switchroom 0.19.0 → 0.19.2

package/dist/host-control/main.js

@@ -7011,7 +7011,7 @@ var require_dist = __commonJS((exports) => {
 });
 
 // src/util/atomic.ts
-import { closeSync, constants, fsyncSync, openSync, renameSync as renameSync2, rmSync, writeSync } from "node:fs";
+import { closeSync, constants, fchmodSync, fchownSync, fsyncSync, openSync, renameSync as renameSync2, rmSync, writeSync } from "node:fs";
 var TMP_OPEN_FLAGS;
 var init_atomic = __esm(() => {
   TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
@@ -20732,7 +20732,7 @@ var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 
 // src/memory/hindsight.ts
-var DEFAULT_RETAIN_MISSION = "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise.";
+var DEFAULT_RETAIN_MISSION = "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise, " + "including in-flight workflow/process narration (a sub-task started, " + "paused, or is still running) — only retain the outcome once a task " + "actually completes or a decision is made.";
 var PROFILE_MEMORY_DEFAULTS = {
   "health-coach": {
     disposition: { skepticism: 2, literalism: 2, empathy: 5 },
@@ -26663,7 +26663,7 @@ import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:f
 import { dirname as dirname4, join as join7 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.19.0";
+var VERSION = "0.19.2";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {

package/dist/vault/approvals/kernel-server.js

@@ -4857,7 +4857,7 @@ var init_schema = __esm(() => {
 });
 
 // src/util/atomic.ts
-import { closeSync, constants, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+import { closeSync, constants, fchmodSync, fchownSync, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
 var TMP_OPEN_FLAGS;
 var init_atomic = __esm(() => {
   TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
@@ -19117,7 +19117,7 @@ var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 
 // src/memory/hindsight.ts
-var DEFAULT_RETAIN_MISSION = "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise.";
+var DEFAULT_RETAIN_MISSION = "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise, " + "including in-flight workflow/process narration (a sub-task started, " + "paused, or is still running) — only retain the outcome once a task " + "actually completes or a decision is made.";
 var PROFILE_MEMORY_DEFAULTS = {
   "health-coach": {
     disposition: { skepticism: 2, literalism: 2, empathy: 5 },

package/dist/vault/broker/server.js

@@ -4857,7 +4857,7 @@ var init_schema = __esm(() => {
 });
 
 // src/util/atomic.ts
-import { closeSync, constants, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+import { closeSync, constants, fchmodSync, fchownSync, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
 var TMP_OPEN_FLAGS;
 var init_atomic = __esm(() => {
   TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
@@ -18825,7 +18825,7 @@ var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 
 // src/memory/hindsight.ts
-var DEFAULT_RETAIN_MISSION = "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise.";
+var DEFAULT_RETAIN_MISSION = "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise, " + "including in-flight workflow/process narration (a sub-task started, " + "paused, or is still running) — only retain the outcome once a task " + "actually completes or a decision is made.";
 var PROFILE_MEMORY_DEFAULTS = {
   "health-coach": {
     disposition: { skepticism: 2, literalism: 2, empathy: 5 },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
     "test:vitest": "vitest run",
     "test:bun": "bun test telegram-plugin/tests/catch-all-forwarded-history.test.ts src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-scope-persist.test.ts src/vault/broker/server-tokenless-scope.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:watch": "vitest",
-    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-web-subscription-honest.mjs && node scripts/check-no-unpinned-npx-playwright.mjs && node scripts/check-gateway-line-ratchet.mjs",
+    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-web-subscription-honest.mjs && node scripts/check-no-unpinned-npx-playwright.mjs && node scripts/check-gateway-line-ratchet.mjs && node scripts/check-litellm-config-guard.mjs",
     "lint:tsc": "tsc --noEmit",
     "lint:plugin-references": "node scripts/check-plugin-references.mjs",
     "lint:bot-api-wrapping": "bash scripts/check-bot-api-wrapping.sh",
@@ -37,6 +37,7 @@
     "lint:web-subscription-honest": "node scripts/check-web-subscription-honest.mjs",
     "lint:no-broadcast-delivery": "node scripts/check-no-broadcast-delivery.mjs",
     "lint:gateway-line-ratchet": "node scripts/check-gateway-line-ratchet.mjs",
+    "lint:litellm-config-guard": "node scripts/check-litellm-config-guard.mjs",
     "prepublishOnly": "npm run build && npm run lint && npm test"
   },
   "dependencies": {

package/profiles/_base/start.sh.hbs

@@ -1211,6 +1211,7 @@ fi
 
 # --- Session model resolution (consume-once .session-model carrier) ---
 #
+# Doctor (checkStartShSessionModelCarrier) and tests pin this path against gateway SESSION_MODEL_FILE — regenerate via `switchroom apply` if fleet start.sh drifts.
 # Contract: reference/rfcs/session-model-stickiness.md §0.05 (rev 5, operator
 # decision 2026-07-16 — DETERMINISTIC SWITCH, superseding rev 4 §0.1's "live
 # Claude switches write no carrier"). A `/model` override lasts only for the

package/skills/switchroom-cli/SKILL.md

@@ -263,6 +263,31 @@ If the user asks whether scheduled runs were missed during downtime: the schedul
 
 ---
 
+## Hindsight model change — "swap the memory model", "move retain off the subscription"
+
+Changing which LLM runs Hindsight's retain / reflect / consolidation ops is a
+config-plus-recreate operation with three known traps. **Follow the runbook:
+`docs/operators/hindsight-model-change.md`.** The short version:
+
+1. Edit `hindsight.llm.{retain,reflect,consolidation}` in the operator's
+   `switchroom.yaml` — keep the outgoing block in a dated comment for rollback.
+2. Pick a full lane: non-Claude via LiteLLM needs `provider: litellm` +
+   `model` + `base_url` + `api_key`; subscription Claude needs
+   `provider: claude-code` + a Claude model name with NO base_url/api_key.
+   A per-op `model:` alone does **not** reroute (docs/model-routing.md G1/G5).
+3. Apply with `switchroom memory setup --recreate` **on the host** — a plain
+   `docker restart` does not re-derive env, and running the CLI inside an
+   agent container silently reads the stale `SWITCHROOM_CONFIG` snapshot.
+4. Verify with `docker inspect switchroom-hindsight`:
+   `HINDSIGHT_API_<OP>_LLM_MODEL` / `_PROVIDER` / `_BASE_URL` match the yaml,
+   and health reaches `healthy`.
+5. `docker restart switchroom-hostd` after the yaml edit, and **re-verify after
+   any fleet rollout** — the singletons bind-mount the yaml as a single file,
+   so an atomic (rename-based) edit leaves them pinned to the stale old inode
+   and a hostd-driven rollout can silently revert the model change.
+
+---
+
 ## Telegram plugin reference — "what MCP tools", "how does reply work"
 
 The `switchroom-telegram` plugin is an enhanced fork of the official Telegram MCP plugin and is the default for all switchroom agents. It exposes **9 MCP tools** (all prefixed `mcp__switchroom-telegram__`):

package/telegram-plugin/auth-snapshot-format.ts

@@ -1011,6 +1011,45 @@ export function zipProbeResults(
   return staleCachedAtMs != null ? { quotas, staleCachedAtMs } : { quotas };
 }
 
+/**
+ * The freshness-marker subset of the /usage card's render opts. Mirrors the
+ * three mutually-prioritised fields on `UsageCardRenderOpts`
+ * (quota-bar-format.ts) without importing across the module — cache-stale >
+ * live > probe-failed.
+ */
+export interface UsageFooterFreshness {
+  staleCachedAtMs?: number;
+  liveProbedAtMs?: number;
+  probeFailed?: boolean;
+}
+
+/**
+ * Decide the /usage card's freshness footer from a broker probe response.
+ *
+ * Adversarial-review F1: the caller must NEVER stamp "Live" when no account
+ * row carries usable live data. A non-empty `results` array is NOT proof of
+ * that — opProbeQuota (src/auth/broker/server.ts) returns
+ * `{result:{ok:false}, served:"live"}` for a failed live probe against an
+ * empty cache, so every row can be `ok:false` while `results.length > 0`.
+ * `zipProbeResults` only marks `served==="cache"` rows stale, so those failed
+ * rows carry no cache stamp either. The honest signal is whether ANY row's
+ * `result.ok` is true.
+ *
+ * Precedence (highest first): cache-served data (`staleCachedAtMs`, real but
+ * stale) → live data present (`liveProbedAtMs`) → nothing usable
+ * (`probeFailed`). Extracted so the decision is unit-testable and can't drift
+ * back to a length check.
+ */
+export function deriveUsageFooterFreshness(
+  results: readonly ProbeQuotaResultRow[],
+  staleCachedAtMs: number | undefined,
+  liveProbedAtMs: number,
+): UsageFooterFreshness {
+  if (staleCachedAtMs != null) return { staleCachedAtMs };
+  if (results.some((r) => r.result.ok)) return { liveProbedAtMs };
+  return { probeFailed: true };
+}
+
 /**
  * Given the broker's `listState` data + a parallel array of live quota
  * results (same length, same order), return the AccountSnapshot[] the