switchroom 0.19.45 → 0.19.46

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.19.45", COMMIT_SHA = "2ad33d5d";
+var VERSION = "0.19.46", COMMIT_SHA = "306c3ed1";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -37439,11 +37439,14 @@ __export(exports_drive, {
   selectGoogleWorkspaceScopes: () => selectGoogleWorkspaceScopes,
   selectDriveAccountScopes: () => selectDriveAccountScopes,
   runDriveOAuthFlow: () => runDriveOAuthFlow,
+  resolveReconsentCapabilities: () => resolveReconsentCapabilities,
   registerDriveCommand: () => registerDriveCommand,
+  capabilitiesFromScopeString: () => capabilitiesFromScopeString,
   __test: () => __test,
   GOOGLE_SLIDES_SCOPE: () => GOOGLE_SLIDES_SCOPE,
   GOOGLE_SHEETS_SCOPE: () => GOOGLE_SHEETS_SCOPE,
   GOOGLE_DOCS_SCOPE: () => GOOGLE_DOCS_SCOPE,
+  GOOGLE_CALENDAR_READONLY_SCOPE: () => GOOGLE_CALENDAR_READONLY_SCOPE,
   DRIVE_WRITE_SCOPES: () => DRIVE_WRITE_SCOPES,
   DRIVE_READONLY_SCOPES: () => DRIVE_READONLY_SCOPES
 });
@@ -37461,7 +37464,29 @@ function selectDriveAccountScopes(write) {
 function selectGoogleWorkspaceScopes(opts) {
   const base = selectDriveAccountScopes(opts.write);
   const workspace = workspaceScopesForTier(opts.tier ?? "core");
-  return [...new Set([...base, ...workspace])];
+  const calendar = opts.calendar ? [GOOGLE_CALENDAR_READONLY_SCOPE] : [];
+  return [...new Set([...base, ...workspace, ...calendar])];
+}
+function capabilitiesFromScopeString(scope) {
+  const have = new Set(scope.split(/\s+/).map((s) => s.trim()).filter((s) => s.length > 0));
+  return {
+    write: have.has("https://www.googleapis.com/auth/drive.file"),
+    calendar: have.has(GOOGLE_CALENDAR_READONLY_SCOPE)
+  };
+}
+function resolveReconsentCapabilities(requested, existing) {
+  const keys = ["write", "calendar"];
+  if (!existing) {
+    return { effective: { ...requested }, carried: [], added: [] };
+  }
+  return {
+    effective: {
+      write: requested.write || existing.write,
+      calendar: requested.calendar || existing.calendar
+    },
+    carried: keys.filter((k) => existing[k] && !requested[k]),
+    added: keys.filter((k) => requested[k] && !existing[k])
+  };
 }
 function getVaultPath(configPath) {
   try {
@@ -37875,7 +37900,7 @@ function registerDriveCommand(program3, deps = {}) {
     await runDisconnect({ agentName: agent }, deps);
   });
 }
-var EXIT_OK = 0, EXIT_DENIED = 1, EXIT_TIMEOUT = 2, EXIT_RATE_LIMITED = 3, EXIT_ERROR = 4, EXIT_ABORTED = 130, DRIVE_READONLY_SCOPES, DRIVE_WRITE_SCOPES, DEFAULT_SCOPES, GOOGLE_DOCS_SCOPE = "https://www.googleapis.com/auth/documents", GOOGLE_SHEETS_SCOPE = "https://www.googleapis.com/auth/spreadsheets", GOOGLE_SLIDES_SCOPE = "https://www.googleapis.com/auth/presentations", __test;
+var EXIT_OK = 0, EXIT_DENIED = 1, EXIT_TIMEOUT = 2, EXIT_RATE_LIMITED = 3, EXIT_ERROR = 4, EXIT_ABORTED = 130, DRIVE_READONLY_SCOPES, DRIVE_WRITE_SCOPES, DEFAULT_SCOPES, GOOGLE_DOCS_SCOPE = "https://www.googleapis.com/auth/documents", GOOGLE_SHEETS_SCOPE = "https://www.googleapis.com/auth/spreadsheets", GOOGLE_SLIDES_SCOPE = "https://www.googleapis.com/auth/presentations", GOOGLE_CALENDAR_READONLY_SCOPE = "https://www.googleapis.com/auth/calendar.readonly", __test;
 var init_drive = __esm(() => {
   init_source();
   init_loader();
@@ -77304,10 +77329,15 @@ function pad(s, width) {
   return s.length >= width ? s : s + " ".repeat(width - s.length);
 }
 function registerAccountAdd(accountParent) {
-  accountParent.command("add <account>").description("Mint a Google OAuth refresh token for <account> and register it with the auth-broker. For Drive scopes the effective flow is desktop-loopback (device-code returns invalid_scope for Drive; OOB is retired) \u2014 use a Desktop OAuth client; on a headless host complete the browser step over an SSH port-forward. Add --write for create/edit (drive.file); default is read-only.").option("--replace", "Overwrite existing credentials for <account> (default refuses if account already registered)", false).option("--write", "Request Drive WRITE scope (drive.file: create + edit app-created files) in addition to read. Default is read-only \u2014 a read grant never silently becomes a write grant. Re-consent an existing account with `--replace --write`.", false).action(withConfigError(async (account, opts) => {
+  accountParent.command("add <account>").description("Mint a Google OAuth refresh token for <account> and register it with the auth-broker. For Drive scopes the effective flow is desktop-loopback (device-code returns invalid_scope for Drive; OOB is retired) \u2014 use a Desktop OAuth client; on a headless host complete the browser step over an SSH port-forward. Add --write for create/edit (drive.file) and --calendar for read-only Calendar; default is Drive read-only.").option("--replace", "Overwrite existing credentials for <account> (default refuses if account already registered)", false).option("--write", "Request Drive WRITE scope (drive.file: create + edit app-created files) in addition to read. Default is read-only \u2014 a read grant never silently becomes a write grant. Re-consent an existing account with `--replace --write`.", false).option("--calendar", "Request READ-ONLY Calendar scope (calendar.readonly) so the gdrive MCP's list_calendars / get_events tools authenticate. Opt-in \u2014 no tier grants it by default, and switchroom never requests a Calendar WRITE scope. Re-consent an existing account with `--replace --calendar`.", false).action(withConfigError(async (account, opts) => {
     const normalizedAccount = validateAndNormalizeAccountEmail(account);
     const [
-      { runDriveOAuthFlow: runDriveOAuthFlow2, selectGoogleWorkspaceScopes: selectGoogleWorkspaceScopes2 },
+      {
+        runDriveOAuthFlow: runDriveOAuthFlow2,
+        selectGoogleWorkspaceScopes: selectGoogleWorkspaceScopes2,
+        capabilitiesFromScopeString: capabilitiesFromScopeString2,
+        resolveReconsentCapabilities: resolveReconsentCapabilities2
+      },
       { selectInitialTier: selectInitialTier2 },
       { brokerCall: brokerCall2 },
       { loadConfig: loadConfig2, resolvePath: resolvePath2 },
@@ -77377,8 +77407,14 @@ function registerAccountAdd(accountParent) {
       clientSecretRaw = await resolveRef(clientSecretRaw, "google_client_secret");
     }
     const tier = gw.tier ?? "core";
+    const existingEntry = (await brokerCall2(async (client) => client.listGoogleAccounts())).accounts.find((a) => a.account === normalizedAccount);
+    const plan = resolveReconsentCapabilities2({ write: opts.write ?? false, calendar: opts.calendar ?? false }, existingEntry ? capabilitiesFromScopeString2(existingEntry.scope) : undefined);
+    if (existingEntry && !opts.replace && plan.added.length > 0) {
+      throw new Error(buildScopeReconsentRequiredError(normalizedAccount, plan.added));
+    }
     const accountScopes = selectGoogleWorkspaceScopes2({
-      write: opts.write ?? false,
+      write: plan.effective.write,
+      calendar: plan.effective.calendar,
       tier
     });
     const oauthCfg = {
@@ -77386,9 +77422,15 @@ function registerAccountAdd(accountParent) {
       client_secret: clientSecretRaw,
       scopes: accountScopes
     };
-    if (opts.write) {
+    if (plan.effective.write) {
       console.log(source_default.yellow("  Requesting Drive WRITE scope (drive.file \u2014 create/edit app-created files)."));
     }
+    if (plan.effective.calendar) {
+      console.log(source_default.yellow("  Requesting Calendar READ-ONLY scope (calendar.readonly \u2014 list calendars, read events)."));
+    }
+    for (const line of buildCarryForwardNotices(plan.carried)) {
+      console.log(source_default.gray(line));
+    }
     console.log(source_default.gray(`  Workspace tier: ${tier} \u2014 requesting Docs + Sheets` + (tier === "extended" || tier === "complete" ? " + Slides" : "") + " API scopes so the tier's tools can authenticate."));
     console.log(source_default.gray(`  Changing the tier later requires re-running this command
 ` + "  (`--replace`) \u2014 OAuth scopes are fixed at consent time."));
@@ -77425,6 +77467,40 @@ function registerAccountAdd(accountParent) {
     console.log();
   }));
 }
+var CAPABILITY_LABELS = {
+  write: {
+    flag: "--write",
+    scope: "drive.file",
+    summary: "Drive write (create + edit app-created files)"
+  },
+  calendar: {
+    flag: "--calendar",
+    scope: "calendar.readonly",
+    summary: "Calendar read-only (list calendars, read events)"
+  }
+};
+function buildScopeReconsentRequiredError(account, added) {
+  const flags = added.map((k) => CAPABILITY_LABELS[k].flag);
+  const scopes = added.map((k) => CAPABILITY_LABELS[k].scope).join(", ");
+  return [
+    `'${account}' is already registered with the auth-broker, and its stored ` + `token does not carry ${scopes}.`,
+    "",
+    "OAuth scopes are fixed at consent time \u2014 a stored token cannot be",
+    "widened in place. Re-consent to mint a new token that includes it:",
+    "",
+    `  switchroom auth google account add ${account} --replace ${flags.join(" ")}`,
+    "",
+    "Scopes the account already holds are carried forward automatically,",
+    "so re-consenting will not drop existing capabilities."
+  ].join(`
+`);
+}
+function buildCarryForwardNotices(carried) {
+  return carried.map((k) => {
+    const { flag, scope, summary } = CAPABILITY_LABELS[k];
+    return `  Carrying forward ${summary} \u2014 the existing token holds ${scope}, ` + `so it is re-requested even though ${flag} was not passed ` + `(re-consent would otherwise silently revoke it).`;
+  });
+}
 function oauthClientSetupGuidance(reason) {
   return [
     reason,
@@ -100174,12 +100250,25 @@ function findMissingWorkspaceScopes(seedScope, tier) {
   return requiredWorkspaceScopesForTier(tier).filter((s) => !have.has(s));
 }
 var DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
-function buildMissingScopeWarning(missing, tier, accountEmail, hasWriteScope) {
+var CALENDAR_READONLY_SCOPE = "https://www.googleapis.com/auth/calendar.readonly";
+function seedOptInCapabilities(seedScope) {
+  const have = new Set(seedScope.split(/\s+/).map((s) => s.trim()).filter((s) => s.length > 0));
+  return {
+    write: have.has(DRIVE_FILE_SCOPE),
+    calendar: have.has(CALENDAR_READONLY_SCOPE)
+  };
+}
+function buildMissingScopeWarning(missing, tier, accountEmail, granted) {
   const short = missing.map((s) => s.replace(/^https:\/\/www\.googleapis\.com\/auth\//, "")).join(", ");
+  const suffix = (granted.write ? " --write" : "") + (granted.calendar ? " --calendar" : "");
+  const preserved = [
+    granted.write ? "--write preserves the existing Drive write capability" : "",
+    granted.calendar ? "--calendar preserves the existing Calendar read capability" : ""
+  ].filter((s) => s.length > 0);
   return `drive-mcp-launcher: WARNING \u2014 the Google account '${accountEmail}' was ` + `consented WITHOUT the scope(s) needed for tier '${tier ?? "core"}': ` + `${short}.
 ` + `  The matching MCP tools (Docs / Sheets / Slides create+edit) will FAIL ` + `to authenticate. OAuth scopes are fixed at consent time \u2014 re-run on the ` + `host to re-mint the token with the correct scopes:
-` + `    switchroom auth google account add ${accountEmail} --replace` + `${hasWriteScope ? " --write" : ""}
-` + `  (scopes are derived from \`google_workspace.tier\` \u2014 set the tier ` + `before re-running${hasWriteScope ? "; --write preserves the existing " + "Drive write capability" : ""}). Drive read/file tools are unaffected.
+` + `    switchroom auth google account add ${accountEmail} --replace` + `${suffix}
+` + `  (scopes are derived from \`google_workspace.tier\` \u2014 set the tier ` + `before re-running${preserved.length > 0 ? "; " + preserved.join("; ") : ""}` + `). Drive read/file tools are unaffected.
 `;
 }
 function buildUvxArgs(tier) {
@@ -100427,8 +100516,7 @@ async function runDriveMcpLauncher(opts) {
   const tier = opts.tier ?? configSecrets.tier;
   const missingScopes = findMissingWorkspaceScopes(brokerCreds.scope, tier);
   if (missingScopes.length > 0) {
-    const hasWriteScope = brokerCreds.scope.split(/\s+/).map((s) => s.trim()).includes(DRIVE_FILE_SCOPE);
-    process.stderr.write(buildMissingScopeWarning(missingScopes, tier, brokerCreds.accountEmail, hasWriteScope));
+    process.stderr.write(buildMissingScopeWarning(missingScopes, tier, brokerCreds.accountEmail, seedOptInCapabilities(brokerCreds.scope)));
   }
   const args = buildUvxArgs(tier);
   const env2 = buildChildEnv(process.env, credentialsDir, brokerCreds.accountEmail);

package/dist/host-control/main.js

@@ -21402,7 +21402,7 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.19.45";
+var VERSION = "0.19.46";
 
 // src/setup/hindsight-recall-tunables.ts
 var RECALL_DEADLINE_HEADROOM_SECONDS = 2;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.19.45",
+  "version": "0.19.46",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/_base/start.sh.hbs

@@ -805,7 +805,26 @@ export SWITCHROOM_AGENT_START_CWD="{{agentDir}}"
 # already gets this via .mcp.json env, but the Claude Code process
 # doesn't inherit that — so without this export, `switchroom auth status`
 # from Bash inside the agent fails with "No switchroom.yaml found".
-export SWITCHROOM_CONFIG={{{switchroomConfigPathQ}}}
+#
+# DEFER to a pre-set value: in Docker, compose.ts already sets
+# SWITCHROOM_CONFIG to the in-container mount (/state/config/
+# switchroom.yaml). The value baked here is the HOST path — resolve()d on
+# the machine that ran the scaffold — which does not exist inside the
+# container. Unconditionally exporting it clobbered the correct compose
+# value and silently killed the live model/effort resolvers below (their
+# [ -f "$SWITCHROOM_CONFIG" ] guard failed and fell into the quiet
+# no-config-mount branch), so `model:` edits + bare restart did nothing.
+# The bake stays as the fallback for host-run (non-Docker) agents, where
+# nothing else sets the var. ${VAR:-} also treats a set-but-EMPTY var as
+# unset, so an empty compose env can never blank the fallback.
+#
+# NB the baked path is pre-single-quoted by the scaffold, so it is
+# assigned BARE to a temp var first — embedding it directly inside
+# "${SWITCHROOM_CONFIG:-...}" would keep the literal quote characters in
+# the value.
+_SR_CONFIG_BAKED={{{switchroomConfigPathQ}}}
+export SWITCHROOM_CONFIG="${SWITCHROOM_CONFIG:-$_SR_CONFIG_BAKED}"
+unset _SR_CONFIG_BAKED
 {{/if}}
 {{#if hindsightEnabled}}
 # Hindsight memory plugin (vendored at .claude/plugins/hindsight-memory/).
@@ -1722,9 +1741,11 @@ fi
 #      launcher recorded on every prior boot (read BEFORE it is overwritten);
 #   3. the apply-time bake.
 # Steps 2/3 append to `.session-model-alert` so the gateway tells the
-# operator once at boot. No SWITCHROOM_CONFIG mount at all means there is
-# nothing to read live — the bake IS the truth there (stderr note only; an
-# operator alert every boot forever would be noise with no action).
+# operator once at boot. No SWITCHROOM_CONFIG at all means there is
+# nothing to read live — the bake IS the truth there and the fallback is
+# silent. But SWITCHROOM_CONFIG set with the FILE MISSING is a
+# misconfiguration that kills live resolution outright, so that case is
+# loud (stderr + operator alert) — see the else branch below.
 #
 # The yaml file bind mount re-resolves by PATH at container start, so a
 # host-side atomic-rename write is always picked up by the NEXT boot — the
@@ -1785,6 +1806,23 @@ if [ -n "$SWITCHROOM_CONFIG" ] && [ -f "$SWITCHROOM_CONFIG" ] && command -v swit
   unset _lm_live _lm_try _lm_baked_class _lm_live_class
 else
   _EFFECTIVE_MODEL="$_BAKED_MODEL"
+  # No live read possible. Distinguish the legitimately quiet case — no
+  # SWITCHROOM_CONFIG at all (host-run agent scaffolded without a config
+  # path; the bake IS the truth) — from a broken resolver hiding behind
+  # it. SWITCHROOM_CONFIG set but pointing at a file that does not exist
+  # is a misconfiguration (e.g. a host path leaking into a container env)
+  # that silently disables live `model:`/`thinking_effort:` resolution:
+  # exactly the defect that let the start.sh host-path clobber of the
+  # compose-set env go unnoticed. That case is LOUD — stderr + a one-boot
+  # operator alert. A set config whose file exists but with no
+  # `switchroom` CLI on PATH is equally dead, stderr-only (nothing the
+  # operator can act on from chat).
+  if [ -n "$SWITCHROOM_CONFIG" ] && [ ! -f "$SWITCHROOM_CONFIG" ]; then
+    echo "session-model: SWITCHROOM_CONFIG='$SWITCHROOM_CONFIG' is set but the file does not exist — live config resolution is DISABLED; using apply-time baked model '$_BAKED_MODEL'" >&2
+    printf '`SWITCHROOM_CONFIG` points at `%s`, which does not exist in this environment, so live `model:`/`thinking_effort:` resolution is disabled and the agent booted on the apply-time default `%s`. Edits to switchroom.yaml will NOT take effect on a bare restart until this is fixed.\n' "$SWITCHROOM_CONFIG" "$_BAKED_MODEL" >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+  elif [ -n "$SWITCHROOM_CONFIG" ]; then
+    echo "session-model: SWITCHROOM_CONFIG is set but no 'switchroom' CLI is on PATH — live config resolution is DISABLED; using apply-time baked model '$_BAKED_MODEL'" >&2
+  fi
 fi
 unset _BAKED_MODEL _LKG_MODEL
 # Record the RESOLVED configured default (raw, unquoted) every boot, before
@@ -2078,6 +2116,12 @@ if [ -n "$SWITCHROOM_CONFIG" ] && [ -f "$SWITCHROOM_CONFIG" ] && command -v swit
   unset _le_live _le_try
 else
   _EFFECTIVE_EFFORT="$_BAKED_EFFORT"
+  # Misconfig visibility, parity with the model sibling above — which
+  # owns the operator alert for this shared root cause; a second alert
+  # here would double-post for the same broken env. stderr only.
+  if [ -n "$SWITCHROOM_CONFIG" ] && [ ! -f "$SWITCHROOM_CONFIG" ]; then
+    echo "session-effort: SWITCHROOM_CONFIG='$SWITCHROOM_CONFIG' is set but the file does not exist — live config resolution is DISABLED; using apply-time baked thinking_effort '${_BAKED_EFFORT:-<unset>}'" >&2
+  fi
 fi
 unset _BAKED_EFFORT _LKG_EFFORT
 # Record the LIVE-RESOLVED configured default, BEFORE the carrier below can

package/telegram-plugin/dist/gateway/gateway.js

@@ -72781,7 +72781,7 @@ function parseProviderVerb(provider, rest) {
     return { kind: "provider-cancel", provider };
   }
   if (sub !== "add") {
-    const usage = provider === "google" ? "Usage: /auth google add <email> [--replace] [--write]" : "Usage: /auth microsoft add <email> [--replace] [--org-mode]";
+    const usage = provider === "google" ? "Usage: /auth google add <email> [--replace] [--write] [--calendar]" : "Usage: /auth microsoft add <email> [--replace] [--org-mode]";
     return {
       kind: "help",
       reason: `Unknown \`${provider}\` subcommand: \`${codeSpanSafe(sub || "(none)")}\`. ${usage}`
@@ -72792,13 +72792,13 @@ function parseProviderVerb(provider, rest) {
   const positional = args.filter((a) => !a.startsWith("--"));
   const email = positional[0];
   if (!email) {
-    const usage = provider === "google" ? "Usage: /auth google add <email> [--replace] [--write]" : "Usage: /auth microsoft add <email> [--replace] [--org-mode]";
+    const usage = provider === "google" ? "Usage: /auth google add <email> [--replace] [--write] [--calendar]" : "Usage: /auth microsoft add <email> [--replace] [--org-mode]";
     return { kind: "help", reason: usage };
   }
   const emailErr = validateAuthAddLabel(email);
   if (emailErr)
     return { kind: "help", reason: emailErr };
-  const allowed = provider === "google" ? new Set(["--replace", "--write"]) : new Set(["--replace", "--org-mode"]);
+  const allowed = provider === "google" ? new Set(["--replace", "--write", "--calendar"]) : new Set(["--replace", "--org-mode"]);
   for (const f of flags) {
     if (!allowed.has(f)) {
       return {
@@ -72813,6 +72813,7 @@ function parseProviderVerb(provider, rest) {
     email,
     replace: flags.has("--replace"),
     write: provider === "google" && flags.has("--write"),
+    calendar: provider === "google" && flags.has("--calendar"),
     orgMode: provider === "microsoft" && flags.has("--org-mode")
   };
 }
@@ -74520,16 +74521,16 @@ ${loginUrl}
 
 // gateway/auth-loopback-relay.ts
 import { spawn } from "node:child_process";
-function defaultSpawnRelay(provider, email, opts) {
-  const binary = opts.binary ?? "switchroom";
-  const args = provider === "google" ? [
+function buildRelayArgs(provider, email, opts) {
+  return provider === "google" ? [
     "auth",
     "google",
     "account",
     "add",
     email,
     ...opts.replace ? ["--replace"] : [],
-    ...opts.write ? ["--write"] : []
+    ...opts.write ? ["--write"] : [],
+    ...opts.calendar ? ["--calendar"] : []
   ] : [
     "auth",
     "microsoft",
@@ -74539,6 +74540,10 @@ function defaultSpawnRelay(provider, email, opts) {
     ...opts.replace ? ["--replace"] : [],
     ...opts.orgMode ? ["--org-mode"] : []
   ];
+}
+function defaultSpawnRelay(provider, email, opts) {
+  const binary = opts.binary ?? "switchroom";
+  const args = buildRelayArgs(provider, email, opts);
   const child = spawn(binary, args, {
     stdio: ["ignore", "pipe", "pipe"],
     env: {
@@ -101041,10 +101046,10 @@ function startOutboxSweep(deps) {
 }
 
 // ../src/build-info.ts
-var VERSION2 = "0.19.45";
-var COMMIT_SHA = "2ad33d5d";
-var COMMIT_DATE = "2026-08-01T23:47:32Z";
-var LATEST_PR = 4192;
+var VERSION2 = "0.19.46";
+var COMMIT_SHA = "306c3ed1";
+var COMMIT_DATE = "2026-08-02T00:29:39Z";
+var LATEST_PR = 4194;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -112527,7 +112532,7 @@ Set \`admin: true\` on this agent in switchroom.yaml to unlock.`, { html: true }
         return;
       }
       try {
-        const { consentUrl, state: state7, port, child } = await startLoopbackFlow(parsed.provider, parsed.email, { replace: parsed.replace, write: parsed.write, orgMode: parsed.orgMode });
+        const { consentUrl, state: state7, port, child } = await startLoopbackFlow(parsed.provider, parsed.email, { replace: parsed.replace, write: parsed.write, calendar: parsed.calendar, orgMode: parsed.orgMode });
         const newFlow = {
           provider: parsed.provider,
           email: parsed.email,

package/telegram-plugin/gateway/auth-command.ts

@@ -65,6 +65,8 @@ export type ParsedAuthCommand =
       replace: boolean
       /** Google `--write` (Drive write scope). */
       write: boolean
+      /** Google `--calendar` (read-only Calendar scope). */
+      calendar: boolean
       /** Microsoft `--org-mode`. */
       orgMode: boolean
     }
@@ -251,7 +253,7 @@ export function parseAuthCommand(text: string): ParsedAuthCommand | null {
  * wired; anything else is a help-with-reason so the operator sees the shape.
  *
  * Flags mirror the CLI:
- *   google:    `add <email> [--replace] [--write]`
+ *   google:    `add <email> [--replace] [--write] [--calendar]`
  *   microsoft: `add <email> [--replace] [--org-mode]`
  */
 export function parseProviderVerb(
@@ -265,7 +267,7 @@ export function parseProviderVerb(
   if (sub !== 'add') {
     const usage =
       provider === 'google'
-        ? 'Usage: /auth google add <email> [--replace] [--write]'
+        ? 'Usage: /auth google add <email> [--replace] [--write] [--calendar]'
         : 'Usage: /auth microsoft add <email> [--replace] [--org-mode]'
     return {
       kind: 'help',
@@ -280,7 +282,7 @@ export function parseProviderVerb(
   if (!email) {
     const usage =
       provider === 'google'
-        ? 'Usage: /auth google add <email> [--replace] [--write]'
+        ? 'Usage: /auth google add <email> [--replace] [--write] [--calendar]'
         : 'Usage: /auth microsoft add <email> [--replace] [--org-mode]'
     return { kind: 'help', reason: usage }
   }
@@ -288,7 +290,7 @@ export function parseProviderVerb(
   if (emailErr) return { kind: 'help', reason: emailErr }
   // Reject unknown flags so a typo (`--replaced`) isn't silently dropped.
   const allowed = provider === 'google'
-    ? new Set(['--replace', '--write'])
+    ? new Set(['--replace', '--write', '--calendar'])
     : new Set(['--replace', '--org-mode'])
   for (const f of flags) {
     if (!allowed.has(f)) {
@@ -304,6 +306,7 @@ export function parseProviderVerb(
     email,
     replace: flags.has('--replace'),
     write: provider === 'google' && flags.has('--write'),
+    calendar: provider === 'google' && flags.has('--calendar'),
     orgMode: provider === 'microsoft' && flags.has('--org-mode'),
   }
 }

package/telegram-plugin/gateway/auth-loopback-relay.ts

@@ -84,6 +84,8 @@ export interface SpawnRelayOpts {
   replace?: boolean
   /** Google `--write` (Drive write scope). */
   write?: boolean
+  /** Google `--calendar` (read-only Calendar scope). */
+  calendar?: boolean
   /** Microsoft `--org-mode`. */
   orgMode?: boolean
   /** Override the CLI binary (tests / non-default install). */
@@ -96,6 +98,42 @@ export type SpawnRelay = (
   opts: SpawnRelayOpts,
 ) => RelayChild
 
+/**
+ * Build the `switchroom auth <provider> account add` argv the relay spawns.
+ *
+ * Pure + exported so the flag plumbing is unit-pinned: every opt-in flag
+ * the chat command accepts has to actually reach the CLI, and a flag that
+ * was NOT requested must never appear (the relay is the only path most
+ * operators use, so a dropped `--calendar` here is indistinguishable from
+ * the feature not existing, and a spurious one silently widens a grant).
+ */
+export function buildRelayArgs(
+  provider: LoopbackProvider,
+  email: string,
+  opts: SpawnRelayOpts,
+): string[] {
+  return provider === 'google'
+    ? [
+        'auth',
+        'google',
+        'account',
+        'add',
+        email,
+        ...(opts.replace ? ['--replace'] : []),
+        ...(opts.write ? ['--write'] : []),
+        ...(opts.calendar ? ['--calendar'] : []),
+      ]
+    : [
+        'auth',
+        'microsoft',
+        'account',
+        'add',
+        email,
+        ...(opts.replace ? ['--replace'] : []),
+        ...(opts.orgMode ? ['--org-mode'] : []),
+      ]
+}
+
 /**
  * Default spawn: the real `switchroom` CLI, stdout+stderr piped, stdin
  * ignored. `BROWSER=/bin/true` suppresses any browser auto-open; the Drive
@@ -109,26 +147,7 @@ export function defaultSpawnRelay(
   opts: SpawnRelayOpts,
 ): RelayChild {
   const binary = opts.binary ?? 'switchroom'
-  const args =
-    provider === 'google'
-      ? [
-          'auth',
-          'google',
-          'account',
-          'add',
-          email,
-          ...(opts.replace ? ['--replace'] : []),
-          ...(opts.write ? ['--write'] : []),
-        ]
-      : [
-          'auth',
-          'microsoft',
-          'account',
-          'add',
-          email,
-          ...(opts.replace ? ['--replace'] : []),
-          ...(opts.orgMode ? ['--org-mode'] : []),
-        ]
+  const args = buildRelayArgs(provider, email, opts)
   const child: ChildProcess = spawn(binary, args, {
     stdio: ['ignore', 'pipe', 'pipe'],
     env: {

package/telegram-plugin/gateway/gateway.ts

@@ -20738,7 +20738,7 @@ bot.command("auth", async ctx => {
       const { consentUrl, state, port, child } = await startLoopbackFlow(
         parsed.provider,
         parsed.email,
-        { replace: parsed.replace, write: parsed.write, orgMode: parsed.orgMode },
+        { replace: parsed.replace, write: parsed.write, calendar: parsed.calendar, orgMode: parsed.orgMode },
       )
       const newFlow = {
         provider: parsed.provider,

package/telegram-plugin/tests/auth-loopback-relay.test.ts

@@ -22,6 +22,7 @@ import { describe, it, expect } from 'vitest'
 import { EventEmitter } from 'node:events'
 
 import {
+  buildRelayArgs,
   parseLoopbackRedirect,
   extractConsentUrl,
   parseConsentUrl,
@@ -492,6 +493,7 @@ describe('parseAuthCommand — provider verbs (#2582)', () => {
       email: 'user@example.com',
       replace: false,
       write: false,
+      calendar: false,
       orgMode: false,
     })
   })
@@ -501,6 +503,26 @@ describe('parseAuthCommand — provider verbs (#2582)', () => {
     expect(p).toMatchObject({ kind: 'provider-add', replace: true, write: true })
   })
 
+  it('parses google --calendar, and it does not imply --write', () => {
+    const p = parseAuthCommand('/auth google add user@example.com --replace --calendar')
+    expect(p).toMatchObject({
+      kind: 'provider-add',
+      replace: true,
+      calendar: true,
+      write: false,
+    })
+  })
+
+  it('parses --write and --calendar together', () => {
+    const p = parseAuthCommand('/auth google add user@example.com --write --calendar')
+    expect(p).toMatchObject({ kind: 'provider-add', write: true, calendar: true })
+  })
+
+  it('--calendar is google-only — microsoft rejects it as an unknown flag', () => {
+    const p = parseAuthCommand('/auth microsoft add user@corp.com --calendar')
+    expect(p).toMatchObject({ kind: 'help' })
+  })
+
   it('parses /auth microsoft add with --org-mode', () => {
     const p = parseAuthCommand('/auth microsoft add user@corp.com --org-mode')
     expect(p).toMatchObject({
@@ -531,3 +553,39 @@ describe('parseAuthCommand — provider verbs (#2582)', () => {
     expect(p).toMatchObject({ kind: 'help' })
   })
 })
+
+
+describe('buildRelayArgs — chat flags actually reach the CLI', () => {
+  it('bare google add: no opt-in flags', () => {
+    expect(buildRelayArgs('google', 'a@b.com', {})).toEqual([
+      'auth', 'google', 'account', 'add', 'a@b.com',
+    ])
+  })
+
+  it('forwards --calendar', () => {
+    expect(buildRelayArgs('google', 'a@b.com', { calendar: true })).toEqual([
+      'auth', 'google', 'account', 'add', 'a@b.com', '--calendar',
+    ])
+  })
+
+  it('forwards --replace --write --calendar together, in order', () => {
+    expect(
+      buildRelayArgs('google', 'a@b.com', {
+        replace: true,
+        write: true,
+        calendar: true,
+      }),
+    ).toEqual([
+      'auth', 'google', 'account', 'add', 'a@b.com',
+      '--replace', '--write', '--calendar',
+    ])
+  })
+
+  it('--calendar never leaks into the microsoft argv', () => {
+    expect(
+      buildRelayArgs('microsoft', 'a@corp.com', { calendar: true, orgMode: true }),
+    ).toEqual([
+      'auth', 'microsoft', 'account', 'add', 'a@corp.com', '--org-mode',
+    ])
+  })
+})