switchroom 0.19.18 → 0.19.19

package/dist/vault/approvals/kernel-server.js

@@ -18546,7 +18546,8 @@ var ApprovalDecisionMetaSchema = exports_external.object({
   ttl_expires_at: exports_external.number().nullable(),
   last_used_at: exports_external.number().nullable(),
   revoked_at: exports_external.number().nullable(),
-  revoke_reason: exports_external.string().nullable()
+  revoke_reason: exports_external.string().nullable(),
+  origin: exports_external.enum(["agent", "operator"]).optional()
 });
 var OkApprovalLookupResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -18710,6 +18711,7 @@ function migrateApprovalSchema(db) {
 var DEFAULT_MAX_TTL_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
 
 // src/vault/approvals/kernel.ts
+var ALLOW_ONCE_CONSUMED_REASON = "allow_once_consumed";
 function generateRequestId() {
   return randomBytes(16).toString("hex");
 }
@@ -18857,6 +18859,38 @@ function evaluateDecisionRow(db, row, currentCanonical, opts, now) {
   if (decision.decision === "deny") {
     return { state: "denied", decision };
   }
+  if (decision.decision === "allow_once") {
+    const burn = db.run(`UPDATE approval_decisions
+       SET last_used_at = ?, revoked_at = ?, revoke_reason = ?
+       WHERE id = ? AND revoked_at IS NULL`, [now, now, ALLOW_ONCE_CONSUMED_REASON, decision.id]);
+    if ((burn.changes ?? 0) === 0) {
+      audit(db, "deny", {
+        agent_unit: decision.agent_unit,
+        scope: decision.scope,
+        action: decision.action,
+        decision_id: decision.id,
+        context: { reason: ALLOW_ONCE_CONSUMED_REASON }
+      });
+      return { state: "denied", decision };
+    }
+    decision.last_used_at = now;
+    decision.revoked_at = now;
+    decision.revoke_reason = ALLOW_ONCE_CONSUMED_REASON;
+    audit(db, "match", {
+      agent_unit: decision.agent_unit,
+      scope: decision.scope,
+      action: decision.action,
+      decision_id: decision.id
+    });
+    audit(db, "revoke", {
+      agent_unit: decision.agent_unit,
+      scope: decision.scope,
+      action: decision.action,
+      decision_id: decision.id,
+      context: { actor: "kernel", reason: ALLOW_ONCE_CONSUMED_REASON }
+    });
+    return { state: "granted", decision };
+  }
   if (decision.decision === "allow_ttl") {
     const maxLifetime = opts.max_ttl_lifetime_ms ?? DEFAULT_MAX_TTL_LIFETIME_MS;
     const hardCap = decision.granted_at + maxLifetime;
@@ -18925,7 +18959,8 @@ function consumeNonce(db, request_id, now = Date.now()) {
 }
 function recordDecision(db, input, now = Date.now()) {
   const id = randomUUID();
-  const ttl_expires_at = input.decision === "allow_ttl" && input.ttl_ms ? now + input.ttl_ms : null;
+  const maxLifetime = input.max_ttl_lifetime_ms ?? DEFAULT_MAX_TTL_LIFETIME_MS;
+  const ttl_expires_at = input.decision === "allow_ttl" && input.ttl_ms ? now + Math.min(input.ttl_ms, maxLifetime) : null;
   const canonical = canonicalizeApproverSet(input.approver_set);
   db.run(`INSERT INTO approval_decisions
        (id, agent_unit, scope, action, decision,
@@ -19123,6 +19158,7 @@ var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`
 var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
+var DOCKER_PROBE_TIMEOUT_MS = 60 * 1000;
 
 // src/memory/hindsight.ts
 var DEFAULT_RETAIN_MISSION = "Extract durable facts that will still be true and useful weeks from now: " + "user preferences and standing rules, ongoing projects and recurring " + "commitments, technical and architectural decisions with their rationale, " + "and people/tool relationships. A preference revealed by a request is " + "durable — record the preference (what the user likes, wants, or always " + `does), not the request itself.
@@ -19385,6 +19421,9 @@ function handleConnection(socket, agent, db, isOperator = false) {
 }
 var KERNEL_OPERATOR_NAME = "operator";
 var OPERATOR_ALLOWED_OPS = new Set(["approval_list"]);
+function listenerOrigin(isOperator) {
+  return isOperator ? "operator" : "agent";
+}
 function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
   if (isOperator && !OPERATOR_ALLOWED_OPS.has(req.op)) {
     socket.write(encodeResponse(errorResponse("DENIED", `kernel operator socket is read-only: '${req.op}' is not permitted (only ${[...OPERATOR_ALLOWED_OPS].join(", ")})`)));
@@ -19445,7 +19484,8 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
       ttl_expires_at: r.decision.ttl_expires_at,
       last_used_at: r.decision.last_used_at,
       revoked_at: r.decision.revoked_at,
-      revoke_reason: r.decision.revoke_reason
+      revoke_reason: r.decision.revoke_reason,
+      origin: r.decision.origin
     } : null;
     socket.write(encodeResponse({ ok: true, state: r.state, decision }));
     return;
@@ -19472,7 +19512,8 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
       ttl_expires_at: r.decision.ttl_expires_at,
       last_used_at: r.decision.last_used_at,
       revoked_at: r.decision.revoked_at,
-      revoke_reason: r.decision.revoke_reason
+      revoke_reason: r.decision.revoke_reason,
+      origin: r.decision.origin
     } : null;
     socket.write(encodeResponse({ ok: true, state: r.state, decision }));
     return;
@@ -19534,7 +19575,8 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
       decision: req.decision,
       approver_set: req.approver_set,
       granted_by_user_id: req.granted_by_user_id,
-      ttl_ms: req.ttl_ms ?? undefined
+      ttl_ms: req.ttl_ms ?? undefined,
+      origin: listenerOrigin(isOperator)
     });
     socket.write(encodeResponse({ ok: true, decision_id }));
     return;
@@ -19553,7 +19595,8 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
       decision: req.decision,
       approver_set: req.approver_set,
       granted_by_user_id: req.granted_by_user_id,
-      ttl_ms: req.ttl_ms ?? undefined
+      ttl_ms: req.ttl_ms ?? undefined,
+      origin: listenerOrigin(isOperator)
     });
     if (!res.consumed) {
       socket.write(encodeResponse({ ok: true, consumed: false }));
@@ -19571,7 +19614,16 @@ function handleRequest(socket, req, agent, db, peerUid, isOperator = false) {
     return;
   }
   if (req.op === "approval_list") {
-    const decisions = listDecisions(db, { agent_unit: req.agent_unit });
+    let listFilter = { agent_unit: req.agent_unit };
+    if (!isOperator) {
+      const acl = checkApprovalAclByAgent(agent, req.agent_unit ?? agent);
+      if (!acl.allow) {
+        socket.write(encodeResponse(errorResponse("DENIED", acl.reason)));
+        return;
+      }
+      listFilter = { agent_unit: agent };
+    }
+    const decisions = listDecisions(db, listFilter);
     const meta = decisions.map((d) => ({
       id: d.id,
       agent_unit: d.agent_unit,
@@ -19733,6 +19785,7 @@ if (import.meta.url === `file://${process.argv[1]}` && /(?:^|[/\\])(?:vault[/\\]
 export {
   openKernelDb,
   main,
+  listenerOrigin,
   bootstrap,
   KERNEL_OPERATOR_NAME
 };

package/dist/vault/broker/server.js

@@ -18222,7 +18222,7 @@ var require_lib = __commonJS((exports, module) => {
 
 // src/vault/broker/server.ts
 import * as net from "node:net";
-import { mkdirSync as mkdirSync7, chmodSync as chmodSync5, chownSync, existsSync as existsSync12, readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync6, unlinkSync as unlinkSync6, writeFileSync as writeFileSync3, renameSync as renameSync8 } from "node:fs";
+import { mkdirSync as mkdirSync7, chmodSync as chmodSync5, chownSync, existsSync as existsSync12, readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync3, renameSync as renameSync8 } from "node:fs";
 
 // src/agents/compose.ts
 init_schema();
@@ -18831,6 +18831,7 @@ var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`
 var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
+var DOCKER_PROBE_TIMEOUT_MS = 60 * 1000;
 
 // src/memory/hindsight.ts
 var DEFAULT_RETAIN_MISSION = "Extract durable facts that will still be true and useful weeks from now: " + "user preferences and standing rules, ongoing projects and recurring " + "commitments, technical and architectural decisions with their rationale, " + "and people/tool relationships. A preference revealed by a request is " + "durable — record the preference (what the user likes, wants, or always " + `does), not the request itself.
@@ -19546,7 +19547,8 @@ var ApprovalDecisionMetaSchema = exports_external.object({
   ttl_expires_at: exports_external.number().nullable(),
   last_used_at: exports_external.number().nullable(),
   revoked_at: exports_external.number().nullable(),
-  revoke_reason: exports_external.string().nullable()
+  revoke_reason: exports_external.string().nullable(),
+  origin: exports_external.enum(["agent", "operator"]).optional()
 });
 var OkApprovalLookupResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -19745,9 +19747,9 @@ function migrateLegacyGrantsDbLocation(newDbPath = getGrantsDbPath(), deps) {
 var BIND_MOUNT_EXACT_SOURCE_DENY = new Set(["/var/run/docker.sock"]);
 
 // src/vault/broker/server.ts
-import { dirname as dirname7, resolve as resolve9, basename as basename4 } from "node:path";
+import { dirname as dirname7, resolve as resolve9, basename as basename5 } from "node:path";
 import * as os3 from "node:os";
-import * as path4 from "node:path";
+import * as path5 from "node:path";
 
 // src/vault/migrate-layout.ts
 import {
@@ -19981,9 +19983,9 @@ function readAutoUnlockFile(filePath) {
 var DEFAULT_AUTO_UNLOCK_PATH = "~/.switchroom/vault-auto-unlock";
 
 // src/vault/broker/audit-log.ts
-import * as fs2 from "node:fs";
+import * as fs3 from "node:fs";
 import * as os2 from "node:os";
-import * as path2 from "node:path";
+import * as path3 from "node:path";
 
 // src/util/audit-hashchain.ts
 import { createHash as createHash4 } from "node:crypto";
@@ -20100,76 +20102,107 @@ function safeAuditLogPath(requestedPath) {
   return cachedTmpAuditLog;
 }
 
-// src/vault/broker/audit-log.ts
-function failOpenStatePath(logPath) {
-  return `${logPath}.failopen`;
-}
-function readFailOpenState(statePath) {
+// src/util/log-rotation.ts
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+function fsyncAndMeasure(snapshotPath, logPath, tag) {
+  let step = "open";
   try {
-    const raw = fs2.readFileSync(statePath, "utf8");
-    const parsed = JSON.parse(raw);
-    const count = Number(parsed.failOpenCount);
-    return {
-      failOpenCount: Number.isFinite(count) && count > 0 ? count : 0,
-      lastFailureTs: typeof parsed.lastFailureTs === "string" ? parsed.lastFailureTs : undefined,
-      lastError: typeof parsed.lastError === "string" ? parsed.lastError : undefined
-    };
-  } catch {
-    return { failOpenCount: 0 };
+    const fd = fs2.openSync(snapshotPath, "r");
+    try {
+      step = "fsync";
+      fs2.fsyncSync(fd);
+      step = "measure";
+      const size = fs2.fstatSync(fd).size;
+      step = "close";
+      return size;
+    } finally {
+      fs2.closeSync(fd);
+    }
+  } catch (err) {
+    process.stderr.write(`[${tag}] ERROR: could not ${step} snapshot ${snapshotPath}; leaving active log ${logPath} intact to avoid data loss: ${err.message}
+`);
+    return null;
   }
 }
-var DEFAULT_AUDIT_MAX_BYTES = 32 * 1024 * 1024;
-var DEFAULT_AUDIT_MAX_FILES = 5;
-function resolveRotation(opts) {
-  const envBytes = Number(process.env.SWITCHROOM_VAULT_AUDIT_MAX_BYTES);
-  const envFiles = Number(process.env.SWITCHROOM_VAULT_AUDIT_MAX_FILES);
-  const maxBytes = opts.maxBytes !== undefined && opts.maxBytes !== 0 ? opts.maxBytes : Number.isFinite(envBytes) && envBytes !== 0 ? envBytes : DEFAULT_AUDIT_MAX_BYTES;
-  const maxFiles = opts.maxFiles !== undefined && opts.maxFiles > 0 ? opts.maxFiles : Number.isFinite(envFiles) && envFiles > 0 ? envFiles : DEFAULT_AUDIT_MAX_FILES;
-  return { maxBytes, maxFiles };
-}
-function rotateAuditLog(logPath, maxFiles) {
-  const oldest = `${logPath}.${maxFiles}`;
+function rotateLogFile(logPath, maxFiles, tag, stillHeld) {
+  const keep = Math.max(1, Math.floor(maxFiles));
+  const held = (what) => {
+    if (!stillHeld || stillHeld())
+      return true;
+    process.stderr.write(`[${tag}] WARN: rotation lock for ${logPath} was reclaimed while we were inside it; declining to ${what}
+`);
+    return false;
+  };
+  let entryBytes;
+  try {
+    entryBytes = fs2.statSync(logPath).size;
+  } catch (err) {
+    process.stderr.write(`[${tag}] ERROR: could not stat active log ${logPath} before rotating it: ${err.message}
+`);
+    return false;
+  }
+  const notRotatedUnderUs = (what) => {
+    let live;
+    try {
+      live = fs2.statSync(logPath).size;
+    } catch (err) {
+      process.stderr.write(`[${tag}] ERROR: could not re-stat active log ${logPath}; declining to ${what}: ${err.message}
+`);
+      return false;
+    }
+    if (live < entryBytes) {
+      process.stderr.write(`[${tag}] WARN: active log ${logPath} shrank from ${entryBytes} to ${live} bytes while we were rotating it; another rotator snapshotted it and these generations are its, not ours — declining to ${what}
+`);
+      return false;
+    }
+    return true;
+  };
+  const oldest = `${logPath}.${keep}`;
   if (fs2.existsSync(oldest)) {
+    if (!held(`drop ${oldest}`))
+      return false;
+    if (!notRotatedUnderUs(`drop ${oldest}`))
+      return false;
     try {
       fs2.unlinkSync(oldest);
     } catch (err) {
-      process.stderr.write(`[vault-audit] ERROR: could not drop oldest rotation ${oldest}: ${err.message}
+      process.stderr.write(`[${tag}] ERROR: could not drop oldest rotation ${oldest}: ${err.message}
 `);
     }
   }
-  for (let n = maxFiles - 1;n >= 1; n--) {
+  for (let n = keep - 1;n >= 1; n--) {
     const from = `${logPath}.${n}`;
     const to = `${logPath}.${n + 1}`;
     if (!fs2.existsSync(from))
       continue;
+    if (!held(`shift ${from} → ${to}`))
+      return false;
+    if (!notRotatedUnderUs(`shift ${from} → ${to}`))
+      return false;
     try {
       fs2.renameSync(from, to);
     } catch (err) {
-      process.stderr.write(`[vault-audit] ERROR: could not rotate ${from} → ${to}: ${err.message}
+      process.stderr.write(`[${tag}] ERROR: could not rotate ${from} → ${to}: ${err.message}
 `);
-      return;
+      return false;
     }
   }
   const snapshotPath = `${logPath}.1`;
+  if (!held(`overwrite ${snapshotPath}`))
+    return false;
+  if (!notRotatedUnderUs(`overwrite ${snapshotPath}`))
+    return false;
   try {
     fs2.copyFileSync(logPath, snapshotPath);
   } catch (err) {
-    process.stderr.write(`[vault-audit] ERROR: could not snapshot active audit log ${logPath} → ${snapshotPath}: ${err.message}
+    process.stderr.write(`[${tag}] ERROR: could not snapshot active log ${logPath} → ${snapshotPath}: ${err.message}
 `);
-    return;
-  }
-  try {
-    const fd = fs2.openSync(snapshotPath, "r");
-    try {
-      fs2.fsyncSync(fd);
-    } finally {
-      fs2.closeSync(fd);
-    }
-  } catch (err) {
-    process.stderr.write(`[vault-audit] ERROR: could not fsync audit snapshot ${snapshotPath}; leaving active log intact to avoid data loss: ${err.message}
-`);
-    return;
+    return false;
   }
+  const snapshotBytes = fsyncAndMeasure(snapshotPath, logPath, tag);
+  if (snapshotBytes === null)
+    return false;
   try {
     const dirFd = fs2.openSync(path2.dirname(snapshotPath), "r");
     try {
@@ -20178,15 +20211,78 @@ function rotateAuditLog(logPath, maxFiles) {
       fs2.closeSync(dirFd);
     }
   } catch {}
+  if (!held(`truncate ${logPath}`))
+    return false;
+  let liveBytes;
+  try {
+    liveBytes = fs2.statSync(logPath).size;
+  } catch (err) {
+    process.stderr.write(`[${tag}] ERROR: could not re-stat active log ${logPath} before truncating; leaving it intact to avoid data loss: ${err.message}
+`);
+    return false;
+  }
+  if (liveBytes < snapshotBytes) {
+    process.stderr.write(`[${tag}] WARN: active log ${logPath} shrank from ${snapshotBytes} to ${liveBytes} bytes after we snapshotted it; another rotator truncated it and these rows are its, not ours — declining to truncate
+`);
+    return false;
+  }
   try {
     fs2.truncateSync(logPath, 0);
   } catch (err) {
-    process.stderr.write(`[vault-audit] ERROR: could not truncate active audit log ${logPath}: ${err.message}
+    process.stderr.write(`[${tag}] ERROR: could not truncate active log ${logPath}: ${err.message}
+`);
+    return false;
+  }
+  if (stillHeld && !stillHeld()) {
+    process.stderr.write(`[${tag}] ERROR: truncated ${logPath} after our rotation lock was reclaimed; rows another rotator wrote between our size check and our truncate are LOST
 `);
   }
+  return true;
+}
+function resolveRotationConfig(args) {
+  const env = args.env ?? process.env;
+  const envBytes = Number(env[args.envBytesVar]);
+  const envFiles = Number(env[args.envFilesVar]);
+  const maxBytes = args.maxBytes !== undefined && args.maxBytes !== 0 ? args.maxBytes : Number.isFinite(envBytes) && envBytes !== 0 ? envBytes : args.defaultBytes;
+  const maxFiles = args.maxFiles !== undefined && args.maxFiles > 0 ? args.maxFiles : Number.isFinite(envFiles) && envFiles > 0 ? envFiles : args.defaultFiles;
+  return { maxBytes, maxFiles };
+}
+
+// src/vault/broker/audit-log.ts
+function failOpenStatePath(logPath) {
+  return `${logPath}.failopen`;
+}
+function readFailOpenState(statePath) {
+  try {
+    const raw = fs3.readFileSync(statePath, "utf8");
+    const parsed = JSON.parse(raw);
+    const count = Number(parsed.failOpenCount);
+    return {
+      failOpenCount: Number.isFinite(count) && count > 0 ? count : 0,
+      lastFailureTs: typeof parsed.lastFailureTs === "string" ? parsed.lastFailureTs : undefined,
+      lastError: typeof parsed.lastError === "string" ? parsed.lastError : undefined
+    };
+  } catch {
+    return { failOpenCount: 0 };
+  }
+}
+var DEFAULT_AUDIT_MAX_BYTES = 32 * 1024 * 1024;
+var DEFAULT_AUDIT_MAX_FILES = 5;
+function resolveRotation(opts) {
+  return resolveRotationConfig({
+    maxBytes: opts.maxBytes,
+    maxFiles: opts.maxFiles,
+    envBytesVar: "SWITCHROOM_VAULT_AUDIT_MAX_BYTES",
+    envFilesVar: "SWITCHROOM_VAULT_AUDIT_MAX_FILES",
+    defaultBytes: DEFAULT_AUDIT_MAX_BYTES,
+    defaultFiles: DEFAULT_AUDIT_MAX_FILES
+  });
+}
+function rotateAuditLog(logPath, maxFiles) {
+  rotateLogFile(logPath, maxFiles, "vault-audit");
 }
 function defaultAuditLogPath() {
-  return path2.join(os2.homedir(), ".switchroom", "vault-audit.log");
+  return path3.join(os2.homedir(), ".switchroom", "vault-audit.log");
 }
 function callerFromPeer(peer) {
   if (peer.systemdUnit !== null && peer.systemdUnit.length > 0) {
@@ -20208,7 +20304,7 @@ function createAuditLogger(opts = {}) {
       lastError: String(err.message).slice(0, 300)
     };
     try {
-      fs2.writeFileSync(statePath, `${JSON.stringify(state)}
+      fs3.writeFileSync(statePath, `${JSON.stringify(state)}
 `, { mode: 384 });
     } catch (persistErr) {
       process.stderr.write(`[vault-audit] ERROR: could not persist fail-open counter ${statePath}: ${persistErr.message}
@@ -20222,7 +20318,7 @@ function createAuditLogger(opts = {}) {
     write(entry) {
       if (rotation.maxBytes > 0) {
         try {
-          const size = fs2.statSync(logPath).size;
+          const size = fs3.statSync(logPath).size;
           if (size >= rotation.maxBytes) {
             rotateAuditLog(logPath, rotation.maxFiles);
           }
@@ -20231,7 +20327,7 @@ function createAuditLogger(opts = {}) {
       const { line, next } = chainRow(chain, entry);
       let fd;
       try {
-        fd = fs2.openSync(logPath, "a", 384);
+        fd = fs3.openSync(logPath, "a", 384);
       } catch (err) {
         process.stderr.write(`[vault-audit] ERROR: could not open audit log ${logPath}: ${err.message}
 `);
@@ -20240,7 +20336,7 @@ function createAuditLogger(opts = {}) {
       }
       let durable = false;
       try {
-        fs2.writeSync(fd, line);
+        fs3.writeSync(fd, line);
         chain = next;
         durable = true;
       } catch (err) {
@@ -20249,7 +20345,7 @@ function createAuditLogger(opts = {}) {
         recordFailOpen(err);
       } finally {
         try {
-          fs2.closeSync(fd);
+          fs3.closeSync(fd);
         } catch (closeErr) {
           process.stderr.write(`[vault-audit] ERROR: could not close audit log fd: ${closeErr.message}
 `);
@@ -22168,8 +22264,8 @@ function adminOnlyKeysBeingAdded(requestedKeys, existingKeys, patterns) {
 }
 
 // src/vault/grants-db.ts
-import * as path3 from "node:path";
-import * as fs3 from "node:fs";
+import * as path4 from "node:path";
+import * as fs4 from "node:fs";
 import { Database } from "bun:sqlite";
 
 // src/vault/approvals/schema.ts
@@ -22262,12 +22358,12 @@ function isGrantsDbCorruption(err) {
 function quarantineGrantsDb(dbPath) {
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
   const quarantinePath = `${dbPath}.corrupt-${stamp}`;
-  fs3.renameSync(dbPath, quarantinePath);
+  fs4.renameSync(dbPath, quarantinePath);
   for (const suffix of WAL_SIDECAR_SUFFIXES2) {
     const sidecar = `${dbPath}${suffix}`;
-    if (fs3.existsSync(sidecar)) {
+    if (fs4.existsSync(sidecar)) {
       try {
-        fs3.renameSync(sidecar, `${quarantinePath}${suffix}`);
+        fs4.renameSync(sidecar, `${quarantinePath}${suffix}`);
       } catch {}
     }
   }
@@ -22277,7 +22373,7 @@ function openAndMigrate(dbPath) {
   const db = new Database(dbPath, { create: true });
   try {
     try {
-      fs3.chmodSync(dbPath, 384);
+      fs4.chmodSync(dbPath, 384);
     } catch {}
     db.run("PRAGMA journal_mode=WAL");
     db.run("PRAGMA busy_timeout=5000");
@@ -22293,8 +22389,8 @@ function openAndMigrate(dbPath) {
   return db;
 }
 function openGrantsDb(dbPath = DEFAULT_GRANTS_DB_PATH, opener = openAndMigrate) {
-  const dir = path3.dirname(dbPath);
-  fs3.mkdirSync(dir, { recursive: true });
+  const dir = path4.dirname(dbPath);
+  fs4.mkdirSync(dir, { recursive: true });
   migrateLegacyGrantsDbLocation(dbPath);
   try {
     return opener(dbPath);
@@ -22318,6 +22414,7 @@ function canonicalizeApproverSet(approvers) {
 }
 
 // src/vault/approvals/kernel.ts
+var ALLOW_ONCE_CONSUMED_REASON = "allow_once_consumed";
 function generateRequestId() {
   return randomBytes5(16).toString("hex");
 }
@@ -22444,6 +22541,38 @@ function evaluateDecisionRow(db, row, currentCanonical, opts, now) {
   if (decision.decision === "deny") {
     return { state: "denied", decision };
   }
+  if (decision.decision === "allow_once") {
+    const burn = db.run(`UPDATE approval_decisions
+       SET last_used_at = ?, revoked_at = ?, revoke_reason = ?
+       WHERE id = ? AND revoked_at IS NULL`, [now, now, ALLOW_ONCE_CONSUMED_REASON, decision.id]);
+    if ((burn.changes ?? 0) === 0) {
+      audit(db, "deny", {
+        agent_unit: decision.agent_unit,
+        scope: decision.scope,
+        action: decision.action,
+        decision_id: decision.id,
+        context: { reason: ALLOW_ONCE_CONSUMED_REASON }
+      });
+      return { state: "denied", decision };
+    }
+    decision.last_used_at = now;
+    decision.revoked_at = now;
+    decision.revoke_reason = ALLOW_ONCE_CONSUMED_REASON;
+    audit(db, "match", {
+      agent_unit: decision.agent_unit,
+      scope: decision.scope,
+      action: decision.action,
+      decision_id: decision.id
+    });
+    audit(db, "revoke", {
+      agent_unit: decision.agent_unit,
+      scope: decision.scope,
+      action: decision.action,
+      decision_id: decision.id,
+      context: { actor: "kernel", reason: ALLOW_ONCE_CONSUMED_REASON }
+    });
+    return { state: "granted", decision };
+  }
   if (decision.decision === "allow_ttl") {
     const maxLifetime = opts.max_ttl_lifetime_ms ?? DEFAULT_MAX_TTL_LIFETIME_MS;
     const hardCap = decision.granted_at + maxLifetime;
@@ -22512,7 +22641,8 @@ function consumeNonce(db, request_id, now = Date.now()) {
 }
 function recordDecision(db, input, now = Date.now()) {
   const id = randomUUID();
-  const ttl_expires_at = input.decision === "allow_ttl" && input.ttl_ms ? now + input.ttl_ms : null;
+  const maxLifetime = input.max_ttl_lifetime_ms ?? DEFAULT_MAX_TTL_LIFETIME_MS;
+  const ttl_expires_at = input.decision === "allow_ttl" && input.ttl_ms ? now + Math.min(input.ttl_ms, maxLifetime) : null;
   const canonical = canonicalizeApproverSet(input.approver_set);
   db.run(`INSERT INTO approval_decisions
        (id, agent_unit, scope, action, decision,
@@ -23827,10 +23957,10 @@ class VaultBroker {
         return;
       }
       try {
-        const agentsDir = this.config ? resolveAgentsDir(this.config) : path4.join(os3.homedir(), ".switchroom", "agents");
-        const tokenDir = path4.join(agentsDir, agent);
+        const agentsDir = this.config ? resolveAgentsDir(this.config) : path5.join(os3.homedir(), ".switchroom", "agents");
+        const tokenDir = path5.join(agentsDir, agent);
         mkdirSync7(tokenDir, { recursive: true });
-        const tokenPath = path4.join(tokenDir, ".vault-token");
+        const tokenPath = path5.join(tokenDir, ".vault-token");
         const tmpPath = `${tokenPath}.tmp.${process.pid}`;
         writeFileSync3(tmpPath, mintResult.token, { mode: 384 });
         renameSync8(tmpPath, tokenPath);
@@ -23892,8 +24022,8 @@ class VaultBroker {
       try {
         const row = this.grantsDb.query("SELECT agent_slug FROM vault_grants WHERE id = ?").get(id);
         if (row && AgentNameSchema.safeParse(row.agent_slug).success) {
-          const agentsDir = this.config ? resolveAgentsDir(this.config) : path4.join(os3.homedir(), ".switchroom", "agents");
-          const tokenPath = path4.join(agentsDir, row.agent_slug, ".vault-token");
+          const agentsDir = this.config ? resolveAgentsDir(this.config) : path5.join(os3.homedir(), ".switchroom", "agents");
+          const tokenPath = path5.join(agentsDir, row.agent_slug, ".vault-token");
           if (existsSync12(tokenPath)) {
             try {
               unlinkSync6(tokenPath);
@@ -24135,7 +24265,7 @@ class VaultBroker {
     if (!existsSync12(filePath))
       return false;
     try {
-      if (statSync6(filePath).size === 0)
+      if (statSync7(filePath).size === 0)
         return false;
     } catch {
       return false;
@@ -24214,12 +24344,12 @@ class VaultBroker {
 }
 function detectVaultLayoutDrift(vaultPath) {
   const dir = dirname7(vaultPath);
-  if (basename4(dir) !== "vault")
+  if (basename5(dir) !== "vault")
     return;
-  if (basename4(vaultPath) !== "vault.enc")
+  if (basename5(vaultPath) !== "vault.enc")
     return;
   const switchroomDir = dirname7(dir);
-  if (basename4(switchroomDir) !== ".switchroom")
+  if (basename5(switchroomDir) !== ".switchroom")
     return;
   const home2 = dirname7(switchroomDir);
   const result = inspectVaultLayout(home2);
@@ -24248,7 +24378,7 @@ async function main() {
   let perAgentTargets = [];
   try {
     if (existsSync12(perAgentDir)) {
-      const entries = readdirSync4(perAgentDir, { withFileTypes: true });
+      const entries = readdirSync5(perAgentDir, { withFileTypes: true });
       const flat = [];
       const subdirs = [];
       for (const e of entries) {