switchroom 0.18.6 → 0.18.7

package/dist/cli/switchroom.js

@@ -13741,6 +13741,7 @@ var init_schema = __esm(() => {
     max_turns_in_briefing: exports_external.number().int().positive().optional().describe("Cap on recent user/assistant turn pairs fed to the summarizer."),
     resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
     resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale."),
+    boot_resume: exports_external.enum(["always", "in-flight", "never"]).optional().describe("How the gateway auto-resumes a turn that was IN FLIGHT when the " + "agent restarted. 'in-flight' (default) resumes genuinely " + "interrupted work even after a deliberate/operator restart \u2014 a " + "sanctioned restart landing mid-turn no longer silently drops the " + "work. 'always' forces resume unconditionally (same as the " + "SWITCHROOM_BOOT_RESUME_ALWAYS=1 escape hatch). 'never' is the " + "quota-saving posture: don't auto-replay work across a clean " + "restart \u2014 but the user is STILL sent a passive notice of what was " + "in flight (silence is never used). Independent of the at-most-once " + "resume ledger and the bounded resume-chain loop-guard, which always " + "apply. Threaded to the gateway as SWITCHROOM_BOOT_RESUME."),
     session_retention_max_count: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): keep at most this many " + "newest session transcripts under .claude/projects; older ones " + "past both this count and the age bound are pruned by the Stop " + "hook. The newest sessions (and the handoff source) are always " + "kept. Default 20; set 0 to disable the count bound."),
     session_retention_max_age_days: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): prune session transcripts " + "older than this many days (a file is deleted only when it is BOTH " + "over the count bound and older than this). Default 30; set 0 to " + "disable the age bound.")
   }).optional();
@@ -26944,6 +26945,7 @@ ${baseAppend}` : TELEGRAM_FORMATTING_FLOOR_CARD;
     handoffEnabled: agentConfig.session_continuity?.enabled !== false,
     resumeMode: agentConfig.session_continuity?.resume_mode ?? "handoff",
     resumeMaxBytes: agentConfig.session_continuity?.resume_max_bytes ?? 2000000,
+    bootResumeMode: agentConfig.session_continuity?.boot_resume ?? "in-flight",
     resumeModeHasContinuePath: (() => {
       const mode = agentConfig.session_continuity?.resume_mode ?? "handoff";
       return mode === "auto" || mode === "continue";
@@ -28046,7 +28048,8 @@ ${baseAppend}` : TELEGRAM_FORMATTING_FLOOR_CARD;
       sessionMaxTurns: agentConfig.session?.max_turns,
       handoffEnabled: agentConfig.session_continuity?.enabled !== false,
       resumeMode: agentConfig.session_continuity?.resume_mode ?? "handoff",
-      resumeMaxBytes: agentConfig.session_continuity?.resume_max_bytes ?? 2000000
+      resumeMaxBytes: agentConfig.session_continuity?.resume_max_bytes ?? 2000000,
+      bootResumeMode: agentConfig.session_continuity?.boot_resume ?? "in-flight"
     };
     const beforeStartSh = existsSync15(startShPath) ? readFileSync13(startShPath, "utf-8") : "";
     const afterStartSh = renderTemplate(join10(basePath, "start.sh.hbs"), startShContext);
@@ -30047,7 +30050,25 @@ import { chownSync as chownSync2 } from "node:fs";
 import { mkdir, readFile, writeFile, rename, copyFile } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
 import { basename as basename4, dirname as dirname6, join as join13 } from "node:path";
-async function resolveLiteLLMConfirmedAgents(config) {
+function agentHadLiteLLMRouting(composeContent, agentName) {
+  const lines = composeContent.split(`
+`);
+  const header = `  agent-${agentName}:`;
+  let i = lines.indexOf(header);
+  if (i < 0)
+    return false;
+  for (i = i + 1;i < lines.length; i++) {
+    const line = lines[i];
+    if (/^ {2}\S/.test(line))
+      break;
+    if (/^\S/.test(line))
+      break;
+    if (/^\s+SWITCHROOM_LITELLM:\s*"1"\s*$/.test(line))
+      return true;
+  }
+  return false;
+}
+async function resolveLiteLLMConfirmedAgents(config, previousCompose, deps) {
   const confirmed = new Set;
   const topEnabled = config.litellm?.enabled ?? false;
   const optedIn = [];
@@ -30062,16 +30083,52 @@ async function resolveLiteLLMConfirmedAgents(config) {
   }
   if (optedIn.length === 0)
     return confirmed;
-  try {
-    const { getViaBrokerStructured: getViaBrokerStructured2 } = await Promise.resolve().then(() => (init_client(), exports_client));
-    for (const name of optedIn) {
-      try {
-        const r = await getViaBrokerStructured2(`litellm/${name}/api-key`);
-        if (r.kind === "ok")
-          confirmed.add(name);
-      } catch {}
+  let getKey = deps?.getKey ?? null;
+  if (!getKey) {
+    try {
+      ({ getViaBrokerStructured: getKey } = await Promise.resolve().then(() => (init_client(), exports_client)));
+    } catch {
+      getKey = null;
     }
-  } catch {}
+  }
+  const unreachableAgents = [];
+  for (const name of optedIn) {
+    if (!getKey) {
+      unreachableAgents.push(name);
+      continue;
+    }
+    try {
+      const r = await getKey(`litellm/${name}/api-key`);
+      if (r.kind === "ok") {
+        confirmed.add(name);
+      } else if (r.kind === "unreachable") {
+        unreachableAgents.push(name);
+      } else if (r.kind === "denied" && r.code !== "DENIED") {
+        unreachableAgents.push(name);
+      }
+    } catch {
+      unreachableAgents.push(name);
+    }
+  }
+  if (unreachableAgents.length > 0) {
+    const preserved = [];
+    const couldNotPreserve = [];
+    for (const name of unreachableAgents) {
+      if (previousCompose && agentHadLiteLLMRouting(previousCompose, name)) {
+        confirmed.add(name);
+        preserved.push(name);
+      } else {
+        couldNotPreserve.push(name);
+      }
+    }
+    console.warn(`switchroom: vault-broker unreachable or unable to answer (locked/internal) while resolving LiteLLM key status for ${unreachableAgents.length} opted-in agent(s): ${unreachableAgents.join(", ")}. Refusing to silently strip proxy routing (that would boot them on untracked direct OAuth). Re-run \`switchroom apply\` once the broker is back to reconcile.`);
+    if (preserved.length > 0) {
+      console.warn(`switchroom: PRESERVED existing proxy routing from the on-disk compose for: ${preserved.join(", ")}.`);
+    }
+    if (couldNotPreserve.length > 0) {
+      console.warn(`switchroom: no prior routing verdict on disk for: ${couldNotPreserve.join(", ")} ` + `\u2014 leaving them unrouted (they were not previously routed).`);
+    }
+  }
   return confirmed;
 }
 function resolveHostSwitchroomConfigPath(rawPath) {
@@ -30109,7 +30166,13 @@ async function computeComposeContent(opts) {
   const imageTag = resolveImageTag(release);
   const operatorUid = resolveOperatorUid();
   const resolvedConfigPath = opts.switchroomConfigPath !== undefined ? resolveHostSwitchroomConfigPath(opts.switchroomConfigPath) : undefined;
-  const litellmConfirmedAgents = await resolveLiteLLMConfirmedAgents(opts.config);
+  let previous = null;
+  try {
+    previous = await readFile(opts.composePath, "utf8");
+  } catch {
+    previous = null;
+  }
+  const litellmConfirmedAgents = await resolveLiteLLMConfirmedAgents(opts.config, previous);
   const content = generateCompose({
     config: opts.config,
     imageTag,
@@ -30121,12 +30184,6 @@ async function computeComposeContent(opts) {
     switchroomConfigPath: resolvedConfigPath,
     operatorUid
   });
-  let previous = null;
-  try {
-    previous = await readFile(opts.composePath, "utf8");
-  } catch {
-    previous = null;
-  }
   const previousImageTag = previous ? AGENT_IMAGE_TAG_RE.exec(previous)?.[1] ?? null : null;
   return { content, imageTag, previous, previousImageTag };
 }
@@ -48883,6 +48940,7 @@ var init_install_detect = () => {};
 // src/litellm/provision.ts
 var exports_provision = {};
 __export(exports_provision, {
+  validateKey: () => validateKey,
   ensureTeam: () => ensureTeam,
   ensureKey: () => ensureKey,
   LiteLLMProvisionError: () => LiteLLMProvisionError
@@ -48904,6 +48962,12 @@ function looksLikeAlreadyExists(status, body) {
     return true;
   return false;
 }
+function looksLikeUnknownKey(status, body) {
+  if (status !== 400 && status !== 401 && status !== 403 && status !== 404)
+    return false;
+  const t = body.toLowerCase();
+  return t.includes("not found") || t.includes("does not exist") || t.includes("no such key") || t.includes("no key found");
+}
 async function ensureTeam(baseUrl, masterKey, teamName, fetchFn = fetch) {
   const url = `${normalizeBase(baseUrl)}/team/new`;
   let resp;
@@ -48923,7 +48987,7 @@ async function ensureTeam(baseUrl, masterKey, teamName, fetchFn = fetch) {
     return;
   throw new LiteLLMProvisionError(`LiteLLM /team/new returned ${resp.status}`, resp.status, body);
 }
-async function ensureKey(opts, fetchFn = fetch) {
+async function generateKeyOnce(opts, fetchFn) {
   const url = `${normalizeBase(opts.baseUrl)}/key/generate`;
   const payload = {
     key_alias: opts.alias
@@ -48943,23 +49007,129 @@ async function ensureKey(opts, fetchFn = fetch) {
       body: JSON.stringify(payload)
     });
   } catch (err) {
-    throw new LiteLLMProvisionError(`LiteLLM /key/generate request failed: ${err.message}`);
+    return {
+      kind: "error",
+      error: new LiteLLMProvisionError(`LiteLLM /key/generate request failed: ${err.message}`)
+    };
   }
   if (!resp.ok) {
     const body = await safeText(resp);
-    throw new LiteLLMProvisionError(`LiteLLM /key/generate returned ${resp.status}`, resp.status, body);
+    if (looksLikeAlreadyExists(resp.status, body)) {
+      return { kind: "duplicate-alias", status: resp.status, body };
+    }
+    return {
+      kind: "error",
+      error: new LiteLLMProvisionError(`LiteLLM /key/generate returned ${resp.status}`, resp.status, body)
+    };
   }
   let json;
   try {
     json = await resp.json();
   } catch (err) {
-    throw new LiteLLMProvisionError(`LiteLLM /key/generate returned non-JSON body: ${err.message}`, resp.status);
+    return {
+      kind: "error",
+      error: new LiteLLMProvisionError(`LiteLLM /key/generate returned non-JSON body: ${err.message}`, resp.status)
+    };
   }
   const key = json?.key;
   if (typeof key !== "string" || key.length === 0) {
-    throw new LiteLLMProvisionError(`LiteLLM /key/generate response missing a "key" field`, resp.status, JSON.stringify(json));
+    return {
+      kind: "error",
+      error: new LiteLLMProvisionError(`LiteLLM /key/generate response missing a "key" field`, resp.status, JSON.stringify(json))
+    };
   }
-  return { key };
+  return { kind: "ok", key };
+}
+async function resolveTokensForAlias(baseUrl, masterKey, alias, fetchFn) {
+  const url = `${normalizeBase(baseUrl)}/key/list?key_alias=${encodeURIComponent(alias)}` + `&return_full_object=true&include_team_keys=true`;
+  let resp;
+  try {
+    resp = await fetchFn(url, { method: "GET", headers: authHeaders3(masterKey) });
+  } catch {
+    return [];
+  }
+  if (!resp.ok)
+    return [];
+  let json;
+  try {
+    json = await resp.json();
+  } catch {
+    return [];
+  }
+  const keys = json?.keys;
+  if (!Array.isArray(keys))
+    return [];
+  const tokens = [];
+  for (const k of keys) {
+    if (typeof k === "string" && k.length > 0)
+      tokens.push(k);
+    else if (k && typeof k === "object") {
+      const tok = k.token;
+      const raw = k.key;
+      if (typeof tok === "string" && tok.length > 0)
+        tokens.push(tok);
+      else if (typeof raw === "string" && raw.length > 0)
+        tokens.push(raw);
+    }
+  }
+  return tokens;
+}
+async function deleteOrphanedAlias(opts, fetchFn, log) {
+  const tokens = await resolveTokensForAlias(opts.baseUrl, opts.masterKey, opts.alias, fetchFn);
+  const body = { key_aliases: [opts.alias] };
+  if (tokens.length > 0)
+    body.keys = tokens;
+  const manual = `Manual remediation: delete the key with alias '${opts.alias}' in the LiteLLM ` + `admin UI, or run ` + `\`curl -X POST "${normalizeBase(opts.baseUrl)}/key/delete" -H "Authorization: Bearer <master-key>" ` + `-H "content-type: application/json" -d '{"key_aliases":["${opts.alias}"]}'\`, ` + `then re-run \`switchroom apply\`.`;
+  const url = `${normalizeBase(opts.baseUrl)}/key/delete`;
+  let resp;
+  try {
+    resp = await fetchFn(url, {
+      method: "POST",
+      headers: authHeaders3(opts.masterKey),
+      body: JSON.stringify(body)
+    });
+  } catch (err) {
+    throw new LiteLLMProvisionError(`LiteLLM /key/delete request failed while recovering orphaned alias ` + `'${opts.alias}': ${err.message}. ${manual}`);
+  }
+  if (!resp.ok) {
+    const errBody = await safeText(resp);
+    throw new LiteLLMProvisionError(`LiteLLM /key/delete returned ${resp.status} while recovering orphaned ` + `alias '${opts.alias}'. ${manual}`, resp.status, errBody);
+  }
+  log(`litellm: deleted orphaned key(s) for alias '${opts.alias}'` + (tokens.length > 0 ? ` (${tokens.length} token(s) resolved)` : "") + ` \u2014 regenerating`);
+}
+async function ensureKey(opts, fetchFn = fetch) {
+  const log = opts.log ?? (() => {});
+  const first = await generateKeyOnce(opts, fetchFn);
+  if (first.kind === "ok")
+    return { key: first.key };
+  if (first.kind === "error")
+    throw first.error;
+  log(`litellm: key_alias '${opts.alias}' already exists in LiteLLM but the vault ` + `has no recoverable key (orphaned by a prior failed provision) \u2014 ` + `self-healing: deleting the orphan and regenerating`);
+  await deleteOrphanedAlias(opts, fetchFn, log);
+  const second = await generateKeyOnce(opts, fetchFn);
+  if (second.kind === "ok") {
+    log(`litellm: regenerated key for alias '${opts.alias}' after orphan recovery`);
+    return { key: second.key };
+  }
+  if (second.kind === "duplicate-alias") {
+    throw new LiteLLMProvisionError(`LiteLLM /key/generate still reports alias '${opts.alias}' already exists ` + `after deleting the orphan \u2014 the delete did not take effect. Manual ` + `remediation: remove the key with alias '${opts.alias}' via the LiteLLM ` + `admin UI (or POST /key/delete {"key_aliases":["${opts.alias}"]}) then ` + `re-run \`switchroom apply\`.`, second.status, second.body);
+  }
+  throw second.error;
+}
+async function validateKey(opts, fetchFn = fetch) {
+  const url = `${normalizeBase(opts.baseUrl)}/key/info?key=${encodeURIComponent(opts.key)}`;
+  let resp;
+  try {
+    resp = await fetchFn(url, { method: "GET", headers: authHeaders3(opts.masterKey) });
+  } catch (err) {
+    return { kind: "unreachable", detail: err.message };
+  }
+  if (resp.ok)
+    return { kind: "valid" };
+  const body = await safeText(resp);
+  if (looksLikeUnknownKey(resp.status, body))
+    return { kind: "unknown" };
+  return { kind: "unreachable", detail: `HTTP ${resp.status}: ${body.slice(0, 200)}` };
 }
 async function safeText(resp) {
   try {
@@ -49154,7 +49324,7 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
   const needsHindsight = config.litellm?.enabled === true && config.memory?.backend === "hindsight";
   if (optedIn.length === 0 && !needsHindsight)
     return;
-  const [{ getViaBrokerStructured: getViaBrokerStructured2, putViaBroker: putViaBroker2 }, { ensureTeam: ensureTeam2, ensureKey: ensureKey2 }, { addAgentSecret: addAgentSecret2 }] = await Promise.all([
+  const [{ getViaBrokerStructured: getViaBrokerStructured2, putViaBroker: putViaBroker2 }, { ensureTeam: ensureTeam2, ensureKey: ensureKey2, validateKey: validateKey2 }, { addAgentSecret: addAgentSecret2 }] = await Promise.all([
     Promise.resolve().then(() => (init_client(), exports_client)),
     Promise.resolve().then(() => (init_provision(), exports_provision)),
     Promise.resolve().then(() => (init_telegram_yaml(), exports_telegram_yaml))
@@ -49176,7 +49346,21 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
         unprovisionedNew.push(name);
       }
     }
-    const hindsightPending = needsHindsight;
+    let hindsightPending = false;
+    if (needsHindsight) {
+      const h = await getViaBrokerStructured3("litellm/hindsight/api-key");
+      if (h.kind === "ok") {
+        hindsightPending = false;
+        writeOut(source_default.gray(`  ~ litellm/hindsight: key already provisioned (skipped) \u2014 unaffected by missing passphrase.
+`));
+      } else if (h.kind === "unreachable") {
+        hindsightPending = false;
+        ctx.writeErr(source_default.yellow(`  ! litellm/hindsight: vault-broker unreachable \u2014 could not verify the ` + `service key; it keeps its previous state.
+`));
+      } else {
+        hindsightPending = true;
+      }
+    }
     if (alreadyProvisioned.length > 0) {
       writeOut(source_default.gray(`  ~ litellm: ${alreadyProvisioned.length} agent(s) already provisioned (${alreadyProvisioned.join(", ")}) \u2014 unaffected by missing passphrase.
 `));
@@ -49227,43 +49411,62 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
         continue;
       }
       const vaultKey = `litellm/${name}/api-key`;
+      const alias = `agent:${name}`;
       const existing = await getViaBrokerStructured2(vaultKey);
-      if (existing.kind === "ok") {
-        writeOut(source_default.gray(`  ~ litellm/${name}: key already provisioned (skipped)
-`));
-        if (configText !== null) {
-          const after = addAgentSecret2(configText, name, vaultKey);
-          if (after !== configText) {
-            configText = after;
-            pendingConfigEdits = true;
-          }
-        }
-        continue;
-      }
       if (existing.kind === "unreachable") {
         ctx.writeErr(source_default.yellow(`  ! litellm/${name}: vault-broker unreachable (${existing.msg ?? "no detail"}) \u2014 ` + `skipping key provisioning; agent keeps its previous routing env.
 `));
         continue;
       }
       let masterKey = adminKeyRef;
+      let masterKeyErr = null;
       if (isVaultReference(adminKeyRef)) {
         const refKey = parseVaultReference(adminKeyRef);
         const resolved = await getViaBrokerStructured2(refKey);
         if (resolved.kind !== "ok") {
-          failures.push({
-            agent: name,
-            message: `litellm: admin_key vault ref '${adminKeyRef}' did not resolve (${resolved.kind}${"msg" in resolved && resolved.msg ? `: ${resolved.msg}` : ""}).`
-          });
-          continue;
+          masterKey = null;
+          masterKeyErr = `litellm: admin_key vault ref '${adminKeyRef}' did not resolve (${resolved.kind}${"msg" in resolved && resolved.msg ? `: ${resolved.msg}` : ""}).`;
+        } else if (resolved.entry.kind !== "string") {
+          masterKey = null;
+          masterKeyErr = `litellm: admin_key vault ref '${adminKeyRef}' is not a string secret.`;
+        } else {
+          masterKey = resolved.entry.value;
         }
-        if (resolved.entry.kind !== "string") {
-          failures.push({
-            agent: name,
-            message: `litellm: admin_key vault ref '${adminKeyRef}' is not a string secret.`
-          });
+      }
+      if (existing.kind === "ok") {
+        const storedKey = existing.entry.kind === "string" ? existing.entry.value : null;
+        let driftReprovision = false;
+        if (storedKey && masterKey) {
+          const validation = await validateKey2({ baseUrl, masterKey, key: storedKey });
+          if (validation.kind === "unknown") {
+            driftReprovision = true;
+            ctx.writeErr(source_default.yellow(`  ! litellm/${name}: stored virtual key not recognized by the proxy ` + `(DB drift) \u2014 re-provisioning a fresh key.
+`));
+          } else if (validation.kind === "unreachable") {
+            ctx.writeErr(source_default.yellow(`  ! litellm/${name}: proxy unreachable during key validation (${validation.detail}) \u2014 keeping the stored key unverified.
+`));
+          } else {
+            writeOut(source_default.gray(`  ~ litellm/${name}: key already provisioned + validated (skipped)
+`));
+          }
+        } else {
+          writeOut(source_default.gray(`  ~ litellm/${name}: key already provisioned (skipped)
+`));
+        }
+        if (!driftReprovision) {
+          if (configText !== null) {
+            const after = addAgentSecret2(configText, name, vaultKey);
+            if (after !== configText) {
+              configText = after;
+              pendingConfigEdits = true;
+            }
+          }
           continue;
         }
-        masterKey = resolved.entry.value;
+      }
+      if (!masterKey) {
+        failures.push({ agent: name, message: masterKeyErr ?? `litellm: admin_key unresolved` });
+        continue;
       }
       await ensureTeam2(baseUrl, masterKey, team);
       const metadata = {
@@ -49281,9 +49484,11 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
       const { key } = await ensureKey2({
         baseUrl,
         masterKey,
-        alias: `agent:${name}`,
+        alias,
         team,
-        metadata
+        metadata,
+        log: (m) => ctx.writeErr(source_default.gray(`  ~ litellm/${name}: ${m}
+`))
       });
       const put = await putViaBroker2(vaultKey, { kind: "string", value: key }, { passphrase });
       if (put.kind !== "ok") {
@@ -49345,7 +49550,9 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
             masterKey,
             alias: "service:hindsight",
             team,
-            metadata: { service: "hindsight", env: "fleet", ...oauthAccount ? { oauth_account: oauthAccount } : {} }
+            metadata: { service: "hindsight", env: "fleet", ...oauthAccount ? { oauth_account: oauthAccount } : {} },
+            log: (m) => ctx.writeErr(source_default.gray(`  ~ litellm/hindsight: ${m}
+`))
           });
           const put = await putViaBroker2(hindsightVaultKey, { kind: "string", value: key }, { passphrase });
           if (put.kind === "ok") {
@@ -64682,8 +64889,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.18.6";
-var COMMIT_SHA = "b62d558a";
+var VERSION = "0.18.7";
+var COMMIT_SHA = "21478348";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
@@ -79554,7 +79761,8 @@ var SUBAGENTS_SCHEMA_SQL = `
     status            TEXT    NOT NULL,
     result_summary    TEXT,
     jsonl_agent_id    TEXT,
-    parent_agent_id   TEXT
+    parent_agent_id   TEXT,
+    model             TEXT
   );
   CREATE INDEX IF NOT EXISTS subagents_turn      ON subagents(parent_turn_key);
   CREATE INDEX IF NOT EXISTS subagents_status    ON subagents(status);
@@ -79570,6 +79778,10 @@ function applySubagentsSchema(db) {
   if (!hasParentAgentId) {
     db.exec("ALTER TABLE subagents ADD COLUMN parent_agent_id TEXT");
   }
+  const hasModel = cols.some((c) => c.name === "model");
+  if (!hasModel) {
+    db.exec("ALTER TABLE subagents ADD COLUMN model TEXT");
+  }
   db.exec("CREATE INDEX IF NOT EXISTS subagents_jsonl_id ON subagents(jsonl_agent_id)");
 }
 function mapSubagentRow(row) {
@@ -79586,7 +79798,8 @@ function mapSubagentRow(row) {
     status: row.status,
     result_summary: row.result_summary,
     jsonl_agent_id: row.jsonl_agent_id,
-    parent_agent_id: row.parent_agent_id ?? null
+    parent_agent_id: row.parent_agent_id ?? null,
+    model: row.model ?? null
   };
 }
 function listSubagents(db, opts = {}) {

package/dist/host-control/main.js

@@ -21495,6 +21495,7 @@ var SessionContinuitySchema = exports_external.object({
   max_turns_in_briefing: exports_external.number().int().positive().optional().describe("Cap on recent user/assistant turn pairs fed to the summarizer."),
   resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
   resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale."),
+  boot_resume: exports_external.enum(["always", "in-flight", "never"]).optional().describe("How the gateway auto-resumes a turn that was IN FLIGHT when the " + "agent restarted. 'in-flight' (default) resumes genuinely " + "interrupted work even after a deliberate/operator restart — a " + "sanctioned restart landing mid-turn no longer silently drops the " + "work. 'always' forces resume unconditionally (same as the " + "SWITCHROOM_BOOT_RESUME_ALWAYS=1 escape hatch). 'never' is the " + "quota-saving posture: don't auto-replay work across a clean " + "restart — but the user is STILL sent a passive notice of what was " + "in flight (silence is never used). Independent of the at-most-once " + "resume ledger and the bounded resume-chain loop-guard, which always " + "apply. Threaded to the gateway as SWITCHROOM_BOOT_RESUME."),
   session_retention_max_count: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): keep at most this many " + "newest session transcripts under .claude/projects; older ones " + "past both this count and the age bound are pruned by the Stop " + "hook. The newest sessions (and the handoff source) are always " + "kept. Default 20; set 0 to disable the count bound."),
   session_retention_max_age_days: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): prune session transcripts " + "older than this many days (a file is deleted only when it is BOTH " + "over the count bound and older than this). Default 30; set 0 to " + "disable the age bound.")
 }).optional();
@@ -28737,7 +28738,7 @@ import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:f
 import { dirname as dirname4, join as join6 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.18.6";
+var VERSION = "0.18.7";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {

package/dist/vault/approvals/kernel-server.js

@@ -4212,6 +4212,7 @@ var init_schema = __esm(() => {
     max_turns_in_briefing: exports_external.number().int().positive().optional().describe("Cap on recent user/assistant turn pairs fed to the summarizer."),
     resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
     resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale."),
+    boot_resume: exports_external.enum(["always", "in-flight", "never"]).optional().describe("How the gateway auto-resumes a turn that was IN FLIGHT when the " + "agent restarted. 'in-flight' (default) resumes genuinely " + "interrupted work even after a deliberate/operator restart — a " + "sanctioned restart landing mid-turn no longer silently drops the " + "work. 'always' forces resume unconditionally (same as the " + "SWITCHROOM_BOOT_RESUME_ALWAYS=1 escape hatch). 'never' is the " + "quota-saving posture: don't auto-replay work across a clean " + "restart — but the user is STILL sent a passive notice of what was " + "in flight (silence is never used). Independent of the at-most-once " + "resume ledger and the bounded resume-chain loop-guard, which always " + "apply. Threaded to the gateway as SWITCHROOM_BOOT_RESUME."),
     session_retention_max_count: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): keep at most this many " + "newest session transcripts under .claude/projects; older ones " + "past both this count and the age bound are pruned by the Stop " + "hook. The newest sessions (and the handoff source) are always " + "kept. Default 20; set 0 to disable the count bound."),
     session_retention_max_age_days: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): prune session transcripts " + "older than this many days (a file is deleted only when it is BOTH " + "over the count bound and older than this). Default 30; set 0 to " + "disable the age bound.")
   }).optional();

package/dist/vault/broker/server.js

@@ -4212,6 +4212,7 @@ var init_schema = __esm(() => {
     max_turns_in_briefing: exports_external.number().int().positive().optional().describe("Cap on recent user/assistant turn pairs fed to the summarizer."),
     resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
     resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale."),
+    boot_resume: exports_external.enum(["always", "in-flight", "never"]).optional().describe("How the gateway auto-resumes a turn that was IN FLIGHT when the " + "agent restarted. 'in-flight' (default) resumes genuinely " + "interrupted work even after a deliberate/operator restart — a " + "sanctioned restart landing mid-turn no longer silently drops the " + "work. 'always' forces resume unconditionally (same as the " + "SWITCHROOM_BOOT_RESUME_ALWAYS=1 escape hatch). 'never' is the " + "quota-saving posture: don't auto-replay work across a clean " + "restart — but the user is STILL sent a passive notice of what was " + "in flight (silence is never used). Independent of the at-most-once " + "resume ledger and the bounded resume-chain loop-guard, which always " + "apply. Threaded to the gateway as SWITCHROOM_BOOT_RESUME."),
     session_retention_max_count: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): keep at most this many " + "newest session transcripts under .claude/projects; older ones " + "past both this count and the age bound are pruned by the Stop " + "hook. The newest sessions (and the handoff source) are always " + "kept. Default 20; set 0 to disable the count bound."),
     session_retention_max_age_days: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): prune session transcripts " + "older than this many days (a file is deleted only when it is BOTH " + "over the count bound and older than this). Default 30; set 0 to " + "disable the age bound.")
   }).optional();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.18.6",
+  "version": "0.18.7",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {
@@ -24,9 +24,9 @@
     "build": "node scripts/build.mjs",
     "build:cli": "node scripts/build.mjs && bun build --compile --target=bun-linux-x64 --minify bin/switchroom.ts --outfile switchroom-linux-amd64",
     "pretest": "npm run build",
-    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
+    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:vitest": "vitest run",
-    "test:bun": "bun test src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
+    "test:bun": "bun test src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:watch": "vitest",
     "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-web-subscription-honest.mjs",
     "lint:tsc": "tsc --noEmit",