switchroom 0.19.17 → 0.19.19

package/dist/vault/broker/server.js

@@ -4013,7 +4013,7 @@ var init_zod = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, ReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   CodeRepoEntrySchema = exports_external.object({
@@ -4164,7 +4164,7 @@ var init_schema = __esm(() => {
     recall: exports_external.object({
       max_memories: exports_external.number().int().min(0).optional().describe("Cap on the number of memories injected into the prompt by " + "auto-recall, regardless of token budget. Plugin default is 12. " + "0 disables the cap (all memories Hindsight returns are injected)."),
       cache_ttl_secs: exports_external.number().int().min(0).optional().describe("Per-session recall cache TTL in seconds. When > 0, identical " + "(prompt, bank) within the same session reuse the cached recall " + "result instead of round-tripping to Hindsight. 0 disables. " + "Default is 600 (10 min) for switchroom-managed agents."),
-      min_overlap: exports_external.number().min(0).max(1).optional().describe("Minimum Jaccard token overlap [0.0–1.0] between the user " + "prompt and a memory's text for the memory to be injected. " + "Drops low-relevance matches before the count cap so weak hits " + "don't fill the slot on real queries. 0.0 disables (default — " + "current behaviour). Try 0.10–0.20 to start; observe the " + "`overlap_dropped` field via `switchroom memory recall-log`."),
+      min_overlap: exports_external.number().min(0).max(1).optional().describe("Minimum containment token overlap [0.0–1.0] between the user " + "prompt and a memory's text for the memory to be injected. " + "A cheap FLOOR that removes candidates with (near-)zero lexical " + "relationship to the prompt — NOT a precision control: at the " + "recommended 0.10 the gate is near-passthrough, and the " + "effective precision control is the engine rerank plus the " + "max_memories head-slice. 0.0 disables (default — current " + "behaviour). Use 0.10; values at or above 0.20 measurably " + "starve recall — on production replay 0.20 leaves ~41.9% of " + "turns with NO memories at all, re-creating the bug #3541 " + "fixed. Observe the `overlap_dropped` field via " + "`switchroom memory recall-log`."),
       types: exports_external.array(exports_external.string()).optional().describe("Hindsight fact types to recall. Switchroom default is " + '["world", "experience", "observation"] — the synthesized ' + "`observation` tier is on by default. Set to " + '["world", "experience"] to opt out of observation-backed ' + "recall for this agent (or fleet-wide under defaults)."),
       additional_banks: exports_external.array(exports_external.string()).optional().describe("Extra Hindsight banks to recall from on every turn, merged into " + "the agent's own bank results — e.g. a shared operator/household " + "profile bank authored via `switchroom memory profile`. Each is " + "recalled with an 8s timeout and is non-fatal on failure. Stays " + "within the single tenant: all banks are the operator's data, in " + "the operator's Hindsight instance (see the `single-tenant` " + "invariant). Defaults to [] (no extra banks)."),
       sender_banks: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Per-speaker recall routing: a map of Telegram sender → extra " + "recall bank. When a message arrives, the agent also recalls the " + "speaker's bank (matched by Telegram username — a leading @ is " + "optional — or numeric user_id), merged " + "into its own results — so each trusted user gets their own " + "profile context. Additive recall scoping within the single " + "tenant: never an access boundary (who may drive an agent stays " + "the per-agent user assignment in `access.allowFrom`). Author the " + "banks via `switchroom memory profile`."),
@@ -4476,9 +4476,16 @@ var init_schema = __esm(() => {
     enabled: exports_external.boolean().optional().describe("Master switch for the reaction-dispatch path. Default false — " + "with no reaction_dispatch block, reactions are persisted (and may " + "feed the `reactions` feedback path) but are NEVER dispatched as " + "event-driven inbound turns."),
     emojis: exports_external.array(exports_external.string()).optional().describe('Emoji allowlist that triggers a `<channel event="reaction">` ' + "inbound turn when reacted to any message. Default [] (nothing " + "fires). Cascade mode: REPLACE (not union) — a layer's list " + "replaces lower layers entirely so an operator can narrow per-agent.")
   }).optional();
-  ReleaseBlock = exports_external.object({
+  releaseBlockFields = {
     channel: exports_external.enum(["dev", "rc", "latest"]).optional(),
     pin: exports_external.string().regex(/^(sha-[0-9a-f]{7,40}|v\d+\.\d+\.\d+)$/).optional()
+  };
+  ReleaseBlock = exports_external.object(releaseBlockFields).strict().refine((r) => !(r.channel && r.pin), {
+    message: "release.channel and release.pin are mutually exclusive"
+  });
+  RootReleaseBlock = exports_external.object({
+    ...releaseBlockFields,
+    auto_update: exports_external.boolean().optional().describe("Opt-in unattended fleet auto-update (KEN-131). When true, hostd's " + "release watcher polls the published release version and, on a new " + "release, drives the EXISTING staggered canary rollout " + "(`switchroom rollout --pin vX.Y.Z`) unattended: canary-first, " + "per-agent version assert, durable pin persisted only after the " + "canary is green, abort + operator alert card on canary failure, " + "and compose rollback on a failed apply. Default false — with it " + "unset/false, behaviour is unchanged.")
   }).strict().refine((r) => !(r.channel && r.pin), {
     message: "release.channel and release.pin are mutually exclusive"
   });
@@ -4722,6 +4729,7 @@ var init_schema = __esm(() => {
     enabled: exports_external.boolean().default(false).describe("When true, hostd polls the remote release tag every " + "`interval_minutes` and applies + restarts the fleet when a new " + "release is detected. Default false — opt-in."),
     interval_minutes: exports_external.number().int().min(5).max(1440).default(5).describe("Poll interval in minutes. Floor of 5m matches the agent-config " + "cron rate limit; ceiling of 1440m (24h) is a sanity cap."),
     apply_on_detect: exports_external.boolean().default(true).describe("When false, hostd logs `release_detected` but does NOT call " + "update_apply / restart all. Useful for dogfooding the detector " + "without rolling the fleet."),
+    notify_on_detect: exports_external.boolean().default(false).describe("KEN-129 — operator-in-the-loop update prompt. Only consulted " + "when apply_on_detect is false (auto-apply supersedes notify): " + "a newly detected release posts ONE operator approval card " + "('fleet is behind — tap to apply') via an admin agent's " + "gateway; Approve runs hostd's update_apply path (fleet-" + "mutation-locked, durable status rows, get_status-pollable). " + "Dedup on release id: the last-notified id persists in " + "~/.switchroom/release-notify-state.json, so a card that " + "reached the operator is never re-posted for the same release."),
     image_ref: exports_external.string().default("ghcr.io/switchroom/switchroom-agent:latest").describe("Image reference whose remote digest is compared to the local " + "image digest. Defaults to the agent image's :latest tag, which " + "is the canonical signal that a release has been promoted.")
   });
   HostControlConfigSchema = exports_external.object({
@@ -4764,7 +4772,7 @@ var init_schema = __esm(() => {
       timezone: exports_external.string().regex(TIMEZONE_REGEX, "timezone must be an IANA zone name like 'Australia/Melbourne' or 'UTC'").optional().describe("Global default IANA timezone applied to every agent unless the " + "agent (or its profile) declares its own. See the per-agent " + "timezone field for the full cascade and auto-detection fallback.")
     }),
     telegram: TelegramConfigSchema,
-    release: ReleaseBlock.optional().describe("Fleet-wide default release-channel pin / pointer for the update " + "flow. Either `channel` (dev|rc|latest) or `pin` (sha-<hex>|v<semver>) " + "— mutually exclusive. Per-agent `release` REPLACES this entirely."),
+    release: RootReleaseBlock.optional().describe("Fleet-wide default release-channel pin / pointer for the update " + "flow. Either `channel` (dev|rc|latest) or `pin` (sha-<hex>|v<semver>) " + "— mutually exclusive. Per-agent `release` REPLACES this entirely " + "(except `auto_update`, which is root-only — a fleet property read by " + "hostd's release watcher, never per-agent)."),
     memory: MemoryBackendConfigSchema.optional(),
     hindsight: HindsightConfigSchema.optional().describe("Fleet-singleton Hindsight (memory backend) configuration. Currently " + "just the LLM knob (provider + model) used for retain/reflect/" + "consolidation. Both fields optional; when unset the container falls " + "back to provider=claude-code + the hard-coded HINDSIGHT_DEFAULT_MODEL " + "so nothing changes for operators who don't set it. Read at container " + "launch by startHindsight() (src/setup/hindsight.ts) — takes effect on " + "the next `switchroom apply` / `memory setup --recreate`."),
     vault: VaultConfigSchema.optional(),
@@ -18214,7 +18222,7 @@ var require_lib = __commonJS((exports, module) => {
 
 // src/vault/broker/server.ts
 import * as net from "node:net";
-import { mkdirSync as mkdirSync7, chmodSync as chmodSync5, chownSync, existsSync as existsSync12, readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync6, unlinkSync as unlinkSync6, writeFileSync as writeFileSync3, renameSync as renameSync8 } from "node:fs";
+import { mkdirSync as mkdirSync7, chmodSync as chmodSync5, chownSync, existsSync as existsSync12, readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync3, renameSync as renameSync8 } from "node:fs";
 
 // src/agents/compose.ts
 init_schema();
@@ -18823,9 +18831,26 @@ var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`
 var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
+var DOCKER_PROBE_TIMEOUT_MS = 60 * 1000;
 
 // src/memory/hindsight.ts
-var DEFAULT_RETAIN_MISSION = "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise, " + "including in-flight workflow/process narration (a sub-task started, " + "paused, or is still running) — only retain the outcome once a task " + "actually completes or a decision is made.";
+var DEFAULT_RETAIN_MISSION = "Extract durable facts that will still be true and useful weeks from now: " + "user preferences and standing rules, ongoing projects and recurring " + "commitments, technical and architectural decisions with their rationale, " + "and people/tool relationships. A preference revealed by a request is " + "durable — record the preference (what the user likes, wants, or always " + `does), not the request itself.
+
+` + `NEVER extract:
+` + "- Agent tool-use traces or narration of what the assistant did (e.g. " + `"the assistant used X to query Y", "ran a search", "sent the message").
+` + "- In-flight workflow/process narration (a sub-task started, paused, or is " + "still running) — retain the outcome only once the task completes or a " + `decision is made.
+` + `- Operation, request, batch or session IDs, UUIDs, hashes, or error codes.
+` + "- Hindsight's own errors, retries, backlogs, or internal state — the " + `memory system's self-reports are not memories.
+` + `- Restatements of the user's current request or the task in progress.
+` + "- Transient state (unread counts, build status, what is running right now) " + "unless the fact is explicitly dated, in which case record it as a dated " + `observation.
+` + `- Greetings, acknowledgements, and routine operational chatter.
+
+` + "If a candidate fact matches an exclusion, drop it rather than rewording " + "it. If nothing durable remains, return an empty facts list.";
+var SUPERSEDED_RETAIN_MISSIONS = [
+  "Extract technical decisions, architectural choices, user preferences, project context, and people/tool relationships. Ignore routine greetings and transient operational details.",
+  "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise.",
+  "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise, " + "including in-flight workflow/process narration (a sub-task started, " + "paused, or is still running) — only retain the outcome once a task " + "actually completes or a decision is made."
+];
 var PROFILE_MEMORY_DEFAULTS = {
   "health-coach": {
     disposition: { skepticism: 2, literalism: 2, empathy: 5 },
@@ -19522,7 +19547,8 @@ var ApprovalDecisionMetaSchema = exports_external.object({
   ttl_expires_at: exports_external.number().nullable(),
   last_used_at: exports_external.number().nullable(),
   revoked_at: exports_external.number().nullable(),
-  revoke_reason: exports_external.string().nullable()
+  revoke_reason: exports_external.string().nullable(),
+  origin: exports_external.enum(["agent", "operator"]).optional()
 });
 var OkApprovalLookupResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -19634,6 +19660,7 @@ init_paths();
 // src/agents/scaffold.ts
 var REPO_ROOT = resolve6(import.meta.dirname, "../..");
 var CLAUDE_MD_YOURS_PLACEHOLDER = "This space is yours. Add per-agent rules, exceptions, or context the " + "Switchroom template doesn't capture. Everything above the marker line is " + "regenerated on every apply; this section is preserved.";
+var pendingBankOps = new Set;
 var SWITCHROOM_OWNED_SETTINGS_KEYS = new Set([
   "permissions",
   "mcpServers",
@@ -19720,9 +19747,9 @@ function migrateLegacyGrantsDbLocation(newDbPath = getGrantsDbPath(), deps) {
 var BIND_MOUNT_EXACT_SOURCE_DENY = new Set(["/var/run/docker.sock"]);
 
 // src/vault/broker/server.ts
-import { dirname as dirname7, resolve as resolve9, basename as basename4 } from "node:path";
+import { dirname as dirname7, resolve as resolve9, basename as basename5 } from "node:path";
 import * as os3 from "node:os";
-import * as path4 from "node:path";
+import * as path5 from "node:path";
 
 // src/vault/migrate-layout.ts
 import {
@@ -19956,9 +19983,9 @@ function readAutoUnlockFile(filePath) {
 var DEFAULT_AUTO_UNLOCK_PATH = "~/.switchroom/vault-auto-unlock";
 
 // src/vault/broker/audit-log.ts
-import * as fs2 from "node:fs";
+import * as fs3 from "node:fs";
 import * as os2 from "node:os";
-import * as path2 from "node:path";
+import * as path3 from "node:path";
 
 // src/util/audit-hashchain.ts
 import { createHash as createHash4 } from "node:crypto";
@@ -20075,76 +20102,107 @@ function safeAuditLogPath(requestedPath) {
   return cachedTmpAuditLog;
 }
 
-// src/vault/broker/audit-log.ts
-function failOpenStatePath(logPath) {
-  return `${logPath}.failopen`;
-}
-function readFailOpenState(statePath) {
+// src/util/log-rotation.ts
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+function fsyncAndMeasure(snapshotPath, logPath, tag) {
+  let step = "open";
   try {
-    const raw = fs2.readFileSync(statePath, "utf8");
-    const parsed = JSON.parse(raw);
-    const count = Number(parsed.failOpenCount);
-    return {
-      failOpenCount: Number.isFinite(count) && count > 0 ? count : 0,
-      lastFailureTs: typeof parsed.lastFailureTs === "string" ? parsed.lastFailureTs : undefined,
-      lastError: typeof parsed.lastError === "string" ? parsed.lastError : undefined
-    };
-  } catch {
-    return { failOpenCount: 0 };
+    const fd = fs2.openSync(snapshotPath, "r");
+    try {
+      step = "fsync";
+      fs2.fsyncSync(fd);
+      step = "measure";
+      const size = fs2.fstatSync(fd).size;
+      step = "close";
+      return size;
+    } finally {
+      fs2.closeSync(fd);
+    }
+  } catch (err) {
+    process.stderr.write(`[${tag}] ERROR: could not ${step} snapshot ${snapshotPath}; leaving active log ${logPath} intact to avoid data loss: ${err.message}
+`);
+    return null;
   }
 }
-var DEFAULT_AUDIT_MAX_BYTES = 32 * 1024 * 1024;
-var DEFAULT_AUDIT_MAX_FILES = 5;
-function resolveRotation(opts) {
-  const envBytes = Number(process.env.SWITCHROOM_VAULT_AUDIT_MAX_BYTES);
-  const envFiles = Number(process.env.SWITCHROOM_VAULT_AUDIT_MAX_FILES);
-  const maxBytes = opts.maxBytes !== undefined && opts.maxBytes !== 0 ? opts.maxBytes : Number.isFinite(envBytes) && envBytes !== 0 ? envBytes : DEFAULT_AUDIT_MAX_BYTES;
-  const maxFiles = opts.maxFiles !== undefined && opts.maxFiles > 0 ? opts.maxFiles : Number.isFinite(envFiles) && envFiles > 0 ? envFiles : DEFAULT_AUDIT_MAX_FILES;
-  return { maxBytes, maxFiles };
-}
-function rotateAuditLog(logPath, maxFiles) {
-  const oldest = `${logPath}.${maxFiles}`;
+function rotateLogFile(logPath, maxFiles, tag, stillHeld) {
+  const keep = Math.max(1, Math.floor(maxFiles));
+  const held = (what) => {
+    if (!stillHeld || stillHeld())
+      return true;
+    process.stderr.write(`[${tag}] WARN: rotation lock for ${logPath} was reclaimed while we were inside it; declining to ${what}
+`);
+    return false;
+  };
+  let entryBytes;
+  try {
+    entryBytes = fs2.statSync(logPath).size;
+  } catch (err) {
+    process.stderr.write(`[${tag}] ERROR: could not stat active log ${logPath} before rotating it: ${err.message}
+`);
+    return false;
+  }
+  const notRotatedUnderUs = (what) => {
+    let live;
+    try {
+      live = fs2.statSync(logPath).size;
+    } catch (err) {
+      process.stderr.write(`[${tag}] ERROR: could not re-stat active log ${logPath}; declining to ${what}: ${err.message}
+`);
+      return false;
+    }
+    if (live < entryBytes) {
+      process.stderr.write(`[${tag}] WARN: active log ${logPath} shrank from ${entryBytes} to ${live} bytes while we were rotating it; another rotator snapshotted it and these generations are its, not ours — declining to ${what}
+`);
+      return false;
+    }
+    return true;
+  };
+  const oldest = `${logPath}.${keep}`;
   if (fs2.existsSync(oldest)) {
+    if (!held(`drop ${oldest}`))
+      return false;
+    if (!notRotatedUnderUs(`drop ${oldest}`))
+      return false;
     try {
       fs2.unlinkSync(oldest);
     } catch (err) {
-      process.stderr.write(`[vault-audit] ERROR: could not drop oldest rotation ${oldest}: ${err.message}
+      process.stderr.write(`[${tag}] ERROR: could not drop oldest rotation ${oldest}: ${err.message}
 `);
     }
   }
-  for (let n = maxFiles - 1;n >= 1; n--) {
+  for (let n = keep - 1;n >= 1; n--) {
     const from = `${logPath}.${n}`;
     const to = `${logPath}.${n + 1}`;
     if (!fs2.existsSync(from))
       continue;
+    if (!held(`shift ${from} → ${to}`))
+      return false;
+    if (!notRotatedUnderUs(`shift ${from} → ${to}`))
+      return false;
     try {
       fs2.renameSync(from, to);
     } catch (err) {
-      process.stderr.write(`[vault-audit] ERROR: could not rotate ${from} → ${to}: ${err.message}
+      process.stderr.write(`[${tag}] ERROR: could not rotate ${from} → ${to}: ${err.message}
 `);
-      return;
+      return false;
     }
   }
   const snapshotPath = `${logPath}.1`;
+  if (!held(`overwrite ${snapshotPath}`))
+    return false;
+  if (!notRotatedUnderUs(`overwrite ${snapshotPath}`))
+    return false;
   try {
     fs2.copyFileSync(logPath, snapshotPath);
   } catch (err) {
-    process.stderr.write(`[vault-audit] ERROR: could not snapshot active audit log ${logPath} → ${snapshotPath}: ${err.message}
-`);
-    return;
-  }
-  try {
-    const fd = fs2.openSync(snapshotPath, "r");
-    try {
-      fs2.fsyncSync(fd);
-    } finally {
-      fs2.closeSync(fd);
-    }
-  } catch (err) {
-    process.stderr.write(`[vault-audit] ERROR: could not fsync audit snapshot ${snapshotPath}; leaving active log intact to avoid data loss: ${err.message}
+    process.stderr.write(`[${tag}] ERROR: could not snapshot active log ${logPath} → ${snapshotPath}: ${err.message}
 `);
-    return;
+    return false;
   }
+  const snapshotBytes = fsyncAndMeasure(snapshotPath, logPath, tag);
+  if (snapshotBytes === null)
+    return false;
   try {
     const dirFd = fs2.openSync(path2.dirname(snapshotPath), "r");
     try {
@@ -20153,15 +20211,78 @@ function rotateAuditLog(logPath, maxFiles) {
       fs2.closeSync(dirFd);
     }
   } catch {}
+  if (!held(`truncate ${logPath}`))
+    return false;
+  let liveBytes;
+  try {
+    liveBytes = fs2.statSync(logPath).size;
+  } catch (err) {
+    process.stderr.write(`[${tag}] ERROR: could not re-stat active log ${logPath} before truncating; leaving it intact to avoid data loss: ${err.message}
+`);
+    return false;
+  }
+  if (liveBytes < snapshotBytes) {
+    process.stderr.write(`[${tag}] WARN: active log ${logPath} shrank from ${snapshotBytes} to ${liveBytes} bytes after we snapshotted it; another rotator truncated it and these rows are its, not ours — declining to truncate
+`);
+    return false;
+  }
   try {
     fs2.truncateSync(logPath, 0);
   } catch (err) {
-    process.stderr.write(`[vault-audit] ERROR: could not truncate active audit log ${logPath}: ${err.message}
+    process.stderr.write(`[${tag}] ERROR: could not truncate active log ${logPath}: ${err.message}
 `);
+    return false;
+  }
+  if (stillHeld && !stillHeld()) {
+    process.stderr.write(`[${tag}] ERROR: truncated ${logPath} after our rotation lock was reclaimed; rows another rotator wrote between our size check and our truncate are LOST
+`);
+  }
+  return true;
+}
+function resolveRotationConfig(args) {
+  const env = args.env ?? process.env;
+  const envBytes = Number(env[args.envBytesVar]);
+  const envFiles = Number(env[args.envFilesVar]);
+  const maxBytes = args.maxBytes !== undefined && args.maxBytes !== 0 ? args.maxBytes : Number.isFinite(envBytes) && envBytes !== 0 ? envBytes : args.defaultBytes;
+  const maxFiles = args.maxFiles !== undefined && args.maxFiles > 0 ? args.maxFiles : Number.isFinite(envFiles) && envFiles > 0 ? envFiles : args.defaultFiles;
+  return { maxBytes, maxFiles };
+}
+
+// src/vault/broker/audit-log.ts
+function failOpenStatePath(logPath) {
+  return `${logPath}.failopen`;
+}
+function readFailOpenState(statePath) {
+  try {
+    const raw = fs3.readFileSync(statePath, "utf8");
+    const parsed = JSON.parse(raw);
+    const count = Number(parsed.failOpenCount);
+    return {
+      failOpenCount: Number.isFinite(count) && count > 0 ? count : 0,
+      lastFailureTs: typeof parsed.lastFailureTs === "string" ? parsed.lastFailureTs : undefined,
+      lastError: typeof parsed.lastError === "string" ? parsed.lastError : undefined
+    };
+  } catch {
+    return { failOpenCount: 0 };
   }
 }
+var DEFAULT_AUDIT_MAX_BYTES = 32 * 1024 * 1024;
+var DEFAULT_AUDIT_MAX_FILES = 5;
+function resolveRotation(opts) {
+  return resolveRotationConfig({
+    maxBytes: opts.maxBytes,
+    maxFiles: opts.maxFiles,
+    envBytesVar: "SWITCHROOM_VAULT_AUDIT_MAX_BYTES",
+    envFilesVar: "SWITCHROOM_VAULT_AUDIT_MAX_FILES",
+    defaultBytes: DEFAULT_AUDIT_MAX_BYTES,
+    defaultFiles: DEFAULT_AUDIT_MAX_FILES
+  });
+}
+function rotateAuditLog(logPath, maxFiles) {
+  rotateLogFile(logPath, maxFiles, "vault-audit");
+}
 function defaultAuditLogPath() {
-  return path2.join(os2.homedir(), ".switchroom", "vault-audit.log");
+  return path3.join(os2.homedir(), ".switchroom", "vault-audit.log");
 }
 function callerFromPeer(peer) {
   if (peer.systemdUnit !== null && peer.systemdUnit.length > 0) {
@@ -20183,7 +20304,7 @@ function createAuditLogger(opts = {}) {
       lastError: String(err.message).slice(0, 300)
     };
     try {
-      fs2.writeFileSync(statePath, `${JSON.stringify(state)}
+      fs3.writeFileSync(statePath, `${JSON.stringify(state)}
 `, { mode: 384 });
     } catch (persistErr) {
       process.stderr.write(`[vault-audit] ERROR: could not persist fail-open counter ${statePath}: ${persistErr.message}
@@ -20197,7 +20318,7 @@ function createAuditLogger(opts = {}) {
     write(entry) {
       if (rotation.maxBytes > 0) {
         try {
-          const size = fs2.statSync(logPath).size;
+          const size = fs3.statSync(logPath).size;
           if (size >= rotation.maxBytes) {
             rotateAuditLog(logPath, rotation.maxFiles);
           }
@@ -20206,7 +20327,7 @@ function createAuditLogger(opts = {}) {
       const { line, next } = chainRow(chain, entry);
       let fd;
       try {
-        fd = fs2.openSync(logPath, "a", 384);
+        fd = fs3.openSync(logPath, "a", 384);
       } catch (err) {
         process.stderr.write(`[vault-audit] ERROR: could not open audit log ${logPath}: ${err.message}
 `);
@@ -20215,7 +20336,7 @@ function createAuditLogger(opts = {}) {
       }
       let durable = false;
       try {
-        fs2.writeSync(fd, line);
+        fs3.writeSync(fd, line);
         chain = next;
         durable = true;
       } catch (err) {
@@ -20224,7 +20345,7 @@ function createAuditLogger(opts = {}) {
         recordFailOpen(err);
       } finally {
         try {
-          fs2.closeSync(fd);
+          fs3.closeSync(fd);
         } catch (closeErr) {
           process.stderr.write(`[vault-audit] ERROR: could not close audit log fd: ${closeErr.message}
 `);
@@ -20236,7 +20357,7 @@ function createAuditLogger(opts = {}) {
 }
 
 // src/vault/grants.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash5, randomBytes as randomBytes4 } from "node:crypto";
 
 // node_modules/.bun/bcryptjs@3.0.3/node_modules/bcryptjs/index.js
 import nodeCrypto from "crypto";
@@ -21930,6 +22051,44 @@ function migrateGrantsSchema(db) {
   }
 }
 var BCRYPT_COST = 10;
+var COMPARE_MEMO_TTL_MS = 60000;
+var COMPARE_MEMO_MAX_ENTRIES = 512;
+var compareMemo = new Map;
+function memoKey(id, secretHash, secret) {
+  return `${id}:${secretHash}:${createHash5("sha256").update(secret).digest("hex")}`;
+}
+async function compareSecret(id, secret, secretHash) {
+  const k = memoKey(id, secretHash, secret);
+  const now = Date.now();
+  const expiry = compareMemo.get(k);
+  if (expiry !== undefined) {
+    if (expiry > now)
+      return true;
+    compareMemo.delete(k);
+  }
+  let hashMatches;
+  try {
+    hashMatches = await compare(secret, secretHash);
+  } catch {
+    hashMatches = false;
+  }
+  if (hashMatches) {
+    if (compareMemo.size >= COMPARE_MEMO_MAX_ENTRIES) {
+      for (const [ck, cexp] of compareMemo) {
+        if (cexp <= now)
+          compareMemo.delete(ck);
+      }
+      while (compareMemo.size >= COMPARE_MEMO_MAX_ENTRIES) {
+        const oldest = compareMemo.keys().next();
+        if (oldest.done)
+          break;
+        compareMemo.delete(oldest.value);
+      }
+    }
+    compareMemo.set(k, now + COMPARE_MEMO_TTL_MS);
+  }
+  return hashMatches;
+}
 function generateId() {
   return "vg_" + randomBytes4(3).toString("hex");
 }
@@ -22012,12 +22171,7 @@ async function validateGrant(db, token, key) {
     return { ok: false, reason: "grant-invalid" };
   }
   const secretHash = row.secret_hash;
-  let hashMatches;
-  try {
-    hashMatches = await compare(secret, secretHash);
-  } catch {
-    hashMatches = false;
-  }
+  const hashMatches = await compareSecret(id, secret, secretHash);
   if (!hashMatches) {
     return { ok: false, reason: "grant-invalid" };
   }
@@ -22049,12 +22203,7 @@ async function validateGrantForWrite(db, token, key) {
   if (!row)
     return { ok: false, reason: "grant-invalid" };
   const secretHash = row.secret_hash;
-  let hashMatches;
-  try {
-    hashMatches = await compare(secret, secretHash);
-  } catch {
-    hashMatches = false;
-  }
+  const hashMatches = await compareSecret(id, secret, secretHash);
   if (!hashMatches)
     return { ok: false, reason: "grant-invalid" };
   const grant = rowToGrant(row);
@@ -22115,8 +22264,8 @@ function adminOnlyKeysBeingAdded(requestedKeys, existingKeys, patterns) {
 }
 
 // src/vault/grants-db.ts
-import * as path3 from "node:path";
-import * as fs3 from "node:fs";
+import * as path4 from "node:path";
+import * as fs4 from "node:fs";
 import { Database } from "bun:sqlite";
 
 // src/vault/approvals/schema.ts
@@ -22209,12 +22358,12 @@ function isGrantsDbCorruption(err) {
 function quarantineGrantsDb(dbPath) {
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
   const quarantinePath = `${dbPath}.corrupt-${stamp}`;
-  fs3.renameSync(dbPath, quarantinePath);
+  fs4.renameSync(dbPath, quarantinePath);
   for (const suffix of WAL_SIDECAR_SUFFIXES2) {
     const sidecar = `${dbPath}${suffix}`;
-    if (fs3.existsSync(sidecar)) {
+    if (fs4.existsSync(sidecar)) {
       try {
-        fs3.renameSync(sidecar, `${quarantinePath}${suffix}`);
+        fs4.renameSync(sidecar, `${quarantinePath}${suffix}`);
       } catch {}
     }
   }
@@ -22224,7 +22373,7 @@ function openAndMigrate(dbPath) {
   const db = new Database(dbPath, { create: true });
   try {
     try {
-      fs3.chmodSync(dbPath, 384);
+      fs4.chmodSync(dbPath, 384);
     } catch {}
     db.run("PRAGMA journal_mode=WAL");
     db.run("PRAGMA busy_timeout=5000");
@@ -22240,8 +22389,8 @@ function openAndMigrate(dbPath) {
   return db;
 }
 function openGrantsDb(dbPath = DEFAULT_GRANTS_DB_PATH, opener = openAndMigrate) {
-  const dir = path3.dirname(dbPath);
-  fs3.mkdirSync(dir, { recursive: true });
+  const dir = path4.dirname(dbPath);
+  fs4.mkdirSync(dir, { recursive: true });
   migrateLegacyGrantsDbLocation(dbPath);
   try {
     return opener(dbPath);
@@ -22265,6 +22414,7 @@ function canonicalizeApproverSet(approvers) {
 }
 
 // src/vault/approvals/kernel.ts
+var ALLOW_ONCE_CONSUMED_REASON = "allow_once_consumed";
 function generateRequestId() {
   return randomBytes5(16).toString("hex");
 }
@@ -22391,6 +22541,38 @@ function evaluateDecisionRow(db, row, currentCanonical, opts, now) {
   if (decision.decision === "deny") {
     return { state: "denied", decision };
   }
+  if (decision.decision === "allow_once") {
+    const burn = db.run(`UPDATE approval_decisions
+       SET last_used_at = ?, revoked_at = ?, revoke_reason = ?
+       WHERE id = ? AND revoked_at IS NULL`, [now, now, ALLOW_ONCE_CONSUMED_REASON, decision.id]);
+    if ((burn.changes ?? 0) === 0) {
+      audit(db, "deny", {
+        agent_unit: decision.agent_unit,
+        scope: decision.scope,
+        action: decision.action,
+        decision_id: decision.id,
+        context: { reason: ALLOW_ONCE_CONSUMED_REASON }
+      });
+      return { state: "denied", decision };
+    }
+    decision.last_used_at = now;
+    decision.revoked_at = now;
+    decision.revoke_reason = ALLOW_ONCE_CONSUMED_REASON;
+    audit(db, "match", {
+      agent_unit: decision.agent_unit,
+      scope: decision.scope,
+      action: decision.action,
+      decision_id: decision.id
+    });
+    audit(db, "revoke", {
+      agent_unit: decision.agent_unit,
+      scope: decision.scope,
+      action: decision.action,
+      decision_id: decision.id,
+      context: { actor: "kernel", reason: ALLOW_ONCE_CONSUMED_REASON }
+    });
+    return { state: "granted", decision };
+  }
   if (decision.decision === "allow_ttl") {
     const maxLifetime = opts.max_ttl_lifetime_ms ?? DEFAULT_MAX_TTL_LIFETIME_MS;
     const hardCap = decision.granted_at + maxLifetime;
@@ -22459,7 +22641,8 @@ function consumeNonce(db, request_id, now = Date.now()) {
 }
 function recordDecision(db, input, now = Date.now()) {
   const id = randomUUID();
-  const ttl_expires_at = input.decision === "allow_ttl" && input.ttl_ms ? now + input.ttl_ms : null;
+  const maxLifetime = input.max_ttl_lifetime_ms ?? DEFAULT_MAX_TTL_LIFETIME_MS;
+  const ttl_expires_at = input.decision === "allow_ttl" && input.ttl_ms ? now + Math.min(input.ttl_ms, maxLifetime) : null;
   const canonical = canonicalizeApproverSet(input.approver_set);
   db.run(`INSERT INTO approval_decisions
        (id, agent_unit, scope, action, decision,
@@ -23774,10 +23957,10 @@ class VaultBroker {
         return;
       }
       try {
-        const agentsDir = this.config ? resolveAgentsDir(this.config) : path4.join(os3.homedir(), ".switchroom", "agents");
-        const tokenDir = path4.join(agentsDir, agent);
+        const agentsDir = this.config ? resolveAgentsDir(this.config) : path5.join(os3.homedir(), ".switchroom", "agents");
+        const tokenDir = path5.join(agentsDir, agent);
         mkdirSync7(tokenDir, { recursive: true });
-        const tokenPath = path4.join(tokenDir, ".vault-token");
+        const tokenPath = path5.join(tokenDir, ".vault-token");
         const tmpPath = `${tokenPath}.tmp.${process.pid}`;
         writeFileSync3(tmpPath, mintResult.token, { mode: 384 });
         renameSync8(tmpPath, tokenPath);
@@ -23839,8 +24022,8 @@ class VaultBroker {
       try {
         const row = this.grantsDb.query("SELECT agent_slug FROM vault_grants WHERE id = ?").get(id);
         if (row && AgentNameSchema.safeParse(row.agent_slug).success) {
-          const agentsDir = this.config ? resolveAgentsDir(this.config) : path4.join(os3.homedir(), ".switchroom", "agents");
-          const tokenPath = path4.join(agentsDir, row.agent_slug, ".vault-token");
+          const agentsDir = this.config ? resolveAgentsDir(this.config) : path5.join(os3.homedir(), ".switchroom", "agents");
+          const tokenPath = path5.join(agentsDir, row.agent_slug, ".vault-token");
           if (existsSync12(tokenPath)) {
             try {
               unlinkSync6(tokenPath);
@@ -24082,7 +24265,7 @@ class VaultBroker {
     if (!existsSync12(filePath))
       return false;
     try {
-      if (statSync6(filePath).size === 0)
+      if (statSync7(filePath).size === 0)
         return false;
     } catch {
       return false;
@@ -24161,12 +24344,12 @@ class VaultBroker {
 }
 function detectVaultLayoutDrift(vaultPath) {
   const dir = dirname7(vaultPath);
-  if (basename4(dir) !== "vault")
+  if (basename5(dir) !== "vault")
     return;
-  if (basename4(vaultPath) !== "vault.enc")
+  if (basename5(vaultPath) !== "vault.enc")
     return;
   const switchroomDir = dirname7(dir);
-  if (basename4(switchroomDir) !== ".switchroom")
+  if (basename5(switchroomDir) !== ".switchroom")
     return;
   const home2 = dirname7(switchroomDir);
   const result = inspectVaultLayout(home2);
@@ -24195,7 +24378,7 @@ async function main() {
   let perAgentTargets = [];
   try {
     if (existsSync12(perAgentDir)) {
-      const entries = readdirSync4(perAgentDir, { withFileTypes: true });
+      const entries = readdirSync5(perAgentDir, { withFileTypes: true });
       const flat = [];
       const subdirs = [];
       for (const e of entries) {