switchroom 0.18.11 → 0.18.13

package/dist/vault/approvals/kernel-server.js

@@ -4116,7 +4116,12 @@ var init_schema = __esm(() => {
   AgentSoulSchema = exports_external.object({
     name: exports_external.string().describe("Agent persona name (e.g., 'Coach', 'Sage')"),
     style: exports_external.string().describe("Communication style description"),
-    boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers")
+    creature: exports_external.string().optional().describe("Persona creature/form (e.g., 'owl', 'octopus')"),
+    vibe: exports_external.string().optional().describe("One-line personality vibe (e.g., 'calm, precise')"),
+    expertise: exports_external.string().optional().describe("Domain expertise summary rendered into the persona"),
+    emoji: exports_external.string().optional().describe("Signature emoji for the persona (e.g., '\uD83E\uDD89')"),
+    boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers"),
+    shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).default("generalist").describe("Persona-shape discriminator the per-agent CLAUDE.md template can " + "branch on (e.g., 'you are an executive assistant' vs 'a senior " + "engineer'). No runtime behavior yet — template work lands in a " + "later issue. Cascade: override (per-agent wins over default).")
   }).optional();
   AgentToolsSchema = exports_external.object({
     allow: exports_external.array(exports_external.string()).default([]).describe("Allowed tools (use ['all'] for unrestricted)"),
@@ -4281,6 +4286,11 @@ var init_schema = __esm(() => {
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
     }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
+    button_choice_confirmation: exports_external.object({
+      enabled: exports_external.boolean().default(false).describe("When true, tapping an agent-emitted inline_keyboard button annotates " + "the source message body with a '✅ You chose: <label> · HH:MM' line so " + "the chat surface is self-documenting. Only applies to single-use " + "keyboards (re-tappable keyboards are never annotated). Requires the " + "agent's parseMode to be the default 'html'. Opt-in (default false). " + "Limitation: the annotated body is rebuilt from the message's plain " + "text, so any formatting entities (bold, links, code, ...) on the " + "original message are lost when the annotation is applied."),
+      format: exports_external.string().default("✅ You chose: {label} · {time}").describe("Template for the annotation line. `{label}` is replaced with the " + "tapped button's text (newlines stripped, HTML-escaped, trimmed to 60 " + "chars) and `{time}` with HH:MM in the chosen timezone. Note: retap " + "dedup (replacing a prior annotation instead of appending another " + "line) only recognizes the DEFAULT format shape — a custom format " + "accumulates one line per retap."),
+      timezone: exports_external.enum(["gateway", "utc"]).default("gateway").describe("Timezone for the {time} placeholder. 'gateway' uses the gateway " + "process's local time; 'utc' uses UTC. Per-user timezones are out of " + "scope for v1.")
+    }).optional().describe("Auto-confirm 'You chose: X' annotation on inline_keyboard taps (#789). " + "Cascades from defaults.channels.telegram.button_choice_confirmation."),
     webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
     webhook_dispatch: exports_external.object({
       github: exports_external.array(webhookDispatchRule).optional(),
@@ -4429,7 +4439,12 @@ var init_schema = __esm(() => {
     soul: exports_external.object({
       name: exports_external.string().optional(),
       style: exports_external.string().optional(),
-      boundaries: exports_external.string().optional()
+      creature: exports_external.string().optional(),
+      vibe: exports_external.string().optional(),
+      expertise: exports_external.string().optional(),
+      emoji: exports_external.string().optional(),
+      boundaries: exports_external.string().optional(),
+      shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).optional()
     }).optional(),
     tools: exports_external.object({
       allow: exports_external.array(exports_external.string()).optional(),
@@ -4626,7 +4641,8 @@ var init_schema = __esm(() => {
       autoUnlockCredentialPath: exports_external.string().default("~/.switchroom/vault-auto-unlock").describe("Path to the machine-bound auto-unlock blob (see " + "src/vault/auto-unlock.ts for the format). Default lives under " + "~/.switchroom so it can be bind-mounted into the vault-broker " + "container by docker compose. Tilde-expansion happens " + "at read time."),
       approvalAuth: exports_external.enum(["passphrase", "telegram-id"]).default("passphrase").describe("Posture for tap-to-Approve on vault grant cards. `passphrase` " + "(default) prompts the operator to type the vault passphrase on " + "every Approve — two-factor (Telegram ID + passphrase). " + "`telegram-id` mints immediately on Approve with no passphrase " + "prompt — single-factor (Telegram ID only); REQUIRES " + "`autoUnlock: true` so the broker already holds the passphrase. " + "Trades a factor of security for smoother UX; opt-in only."),
       postureMintAgents: exports_external.array(exports_external.string().min(1)).default([]).describe("Per-agent opt-in for posture-attested broker calls (`mint_grant` / " + "`list_grants` / `put` with `attest_via_posture: true`). Only agents " + "whose names are in this list can use the silent-mint path under " + "`approvalAuth: telegram-id`. Default `[]` — no agent can self-mint " + "until the operator explicitly opts it in. The request's `agent` " + "field must also equal the calling peer's resolved agent name " + "(broker rejects cross-agent posture mints). When `approvalAuth` is " + "`passphrase` this list is ignored — passphrase attestation still " + "works as before. Each entry is an agent slug exactly as it appears " + "under `agents:` in this config."),
-      adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload).")
+      adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload)."),
+      auditFailClosed: exports_external.boolean().default(false).describe("sec WS10-F3 (#1420) — fail-CLOSED on an audit-append failure. When " + "`false` (default, backward-compatible) the broker fails OPEN: if a " + "vault-audit.log append fails it logs to stderr, bumps the durable " + "fail-open counter, and STILL releases the secret. When `true`, a " + "failed audit append DENIES the secret release with " + "`AUDIT_UNAVAILABLE` — no secret leaves the broker without a durable " + "audit row. The env var `SWITCHROOM_VAULT_AUDIT_FAIL_CLOSED` " + "(`1`/`true` or `0`/`false`) overrides this at runtime. Either way " + "the fail-open counter is surfaced by `switchroom doctor`. Takes " + "effect on broker restart.")
     }).default({}).superRefine((broker, ctx) => {
       if (broker.approvalAuth === "telegram-id" && broker.autoUnlock !== true) {
         ctx.addIssue({
@@ -4665,7 +4681,9 @@ var init_schema = __esm(() => {
   });
   HostdConfigSchema = exports_external.object({
     config_edit_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the `config_propose_edit` hostd verb (RFC " + "admin-agent-config-edit §3). Default false — the verb returns " + "`E_CONFIG_EDIT_DISABLED` until the operator explicitly flips " + "this to true. When true, admin agents can propose unified-diff " + "patches against " + "`/state/config/switchroom.yaml`, gated by an operator approval " + "card in the primary chat. Same trust posture as `update_apply` " + "and `agent_restart`: the human-in-the-loop tap is the security " + "boundary, not the agent's judgement."),
-    config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat.")
+    config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat."),
+    operator_attest_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the operator-passphrase 2nd factor on hostd's " + "mutating verbs (#1841, RFC host-control-daemon.md §5.4). Default " + "false — attestation is ACCEPTED-and-audited whenever present, but " + "no verb REQUIRES it (behaviour is byte-identical to today, so " + "existing fleets and the Telegram approval-card flow are unchanged). " + "When true, the verbs in `operator_attest_required_verbs` demand a " + "valid operator-passphrase attestation IN ADDITION to admin: hostd " + "forwards the passphrase to the vault broker over its own admin-client " + "connection (`/run/switchroom/broker/hostd/sock`) and treats a broker " + "DENIED as a gate failure. hostd never holds the passphrase. Leave " + "this off until BOTH the gateway passphrase-forward and the " + "cross-compose broker socket are deployed, or gated verbs will fail."),
+    operator_attest_required_verbs: exports_external.array(exports_external.string().min(1)).default(["update_apply", "apply", "rollout"]).describe("Which mutating hostd verbs REQUIRE a valid operator-passphrase " + "attestation when `operator_attest_enabled` is true (#1841). Default " + "is the RFC §5.4 fleet-mutation set (`update_apply`, `apply`, " + "`rollout`). Verbs NOT in this list still accept-and-audit an " + "attestation when one is supplied, but never require it. Ignored " + "entirely when `operator_attest_enabled` is false.")
   });
   CronEgressSchema = exports_external.object({
     allowed_hosts: exports_external.array(exports_external.string().min(1)).default([]).describe("Hosts a poll may reach (exact, https-only). loopback/private/IP-literal are always rejected."),
@@ -4760,6 +4778,13 @@ var init_schema = __esm(() => {
   });
 });
 
+// src/util/atomic.ts
+import { closeSync, constants, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+var TMP_OPEN_FLAGS;
+var init_atomic = __esm(() => {
+  TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
+});
+
 // src/config/merge.ts
 function dedupe(items) {
   const seen = new Set;
@@ -4897,6 +4922,11 @@ function mergeAgentConfig(defaultsIn, agentIn) {
       if (v !== undefined)
         combined[k] = v;
     }
+    const baseSoul = base;
+    const overrideSoul = override;
+    if (baseSoul.shape !== undefined && (overrideSoul.shape === undefined || overrideSoul.shape === "generalist")) {
+      combined.shape = baseSoul.shape;
+    }
     merged.soul = combined;
   }
   if (defaults.memory || merged.memory) {
@@ -18226,6 +18256,13 @@ var ApprovalLookupRequestSchema = exports_external.object({
   action: exports_external.string().min(1),
   current_approver_set: exports_external.array(exports_external.string())
 });
+var ApprovalLookupByRequestRequestSchema = exports_external.object({
+  v: exports_external.literal(1),
+  op: exports_external.literal("approval_lookup_by_request"),
+  agent_unit: exports_external.string().min(1),
+  request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
+  current_approver_set: exports_external.array(exports_external.string())
+});
 var ApprovalConsumeRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("approval_consume"),
@@ -18280,6 +18317,7 @@ var RequestSchema = exports_external.discriminatedUnion("op", [
   RevokeGrantRequestSchema,
   ApprovalRequestRequestSchema,
   ApprovalLookupRequestSchema,
+  ApprovalLookupByRequestRequestSchema,
   ApprovalConsumeRequestSchema,
   ApprovalRevokeRequestSchema,
   ApprovalListRequestSchema,
@@ -18302,7 +18340,8 @@ var ErrorCode = exports_external.enum([
   "DENIED",
   "UNKNOWN_KEY",
   "BAD_REQUEST",
-  "INTERNAL"
+  "INTERNAL",
+  "AUDIT_UNAVAILABLE"
 ]);
 var OkEntryResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -18640,6 +18679,30 @@ function lookupDecision(db, query, opts = {}, now = Date.now()) {
        ORDER BY granted_at DESC LIMIT 1`).get(query.agent_unit, query.scope, query.action);
   if (!row)
     return { state: "no_decision" };
+  return evaluateDecisionRow(db, row, currentCanonical, opts, now);
+}
+function lookupDecisionByRequestId(db, query, opts = {}, now = Date.now()) {
+  const currentCanonical = canonicalizeApproverSet(query.current_approver_set);
+  const nonceRow = db.query(`SELECT * FROM approval_nonces WHERE request_id = ?`).get(query.request_id);
+  if (!nonceRow)
+    return { state: "no_decision" };
+  const nonce = nonceFromRow(nonceRow);
+  if (nonce.agent_unit !== query.agent_unit)
+    return { state: "no_decision" };
+  if (nonce.decision_id === null) {
+    if (nonce.expires_at < now)
+      return { state: "expired" };
+    return { state: "pending", request_id: nonce.request_id };
+  }
+  const decRow = db.query(`SELECT * FROM approval_decisions WHERE id = ?`).get(nonce.decision_id);
+  if (!decRow)
+    return { state: "expired" };
+  if (decRow.revoked_at != null) {
+    return { state: "denied", decision: rowToDecision(decRow) };
+  }
+  return evaluateDecisionRow(db, decRow, currentCanonical, opts, now);
+}
+function evaluateDecisionRow(db, row, currentCanonical, opts, now) {
   const decision = rowToDecision(row);
   if (decision.decision === "deny_perm") {
     return { state: "denied", decision };
@@ -18836,6 +18899,7 @@ init_schema();
 
 // src/agents/scaffold.ts
 import { join as join4, resolve as resolve5 } from "node:path";
+init_atomic();
 init_schema();
 
 // src/config/users.ts
@@ -18901,18 +18965,22 @@ var tails = new Map;
 
 // src/agents/inject.ts
 var INJECT_COMMANDS = new Map([
-  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true }],
-  ["/status", { description: "Show session status", expectsOutput: true, dialog: true }],
-  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true }],
-  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true }],
-  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true }],
-  ["/model", { description: "Open model picker", expectsOutput: true }],
+  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/status", { description: "Show session status", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/help", { description: "Show help / command discovery", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/context", { description: "Show context window usage", expectsOutput: true, argsAllowed: false }],
+  ["/release-notes", { description: "Show release-notes version list", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/model", { description: "Open model picker", expectsOutput: true, argsAllowed: true }],
   [
     "/clear",
     {
       description: "Clear session screen",
       expectsOutput: false,
-      silentNote: "context cleared — fresh slate"
+      silentNote: "context cleared — fresh slate",
+      argsAllowed: false
     }
   ],
   [
@@ -18920,7 +18988,8 @@ var INJECT_COMMANDS = new Map([
     {
       description: "Compact conversation history",
       expectsOutput: false,
-      silentNote: "compaction runs silently"
+      silentNote: "compaction runs silently",
+      argsAllowed: false
     }
   ]
 ]);
@@ -18930,6 +18999,15 @@ var INJECT_BLOCKED = new Map([
   ["/logout", { reason: "would terminate the agent's auth session" }],
   ["/exit", { reason: "would kill the agent process" }],
   ["/quit", { reason: "would kill the agent process" }],
+  ["/upgrade", { reason: "mutates the Claude Code installation" }],
+  ["/init", { reason: "generates/overwrites CLAUDE.md and runs a model turn" }],
+  ["/mcp", { reason: "opens an interactive MCP server management dialog" }],
+  ["/permissions", { reason: "opens an interactive permissions editor that mutates tool policy" }],
+  ["/install-github-app", { reason: "runs a network/OAuth install flow" }],
+  ["/add-dir", { reason: "mutates the session's working-directory set" }],
+  ["/terminal-setup", { reason: "mutates terminal keybinding configuration" }],
+  ["/privacy-settings", { reason: "opens an interactive privacy-settings dialog" }],
+  ["/bug", { reason: "submits a bug report over the network" }],
   [
     "/effort",
     {
@@ -18947,6 +19025,7 @@ var HINDSIGHT_CONSUMER_NAME = "hindsight";
 var HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight";
 var HINDSIGHT_IMAGE = `${HINDSIGHT_IMAGE_REPO}:latest`;
 var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`;
+var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 
@@ -19004,6 +19083,7 @@ init_paths();
 
 // src/agents/scaffold.ts
 var REPO_ROOT = resolve5(import.meta.dirname, "../..");
+var CLAUDE_MD_YOURS_PLACEHOLDER = "This space is yours. Add per-agent rules, exceptions, or context the " + "Switchroom template doesn't capture. Everything above the marker line is " + "regenerated on every apply; this section is preserved.";
 var SWITCHROOM_OWNED_SETTINGS_KEYS = new Set([
   "permissions",
   "mcpServers",
@@ -19261,6 +19341,33 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
     socket.write(encodeResponse({ ok: true, state: r.state, decision }));
     return;
   }
+  if (req.op === "approval_lookup_by_request") {
+    const acl = checkApprovalAclByAgent(agent, req.agent_unit);
+    if (!acl.allow) {
+      socket.write(encodeResponse(errorResponse("DENIED", acl.reason)));
+      return;
+    }
+    const r = lookupDecisionByRequestId(db, {
+      agent_unit: req.agent_unit,
+      request_id: req.request_id,
+      current_approver_set: req.current_approver_set
+    });
+    const decision = r.state === "granted" || r.state === "denied" ? {
+      id: r.decision.id,
+      agent_unit: r.decision.agent_unit,
+      scope: r.decision.scope,
+      action: r.decision.action,
+      decision: r.decision.decision,
+      granted_at: r.decision.granted_at,
+      granted_by_user_id: r.decision.granted_by_user_id,
+      ttl_expires_at: r.decision.ttl_expires_at,
+      last_used_at: r.decision.last_used_at,
+      revoked_at: r.decision.revoked_at,
+      revoke_reason: r.decision.revoke_reason
+    } : null;
+    socket.write(encodeResponse({ ok: true, state: r.state, decision }));
+    return;
+  }
   if (req.op === "approval_consume") {
     const peek = getNonce(db, req.request_id);
     if (peek !== null) {