switchroom 0.18.11 → 0.18.13

package/dist/cli/ms-365-write-pretool.mjs

@@ -24,10 +24,33 @@ var GATED_MS365_WRITE_TOOLS = new Set([
   "update-message",
   "delete-message"
 ]);
+var KNOWN_SAFE_MS365_READ_TOOLS = new Set([
+  "list-files",
+  "list-drive-items",
+  "get-drive-item",
+  "download-bytes",
+  "search-files",
+  "list-events",
+  "get-event",
+  "list-calendars",
+  "get-calendar",
+  "list-messages",
+  "get-message",
+  "search-mail",
+  "list-mail-folders",
+  "get-mail-folder",
+  "whoami",
+  "get-current-user"
+]);
 function isGatedMs365Tool(toolName) {
   if (!toolName.startsWith(TOOL_PREFIX))
     return false;
-  return GATED_MS365_WRITE_TOOLS.has(toolName.slice(TOOL_PREFIX.length));
+  const bare = toolName.slice(TOOL_PREFIX.length);
+  if (bare.length === 0)
+    return false;
+  if (KNOWN_SAFE_MS365_READ_TOOLS.has(bare))
+    return false;
+  return true;
 }
 function readStdin() {
   try {
@@ -170,13 +193,12 @@ async function rpcKernel(payload) {
     });
   });
 }
-async function approvalLookup(agentUnit, scope, approverSet) {
+async function approvalLookupByRequest(agentUnit, requestId, approverSet) {
   const res = await rpcKernel({
     v: 1,
-    op: "approval_lookup",
+    op: "approval_lookup_by_request",
     agent_unit: agentUnit,
-    scope,
-    action: "write",
+    request_id: requestId,
     current_approver_set: approverSet
   });
   if (!res.ok)
@@ -203,7 +225,7 @@ async function main() {
   }
   const agentName = process.env.SWITCHROOM_AGENT_NAME;
   if (!agentName) {
-    allow();
+    fail("SWITCHROOM_AGENT_NAME unset \u2014 cannot identify agent to gate write");
   }
   const accountEmail = process.env.SWITCHROOM_MICROSOFT_ACCOUNT ?? "(unknown)";
   const extract = extractMs365Preview(toolName, input.tool_input);
@@ -230,11 +252,11 @@ async function main() {
   if (!response.ok || !response.requestId) {
     fail(response.reason ?? "gateway returned ok=false");
   }
+  const requestId = response.requestId;
   const deadline = response.expiresAtMs ?? Date.now() + HOOK_TIMEOUT_MS;
-  const scope = `ms-365:write:${preview.itemId}`;
   while (Date.now() < deadline) {
     await new Promise((r) => setTimeout(r, KERNEL_POLL_INTERVAL_MS));
-    const lookup = await approvalLookup(agentName, scope, []);
+    const lookup = await approvalLookupByRequest(agentName, requestId, []);
     if (!lookup)
       continue;
     const state = lookup.state;
@@ -255,5 +277,6 @@ if (__require.main == __require.module) {
 export {
   isGatedMs365Tool,
   extractMs365Preview,
+  KNOWN_SAFE_MS365_READ_TOOLS,
   GATED_MS365_WRITE_TOOLS
 };

package/dist/cli/notion-write-pretool.mjs

@@ -10928,7 +10928,7 @@ function decodeResponse(line) {
   const obj = JSON.parse(line);
   return ResponseSchema.parse(obj);
 }
-var MAX_FRAME_BYTES, AgentNameSchema, GetRequestSchema, PutRequestSchema, ListRequestSchema, MintGrantRequestSchema, ListGrantsRequestSchema, RevokeGrantRequestSchema, StatusRequestSchema, LockRequestSchema, PreflightAccessRequestSchema, OkPreflightAccessResponseSchema, ApprovalRequestRequestSchema, ApprovalLookupRequestSchema, ApprovalConsumeRequestSchema, ApprovalRevokeRequestSchema, ApprovalListRequestSchema, ApprovalDecisionModeSchema, ApprovalRecordRequestSchema, ApprovalConsumeRecordRequestSchema, RequestSchema, VaultEntrySchema, ErrorCode, OkEntryResponseSchema, OkKeysResponseSchema, BrokerStatus, OkStatusResponseSchema, OkLockResponseSchema, OkPutResponseSchema, OkMintGrantResponseSchema, GrantMetaSchema, OkListGrantsResponseSchema, OkRevokeGrantResponseSchema, OkApprovalRequestResponseSchema, ApprovalDecisionMetaSchema, OkApprovalLookupResponseSchema, OkApprovalConsumeResponseSchema, OkApprovalRevokeResponseSchema, OkApprovalListResponseSchema, OkApprovalRecordResponseSchema, OkApprovalConsumeRecordResponseSchema, ErrorResponseSchema, ResponseSchema;
+var MAX_FRAME_BYTES, AgentNameSchema, GetRequestSchema, PutRequestSchema, ListRequestSchema, MintGrantRequestSchema, ListGrantsRequestSchema, RevokeGrantRequestSchema, StatusRequestSchema, LockRequestSchema, PreflightAccessRequestSchema, OkPreflightAccessResponseSchema, ApprovalRequestRequestSchema, ApprovalLookupRequestSchema, ApprovalLookupByRequestRequestSchema, ApprovalConsumeRequestSchema, ApprovalRevokeRequestSchema, ApprovalListRequestSchema, ApprovalDecisionModeSchema, ApprovalRecordRequestSchema, ApprovalConsumeRecordRequestSchema, RequestSchema, VaultEntrySchema, ErrorCode, OkEntryResponseSchema, OkKeysResponseSchema, BrokerStatus, OkStatusResponseSchema, OkLockResponseSchema, OkPutResponseSchema, OkMintGrantResponseSchema, GrantMetaSchema, OkListGrantsResponseSchema, OkRevokeGrantResponseSchema, OkApprovalRequestResponseSchema, ApprovalDecisionMetaSchema, OkApprovalLookupResponseSchema, OkApprovalConsumeResponseSchema, OkApprovalRevokeResponseSchema, OkApprovalListResponseSchema, OkApprovalRecordResponseSchema, OkApprovalConsumeRecordResponseSchema, ErrorResponseSchema, ResponseSchema;
 var init_protocol = __esm(() => {
   init_zod();
   init_peercred();
@@ -11028,6 +11028,13 @@ var init_protocol = __esm(() => {
     action: exports_external.string().min(1),
     current_approver_set: exports_external.array(exports_external.string())
   });
+  ApprovalLookupByRequestRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("approval_lookup_by_request"),
+    agent_unit: exports_external.string().min(1),
+    request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
+    current_approver_set: exports_external.array(exports_external.string())
+  });
   ApprovalConsumeRequestSchema = exports_external.object({
     v: exports_external.literal(1),
     op: exports_external.literal("approval_consume"),
@@ -11082,6 +11089,7 @@ var init_protocol = __esm(() => {
     RevokeGrantRequestSchema,
     ApprovalRequestRequestSchema,
     ApprovalLookupRequestSchema,
+    ApprovalLookupByRequestRequestSchema,
     ApprovalConsumeRequestSchema,
     ApprovalRevokeRequestSchema,
     ApprovalListRequestSchema,
@@ -11104,7 +11112,8 @@ var init_protocol = __esm(() => {
     "DENIED",
     "UNKNOWN_KEY",
     "BAD_REQUEST",
-    "INTERNAL"
+    "INTERNAL",
+    "AUDIT_UNAVAILABLE"
   ]);
   OkEntryResponseSchema = exports_external.object({
     ok: exports_external.literal(true),
@@ -11808,7 +11817,12 @@ var ScheduleEntrySchema = exports_external.object({
 var AgentSoulSchema = exports_external.object({
   name: exports_external.string().describe("Agent persona name (e.g., 'Coach', 'Sage')"),
   style: exports_external.string().describe("Communication style description"),
-  boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers")
+  creature: exports_external.string().optional().describe("Persona creature/form (e.g., 'owl', 'octopus')"),
+  vibe: exports_external.string().optional().describe("One-line personality vibe (e.g., 'calm, precise')"),
+  expertise: exports_external.string().optional().describe("Domain expertise summary rendered into the persona"),
+  emoji: exports_external.string().optional().describe("Signature emoji for the persona (e.g., '\uD83E\uDD89')"),
+  boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers"),
+  shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).default("generalist").describe("Persona-shape discriminator the per-agent CLAUDE.md template can " + "branch on (e.g., 'you are an executive assistant' vs 'a senior " + "engineer'). No runtime behavior yet \u2014 template work lands in a " + "later issue. Cascade: override (per-agent wins over default).")
 }).optional();
 var AgentToolsSchema = exports_external.object({
   allow: exports_external.array(exports_external.string()).default([]).describe("Allowed tools (use ['all'] for unrestricted)"),
@@ -11973,6 +11987,11 @@ var TelegramChannelSchema = exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short \u2014 the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
   }).optional().describe("Interrupt timing \u2014 how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
+  button_choice_confirmation: exports_external.object({
+    enabled: exports_external.boolean().default(false).describe("When true, tapping an agent-emitted inline_keyboard button annotates " + "the source message body with a '\u2705 You chose: <label> \u00b7 HH:MM' line so " + "the chat surface is self-documenting. Only applies to single-use " + "keyboards (re-tappable keyboards are never annotated). Requires the " + "agent's parseMode to be the default 'html'. Opt-in (default false). " + "Limitation: the annotated body is rebuilt from the message's plain " + "text, so any formatting entities (bold, links, code, ...) on the " + "original message are lost when the annotation is applied."),
+    format: exports_external.string().default("\u2705 You chose: {label} \u00b7 {time}").describe("Template for the annotation line. `{label}` is replaced with the " + "tapped button's text (newlines stripped, HTML-escaped, trimmed to 60 " + "chars) and `{time}` with HH:MM in the chosen timezone. Note: retap " + "dedup (replacing a prior annotation instead of appending another " + "line) only recognizes the DEFAULT format shape \u2014 a custom format " + "accumulates one line per retap."),
+    timezone: exports_external.enum(["gateway", "utc"]).default("gateway").describe("Timezone for the {time} placeholder. 'gateway' uses the gateway " + "process's local time; 'utc' uses UTC. Per-user timezones are out of " + "scope for v1.")
+  }).optional().describe("Auto-confirm 'You chose: X' annotation on inline_keyboard taps (#789). " + "Cascades from defaults.channels.telegram.button_choice_confirmation."),
   webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default \u2014 webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 \u2014 see #577.)"),
   webhook_dispatch: exports_external.object({
     github: exports_external.array(webhookDispatchRule).optional(),
@@ -12121,7 +12140,12 @@ var profileFields = {
   soul: exports_external.object({
     name: exports_external.string().optional(),
     style: exports_external.string().optional(),
-    boundaries: exports_external.string().optional()
+    creature: exports_external.string().optional(),
+    vibe: exports_external.string().optional(),
+    expertise: exports_external.string().optional(),
+    emoji: exports_external.string().optional(),
+    boundaries: exports_external.string().optional(),
+    shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).optional()
   }).optional(),
   tools: exports_external.object({
     allow: exports_external.array(exports_external.string()).optional(),
@@ -12318,7 +12342,8 @@ var VaultConfigSchema = exports_external.object({
     autoUnlockCredentialPath: exports_external.string().default("~/.switchroom/vault-auto-unlock").describe("Path to the machine-bound auto-unlock blob (see " + "src/vault/auto-unlock.ts for the format). Default lives under " + "~/.switchroom so it can be bind-mounted into the vault-broker " + "container by docker compose. Tilde-expansion happens " + "at read time."),
     approvalAuth: exports_external.enum(["passphrase", "telegram-id"]).default("passphrase").describe("Posture for tap-to-Approve on vault grant cards. `passphrase` " + "(default) prompts the operator to type the vault passphrase on " + "every Approve \u2014 two-factor (Telegram ID + passphrase). " + "`telegram-id` mints immediately on Approve with no passphrase " + "prompt \u2014 single-factor (Telegram ID only); REQUIRES " + "`autoUnlock: true` so the broker already holds the passphrase. " + "Trades a factor of security for smoother UX; opt-in only."),
     postureMintAgents: exports_external.array(exports_external.string().min(1)).default([]).describe("Per-agent opt-in for posture-attested broker calls (`mint_grant` / " + "`list_grants` / `put` with `attest_via_posture: true`). Only agents " + "whose names are in this list can use the silent-mint path under " + "`approvalAuth: telegram-id`. Default `[]` \u2014 no agent can self-mint " + "until the operator explicitly opts it in. The request's `agent` " + "field must also equal the calling peer's resolved agent name " + "(broker rejects cross-agent posture mints). When `approvalAuth` is " + "`passphrase` this list is ignored \u2014 passphrase attestation still " + "works as before. Each entry is an agent slug exactly as it appears " + "under `agents:` in this config."),
-    adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation \u2014 granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` \u2014 no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload).")
+    adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation \u2014 granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` \u2014 no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload)."),
+    auditFailClosed: exports_external.boolean().default(false).describe("sec WS10-F3 (#1420) \u2014 fail-CLOSED on an audit-append failure. When " + "`false` (default, backward-compatible) the broker fails OPEN: if a " + "vault-audit.log append fails it logs to stderr, bumps the durable " + "fail-open counter, and STILL releases the secret. When `true`, a " + "failed audit append DENIES the secret release with " + "`AUDIT_UNAVAILABLE` \u2014 no secret leaves the broker without a durable " + "audit row. The env var `SWITCHROOM_VAULT_AUDIT_FAIL_CLOSED` " + "(`1`/`true` or `0`/`false`) overrides this at runtime. Either way " + "the fail-open counter is surfaced by `switchroom doctor`. Takes " + "effect on broker restart.")
   }).default({}).superRefine((broker, ctx) => {
     if (broker.approvalAuth === "telegram-id" && broker.autoUnlock !== true) {
       ctx.addIssue({
@@ -12357,7 +12382,9 @@ var FleetHealthConfigSchema = exports_external.object({
 });
 var HostdConfigSchema = exports_external.object({
   config_edit_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the `config_propose_edit` hostd verb (RFC " + "admin-agent-config-edit \u00a73). Default false \u2014 the verb returns " + "`E_CONFIG_EDIT_DISABLED` until the operator explicitly flips " + "this to true. When true, admin agents can propose unified-diff " + "patches against " + "`/state/config/switchroom.yaml`, gated by an operator approval " + "card in the primary chat. Same trust posture as `update_apply` " + "and `agent_restart`: the human-in-the-loop tap is the security " + "boundary, not the agent's judgement."),
-  config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit \u00a75). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card \u2014 so a looping agent is throttled rather than spamming the chat.")
+  config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit \u00a75). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card \u2014 so a looping agent is throttled rather than spamming the chat."),
+  operator_attest_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the operator-passphrase 2nd factor on hostd's " + "mutating verbs (#1841, RFC host-control-daemon.md \u00a75.4). Default " + "false \u2014 attestation is ACCEPTED-and-audited whenever present, but " + "no verb REQUIRES it (behaviour is byte-identical to today, so " + "existing fleets and the Telegram approval-card flow are unchanged). " + "When true, the verbs in `operator_attest_required_verbs` demand a " + "valid operator-passphrase attestation IN ADDITION to admin: hostd " + "forwards the passphrase to the vault broker over its own admin-client " + "connection (`/run/switchroom/broker/hostd/sock`) and treats a broker " + "DENIED as a gate failure. hostd never holds the passphrase. Leave " + "this off until BOTH the gateway passphrase-forward and the " + "cross-compose broker socket are deployed, or gated verbs will fail."),
+  operator_attest_required_verbs: exports_external.array(exports_external.string().min(1)).default(["update_apply", "apply", "rollout"]).describe("Which mutating hostd verbs REQUIRE a valid operator-passphrase " + "attestation when `operator_attest_enabled` is true (#1841). Default " + "is the RFC \u00a75.4 fleet-mutation set (`update_apply`, `apply`, " + "`rollout`). Verbs NOT in this list still accept-and-audit an " + "attestation when one is supplied, but never require it. Ignored " + "entirely when `operator_attest_enabled` is false.")
 });
 var CronEgressSchema = exports_external.object({
   allowed_hosts: exports_external.array(exports_external.string().min(1)).default([]).describe("Hosts a poll may reach (exact, https-only). loopback/private/IP-literal are always rejected."),
@@ -12771,6 +12798,11 @@ function mergeAgentConfig(defaultsIn, agentIn) {
       if (v !== undefined)
         combined[k] = v;
     }
+    const baseSoul = base;
+    const overrideSoul = override;
+    if (baseSoul.shape !== undefined && (overrideSoul.shape === undefined || overrideSoul.shape === "generalist")) {
+      combined.shape = baseSoul.shape;
+    }
     merged.soul = combined;
   }
   if (defaults.memory || merged.memory) {