approval-card flow are unchanged). " + "When true, the verbs in `operator_attest_required_verbs` demand a " + "valid operator-passphrase attestation IN ADDITION to admin: hostd " + "forwards the passphrase to the vault broker over its own admin-client " + "connection (`/run/switchroom/broker/hostd/sock`) and treats a broker " + "DENIED as a gate failure. hostd never holds the passphrase. Leave " + "this off until BOTH the gateway passphrase-forward and the " + "cross-compose broker socket are deployed, or gated verbs will fail."),
+  operator_attest_required_verbs: exports_external.array(exports_external.string().min(1)).default(["update_apply", "apply", "rollout"]).describe("Which mutating hostd verbs REQUIRE a valid operator-passphrase " + "attestation when `operator_attest_enabled` is true (#1841). Default " + "is the RFC §5.4 fleet-mutation set (`update_apply`, `apply`, " + "`rollout`). Verbs NOT in this list still accept-and-audit an " + "attestation when one is supplied, but never require it. Ignored " + "entirely when `operator_attest_enabled` is false.")
 });
 var CronEgressSchema = exports_external.object({
   allowed_hosts: exports_external.array(exports_external.string().min(1)).default([]).describe("Hosts a poll may reach (exact, https-only). loopback/private/IP-literal are always rejected."),
@@ -17650,6 +17668,11 @@ function mergeAgentConfig(defaultsIn, agentIn) {
       if (v !== undefined)
         combined[k] = v;
     }
+    const baseSoul = base;
+    const overrideSoul = override;
+    if (baseSoul.shape !== undefined && (overrideSoul.shape === undefined || overrideSoul.shape === "generalist")) {
+      combined.shape = baseSoul.shape;
+    }
     merged.soul = combined;
   }
   if (defaults.memory || merged.memory) {
@@ -18089,7 +18112,7 @@ import {
   rmSync as rmSync5,
   statSync as statSync6,
   unlinkSync,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync2
 } from "node:fs";
 import { closeSync as closeSync2, openSync as openSync2, writeSync as writeSync2 } from "node:fs";
 import * as constants2 from "node:constants";
@@ -18101,6 +18124,7 @@ import { createHash } from "node:crypto";
 
 // src/agents/scaffold.ts
 import { join as join4, resolve as resolve5 } from "node:path";
+init_atomic();
 
 // src/config/timezone.ts
 var CONTAINER_DEFAULT_UTC_ZONES = new Set([
@@ -18149,18 +18173,22 @@ var tails = new Map;
 
 // src/agents/inject.ts
 var INJECT_COMMANDS = new Map([
-  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true }],
-  ["/status", { description: "Show session status", expectsOutput: true, dialog: true }],
-  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true }],
-  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true }],
-  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true }],
-  ["/model", { description: "Open model picker", expectsOutput: true }],
+  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/status", { description: "Show session status", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/help", { description: "Show help / command discovery", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/context", { description: "Show context window usage", expectsOutput: true, argsAllowed: false }],
+  ["/release-notes", { description: "Show release-notes version list", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/model", { description: "Open model picker", expectsOutput: true, argsAllowed: true }],
   [
     "/clear",
     {
       description: "Clear session screen",
       expectsOutput: false,
-      silentNote: "context cleared — fresh slate"
+      silentNote: "context cleared — fresh slate",
+      argsAllowed: false
     }
   ],
   [
@@ -18168,7 +18196,8 @@ var INJECT_COMMANDS = new Map([
     {
       description: "Compact conversation history",
       expectsOutput: false,
-      silentNote: "compaction runs silently"
+      silentNote: "compaction runs silently",
+      argsAllowed: false
     }
   ]
 ]);
@@ -18178,6 +18207,15 @@ var INJECT_BLOCKED = new Map([
   ["/logout", { reason: "would terminate the agent's auth session" }],
   ["/exit", { reason: "would kill the agent process" }],
   ["/quit", { reason: "would kill the agent process" }],
+  ["/upgrade", { reason: "mutates the Claude Code installation" }],
+  ["/init", { reason: "generates/overwrites CLAUDE.md and runs a model turn" }],
+  ["/mcp", { reason: "opens an interactive MCP server management dialog" }],
+  ["/permissions", { reason: "opens an interactive permissions editor that mutates tool policy" }],
+  ["/install-github-app", { reason: "runs a network/OAuth install flow" }],
+  ["/add-dir", { reason: "mutates the session's working-directory set" }],
+  ["/terminal-setup", { reason: "mutates terminal keybinding configuration" }],
+  ["/privacy-settings", { reason: "opens an interactive privacy-settings dialog" }],
+  ["/bug", { reason: "submits a bug report over the network" }],
   [
     "/effort",
     {
@@ -18195,6 +18233,7 @@ var HINDSIGHT_CONSUMER_NAME = "hindsight";
 var HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight";
 var HINDSIGHT_IMAGE = `${HINDSIGHT_IMAGE_REPO}:latest`;
 var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`;
+var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 
@@ -18352,6 +18391,13 @@ var ApprovalLookupRequestSchema = exports_external.object({
   action: exports_external.string().min(1),
   current_approver_set: exports_external.array(exports_external.string())
 });
+var ApprovalLookupByRequestRequestSchema = exports_external.object({
+  v: exports_external.literal(1),
+  op: exports_external.literal("approval_lookup_by_request"),
+  agent_unit: exports_external.string().min(1),
+  request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
+  current_approver_set: exports_external.array(exports_external.string())
+});
 var ApprovalConsumeRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("approval_consume"),
@@ -18406,6 +18452,7 @@ var RequestSchema = exports_external.discriminatedUnion("op", [
   RevokeGrantRequestSchema,
   ApprovalRequestRequestSchema,
   ApprovalLookupRequestSchema,
+  ApprovalLookupByRequestRequestSchema,
   ApprovalConsumeRequestSchema,
   ApprovalRevokeRequestSchema,
   ApprovalListRequestSchema,
@@ -18428,7 +18475,8 @@ var ErrorCode = exports_external.enum([
   "DENIED",
   "UNKNOWN_KEY",
   "BAD_REQUEST",
-  "INTERNAL"
+  "INTERNAL",
+  "AUDIT_UNAVAILABLE"
 ]);
 var OkEntryResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -18575,6 +18623,7 @@ var materializedDirs = new Set;
 
 // src/agents/scaffold.ts
 var REPO_ROOT = resolve5(import.meta.dirname, "../..");
+var CLAUDE_MD_YOURS_PLACEHOLDER = "This space is yours. Add per-agent rules, exceptions, or context the " + "Switchroom template doesn't capture. Everything above the marker line is " + "regenerated on every apply; this section is preserved.";
 var SWITCHROOM_OWNED_SETTINGS_KEYS = new Set([
   "permissions",
   "mcpServers",
@@ -18603,9 +18652,6 @@ var BIND_MOUNT_EXACT_SOURCE_DENY = new Set(["/var/run/docker.sock"]);
 var OAUTH_BETA = "oauth-2025-04-20";
 var DEFAULT_USER_AGENT = "claude-cli/1.0.0 (external, cli)";
 var DEFAULT_PROBE_MODEL = "claude-haiku-4-5-20251001";
-function isProbeThin(q) {
-  return q.fiveHourUtilPresent === false && q.sevenDayUtilPresent === false;
-}
 function parseFloatHeader(headers, name) {
   const v = headers.get(name);
   if (v == null || v.trim().length === 0)
@@ -18702,6 +18748,9 @@ function snapshotFresh(s, now, maxAgeMs = SNAPSHOT_STALE_AGE_MS) {
 function snapshotWalled(s) {
   return s.fiveHourUtilizationPct >= WALL_PCT || s.sevenDayUtilizationPct >= WALL_PCT;
 }
+function snapshotComplete(s) {
+  return s.fiveHourUtilPresent !== false && s.sevenDayUtilPresent !== false;
+}
 function overageLiftsWall(snapshot, inAllowList) {
   if (!inAllowList)
     return false;
@@ -18717,16 +18766,19 @@ function snapshotClearlyHealthy(s) {
 }
 function accountEligibility(opts) {
   const { mark, snapshot, now, allowOverage = false } = opts;
+  if (snapshotFresh(snapshot, now) && snapshotWalled(snapshot) && !overageLiftsWall(snapshot, allowOverage)) {
+    return "blocked";
+  }
   if (snapshotFresh(snapshot, now)) {
     const markedAt = mark?.marked_at ?? 0;
     if (snapshot.capturedAt >= markedAt) {
       if (snapshotWalled(snapshot)) {
-        if (overageLiftsWall(snapshot, allowOverage)) {
+        if (overageLiftsWall(snapshot, allowOverage))
           return "eligible";
-        }
         return "blocked";
       }
-      return "eligible";
+      if (snapshotComplete(snapshot))
+        return "eligible";
     }
   }
   if (mark !== undefined && mark.exhausted_until > now)
@@ -18743,7 +18795,7 @@ function snapshotShouldClearMark(snapshot, mark, now) {
     return false;
   if (snapshot.capturedAt < (mark.marked_at ?? 0))
     return false;
-  if (isProbeThin(snapshot))
+  if (!snapshotComplete(snapshot))
     return false;
   return snapshotClearlyHealthy(snapshot);
 }
@@ -18752,7 +18804,7 @@ function clampMarkExpiry(opts) {
   const shortCeil = now + shortMs;
   if (proposedUntil <= shortCeil)
     return proposedUntil;
-  const liveContradictsWeeklyWall = snapshotFresh(snapshot, now) && snapshot.sevenDayUtilizationPct < WALL_PCT;
+  const liveContradictsWeeklyWall = snapshotFresh(snapshot, now) && snapshot.sevenDayUtilPresent !== false && snapshot.sevenDayUtilizationPct < WALL_PCT;
   return liveContradictsWeeklyWall ? shortCeil : proposedUntil;
 }
 var SOFT_AVOID_FIVE_HOUR_CAP = 98;
@@ -18845,6 +18897,7 @@ function resolveConsumerProbeIntervalMs(env) {
 init_atomic();
 
 // src/auth/account-store.ts
+init_atomic();
 import {
   chownSync,
   existsSync as existsSync5,
@@ -18853,10 +18906,8 @@ import {
   readdirSync as readdirSync3,
   renameSync as renameSync2,
   rmSync as rmSync2,
-  statSync as statSync3,
-  writeFileSync as writeFileSync2
+  statSync as statSync3
 } from "node:fs";
-import { randomBytes as randomBytes2 } from "node:crypto";
 import { homedir as homedir4 } from "node:os";
 import { join as join5, resolve as resolve6 } from "node:path";
 var LABEL_MAX = 64;
@@ -18940,8 +18991,8 @@ function enrichClaudeCreds(value) {
 }
 function writeAccountCredentials(label, value, home2 = homedir4()) {
   validateAccountLabel(label);
-  mkdirSync2(accountDir(label, home2), { recursive: true });
-  atomicWriteJson(accountCredentialsPath(label, home2), enrichClaudeCreds(value));
+  mkdirSync2(accountDir(label, home2), { recursive: true, mode: 448 });
+  atomicWriteJsonSync(accountCredentialsPath(label, home2), enrichClaudeCreds(value));
 }
 function chownAccountFiles(label, uid, home2 = homedir4()) {
   validateAccountLabel(label);
@@ -18967,8 +19018,8 @@ function readAccountMeta(label, home2 = homedir4()) {
 }
 function writeAccountMeta(label, value, home2 = homedir4()) {
   validateAccountLabel(label);
-  mkdirSync2(accountDir(label, home2), { recursive: true });
-  atomicWriteJson(accountMetaPath(label, home2), value);
+  mkdirSync2(accountDir(label, home2), { recursive: true, mode: 448 });
+  atomicWriteJsonSync(accountMetaPath(label, home2), value);
 }
 function patchAccountMeta(label, patch, home2 = homedir4()) {
   const existing = readAccountMeta(label, home2) ?? { createdAt: Date.now() };
@@ -18976,19 +19027,6 @@ function patchAccountMeta(label, patch, home2 = homedir4()) {
   writeAccountMeta(label, merged, home2);
   return merged;
 }
-function atomicWriteJson(destPath, value, mode = 384) {
-  const tmp = `${destPath}.tmp-${process.pid}-${randomBytes2(4).toString("hex")}`;
-  try {
-    writeFileSync2(tmp, JSON.stringify(value, null, 2) + `
-`, { mode });
-    renameSync2(tmp, destPath);
-  } catch (err) {
-    try {
-      rmSync2(tmp, { force: true });
-    } catch {}
-    throw err;
-  }
-}
 
 // src/auth/account-refresh.ts
 var REFRESH_THRESHOLD_MS = 60 * 60 * 1000;
@@ -20155,7 +20193,7 @@ class AuthBroker {
     if (!this.opts.skipHealthyMarker) {
       try {
         const healthyPath = join8(this.stateDir, "healthy");
-        writeFileSync3(healthyPath, String(this.now()) + `
+        writeFileSync2(healthyPath, String(this.now()) + `
 `, { mode: 384 });
       } catch (err) {
         this.logErr(`failed to write healthy marker: ${err.message}`);

package/dist/cli/hindsight-mental-model-pretool.mjs

@@ -0,0 +1,39 @@
+// src/cli/hindsight-mental-model-pretool.ts
+import { readFileSync } from "node:fs";
+var MENTAL_MODEL_WRITE_TOOLS = new Set([
+  "mcp__hindsight__create_mental_model",
+  "mcp__hindsight__update_mental_model",
+  "mcp__hindsight__delete_mental_model",
+  "mcp__hindsight__refresh_mental_model"
+]);
+var DENY_MESSAGE = "Mental-model writes are operator-approved. Use " + "`mcp__switchroom-telegram__mental_model_propose` instead \u2014 it posts an " + "approval card and persists on approval.";
+function readStdin() {
+  try {
+    return readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+function allow() {
+  process.exit(0);
+}
+function block(reason) {
+  process.stdout.write(JSON.stringify({ decision: "block", reason }));
+  process.exit(0);
+}
+function main() {
+  const raw = readStdin().trim();
+  if (!raw)
+    allow();
+  let event;
+  try {
+    event = JSON.parse(raw);
+  } catch {
+    allow();
+  }
+  const toolName = typeof event.tool_name === "string" ? event.tool_name : "";
+  if (MENTAL_MODEL_WRITE_TOOLS.has(toolName))
+    block(DENY_MESSAGE);
+  allow();
+}
+main();