switchroom 0.19.18 → 0.19.19

package/dist/agent-scheduler/index.js

@@ -13406,7 +13406,8 @@ var ApprovalDecisionMetaSchema = exports_external.object({
   ttl_expires_at: exports_external.number().nullable(),
   last_used_at: exports_external.number().nullable(),
   revoked_at: exports_external.number().nullable(),
-  revoke_reason: exports_external.string().nullable()
+  revoke_reason: exports_external.string().nullable(),
+  origin: exports_external.enum(["agent", "operator"]).optional()
 });
 var OkApprovalLookupResponseSchema = exports_external.object({
   ok: exports_external.literal(true),

package/dist/auth-broker/index.js

@@ -18363,6 +18363,7 @@ var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`
 var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
+var DOCKER_PROBE_TIMEOUT_MS = 60 * 1000;
 
 // src/memory/hindsight.ts
 var DEFAULT_RETAIN_MISSION = "Extract durable facts that will still be true and useful weeks from now: " + "user preferences and standing rules, ongoing projects and recurring " + "commitments, technical and architectural decisions with their rationale, " + "and people/tool relationships. A preference revealed by a request is " + "durable — record the preference (what the user likes, wants, or always " + `does), not the request itself.
@@ -18695,7 +18696,8 @@ var ApprovalDecisionMetaSchema = exports_external.object({
   ttl_expires_at: exports_external.number().nullable(),
   last_used_at: exports_external.number().nullable(),
   revoked_at: exports_external.number().nullable(),
-  revoke_reason: exports_external.string().nullable()
+  revoke_reason: exports_external.string().nullable(),
+  origin: exports_external.enum(["agent", "operator"]).optional()
 });
 var OkApprovalLookupResponseSchema = exports_external.object({
   ok: exports_external.literal(true),

package/dist/cli/drive-write-pretool.mjs

@@ -5300,6 +5300,34 @@ function truncateLine2(s) {
   return cleaned.length <= 60 ? cleaned : `${cleaned.slice(0, 59)}\u2026`;
 }
 
+// src/vault/approvals/gated-write-policy.ts
+var REQUIRE_OPERATOR_WRITE_ENV = "SWITCHROOM_REQUIRE_OPERATOR_APPROVAL_WRITE";
+function requireOperatorApprovalForWrites(env = process.env) {
+  return env[REQUIRE_OPERATOR_WRITE_ENV] === "1";
+}
+function isGatedWriteApproved(lookup, requireOperator) {
+  if (lookup.state !== "granted") {
+    return { allow: false, reason: `approval state is '${lookup.state ?? "unknown"}', not 'granted'` };
+  }
+  if (!requireOperator)
+    return { allow: true };
+  if (lookup.origin !== "operator") {
+    return {
+      allow: false,
+      reason: `approval was recorded with origin='${lookup.origin ?? "unknown"}', not 'operator' \u2014 ` + `an agent-origin decision is not proof an operator tapped ` + `(${REQUIRE_OPERATOR_WRITE_ENV}=1)`
+    };
+  }
+  return { allow: true };
+}
+function evaluateGatedWrite(lookup, requireOperator) {
+  const verdict = isGatedWriteApproved(lookup, requireOperator);
+  if (verdict.allow)
+    return { kind: "allow" };
+  if (lookup.state === "granted")
+    return { kind: "block", reason: verdict.reason };
+  return { kind: "wait" };
+}
+
 // src/cli/drive-write-pretool.ts
 var HOOK_TIMEOUT_MS = 5 * 60 * 1000;
 var KERNEL_POLL_INTERVAL_MS = 2000;
@@ -5383,9 +5411,15 @@ async function approvalLookup(scope, approverSet) {
     current_approver_set: approverSet
   });
   if (r === null || r.ok !== true)
-    return null;
-  return typeof r.state === "string" ? r.state : null;
+    return { state: null };
+  const dec = r.decision;
+  const origin = dec != null && (dec.origin === "operator" || dec.origin === "agent") ? dec.origin : undefined;
+  return {
+    state: typeof r.state === "string" ? r.state : null,
+    origin
+  };
 }
+var REQUIRE_OPERATOR_ORIGIN = requireOperatorApprovalForWrites();
 function loadAllowFrom() {
   const stateDir = process.env.TELEGRAM_STATE_DIR ?? join2(homedir2(), ".claude", "channels", "telegram");
   const accessPath = join2(stateDir, "access.json");
@@ -5500,9 +5534,13 @@ async function main() {
     block("no operator paired \u2014 cannot post approval card");
   }
   const existing = await approvalLookup(scope, allowFrom);
-  if (existing === "granted") {
+  const existingAction = evaluateGatedWrite(existing, REQUIRE_OPERATOR_ORIGIN);
+  if (existingAction.kind === "allow") {
     allow();
   }
+  if (existingAction.kind === "block") {
+    block(`Drive write refused: ${existingAction.reason}`);
+  }
   let handle;
   try {
     handle = await loadFromAuthBroker();
@@ -5546,10 +5584,15 @@ async function main() {
     if (!first) {
       await new Promise((r) => setTimeout(r, KERNEL_POLL_INTERVAL_MS));
     }
-    const state = await approvalLookup(scope, allowFrom);
-    if (state === "granted") {
+    const lookup = await approvalLookup(scope, allowFrom);
+    const state = lookup.state;
+    const action = evaluateGatedWrite(lookup, REQUIRE_OPERATOR_ORIGIN);
+    if (action.kind === "allow") {
       allow();
     }
+    if (action.kind === "block") {
+      block(`Drive write refused: ${action.reason}`);
+    }
     if (state === "denied" || state === "drift_revoked") {
       block(`user denied Drive write (kernel verdict: ${state})`);
     }

package/dist/cli/ms-365-write-pretool.mjs

@@ -4944,6 +4944,34 @@ function buildBatchAbortReason(appliedInBatch) {
   return `grant lapsed mid-batch \u2014 ${n} MS-365 write${n === 1 ? "" : "s"} already ` + `applied in this batch; remaining ops aborted. STOP: do not retry blindly \u2014 ` + `reconcile what landed before re-issuing.`;
 }
 
+// src/vault/approvals/gated-write-policy.ts
+var REQUIRE_OPERATOR_WRITE_ENV = "SWITCHROOM_REQUIRE_OPERATOR_APPROVAL_WRITE";
+function requireOperatorApprovalForWrites(env = process.env) {
+  return env[REQUIRE_OPERATOR_WRITE_ENV] === "1";
+}
+function isGatedWriteApproved(lookup, requireOperator) {
+  if (lookup.state !== "granted") {
+    return { allow: false, reason: `approval state is '${lookup.state ?? "unknown"}', not 'granted'` };
+  }
+  if (!requireOperator)
+    return { allow: true };
+  if (lookup.origin !== "operator") {
+    return {
+      allow: false,
+      reason: `approval was recorded with origin='${lookup.origin ?? "unknown"}', not 'operator' \u2014 ` + `an agent-origin decision is not proof an operator tapped ` + `(${REQUIRE_OPERATOR_WRITE_ENV}=1)`
+    };
+  }
+  return { allow: true };
+}
+function evaluateGatedWrite(lookup, requireOperator) {
+  const verdict = isGatedWriteApproved(lookup, requireOperator);
+  if (verdict.allow)
+    return { kind: "allow" };
+  if (lookup.state === "granted")
+    return { kind: "block", reason: verdict.reason };
+  return { kind: "wait" };
+}
+
 // src/cli/ms-365-write-pretool.ts
 var HOOK_TIMEOUT_MS = 5 * 60 * 1000;
 var KERNEL_POLL_INTERVAL_MS = 2000;
@@ -5350,8 +5378,14 @@ async function approvalLookupByRequest(agentUnit, requestId, approverSet) {
   });
   if (!res.ok)
     return null;
-  return res.value;
+  const value = res.value;
+  const o = value.decision?.origin;
+  return {
+    state: value.state,
+    origin: o === "operator" || o === "agent" ? o : undefined
+  };
 }
+var REQUIRE_OPERATOR_ORIGIN = requireOperatorApprovalForWrites();
 function fail(reason) {
   process.stdout.write(JSON.stringify({
     decision: "block",
@@ -5426,10 +5460,14 @@ async function main() {
     if (!lookup)
       continue;
     const state = lookup.state;
-    if (state === "granted") {
+    const action = evaluateGatedWrite({ state: state ?? null, origin: lookup.origin }, REQUIRE_OPERATOR_ORIGIN);
+    if (action.kind === "allow") {
       recordOutcome(Date.now(), { ...ledgerEntry, outcome: "applied" });
       allow();
     }
+    if (action.kind === "block") {
+      fail(action.reason);
+    }
     if (state === "expired" || state === "drift_revoked") {
       const t = Date.now();
       const applied = countCurrentBatchApplied(readLedger(t).entries, t);

package/dist/cli/notion-write-pretool.mjs

@@ -11190,7 +11190,8 @@ var init_protocol = __esm(() => {
     ttl_expires_at: exports_external.number().nullable(),
     last_used_at: exports_external.number().nullable(),
     revoked_at: exports_external.number().nullable(),
-    revoke_reason: exports_external.string().nullable()
+    revoke_reason: exports_external.string().nullable(),
+    origin: exports_external.enum(["agent", "operator"]).optional()
   });
   OkApprovalLookupResponseSchema = exports_external.object({
     ok: exports_external.literal(true),