switchroom 0.18.11 → 0.18.13

package/dist/vault/broker/server.js

@@ -4116,7 +4116,12 @@ var init_schema = __esm(() => {
   AgentSoulSchema = exports_external.object({
     name: exports_external.string().describe("Agent persona name (e.g., 'Coach', 'Sage')"),
     style: exports_external.string().describe("Communication style description"),
-    boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers")
+    creature: exports_external.string().optional().describe("Persona creature/form (e.g., 'owl', 'octopus')"),
+    vibe: exports_external.string().optional().describe("One-line personality vibe (e.g., 'calm, precise')"),
+    expertise: exports_external.string().optional().describe("Domain expertise summary rendered into the persona"),
+    emoji: exports_external.string().optional().describe("Signature emoji for the persona (e.g., '\uD83E\uDD89')"),
+    boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers"),
+    shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).default("generalist").describe("Persona-shape discriminator the per-agent CLAUDE.md template can " + "branch on (e.g., 'you are an executive assistant' vs 'a senior " + "engineer'). No runtime behavior yet — template work lands in a " + "later issue. Cascade: override (per-agent wins over default).")
   }).optional();
   AgentToolsSchema = exports_external.object({
     allow: exports_external.array(exports_external.string()).default([]).describe("Allowed tools (use ['all'] for unrestricted)"),
@@ -4281,6 +4286,11 @@ var init_schema = __esm(() => {
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
     }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
+    button_choice_confirmation: exports_external.object({
+      enabled: exports_external.boolean().default(false).describe("When true, tapping an agent-emitted inline_keyboard button annotates " + "the source message body with a '✅ You chose: <label> · HH:MM' line so " + "the chat surface is self-documenting. Only applies to single-use " + "keyboards (re-tappable keyboards are never annotated). Requires the " + "agent's parseMode to be the default 'html'. Opt-in (default false). " + "Limitation: the annotated body is rebuilt from the message's plain " + "text, so any formatting entities (bold, links, code, ...) on the " + "original message are lost when the annotation is applied."),
+      format: exports_external.string().default("✅ You chose: {label} · {time}").describe("Template for the annotation line. `{label}` is replaced with the " + "tapped button's text (newlines stripped, HTML-escaped, trimmed to 60 " + "chars) and `{time}` with HH:MM in the chosen timezone. Note: retap " + "dedup (replacing a prior annotation instead of appending another " + "line) only recognizes the DEFAULT format shape — a custom format " + "accumulates one line per retap."),
+      timezone: exports_external.enum(["gateway", "utc"]).default("gateway").describe("Timezone for the {time} placeholder. 'gateway' uses the gateway " + "process's local time; 'utc' uses UTC. Per-user timezones are out of " + "scope for v1.")
+    }).optional().describe("Auto-confirm 'You chose: X' annotation on inline_keyboard taps (#789). " + "Cascades from defaults.channels.telegram.button_choice_confirmation."),
     webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
     webhook_dispatch: exports_external.object({
       github: exports_external.array(webhookDispatchRule).optional(),
@@ -4429,7 +4439,12 @@ var init_schema = __esm(() => {
     soul: exports_external.object({
       name: exports_external.string().optional(),
       style: exports_external.string().optional(),
-      boundaries: exports_external.string().optional()
+      creature: exports_external.string().optional(),
+      vibe: exports_external.string().optional(),
+      expertise: exports_external.string().optional(),
+      emoji: exports_external.string().optional(),
+      boundaries: exports_external.string().optional(),
+      shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).optional()
     }).optional(),
     tools: exports_external.object({
       allow: exports_external.array(exports_external.string()).optional(),
@@ -4626,7 +4641,8 @@ var init_schema = __esm(() => {
       autoUnlockCredentialPath: exports_external.string().default("~/.switchroom/vault-auto-unlock").describe("Path to the machine-bound auto-unlock blob (see " + "src/vault/auto-unlock.ts for the format). Default lives under " + "~/.switchroom so it can be bind-mounted into the vault-broker " + "container by docker compose. Tilde-expansion happens " + "at read time."),
       approvalAuth: exports_external.enum(["passphrase", "telegram-id"]).default("passphrase").describe("Posture for tap-to-Approve on vault grant cards. `passphrase` " + "(default) prompts the operator to type the vault passphrase on " + "every Approve — two-factor (Telegram ID + passphrase). " + "`telegram-id` mints immediately on Approve with no passphrase " + "prompt — single-factor (Telegram ID only); REQUIRES " + "`autoUnlock: true` so the broker already holds the passphrase. " + "Trades a factor of security for smoother UX; opt-in only."),
       postureMintAgents: exports_external.array(exports_external.string().min(1)).default([]).describe("Per-agent opt-in for posture-attested broker calls (`mint_grant` / " + "`list_grants` / `put` with `attest_via_posture: true`). Only agents " + "whose names are in this list can use the silent-mint path under " + "`approvalAuth: telegram-id`. Default `[]` — no agent can self-mint " + "until the operator explicitly opts it in. The request's `agent` " + "field must also equal the calling peer's resolved agent name " + "(broker rejects cross-agent posture mints). When `approvalAuth` is " + "`passphrase` this list is ignored — passphrase attestation still " + "works as before. Each entry is an agent slug exactly as it appears " + "under `agents:` in this config."),
-      adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload).")
+      adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload)."),
+      auditFailClosed: exports_external.boolean().default(false).describe("sec WS10-F3 (#1420) — fail-CLOSED on an audit-append failure. When " + "`false` (default, backward-compatible) the broker fails OPEN: if a " + "vault-audit.log append fails it logs to stderr, bumps the durable " + "fail-open counter, and STILL releases the secret. When `true`, a " + "failed audit append DENIES the secret release with " + "`AUDIT_UNAVAILABLE` — no secret leaves the broker without a durable " + "audit row. The env var `SWITCHROOM_VAULT_AUDIT_FAIL_CLOSED` " + "(`1`/`true` or `0`/`false`) overrides this at runtime. Either way " + "the fail-open counter is surfaced by `switchroom doctor`. Takes " + "effect on broker restart.")
     }).default({}).superRefine((broker, ctx) => {
       if (broker.approvalAuth === "telegram-id" && broker.autoUnlock !== true) {
         ctx.addIssue({
@@ -4665,7 +4681,9 @@ var init_schema = __esm(() => {
   });
   HostdConfigSchema = exports_external.object({
     config_edit_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the `config_propose_edit` hostd verb (RFC " + "admin-agent-config-edit §3). Default false — the verb returns " + "`E_CONFIG_EDIT_DISABLED` until the operator explicitly flips " + "this to true. When true, admin agents can propose unified-diff " + "patches against " + "`/state/config/switchroom.yaml`, gated by an operator approval " + "card in the primary chat. Same trust posture as `update_apply` " + "and `agent_restart`: the human-in-the-loop tap is the security " + "boundary, not the agent's judgement."),
-    config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat.")
+    config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat."),
+    operator_attest_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the operator-passphrase 2nd factor on hostd's " + "mutating verbs (#1841, RFC host-control-daemon.md §5.4). Default " + "false — attestation is ACCEPTED-and-audited whenever present, but " + "no verb REQUIRES it (behaviour is byte-identical to today, so " + "existing fleets and the Telegram approval-card flow are unchanged). " + "When true, the verbs in `operator_attest_required_verbs` demand a " + "valid operator-passphrase attestation IN ADDITION to admin: hostd " + "forwards the passphrase to the vault broker over its own admin-client " + "connection (`/run/switchroom/broker/hostd/sock`) and treats a broker " + "DENIED as a gate failure. hostd never holds the passphrase. Leave " + "this off until BOTH the gateway passphrase-forward and the " + "cross-compose broker socket are deployed, or gated verbs will fail."),
+    operator_attest_required_verbs: exports_external.array(exports_external.string().min(1)).default(["update_apply", "apply", "rollout"]).describe("Which mutating hostd verbs REQUIRE a valid operator-passphrase " + "attestation when `operator_attest_enabled` is true (#1841). Default " + "is the RFC §5.4 fleet-mutation set (`update_apply`, `apply`, " + "`rollout`). Verbs NOT in this list still accept-and-audit an " + "attestation when one is supplied, but never require it. Ignored " + "entirely when `operator_attest_enabled` is false.")
   });
   CronEgressSchema = exports_external.object({
     allowed_hosts: exports_external.array(exports_external.string().min(1)).default([]).describe("Hosts a poll may reach (exact, https-only). loopback/private/IP-literal are always rejected."),
@@ -4760,6 +4778,13 @@ var init_schema = __esm(() => {
   });
 });
 
+// src/util/atomic.ts
+import { closeSync, constants, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+var TMP_OPEN_FLAGS;
+var init_atomic = __esm(() => {
+  TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
+});
+
 // src/config/merge.ts
 function dedupe(items) {
   const seen = new Set;
@@ -4897,6 +4922,11 @@ function mergeAgentConfig(defaultsIn, agentIn) {
       if (v !== undefined)
         combined[k] = v;
     }
+    const baseSoul = base;
+    const overrideSoul = override;
+    if (baseSoul.shape !== undefined && (overrideSoul.shape === undefined || overrideSoul.shape === "generalist")) {
+      combined.shape = baseSoul.shape;
+    }
     merged.soul = combined;
   }
   if (defaults.memory || merged.memory) {
@@ -18064,7 +18094,7 @@ var require_lib = __commonJS((exports, module) => {
 
 // src/vault/broker/server.ts
 import * as net from "node:net";
-import { mkdirSync as mkdirSync6, chmodSync as chmodSync4, chownSync, existsSync as existsSync11, readFileSync as readFileSync9, readdirSync as readdirSync4, statSync as statSync6, unlinkSync as unlinkSync6, writeFileSync as writeFileSync2, renameSync as renameSync6 } from "node:fs";
+import { mkdirSync as mkdirSync6, chmodSync as chmodSync4, chownSync, existsSync as existsSync11, readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync6, unlinkSync as unlinkSync6, writeFileSync as writeFileSync3, renameSync as renameSync7 } from "node:fs";
 
 // src/agents/compose.ts
 import { createHash } from "node:crypto";
@@ -18072,6 +18102,7 @@ init_schema();
 
 // src/agents/scaffold.ts
 import { join as join4, resolve as resolve6 } from "node:path";
+init_atomic();
 init_schema();
 
 // src/config/users.ts
@@ -18154,22 +18185,6 @@ function isWebkiteCredentialKeyForAgent(agentConfig, key) {
     return false;
   return true;
 }
-function parseCronUnit(unitName) {
-  const m = unitName.match(/^switchroom-([a-zA-Z0-9_-]+)-cron-(\d+)\.service$/);
-  if (!m)
-    return null;
-  const agentName = m[1];
-  const index = parseInt(m[2], 10);
-  if (!agentName)
-    return null;
-  return { agentName, index };
-}
-function agentSlugFromPeer(peer) {
-  if (peer.systemdUnit === null)
-    return null;
-  const parsed = parseCronUnit(peer.systemdUnit);
-  return parsed?.agentName ?? null;
-}
 function checkEntryScope(scope, agentSlug) {
   if (scope === undefined || scope === null) {
     return { allow: true };
@@ -18192,42 +18207,6 @@ function checkEntryScope(scope, agentSlug) {
   }
   return { allow: true };
 }
-function checkAcl(peer, config, key) {
-  if (peer.systemdUnit !== null) {
-    const parsed = parseCronUnit(peer.systemdUnit);
-    if (parsed === null) {
-      return {
-        allow: false,
-        reason: `systemd unit '${peer.systemdUnit}' does not match switchroom cron unit naming convention`
-      };
-    }
-    const { agentName, index } = parsed;
-    const agentConfig = config.agents?.[agentName];
-    if (!agentConfig) {
-      return { allow: false, reason: `agent '${agentName}' not found in config` };
-    }
-    const schedule = agentConfig.schedule ?? [];
-    if (index >= schedule.length || index < 0) {
-      return {
-        allow: false,
-        reason: `schedule index ${index} out of range for agent '${agentName}' (${schedule.length} entries)`
-      };
-    }
-    const entry = schedule[index];
-    const allowedKeys = entry.secrets ?? [];
-    if (!allowedKeys.includes(key)) {
-      return {
-        allow: false,
-        reason: `key '${key}' not in ACL for ${agentName}/schedule[${index}]`
-      };
-    }
-    return { allow: true };
-  }
-  return {
-    allow: false,
-    reason: "caller is not a switchroom cron unit; use 'switchroom vault get --no-broker' for interactive access"
-  };
-}
 function checkAclByAgent(config, agentName, key) {
   if (!agentName) {
     return { allow: false, reason: "agent name unresolved" };
@@ -18361,18 +18340,22 @@ var tails = new Map;
 
 // src/agents/inject.ts
 var INJECT_COMMANDS = new Map([
-  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true }],
-  ["/status", { description: "Show session status", expectsOutput: true, dialog: true }],
-  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true }],
-  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true }],
-  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true }],
-  ["/model", { description: "Open model picker", expectsOutput: true }],
+  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/status", { description: "Show session status", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/help", { description: "Show help / command discovery", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/context", { description: "Show context window usage", expectsOutput: true, argsAllowed: false }],
+  ["/release-notes", { description: "Show release-notes version list", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/model", { description: "Open model picker", expectsOutput: true, argsAllowed: true }],
   [
     "/clear",
     {
       description: "Clear session screen",
       expectsOutput: false,
-      silentNote: "context cleared — fresh slate"
+      silentNote: "context cleared — fresh slate",
+      argsAllowed: false
     }
   ],
   [
@@ -18380,7 +18363,8 @@ var INJECT_COMMANDS = new Map([
     {
       description: "Compact conversation history",
       expectsOutput: false,
-      silentNote: "compaction runs silently"
+      silentNote: "compaction runs silently",
+      argsAllowed: false
     }
   ]
 ]);
@@ -18390,6 +18374,15 @@ var INJECT_BLOCKED = new Map([
   ["/logout", { reason: "would terminate the agent's auth session" }],
   ["/exit", { reason: "would kill the agent process" }],
   ["/quit", { reason: "would kill the agent process" }],
+  ["/upgrade", { reason: "mutates the Claude Code installation" }],
+  ["/init", { reason: "generates/overwrites CLAUDE.md and runs a model turn" }],
+  ["/mcp", { reason: "opens an interactive MCP server management dialog" }],
+  ["/permissions", { reason: "opens an interactive permissions editor that mutates tool policy" }],
+  ["/install-github-app", { reason: "runs a network/OAuth install flow" }],
+  ["/add-dir", { reason: "mutates the session's working-directory set" }],
+  ["/terminal-setup", { reason: "mutates terminal keybinding configuration" }],
+  ["/privacy-settings", { reason: "opens an interactive privacy-settings dialog" }],
+  ["/bug", { reason: "submits a bug report over the network" }],
   [
     "/effort",
     {
@@ -18407,6 +18400,7 @@ var HINDSIGHT_CONSUMER_NAME = "hindsight";
 var HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight";
 var HINDSIGHT_IMAGE = `${HINDSIGHT_IMAGE_REPO}:latest`;
 var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`;
+var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 
@@ -18438,14 +18432,14 @@ init_loader();
 import { randomBytes, scryptSync, createCipheriv, createDecipheriv } from "node:crypto";
 import {
   readFileSync as readFileSync5,
-  writeSync as writeSync2,
+  writeSync as writeSync3,
   existsSync as existsSync6,
-  renameSync,
+  renameSync as renameSync2,
   mkdirSync as mkdirSync2,
   unlinkSync as unlinkSync2,
-  fsyncSync as fsyncSync2,
-  openSync as openSync2,
-  closeSync as closeSync2,
+  fsyncSync as fsyncSync3,
+  openSync as openSync3,
+  closeSync as closeSync3,
   lstatSync,
   realpathSync as realpathSync2
 } from "node:fs";
@@ -18454,10 +18448,10 @@ import { dirname, basename as basename2, resolve as resolve5 } from "node:path";
 // src/vault/flock.ts
 import {
   existsSync as existsSync5,
-  openSync,
-  closeSync,
-  writeSync,
-  fsyncSync,
+  openSync as openSync2,
+  closeSync as closeSync2,
+  writeSync as writeSync2,
+  fsyncSync as fsyncSync2,
   unlinkSync,
   readFileSync as readFileSync4,
   readdirSync as readdirSync3,
@@ -18582,7 +18576,7 @@ function acquireLock(vaultPath, options = {}) {
   while (true) {
     let fd = null;
     try {
-      fd = openSync(lockPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
+      fd = openSync2(lockPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
     } catch (err) {
       const code = err?.code ?? "";
       if (code === "EEXIST") {
@@ -18618,11 +18612,11 @@ function acquireLock(vaultPath, options = {}) {
 ${Date.now()}
 ${process.argv[1] ?? ""}
 `;
-      writeSync(fd, meta);
-      fsyncSync(fd);
+      writeSync2(fd, meta);
+      fsyncSync2(fd);
     } catch {
       try {
-        closeSync(fd);
+        closeSync2(fd);
       } catch {}
       try {
         unlinkSync(lockPath);
@@ -18633,7 +18627,7 @@ ${process.argv[1] ?? ""}
     return {
       release: () => {
         try {
-          closeSync(ownedFd);
+          closeSync2(ownedFd);
         } catch {}
         try {
           unlinkSync(lockPath);
@@ -18689,20 +18683,20 @@ function atomicWriteFileSync(path, data, mode) {
   const dir = dirname(resolve5(effectivePath));
   const tmp = resolve5(dir, `.${basename2(effectivePath)}.${process.pid}.${Date.now()}.tmp`);
   try {
-    const fd = openSync2(tmp, "wx", mode);
+    const fd = openSync3(tmp, "wx", mode);
     try {
-      writeSync2(fd, data);
-      fsyncSync2(fd);
+      writeSync3(fd, data);
+      fsyncSync3(fd);
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
-    renameSync(tmp, effectivePath);
+    renameSync2(tmp, effectivePath);
     try {
-      const dirFd = openSync2(dir, "r");
+      const dirFd = openSync3(dir, "r");
       try {
-        fsyncSync2(dirFd);
+        fsyncSync3(dirFd);
       } finally {
-        closeSync2(dirFd);
+        closeSync3(dirFd);
       }
     } catch {}
   } catch (err) {
@@ -19278,6 +19272,13 @@ var ApprovalLookupRequestSchema = exports_external.object({
   action: exports_external.string().min(1),
   current_approver_set: exports_external.array(exports_external.string())
 });
+var ApprovalLookupByRequestRequestSchema = exports_external.object({
+  v: exports_external.literal(1),
+  op: exports_external.literal("approval_lookup_by_request"),
+  agent_unit: exports_external.string().min(1),
+  request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
+  current_approver_set: exports_external.array(exports_external.string())
+});
 var ApprovalConsumeRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("approval_consume"),
@@ -19332,6 +19333,7 @@ var RequestSchema = exports_external.discriminatedUnion("op", [
   RevokeGrantRequestSchema,
   ApprovalRequestRequestSchema,
   ApprovalLookupRequestSchema,
+  ApprovalLookupByRequestRequestSchema,
   ApprovalConsumeRequestSchema,
   ApprovalRevokeRequestSchema,
   ApprovalListRequestSchema,
@@ -19354,7 +19356,8 @@ var ErrorCode = exports_external.enum([
   "DENIED",
   "UNKNOWN_KEY",
   "BAD_REQUEST",
-  "INTERNAL"
+  "INTERNAL",
+  "AUDIT_UNAVAILABLE"
 ]);
 var OkEntryResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -19542,6 +19545,7 @@ init_paths();
 
 // src/agents/scaffold.ts
 var REPO_ROOT = resolve6(import.meta.dirname, "../..");
+var CLAUDE_MD_YOURS_PLACEHOLDER = "This space is yours. Add per-agent rules, exceptions, or context the " + "Switchroom template doesn't capture. Everything above the marker line is " + "regenerated on every apply; this section is preserved.";
 var SWITCHROOM_OWNED_SETTINGS_KEYS = new Set([
   "permissions",
   "mcpServers",
@@ -19582,13 +19586,13 @@ import {
   copyFileSync as copyFileSync2,
   chmodSync,
   existsSync as existsSync7,
-  fsyncSync as fsyncSync3,
+  fsyncSync as fsyncSync4,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync3,
-  openSync as openSync3,
-  closeSync as closeSync3,
+  openSync as openSync4,
+  closeSync as closeSync4,
   readFileSync as readFileSync7,
-  renameSync as renameSync2,
+  renameSync as renameSync3,
   statSync as statSync4,
   symlinkSync,
   unlinkSync as unlinkSync3
@@ -19654,7 +19658,7 @@ function runMigration(home2, opts) {
       copyFileSync2(oldPath, tempNew);
       chmodSync(tempNew, 384);
       fsyncFile(tempNew);
-      renameSync2(tempNew, newPath);
+      renameSync3(tempNew, newPath);
       fsyncDir(parent);
       atomicReplaceWithSymlink(oldPath, "vault/vault.enc");
       fsyncDir(switchroomRoot);
@@ -19688,22 +19692,22 @@ function atomicReplaceWithSymlink(target, linkTarget) {
     } catch {}
   }
   symlinkSync(linkTarget, tmp);
-  renameSync2(tmp, target);
+  renameSync3(tmp, target);
 }
 function fsyncFile(path) {
-  const fd = openSync3(path, "r+");
+  const fd = openSync4(path, "r+");
   try {
-    fsyncSync3(fd);
+    fsyncSync4(fd);
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
 function fsyncDir(path) {
-  const fd = openSync3(path, "r");
+  const fd = openSync4(path, "r");
   try {
-    fsyncSync3(fd);
+    fsyncSync4(fd);
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
 
@@ -19714,15 +19718,15 @@ init_loader();
 import { createHmac, randomBytes as randomBytes2, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "node:crypto";
 import {
   chmodSync as chmodSync2,
-  closeSync as closeSync4,
+  closeSync as closeSync5,
   existsSync as existsSync8,
-  fsyncSync as fsyncSync4,
+  fsyncSync as fsyncSync5,
   mkdirSync as mkdirSync4,
-  openSync as openSync4,
+  openSync as openSync5,
   readFileSync as readFileSync8,
-  renameSync as renameSync3,
+  renameSync as renameSync4,
   unlinkSync as unlinkSync4,
-  writeSync as writeSync3
+  writeSync as writeSync4
 } from "node:fs";
 var FORMAT_VERSION = 1;
 var SALT_LEN = 16;
@@ -19815,7 +19819,7 @@ import * as path from "node:path";
 
 // src/util/audit-hashchain.ts
 import { createHash as createHash4 } from "node:crypto";
-import { openSync as openSync5, readSync, fstatSync as fstatSync2, closeSync as closeSync5 } from "node:fs";
+import { openSync as openSync6, readSync, fstatSync as fstatSync2, closeSync as closeSync6 } from "node:fs";
 var CHAIN_GENESIS = "GENESIS";
 var SEP = "\x00";
 function rowHash(prev, seq, rowJsonNoChain) {
@@ -19836,7 +19840,7 @@ function chainRow(state, entry) {
 function readTail(path, tailBytes = 64 * 1024) {
   let fd;
   try {
-    fd = openSync5(path, "r");
+    fd = openSync6(path, "r");
   } catch {
     return null;
   }
@@ -19852,7 +19856,7 @@ function readTail(path, tailBytes = 64 * 1024) {
     return null;
   } finally {
     try {
-      closeSync5(fd);
+      closeSync6(fd);
     } catch {}
   }
 }
@@ -19929,6 +19933,23 @@ function safeAuditLogPath(requestedPath) {
 }
 
 // src/vault/broker/audit-log.ts
+function failOpenStatePath(logPath) {
+  return `${logPath}.failopen`;
+}
+function readFailOpenState(statePath) {
+  try {
+    const raw = fs.readFileSync(statePath, "utf8");
+    const parsed = JSON.parse(raw);
+    const count = Number(parsed.failOpenCount);
+    return {
+      failOpenCount: Number.isFinite(count) && count > 0 ? count : 0,
+      lastFailureTs: typeof parsed.lastFailureTs === "string" ? parsed.lastFailureTs : undefined,
+      lastError: typeof parsed.lastError === "string" ? parsed.lastError : undefined
+    };
+  } catch {
+    return { failOpenCount: 0 };
+  }
+}
 var DEFAULT_AUDIT_MAX_BYTES = 32 * 1024 * 1024;
 var DEFAULT_AUDIT_MAX_FILES = 5;
 function resolveRotation(opts) {
@@ -20009,7 +20030,27 @@ function createAuditLogger(opts = {}) {
   const logPath = safeAuditLogPath(opts.path ?? defaultAuditLogPath());
   let chain = seedChain(logPath);
   const rotation = resolveRotation(opts);
+  const statePath = opts.statePath ?? failOpenStatePath(logPath);
+  let failOpen = readFailOpenState(statePath).failOpenCount;
+  const recordFailOpen = (err) => {
+    failOpen += 1;
+    const state = {
+      failOpenCount: failOpen,
+      lastFailureTs: new Date().toISOString(),
+      lastError: String(err.message).slice(0, 300)
+    };
+    try {
+      fs.writeFileSync(statePath, `${JSON.stringify(state)}
+`, { mode: 384 });
+    } catch (persistErr) {
+      process.stderr.write(`[vault-audit] ERROR: could not persist fail-open counter ${statePath}: ${persistErr.message}
+`);
+    }
+  };
   return {
+    failOpenCount() {
+      return failOpen;
+    },
     write(entry) {
       if (rotation.maxBytes > 0) {
         try {
@@ -20026,14 +20067,18 @@ function createAuditLogger(opts = {}) {
       } catch (err) {
         process.stderr.write(`[vault-audit] ERROR: could not open audit log ${logPath}: ${err.message}
 `);
-        return;
+        recordFailOpen(err);
+        return false;
       }
+      let durable = false;
       try {
         fs.writeSync(fd, line);
         chain = next;
+        durable = true;
       } catch (err) {
         process.stderr.write(`[vault-audit] ERROR: could not write to audit log ${logPath}: ${err.message}
 `);
+        recordFailOpen(err);
       } finally {
         try {
           fs.closeSync(fd);
@@ -20042,6 +20087,7 @@ function createAuditLogger(opts = {}) {
 `);
         }
       }
+      return durable;
     }
   };
 }
@@ -22166,6 +22212,9 @@ function lookupDecision(db, query, opts = {}, now = Date.now()) {
        ORDER BY granted_at DESC LIMIT 1`).get(query.agent_unit, query.scope, query.action);
   if (!row)
     return { state: "no_decision" };
+  return evaluateDecisionRow(db, row, currentCanonical, opts, now);
+}
+function evaluateDecisionRow(db, row, currentCanonical, opts, now) {
   const decision = rowToDecision(row);
   if (decision.decision === "deny_perm") {
     return { state: "denied", decision };
@@ -22375,6 +22424,21 @@ class VaultBroker {
       this.grantsDb = openGrantsDb();
     }
   }
+  auditFailClosedEnabled() {
+    const env = process.env.SWITCHROOM_VAULT_AUDIT_FAIL_CLOSED;
+    if (env !== undefined && env !== "") {
+      return env === "1" || env.toLowerCase() === "true";
+    }
+    return this.config?.vault?.broker?.auditFailClosed === true;
+  }
+  auditedReleaseOk(socket, writeAudit, entry) {
+    const durable = writeAudit(entry);
+    if (!durable && this.auditFailClosedEnabled()) {
+      socket.write(encodeResponse(errorResponse("AUDIT_UNAVAILABLE", "secret release denied: audit append failed and broker is in fail-closed mode (vault.broker.auditFailClosed)")));
+      return false;
+    }
+    return true;
+  }
   async start(socketPath, configPath, vaultPath) {
     if (process.platform !== "linux" && process.env.SWITCHROOM_BROKER_ALLOW_NON_LINUX !== "1") {
       throw new Error(`vault-broker is Linux-only (running on ${process.platform}). ` + `The broker's ACL relies on cgroup-based systemd unit identification, ` + `which is not available on this platform. ` + `Use 'switchroom vault get --no-broker' for direct vault access. ` + `If you need to run the broker for development on this platform, ` + `set SWITCHROOM_BROKER_ALLOW_NON_LINUX=1 — but understand that the ` + `broker will accept any same-user caller without per-cron ACL enforcement.`);
@@ -22442,7 +22506,7 @@ class VaultBroker {
       return;
     try {
       if (ready) {
-        writeFileSync2(p, "", { mode: 384 });
+        writeFileSync3(p, "", { mode: 384 });
       } else if (existsSync11(p)) {
         unlinkSync6(p);
       }
@@ -22741,7 +22805,7 @@ class VaultBroker {
     const auditPeerUid = peer?.uid;
     const auditAgentName = agentName ?? undefined;
     const writeAudit = (entry) => {
-      this.auditLogger.write({
+      return this.auditLogger.write({
         ...entry,
         peer_uid: entry.peer_uid ?? auditPeerUid,
         agent_name: entry.agent_name ?? auditAgentName
@@ -22850,8 +22914,8 @@ class VaultBroker {
           return;
         }
       }
-      if (!isOperator && agentName === null && process.platform === "linux" && peer === null) {
-        const reason = "Unable to identify caller (peercred unavailable); denying on Linux";
+      if (!isOperator && agentName === null && process.platform === "linux") {
+        const reason = "Unable to identify caller (no per-agent socket identity); denying on Linux";
         this.auditLogger.write({
           ts: new Date().toISOString(),
           op: "list",
@@ -22863,14 +22927,12 @@ class VaultBroker {
         socket.write(encodeResponse(errorResponse("DENIED", reason)));
         return;
       }
-      const listAgentSlug = agentName ?? (peer !== null ? agentSlugFromPeer(peer) : null);
+      const listAgentSlug = agentName;
       let visibleKeys;
       if (isOperator) {
         visibleKeys = Object.entries(this.secrets).filter(([, entry]) => checkEntryScope(entry.scope, "operator").allow).map(([k]) => k);
       } else if (agentName !== null && this.config !== null) {
         visibleKeys = Object.entries(this.secrets).filter(([key, entry]) => checkAclByAgent(this.config, agentName, key).allow && checkEntryScope(entry.scope, agentName).allow).map(([k]) => k);
-      } else if (peer !== null && this.config !== null) {
-        visibleKeys = Object.entries(this.secrets).filter(([key, entry]) => checkAcl(peer, this.config, key).allow && checkEntryScope(entry.scope, listAgentSlug).allow).map(([k]) => k);
       } else {
         visibleKeys = Object.entries(this.secrets).filter(([, entry]) => checkEntryScope(entry.scope, listAgentSlug).allow).map(([k]) => k);
       }
@@ -22894,6 +22956,21 @@ class VaultBroker {
         const grantResult = await validateGrant(this.grantsDb, req.token, req.key);
         if (grantResult.ok) {
           const grantId = grantResult.grant.id;
+          if (agentName !== null && grantResult.grant.agent_slug !== agentName) {
+            this.auditLogger.write({
+              ts: new Date().toISOString(),
+              op: "get",
+              key: req.key,
+              caller: auditCaller,
+              pid: auditPid,
+              cgroup: auditCgroup,
+              result: "denied:grant-identity-mismatch",
+              method: "grant",
+              grant_id: grantId
+            });
+            socket.write(encodeResponse(errorResponse("DENIED", "grant-identity-mismatch")));
+            return;
+          }
           const entry2 = this.secrets[req.key];
           if (entry2 === undefined) {
             this.auditLogger.write({
@@ -22910,7 +22987,23 @@ class VaultBroker {
             socket.write(encodeResponse(errorResponse("UNKNOWN_KEY", `Key not found: ${req.key}`)));
             return;
           }
-          this.auditLogger.write({
+          const tokenScope = checkEntryScope(entry2.scope, grantResult.grant.agent_slug);
+          if (!tokenScope.allow) {
+            this.auditLogger.write({
+              ts: new Date().toISOString(),
+              op: "get",
+              key: req.key,
+              caller: auditCaller,
+              pid: auditPid,
+              cgroup: auditCgroup,
+              result: `denied:${tokenScope.reason}`,
+              method: "grant",
+              grant_id: grantId
+            });
+            socket.write(encodeResponse(errorResponse("DENIED", tokenScope.reason)));
+            return;
+          }
+          if (!this.auditedReleaseOk(socket, writeAudit, {
             ts: new Date().toISOString(),
             op: "get",
             key: req.key,
@@ -22920,7 +23013,9 @@ class VaultBroker {
             result: "allowed",
             method: "grant",
             grant_id: grantId
-          });
+          })) {
+            return;
+          }
           socket.write(encodeResponse(entryResponse(entry2)));
           return;
         } else if (grantResult.reason === "grant-revoked") {
@@ -22974,23 +23069,8 @@ class VaultBroker {
           socket.write(encodeResponse(errorResponse("DENIED", aclResult.reason)));
           return;
         }
-      } else if (peer !== null && this.config !== null) {
-        const aclResult = checkAcl(peer, this.config, req.key);
-        if (!aclResult.allow) {
-          writeAudit({
-            ts: new Date().toISOString(),
-            op: "get",
-            key: req.key,
-            caller: auditCaller,
-            pid: auditPid,
-            cgroup: auditCgroup,
-            result: `denied:${aclResult.reason}`
-          });
-          socket.write(encodeResponse(errorResponse("DENIED", aclResult.reason)));
-          return;
-        }
-      } else if (process.platform === "linux" && peer === null) {
-        const reason = "Unable to identify caller (peercred unavailable); denying on Linux";
+      } else if (process.platform === "linux" && agentName === null) {
+        const reason = "Unable to identify caller (no per-agent socket identity); denying on Linux";
         this.auditLogger.write({
           ts: new Date().toISOString(),
           op: "get",
@@ -23017,7 +23097,7 @@ class VaultBroker {
         socket.write(encodeResponse(errorResponse("UNKNOWN_KEY", `Key not found: ${req.key}`)));
         return;
       }
-      const getAgentSlug = agentName ?? (peer !== null ? agentSlugFromPeer(peer) : null);
+      const getAgentSlug = agentName;
       const scopeResult = checkEntryScope(entry.scope, getAgentSlug);
       if (!scopeResult.allow) {
         this.auditLogger.write({
@@ -23032,7 +23112,7 @@ class VaultBroker {
         socket.write(encodeResponse(errorResponse("DENIED", scopeResult.reason)));
         return;
       }
-      this.auditLogger.write({
+      if (!this.auditedReleaseOk(socket, writeAudit, {
         ts: new Date().toISOString(),
         op: "get",
         key: req.key,
@@ -23040,7 +23120,9 @@ class VaultBroker {
         pid: auditPid,
         cgroup: auditCgroup,
         result: "allowed"
-      });
+      })) {
+        return;
+      }
       socket.write(encodeResponse(entryResponse(entry)));
       return;
     }
@@ -23140,6 +23222,41 @@ class VaultBroker {
       if (req.token !== undefined && req.token !== "") {
         const v = await validateGrantForWrite(this.grantsDb, req.token, req.key);
         if (v.ok) {
+          const writeGrantAgentSlug = v.grant.agent_slug;
+          if (agentName !== null && writeGrantAgentSlug !== agentName) {
+            this.auditLogger.write({
+              ts: new Date().toISOString(),
+              op: "put",
+              key: req.key,
+              caller: auditCaller,
+              pid: auditPid,
+              cgroup: auditCgroup,
+              result: "denied:grant-identity-mismatch",
+              method: "grant",
+              grant_id: v.grant.id
+            });
+            socket.write(encodeResponse(errorResponse("DENIED", "grant-identity-mismatch")));
+            return;
+          }
+          const existingForScope = this.secrets[req.key];
+          if (existingForScope !== undefined) {
+            const writeScope = checkEntryScope(existingForScope.scope, writeGrantAgentSlug);
+            if (!writeScope.allow) {
+              this.auditLogger.write({
+                ts: new Date().toISOString(),
+                op: "put",
+                key: req.key,
+                caller: auditCaller,
+                pid: auditPid,
+                cgroup: auditCgroup,
+                result: `denied:${writeScope.reason}`,
+                method: "grant",
+                grant_id: v.grant.id
+              });
+              socket.write(encodeResponse(errorResponse("DENIED", writeScope.reason)));
+              return;
+            }
+          }
           writeGrantId = v.grant.id;
         } else if (v.reason === "grant-expired" || v.reason === "grant-revoked") {
           this.auditLogger.write({
@@ -23448,21 +23565,6 @@ class VaultBroker {
           socket.write(encodeResponse(errorResponse("DENIED", "peercred unavailable; cannot verify operator identity")));
           return;
         }
-        if (peer !== null && peer.systemdUnit !== null) {
-          const parsed = parseCronUnit(peer.systemdUnit);
-          if (parsed !== null) {
-            this.auditLogger.write({
-              ts: new Date().toISOString(),
-              op: req.op,
-              caller: auditCaller,
-              pid: auditPid,
-              cgroup: auditCgroup,
-              result: "denied:cron-cannot-manage-grants"
-            });
-            socket.write(encodeResponse(errorResponse("DENIED", "Grant management ops are operator-only; cron units cannot mint, list, or revoke grants")));
-            return;
-          }
-        }
       }
     }
     if (req.op === "mint_grant") {
@@ -23501,8 +23603,8 @@ class VaultBroker {
         mkdirSync6(tokenDir, { recursive: true });
         const tokenPath = path3.join(tokenDir, ".vault-token");
         const tmpPath = `${tokenPath}.tmp.${process.pid}`;
-        writeFileSync2(tmpPath, mintResult.token, { mode: 384 });
-        renameSync6(tmpPath, tokenPath);
+        writeFileSync3(tmpPath, mintResult.token, { mode: 384 });
+        renameSync7(tmpPath, tokenPath);
         try {
           const uid = allocateAgentUid(agent);
           chownSync(tokenPath, uid, uid);
@@ -23788,7 +23890,7 @@ class VaultBroker {
   _writePidFile() {
     try {
       const pidPath = resolvePath(PID_FILE_DEFAULT);
-      writeFileSync2(pidPath, String(process.pid) + `
+      writeFileSync3(pidPath, String(process.pid) + `
 `, { mode: 384 });
     } catch {}
   }
@@ -23844,7 +23946,7 @@ class VaultBroker {
     const credPath = `${dir}/vault-passphrase`;
     let passphrase;
     try {
-      passphrase = readFileSync9(credPath, "utf8").replace(/\n+$/, "");
+      passphrase = readFileSync10(credPath, "utf8").replace(/\n+$/, "");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {