switchroom 0.19.17 → 0.19.19

package/dist/cli/drive-write-pretool.mjs

@@ -5300,6 +5300,34 @@ function truncateLine2(s) {
   return cleaned.length <= 60 ? cleaned : `${cleaned.slice(0, 59)}\u2026`;
 }
 
+// src/vault/approvals/gated-write-policy.ts
+var REQUIRE_OPERATOR_WRITE_ENV = "SWITCHROOM_REQUIRE_OPERATOR_APPROVAL_WRITE";
+function requireOperatorApprovalForWrites(env = process.env) {
+  return env[REQUIRE_OPERATOR_WRITE_ENV] === "1";
+}
+function isGatedWriteApproved(lookup, requireOperator) {
+  if (lookup.state !== "granted") {
+    return { allow: false, reason: `approval state is '${lookup.state ?? "unknown"}', not 'granted'` };
+  }
+  if (!requireOperator)
+    return { allow: true };
+  if (lookup.origin !== "operator") {
+    return {
+      allow: false,
+      reason: `approval was recorded with origin='${lookup.origin ?? "unknown"}', not 'operator' \u2014 ` + `an agent-origin decision is not proof an operator tapped ` + `(${REQUIRE_OPERATOR_WRITE_ENV}=1)`
+    };
+  }
+  return { allow: true };
+}
+function evaluateGatedWrite(lookup, requireOperator) {
+  const verdict = isGatedWriteApproved(lookup, requireOperator);
+  if (verdict.allow)
+    return { kind: "allow" };
+  if (lookup.state === "granted")
+    return { kind: "block", reason: verdict.reason };
+  return { kind: "wait" };
+}
+
 // src/cli/drive-write-pretool.ts
 var HOOK_TIMEOUT_MS = 5 * 60 * 1000;
 var KERNEL_POLL_INTERVAL_MS = 2000;
@@ -5383,9 +5411,15 @@ async function approvalLookup(scope, approverSet) {
     current_approver_set: approverSet
   });
   if (r === null || r.ok !== true)
-    return null;
-  return typeof r.state === "string" ? r.state : null;
+    return { state: null };
+  const dec = r.decision;
+  const origin = dec != null && (dec.origin === "operator" || dec.origin === "agent") ? dec.origin : undefined;
+  return {
+    state: typeof r.state === "string" ? r.state : null,
+    origin
+  };
 }
+var REQUIRE_OPERATOR_ORIGIN = requireOperatorApprovalForWrites();
 function loadAllowFrom() {
   const stateDir = process.env.TELEGRAM_STATE_DIR ?? join2(homedir2(), ".claude", "channels", "telegram");
   const accessPath = join2(stateDir, "access.json");
@@ -5500,9 +5534,13 @@ async function main() {
     block("no operator paired \u2014 cannot post approval card");
   }
   const existing = await approvalLookup(scope, allowFrom);
-  if (existing === "granted") {
+  const existingAction = evaluateGatedWrite(existing, REQUIRE_OPERATOR_ORIGIN);
+  if (existingAction.kind === "allow") {
     allow();
   }
+  if (existingAction.kind === "block") {
+    block(`Drive write refused: ${existingAction.reason}`);
+  }
   let handle;
   try {
     handle = await loadFromAuthBroker();
@@ -5546,10 +5584,15 @@ async function main() {
     if (!first) {
       await new Promise((r) => setTimeout(r, KERNEL_POLL_INTERVAL_MS));
     }
-    const state = await approvalLookup(scope, allowFrom);
-    if (state === "granted") {
+    const lookup = await approvalLookup(scope, allowFrom);
+    const state = lookup.state;
+    const action = evaluateGatedWrite(lookup, REQUIRE_OPERATOR_ORIGIN);
+    if (action.kind === "allow") {
       allow();
     }
+    if (action.kind === "block") {
+      block(`Drive write refused: ${action.reason}`);
+    }
     if (state === "denied" || state === "drift_revoked") {
       block(`user denied Drive write (kernel verdict: ${state})`);
     }

package/dist/cli/ms-365-write-pretool.mjs

@@ -4944,6 +4944,34 @@ function buildBatchAbortReason(appliedInBatch) {
   return `grant lapsed mid-batch \u2014 ${n} MS-365 write${n === 1 ? "" : "s"} already ` + `applied in this batch; remaining ops aborted. STOP: do not retry blindly \u2014 ` + `reconcile what landed before re-issuing.`;
 }
 
+// src/vault/approvals/gated-write-policy.ts
+var REQUIRE_OPERATOR_WRITE_ENV = "SWITCHROOM_REQUIRE_OPERATOR_APPROVAL_WRITE";
+function requireOperatorApprovalForWrites(env = process.env) {
+  return env[REQUIRE_OPERATOR_WRITE_ENV] === "1";
+}
+function isGatedWriteApproved(lookup, requireOperator) {
+  if (lookup.state !== "granted") {
+    return { allow: false, reason: `approval state is '${lookup.state ?? "unknown"}', not 'granted'` };
+  }
+  if (!requireOperator)
+    return { allow: true };
+  if (lookup.origin !== "operator") {
+    return {
+      allow: false,
+      reason: `approval was recorded with origin='${lookup.origin ?? "unknown"}', not 'operator' \u2014 ` + `an agent-origin decision is not proof an operator tapped ` + `(${REQUIRE_OPERATOR_WRITE_ENV}=1)`
+    };
+  }
+  return { allow: true };
+}
+function evaluateGatedWrite(lookup, requireOperator) {
+  const verdict = isGatedWriteApproved(lookup, requireOperator);
+  if (verdict.allow)
+    return { kind: "allow" };
+  if (lookup.state === "granted")
+    return { kind: "block", reason: verdict.reason };
+  return { kind: "wait" };
+}
+
 // src/cli/ms-365-write-pretool.ts
 var HOOK_TIMEOUT_MS = 5 * 60 * 1000;
 var KERNEL_POLL_INTERVAL_MS = 2000;
@@ -5350,8 +5378,14 @@ async function approvalLookupByRequest(agentUnit, requestId, approverSet) {
   });
   if (!res.ok)
     return null;
-  return res.value;
+  const value = res.value;
+  const o = value.decision?.origin;
+  return {
+    state: value.state,
+    origin: o === "operator" || o === "agent" ? o : undefined
+  };
 }
+var REQUIRE_OPERATOR_ORIGIN = requireOperatorApprovalForWrites();
 function fail(reason) {
   process.stdout.write(JSON.stringify({
     decision: "block",
@@ -5426,10 +5460,14 @@ async function main() {
     if (!lookup)
       continue;
     const state = lookup.state;
-    if (state === "granted") {
+    const action = evaluateGatedWrite({ state: state ?? null, origin: lookup.origin }, REQUIRE_OPERATOR_ORIGIN);
+    if (action.kind === "allow") {
       recordOutcome(Date.now(), { ...ledgerEntry, outcome: "applied" });
       allow();
     }
+    if (action.kind === "block") {
+      fail(action.reason);
+    }
     if (state === "expired" || state === "drift_revoked") {
       const t = Date.now();
       const applied = countCurrentBatchApplied(readLedger(t).entries, t);

package/dist/cli/notion-write-pretool.mjs

@@ -11190,7 +11190,8 @@ var init_protocol = __esm(() => {
     ttl_expires_at: exports_external.number().nullable(),
     last_used_at: exports_external.number().nullable(),
     revoked_at: exports_external.number().nullable(),
-    revoke_reason: exports_external.string().nullable()
+    revoke_reason: exports_external.string().nullable(),
+    origin: exports_external.enum(["agent", "operator"]).optional()
   });
   OkApprovalLookupResponseSchema = exports_external.object({
     ok: exports_external.literal(true),
@@ -11865,7 +11866,7 @@ var AgentMemorySchema = exports_external.object({
   recall: exports_external.object({
     max_memories: exports_external.number().int().min(0).optional().describe("Cap on the number of memories injected into the prompt by " + "auto-recall, regardless of token budget. Plugin default is 12. " + "0 disables the cap (all memories Hindsight returns are injected)."),
     cache_ttl_secs: exports_external.number().int().min(0).optional().describe("Per-session recall cache TTL in seconds. When > 0, identical " + "(prompt, bank) within the same session reuse the cached recall " + "result instead of round-tripping to Hindsight. 0 disables. " + "Default is 600 (10 min) for switchroom-managed agents."),
-    min_overlap: exports_external.number().min(0).max(1).optional().describe("Minimum Jaccard token overlap [0.0\u20131.0] between the user " + "prompt and a memory's text for the memory to be injected. " + "Drops low-relevance matches before the count cap so weak hits " + "don't fill the slot on real queries. 0.0 disables (default \u2014 " + "current behaviour). Try 0.10\u20130.20 to start; observe the " + "`overlap_dropped` field via `switchroom memory recall-log`."),
+    min_overlap: exports_external.number().min(0).max(1).optional().describe("Minimum containment token overlap [0.0\u20131.0] between the user " + "prompt and a memory's text for the memory to be injected. " + "A cheap FLOOR that removes candidates with (near-)zero lexical " + "relationship to the prompt \u2014 NOT a precision control: at the " + "recommended 0.10 the gate is near-passthrough, and the " + "effective precision control is the engine rerank plus the " + "max_memories head-slice. 0.0 disables (default \u2014 current " + "behaviour). Use 0.10; values at or above 0.20 measurably " + "starve recall \u2014 on production replay 0.20 leaves ~41.9% of " + "turns with NO memories at all, re-creating the bug #3541 " + "fixed. Observe the `overlap_dropped` field via " + "`switchroom memory recall-log`."),
     types: exports_external.array(exports_external.string()).optional().describe("Hindsight fact types to recall. Switchroom default is " + '["world", "experience", "observation"] \u2014 the synthesized ' + "`observation` tier is on by default. Set to " + '["world", "experience"] to opt out of observation-backed ' + "recall for this agent (or fleet-wide under defaults)."),
     additional_banks: exports_external.array(exports_external.string()).optional().describe("Extra Hindsight banks to recall from on every turn, merged into " + "the agent's own bank results \u2014 e.g. a shared operator/household " + "profile bank authored via `switchroom memory profile`. Each is " + "recalled with an 8s timeout and is non-fatal on failure. Stays " + "within the single tenant: all banks are the operator's data, in " + "the operator's Hindsight instance (see the `single-tenant` " + "invariant). Defaults to [] (no extra banks)."),
     sender_banks: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Per-speaker recall routing: a map of Telegram sender \u2192 extra " + "recall bank. When a message arrives, the agent also recalls the " + "speaker's bank (matched by Telegram username \u2014 a leading @ is " + "optional \u2014 or numeric user_id), merged " + "into its own results \u2014 so each trusted user gets their own " + "profile context. Additive recall scoping within the single " + "tenant: never an access boundary (who may drive an agent stays " + "the per-agent user assignment in `access.allowFrom`). Author the " + "banks via `switchroom memory profile`."),
@@ -12177,9 +12178,16 @@ var ReactionDispatchSchema = exports_external.object({
   enabled: exports_external.boolean().optional().describe("Master switch for the reaction-dispatch path. Default false \u2014 " + "with no reaction_dispatch block, reactions are persisted (and may " + "feed the `reactions` feedback path) but are NEVER dispatched as " + "event-driven inbound turns."),
   emojis: exports_external.array(exports_external.string()).optional().describe('Emoji allowlist that triggers a `<channel event="reaction">` ' + "inbound turn when reacted to any message. Default [] (nothing " + "fires). Cascade mode: REPLACE (not union) \u2014 a layer's list " + "replaces lower layers entirely so an operator can narrow per-agent.")
 }).optional();
-var ReleaseBlock = exports_external.object({
+var releaseBlockFields = {
   channel: exports_external.enum(["dev", "rc", "latest"]).optional(),
   pin: exports_external.string().regex(/^(sha-[0-9a-f]{7,40}|v\d+\.\d+\.\d+)$/).optional()
+};
+var ReleaseBlock = exports_external.object(releaseBlockFields).strict().refine((r) => !(r.channel && r.pin), {
+  message: "release.channel and release.pin are mutually exclusive"
+});
+var RootReleaseBlock = exports_external.object({
+  ...releaseBlockFields,
+  auto_update: exports_external.boolean().optional().describe("Opt-in unattended fleet auto-update (KEN-131). When true, hostd's " + "release watcher polls the published release version and, on a new " + "release, drives the EXISTING staggered canary rollout " + "(`switchroom rollout --pin vX.Y.Z`) unattended: canary-first, " + "per-agent version assert, durable pin persisted only after the " + "canary is green, abort + operator alert card on canary failure, " + "and compose rollback on a failed apply. Default false \u2014 with it " + "unset/false, behaviour is unchanged.")
 }).strict().refine((r) => !(r.channel && r.pin), {
   message: "release.channel and release.pin are mutually exclusive"
 });
@@ -12423,6 +12431,7 @@ var AutoReleaseCheckSchema = exports_external.object({
   enabled: exports_external.boolean().default(false).describe("When true, hostd polls the remote release tag every " + "`interval_minutes` and applies + restarts the fleet when a new " + "release is detected. Default false \u2014 opt-in."),
   interval_minutes: exports_external.number().int().min(5).max(1440).default(5).describe("Poll interval in minutes. Floor of 5m matches the agent-config " + "cron rate limit; ceiling of 1440m (24h) is a sanity cap."),
   apply_on_detect: exports_external.boolean().default(true).describe("When false, hostd logs `release_detected` but does NOT call " + "update_apply / restart all. Useful for dogfooding the detector " + "without rolling the fleet."),
+  notify_on_detect: exports_external.boolean().default(false).describe("KEN-129 \u2014 operator-in-the-loop update prompt. Only consulted " + "when apply_on_detect is false (auto-apply supersedes notify): " + "a newly detected release posts ONE operator approval card " + "('fleet is behind \u2014 tap to apply') via an admin agent's " + "gateway; Approve runs hostd's update_apply path (fleet-" + "mutation-locked, durable status rows, get_status-pollable). " + "Dedup on release id: the last-notified id persists in " + "~/.switchroom/release-notify-state.json, so a card that " + "reached the operator is never re-posted for the same release."),
   image_ref: exports_external.string().default("ghcr.io/switchroom/switchroom-agent:latest").describe("Image reference whose remote digest is compared to the local " + "image digest. Defaults to the agent image's :latest tag, which " + "is the canonical signal that a release has been promoted.")
 });
 var HostControlConfigSchema = exports_external.object({
@@ -12465,7 +12474,7 @@ var SwitchroomConfigSchema = exports_external.object({
     timezone: exports_external.string().regex(TIMEZONE_REGEX, "timezone must be an IANA zone name like 'Australia/Melbourne' or 'UTC'").optional().describe("Global default IANA timezone applied to every agent unless the " + "agent (or its profile) declares its own. See the per-agent " + "timezone field for the full cascade and auto-detection fallback.")
   }),
   telegram: TelegramConfigSchema,
-  release: ReleaseBlock.optional().describe("Fleet-wide default release-channel pin / pointer for the update " + "flow. Either `channel` (dev|rc|latest) or `pin` (sha-<hex>|v<semver>) " + "\u2014 mutually exclusive. Per-agent `release` REPLACES this entirely."),
+  release: RootReleaseBlock.optional().describe("Fleet-wide default release-channel pin / pointer for the update " + "flow. Either `channel` (dev|rc|latest) or `pin` (sha-<hex>|v<semver>) " + "\u2014 mutually exclusive. Per-agent `release` REPLACES this entirely " + "(except `auto_update`, which is root-only \u2014 a fleet property read by " + "hostd's release watcher, never per-agent)."),
   memory: MemoryBackendConfigSchema.optional(),
   hindsight: HindsightConfigSchema.optional().describe("Fleet-singleton Hindsight (memory backend) configuration. Currently " + "just the LLM knob (provider + model) used for retain/reflect/" + "consolidation. Both fields optional; when unset the container falls " + "back to provider=claude-code + the hard-coded HINDSIGHT_DEFAULT_MODEL " + "so nothing changes for operators who don't set it. Read at container " + "launch by startHindsight() (src/setup/hindsight.ts) \u2014 takes effect on " + "the next `switchroom apply` / `memory setup --recreate`."),
   vault: VaultConfigSchema.optional(),