switchroom 0.19.30 → 0.19.32

package/dist/host-control/main.js

@@ -19060,9 +19060,9 @@ var require_commander = __commonJS((exports2) => {
 });
 
 // src/host-control/main.ts
-import { homedir as homedir7 } from "node:os";
-import { existsSync as existsSync15, readdirSync as readdirSync6 } from "node:fs";
-import { join as join13, resolve as resolve10 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { existsSync as existsSync16, readdirSync as readdirSync7 } from "node:fs";
+import { join as join14, resolve as resolve10 } from "node:path";
 
 // src/config/loader.ts
 init_zod();
@@ -21210,7 +21210,7 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.19.30";
+var VERSION = "0.19.32";
 
 // src/setup/hindsight-recall-tunables.ts
 var RECALL_DEADLINE_HEADROOM_SECONDS = 2;
@@ -21767,8 +21767,8 @@ import { createServer } from "node:net";
 import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
 import { mkdir as mkdir2, chmod, chown, unlink, appendFile } from "node:fs/promises";
 import {
-  readdirSync as readdirSync5,
-  existsSync as existsSync14,
+  readdirSync as readdirSync6,
+  existsSync as existsSync15,
   readFileSync as readFileSync11,
   writeFileSync as writeFileSync6,
   renameSync as renameSync5,
@@ -21781,7 +21781,7 @@ import {
   copyFileSync as copyFileSync3,
   unlinkSync as unlinkSync5
 } from "node:fs";
-import { join as join12, dirname as dirname9, resolve as resolve9 } from "node:path";
+import { join as join13, dirname as dirname9, resolve as resolve9 } from "node:path";
 import { createHash as createHash6, randomUUID as randomUUID2, randomBytes } from "node:crypto";
 
 // src/host-control/protocol.ts
@@ -27739,7 +27739,51 @@ function recoverPinJournal(configPath, opts = {}) {
 }
 
 // src/cli/operator-uid.ts
-function resolveOperatorUid() {
+import {
+  chownSync,
+  existsSync as existsSync12,
+  lstatSync as lstatSync2,
+  readdirSync as readdirSync5,
+  realpathSync as realpathSync2,
+  statSync as statSync7
+} from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { join as join9 } from "node:path";
+var CONTAINER_OPERATOR_HOME = "/host-home";
+var SWITCHROOM_HOME_MARKER = "switchroom.yaml";
+function operatorHomeCandidates(env, home2) {
+  const roots = [env.SWITCHROOM_HOST_HOME?.trim(), home2, CONTAINER_OPERATOR_HOME];
+  const out = [];
+  for (const r of roots) {
+    if (!r || r.length === 0)
+      continue;
+    const dir = join9(r, ".switchroom");
+    if (!out.includes(dir))
+      out.push(dir);
+  }
+  return out;
+}
+function resolveOperatorUidFromOwnership(deps = {}) {
+  const env = deps.env ?? process.env;
+  const home2 = deps.home ?? homedir6();
+  const exists = deps.exists ?? ((p) => existsSync12(p));
+  const statUid = deps.statUid ?? ((p) => {
+    try {
+      return statSync7(p).uid;
+    } catch {
+      return;
+    }
+  });
+  for (const dir of operatorHomeCandidates(env, home2)) {
+    if (!exists(join9(dir, SWITCHROOM_HOME_MARKER)))
+      continue;
+    const uid = statUid(dir);
+    if (uid !== undefined && Number.isFinite(uid) && uid > 0)
+      return uid;
+  }
+  return;
+}
+function resolveOperatorUid(ownershipDeps = {}) {
   const sudoUid = process.env.SUDO_UID;
   if (sudoUid !== undefined) {
     const parsed = parseInt(sudoUid, 10);
@@ -27757,20 +27801,20 @@ function resolveOperatorUid() {
     if (Number.isFinite(parsed) && parsed > 0)
       return parsed;
   }
-  return;
+  return resolveOperatorUidFromOwnership(ownershipDeps);
 }
 
 // src/cli/rollout.ts
 init_atomic();
 
 // src/cli/resolve-version.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
-import { dirname as dirname7, join as join9 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync9 } from "node:fs";
+import { dirname as dirname7, join as join10 } from "node:path";
 function readPackageVersion() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 12 && dir && dir !== "/"; i++) {
-    const p = join9(dir, "package.json");
-    if (existsSync12(p)) {
+    const p = join10(dir, "package.json");
+    if (existsSync13(p)) {
       try {
         const pkg = JSON.parse(readFileSync9(p, "utf-8"));
         if (pkg?.name === "switchroom" && typeof pkg.version === "string") {
@@ -27869,6 +27913,9 @@ function parseAuditLine(line) {
     entry.failed_step = o.failed_step;
   if (typeof o.failed_agent === "string")
     entry.failed_agent = o.failed_agent;
+  if (Array.isArray(o.drifted) && o.drifted.every((x) => typeof x === "string")) {
+    entry.drifted = o.drifted;
+  }
   if (typeof o.agent === "string")
     entry.agent = o.agent;
   if (typeof o.n === "number")
@@ -27900,6 +27947,7 @@ function latestRolloutRowForRequest(raw, requestId) {
 var DOCKER_INSPECT_TIMEOUT_MS = 60 * 1000;
 
 // src/cli/rollout.ts
+var VERIFY_COMPONENTS_STEP = "verify-components";
 function isVersionAssertable(target) {
   return /^v?\d+\.\d+\.\d+$/.test(target.trim());
 }
@@ -27973,7 +28021,7 @@ var ROLLOUT_RUN_TIMEOUT_MS = envMs("SWITCHROOM_ROLLOUT_RUN_TIMEOUT_MS", 20 * 60
 var ROLLOUT_PROBE_TIMEOUT_MS = envMs("SWITCHROOM_ROLLOUT_PROBE_TIMEOUT_MS", 60 * 1000);
 
 // src/cli/write-compose.ts
-import { chownSync } from "node:fs";
+import { chownSync as chownSync2 } from "node:fs";
 import { mkdir, readFile, writeFile, rename, copyFile } from "node:fs/promises";
 var AGENT_IMAGE_TAG_RE = /image:\s*\S*switchroom-agent:(\S+)/;
 var BACKUP_SUFFIX = ".bak";
@@ -28062,7 +28110,7 @@ async function restoreComposeBackup(composePath, opts = {}) {
   const operatorUid = resolveOperatorUid();
   if (operatorUid !== undefined && process.geteuid?.() === 0) {
     try {
-      chownSync(composePath, operatorUid, operatorUid);
+      chownSync2(composePath, operatorUid, operatorUid);
     } catch {}
   }
   return { restored: true, imageTag: composeImageTag(content) };
@@ -28072,8 +28120,8 @@ async function restoreComposeBackup(composePath, opts = {}) {
 var import__2 = __toESM(require_commander(), 1);
 
 // src/cli/update.ts
-import { join as join10, dirname as dirname8, resolve as resolve8 } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { join as join11, dirname as dirname8, resolve as resolve8 } from "node:path";
+import { homedir as homedir7 } from "node:os";
 
 // src/agents/lifecycle.ts
 import { execFileSync, spawn, spawnSync } from "node:child_process";
@@ -28169,7 +28217,7 @@ function getAllAgentStatuses(config) {
 
 // src/cli/update.ts
 init_atomic();
-var DEFAULT_COMPOSE_PATH = join10(homedir6(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH = join11(homedir7(), ".switchroom", "compose", "docker-compose.yml");
 var UPDATE_RESULT_SENTINEL = "SWITCHROOM_UPDATE_RESULT:";
 function parseUpdateResultLine(stdout) {
   const idx = stdout.lastIndexOf(UPDATE_RESULT_SENTINEL);
@@ -28192,9 +28240,9 @@ function parseUpdateResultLine(stdout) {
 
 // src/host-control/config-edit-validator.ts
 var import_yaml5 = __toESM(require_dist(), 1);
-import { mkdtempSync, writeFileSync as writeFileSync5, rmSync as rmSync2, existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync5, rmSync as rmSync2, existsSync as existsSync14, readFileSync as readFileSync10 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join11, isAbsolute as isAbsolute3, normalize, basename as basename4 } from "node:path";
+import { join as join12, isAbsolute as isAbsolute3, normalize, basename as basename4 } from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { isDeepStrictEqual } from "node:util";
 var MAX_PATCH_BYTES = 1024 * 1024;
@@ -28334,7 +28382,7 @@ function validateShape(unifiedDiff, targetPath) {
   return null;
 }
 function applyPatch(unifiedDiff, configPath, gitBin) {
-  if (!existsSync13(configPath)) {
+  if (!existsSync14(configPath)) {
     return {
       ok: false,
       code: "E_PATCH_APPLY_FAILED",
@@ -28342,13 +28390,13 @@ function applyPatch(unifiedDiff, configPath, gitBin) {
     };
   }
   const liveContent = readFileSync10(configPath, "utf8");
-  const scratchDir = mkdtempSync(join11(tmpdir(), "config-propose-edit-"));
+  const scratchDir = mkdtempSync(join12(tmpdir(), "config-propose-edit-"));
   try {
     const targetBasename = configPath.split("/").pop() ?? "switchroom.yaml";
-    const scratchFile = join11(scratchDir, targetBasename);
+    const scratchFile = join12(scratchDir, targetBasename);
     writeFileSync5(scratchFile, liveContent);
     const normalizedDiff = normalizeDiffHeadersToBasename(unifiedDiff, targetBasename);
-    const patchFile = join11(scratchDir, "proposal.patch");
+    const patchFile = join12(scratchDir, "proposal.patch");
     writeFileSync5(patchFile, normalizedDiff);
     const bin = gitBin ?? "git";
     const baseArgs = [
@@ -28576,7 +28624,7 @@ function validateConfigEdit(opts) {
     return schemaErr;
   let beforeData = {};
   try {
-    const beforeRaw = existsSync13(opts.configPath) ? readFileSync10(opts.configPath, "utf8") : "";
+    const beforeRaw = existsSync14(opts.configPath) ? readFileSync10(opts.configPath, "utf8") : "";
     const beforeDoc = import_yaml5.parseDocument(beforeRaw, { merge: false, strict: false });
     beforeData = beforeDoc.toJS();
   } catch {
@@ -28917,8 +28965,8 @@ function etaLine(s) {
 function deferredLines(target) {
   const bare = target.trim().replace(/^v/, "");
   return [
-    `**Deferred (still on the prior version — run host-side):**`,
-    `- \`switchroom-web\` — \`switchroom webd install --tag ${target}\``,
+    `**Verified on ${target}** — every component this roll owned passed \`verify-components\`, so this is host convergence, not just the agents. Anything the roll was told to skip is named in its warnings.`,
+    `**Still host-side (nothing in a roll can do these):**`,
     `- host operator CLI — \`sudo npm i -g switchroom@${bare}\``,
     `- hostd template regen (only if the release changed hostd mounts/env) — \`switchroom hostd install --tag ${target}\``
   ];
@@ -28948,6 +28996,21 @@ function renderWith(s, compact) {
     if (s.deferred !== false)
       parts2.push("", ...deferredLines(s.target));
     return parts2.join(`
+`);
+  }
+  if (s.terminal === "error" && s.failedStep === VERIFY_COMPONENTS_STEP) {
+    const drifted = s.drifted ?? [];
+    const parts2 = [headerLine(s, "⚠️")];
+    let summary = `**INCOMPLETE** — ${rolledCount}${s.m !== undefined ? `/${s.m}` : ""} ` + `agent(s) reached ${s.target}`;
+    if (elapsedMs !== undefined)
+      summary += ` in ${formatDurationMs(elapsedMs)}`;
+    summary += `, but the host did NOT fully converge.`;
+    parts2.push(summary);
+    parts2.push("", `**Still behind ${s.target}:** ` + (drifted.length > 0 ? drifted.map((d) => `\`${d}\``).join(", ") : "one or more components (see the roll's warnings)"));
+    parts2.push("", `Re-running the roll will NOT fix this — the agents are already on ` + `target. Finish the stale component(s), then \`switchroom update --check\`.`);
+    if (checklist.length > 0)
+      parts2.push("", ...checklist);
+    return parts2.join(`
 `);
   }
   if (s.terminal === "error") {
@@ -29078,9 +29141,9 @@ function resolveDigests(imageRefs) {
   return out;
 }
 function readCachedInstallType(bindRoot) {
-  const cacheDir = join12(bindRoot, ".switchroom");
-  const cachePath = join12(cacheDir, "install-type.json");
-  if (existsSync14(cachePath)) {
+  const cacheDir = join13(bindRoot, ".switchroom");
+  const cachePath = join13(cacheDir, "install-type.json");
+  if (existsSync15(cachePath)) {
     try {
       const raw = readFileSync11(cachePath, "utf-8");
       const parsed = JSON.parse(raw);
@@ -29169,7 +29232,7 @@ class HostdServer {
   fleetMutationInFlight = null;
   lastAutoRolloutFailedPin = null;
   autoRolloutLatchPath() {
-    return join12(this.hostdDirPath(), AUTO_ROLLOUT_LATCH_FILENAME);
+    return join13(this.hostdDirPath(), AUTO_ROLLOUT_LATCH_FILENAME);
   }
   readAutoRolloutLatch() {
     try {
@@ -29212,7 +29275,7 @@ class HostdServer {
     return resolveHostdConfigPath(this.opts.configPath);
   }
   fleetComposePath() {
-    return join12(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
+    return join13(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
   }
   recoverRolloutPinJournal(context) {
     let note = null;
@@ -29251,7 +29314,7 @@ class HostdServer {
     return note;
   }
   async start() {
-    const hostdDir = join12(this.opts.homeDir, ".switchroom", "hostd");
+    const hostdDir = join13(this.opts.homeDir, ".switchroom", "hostd");
     await mkdir2(hostdDir, { recursive: true });
     await chmod(hostdDir, 493).catch(() => {
       return;
@@ -29272,13 +29335,13 @@ class HostdServer {
     }
     try {
       for (const name of agentNames) {
-        const dir = join12(hostdDir, name);
-        const sockPath = join12(dir, "sock");
+        const dir = join13(hostdDir, name);
+        const sockPath = join13(dir, "sock");
         await mkdir2(dir, { recursive: true });
         await chmod(dir, 493).catch(() => {
           return;
         });
-        if (existsSync14(sockPath))
+        if (existsSync15(sockPath))
           await unlink(sockPath).catch(() => {
             return;
           });
@@ -29309,13 +29372,13 @@ class HostdServer {
           process.stderr.write(`hostd: SWITCHROOM_HOSTD_OPERATOR_UID='${opUidStr}' is not a positive integer; skipping operator listener
 `);
         } else {
-          const dir = join12(hostdDir, "operator");
-          const sockPath = join12(dir, "sock");
+          const dir = join13(hostdDir, "operator");
+          const sockPath = join13(dir, "sock");
           await mkdir2(dir, { recursive: true });
           await chmod(dir, 493).catch(() => {
             return;
           });
-          if (existsSync14(sockPath))
+          if (existsSync15(sockPath))
             await unlink(sockPath).catch(() => {
               return;
             });
@@ -29351,7 +29414,7 @@ class HostdServer {
   }
   async reconcileOrphanedFleetMutations() {
     const path3 = this.auditLogPath();
-    if (!existsSync14(path3))
+    if (!existsSync15(path3))
       return;
     let raw;
     try {
@@ -29754,11 +29817,11 @@ class HostdServer {
   missingApplyAssets() {
     const root = this.opts.applyAssetsRoot ?? resolve9(import.meta.dirname, "../..");
     return [
-      join12(root, "profiles"),
-      join12(root, "profiles", "default"),
-      join12(root, "vendor", "hindsight-memory"),
-      join12(root, "skills")
-    ].filter((p) => !existsSync14(p));
+      join13(root, "profiles"),
+      join13(root, "profiles", "default"),
+      join13(root, "vendor", "hindsight-memory"),
+      join13(root, "skills")
+    ].filter((p) => !existsSync15(p));
   }
   applyAssetPreflight(request_id, started) {
     const missing = this.missingApplyAssets();
@@ -30021,16 +30084,16 @@ class HostdServer {
     return entry;
   }
   hostdDirPath() {
-    return join12(this.opts.homeDir, ".switchroom", "hostd");
+    return join13(this.opts.homeDir, ".switchroom", "hostd");
   }
   hostdDirHostPath() {
     const hostHome = this.opts.hostHomeDir ?? process.env.SWITCHROOM_HOST_HOME?.trim() ?? this.opts.homeDir;
-    return join12(hostHome, ".switchroom", "hostd");
+    return join13(hostHome, ".switchroom", "hostd");
   }
   async beginSelfBump(req, caller, started) {
     const ownVersion = this.opts.selfVersion ?? SWITCHROOM_VERSION;
-    const composePath = join12(this.hostdDirPath(), "docker-compose.yml");
-    if (!existsSync14(composePath)) {
+    const composePath = join13(this.hostdDirPath(), "docker-compose.yml");
+    if (!existsSync15(composePath)) {
       return deniedResponse(req.request_id, `rollout: hostd's CLI (v${ownVersion}) is older than the target ` + `${req.args.pin} and needs a self-bump first, but its compose file ` + `is missing at ${composePath}. Run \`switchroom hostd install ` + `--tag ${req.args.pin}\` on the host, then re-run the roll. ` + `Nothing was changed.`, Date.now() - started);
     }
     const before = readFileSync11(composePath, "utf8");
@@ -30052,12 +30115,12 @@ class HostdServer {
     const ts = new Date().toISOString().replace(/[:.]/g, "-");
     const bakPath = `${composePath}.bak-selfbump-${ts}`;
     try {
-      const baks = readdirSync5(this.hostdDirPath()).filter((f) => f.startsWith("docker-compose.yml.bak-selfbump-")).sort();
+      const baks = readdirSync6(this.hostdDirPath()).filter((f) => f.startsWith("docker-compose.yml.bak-selfbump-")).sort();
       for (const f of baks.slice(0, Math.max(0, baks.length - 4))) {
-        unlinkSync5(join12(this.hostdDirPath(), f));
+        unlinkSync5(join13(this.hostdDirPath(), f));
       }
     } catch {}
-    const markerPath = join12(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+    const markerPath = join13(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
     const marker = {
       v: 1,
       request_id: req.request_id,
@@ -30141,7 +30204,7 @@ class HostdServer {
       rollbackBump();
       entry.result = "error";
       entry.finished_at = Date.now();
-      entry.error = `self-bump helper failed (container exit ${Number.isFinite(code) ? code : "unknown"}). ` + `See ${join12(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)} on the host. ` + `Compose bump rolled back. Fallback: \`switchroom hostd install ` + `--tag ${req.args.pin}\` host-side, then re-run the roll.`;
+      entry.error = `self-bump helper failed (container exit ${Number.isFinite(code) ? code : "unknown"}). ` + `See ${join13(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)} on the host. ` + `Compose bump rolled back. Fallback: \`switchroom hostd install ` + `--tag ${req.args.pin}\` host-side, then re-run the roll.`;
       if (this.fleetMutationInFlight && this.fleetMutationInFlight.request_id === entry.request_id) {
         this.fleetMutationInFlight = null;
       }
@@ -30165,8 +30228,8 @@ class HostdServer {
     };
   }
   async resumePendingSelfBumpRollout() {
-    const markerPath = join12(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
-    if (!existsSync14(markerPath))
+    const markerPath = join13(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+    if (!existsSync15(markerPath))
       return;
     let raw;
     try {
@@ -30221,7 +30284,7 @@ class HostdServer {
       return;
     }
     if (needsSelfBump(ownVersion, marker.pin)) {
-      await failResume(`hostd is still on v${ownVersion} after the self-bump to ` + `${marker.pin} (helper failed? see ` + `${join12(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)}). ` + `Fallback: \`switchroom hostd install --tag ${marker.pin}\` ` + `host-side, then re-issue the rollout.`);
+      await failResume(`hostd is still on v${ownVersion} after the self-bump to ` + `${marker.pin} (helper failed? see ` + `${join13(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)}). ` + `Fallback: \`switchroom hostd install --tag ${marker.pin}\` ` + `host-side, then re-issue the rollout.`);
       return;
     }
     process.stderr.write(`hostd: resuming rollout ${marker.request_id} → ${marker.pin} after ` + `self-bump (v${marker.prior_hostd_version} → v${ownVersion})
@@ -30741,8 +30804,8 @@ ${output.recovery.stderr}` : "";
     if (this.opts.imageRefsForDigests)
       return this.opts.imageRefsForDigests();
     try {
-      const composePath = join12(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
-      if (!existsSync14(composePath))
+      const composePath = join13(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
+      if (!existsSync15(composePath))
         return [];
       const r = spawnSync3("docker", [
         "compose",
@@ -30813,6 +30876,9 @@ ${output.recovery.stderr}` : "";
           entry.failed_step = parsed.failedStep;
         if (parsed.failedAgent)
           entry.failed_agent = parsed.failedAgent;
+        if (parsed.drifted && parsed.drifted.length > 0) {
+          entry.drifted = parsed.drifted;
+        }
         if (parsed.got !== undefined)
           entry.got = parsed.got;
         if (parsed.timedOut)
@@ -30868,7 +30934,10 @@ ${pinNote}`.trim();
     });
   }
   async finishFailedAutoRollout(entry, priorPin) {
-    const notes = [
+    const drifted = entry.drifted ?? [];
+    const notes = entry.failed_step === "verify-components" ? [
+      `Unattended auto-update roll to ${entry.pin ?? "?"} rolled ` + `${(entry.rolled ?? []).length} agent(s) but did NOT converge the ` + `whole host: ${drifted.join(", ") || "one or more components"} ` + `still behind. Re-running the roll will not fix this — run the ` + `per-component install named in the rollout warnings, then ` + `\`switchroom update --check\` to confirm.`
+    ] : [
       `Unattended auto-update roll to ${entry.pin ?? "?"} FAILED at ` + `${entry.failed_step ?? "unknown step"}` + `${entry.failed_agent ? ` (agent ${entry.failed_agent})` : ""}. ` + `Unattended retries of this version are disabled; fix the cause, ` + `then roll manually (\`switchroom rollout --pin ${entry.pin ?? "vX.Y.Z"}\`).`
     ];
     try {
@@ -30891,6 +30960,10 @@ ${pinNote}`.trim();
   async recoverFailedAutoRollout(entry, priorPin) {
     const notes = [];
     const rolledCount = (entry.rolled ?? []).length;
+    if (entry.failed_step === "verify-components") {
+      notes.push(`No automatic rollback: the agent fleet reached ` + `${entry.pin ?? "the target"} and the pin is committed — the gap is ` + `${(entry.drifted ?? []).join(", ") || "a component"}, not the fleet. ` + `Rolling back would move working agents backwards; converge the ` + `named component(s) forward instead.`);
+      return notes;
+    }
     const beforeAnyAgent = entry.failed_step === "apply" || entry.failed_step === "restart-agent" && rolledCount === 0;
     if (!beforeAnyAgent) {
       notes.push(rolledCount > 0 ? `No automatic rollback: ${rolledCount} agent(s) already confirmed on ` + `${entry.pin ?? "the target"} past a green canary ` + `(${(entry.rolled ?? []).join(", ")}). The fleet is mixed — ` + `finish the roll or roll back manually.` : `No automatic rollback: the roll stopped at ` + `${entry.failed_step ?? "an unknown step"} before any change ` + `landed — nothing to revert. Verify host-side if unsure.`);
@@ -30937,7 +31010,8 @@ ${pinNote}`.trim();
         ...entry.finished_at !== null ? { elapsedMs: entry.finished_at - entry.started_at } : {},
         ...entry.failed_step ? { failedStep: entry.failed_step } : {},
         ...entry.failed_agent ? { failedAgent: entry.failed_agent } : {},
-        ...entry.got !== undefined ? { got: entry.got } : {}
+        ...entry.got !== undefined ? { got: entry.got } : {},
+        ...entry.drifted && entry.drifted.length > 0 ? { drifted: entry.drifted } : {}
       });
       this.opts.rolloutRelay.postTerminal({
         requestId: entry.request_id,
@@ -30975,7 +31049,7 @@ ${pinNote}`.trim();
   }
   rolloutRowExistsInLog(targetRequestId) {
     const path3 = this.auditLogPath();
-    if (!existsSync14(path3))
+    if (!existsSync15(path3))
       return false;
     try {
       const raw = readFileSync11(path3, "utf-8");
@@ -30986,7 +31060,7 @@ ${pinNote}`.trim();
   }
   rolloutStatusFromLog(responseRequestId, targetRequestId, started) {
     const path3 = this.auditLogPath();
-    if (!existsSync14(path3))
+    if (!existsSync15(path3))
       return null;
     let raw;
     try {
@@ -31006,6 +31080,7 @@ ${pinNote}`.trim();
       ...row.agent ? { agent: row.agent } : {},
       ...row.failed_step ? { failedStep: row.failed_step } : {},
       ...row.failed_agent ? { failedAgent: row.failed_agent } : {},
+      ...row.drifted && row.drifted.length > 0 ? { drifted: row.drifted } : {},
       ...row.pin ? { pin: row.pin } : {},
       ...row.prior_pin ? { prior_pin: row.prior_pin } : {}
     });
@@ -31028,6 +31103,7 @@ ${pinNote}`.trim();
       ...entry.failed_step ? { failedStep: entry.failed_step } : {},
       ...entry.failed_agent ? { failedAgent: entry.failed_agent } : {},
       ...entry.got !== undefined ? { got: entry.got } : {},
+      ...entry.drifted && entry.drifted.length > 0 ? { drifted: entry.drifted } : {},
       ...entry.pin ? { pin: entry.pin } : {},
       ...entry.prior_pin ? { prior_pin: entry.prior_pin } : {}
     }) : undefined;
@@ -31069,7 +31145,7 @@ ${pinNote}`.trim();
     }
   }
   auditLogPath() {
-    return this.opts.auditLogPath ?? join12(this.opts.homeDir, ".switchroom", "host-control-audit.log");
+    return this.opts.auditLogPath ?? join13(this.opts.homeDir, ".switchroom", "host-control-audit.log");
   }
   maybeRotateAuditLog(path3) {
     const { maxBytes, maxFiles } = resolveRotationConfig({
@@ -31139,6 +31215,7 @@ ${pinNote}`.trim();
       ...entry.rolled ? { rolled: entry.rolled } : {},
       ...entry.failed_step ? { failed_step: entry.failed_step } : {},
       ...entry.failed_agent ? { failed_agent: entry.failed_agent } : {},
+      ...entry.drifted && entry.drifted.length > 0 ? { drifted: entry.drifted } : {},
       ...entry.got !== undefined ? { got: entry.got } : {},
       ...entry.deferred ? { deferred: entry.deferred } : {},
       ...entry.prior_pin ? { prior_pin: entry.prior_pin } : {}
@@ -31856,6 +31933,7 @@ class LogTailRolloutNarrator {
         ...entry.failed_step ? { failedStep: entry.failed_step } : {},
         ...entry.failed_agent ? { failedAgent: entry.failed_agent } : {},
         ...entry.got !== undefined ? { got: entry.got } : {},
+        ...entry.drifted && entry.drifted.length > 0 ? { drifted: entry.drifted } : {},
         ...st.agents.length > 0 ? { agents: st.agents } : {},
         ...st.render.m !== undefined ? { m: st.render.m } : {},
         requestId: entry.request_id,
@@ -32495,7 +32573,7 @@ import { appendFile as appendFile2 } from "node:fs/promises";
 async function loadConfigResilient() {
   try {
     const config = loadConfig();
-    clearStaleDegradedMarker(homedir7(), (m) => process.stderr.write(`hostd: ${m}
+    clearStaleDegradedMarker(homedir8(), (m) => process.stderr.write(`hostd: ${m}
 `));
     return config;
   } catch (err2) {
@@ -32507,13 +32585,13 @@ async function loadConfigResilient() {
     } catch {
       configPath = undefined;
     }
-    const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join13(homedir7(), ".switchroom", "agents");
+    const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join14(homedir8(), ".switchroom", "agents");
     const listGatewayCandidates = () => {
       const out = [];
       try {
-        for (const name of readdirSync6(agentsDir).sort()) {
+        for (const name of readdirSync7(agentsDir).sort()) {
           const sock = resolve10(agentsDir, name, "telegram", "gateway.sock");
-          if (existsSync15(sock))
+          if (existsSync16(sock))
             out.push({ agent: name, sock });
         }
       } catch {}
@@ -32536,7 +32614,7 @@ async function loadConfigResilient() {
     };
     return waitForConfigRecovery({
       initialError: err2,
-      homeDir: homedir7(),
+      homeDir: homedir8(),
       loadFn: () => loadConfig(),
       configPath,
       notify,
@@ -32560,10 +32638,10 @@ async function main() {
 `);
     process.exit(2);
   }
-  const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join13(homedir7(), ".switchroom", "agents");
+  const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join14(homedir8(), ".switchroom", "agents");
   const resolveGatewaySocket = (agentName) => {
     const sock = resolve10(agentsDir, agentName, "telegram", "gateway.sock");
-    return existsSync15(sock) ? sock : null;
+    return existsSync16(sock) ? sock : null;
   };
   const approvalGateway = new SocketApprovalGateway({
     resolveGatewaySocket,
@@ -32582,7 +32660,7 @@ async function main() {
   }), { log: (m) => process.stderr.write(`hostd: rollout-narration — ${m}
 `) });
   const server = new HostdServer({
-    homeDir: homedir7(),
+    homeDir: homedir8(),
     agentUids,
     config: {
       agents: Object.fromEntries(Object.entries(config.agents).map(([n, a]) => [
@@ -32611,7 +32689,7 @@ async function main() {
   const autoRel = config.host_control?.auto_release_check;
   const watcherMode = resolveReleaseWatcherMode(config);
   if (watcherMode.mode !== "off") {
-    const eventsLog = join13(homedir7(), ".switchroom", "release-watcher-events.jsonl");
+    const eventsLog = join14(homedir8(), ".switchroom", "release-watcher-events.jsonl");
     const log = (m) => {
       process.stderr.write(`hostd: ${m}
 `);
@@ -32670,7 +32748,7 @@ async function main() {
 `);
         } else
           notifier = new UpdateNotifier({
-            statePath: join13(homedir7(), ".switchroom", "release-notify-state.json"),
+            statePath: join14(homedir8(), ".switchroom", "release-notify-state.json"),
             repostSuppressMs: cardTimeoutMs,
             isFleetMutationInFlight: () => server.isFleetMutationLocked(),
             startApply: (requestId) => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.19.30",
+  "version": "0.19.32",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/_base/cron-session.sh.hbs

@@ -127,7 +127,11 @@ if [ -n "${SWITCHROOM_LITELLM:-}" ] && command -v switchroom >/dev/null 2>&1; th
   sr_ll_ok=""
   sr_ll_unreachable=""
   if [ -z "$sr_ll_key" ]; then
-    echo "litellm(cron): no virtual key for '{{name}}' — falling back to direct OAuth (untracked, unguarded)" >&2
+    # Remediation, not just diagnosis. Unlike start.sh this block re-runs on
+    # EVERY fire, so no restart is needed — a provisioned key is picked up by
+    # the next fire on its own. Say that, so the operator does not bounce the
+    # agent chasing a cron-only problem.
+    echo "litellm(cron): no virtual key for '{{name}}' — falling back to direct OAuth (untracked, unguarded). FIX: re-run 'switchroom apply' to provision the key; the next fire picks it up (no restart needed)." >&2
   elif command -v curl >/dev/null 2>&1 && [ -n "$ANTHROPIC_BASE_URL" ]; then
     # Bounded retry probe — short budget for cron latency (3 attempts,
     # worst-case ~25s: 3×5s curl timeouts + 2×5s sleeps).

package/profiles/_base/start.sh.hbs

@@ -108,7 +108,13 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
     sr_ll_ok=""
     sr_ll_unreachable=""
     if [ -z "$sr_ll_key" ]; then
-      echo "litellm(outer): WARNING — no virtual key for agent '$SWITCHROOM_AGENT_NAME'; gateway falling back to direct Anthropic OAuth (untracked, unguarded)." >&2
+      # Say what to DO, not just what happened: the fail-open is a BOOT-TIME
+      # decision that is never re-evaluated, so provisioning the key later
+      # changes nothing until the agent is restarted. An operator who reads
+      # only "untracked" and provisions a key reasonably assumes it took
+      # effect; it did not. `switchroom doctor` carries the standing version
+      # of this signal (it reads .routing-mode) once the boot log has rotated.
+      echo "litellm(outer): WARNING — no virtual key for agent '$SWITCHROOM_AGENT_NAME'; gateway falling back to direct Anthropic OAuth (untracked, unguarded). FIX: re-run 'switchroom apply' to provision the key, then RESTART this agent — the fail-open is decided once at boot and is never re-evaluated for the life of the session." >&2
     elif command -v curl >/dev/null 2>&1 && [ -n "$ANTHROPIC_BASE_URL" ]; then
       # Bounded retry probe (co-boot race fix, 2026-07): when the whole stack
       # co-boots, the litellm proxy's heavy Python app is often not yet healthy
@@ -1563,6 +1569,14 @@ if [ -n "${SWITCHROOM_LITELLM:-}" ] && command -v switchroom >/dev/null 2>&1; th
     echo "WARNING: no litellm virtual key for agent '$SWITCHROOM_AGENT_NAME'." >&2
     echo "WARNING: falling back to direct Anthropic OAuth (untracked, unguarded)" >&2
     echo "WARNING: — cannot authenticate to the proxy without a key." >&2
+    # Remediation, not just diagnosis. The fail-open is decided ONCE here and
+    # never re-evaluated, so a key provisioned mid-session is inert — an
+    # operator who is not told that will provision one and believe the agent
+    # healed. `switchroom doctor` reads .routing-mode for the standing version
+    # of this signal, since this banner only lives in a rotating boot log.
+    echo "WARNING: FIX: re-run 'switchroom apply' to provision the key, then" >&2
+    echo "WARNING: RESTART this agent — the fail-open is decided once at boot" >&2
+    echo "WARNING: and is never re-evaluated for the life of this session." >&2
     echo "==========================================================" >&2
   elif command -v curl >/dev/null 2>&1 && [ -n "$ANTHROPIC_BASE_URL" ]; then
     # Bounded retry probe (co-boot race fix, 2026-07): when the whole stack