switchroom 0.20.10 → 0.20.12

package/dist/auth-broker/index.js

@@ -10994,7 +10994,7 @@ var init_observation_scopes = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AntiConfabulationDirectiveSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, BuzzChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleServiceTokenSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AntiConfabulationDirectiveSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, BuzzChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleServiceTokenSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, ConfigRepoConfigSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   init_observation_scopes();
@@ -11444,7 +11444,7 @@ var init_schema = __esm(() => {
       reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent → uses global."),
       consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent → global.")
     }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
-    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1; and " + "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT — the background " + "half of switchroom's recall-admission split (#3660): of the " + "RECALL_MAX_CONCURRENT admission slots, at most this many may be held " + "by background consolidation recalls at once, so foreground per-turn " + "recall always keeps the remainder; must be >= 1 and strictly less " + "than RECALL_MAX_CONCURRENT or the engine refuses to boot; unset " + "means the image's derived default min(2, RECALL_MAX_CONCURRENT - 1); " + "1 biases hard toward the interactive lane while a consolidation " + "backlog drains; and " + "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S — the rollback/tuning knob for " + "switchroom's MM-refresh-debounce image patch: the minimum seconds " + "between consolidation-triggered refreshes of one mental model; unset " + "means the image's baked 3600, 0 restores upstream's " + "refresh-every-round behaviour; explicit and cron-scheduled refreshes " + "are never debounced; and " + "HINDSIGHT_API_TEMPORAL_LANGUAGES — the language set dateparser is " + "restricted to during temporal query analysis, made live by switchroom's " + "temporal-language image patch (which ended a 200+-locale auto-detection " + "pass that blocked the shared asyncio loop on every recall); " + "comma-separated, unset means the image's baked `en`, set e.g. `en,es` to " + "restore i18n parsing; and " + "HINDSIGHT_API_TEMPORAL_MAX_QUERY_CHARS — the max chars of query text " + "dateparser.search_dates() is handed during temporal analysis (0 = " + "unlimited), made live by switchroom's temporal-offload image patch " + "(which moved the synchronous extraction off the shared asyncio loop onto " + "a single-worker thread and bounds its input, ending multi-second loop " + "stalls on multi-KB consolidation queries); unset means the image's baked " + "2000, set 0 to restore an unbounded full scan), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
+    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1; and " + "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT — the background " + "half of switchroom's recall-admission split (#3660): of the " + "RECALL_MAX_CONCURRENT admission slots, at most this many may be held " + "by background consolidation recalls at once, so foreground per-turn " + "recall always keeps the remainder; must be >= 1 and strictly less " + "than RECALL_MAX_CONCURRENT or the engine refuses to boot; unset " + "means the image's derived default min(2, RECALL_MAX_CONCURRENT - 1); " + "1 biases hard toward the interactive lane while a consolidation " + "backlog drains; and " + "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S — the rollback/tuning knob for " + "switchroom's MM-refresh-debounce image patch: the minimum seconds " + "between consolidation-triggered refreshes of one mental model; unset " + "means the image's baked 3600, 0 restores upstream's " + "refresh-every-round behaviour; explicit and cron-scheduled refreshes " + "are never debounced; and " + "HINDSIGHT_API_TEMPORAL_LANGUAGES — the language set dateparser is " + "restricted to during temporal query analysis, made live by switchroom's " + "temporal-language image patch (which ended a 200+-locale auto-detection " + "pass that blocked the shared asyncio loop on every recall); " + "comma-separated, unset means the image's baked `en`, set e.g. `en,es` to " + "restore i18n parsing; and " + "HINDSIGHT_API_TEMPORAL_MAX_QUERY_CHARS — the max chars of query text " + "dateparser.search_dates() is handed during temporal analysis (0 = " + "unlimited), made live by switchroom's temporal-offload image patch " + "(which moved the synchronous extraction off the shared asyncio loop onto " + "a single-worker thread and bounds its input, ending multi-second loop " + "stalls on multi-KB consolidation queries); unset means the image's baked " + "2000, set 0 to restore an unbounded full scan); and " + "HINDSIGHT_API_TEXT_SEARCH_EXTENSION_NATIVE_LANGUAGE — the Postgres " + "text-search regconfig the native BM25 arms and the search_vector index " + "write run to_tsvector/to_tsquery against; unset means upstream's " + "always-safe `english`, set `hindsight_english` to use switchroom's " + "junk-stopping config (dict + stopword file provisioned durably by the " + "image entrypoint, recall degrading to semantic-only if it is ever " + "missing); plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
   });
   MicrosoftWorkspaceConfigSchema = exports_external.object({
     microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
@@ -11691,8 +11691,10 @@ var init_schema = __esm(() => {
     bot_username: exports_external.string().optional().describe("Per-agent Telegram bot username (without leading @) when it doesn't " + "contain the agent slug. Replaces the default 'username includes slug' " + "preflight check with an exact (case-insensitive) match. Use when an " + "agent and its bot have intentionally divergent names (e.g. agent " + "'lawgpt' paired with bot '@meken_law_bot')."),
     timezone: exports_external.string().regex(TIMEZONE_REGEX, "timezone must be an IANA zone name like 'Australia/Melbourne' or 'UTC' " + "(three-letter aliases like EST/PST and bare offsets like UTC+10 are not accepted)").optional().describe("Per-agent IANA timezone override. Wins over any profile/defaults " + "value and over the top-level switchroom.timezone global. Controls " + "the UserPromptSubmit timezone hook's emitted local time and the " + "agent container's `environment.TZ` in compose."),
     auth: exports_external.object({
-      override: exports_external.string().min(1).optional().describe("Per-agent override of the fleet-wide `auth.active`. Edge-case use only — " + "this agent talks to the named account regardless of fleet active. See RFC H §4.5.")
-    }).optional().describe("Account routing for switchroom-auth-broker. RFC H schema uses " + "fleet-wide `auth.active` plus per-agent `override:` for edge cases. " + "Pre-RFC-H `auth.accounts: [..]` and `auth_label:` are migrated in-place " + "on first apply (see src/auth/migrate-schema.ts)."),
+      override: exports_external.string().min(1).optional().describe("Per-agent override of the fleet-wide `auth.active`. Edge-case use only — " + "this agent talks to the named account regardless of fleet active. See RFC H §4.5."),
+      strict: exports_external.boolean().optional().describe("Requires `override`. When true, the pin is a hard binding, not a " + "routing preference: the broker NEVER serves this agent from any " + "other account — no failover to `auth.fallback_order` while the " + "pinned account is quota-walled or exhausted. The agent rides out " + "the wall on its own account (surfacing the normal 429/quota " + "cards) instead of silently borrowing fleet quota. Use for " + "accounts that must never cross a billing/compliance boundary " + "(e.g. an employer-provided subscription)."),
+      exclusive: exports_external.boolean().optional().describe("Requires `override`. When true, the pinned account belongs to " + "THIS agent alone: the broker refuses to serve it to any other " + "agent or consumer, refuses `auth use <label>` (set-active) onto " + "it, and refuses pinning another agent to it. Config that routes " + "others to the account (`auth.active`, `auth.fallback_order`, " + "another agent's `override`, a consumer pin) is rejected at load. " + "Usually paired with `strict: true` for full two-way isolation.")
+    }).optional().describe("Account routing for switchroom-auth-broker. RFC H schema uses " + "fleet-wide `auth.active` plus per-agent `override:` for edge cases, " + "with optional `strict:` (never borrow another account) and " + "`exclusive:` (no one else may use the pinned account) hardening. " + "Pre-RFC-H `auth.accounts: [..]` and `auth_label:` are migrated in-place " + "on first apply (see src/auth/migrate-schema.ts)."),
     dm_only: exports_external.boolean().optional().describe("Mark this agent as a DM-only bot — has its own bot_token and lives " + "exclusively in a private chat with the operator. Suppresses " + "scaffolding's default behavior of inheriting the global " + "telegram.forum_chat_id into the agent's access.json `groups` entry " + "(the forum chat the bot isn't a member of, which would otherwise " + "trigger a 'boot-probe-failed: 400 chat not found' warning every " + "restart). topic_name is still schema-required but unused — set it " + "to a display label like 'DM' for /switchroom status output."),
     topic_name: exports_external.string().describe("Telegram forum topic display name"),
     topic_emoji: exports_external.string().optional().describe("Emoji for the topic (e.g., '\uD83C\uDFCB️')"),
@@ -11767,6 +11769,17 @@ var init_schema = __esm(() => {
       tmp_size: exports_external.string().regex(/^\d+(\.\d+)?[kmgKMG]?$/, "tmp_size must be a Docker size string like '1g', '4g', '512m'").refine((v) => parseFloat(v) > 0, "tmp_size must be greater than zero").optional()
     }).optional()
   }).superRefine((agent, ctx) => {
+    if (agent.auth && !agent.auth.override) {
+      for (const flag of ["strict", "exclusive"]) {
+        if (agent.auth[flag]) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            message: `\`auth.${flag}: true\` requires \`auth.override: <account>\` — there is no pinned account for it to apply to.`,
+            path: ["auth", flag]
+          });
+        }
+      }
+    }
     if (agent.dm_only !== true)
       return;
     const tg = agent.channels?.telegram;
@@ -11879,6 +11892,15 @@ var init_schema = __esm(() => {
     profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
     person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system — just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership — never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later — see docs/configuration.md.")
   });
+  ConfigRepoConfigSchema = exports_external.object({
+    enabled: exports_external.boolean().default(false).describe("Master switch for config-repo change control. Default false (opt-in). " + "When false the `config-repo sync` verb still runs on demand but the " + "doctor check and (later) the scheduled tick treat the feature as off."),
+    path: exports_external.string().regex(/^[a-zA-Z0-9~._\-/]+$/, "config_repo.path must not contain shell-special characters ($, `, \", ', \\, etc.)").default("~/.switchroom-config").describe("Filesystem path to the operator's private config repo. Must be a git " + "repo (else `switchroom doctor` FAILs). Tilde-expanded at read time."),
+    push: exports_external.boolean().default(true).describe("When true, `config-repo sync` pushes after committing (subject to the " + "`require_private` gate). When false, it commits locally only — useful " + "for offline hosts or a review-before-push workflow."),
+    remote: exports_external.string().min(1).default("origin").describe("Git remote name to push to. Default `origin`."),
+    require_private: exports_external.boolean().default(true).describe("Refuse to PUSH unless the GitHub API confirms the remote repo is " + "private. On a public remote — or when the API is unreachable — the " + "push is skipped (commits still land locally) and a WARN is emitted. " + "Fail-safe against exfiltrating memory files / workspace state to a " + "repo that has been flipped public. Default true."),
+    interval_minutes: exports_external.number().int().min(5).max(59).default(30).describe("Cadence (minutes) of the scheduled `config-repo sync` tick installed " + "by `switchroom config-repo --install-cron`. Rendered as a cron " + "`*/N * * * *` minute field, so it must be 5..59 (the 5-min floor " + "matches the rest of the fleet's cron floor). Default 30 (Ken's " + "approved cadence). Changing it takes effect on the next " + "`--install-cron` / `switchroom update` reconcile."),
+    include_vault_backup: exports_external.enum(["off", "daily", "every_tick"]).default("daily").describe("Whether the scheduled tick also runs `switchroom vault backup` " + "(an encrypted vault/memory snapshot into <path>/vault-backups/) " + "before the sync. `off`: sync only. `daily`: an extra once-per-day " + "cron leg runs `vault backup && config-repo sync` (the 30-min legs " + "stay sync-only). `every_tick`: every tick runs the backup first. " + "Default `daily` — the first automated vault backup on this host.")
+  });
   SwitchroomConfigSchema = exports_external.object({
     switchroom: exports_external.object({
       version: exports_external.literal(1).describe("Config schema version"),
@@ -11891,6 +11913,7 @@ var init_schema = __esm(() => {
     memory: MemoryBackendConfigSchema.optional(),
     hindsight: HindsightConfigSchema.optional().describe("Fleet-singleton Hindsight (memory backend) configuration. Currently " + "just the LLM knob (provider + model) used for retain/reflect/" + "consolidation. Both fields optional; when unset the container falls " + "back to provider=claude-code + the hard-coded HINDSIGHT_DEFAULT_MODEL " + "so nothing changes for operators who don't set it. Read at container " + "launch by startHindsight() (src/setup/hindsight.ts) — takes effect on " + "the next `switchroom apply` / `memory setup --recreate`."),
     vault: VaultConfigSchema.optional(),
+    config_repo: ConfigRepoConfigSchema.optional().describe("Change control for the operator's private ~/.switchroom-config git repo " + "(backup + audit trail of live host config, agent workspace state, and " + "mirrored personal skills). Consumed by `switchroom config-repo sync` and " + "the `config repo` doctor check. Optional and OFF by default."),
     auth: exports_external.object({
       active: exports_external.string().min(1).optional().describe("Fleet-wide active Anthropic account label. Every agent without " + "an explicit `agent.auth.override` uses this account. See " + "docs/auth.md for the full model. Set by `switchroom auth use <label>`."),
       fallback_order: exports_external.array(exports_external.string().min(1)).optional().describe("Ordered list of account labels for `switchroom auth rotate` to cycle " + "through when the active account hits a quota event. First entry is " + "normally the same as `auth.active`. When unset, `rotate` is a no-op."),
@@ -11958,6 +11981,48 @@ var init_schema = __esm(() => {
     for (const [name, a] of Object.entries(cfg.agents ?? {})) {
       checkServes(a.serves, ["agents", name, "serves"]);
     }
+    for (const [name, a] of Object.entries(cfg.agents ?? {})) {
+      const agentAuth = a.auth;
+      if (!agentAuth?.exclusive || !agentAuth.override)
+        continue;
+      const acct = agentAuth.override;
+      if (cfg.auth?.active === acct) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — it cannot be the fleet \`auth.active\``,
+          path: ["auth", "active"]
+        });
+      }
+      const fbIdx = (cfg.auth?.fallback_order ?? []).indexOf(acct);
+      if (fbIdx !== -1) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — it cannot appear in \`auth.fallback_order\``,
+          path: ["auth", "fallback_order", fbIdx]
+        });
+      }
+      for (const [other, oa] of Object.entries(cfg.agents ?? {})) {
+        if (other === name)
+          continue;
+        const otherOverride = oa.auth?.override;
+        if (otherOverride === acct) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — agent '${other}' cannot pin it`,
+            path: ["agents", other, "auth", "override"]
+          });
+        }
+      }
+      (cfg.auth?.consumers ?? []).forEach((c, i) => {
+        if (c.account === acct) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — consumer '${c.name}' cannot pin it`,
+            path: ["auth", "consumers", i, "account"]
+          });
+        }
+      });
+    }
     const microsoftAccounts = cfg.microsoft_accounts;
     for (const [name, a] of Object.entries(cfg.agents ?? {})) {
       const mw = a.microsoft_workspace;
@@ -18957,6 +19022,27 @@ function allocateAgentUid(name) {
   return AGENT_UID_MIN + u32 % range;
 }
 
+// src/setup/hindsight-recall-passthrough.ts
+var HINDSIGHT_RECALL_TAG_WEIGHT_SEED = Object.freeze({ sidechain: 0.8 });
+var HINDSIGHT_RECALL_PROMPT_PREAMBLE_DEFAULT = "Relevant memories from past conversations (prioritize recent when " + "conflicting). Only use memories that are directly useful to continue " + "this conversation; ignore the rest:";
+var RECALL_PASSTHROUGH_DEFAULTS = Object.freeze({
+  budget: "low",
+  maxTokens: 1024,
+  preferObservations: true,
+  contextTurns: 2,
+  roles: ["user", "assistant"],
+  promptPreamble: HINDSIGHT_RECALL_PROMPT_PREAMBLE_DEFAULT,
+  tags: [],
+  tagsMatch: "any",
+  tagGroups: {},
+  tagWeights: HINDSIGHT_RECALL_TAG_WEIGHT_SEED,
+  additionalBankFilters: {},
+  transcriptFallback: true,
+  transcriptTailBytes: 262144,
+  maxQueryChars: 800,
+  parallel: true
+});
+
 // src/setup/hindsight-recall-tunables.ts
 var RECALL_DEADLINE_HEADROOM_SECONDS = 2;
 var MIN_RECALL_HOOK_TIMEOUT_SECONDS = RECALL_DEADLINE_HEADROOM_SECONDS + 1;
@@ -19232,7 +19318,8 @@ var HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS = new Set([
   "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT",
   "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S",
   "HINDSIGHT_API_TEMPORAL_LANGUAGES",
-  "HINDSIGHT_API_TEMPORAL_MAX_QUERY_CHARS"
+  "HINDSIGHT_API_TEMPORAL_MAX_QUERY_CHARS",
+  "HINDSIGHT_API_TEXT_SEARCH_EXTENSION_NATIVE_LANGUAGE"
 ]);
 var HINDSIGHT_WORKER_SLOT_TYPES = [
   "consolidation",
@@ -19677,27 +19764,6 @@ init_vault();
 // src/setup/onboarding.ts
 init_paths();
 
-// src/setup/hindsight-recall-passthrough.ts
-var HINDSIGHT_RECALL_TAG_WEIGHT_SEED = Object.freeze({ sidechain: 0.8 });
-var HINDSIGHT_RECALL_PROMPT_PREAMBLE_DEFAULT = "Relevant memories from past conversations (prioritize recent when " + "conflicting). Only use memories that are directly useful to continue " + "this conversation; ignore the rest:";
-var RECALL_PASSTHROUGH_DEFAULTS = Object.freeze({
-  budget: "low",
-  maxTokens: 1024,
-  preferObservations: true,
-  contextTurns: 2,
-  roles: ["user", "assistant"],
-  promptPreamble: HINDSIGHT_RECALL_PROMPT_PREAMBLE_DEFAULT,
-  tags: [],
-  tagsMatch: "any",
-  tagGroups: {},
-  tagWeights: HINDSIGHT_RECALL_TAG_WEIGHT_SEED,
-  additionalBankFilters: {},
-  transcriptFallback: true,
-  transcriptTailBytes: 262144,
-  maxQueryChars: 800,
-  parallel: true
-});
-
 // src/repos/bare-clone.ts
 init_paths();
 
@@ -22183,11 +22249,30 @@ class AuthBroker {
       return override;
     return auth.active ?? null;
   }
+  exclusiveOwnerOf(account) {
+    for (const [name, agent] of Object.entries(this.config.agents ?? {})) {
+      if (agent.auth?.exclusive && agent.auth?.override === account)
+        return name;
+    }
+    return null;
+  }
+  isServableBy(account, forAgent) {
+    const owner = this.exclusiveOwnerOf(account);
+    return owner === null || owner === forAgent;
+  }
   servingAccount(identity) {
-    const account = this.callerAccount(identity);
     if (identity.kind === "operator")
-      return account;
-    return this.accountWithFailover(account);
+      return this.callerAccount(identity);
+    if (identity.kind === "agent")
+      return this.servedAccountForAgent(identity.name);
+    return this.accountWithFailover(this.callerAccount(identity));
+  }
+  servedAccountForAgent(name) {
+    const agent = (this.config.agents ?? {})[name];
+    const override = agent?.auth?.override;
+    if (override && agent?.auth?.strict)
+      return override;
+    return this.accountWithFailover(override ?? this.config.auth?.active ?? null, name);
   }
   isOverageAllowed(account) {
     return (this.config.auth?.allow_overage_accounts ?? []).includes(account);
@@ -22305,6 +22390,8 @@ class AuthBroker {
         continue;
       if (this.isAccountPremiumWalled(cand))
         continue;
+      if (this.exclusiveOwnerOf(cand))
+        continue;
       if (!accountExists(cand, this.home))
         continue;
       if (!readAccountCredentials(cand, this.home))
@@ -22450,15 +22537,30 @@ class AuthBroker {
     if (reselected && this.accountEligibilityOf(reselected) === "eligible")
       return reselected;
     for (const cand of ring) {
-      if (cand && cand !== current && accountExists(cand, this.home) && this.accountEligibilityOf(cand) === "unknown") {
+      if (cand && cand !== current && accountExists(cand, this.home) && !this.exclusiveOwnerOf(cand) && this.accountEligibilityOf(cand) === "unknown") {
         return cand;
       }
     }
     return null;
   }
-  accountWithFailover(account) {
+  accountWithFailover(account, forAgent) {
     if (!account)
       return null;
+    if (!this.isServableBy(account, forAgent)) {
+      for (const cand of this.config.auth?.fallback_order ?? []) {
+        if (cand === account || this.isAccountExhausted(cand))
+          continue;
+        if (!this.isServableBy(cand, forAgent))
+          continue;
+        if (readAccountCredentials(cand, this.home))
+          return cand;
+      }
+      const active2 = this.config.auth?.active;
+      if (active2 && active2 !== account && !this.isAccountExhausted(active2) && this.isServableBy(active2, forAgent) && readAccountCredentials(active2, this.home)) {
+        return active2;
+      }
+      return null;
+    }
     const exhausted = this.isAccountExhausted(account);
     if (!exhausted && !this.isAccountSoftAvoided(account))
       return account;
@@ -22466,6 +22568,8 @@ class AuthBroker {
     for (const cand of this.config.auth?.fallback_order ?? []) {
       if (cand === account || this.isAccountExhausted(cand))
         continue;
+      if (!this.isServableBy(cand, forAgent))
+        continue;
       if (this.isAccountSoftAvoided(cand)) {
         softAvoidExcludedAny = true;
         continue;
@@ -22479,6 +22583,8 @@ class AuthBroker {
       for (const cand of this.config.auth?.fallback_order ?? []) {
         if (cand === account || this.isAccountExhausted(cand))
           continue;
+        if (!this.isServableBy(cand, forAgent))
+          continue;
         if (!readAccountCredentials(cand, this.home))
           continue;
         const score = this.softAvoidUtilScore(cand);
@@ -22493,12 +22599,14 @@ class AuthBroker {
       for (const cand of this.config.auth?.fallback_order ?? []) {
         if (cand === account || this.isAccountExhausted(cand))
           continue;
+        if (!this.isServableBy(cand, forAgent))
+          continue;
         if (readAccountCredentials(cand, this.home))
           return cand;
       }
     }
     const active = this.config.auth?.active;
-    if (active && active !== account && !this.isAccountExhausted(active) && readAccountCredentials(active, this.home)) {
+    if (active && active !== account && !this.isAccountExhausted(active) && this.isServableBy(active, forAgent) && readAccountCredentials(active, this.home)) {
       return active;
     }
     return account;
@@ -22550,7 +22658,9 @@ class AuthBroker {
     const agents = Object.entries(this.config.agents ?? {}).map(([name, agent]) => {
       const override = agent.auth?.override ?? null;
       const account = override ?? auth.active ?? "";
-      return { name, account, override };
+      const strict = Boolean(override && agent.auth?.strict);
+      const exclusive = Boolean(override && agent.auth?.exclusive);
+      return { name, account, override, strict, exclusive };
     });
     const consumers = (auth.consumers ?? []).map((c) => ({
       name: c.name,
@@ -22877,6 +22987,12 @@ class AuthBroker {
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `account '${account}' not found`));
       return;
     }
+    const exclusiveOwner = this.exclusiveOwnerOf(account);
+    if (exclusiveOwner) {
+      this.audit({ op: "set-active", identity, account, accountKind: "claude", ok: false, error: "exclusive-account" });
+      socket.write(encodeError(id, "FORBIDDEN", `account '${account}' is exclusive to agent '${exclusiveOwner}' ` + `(agents.${exclusiveOwner}.auth.exclusive) — it cannot be the fleet active. ` + `Clear the exclusive flag in switchroom.yaml first if you really mean this.`));
+      return;
+    }
     const cfg = {
       ...this.config,
       auth: { ...this.config.auth ?? {}, active: account }
@@ -22888,6 +23004,15 @@ class AuthBroker {
     this.audit({ op: "set-active", identity, account, accountKind: "claude", ok: true });
     socket.write(encodeSuccess(id, { active: account, fanned }));
   }
+  callerStrictPinned(identity) {
+    if (identity.kind !== "agent")
+      return false;
+    const a = (this.config.agents ?? {})[identity.name]?.auth;
+    return Boolean(a?.override && a?.strict);
+  }
+  callerRolledTo(identity, rolledTo) {
+    return this.callerStrictPinned(identity) ? null : rolledTo;
+  }
   async opMarkExhausted(socket, id, identity, until) {
     const account = this.callerAccount(identity);
     if (!account) {
@@ -22897,7 +23022,12 @@ class AuthBroker {
     }
     const { rolled, rolledTo } = await this.markExhaustedAndRoll(account, until, identity);
     this.audit({ op: "mark-exhausted", identity, account, accountKind: "claude", ok: true });
-    socket.write(encodeSuccess(id, { account, rolled, rolledTo }));
+    socket.write(encodeSuccess(id, {
+      account,
+      rolled,
+      rolledTo: this.callerRolledTo(identity, rolledTo),
+      caller_pinned_strict: this.callerStrictPinned(identity)
+    }));
   }
   async opMarkThrottled(socket, id, identity, until, probeOnly = false) {
     const account = this.callerAccount(identity);
@@ -22914,7 +23044,8 @@ class AuthBroker {
         account,
         throttled_until: this.quota[account]?.throttled_until ?? 0,
         escalated: escalated2,
-        rolledTo: escalated2 ? rolledTo2 : null
+        rolledTo: escalated2 ? this.callerRolledTo(identity, rolledTo2) : null,
+        caller_pinned_strict: this.callerStrictPinned(identity)
       }));
       return;
     }
@@ -22957,7 +23088,8 @@ class AuthBroker {
       account,
       throttled_until: throttledUntil,
       escalated,
-      rolledTo: escalated ? rolledTo : null
+      rolledTo: escalated ? this.callerRolledTo(identity, rolledTo) : null,
+      caller_pinned_strict: this.callerStrictPinned(identity)
     }));
   }
   async maybeEscalateThrottle(account, identity, now) {
@@ -23529,6 +23661,22 @@ class AuthBroker {
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `account '${account}' not found`));
       return;
     }
+    if (account !== null) {
+      const exclusiveOwner = this.exclusiveOwnerOf(account);
+      if (exclusiveOwner && exclusiveOwner !== agentName) {
+        this.audit({ op: "set-override", identity, account, accountKind: "claude", ok: false, error: "exclusive-account" });
+        socket.write(encodeError(id, "FORBIDDEN", `account '${account}' is exclusive to agent '${exclusiveOwner}' ` + `(agents.${exclusiveOwner}.auth.exclusive) — agent '${agentName}' cannot pin it.`));
+        return;
+      }
+    }
+    {
+      const curAuth = (this.config.agents ?? {})[agentName]?.auth;
+      if ((curAuth?.strict || curAuth?.exclusive) && account !== (curAuth?.override ?? null)) {
+        this.audit({ op: "set-override", identity, account: account ?? undefined, accountKind: "claude", ok: false, error: "yaml-pinned" });
+        socket.write(encodeError(id, "FORBIDDEN", `agent '${agentName}' has a strict/exclusive pin declared in switchroom.yaml — ` + `edit the yaml (agents.${agentName}.auth) and restart the broker to change it.`));
+        return;
+      }
+    }
     const agents = { ...this.config.agents ?? {} };
     const cur = agents[agentName];
     const auth = { ...cur.auth ?? {} };
@@ -23704,10 +23852,9 @@ class AuthBroker {
     return out;
   }
   fanoutToAffectedAgents(label) {
-    const auth = this.config.auth ?? {};
     const fanned = [];
-    for (const [name, agent] of Object.entries(this.config.agents ?? {})) {
-      const effective = this.accountWithFailover(agent.auth?.override ?? auth.active);
+    for (const name of Object.keys(this.config.agents ?? {})) {
+      const effective = this.servedAccountForAgent(name);
       if (effective === label) {
         if (this.fanoutForAgent(name))
           fanned.push(name);
@@ -23726,10 +23873,9 @@ class AuthBroker {
       const isEffective = effective === label;
       if (!isPinned && !isEffective)
         continue;
-      const toMirror = effective ?? bound;
-      if (toMirror == null)
+      if (effective == null)
         continue;
-      if (this.mirrorAccountToConsumer(toMirror, consumer)) {
+      if (this.mirrorAccountToConsumer(effective, consumer)) {
         fanned.push(consumer.name);
       }
     }
@@ -23830,6 +23976,10 @@ class AuthBroker {
       const effective = agent.auth?.override ?? auth.active;
       if (effective !== label)
         continue;
+      if (agent.auth?.override && agent.auth?.strict)
+        continue;
+      if (!this.isServableBy(next, name))
+        continue;
       if (this.mirrorAccountToAgent(next, name)) {
         rolled.push(name);
       }
@@ -23838,8 +23988,13 @@ class AuthBroker {
   }
   nextHealthyAccount(current, order) {
     const start = order.indexOf(current);
-    if (start === -1)
-      return order[0] ?? null;
+    if (start === -1) {
+      for (const cand of order) {
+        if (cand && !this.exclusiveOwnerOf(cand))
+          return cand;
+      }
+      return null;
+    }
     let bestSoftAvoided = null;
     let bestScore = Number.POSITIVE_INFINITY;
     for (let i = 1;i <= order.length; i++) {
@@ -23848,6 +24003,8 @@ class AuthBroker {
         continue;
       if (this.isAccountExhausted(cand) || !accountExists(cand, this.home))
         continue;
+      if (this.exclusiveOwnerOf(cand))
+        continue;
       if (!this.isAccountSoftAvoided(cand))
         return cand;
       const score = this.softAvoidUtilScore(cand);
@@ -23859,11 +24016,10 @@ class AuthBroker {
     return bestSoftAvoided;
   }
   fanoutForAgent(name) {
-    const auth = this.config.auth ?? {};
     const agent = (this.config.agents ?? {})[name];
     if (!agent)
       return false;
-    const effective = this.accountWithFailover(agent.auth?.override ?? auth.active);
+    const effective = this.servedAccountForAgent(name);
     if (!effective)
       return false;
     return this.mirrorAccountToAgent(effective, name);
@@ -23992,6 +24148,15 @@ class AuthBroker {
 `);
       return;
     }
+    const exclusiveOwner = this.exclusiveOwnerOf(ov.active);
+    if (exclusiveOwner) {
+      process.stdout.write(`auth-broker: active-override dropped — account '${ov.active}' is now exclusive ` + `to agent '${exclusiveOwner}' (agents.${exclusiveOwner}.auth.exclusive); yaml wins
+`);
+      try {
+        unlinkSync(join7(this.stateDir, "active-override.json"));
+      } catch {}
+      return;
+    }
     if (ov.active === this.config.auth?.active)
       return;
     this.config = {