switchroom 0.19.17 → 0.19.19

package/dist/vault/approvals/kernel-server.js

@@ -4013,7 +4013,7 @@ var init_zod = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, ReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   CodeRepoEntrySchema = exports_external.object({
@@ -4164,7 +4164,7 @@ var init_schema = __esm(() => {
     recall: exports_external.object({
       max_memories: exports_external.number().int().min(0).optional().describe("Cap on the number of memories injected into the prompt by " + "auto-recall, regardless of token budget. Plugin default is 12. " + "0 disables the cap (all memories Hindsight returns are injected)."),
       cache_ttl_secs: exports_external.number().int().min(0).optional().describe("Per-session recall cache TTL in seconds. When > 0, identical " + "(prompt, bank) within the same session reuse the cached recall " + "result instead of round-tripping to Hindsight. 0 disables. " + "Default is 600 (10 min) for switchroom-managed agents."),
-      min_overlap: exports_external.number().min(0).max(1).optional().describe("Minimum Jaccard token overlap [0.0–1.0] between the user " + "prompt and a memory's text for the memory to be injected. " + "Drops low-relevance matches before the count cap so weak hits " + "don't fill the slot on real queries. 0.0 disables (default — " + "current behaviour). Try 0.10–0.20 to start; observe the " + "`overlap_dropped` field via `switchroom memory recall-log`."),
+      min_overlap: exports_external.number().min(0).max(1).optional().describe("Minimum containment token overlap [0.0–1.0] between the user " + "prompt and a memory's text for the memory to be injected. " + "A cheap FLOOR that removes candidates with (near-)zero lexical " + "relationship to the prompt — NOT a precision control: at the " + "recommended 0.10 the gate is near-passthrough, and the " + "effective precision control is the engine rerank plus the " + "max_memories head-slice. 0.0 disables (default — current " + "behaviour). Use 0.10; values at or above 0.20 measurably " + "starve recall — on production replay 0.20 leaves ~41.9% of " + "turns with NO memories at all, re-creating the bug #3541 " + "fixed. Observe the `overlap_dropped` field via " + "`switchroom memory recall-log`."),
       types: exports_external.array(exports_external.string()).optional().describe("Hindsight fact types to recall. Switchroom default is " + '["world", "experience", "observation"] — the synthesized ' + "`observation` tier is on by default. Set to " + '["world", "experience"] to opt out of observation-backed ' + "recall for this agent (or fleet-wide under defaults)."),
       additional_banks: exports_external.array(exports_external.string()).optional().describe("Extra Hindsight banks to recall from on every turn, merged into " + "the agent's own bank results — e.g. a shared operator/household " + "profile bank authored via `switchroom memory profile`. Each is " + "recalled with an 8s timeout and is non-fatal on failure. Stays " + "within the single tenant: all banks are the operator's data, in " + "the operator's Hindsight instance (see the `single-tenant` " + "invariant). Defaults to [] (no extra banks)."),
       sender_banks: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Per-speaker recall routing: a map of Telegram sender → extra " + "recall bank. When a message arrives, the agent also recalls the " + "speaker's bank (matched by Telegram username — a leading @ is " + "optional — or numeric user_id), merged " + "into its own results — so each trusted user gets their own " + "profile context. Additive recall scoping within the single " + "tenant: never an access boundary (who may drive an agent stays " + "the per-agent user assignment in `access.allowFrom`). Author the " + "banks via `switchroom memory profile`."),
@@ -4476,9 +4476,16 @@ var init_schema = __esm(() => {
     enabled: exports_external.boolean().optional().describe("Master switch for the reaction-dispatch path. Default false — " + "with no reaction_dispatch block, reactions are persisted (and may " + "feed the `reactions` feedback path) but are NEVER dispatched as " + "event-driven inbound turns."),
     emojis: exports_external.array(exports_external.string()).optional().describe('Emoji allowlist that triggers a `<channel event="reaction">` ' + "inbound turn when reacted to any message. Default [] (nothing " + "fires). Cascade mode: REPLACE (not union) — a layer's list " + "replaces lower layers entirely so an operator can narrow per-agent.")
   }).optional();
-  ReleaseBlock = exports_external.object({
+  releaseBlockFields = {
     channel: exports_external.enum(["dev", "rc", "latest"]).optional(),
     pin: exports_external.string().regex(/^(sha-[0-9a-f]{7,40}|v\d+\.\d+\.\d+)$/).optional()
+  };
+  ReleaseBlock = exports_external.object(releaseBlockFields).strict().refine((r) => !(r.channel && r.pin), {
+    message: "release.channel and release.pin are mutually exclusive"
+  });
+  RootReleaseBlock = exports_external.object({
+    ...releaseBlockFields,
+    auto_update: exports_external.boolean().optional().describe("Opt-in unattended fleet auto-update (KEN-131). When true, hostd's " + "release watcher polls the published release version and, on a new " + "release, drives the EXISTING staggered canary rollout " + "(`switchroom rollout --pin vX.Y.Z`) unattended: canary-first, " + "per-agent version assert, durable pin persisted only after the " + "canary is green, abort + operator alert card on canary failure, " + "and compose rollback on a failed apply. Default false — with it " + "unset/false, behaviour is unchanged.")
   }).strict().refine((r) => !(r.channel && r.pin), {
     message: "release.channel and release.pin are mutually exclusive"
   });
@@ -4722,6 +4729,7 @@ var init_schema = __esm(() => {
     enabled: exports_external.boolean().default(false).describe("When true, hostd polls the remote release tag every " + "`interval_minutes` and applies + restarts the fleet when a new " + "release is detected. Default false — opt-in."),
     interval_minutes: exports_external.number().int().min(5).max(1440).default(5).describe("Poll interval in minutes. Floor of 5m matches the agent-config " + "cron rate limit; ceiling of 1440m (24h) is a sanity cap."),
     apply_on_detect: exports_external.boolean().default(true).describe("When false, hostd logs `release_detected` but does NOT call " + "update_apply / restart all. Useful for dogfooding the detector " + "without rolling the fleet."),
+    notify_on_detect: exports_external.boolean().default(false).describe("KEN-129 — operator-in-the-loop update prompt. Only consulted " + "when apply_on_detect is false (auto-apply supersedes notify): " + "a newly detected release posts ONE operator approval card " + "('fleet is behind — tap to apply') via an admin agent's " + "gateway; Approve runs hostd's update_apply path (fleet-" + "mutation-locked, durable status rows, get_status-pollable). " + "Dedup on release id: the last-notified id persists in " + "~/.switchroom/release-notify-state.json, so a card that " + "reached the operator is never re-posted for the same release."),
     image_ref: exports_external.string().default("ghcr.io/switchroom/switchroom-agent:latest").describe("Image reference whose remote digest is compared to the local " + "image digest. Defaults to the agent image's :latest tag, which " + "is the canonical signal that a release has been promoted.")
   });
   HostControlConfigSchema = exports_external.object({
@@ -4764,7 +4772,7 @@ var init_schema = __esm(() => {
       timezone: exports_external.string().regex(TIMEZONE_REGEX, "timezone must be an IANA zone name like 'Australia/Melbourne' or 'UTC'").optional().describe("Global default IANA timezone applied to every agent unless the " + "agent (or its profile) declares its own. See the per-agent " + "timezone field for the full cascade and auto-detection fallback.")
     }),
     telegram: TelegramConfigSchema,
-    release: ReleaseBlock.optional().describe("Fleet-wide default release-channel pin / pointer for the update " + "flow. Either `channel` (dev|rc|latest) or `pin` (sha-<hex>|v<semver>) " + "— mutually exclusive. Per-agent `release` REPLACES this entirely."),
+    release: RootReleaseBlock.optional().describe("Fleet-wide default release-channel pin / pointer for the update " + "flow. Either `channel` (dev|rc|latest) or `pin` (sha-<hex>|v<semver>) " + "— mutually exclusive. Per-agent `release` REPLACES this entirely " + "(except `auto_update`, which is root-only — a fleet property read by " + "hostd's release watcher, never per-agent)."),
     memory: MemoryBackendConfigSchema.optional(),
     hindsight: HindsightConfigSchema.optional().describe("Fleet-singleton Hindsight (memory backend) configuration. Currently " + "just the LLM knob (provider + model) used for retain/reflect/" + "consolidation. Both fields optional; when unset the container falls " + "back to provider=claude-code + the hard-coded HINDSIGHT_DEFAULT_MODEL " + "so nothing changes for operators who don't set it. Read at container " + "launch by startHindsight() (src/setup/hindsight.ts) — takes effect on " + "the next `switchroom apply` / `memory setup --recreate`."),
     vault: VaultConfigSchema.optional(),
@@ -18538,7 +18546,8 @@ var ApprovalDecisionMetaSchema = exports_external.object({
   ttl_expires_at: exports_external.number().nullable(),
   last_used_at: exports_external.number().nullable(),
   revoked_at: exports_external.number().nullable(),
-  revoke_reason: exports_external.string().nullable()
+  revoke_reason: exports_external.string().nullable(),
+  origin: exports_external.enum(["agent", "operator"]).optional()
 });
 var OkApprovalLookupResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -18702,6 +18711,7 @@ function migrateApprovalSchema(db) {
 var DEFAULT_MAX_TTL_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
 
 // src/vault/approvals/kernel.ts
+var ALLOW_ONCE_CONSUMED_REASON = "allow_once_consumed";
 function generateRequestId() {
   return randomBytes(16).toString("hex");
 }
@@ -18849,6 +18859,38 @@ function evaluateDecisionRow(db, row, currentCanonical, opts, now) {
   if (decision.decision === "deny") {
     return { state: "denied", decision };
   }
+  if (decision.decision === "allow_once") {
+    const burn = db.run(`UPDATE approval_decisions
+       SET last_used_at = ?, revoked_at = ?, revoke_reason = ?
+       WHERE id = ? AND revoked_at IS NULL`, [now, now, ALLOW_ONCE_CONSUMED_REASON, decision.id]);
+    if ((burn.changes ?? 0) === 0) {
+      audit(db, "deny", {
+        agent_unit: decision.agent_unit,
+        scope: decision.scope,
+        action: decision.action,
+        decision_id: decision.id,
+        context: { reason: ALLOW_ONCE_CONSUMED_REASON }
+      });
+      return { state: "denied", decision };
+    }
+    decision.last_used_at = now;
+    decision.revoked_at = now;
+    decision.revoke_reason = ALLOW_ONCE_CONSUMED_REASON;
+    audit(db, "match", {
+      agent_unit: decision.agent_unit,
+      scope: decision.scope,
+      action: decision.action,
+      decision_id: decision.id
+    });
+    audit(db, "revoke", {
+      agent_unit: decision.agent_unit,
+      scope: decision.scope,
+      action: decision.action,
+      decision_id: decision.id,
+      context: { actor: "kernel", reason: ALLOW_ONCE_CONSUMED_REASON }
+    });
+    return { state: "granted", decision };
+  }
   if (decision.decision === "allow_ttl") {
     const maxLifetime = opts.max_ttl_lifetime_ms ?? DEFAULT_MAX_TTL_LIFETIME_MS;
     const hardCap = decision.granted_at + maxLifetime;
@@ -18917,7 +18959,8 @@ function consumeNonce(db, request_id, now = Date.now()) {
 }
 function recordDecision(db, input, now = Date.now()) {
   const id = randomUUID();
-  const ttl_expires_at = input.decision === "allow_ttl" && input.ttl_ms ? now + input.ttl_ms : null;
+  const maxLifetime = input.max_ttl_lifetime_ms ?? DEFAULT_MAX_TTL_LIFETIME_MS;
+  const ttl_expires_at = input.decision === "allow_ttl" && input.ttl_ms ? now + Math.min(input.ttl_ms, maxLifetime) : null;
   const canonical = canonicalizeApproverSet(input.approver_set);
   db.run(`INSERT INTO approval_decisions
        (id, agent_unit, scope, action, decision,
@@ -19115,9 +19158,26 @@ var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`
 var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
+var DOCKER_PROBE_TIMEOUT_MS = 60 * 1000;
 
 // src/memory/hindsight.ts
-var DEFAULT_RETAIN_MISSION = "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise, " + "including in-flight workflow/process narration (a sub-task started, " + "paused, or is still running) — only retain the outcome once a task " + "actually completes or a decision is made.";
+var DEFAULT_RETAIN_MISSION = "Extract durable facts that will still be true and useful weeks from now: " + "user preferences and standing rules, ongoing projects and recurring " + "commitments, technical and architectural decisions with their rationale, " + "and people/tool relationships. A preference revealed by a request is " + "durable — record the preference (what the user likes, wants, or always " + `does), not the request itself.
+
+` + `NEVER extract:
+` + "- Agent tool-use traces or narration of what the assistant did (e.g. " + `"the assistant used X to query Y", "ran a search", "sent the message").
+` + "- In-flight workflow/process narration (a sub-task started, paused, or is " + "still running) — retain the outcome only once the task completes or a " + `decision is made.
+` + `- Operation, request, batch or session IDs, UUIDs, hashes, or error codes.
+` + "- Hindsight's own errors, retries, backlogs, or internal state — the " + `memory system's self-reports are not memories.
+` + `- Restatements of the user's current request or the task in progress.
+` + "- Transient state (unread counts, build status, what is running right now) " + "unless the fact is explicitly dated, in which case record it as a dated " + `observation.
+` + `- Greetings, acknowledgements, and routine operational chatter.
+
+` + "If a candidate fact matches an exclusion, drop it rather than rewording " + "it. If nothing durable remains, return an empty facts list.";
+var SUPERSEDED_RETAIN_MISSIONS = [
+  "Extract technical decisions, architectural choices, user preferences, project context, and people/tool relationships. Ignore routine greetings and transient operational details.",
+  "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise.",
+  "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise, " + "including in-flight workflow/process narration (a sub-task started, " + "paused, or is still running) — only retain the outcome once a task " + "actually completes or a decision is made."
+];
 var PROFILE_MEMORY_DEFAULTS = {
   "health-coach": {
     disposition: { skepticism: 2, literalism: 2, empathy: 5 },
@@ -19172,6 +19232,7 @@ init_paths();
 // src/agents/scaffold.ts
 var REPO_ROOT = resolve5(import.meta.dirname, "../..");
 var CLAUDE_MD_YOURS_PLACEHOLDER = "This space is yours. Add per-agent rules, exceptions, or context the " + "Switchroom template doesn't capture. Everything above the marker line is " + "regenerated on every apply; this section is preserved.";
+var pendingBankOps = new Set;
 var SWITCHROOM_OWNED_SETTINGS_KEYS = new Set([
   "permissions",
   "mcpServers",
@@ -19360,6 +19421,9 @@ function handleConnection(socket, agent, db, isOperator = false) {
 }
 var KERNEL_OPERATOR_NAME = "operator";
 var OPERATOR_ALLOWED_OPS = new Set(["approval_list"]);
+function listenerOrigin(isOperator) {
+  return isOperator ? "operator" : "agent";
+}
 function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
   if (isOperator && !OPERATOR_ALLOWED_OPS.has(req.op)) {
     socket.write(encodeResponse(errorResponse("DENIED", `kernel operator socket is read-only: '${req.op}' is not permitted (only ${[...OPERATOR_ALLOWED_OPS].join(", ")})`)));
@@ -19420,7 +19484,8 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
       ttl_expires_at: r.decision.ttl_expires_at,
       last_used_at: r.decision.last_used_at,
       revoked_at: r.decision.revoked_at,
-      revoke_reason: r.decision.revoke_reason
+      revoke_reason: r.decision.revoke_reason,
+      origin: r.decision.origin
     } : null;
     socket.write(encodeResponse({ ok: true, state: r.state, decision }));
     return;
@@ -19447,7 +19512,8 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
       ttl_expires_at: r.decision.ttl_expires_at,
       last_used_at: r.decision.last_used_at,
       revoked_at: r.decision.revoked_at,
-      revoke_reason: r.decision.revoke_reason
+      revoke_reason: r.decision.revoke_reason,
+      origin: r.decision.origin
     } : null;
     socket.write(encodeResponse({ ok: true, state: r.state, decision }));
     return;
@@ -19509,7 +19575,8 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
       decision: req.decision,
       approver_set: req.approver_set,
       granted_by_user_id: req.granted_by_user_id,
-      ttl_ms: req.ttl_ms ?? undefined
+      ttl_ms: req.ttl_ms ?? undefined,
+      origin: listenerOrigin(isOperator)
     });
     socket.write(encodeResponse({ ok: true, decision_id }));
     return;
@@ -19528,7 +19595,8 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
       decision: req.decision,
       approver_set: req.approver_set,
       granted_by_user_id: req.granted_by_user_id,
-      ttl_ms: req.ttl_ms ?? undefined
+      ttl_ms: req.ttl_ms ?? undefined,
+      origin: listenerOrigin(isOperator)
     });
     if (!res.consumed) {
       socket.write(encodeResponse({ ok: true, consumed: false }));
@@ -19546,7 +19614,16 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
     return;
   }
   if (req.op === "approval_list") {
-    const decisions = listDecisions(db, { agent_unit: req.agent_unit });
+    let listFilter = { agent_unit: req.agent_unit };
+    if (!isOperator) {
+      const acl = checkApprovalAclByAgent(agent, req.agent_unit ?? agent);
+      if (!acl.allow) {
+        socket.write(encodeResponse(errorResponse("DENIED", acl.reason)));
+        return;
+      }
+      listFilter = { agent_unit: agent };
+    }
+    const decisions = listDecisions(db, listFilter);
     const meta = decisions.map((d) => ({
       id: d.id,
       agent_unit: d.agent_unit,
@@ -19708,6 +19785,7 @@ if (import.meta.url === `file://${process.argv[1]}` && /(?:^|[/\\])(?:vault[/\\]
 export {
   openKernelDb,
   main,
+  listenerOrigin,
   bootstrap,
   KERNEL_OPERATOR_NAME
 };