switchroom 0.18.28 → 0.18.30

package/dist/cli/ms-365-write-pretool.mjs

@@ -4011,7 +4011,8 @@ var init_protocol = __esm(() => {
     v: exports_external.literal(PROTOCOL_VERSION),
     op: exports_external.literal("get-credentials"),
     id: exports_external.string().min(1),
-    provider: ProviderNameSchema.optional()
+    provider: ProviderNameSchema.optional(),
+    account: exports_external.string().min(1).optional()
   });
   ListStateRequestSchema = exports_external.object({
     v: exports_external.literal(PROTOCOL_VERSION),
@@ -4326,13 +4327,17 @@ class AuthBrokerClient {
       sock.destroy();
     }
   }
-  async getCredentials(provider) {
+  async getCredentials(provider, account) {
     const base = {
       v: PROTOCOL_VERSION,
       id: randomUUID(),
       op: "get-credentials"
     };
-    const req = provider !== undefined ? { ...base, provider } : base;
+    let req = base;
+    if (provider !== undefined)
+      req = { ...req, provider };
+    if (account !== undefined)
+      req = { ...req, account };
     const data = await this.send(req);
     return data;
   }
@@ -4606,6 +4611,106 @@ var init_client = __esm(() => {
   };
 });
 
+// src/config/microsoft-workspace-acl.ts
+var exports_microsoft_workspace_acl = {};
+__export(exports_microsoft_workspace_acl, {
+  vaultRefKey: () => vaultRefKey,
+  shouldEmitMs365Mcp: () => shouldEmitMs365Mcp,
+  normalizeMicrosoftBindings: () => normalizeMicrosoftBindings,
+  ms365McpKeyForBinding: () => ms365McpKeyForBinding,
+  microsoftAccountSlug: () => microsoftAccountSlug,
+  isMultiAccount: () => isMultiAccount,
+  isMicrosoftClientCredentialKeyForAgent: () => isMicrosoftClientCredentialKeyForAgent,
+  bindingsForAgent: () => bindingsForAgent
+});
+function normalizeMicrosoftBindings(mw) {
+  if (!mw)
+    return [];
+  if (mw.accounts !== undefined) {
+    return mw.accounts.filter((b) => b && typeof b.account === "string" && b.account.length > 0).map((b) => ({
+      account: b.account.trim().toLowerCase(),
+      tools: b.tools,
+      org_mode: b.org_mode
+    }));
+  }
+  if (typeof mw.account === "string" && mw.account.length > 0) {
+    return [
+      {
+        account: mw.account.trim().toLowerCase(),
+        tools: mw.tools,
+        org_mode: mw.org_mode
+      }
+    ];
+  }
+  return [];
+}
+function isMultiAccount(mw) {
+  return normalizeMicrosoftBindings(mw).length > 1;
+}
+function microsoftAccountSlug(account) {
+  const email = account.trim().toLowerCase();
+  const local = email.split("@")[0] ?? email;
+  let base = local.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (base.length === 0)
+    base = "acct";
+  if (base.length > 24)
+    base = base.slice(0, 24).replace(/-+$/g, "");
+  let h = 2166136261;
+  for (let i = 0;i < email.length; i++) {
+    h ^= email.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  const hex = (h >>> 0).toString(16).padStart(8, "0").slice(0, 4);
+  return `${base}-${hex}`;
+}
+function ms365McpKeyForBinding(mw, account) {
+  if (isMultiAccount(mw))
+    return `ms-365-${microsoftAccountSlug(account)}`;
+  return "ms-365";
+}
+function shouldEmitMs365Mcp(agentName, agentMicrosoftAccount, microsoftAccounts) {
+  if (!agentMicrosoftAccount)
+    return false;
+  const account = agentMicrosoftAccount.trim().toLowerCase();
+  if (account.length === 0)
+    return false;
+  const acctEntry = microsoftAccounts?.[account];
+  if (!acctEntry)
+    return false;
+  const enabledFor = acctEntry.enabled_for ?? [];
+  return enabledFor.includes(agentName);
+}
+function bindingsForAgent(agentName, mw, microsoftAccounts) {
+  return normalizeMicrosoftBindings(mw).filter((b) => shouldEmitMs365Mcp(agentName, b.account, microsoftAccounts));
+}
+function vaultRefKey(value) {
+  if (typeof value !== "string" || !value.startsWith("vault:"))
+    return null;
+  const key = value.slice("vault:".length).split("#")[0];
+  return key.length > 0 ? key : null;
+}
+function isMicrosoftClientCredentialKeyForAgent(config, agentName, key) {
+  if (!agentName || !key)
+    return false;
+  const agentConfig = config.agents?.[agentName];
+  if (!agentConfig)
+    return false;
+  if (agentConfig.mcp_servers?.["ms-365"] === false) {
+    return false;
+  }
+  if (bindingsForAgent(agentName, agentConfig.microsoft_workspace, config.microsoft_accounts).length === 0) {
+    return false;
+  }
+  const mw = config.microsoft_workspace;
+  if (!mw)
+    return false;
+  for (const ref of [mw.microsoft_client_id, mw.microsoft_client_secret]) {
+    if (vaultRefKey(ref) === key)
+      return true;
+  }
+  return false;
+}
+
 // src/cli/ms-365-write-pretool.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 import { createConnection } from "node:net";
@@ -4621,7 +4726,7 @@ async function loadMicrosoftFromAuthBroker(options = {}) {
   let result;
   try {
     result = await withAuthBrokerClient2(async (client) => {
-      return await client.getCredentials("microsoft");
+      return await client.getCredentials("microsoft", options.account);
     }, options.socketPath !== undefined ? { socket: options.socketPath } : undefined);
   } catch (err) {
     if (err instanceof AuthBrokerUnreachableError2 || err instanceof AuthBrokerError2) {
@@ -4644,6 +4749,30 @@ async function loadMicrosoftFromAuthBroker(options = {}) {
     account_email: creds.microsoftOauth?.accountEmail
   };
 }
+async function resolveMicrosoftAccountBySlug(slug, options = {}) {
+  if (!slug)
+    return null;
+  const { microsoftAccountSlug: microsoftAccountSlug2 } = await Promise.resolve().then(() => exports_microsoft_workspace_acl);
+  let accounts;
+  try {
+    if (options.listAccounts) {
+      accounts = await options.listAccounts();
+    } else {
+      const { withAuthBrokerClient: withAuthBrokerClient2 } = await Promise.resolve().then(() => (init_client(), exports_client));
+      accounts = await withAuthBrokerClient2(async (client) => {
+        const data = await client.listMicrosoftAccounts();
+        return (data.accounts ?? []).map((a) => a.account).filter((a) => typeof a === "string");
+      }, options.socketPath !== undefined ? { socket: options.socketPath } : undefined);
+    }
+  } catch {
+    return null;
+  }
+  for (const account of accounts) {
+    if (microsoftAccountSlug2(account) === slug)
+      return account;
+  }
+  return null;
+}
 var GRAPH_BASE = "https://graph.microsoft.com/v1.0";
 var GRAPH_TIMEOUT_MS = 4000;
 function defaultFetch() {
@@ -4793,7 +4922,15 @@ var IPC_REPLY_TIMEOUT_MS = 1e4;
 var KERNEL_RPC_TIMEOUT_MS = 3000;
 var GATEWAY_SOCKET = process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR !== undefined ? join3(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join3(homedir3(), ".claude", "channels", "telegram", "gateway.sock"));
 var KERNEL_SOCKET = process.env.SWITCHROOM_KERNEL_SOCKET ?? "/run/switchroom/kernel/sock";
-var TOOL_PREFIX = "mcp__ms-365__";
+var MS365_TOOL_RE = /^mcp__ms-365(?:-([a-z0-9-]+))?__(.+)$/;
+function ms365BareToolName(toolName) {
+  const m = MS365_TOOL_RE.exec(toolName);
+  return m ? m[2] : null;
+}
+function ms365AccountSlugFromToolName(toolName) {
+  const m = MS365_TOOL_RE.exec(toolName);
+  return m && m[1] ? m[1] : null;
+}
 var GATED_MS365_WRITE_TOOLS = new Set([
   "create-calendar",
   "update-calendar",
@@ -4880,9 +5017,9 @@ var KNOWN_SAFE_MS365_READ_TOOLS = new Set([
   "list-accounts"
 ]);
 function isGatedMs365Tool(toolName) {
-  if (!toolName.startsWith(TOOL_PREFIX))
+  const bare = ms365BareToolName(toolName);
+  if (bare === null)
     return false;
-  const bare = toolName.slice(TOOL_PREFIX.length);
   if (bare.length === 0)
     return false;
   if (KNOWN_SAFE_MS365_READ_TOOLS.has(bare))
@@ -4920,9 +5057,9 @@ function parseHookInput() {
   }
 }
 function isCalendarEventTool(toolName) {
-  if (!toolName.startsWith(TOOL_PREFIX))
+  const bare = ms365BareToolName(toolName);
+  if (bare === null)
     return false;
-  const bare = toolName.slice(TOOL_PREFIX.length);
   return bare.includes("calendar-event");
 }
 function extractEventId(toolInput) {
@@ -5005,11 +5142,19 @@ function buildCalendarChanges(toolInput, current) {
 async function enrichCalendarPreview(toolName, toolInput, deps = {}) {
   if (!isCalendarEventTool(toolName))
     return {};
-  const loadHandle = deps.loadHandle ?? (() => loadMicrosoftFromAuthBroker());
+  const loadHandle = deps.loadHandle ?? ((account2) => loadMicrosoftFromAuthBroker(account2 !== undefined ? { account: account2 } : {}));
+  const resolveAccount = deps.resolveAccount ?? ((slug2) => resolveMicrosoftAccountBySlug(slug2));
   const fetchEvent = deps.fetchEvent ?? ((a) => fetchCalendarEventContext(a));
+  const slug = ms365AccountSlugFromToolName(toolName);
+  let account;
+  try {
+    account = await resolveAccount(slug) ?? undefined;
+  } catch {
+    account = undefined;
+  }
   let handle;
   try {
-    handle = await loadHandle();
+    handle = await loadHandle(account);
   } catch {
     return { resolveAttemptedButFailed: true };
   }
@@ -5281,6 +5426,8 @@ if (__require.main == __require.module) {
   });
 }
 export {
+  ms365BareToolName,
+  ms365AccountSlugFromToolName,
   loadAllowFrom,
   isGatedMs365Tool,
   isCalendarEventTool,

package/dist/cli/notion-write-pretool.mjs

@@ -12112,11 +12112,52 @@ var AgentGoogleWorkspaceConfigSchema = exports_external.object({
   approvers: exports_external.array(ApproverIdSchema).min(1).optional().describe("Per-agent approver override. When set, replaces (does not extend) " + "the top-level drive.approvers list for this agent's onboarding card."),
   tier: GoogleWorkspaceTierSchema.optional().describe("Per-agent tier override (RFC G Phase 1). When set, replaces the " + "top-level google_workspace.tier for this agent. Common case: most " + "agents on `core`, one specialist on `extended` for Slides access.")
 }).optional();
+var MicrosoftAccountEmailSchema = exports_external.string().regex(/^[^@\s:]+@[^@\s:]+\.[^@\s:]+$/, {
+  message: "microsoft_workspace.account must be a Microsoft account email like " + "'alice@outlook.com' or 'alice@contoso.com' (colons not allowed)"
+}).transform((v) => v.trim().toLowerCase());
+var MicrosoftToolTokenSchema = exports_external.string().min(1).regex(/^[a-z0-9-]+$/, {
+  message: "microsoft_workspace tools[] tokens are forwarded to softeria's " + "--enabled-tools regex; each must be lowercase kebab-case " + "([a-z0-9-]+, e.g. 'mail', 'calendar', 'send-mail') so an unescaped " + "regex metacharacter can't crash the launcher"
+});
+var MicrosoftAccountBindingSchema = exports_external.object({
+  account: MicrosoftAccountEmailSchema.describe("The Microsoft account this binding uses. Must be a key in top-level " + "`microsoft_accounts:` with this agent in its `enabled_for[]`."),
+  tools: exports_external.array(MicrosoftToolTokenSchema).min(1).optional().describe("Per-account tool allowlist \u2192 softeria `--enabled-tools <regex>` " + "(tokens joined with `|`). Omitted = all tools exposed for this account."),
+  org_mode: exports_external.boolean().optional().describe("Per-binding org_mode override (RFC #1873 \u00a76.4).")
+});
 var AgentMicrosoftWorkspaceConfigSchema = exports_external.object({
-  account: exports_external.string().regex(/^[^@\s:]+@[^@\s:]+\.[^@\s:]+$/, {
-    message: "microsoft_workspace.account must be a Microsoft account email like " + "'alice@outlook.com' or 'alice@contoso.com' (colons not allowed)"
-  }).transform((v) => v.trim().toLowerCase()).optional().describe("RFC #1873: the Microsoft account this agent uses for the M365 MCP. " + "Must be a key in top-level `microsoft_accounts:` with this agent " + "listed in its `enabled_for[]`. Read by the auth-broker " + "(get-credentials, provider=microsoft) and by the scaffold to " + "decide whether to emit the `ms-365` MCP entry. Normalized to " + "lowercase so it matches the microsoft_accounts key (which is " + "also normalized)."),
-  org_mode: exports_external.boolean().optional().describe("Per-agent org_mode override (RFC #1873 \u00a76.4). When set, replaces " + "the top-level microsoft_workspace.org_mode for this agent. " + "Defaults to top-level value (which defaults to false).")
+  account: MicrosoftAccountEmailSchema.optional().describe("RFC #1873: the Microsoft account this agent uses for the M365 MCP. " + "Must be a key in top-level `microsoft_accounts:` with this agent " + "listed in its `enabled_for[]`. Read by the auth-broker " + "(get-credentials, provider=microsoft) and by the scaffold to " + "decide whether to emit the `ms-365` MCP entry. Normalized to " + "lowercase so it matches the microsoft_accounts key (which is " + "also normalized). Mutually exclusive with `accounts` (plural)."),
+  tools: exports_external.array(MicrosoftToolTokenSchema).min(1).optional().describe("Per-account tool allowlist for the SINGULAR `account` form \u2192 " + "softeria `--enabled-tools <regex>`. Omitted = all tools. Only " + "valid with the singular `account`; using it together with the " + "plural `accounts` (which carries per-binding `tools`) is an error."),
+  org_mode: exports_external.boolean().optional().describe("Per-agent org_mode override (RFC #1873 \u00a76.4). When set, replaces " + "the top-level microsoft_workspace.org_mode for this agent. " + "Defaults to top-level value (which defaults to false)."),
+  accounts: exports_external.array(MicrosoftAccountBindingSchema).min(1).optional().describe("Plural multi-account form: bind MULTIPLE Microsoft accounts to " + "this agent, each with its own tool scope. Mutually exclusive with " + "the singular `account`. Each account gets its own `ms-365-<slug>` " + "MCP server.")
+}).superRefine((v, ctx) => {
+  const hasSingular = v.account !== undefined;
+  const hasPlural = v.accounts !== undefined;
+  if (hasSingular && hasPlural) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "microsoft_workspace: use EITHER `account` (singular) OR " + "`accounts` (plural array), not both",
+      path: ["accounts"]
+    });
+  }
+  if (hasPlural && v.tools !== undefined) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "microsoft_workspace: block-level `tools` applies to the singular " + "`account` only; with `accounts` put `tools` inside each binding",
+      path: ["tools"]
+    });
+  }
+  if (hasPlural) {
+    const seen = new Set;
+    for (const b of v.accounts) {
+      if (seen.has(b.account)) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `microsoft_workspace: duplicate account '${b.account}' in accounts[]`,
+          path: ["accounts"]
+        });
+      }
+      seen.add(b.account);
+    }
+  }
 }).optional();
 var AgentNotionWorkspaceConfigSchema = exports_external.object({
   databases: exports_external.array(exports_external.string().regex(/^[a-z0-9][a-z0-9_-]{0,62}$/, {
@@ -12491,6 +12532,26 @@ var SwitchroomConfigSchema = exports_external.object({
   for (const [name, a] of Object.entries(cfg.agents ?? {})) {
     checkServes(a.serves, ["agents", name, "serves"]);
   }
+  const microsoftAccounts = cfg.microsoft_accounts;
+  for (const [name, a] of Object.entries(cfg.agents ?? {})) {
+    const mw = a.microsoft_workspace;
+    const accounts = mw?.accounts;
+    if (!accounts)
+      continue;
+    accounts.forEach((b, i) => {
+      const acct = b?.account?.trim().toLowerCase();
+      if (!acct)
+        return;
+      const enabledFor = microsoftAccounts?.[acct]?.enabled_for ?? [];
+      if (!enabledFor.includes(name)) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `agent '${name}' binds Microsoft account '${acct}' but is not in ` + `microsoft_accounts['${acct}'].enabled_for[] \u2014 operator must run ` + `\`switchroom auth microsoft enable ${acct} ${name}\``,
+          path: ["agents", name, "microsoft_workspace", "accounts", i, "account"]
+        });
+      }
+    });
+  }
 });
 
 // src/config/paths.ts
@@ -13127,6 +13188,22 @@ function validateNotionWorkspaceConfig(config) {
   return issues;
 }
 
+// src/config/timezone.ts
+function isResolvableTimezone(zone) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: zone });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var CONTAINER_DEFAULT_UTC_ZONES = new Set([
+  "UTC",
+  "Etc/UTC",
+  "Etc/Universal",
+  "Universal"
+]);
+
 // src/config/loader.ts
 class ConfigError extends Error {
   details;
@@ -13250,8 +13327,30 @@ function loadConfig(configPath) {
   if (notionIssues.length > 0) {
     throw new ConfigError(`Invalid notion_workspace configuration in ${filePath}`, notionIssues);
   }
+  validateAllTimezones(config, filePath);
   return config;
 }
+function validateAllTimezones(config, filePath) {
+  const issues = [];
+  const check = (zone, where) => {
+    if (zone == null)
+      return;
+    if (!isResolvableTimezone(zone)) {
+      issues.push(`  ${where}: "${zone}" is not a resolvable IANA timezone ` + `(shape is valid but no such zone exists \u2014 check for a typo, ` + `e.g. "Australia/Melbourne", "America/New_York", "UTC").`);
+    }
+  };
+  check(config.switchroom?.timezone, "switchroom.timezone");
+  check(config.defaults?.timezone, "defaults.timezone");
+  for (const [profileName, profile] of Object.entries(config.profiles ?? {})) {
+    check(profile?.timezone, `profiles.${profileName}.timezone`);
+  }
+  for (const [agentName, agentRaw] of Object.entries(config.agents)) {
+    check(agentRaw?.timezone, `agents.${agentName}.timezone`);
+  }
+  if (issues.length > 0) {
+    throw new ConfigError(`Invalid timezone configuration in ${filePath}`, issues);
+  }
+}
 function validateAllCronTopicAliases(config, filePath) {
   const issues = [];
   for (const [agentName, agentRaw] of Object.entries(config.agents)) {