switchroom 0.20.10 → 0.20.11

package/dist/cli/self-improve-apply-guard-pretool.mjs

@@ -1,6 +1,6 @@
 // src/cli/self-improve-apply-guard-pretool.ts
-import { readFileSync as readFileSync6 } from "node:fs";
-import { join as join6 } from "node:path";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { join as join7 } from "node:path";
 import { homedir } from "node:os";
 
 // src/self-improve/config.ts
@@ -15,6 +15,7 @@ function resolveSelfImproveConfig() {
   return {
     repetitionThreshold: Math.max(2, intEnv("SWITCHROOM_SELF_IMPROVE_THRESHOLD", 2)),
     t1MaxChangedLines: intEnv("SWITCHROOM_SELF_IMPROVE_T1_MAX_LINES", 30),
+    t1MaxGrowthBytes: intEnv("SWITCHROOM_SELF_IMPROVE_T1_MAX_GROWTH_BYTES", 4096),
     maxAutoAppliesPerDay: intEnv("SWITCHROOM_SELF_IMPROVE_MAX_AUTO_PER_DAY", 3),
     maxOutstandingPending: intEnv("SWITCHROOM_SELF_IMPROVE_MAX_PENDING", 5)
   };
@@ -22,6 +23,9 @@ function resolveSelfImproveConfig() {
 function selfImproveEnabled() {
   return process.env.SWITCHROOM_SELF_IMPROVE !== "0";
 }
+function t1LiveEnabled() {
+  return process.env.SWITCHROOM_SELF_IMPROVE_T1_LIVE === "1";
+}
 
 // src/self-improve/review-context.ts
 import {
@@ -52,8 +56,8 @@ function readReviewContext(stateDir) {
 }
 
 // src/self-improve/apply-guard.ts
-import { existsSync as existsSync4, lstatSync, readFileSync as readFileSync4, statSync } from "node:fs";
-import { join as join4, resolve, sep } from "node:path";
+import { existsSync as existsSync6, lstatSync, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
+import { join as join6, resolve, sep } from "node:path";
 
 // src/self-improve/tier-router.ts
 function classifyTier(candidate, cfg = resolveSelfImproveConfig()) {
@@ -113,7 +117,7 @@ function classifyTier(candidate, cfg = resolveSelfImproveConfig()) {
 }
 
 // src/self-improve/eval-gate.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync } from "node:fs";
 import { join as join2 } from "node:path";
 function evalsJsonPath(skillDir) {
   return join2(skillDir, "evals", "evals.json");
@@ -185,7 +189,150 @@ function floatEnv(name, def) {
   return Number.isFinite(n) ? n : def;
 }
 
-// src/self-improve/rate-limit.ts
+// src/self-improve/eval-cases.ts
+import {
+  closeSync as closeSync2,
+  copyFileSync,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync3,
+  openSync as openSync2,
+  readFileSync as readFileSync4,
+  readdirSync as readdirSync2,
+  renameSync,
+  writeFileSync as writeFileSync2,
+  writeSync as writeSync2
+} from "node:fs";
+import { dirname, join as join4 } from "node:path";
+import { createHash } from "node:crypto";
+
+// telegram-plugin/secret-detect/patterns.ts
+var ANCHORED_PATTERNS = [
+  { rule_id: "anthropic_api_key", regex: /\b(sk-ant-[A-Za-z0-9_-]{8,})\b/g, captureIndex: 1, slugHint: "anthropic_api_key" },
+  { rule_id: "anthropic_oauth_code", regex: /(?:^|\s)([A-Za-z0-9_-]{20,}#[A-Za-z0-9_-]{20,})(?=\s|$)/gm, captureIndex: 1, slugHint: "anthropic_oauth_code" },
+  { rule_id: "openai_api_key", regex: /\b(sk-[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "openai_api_key" },
+  { rule_id: "github_pat_classic", regex: /\b(ghp_[A-Za-z0-9]{20,})\b/g, captureIndex: 1, slugHint: "github_pat" },
+  { rule_id: "github_pat_fine_grained", regex: /\b(github_pat_[A-Za-z0-9_]{20,})\b/g, captureIndex: 1, slugHint: "github_pat" },
+  { rule_id: "slack_token", regex: /\b(xox[baprs]-[A-Za-z0-9-]{10,})\b/g, captureIndex: 1, slugHint: "slack_token" },
+  { rule_id: "slack_app_token", regex: /\b(xapp-[A-Za-z0-9-]{10,})\b/g, captureIndex: 1, slugHint: "slack_app_token" },
+  { rule_id: "groq_api_key", regex: /\b(gsk_[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "groq_api_key" },
+  { rule_id: "google_api_key", regex: /\b(AIza[0-9A-Za-z\-_]{20,})\b/g, captureIndex: 1, slugHint: "google_api_key" },
+  { rule_id: "perplexity_api_key", regex: /\b(pplx-[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "perplexity_api_key" },
+  { rule_id: "npm_token", regex: /\b(npm_[A-Za-z0-9]{10,})\b/g, captureIndex: 1, slugHint: "npm_token" },
+  { rule_id: "telegram_bot_token_prefixed", regex: /\bbot(\d{6,}:[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "telegram_bot_token" },
+  { rule_id: "telegram_bot_token", regex: /\b(\d{6,}:[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "telegram_bot_token" },
+  { rule_id: "laravel_sanctum_token", regex: /\b(\d+\|[A-Za-z0-9]{40,})\b/g, captureIndex: 1, slugHint: "api_token" },
+  { rule_id: "aws_access_key", regex: /\b(AKIA[0-9A-Z]{16})\b/g, captureIndex: 1, slugHint: "aws_access_key" },
+  { rule_id: "jwt", regex: /\b(eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "jwt" }
+];
+var STRUCTURED_PATTERNS = [
+  {
+    rule_id: "env_key_value",
+    regex: /\b([A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD))\b\s*[=:]\s*(["']?)([^\s"'\\]+)\2/g,
+    captureIndex: 3,
+    slugHint: "env"
+  },
+  {
+    rule_id: "json_secret_field",
+    regex: /"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken)"\s*:\s*"([^"]+)"/g,
+    captureIndex: 1,
+    slugHint: "json_secret"
+  },
+  {
+    rule_id: "cli_flag",
+    regex: /--(?:api[-_]?key|hook[-_]?token|token|secret|password|passwd)\s+(["']?)([^\s"']+)\1/g,
+    captureIndex: 2,
+    slugHint: "cli_flag"
+  },
+  {
+    rule_id: "bearer_auth_header",
+    regex: /Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)/gi,
+    captureIndex: 1,
+    slugHint: "bearer_token"
+  },
+  {
+    rule_id: "bearer_loose",
+    regex: /\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b/gi,
+    captureIndex: 1,
+    slugHint: "bearer_token"
+  },
+  {
+    rule_id: "basic_auth_header",
+    regex: /Authorization\s*[:=]\s*Basic\s+([A-Za-z0-9+/=]{8,})/gi,
+    captureIndex: 1,
+    slugHint: "basic_auth"
+  },
+  {
+    rule_id: "pem_private_key",
+    regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----/g,
+    captureIndex: 0,
+    slugHint: "pem_private_key"
+  }
+];
+var PROVIDER_PATTERNS = [
+  { rule_id: "slack_webhook", regex: /(https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9_/]+)/g, captureIndex: 1, slugHint: "slack_webhook" },
+  { rule_id: "stripe_live_secret", regex: /\b(sk_live_[A-Za-z0-9]{24,})\b/g, captureIndex: 1, slugHint: "stripe_key" },
+  { rule_id: "stripe_restricted", regex: /\b(rk_live_[A-Za-z0-9]{24,})\b/g, captureIndex: 1, slugHint: "stripe_key" },
+  { rule_id: "sendgrid_api_key", regex: /\b(SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43})\b/g, captureIndex: 1, slugHint: "sendgrid_key" },
+  { rule_id: "gitlab_pat", regex: /\b(glpat-[A-Za-z0-9_-]{20})\b/g, captureIndex: 1, slugHint: "gitlab_pat" },
+  { rule_id: "huggingface_token", regex: /\b(hf_[A-Za-z0-9]{34,})\b/g, captureIndex: 1, slugHint: "huggingface_token" },
+  { rule_id: "twilio_api_key", regex: /\b(SK[0-9a-f]{32})\b/g, captureIndex: 1, slugHint: "twilio_api_key" },
+  { rule_id: "mailgun_key", regex: /\b(key-[0-9a-f]{32})\b/g, captureIndex: 1, slugHint: "mailgun_key" },
+  { rule_id: "digitalocean_pat", regex: /\b(dop_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
+  { rule_id: "digitalocean_oauth", regex: /\b(doo_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
+  { rule_id: "digitalocean_refresh", regex: /\b(dor_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
+  { rule_id: "doppler_token", regex: /\b(dp\.(?:pt|st|ct|sa|scim|audit)\.[A-Za-z0-9]{40,44})\b/g, captureIndex: 1, slugHint: "doppler_token" },
+  { rule_id: "linear_api_key", regex: /\b(lin_api_[A-Za-z0-9]{40})\b/g, captureIndex: 1, slugHint: "linear_api_key" },
+  { rule_id: "shopify_access_token", regex: /\b(shpat_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
+  { rule_id: "shopify_shared_secret", regex: /\b(shpss_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
+  { rule_id: "shopify_private_app", regex: /\b(shppa_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
+  { rule_id: "square_access_token", regex: /\b(sq0atp-[A-Za-z0-9_-]{22})\b/g, captureIndex: 1, slugHint: "square_token" },
+  { rule_id: "square_oauth_secret", regex: /\b(sq0csp-[A-Za-z0-9_-]{43})\b/g, captureIndex: 1, slugHint: "square_token" },
+  { rule_id: "newrelic_key", regex: /\b(NRAK-[A-Z0-9]{27})\b/g, captureIndex: 1, slugHint: "newrelic_key" },
+  { rule_id: "notion_token", regex: /\b(ntn_[A-Za-z0-9]{46})\b/g, captureIndex: 1, slugHint: "notion_token" },
+  { rule_id: "planetscale_password", regex: /\b(pscale_pw_[A-Za-z0-9_.-]{43})\b/g, captureIndex: 1, slugHint: "planetscale_token" },
+  { rule_id: "planetscale_token", regex: /\b(pscale_tkn_[A-Za-z0-9_.-]{43})\b/g, captureIndex: 1, slugHint: "planetscale_token" },
+  { rule_id: "supabase_service_key", regex: /\b(sbp_[a-f0-9]{40})\b/g, captureIndex: 1, slugHint: "supabase_key" },
+  { rule_id: "atlassian_token", regex: /\b(ATATT[A-Za-z0-9_\-=]{20,})\b/g, captureIndex: 1, slugHint: "atlassian_token" },
+  { rule_id: "dropbox_token", regex: /\b(sl\.[A-Za-z0-9_-]{130,})/g, captureIndex: 1, slugHint: "dropbox_token" },
+  { rule_id: "databricks_token", regex: /\b(dapi[a-f0-9]{32})\b/g, captureIndex: 1, slugHint: "databricks_token" },
+  { rule_id: "grafana_service_account", regex: /\b(glsa_[A-Za-z0-9]{32}_[a-fA-F0-9]{8})\b/g, captureIndex: 1, slugHint: "grafana_token" },
+  { rule_id: "pypi_token", regex: /\b(pypi-AgEIcHlwaS[A-Za-z0-9_-]{50,})/g, captureIndex: 1, slugHint: "pypi_token" },
+  { rule_id: "aws_temp_access_key", regex: /\b(ASIA[0-9A-Z]{16})\b/g, captureIndex: 1, slugHint: "aws_access_key" },
+  { rule_id: "gcp_oauth_token", regex: /\b(ya29\.[A-Za-z0-9_-]{30,})/g, captureIndex: 1, slugHint: "gcp_oauth_token" }
+];
+var ALL_PATTERNS = [...ANCHORED_PATTERNS, ...PROVIDER_PATTERNS, ...STRUCTURED_PATTERNS];
+
+// telegram-plugin/secret-detect/inert-values.ts
+var INERT_GATED_RULES = new Set([
+  "env_key_value",
+  "json_secret_field",
+  "cli_flag"
+]);
+
+// telegram-plugin/secret-detect/chunker.ts
+var CHUNK_THRESHOLD = 32 * 1024;
+var WINDOW_SIZE = 16 * 1024;
+var OVERLAP = 8 * 1024;
+
+// telegram-plugin/secret-detect/suppressor.ts
+var MARKERS = ["test", "mock", "example", "fixture", "dummy"];
+var MARKER_RE = new RegExp(`\\b(?:${MARKERS.join("|")})\\b`, "i");
+// telegram-plugin/secret-detect/url-redact.ts
+var SENSITIVE_PARAMS = new Set([
+  "token",
+  "key",
+  "api_key",
+  "apikey",
+  "secret",
+  "access_token",
+  "password",
+  "pass",
+  "auth",
+  "client_secret",
+  "refresh_token",
+  "signature"
+]);
+// src/self-improve/pending-queue.ts
 import {
   closeSync,
   existsSync as existsSync3,
@@ -195,20 +342,128 @@ import {
   writeSync
 } from "node:fs";
 import { join as join3 } from "node:path";
+import { randomUUID } from "node:crypto";
+var PENDING_FILE = "self-improve-pending.jsonl";
+function pendingPath(stateDir) {
+  return join3(stateDir, PENDING_FILE);
+}
+function readPending(stateDir) {
+  const p = pendingPath(stateDir);
+  if (!existsSync3(p))
+    return [];
+  let raw;
+  try {
+    raw = readFileSync3(p, "utf-8");
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const line of raw.split(`
+`)) {
+    if (!line.trim())
+      continue;
+    try {
+      const parsed = JSON.parse(line);
+      if (parsed && typeof parsed.id === "string" && parsed.tier) {
+        out.push(parsed);
+      }
+    } catch {}
+  }
+  return out;
+}
+function outstandingCount(stateDir) {
+  return readPending(stateDir).filter((s) => s.actioned !== true).length;
+}
+function enqueuePending(stateDir, input, opts = {}) {
+  const cfg = resolveSelfImproveConfig();
+  const cap = opts.cap ?? cfg.maxOutstandingPending;
+  const now = opts.now ?? Date.now;
+  ensureDir(stateDir);
+  const outstanding = outstandingCount(stateDir);
+  if (outstanding >= cap) {
+    return { ok: false, reason: "cap-reached", outstanding, cap };
+  }
+  const suggestion = {
+    id: randomUUID(),
+    created_at: new Date(now()).toISOString(),
+    ...input
+  };
+  const fd = openSync(pendingPath(stateDir), "a");
+  try {
+    writeSync(fd, JSON.stringify(suggestion) + `
+`);
+  } finally {
+    closeSync(fd);
+  }
+  return { ok: true, suggestion };
+}
+function ensureDir(stateDir) {
+  if (!existsSync3(stateDir)) {
+    mkdirSync2(stateDir, { recursive: true, mode: 493 });
+  }
+}
+
+// src/self-improve/eval-cases.ts
+var EVAL_MANIFEST_FILE = "self-improve-eval-manifest.json";
+function manifestPath(stateDir) {
+  return join4(stateDir, EVAL_MANIFEST_FILE);
+}
+function evalsSha256(skillDir) {
+  const p = evalsJsonPath(skillDir);
+  if (!existsSync4(p))
+    return null;
+  try {
+    return createHash("sha256").update(readFileSync4(p)).digest("hex");
+  } catch {
+    return null;
+  }
+}
+function readManifest(stateDir) {
+  const p = manifestPath(stateDir);
+  if (!existsSync4(p))
+    return {};
+  try {
+    const parsed = JSON.parse(readFileSync4(p, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function verifyEvalIntegrity(stateDir, slug, skillDir) {
+  const sha = evalsSha256(skillDir);
+  if (sha === null)
+    return "no-evals";
+  const m = readManifest(stateDir);
+  const entry = m[slug];
+  if (!entry)
+    return "missing";
+  return sha === entry.sha256 ? "ok" : "drift";
+}
+
+// src/self-improve/rate-limit.ts
+import {
+  closeSync as closeSync3,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync4,
+  openSync as openSync3,
+  readFileSync as readFileSync5,
+  writeSync as writeSync3
+} from "node:fs";
+import { join as join5 } from "node:path";
 var APPLIES_FILE = "self-improve-applies.jsonl";
 function appliesPath(stateDir) {
-  return join3(stateDir, APPLIES_FILE);
+  return join5(stateDir, APPLIES_FILE);
 }
 function utcDay(ms) {
   return new Date(ms).toISOString().slice(0, 10);
 }
 function appliesToday(stateDir, now = Date.now) {
   const p = appliesPath(stateDir);
-  if (!existsSync3(p))
+  if (!existsSync5(p))
     return 0;
   let raw;
   try {
-    raw = readFileSync3(p, "utf-8");
+    raw = readFileSync5(p, "utf-8");
   } catch {
     return 0;
   }
@@ -227,16 +482,16 @@ function appliesToday(stateDir, now = Date.now) {
   return count;
 }
 function recordAutoApply(stateDir, now = Date.now) {
-  if (!existsSync3(stateDir)) {
-    mkdirSync2(stateDir, { recursive: true, mode: 493 });
+  if (!existsSync5(stateDir)) {
+    mkdirSync4(stateDir, { recursive: true, mode: 493 });
   }
   const ms = now();
-  const fd = openSync(appliesPath(stateDir), "a");
+  const fd = openSync3(appliesPath(stateDir), "a");
   try {
-    writeSync(fd, JSON.stringify({ ts: ms, day: utcDay(ms) }) + `
+    writeSync3(fd, JSON.stringify({ ts: ms, day: utcDay(ms) }) + `
 `);
   } finally {
-    closeSync(fd);
+    closeSync3(fd);
   }
 }
 
@@ -244,7 +499,7 @@ function recordAutoApply(stateDir, now = Date.now) {
 var SKILLS_SEGMENT = "/.claude/skills/";
 var BENCHMARK_SUBDIR = "self-improve-benchmarks";
 function benchmarkJsonForSkill(stateDir, slug) {
-  return join4(stateDir, BENCHMARK_SUBDIR, slug, "benchmark.json");
+  return join6(stateDir, BENCHMARK_SUBDIR, slug, "benchmark.json");
 }
 function parseSkillTarget(filePath) {
   if (typeof filePath !== "string" || filePath.length === 0)
@@ -306,7 +561,7 @@ function estimateChangedLines(toolName, input, filePath) {
   };
   const readCurrent = () => {
     try {
-      return readFileSync4(filePath, "utf-8");
+      return readFileSync6(filePath, "utf-8");
     } catch {
       return "";
     }
@@ -335,6 +590,55 @@ function estimateChangedLines(toolName, input, filePath) {
   }
   return 0;
 }
+function estimateByteDelta(toolName, input, filePath) {
+  const byteLen = (s) => Buffer.byteLength(s, "utf8");
+  let before = 0;
+  try {
+    before = statSync2(filePath).size;
+  } catch {
+    before = 0;
+  }
+  let currentContent = null;
+  const occurrences = (needle) => {
+    if (needle.length === 0)
+      return 0;
+    if (currentContent === null) {
+      try {
+        currentContent = readFileSync6(filePath, "utf-8");
+      } catch {
+        currentContent = "";
+      }
+    }
+    return currentContent.split(needle).length - 1;
+  };
+  const editDelta = (oldS, newS, replaceAll) => {
+    const per = byteLen(newS) - byteLen(oldS);
+    const count = replaceAll ? occurrences(oldS) : 1;
+    return per * count;
+  };
+  let after = before;
+  if (toolName === "Write") {
+    const content = typeof input.content === "string" ? input.content : "";
+    after = byteLen(content);
+  } else if (toolName === "Edit") {
+    const oldS = typeof input.old_string === "string" ? input.old_string : "";
+    const newS = typeof input.new_string === "string" ? input.new_string : "";
+    after = before + editDelta(oldS, newS, input.replace_all === true);
+  } else if (toolName === "MultiEdit") {
+    const edits = Array.isArray(input.edits) ? input.edits : [];
+    let net = 0;
+    for (const e of edits) {
+      if (!e || typeof e !== "object")
+        continue;
+      const ed = e;
+      const oldS = typeof ed.old_string === "string" ? ed.old_string : "";
+      const newS = typeof ed.new_string === "string" ? ed.new_string : "";
+      net += editDelta(oldS, newS, ed.replace_all === true);
+    }
+    after = before + net;
+  }
+  return { before, after, delta: after - before };
+}
 function downgradeCandidate(target, owns, changedLines, lesson) {
   return {
     lesson,
@@ -395,6 +699,18 @@ function decideApply(p) {
       candidate: downgradeCandidate(target, owns, changedLines, lesson)
     };
   }
+  const bytes = estimateByteDelta(p.toolName, p.input, p.filePath);
+  if (bytes.delta > cfg.t1MaxGrowthBytes) {
+    const over = bytes.delta - cfg.t1MaxGrowthBytes;
+    return {
+      action: "block",
+      downgradeTier: "T2",
+      reason: `T1 net-growth cap exceeded for "${target.slug}": +${bytes.delta} bytes (${bytes.before}\u2192${bytes.after}) is ${over} over the ${cfg.t1MaxGrowthBytes}-byte budget \u2014 downgraded to a proposal`,
+      candidate: downgradeCandidate(target, owns, changedLines, lesson),
+      bytesBefore: bytes.before,
+      bytesAfter: bytes.after
+    };
+  }
   if (!skillHasEvals(target.skillDir)) {
     return {
       action: "block",
@@ -404,7 +720,7 @@ function decideApply(p) {
     };
   }
   const benchPath = benchmarkJsonForSkill(p.stateDir, target.slug);
-  if (!existsSync4(benchPath)) {
+  if (!existsSync6(benchPath)) {
     return {
       action: "block",
       downgradeTier: "T2",
@@ -415,7 +731,7 @@ function decideApply(p) {
   if (typeof p.freshAfterMs === "number") {
     let mtime = 0;
     try {
-      mtime = statSync(benchPath).mtimeMs;
+      mtime = statSync2(benchPath).mtimeMs;
     } catch {
       mtime = 0;
     }
@@ -437,6 +753,16 @@ function decideApply(p) {
       candidate: downgradeCandidate(target, owns, changedLines, lesson)
     };
   }
+  const integrity = verifyEvalIntegrity(p.stateDir, target.slug, target.skillDir);
+  if (integrity !== "ok") {
+    const why = integrity === "drift" ? `eval set for "${target.slug}" drifted from its recorded baseline (out-of-band edit)` : `eval set for "${target.slug}" has no sanctioned baseline (integrity: ${integrity})`;
+    return {
+      action: "block",
+      downgradeTier: "T2",
+      reason: `${why} \u2014 refusing to auto-apply on unverified evals; downgraded to a proposal`,
+      candidate: downgradeCandidate(target, owns, changedLines, lesson)
+    };
+  }
   const used = appliesToday(p.stateDir, now);
   if (used >= cfg.maxAutoAppliesPerDay) {
     return {
@@ -446,6 +772,14 @@ function decideApply(p) {
       candidate: downgradeCandidate(target, owns, changedLines, lesson)
     };
   }
+  if (!t1LiveEnabled()) {
+    return {
+      action: "block",
+      downgradeTier: "T2",
+      reason: `verified T1 for "${target.slug}", but silent auto-apply is disabled (SWITCHROOM_SELF_IMPROVE_T1_LIVE unset) \u2014 surfacing as a one-tap proposal`,
+      candidate: downgradeCandidate(target, owns, changedLines, lesson)
+    };
+  }
   return {
     action: "allow",
     tier: "T1",
@@ -456,82 +790,11 @@ function decideApply(p) {
   };
 }
 
-// src/self-improve/pending-queue.ts
-import {
-  closeSync as closeSync2,
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync3,
-  openSync as openSync2,
-  readFileSync as readFileSync5,
-  writeSync as writeSync2
-} from "node:fs";
-import { join as join5 } from "node:path";
-import { randomUUID } from "node:crypto";
-var PENDING_FILE = "self-improve-pending.jsonl";
-function pendingPath(stateDir) {
-  return join5(stateDir, PENDING_FILE);
-}
-function readPending(stateDir) {
-  const p = pendingPath(stateDir);
-  if (!existsSync5(p))
-    return [];
-  let raw;
-  try {
-    raw = readFileSync5(p, "utf-8");
-  } catch {
-    return [];
-  }
-  const out = [];
-  for (const line of raw.split(`
-`)) {
-    if (!line.trim())
-      continue;
-    try {
-      const parsed = JSON.parse(line);
-      if (parsed && typeof parsed.id === "string" && parsed.tier) {
-        out.push(parsed);
-      }
-    } catch {}
-  }
-  return out;
-}
-function outstandingCount(stateDir) {
-  return readPending(stateDir).filter((s) => s.actioned !== true).length;
-}
-function enqueuePending(stateDir, input, opts = {}) {
-  const cfg = resolveSelfImproveConfig();
-  const cap = opts.cap ?? cfg.maxOutstandingPending;
-  const now = opts.now ?? Date.now;
-  ensureDir(stateDir);
-  const outstanding = outstandingCount(stateDir);
-  if (outstanding >= cap) {
-    return { ok: false, reason: "cap-reached", outstanding, cap };
-  }
-  const suggestion = {
-    id: randomUUID(),
-    created_at: new Date(now()).toISOString(),
-    ...input
-  };
-  const fd = openSync2(pendingPath(stateDir), "a");
-  try {
-    writeSync2(fd, JSON.stringify(suggestion) + `
-`);
-  } finally {
-    closeSync2(fd);
-  }
-  return { ok: true, suggestion };
-}
-function ensureDir(stateDir) {
-  if (!existsSync5(stateDir)) {
-    mkdirSync3(stateDir, { recursive: true, mode: 493 });
-  }
-}
-
 // src/cli/self-improve-apply-guard-pretool.ts
 var EDIT_TOOLS = new Set(["Write", "Edit", "MultiEdit"]);
 function readStdin() {
   try {
-    return readFileSync6(0, "utf8");
+    return readFileSync7(0, "utf8");
   } catch {
     return "";
   }
@@ -545,7 +808,7 @@ function block(reason) {
   process.exit(0);
 }
 function resolveStateDir() {
-  return process.env.TELEGRAM_STATE_DIR ?? join6(homedir(), ".claude", "channels", "telegram");
+  return process.env.TELEGRAM_STATE_DIR ?? join7(homedir(), ".claude", "channels", "telegram");
 }
 function main() {
   if (!selfImproveEnabled())
@@ -608,7 +871,9 @@ function main() {
       proposed_change: decision.candidate.proposedChange,
       tier_reason: decision.reason,
       skill_slug: decision.candidate.skillSlug,
-      triggered_by: (ctx.signals ?? []).map((s) => s.kind)
+      triggered_by: (ctx.signals ?? []).map((s) => s.kind),
+      bytes_before: decision.bytesBefore,
+      bytes_after: decision.bytesAfter
     });
     if (!q.ok) {
       capNote = ` (pending queue full ${q.outstanding}/${q.cap} \u2014 proposal not recorded)`;