switchroom 0.18.3 → 0.18.6

package/dist/host-control/main.js

@@ -21959,7 +21959,8 @@ var CronConfigSchema = exports_external.object({
 var UserSchema = exports_external.object({
   name: exports_external.string().optional().describe("Display name for the user."),
   telegram_ids: exports_external.array(exports_external.string()).min(1).describe("Telegram username(s) and/or numeric user id(s) identifying this user " + "(a leading @ is optional). Matched against the message sender for " + "per-speaker memory routing."),
-  profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`).")
+  profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
+  person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system — just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership — never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later — see docs/configuration.md.")
 });
 var SwitchroomConfigSchema = exports_external.object({
   switchroom: exports_external.object({
@@ -28736,7 +28737,7 @@ import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:f
 import { dirname as dirname4, join as join6 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.18.3";
+var VERSION = "0.18.6";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {

package/dist/vault/approvals/kernel-server.js

@@ -4676,7 +4676,8 @@ var init_schema = __esm(() => {
   UserSchema = exports_external.object({
     name: exports_external.string().optional().describe("Display name for the user."),
     telegram_ids: exports_external.array(exports_external.string()).min(1).describe("Telegram username(s) and/or numeric user id(s) identifying this user " + "(a leading @ is optional). Matched against the message sender for " + "per-speaker memory routing."),
-    profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`).")
+    profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
+    person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system — just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership — never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later — see docs/configuration.md.")
   });
   SwitchroomConfigSchema = exports_external.object({
     switchroom: exports_external.object({

package/dist/vault/broker/server.js

@@ -4676,7 +4676,8 @@ var init_schema = __esm(() => {
   UserSchema = exports_external.object({
     name: exports_external.string().optional().describe("Display name for the user."),
     telegram_ids: exports_external.array(exports_external.string()).min(1).describe("Telegram username(s) and/or numeric user id(s) identifying this user " + "(a leading @ is optional). Matched against the message sender for " + "per-speaker memory routing."),
-    profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`).")
+    profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
+    person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system — just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership — never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later — see docs/configuration.md.")
   });
   SwitchroomConfigSchema = exports_external.object({
     switchroom: exports_external.object({
@@ -19569,7 +19570,7 @@ function allocateAgentUid(name) {
 var BIND_MOUNT_EXACT_SOURCE_DENY = new Set(["/var/run/docker.sock"]);
 
 // src/vault/broker/server.ts
-import { dirname as dirname4, resolve as resolve8, basename as basename4 } from "node:path";
+import { dirname as dirname5, resolve as resolve8, basename as basename4 } from "node:path";
 import * as os3 from "node:os";
 import * as path3 from "node:path";
 
@@ -19957,10 +19958,38 @@ function rotateAuditLog(logPath, maxFiles) {
       return;
     }
   }
+  const snapshotPath = `${logPath}.1`;
   try {
-    fs.renameSync(logPath, `${logPath}.1`);
+    fs.copyFileSync(logPath, snapshotPath);
   } catch (err) {
-    process.stderr.write(`[vault-audit] ERROR: could not rotate active audit log ${logPath}: ${err.message}
+    process.stderr.write(`[vault-audit] ERROR: could not snapshot active audit log ${logPath} → ${snapshotPath}: ${err.message}
+`);
+    return;
+  }
+  try {
+    const fd = fs.openSync(snapshotPath, "r");
+    try {
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+  } catch (err) {
+    process.stderr.write(`[vault-audit] ERROR: could not fsync audit snapshot ${snapshotPath}; leaving active log intact to avoid data loss: ${err.message}
+`);
+    return;
+  }
+  try {
+    const dirFd = fs.openSync(path.dirname(snapshotPath), "r");
+    try {
+      fs.fsyncSync(dirFd);
+    } finally {
+      fs.closeSync(dirFd);
+    }
+  } catch {}
+  try {
+    fs.truncateSync(logPath, 0);
+  } catch (err) {
+    process.stderr.write(`[vault-audit] ERROR: could not truncate active audit log ${logPath}: ${err.message}
 `);
   }
 }
@@ -22369,7 +22398,7 @@ class VaultBroker {
       this.passphrase = this.testOpts._testPassphrase;
     }
     process.umask(63);
-    const parentDir = dirname4(this.socketPath);
+    const parentDir = dirname5(this.socketPath);
     mkdirSync6(parentDir, { recursive: true, mode: 448 });
     try {
       chmodSync4(parentDir, 448);
@@ -23850,15 +23879,15 @@ class VaultBroker {
   }
 }
 function detectVaultLayoutDrift(vaultPath) {
-  const dir = dirname4(vaultPath);
+  const dir = dirname5(vaultPath);
   if (basename4(dir) !== "vault")
     return;
   if (basename4(vaultPath) !== "vault.enc")
     return;
-  const switchroomDir = dirname4(dir);
+  const switchroomDir = dirname5(dir);
   if (basename4(switchroomDir) !== ".switchroom")
     return;
-  const home2 = dirname4(switchroomDir);
+  const home2 = dirname5(switchroomDir);
   const result = inspectVaultLayout(home2);
   if (result.kind === "divergent") {
     throw new VaultError(`Vault layout divergence detected at boot: ${result.details.oldPath} and ${result.details.newPath} are both regular files with different content. An older switchroom CLI may have written to the legacy path after migration ran. Run \`switchroom apply\` from the host to surface the recovery recipe (state E refusal with literal \`mv\` commands). See docs/operators/state-e-recovery.md.`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.18.3",
+  "version": "0.18.6",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/skills/switchroom-release/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: switchroom-release
+description: "Cut and ship a switchroom release end-to-end: CHANGELOG consolidation, tag, npm publish, image build, and the fleet rollout gate. Use when the user says 'cut a release', 'ship a release', 'release vX', 'publish a new version', 'roll out the latest', or otherwise wants the merged work on main to go live for the fleet. This is the ONLY skill that authorizes a fleet rollout, and it enforces the npm-publish + image-build gates that were historically skipped (v0.18.4/v0.18.5 shipped to the fleet but never hit npm). Do NOT use for adding agents (switchroom-manage), diagnostics (switchroom-health), or a plain `switchroom update` on one agent (switchroom-cli)."
+allowed-tools: Bash(git *) Bash(gh *) Bash(npm view *) Bash(npm pack *) Bash(docker manifest inspect *) Bash(docker buildx imagetools inspect *)
+---
+
+# Switchroom release
+
+Cut a release of `switchroom/switchroom` and get it live on the fleet. This is a **gated, ordered checklist** — do not skip steps, do not reorder. The whole point of this skill is that two steps that used to be skipped silently (npm publish, image-build verification) are now **hard gates before rollout**.
+
+## What a release actually is
+
+- A release = a `vX.Y.Z` **git tag** on `main` (the merge commit of the CHANGELOG PR).
+- The tag is the version source of truth (`scripts/build.mjs:resolveVersion()`). `package.json` `version` is a **stale placeholder by design** — never bump it in a commit (the `//version` comment + #2733 discipline). The uncommitted pack-time bump happens in CI now, not by hand.
+- Cutting the tag fires TWO workflows in parallel on tag push: `docker-images` (builds + pushes the 6 ghcr images) and `npm-publish` (builds, packs, verifies, publishes to npm). **Rollout is gated on BOTH going green.**
+
+## Before you start — pre-flight (verify, don't assume)
+
+1. `git fetch origin`, confirm `main` is at the commit you want released.
+2. `gh pr list --state open` — confirm no PR meant for this release is still open. Ask the operator if unsure.
+3. Confirm CI on `main` is green (`gh run list --branch main --limit 3`).
+4. Read `CHANGELOG.md` — the `## Unreleased` section is the staging area for this release's notes. If it's empty, there's nothing to release.
+5. Pick the next version: read the latest tag (`git tag --list 'v*' --sort=-v:refname | head -1`) and bump the patch (or minor if the operator asks). Confirm with the operator which.
+
+## Step 1 — Consolidate the changelog (the release commit is CHANGELOG-only)
+
+- Move the `## Unreleased` entries under a new `## vX.Y.Z — <one-line summary>` heading.
+- The release commit touches **CHANGELOG.md only**. Do NOT bump `package.json` (placeholder discipline).
+- Branch protection blocks direct push to `main`, so: create a `release/vX.Y.Z` branch, push it, open a `chore: release vX.Y.Z` PR (base `main`), arm auto-merge (squash, delete-branch) on green CI.
+
+## Step 2 — Cut the tag (on the merge commit, not the PR branch)
+
+Once the changelog PR is merged:
+- `git fetch origin && git checkout main && git pull --ff-only`
+- Tag the merge commit and create the GitHub Release:
+  - `gh release create vX.Y.Z -R switchroom/switchroom --target main --title 'vX.Y.Z — <summary>' --notes-file <notes-file>`
+- **Notes extraction gotcha (historical):** the naive `awk '/^## vX/,/^## v/' CHANGELOG` range collapses to a single line. Use a start-flag awk: `awk 'f{print} /^## vX\.Y\.Z/{print; f=1} f && /^## v/ && !/^## vX\.Y\.Z/{exit}'` — or extract the section to a temp file by line range.
+- **`gh release create` has been silently dropped in past runs.** After running it, verify: `gh release view vX.Y.Z` must return the release. If it didn't create, re-run.
+
+## Step 3 — Wait for BOTH tag-push workflows (hard gates)
+
+The tag push triggers `docker-images` AND `npm-publish` in parallel. **Do not proceed to rollout until both are green AND verified.**
+
+### Gate A — npm publish (`npm-publish.yml`)
+- `gh run list --workflow=npm-publish.yml --limit 1` — wait for it to reach `completed` / `success`.
+- Verify the publish is live: `npm view switchroom version` must return `X.Y.Z` (not the old version). Retry a few times — npm registry propagation can lag a few seconds.
+- If this workflow fails: **the release is not published.** Do NOT roll. Diagnose (NPM_TOKEN unset? npm 5xx? empty dist?). Re-run via `gh workflow run npm-publish.yml --ref vX.Y.Z` after fixing.
+
+### Gate B — docker images (`docker-images.yml`)
+- `gh run list --workflow=docker-images.yml --limit 1` — wait for `completed` / `success`.
+- Verify all 6 images are published: `docker manifest inspect ghcr.io/switchroom/<image>:vX.Y.Z` for `agent`, `auth-broker`, `kernel`, `broker`, `web`, `hostd`. Each must resolve.
+- If any image is missing: do NOT roll — the rollout canary version-assert fails on an unpublished tag. Wait + re-check.
+
+**Only when Gate A AND Gate B are green + verified** do you proceed.
+
+## Step 4 — Fleet rollout (operator-gated, canary-first)
+
+- Fire the rollout via the hostd rollout path (`mcp__hostd__rollout`), which pops an **approval card**. Do NOT roll without the operator tapping approve.
+- Canary discipline: roll the release-critical canary agent first (the test-harness agent, per CLAUDE.md > Release canary discipline), monitor its logs + a smoke check, then stagger the rest per-agent with a `--version` assertion each (guards the `:latest` pull-race).
+- For a release that changes agent runtime behavior (a CLI pin bump, a behavioral template change), offer the operator a canary-first path (one agent → monitor → sweep) vs all-at-once; let them choose.
+
+## What you must NOT do
+
+- **Never bump `package.json` `version` in a commit.** It's a stale placeholder; the tag is the source of truth and `npm-publish.yml` does the uncommitted pack-time bump.
+- **Never run `npm publish` by hand from the agent container.** You can't reach the operator's npm auth, and the workflow is the reliable path. If the workflow is broken, fix the workflow — don't side-step it.
+- **Never roll the fleet before Gate A (npm) AND Gate B (images) are both green + verified.** A release that's on the fleet but not on npm is the exact regression this skill exists to prevent.
+- **Never push directly to `main`.** The CHANGELOG PR goes through auto-merge on green.
+- **Never force-push `main` or bypass hooks (`--no-verify`).**
+
+## If something goes wrong
+
+- **npm-publish failed but the tag is already pushed:** fix + `gh workflow run npm-publish.yml --ref vX.Y.Z`. Do NOT roll until it's green + `npm view` confirms.
+- **Images failed but npm succeeded:** the npm package is live but the fleet can't roll yet. Fix the image workflow / re-run. (npm being ahead of images is fine — the CLI is published for npm consumers; the fleet waits on images.)
+- **Rollout started before publish verified (the old bug):** abort the rollout, publish, then re-roll. Do not let a half-published release sit on the fleet.
+
+## Operator one-time setup (tell them once, not every release)
+
+The `npm-publish.yml` workflow needs an `NPM_TOKEN` repo secret (automation-scoped npm access token with publish rights on `switchroom`). Set it once in repo settings → Secrets and variables → Actions → `NPM_TOKEN`. Without it, Gate A fails loudly on the first release — that's the design (loud > silent).

package/telegram-plugin/auth-snapshot-format.ts

@@ -273,6 +273,16 @@ export interface SnapshotRenderOpts {
    * Takes precedence over `liveProbedAtMs`.
    */
   staleCachedAtMs?: number;
+  /**
+   * True when the live probe returned no usable data for ANY account (probe
+   * threw / timed out / returned zero rows) AND nothing was served from
+   * cache either. The footer renders `⚠ probe failed — no live data`
+   * instead of a false bare `_Live_`. Subscription-honesty: a "Live" footer
+   * next to "no data" rows is the exact lie this closes. `staleCachedAtMs`
+   * (cache-served data) takes precedence over this; this takes precedence
+   * over the bare-`Live` fallback.
+   */
+  probeFailed?: boolean;
   /**
    * Demo mode (the `/usage demo` / `/auth demo` suffix). When true, every
    * account label is run through `maskEmail` before rendering so a screen
@@ -521,11 +531,15 @@ export function renderAuthSnapshotFormat2(
   lines.push(`_${recommendation(snapshots, now, opts.demo ?? false)}_`);
   // #2495 Change 2 — a failed probe-on-open renders an explicit "cached Nm
   // ago" warning, never a false live stamp. The degraded variant takes
-  // precedence over the live stamp.
+  // precedence over the live stamp. A TOTAL probe failure (no rows, no
+  // cache) renders an explicit "probe failed" marker — without it the
+  // bare-else rendered `_Live_` next to no-data rows (the honesty gap).
   if (opts.staleCachedAtMs != null) {
     lines.push(`_⚠ cached ${formatAgeStamp(opts.staleCachedAtMs, now)}_`);
   } else if (opts.liveProbedAtMs != null) {
     lines.push(`_Live · refreshed ${formatAgeStamp(opts.liveProbedAtMs, now)}_`);
+  } else if (opts.probeFailed) {
+    lines.push('_⚠ probe failed — no live data_');
   } else {
     lines.push('_Live_');
   }