switchroom 0.18.12 → 0.18.13

package/dist/vault/approvals/kernel-server.js

@@ -4778,6 +4778,13 @@ var init_schema = __esm(() => {
   });
 });
 
+// src/util/atomic.ts
+import { closeSync, constants, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+var TMP_OPEN_FLAGS;
+var init_atomic = __esm(() => {
+  TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
+});
+
 // src/config/merge.ts
 function dedupe(items) {
   const seen = new Set;
@@ -18249,6 +18256,13 @@ var ApprovalLookupRequestSchema = exports_external.object({
   action: exports_external.string().min(1),
   current_approver_set: exports_external.array(exports_external.string())
 });
+var ApprovalLookupByRequestRequestSchema = exports_external.object({
+  v: exports_external.literal(1),
+  op: exports_external.literal("approval_lookup_by_request"),
+  agent_unit: exports_external.string().min(1),
+  request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
+  current_approver_set: exports_external.array(exports_external.string())
+});
 var ApprovalConsumeRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("approval_consume"),
@@ -18303,6 +18317,7 @@ var RequestSchema = exports_external.discriminatedUnion("op", [
   RevokeGrantRequestSchema,
   ApprovalRequestRequestSchema,
   ApprovalLookupRequestSchema,
+  ApprovalLookupByRequestRequestSchema,
   ApprovalConsumeRequestSchema,
   ApprovalRevokeRequestSchema,
   ApprovalListRequestSchema,
@@ -18664,6 +18679,30 @@ function lookupDecision(db, query, opts = {}, now = Date.now()) {
        ORDER BY granted_at DESC LIMIT 1`).get(query.agent_unit, query.scope, query.action);
   if (!row)
     return { state: "no_decision" };
+  return evaluateDecisionRow(db, row, currentCanonical, opts, now);
+}
+function lookupDecisionByRequestId(db, query, opts = {}, now = Date.now()) {
+  const currentCanonical = canonicalizeApproverSet(query.current_approver_set);
+  const nonceRow = db.query(`SELECT * FROM approval_nonces WHERE request_id = ?`).get(query.request_id);
+  if (!nonceRow)
+    return { state: "no_decision" };
+  const nonce = nonceFromRow(nonceRow);
+  if (nonce.agent_unit !== query.agent_unit)
+    return { state: "no_decision" };
+  if (nonce.decision_id === null) {
+    if (nonce.expires_at < now)
+      return { state: "expired" };
+    return { state: "pending", request_id: nonce.request_id };
+  }
+  const decRow = db.query(`SELECT * FROM approval_decisions WHERE id = ?`).get(nonce.decision_id);
+  if (!decRow)
+    return { state: "expired" };
+  if (decRow.revoked_at != null) {
+    return { state: "denied", decision: rowToDecision(decRow) };
+  }
+  return evaluateDecisionRow(db, decRow, currentCanonical, opts, now);
+}
+function evaluateDecisionRow(db, row, currentCanonical, opts, now) {
   const decision = rowToDecision(row);
   if (decision.decision === "deny_perm") {
     return { state: "denied", decision };
@@ -18860,6 +18899,7 @@ init_schema();
 
 // src/agents/scaffold.ts
 import { join as join4, resolve as resolve5 } from "node:path";
+init_atomic();
 init_schema();
 
 // src/config/users.ts
@@ -19301,6 +19341,33 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
     socket.write(encodeResponse({ ok: true, state: r.state, decision }));
     return;
   }
+  if (req.op === "approval_lookup_by_request") {
+    const acl = checkApprovalAclByAgent(agent, req.agent_unit);
+    if (!acl.allow) {
+      socket.write(encodeResponse(errorResponse("DENIED", acl.reason)));
+      return;
+    }
+    const r = lookupDecisionByRequestId(db, {
+      agent_unit: req.agent_unit,
+      request_id: req.request_id,
+      current_approver_set: req.current_approver_set
+    });
+    const decision = r.state === "granted" || r.state === "denied" ? {
+      id: r.decision.id,
+      agent_unit: r.decision.agent_unit,
+      scope: r.decision.scope,
+      action: r.decision.action,
+      decision: r.decision.decision,
+      granted_at: r.decision.granted_at,
+      granted_by_user_id: r.decision.granted_by_user_id,
+      ttl_expires_at: r.decision.ttl_expires_at,
+      last_used_at: r.decision.last_used_at,
+      revoked_at: r.decision.revoked_at,
+      revoke_reason: r.decision.revoke_reason
+    } : null;
+    socket.write(encodeResponse({ ok: true, state: r.state, decision }));
+    return;
+  }
   if (req.op === "approval_consume") {
     const peek = getNonce(db, req.request_id);
     if (peek !== null) {

package/dist/vault/broker/server.js

@@ -4778,6 +4778,13 @@ var init_schema = __esm(() => {
   });
 });
 
+// src/util/atomic.ts
+import { closeSync, constants, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+var TMP_OPEN_FLAGS;
+var init_atomic = __esm(() => {
+  TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
+});
+
 // src/config/merge.ts
 function dedupe(items) {
   const seen = new Set;
@@ -18087,7 +18094,7 @@ var require_lib = __commonJS((exports, module) => {
 
 // src/vault/broker/server.ts
 import * as net from "node:net";
-import { mkdirSync as mkdirSync6, chmodSync as chmodSync4, chownSync, existsSync as existsSync11, readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync6, unlinkSync as unlinkSync6, writeFileSync as writeFileSync3, renameSync as renameSync6 } from "node:fs";
+import { mkdirSync as mkdirSync6, chmodSync as chmodSync4, chownSync, existsSync as existsSync11, readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync6, unlinkSync as unlinkSync6, writeFileSync as writeFileSync3, renameSync as renameSync7 } from "node:fs";
 
 // src/agents/compose.ts
 import { createHash } from "node:crypto";
@@ -18095,6 +18102,7 @@ init_schema();
 
 // src/agents/scaffold.ts
 import { join as join4, resolve as resolve6 } from "node:path";
+init_atomic();
 init_schema();
 
 // src/config/users.ts
@@ -18424,14 +18432,14 @@ init_loader();
 import { randomBytes, scryptSync, createCipheriv, createDecipheriv } from "node:crypto";
 import {
   readFileSync as readFileSync5,
-  writeSync as writeSync2,
+  writeSync as writeSync3,
   existsSync as existsSync6,
-  renameSync,
+  renameSync as renameSync2,
   mkdirSync as mkdirSync2,
   unlinkSync as unlinkSync2,
-  fsyncSync as fsyncSync2,
-  openSync as openSync2,
-  closeSync as closeSync2,
+  fsyncSync as fsyncSync3,
+  openSync as openSync3,
+  closeSync as closeSync3,
   lstatSync,
   realpathSync as realpathSync2
 } from "node:fs";
@@ -18440,10 +18448,10 @@ import { dirname, basename as basename2, resolve as resolve5 } from "node:path";
 // src/vault/flock.ts
 import {
   existsSync as existsSync5,
-  openSync,
-  closeSync,
-  writeSync,
-  fsyncSync,
+  openSync as openSync2,
+  closeSync as closeSync2,
+  writeSync as writeSync2,
+  fsyncSync as fsyncSync2,
   unlinkSync,
   readFileSync as readFileSync4,
   readdirSync as readdirSync3,
@@ -18568,7 +18576,7 @@ function acquireLock(vaultPath, options = {}) {
   while (true) {
     let fd = null;
     try {
-      fd = openSync(lockPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
+      fd = openSync2(lockPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
     } catch (err) {
       const code = err?.code ?? "";
       if (code === "EEXIST") {
@@ -18604,11 +18612,11 @@ function acquireLock(vaultPath, options = {}) {
 ${Date.now()}
 ${process.argv[1] ?? ""}
 `;
-      writeSync(fd, meta);
-      fsyncSync(fd);
+      writeSync2(fd, meta);
+      fsyncSync2(fd);
     } catch {
       try {
-        closeSync(fd);
+        closeSync2(fd);
       } catch {}
       try {
         unlinkSync(lockPath);
@@ -18619,7 +18627,7 @@ ${process.argv[1] ?? ""}
     return {
       release: () => {
         try {
-          closeSync(ownedFd);
+          closeSync2(ownedFd);
         } catch {}
         try {
           unlinkSync(lockPath);
@@ -18675,20 +18683,20 @@ function atomicWriteFileSync(path, data, mode) {
   const dir = dirname(resolve5(effectivePath));
   const tmp = resolve5(dir, `.${basename2(effectivePath)}.${process.pid}.${Date.now()}.tmp`);
   try {
-    const fd = openSync2(tmp, "wx", mode);
+    const fd = openSync3(tmp, "wx", mode);
     try {
-      writeSync2(fd, data);
-      fsyncSync2(fd);
+      writeSync3(fd, data);
+      fsyncSync3(fd);
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
-    renameSync(tmp, effectivePath);
+    renameSync2(tmp, effectivePath);
     try {
-      const dirFd = openSync2(dir, "r");
+      const dirFd = openSync3(dir, "r");
       try {
-        fsyncSync2(dirFd);
+        fsyncSync3(dirFd);
       } finally {
-        closeSync2(dirFd);
+        closeSync3(dirFd);
       }
     } catch {}
   } catch (err) {
@@ -19264,6 +19272,13 @@ var ApprovalLookupRequestSchema = exports_external.object({
   action: exports_external.string().min(1),
   current_approver_set: exports_external.array(exports_external.string())
 });
+var ApprovalLookupByRequestRequestSchema = exports_external.object({
+  v: exports_external.literal(1),
+  op: exports_external.literal("approval_lookup_by_request"),
+  agent_unit: exports_external.string().min(1),
+  request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
+  current_approver_set: exports_external.array(exports_external.string())
+});
 var ApprovalConsumeRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("approval_consume"),
@@ -19318,6 +19333,7 @@ var RequestSchema = exports_external.discriminatedUnion("op", [
   RevokeGrantRequestSchema,
   ApprovalRequestRequestSchema,
   ApprovalLookupRequestSchema,
+  ApprovalLookupByRequestRequestSchema,
   ApprovalConsumeRequestSchema,
   ApprovalRevokeRequestSchema,
   ApprovalListRequestSchema,
@@ -19570,13 +19586,13 @@ import {
   copyFileSync as copyFileSync2,
   chmodSync,
   existsSync as existsSync7,
-  fsyncSync as fsyncSync3,
+  fsyncSync as fsyncSync4,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync3,
-  openSync as openSync3,
-  closeSync as closeSync3,
+  openSync as openSync4,
+  closeSync as closeSync4,
   readFileSync as readFileSync7,
-  renameSync as renameSync2,
+  renameSync as renameSync3,
   statSync as statSync4,
   symlinkSync,
   unlinkSync as unlinkSync3
@@ -19642,7 +19658,7 @@ function runMigration(home2, opts) {
       copyFileSync2(oldPath, tempNew);
       chmodSync(tempNew, 384);
       fsyncFile(tempNew);
-      renameSync2(tempNew, newPath);
+      renameSync3(tempNew, newPath);
       fsyncDir(parent);
       atomicReplaceWithSymlink(oldPath, "vault/vault.enc");
       fsyncDir(switchroomRoot);
@@ -19676,22 +19692,22 @@ function atomicReplaceWithSymlink(target, linkTarget) {
     } catch {}
   }
   symlinkSync(linkTarget, tmp);
-  renameSync2(tmp, target);
+  renameSync3(tmp, target);
 }
 function fsyncFile(path) {
-  const fd = openSync3(path, "r+");
+  const fd = openSync4(path, "r+");
   try {
-    fsyncSync3(fd);
+    fsyncSync4(fd);
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
 function fsyncDir(path) {
-  const fd = openSync3(path, "r");
+  const fd = openSync4(path, "r");
   try {
-    fsyncSync3(fd);
+    fsyncSync4(fd);
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
 
@@ -19702,15 +19718,15 @@ init_loader();
 import { createHmac, randomBytes as randomBytes2, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "node:crypto";
 import {
   chmodSync as chmodSync2,
-  closeSync as closeSync4,
+  closeSync as closeSync5,
   existsSync as existsSync8,
-  fsyncSync as fsyncSync4,
+  fsyncSync as fsyncSync5,
   mkdirSync as mkdirSync4,
-  openSync as openSync4,
+  openSync as openSync5,
   readFileSync as readFileSync8,
-  renameSync as renameSync3,
+  renameSync as renameSync4,
   unlinkSync as unlinkSync4,
-  writeSync as writeSync3
+  writeSync as writeSync4
 } from "node:fs";
 var FORMAT_VERSION = 1;
 var SALT_LEN = 16;
@@ -19803,7 +19819,7 @@ import * as path from "node:path";
 
 // src/util/audit-hashchain.ts
 import { createHash as createHash4 } from "node:crypto";
-import { openSync as openSync5, readSync, fstatSync as fstatSync2, closeSync as closeSync5 } from "node:fs";
+import { openSync as openSync6, readSync, fstatSync as fstatSync2, closeSync as closeSync6 } from "node:fs";
 var CHAIN_GENESIS = "GENESIS";
 var SEP = "\x00";
 function rowHash(prev, seq, rowJsonNoChain) {
@@ -19824,7 +19840,7 @@ function chainRow(state, entry) {
 function readTail(path, tailBytes = 64 * 1024) {
   let fd;
   try {
-    fd = openSync5(path, "r");
+    fd = openSync6(path, "r");
   } catch {
     return null;
   }
@@ -19840,7 +19856,7 @@ function readTail(path, tailBytes = 64 * 1024) {
     return null;
   } finally {
     try {
-      closeSync5(fd);
+      closeSync6(fd);
     } catch {}
   }
 }
@@ -22196,6 +22212,9 @@ function lookupDecision(db, query, opts = {}, now = Date.now()) {
        ORDER BY granted_at DESC LIMIT 1`).get(query.agent_unit, query.scope, query.action);
   if (!row)
     return { state: "no_decision" };
+  return evaluateDecisionRow(db, row, currentCanonical, opts, now);
+}
+function evaluateDecisionRow(db, row, currentCanonical, opts, now) {
   const decision = rowToDecision(row);
   if (decision.decision === "deny_perm") {
     return { state: "denied", decision };
@@ -23203,6 +23222,41 @@ class VaultBroker {
       if (req.token !== undefined && req.token !== "") {
         const v = await validateGrantForWrite(this.grantsDb, req.token, req.key);
         if (v.ok) {
+          const writeGrantAgentSlug = v.grant.agent_slug;
+          if (agentName !== null && writeGrantAgentSlug !== agentName) {
+            this.auditLogger.write({
+              ts: new Date().toISOString(),
+              op: "put",
+              key: req.key,
+              caller: auditCaller,
+              pid: auditPid,
+              cgroup: auditCgroup,
+              result: "denied:grant-identity-mismatch",
+              method: "grant",
+              grant_id: v.grant.id
+            });
+            socket.write(encodeResponse(errorResponse("DENIED", "grant-identity-mismatch")));
+            return;
+          }
+          const existingForScope = this.secrets[req.key];
+          if (existingForScope !== undefined) {
+            const writeScope = checkEntryScope(existingForScope.scope, writeGrantAgentSlug);
+            if (!writeScope.allow) {
+              this.auditLogger.write({
+                ts: new Date().toISOString(),
+                op: "put",
+                key: req.key,
+                caller: auditCaller,
+                pid: auditPid,
+                cgroup: auditCgroup,
+                result: `denied:${writeScope.reason}`,
+                method: "grant",
+                grant_id: v.grant.id
+              });
+              socket.write(encodeResponse(errorResponse("DENIED", writeScope.reason)));
+              return;
+            }
+          }
           writeGrantId = v.grant.id;
         } else if (v.reason === "grant-expired" || v.reason === "grant-revoked") {
           this.auditLogger.write({
@@ -23550,7 +23604,7 @@ class VaultBroker {
         const tokenPath = path3.join(tokenDir, ".vault-token");
         const tmpPath = `${tokenPath}.tmp.${process.pid}`;
         writeFileSync3(tmpPath, mintResult.token, { mode: 384 });
-        renameSync6(tmpPath, tokenPath);
+        renameSync7(tmpPath, tokenPath);
         try {
           const uid = allocateAgentUid(agent);
           chownSync(tokenPath, uid, uid);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.18.12",
+  "version": "0.18.13",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/bridge/bridge.js

@@ -23035,6 +23035,33 @@ function getNestedObj(obj, key) {
 var DEFAULT_OPERATOR_EVENT_COOLDOWN_MS = 5 * 60000;
 var cooldownMap = new Map;
 
+// text-voice-scrub.ts
+var NULL = "\x00";
+var FENCE_PH = `${NULL}VS_FENCE`;
+var INLINE_PH = `${NULL}VS_INLINE`;
+var HTML_CODE_PH = `${NULL}VS_HTMLCODE`;
+var HTML_PRE_PH = `${NULL}VS_HTMLPRE`;
+var URL_PH = `${NULL}VS_URL`;
+
+// model-unavailable.ts
+var transientUpstreamSignals = [
+  "not your usage limit",
+  "not your account",
+  "not your account's",
+  "temporarily limiting requests",
+  "temporarily rate",
+  "server is temporarily",
+  "would exceed your account\u2019s rate limit",
+  "would exceed your account's rate limit"
+];
+function isTransientUpstreamSignal(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
+  const lower = sample.toLowerCase();
+  return transientUpstreamSignals.some((s) => lower.includes(s));
+}
+
 // tool-label-sidecar.ts
 import { existsSync as existsSync2, readFileSync, statSync as statSync2 } from "node:fs";
 import { join as join2 } from "node:path";
@@ -23453,7 +23480,8 @@ function detectErrorInTranscriptLine(line) {
     const status = typeof obj.apiErrorStatus === "number" ? obj.apiErrorStatus : null;
     const errStr = typeof obj.error === "string" ? obj.error : "";
     const text = extractAssistantText(obj);
-    const kind2 = status === 429 ? "quota-exhausted" : classifyClaudeError({ type: errStr, status, message: text });
+    const kind2 = status === 429 ? isTransientUpstreamSignal(`${text}
+${errStr}`) ? "rate-limited" : "quota-exhausted" : classifyClaudeError({ type: errStr, status, message: text });
     return {
       kind: kind2,
       raw: obj,
@@ -23547,6 +23575,7 @@ function startSessionTail(config2) {
   const onOperatorEvent = config2.onOperatorEvent;
   log?.(`session-tail: projectsDir=${projectsDir}`);
   const sidecars = new Map;
+  const createSidecar = config2.createSidecar ?? createToolLabelSidecar;
   const stateDirForSidecar = process.env.TELEGRAM_STATE_DIR ?? null;
   function sessionIdForFile(file) {
     if (!file)
@@ -23561,7 +23590,7 @@ function startSessionTail(config2) {
     if (existing)
       return existing;
     try {
-      const s = createToolLabelSidecar({ stateDir: stateDirForSidecar, sessionId });
+      const s = createSidecar({ stateDir: stateDirForSidecar, sessionId });
       sidecars.set(sessionId, s);
       s.onLabel((toolUseId, label, toolName) => {
         rawOnEvent({ kind: "tool_label", toolUseId, label, toolName });
@@ -23572,6 +23601,17 @@ function startSessionTail(config2) {
       return null;
     }
   }
+  function stopSidecar(sessionId) {
+    if (!sessionId)
+      return;
+    const s = sidecars.get(sessionId);
+    if (!s)
+      return;
+    try {
+      s.stop();
+    } catch {}
+    sidecars.delete(sessionId);
+  }
   function decorate(ev, sessionId) {
     if (!sessionId)
       return ev;
@@ -23664,6 +23704,11 @@ function startSessionTail(config2) {
       } catch {}
       watcher = null;
     }
+    const rotatedAwaySid = sessionIdForFile(currentFile);
+    const nextSid = sessionIdForFile(file);
+    if (rotatedAwaySid != null && rotatedAwaySid !== nextSid) {
+      stopSidecar(rotatedAwaySid);
+    }
     currentFile = file;
     const prior = fileCursors.get(file);
     if (prior != null) {
@@ -23696,7 +23741,7 @@ function startSessionTail(config2) {
   const multiAgent = isMultiAgentEnabled();
   const CAP_TOOL_USE_THRESHOLD = 30;
   const subTails = new Map;
-  const IDLE_FSWATCH_TTL_MS = 5 * 60 * 1000;
+  const IDLE_FSWATCH_TTL_MS = Math.max(1000, config2.subTailIdleReapMs ?? 5 * 60 * 1000);
   function readSub(t) {
     if (stopped)
       return;
@@ -23803,6 +23848,7 @@ function startSessionTail(config2) {
           } catch {}
           t.watcher = null;
         }
+        stopSidecar(sessionIdForFile(t.file));
         subTails.delete(file);
         log?.(`session-tail: reaped idle sub ${t.agentId} (${file})`);
       }