switchroom 0.19.35 → 0.19.36

package/dist/host-control/main.js

@@ -21311,7 +21311,7 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.19.35";
+var VERSION = "0.19.36";
 
 // src/setup/hindsight-recall-tunables.ts
 var RECALL_DEADLINE_HEADROOM_SECONDS = 2;
@@ -27290,16 +27290,22 @@ var STRUCTURED_PATTERNS = [
   },
   {
     rule_id: "bearer_auth_header",
-    regex: /Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)/g,
+    regex: /Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)/gi,
     captureIndex: 1,
     slugHint: "bearer_token"
   },
   {
     rule_id: "bearer_loose",
-    regex: /\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b/g,
+    regex: /\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b/gi,
     captureIndex: 1,
     slugHint: "bearer_token"
   },
+  {
+    rule_id: "basic_auth_header",
+    regex: /Authorization\s*[:=]\s*Basic\s+([A-Za-z0-9+/=]{8,})/gi,
+    captureIndex: 1,
+    slugHint: "basic_auth"
+  },
   {
     rule_id: "pem_private_key",
     regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----/g,
@@ -27358,9 +27364,108 @@ function shannonEntropy(s) {
   return h;
 }
 
+// telegram-plugin/secret-detect/inert-values.ts
+var INERT_VALUE_RE = [
+  /^\[REDACTED(?::[A-Za-z0-9_]+)?\]$/i,
+  /^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/,
+  /^\{\{[^\n\r\u2028\u2029]*\}\}$/,
+  /^<[^<>\n\r\u2028\u2029]*>$/,
+  /^%[A-Za-z_][A-Za-z0-9_]*%$/,
+  /^vault:[A-Za-z0-9_./-]*$/i,
+  /^[*x•.]+$/i,
+  /^(?:process\.env|import\.meta\.env|os\.environ)(?:\.[A-Za-z_$][A-Za-z0-9_$]*|\[["']?[A-Za-z_$][A-Za-z0-9_$]*["']?\])*$/,
+  /^(?:changeme|change-me|replaceme|replace-me|placeholder|todo|tbd|yourkey|your-key|yourpassword|your-password|yoursecret|your-secret|yourtoken|your-token)(?:[-_][A-Za-z0-9-]+)?$/i,
+  /^[a-z]+(?: [a-z]+){2,}$/
+];
+var CREDENTIAL_RUN_RE = /[A-Za-z0-9]{12,}/g;
+var MIXED_CLASS_RUN_MIN = 12;
+var SINGLE_CLASS_RUN_MIN = 16;
+function runIsCredentialShaped(run) {
+  let classes = 0;
+  if (/[a-z]/.test(run))
+    classes++;
+  if (/[A-Z]/.test(run))
+    classes++;
+  if (/[0-9]/.test(run))
+    classes++;
+  return run.length >= (classes >= 2 ? MIXED_CLASS_RUN_MIN : SINGLE_CLASS_RUN_MIN);
+}
+function hasCredentialShapedRun(value) {
+  for (const run of value.match(CREDENTIAL_RUN_RE) ?? []) {
+    if (runIsCredentialShaped(run))
+      return true;
+  }
+  return false;
+}
+function isInertValue(value) {
+  if (!INERT_VALUE_RE.some((re) => re.test(value)))
+    return false;
+  return !hasCredentialShapedRun(value);
+}
+var INERT_GATED_RULES = new Set([
+  "env_key_value",
+  "json_secret_field",
+  "cli_flag"
+]);
+var TRAILING_PUNCT_RE = /[.,;:!?)\]}]+$/;
+function stripTrailingPunctuation(value) {
+  return value.replace(TRAILING_PUNCT_RE, "");
+}
+
 // telegram-plugin/secret-detect/kv-scanner.ts
 var KV_RE = /\b([A-Za-z_][A-Za-z0-9_-]*(?:password|passwd|token|secret|key|api[_-]?key))\s*[:=]\s*["']?([^\s"'\\]{8,})["']?/gi;
 var KV_ENTROPY_THRESHOLD = 4;
+var MEMORABLE_PW_RE = /\b([A-Za-z0-9_-]*(?:password|passwd|passphrase|pwd))\b\s*(?:[:=]\s*|\s+is\s+)(["']?)([^\s"']{8,64})\2/gi;
+var MEMORABLE_PW_RULE_ID = "memorable_password";
+var MEMORABLE_PW_MIN_CLASSES = 2;
+function charClassCount(value) {
+  let n = 0;
+  if (/[a-z]/.test(value))
+    n++;
+  if (/[A-Z]/.test(value))
+    n++;
+  if (/[0-9]/.test(value))
+    n++;
+  if (/[^A-Za-z0-9]/.test(value))
+    n++;
+  return n;
+}
+function looksLikeMemorablePassword(value) {
+  if (isInertValue(value))
+    return false;
+  const core = stripTrailingPunctuation(value);
+  if (core.length < 8 || core.length > 64)
+    return false;
+  if (isInertValue(core))
+    return false;
+  if (new Set(core).size < 4)
+    return false;
+  return charClassCount(core) >= MEMORABLE_PW_MIN_CLASSES;
+}
+function scanMemorablePasswords(text) {
+  const hits = [];
+  MEMORABLE_PW_RE.lastIndex = 0;
+  let m;
+  while ((m = MEMORABLE_PW_RE.exec(text)) !== null) {
+    const keyName = m[1];
+    const value = m[3];
+    if (!value || !looksLikeMemorablePassword(value))
+      continue;
+    const valueOffsetInMatch = m[0].indexOf(value, keyName.length);
+    if (valueOffsetInMatch < 0)
+      continue;
+    const start = m.index + valueOffsetInMatch;
+    hits.push({
+      rule_id: MEMORABLE_PW_RULE_ID,
+      start,
+      end: start + value.length,
+      matched_text: value,
+      key_name: keyName,
+      confidence: "ambiguous"
+    });
+  }
+  return hits;
+}
 function scanKeyValue(text) {
   const hits = [];
   KV_RE.lastIndex = 0;
@@ -27369,6 +27474,8 @@ function scanKeyValue(text) {
     const [, keyName, value] = m;
     if (!value)
       continue;
+    if (isInertValue(value))
+      continue;
     const h = shannonEntropy(value);
     if (h < KV_ENTROPY_THRESHOLD)
       continue;
@@ -27389,6 +27496,37 @@ function scanKeyValue(text) {
   return hits;
 }
 
+// telegram-plugin/secret-detect/db-uri.ts
+var DB_URI_RE = /\b([a-zA-Z][a-zA-Z0-9+.-]+):\/\/([^\s:/@]+):([^\s/?#]+)@([^\s/@?#]+)/g;
+var DB_URI_RULE_ID = "db_uri_password";
+function isInertPassword(value) {
+  if (value.startsWith("[REDACTED"))
+    return true;
+  return /^[*x]+$/i.test(value);
+}
+function scanDbUris(text) {
+  const hits = [];
+  DB_URI_RE.lastIndex = 0;
+  let m;
+  while ((m = DB_URI_RE.exec(text)) !== null) {
+    const scheme = m[1];
+    const user = m[2];
+    const password = m[3];
+    if (isInertPassword(password))
+      continue;
+    const start = m.index + scheme.length + 3 + user.length + 1;
+    hits.push({
+      rule_id: DB_URI_RULE_ID,
+      start,
+      end: start + password.length,
+      matched_text: password,
+      key_name: `${scheme}_password`,
+      confidence: "ambiguous"
+    });
+  }
+  return hits;
+}
+
 // telegram-plugin/secret-detect/generic-entropy.ts
 var CANDIDATE_RE = /[A-Za-z0-9]{28,}/g;
 var GENERIC_MIN_DISTINCT = 18;
@@ -27562,6 +27700,8 @@ function detectSecrets(text) {
         const globalStart = win.offset + matchStart;
         const globalEnd = globalStart + cap.length;
         const keyName = p.rule_id === "env_key_value" ? m[1] : undefined;
+        if (INERT_GATED_RULES.has(p.rule_id) && isInertValue(cap))
+          continue;
         if (p.rule_id === "env_key_value") {
           const ENV_KV_MIN_LEN = 12;
           const ENV_KV_MIN_ENTROPY = 3.5;
@@ -27584,6 +27724,12 @@ function detectSecrets(text) {
     for (const h of kvHits) {
       raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
     }
+    for (const h of scanDbUris(win.text)) {
+      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
+    }
+    for (const h of scanMemorablePasswords(win.text)) {
+      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
+    }
     const genHits = scanGenericSecrets(win.text);
     for (const h of genHits) {
       raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.19.35",
+  "version": "0.19.36",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {
@@ -28,8 +28,10 @@
     "test:vitest": "vitest run",
     "test:bun": "bun test telegram-plugin/tests/agent-state-dir-preload.test.ts telegram-plugin/tests/catch-all-forwarded-history.test.ts src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-scope-persist.test.ts src/vault/broker/server-tokenless-scope.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/self-approval-bypass.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:watch": "vitest",
-    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-test-runner-coverage.mjs && node scripts/check-bun-module-mock-scope.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-auth-test-hermeticity.mjs && node scripts/check-agent-state-dir-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-mcp-instructions-budget.mjs && node scripts/check-web-subscription-honest.mjs && node scripts/check-no-unpinned-npx-playwright.mjs && node scripts/check-gateway-line-ratchet.mjs && node scripts/check-retry-flood-hooks.mjs && node scripts/check-callback-ctx-wrapping.mjs && node scripts/check-status-pin-single-path.mjs && node scripts/check-litellm-config-guard.mjs && node scripts/check-release-asset-names.mjs && node scripts/check-agent-attribution-trailers.mjs",
+    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-test-runner-coverage.mjs && node scripts/check-bun-module-mock-scope.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-auth-test-hermeticity.mjs && node scripts/check-agent-state-dir-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-mcp-instructions-budget.mjs && node scripts/check-web-subscription-honest.mjs && node scripts/check-no-unpinned-npx-playwright.mjs && node scripts/check-gateway-line-ratchet.mjs && node scripts/check-retry-flood-hooks.mjs && node scripts/check-callback-ctx-wrapping.mjs && node scripts/check-status-pin-single-path.mjs && node scripts/check-litellm-config-guard.mjs && node scripts/check-release-asset-names.mjs && node scripts/check-agent-attribution-trailers.mjs && node scripts/check-hindsight-write-redaction.mjs && bun scripts/check-secret-pattern-parity.ts",
     "lint:tsc": "tsc --noEmit",
+    "lint:hindsight-write-redaction": "node scripts/check-hindsight-write-redaction.mjs",
+    "lint:secret-pattern-parity": "bun scripts/check-secret-pattern-parity.ts",
     "lint:plugin-references": "node scripts/check-plugin-references.mjs",
     "lint:bot-api-wrapping": "bash scripts/check-bot-api-wrapping.sh",
     "lint:bun-test-imports": "node scripts/check-bun-test-imports.mjs",

package/profiles/_base/start.sh.hbs

@@ -390,6 +390,10 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
   # ephemeral). Refresh-or-remove every boot so a stale snapshot can never
   # re-apply a consumed override on a later restart.
   rm -f "{{agentDir}}/.session-model.boot-snapshot" "{{agentDir}}/.session-model-boot-attempts.boot-snapshot"
+  # Resolution runs later, after the bounded LiteLLM probe. Remove the prior
+  # boot's completion barrier before forking the gateway so it cannot consume
+  # stale active-model/effort/alert files while this boot is still resolving.
+  rm -f "{{agentDir}}/.session-model-resolved"
   if [ -f "{{agentDir}}/.session-model" ]; then
     # A failed copy (ENOSPC, perms) must not be a SILENT drop — the resolution
     # block still falls back to the live carrier, but the gateway may consume
@@ -1954,6 +1958,13 @@ rm -f "{{agentDir}}/.session-model.boot-snapshot" "{{agentDir}}/.session-model-b
 # this guard covers only the configured default, which the live-config read
 # above makes a mainline path (pinning `model: fable` in yaml is the normal
 # way to run Fable).
+#
+# Snapshot the resolved model BEFORE this guard can rewrite it. _DECLARED_
+# ROUTING (below) must reflect this boot's actual INTENT — the resolved
+# override or configured default — not a post-demotion landing, or the exact
+# divergence this file exists to catch (missing key silently demoting
+# fable → opus) becomes invisible to the check built to catch it.
+_DECLARED_MODEL="$_EFFECTIVE_MODEL"
 case "$_EFFECTIVE_MODEL" in
   fable|claude-fable-5)
     if [ -z "$_LITELLM_OK" ]; then
@@ -2080,23 +2091,27 @@ export SWITCHROOM_SESSION_MODEL="$_EFFECTIVE_MODEL"
 #
 # Deterministic record of WHERE this boot actually landed, written immediately
 # before exec claude (overwrite-per-boot, one line). Consumers: the gateway
-# boot card's "routing" row and any operator shell. _DECLARED_ROUTING is baked
-# at render time by declaredRoutingMode() — the POST-REPOINT mode this boot is
-# meant to land on (fable/claude-fable-5/sr-* declare router-root because the
-# repoint case below moves them there; only non-fable Claude models declare
-# passthrough) — the apply-time INTENT the landed mode is compared against.
+# boot card's "routing" row and any operator shell. _DECLARED_ROUTING is derived
+# from $_DECLARED_MODEL (the resolved override/default snapshotted BEFORE the
+# missing-key opus demotion above), so a legitimate session override is
+# compared against its own POST-REPOINT intent rather than the configured
+# default's render-time model class — and a missing-key demotion still reads
+# as a genuine divergence instead of chasing its own landed model.
 # Divergence (landed ≠ declared) appends a consume-once .session-model-alert
 # line the gateway relays to the operator, but ONLY when the (landed, declared)
 # PAIR differs from the PREVIOUS boot's pair — a persistently degraded agent
 # alerts once, not on every restart, yet a declared-only flip (operator changes
 # the configured model class while the agent stays stuck on the same wrong
 # landed mode) still re-alerts.
-_DECLARED_ROUTING={{{declaredRoutingQ}}}
-# When LiteLLM was never configured for this agent (no SWITCHROOM_LITELLM at
-# boot entry, captured before any strip), compose injects NO routing env — the
-# declared intent genuinely IS direct-oauth, not the model-class bake. This
-# keeps non-LiteLLM fleets from false-alerting divergence on every boot.
-if [ -z "${SWITCHROOM_LITELLM_DECLARED:-}" ]; then _DECLARED_ROUTING="direct-oauth"; fi
+if [ -z "${SWITCHROOM_LITELLM_DECLARED:-}" ]; then
+  # No LiteLLM routing was configured for this agent at boot entry.
+  _DECLARED_ROUTING="direct-oauth"
+else
+  case "$_DECLARED_MODEL" in
+    sr-*|fable|claude-fable-5) _DECLARED_ROUTING="router-root" ;;
+    *) _DECLARED_ROUTING="passthrough" ;;
+  esac
+fi
 case "${ANTHROPIC_BASE_URL:-}" in
   "") _ROUTING_MODE="direct-oauth" ;;
   */anthropic) _ROUTING_MODE="passthrough" ;;
@@ -2114,7 +2129,17 @@ echo "routing: $_routing_line" >&2
 if [ "$_ROUTING_MODE" != "$_DECLARED_ROUTING" ] && { [ "$_ROUTING_MODE" != "$_prev_routing_mode" ] || [ "$_DECLARED_ROUTING" != "$_prev_declared_routing" ]; }; then
   printf 'Routing divergence: this agent landed on `%s` (base `%s`, model `%s`) but its declared routing is `%s`. Check `%s/.routing-mode` and the boot log for the cause (LiteLLM key/provision or proxy reachability).\n' "$_ROUTING_MODE" "${ANTHROPIC_BASE_URL:-direct}" "$_EFFECTIVE_MODEL" "$_DECLARED_ROUTING" "{{agentDir}}" >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
 fi
-unset _prev_routing_mode _prev_declared_routing _routing_line
+unset _prev_routing_mode _prev_declared_routing _routing_line _DECLARED_MODEL
+
+# Publish completion only after every boot-resolution output is final: active
+# model, active effort, routing mode, and any alert append. Atomic rename keeps
+# the gateway from observing a partially-written barrier.
+_session_model_resolved_tmp="{{agentDir}}/.session-model-resolved.tmp.$$"
+if printf '%s\n' "$$" > "$_session_model_resolved_tmp" 2>/dev/null; then
+  mv -f "$_session_model_resolved_tmp" "{{agentDir}}/.session-model-resolved" 2>/dev/null || true
+fi
+rm -f "$_session_model_resolved_tmp"
+unset _session_model_resolved_tmp
 
 {{#if useSwitchroomPlugin}}
 if [ -n "$APPEND_PROMPT" ]; then