switchroom 0.20.10 → 0.20.12

package/dist/vault/broker/server.js

@@ -4030,7 +4030,7 @@ var init_observation_scopes = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AntiConfabulationDirectiveSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, BuzzChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleServiceTokenSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AntiConfabulationDirectiveSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, BuzzChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleServiceTokenSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, ConfigRepoConfigSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   init_observation_scopes();
@@ -4480,7 +4480,7 @@ var init_schema = __esm(() => {
       reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent → uses global."),
       consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent → global.")
     }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
-    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1; and " + "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT — the background " + "half of switchroom's recall-admission split (#3660): of the " + "RECALL_MAX_CONCURRENT admission slots, at most this many may be held " + "by background consolidation recalls at once, so foreground per-turn " + "recall always keeps the remainder; must be >= 1 and strictly less " + "than RECALL_MAX_CONCURRENT or the engine refuses to boot; unset " + "means the image's derived default min(2, RECALL_MAX_CONCURRENT - 1); " + "1 biases hard toward the interactive lane while a consolidation " + "backlog drains; and " + "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S — the rollback/tuning knob for " + "switchroom's MM-refresh-debounce image patch: the minimum seconds " + "between consolidation-triggered refreshes of one mental model; unset " + "means the image's baked 3600, 0 restores upstream's " + "refresh-every-round behaviour; explicit and cron-scheduled refreshes " + "are never debounced; and " + "HINDSIGHT_API_TEMPORAL_LANGUAGES — the language set dateparser is " + "restricted to during temporal query analysis, made live by switchroom's " + "temporal-language image patch (which ended a 200+-locale auto-detection " + "pass that blocked the shared asyncio loop on every recall); " + "comma-separated, unset means the image's baked `en`, set e.g. `en,es` to " + "restore i18n parsing; and " + "HINDSIGHT_API_TEMPORAL_MAX_QUERY_CHARS — the max chars of query text " + "dateparser.search_dates() is handed during temporal analysis (0 = " + "unlimited), made live by switchroom's temporal-offload image patch " + "(which moved the synchronous extraction off the shared asyncio loop onto " + "a single-worker thread and bounds its input, ending multi-second loop " + "stalls on multi-KB consolidation queries); unset means the image's baked " + "2000, set 0 to restore an unbounded full scan), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
+    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1; and " + "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT — the background " + "half of switchroom's recall-admission split (#3660): of the " + "RECALL_MAX_CONCURRENT admission slots, at most this many may be held " + "by background consolidation recalls at once, so foreground per-turn " + "recall always keeps the remainder; must be >= 1 and strictly less " + "than RECALL_MAX_CONCURRENT or the engine refuses to boot; unset " + "means the image's derived default min(2, RECALL_MAX_CONCURRENT - 1); " + "1 biases hard toward the interactive lane while a consolidation " + "backlog drains; and " + "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S — the rollback/tuning knob for " + "switchroom's MM-refresh-debounce image patch: the minimum seconds " + "between consolidation-triggered refreshes of one mental model; unset " + "means the image's baked 3600, 0 restores upstream's " + "refresh-every-round behaviour; explicit and cron-scheduled refreshes " + "are never debounced; and " + "HINDSIGHT_API_TEMPORAL_LANGUAGES — the language set dateparser is " + "restricted to during temporal query analysis, made live by switchroom's " + "temporal-language image patch (which ended a 200+-locale auto-detection " + "pass that blocked the shared asyncio loop on every recall); " + "comma-separated, unset means the image's baked `en`, set e.g. `en,es` to " + "restore i18n parsing; and " + "HINDSIGHT_API_TEMPORAL_MAX_QUERY_CHARS — the max chars of query text " + "dateparser.search_dates() is handed during temporal analysis (0 = " + "unlimited), made live by switchroom's temporal-offload image patch " + "(which moved the synchronous extraction off the shared asyncio loop onto " + "a single-worker thread and bounds its input, ending multi-second loop " + "stalls on multi-KB consolidation queries); unset means the image's baked " + "2000, set 0 to restore an unbounded full scan); and " + "HINDSIGHT_API_TEXT_SEARCH_EXTENSION_NATIVE_LANGUAGE — the Postgres " + "text-search regconfig the native BM25 arms and the search_vector index " + "write run to_tsvector/to_tsquery against; unset means upstream's " + "always-safe `english`, set `hindsight_english` to use switchroom's " + "junk-stopping config (dict + stopword file provisioned durably by the " + "image entrypoint, recall degrading to semantic-only if it is ever " + "missing); plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
   });
   MicrosoftWorkspaceConfigSchema = exports_external.object({
     microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
@@ -4727,8 +4727,10 @@ var init_schema = __esm(() => {
     bot_username: exports_external.string().optional().describe("Per-agent Telegram bot username (without leading @) when it doesn't " + "contain the agent slug. Replaces the default 'username includes slug' " + "preflight check with an exact (case-insensitive) match. Use when an " + "agent and its bot have intentionally divergent names (e.g. agent " + "'lawgpt' paired with bot '@meken_law_bot')."),
     timezone: exports_external.string().regex(TIMEZONE_REGEX, "timezone must be an IANA zone name like 'Australia/Melbourne' or 'UTC' " + "(three-letter aliases like EST/PST and bare offsets like UTC+10 are not accepted)").optional().describe("Per-agent IANA timezone override. Wins over any profile/defaults " + "value and over the top-level switchroom.timezone global. Controls " + "the UserPromptSubmit timezone hook's emitted local time and the " + "agent container's `environment.TZ` in compose."),
     auth: exports_external.object({
-      override: exports_external.string().min(1).optional().describe("Per-agent override of the fleet-wide `auth.active`. Edge-case use only — " + "this agent talks to the named account regardless of fleet active. See RFC H §4.5.")
-    }).optional().describe("Account routing for switchroom-auth-broker. RFC H schema uses " + "fleet-wide `auth.active` plus per-agent `override:` for edge cases. " + "Pre-RFC-H `auth.accounts: [..]` and `auth_label:` are migrated in-place " + "on first apply (see src/auth/migrate-schema.ts)."),
+      override: exports_external.string().min(1).optional().describe("Per-agent override of the fleet-wide `auth.active`. Edge-case use only — " + "this agent talks to the named account regardless of fleet active. See RFC H §4.5."),
+      strict: exports_external.boolean().optional().describe("Requires `override`. When true, the pin is a hard binding, not a " + "routing preference: the broker NEVER serves this agent from any " + "other account — no failover to `auth.fallback_order` while the " + "pinned account is quota-walled or exhausted. The agent rides out " + "the wall on its own account (surfacing the normal 429/quota " + "cards) instead of silently borrowing fleet quota. Use for " + "accounts that must never cross a billing/compliance boundary " + "(e.g. an employer-provided subscription)."),
+      exclusive: exports_external.boolean().optional().describe("Requires `override`. When true, the pinned account belongs to " + "THIS agent alone: the broker refuses to serve it to any other " + "agent or consumer, refuses `auth use <label>` (set-active) onto " + "it, and refuses pinning another agent to it. Config that routes " + "others to the account (`auth.active`, `auth.fallback_order`, " + "another agent's `override`, a consumer pin) is rejected at load. " + "Usually paired with `strict: true` for full two-way isolation.")
+    }).optional().describe("Account routing for switchroom-auth-broker. RFC H schema uses " + "fleet-wide `auth.active` plus per-agent `override:` for edge cases, " + "with optional `strict:` (never borrow another account) and " + "`exclusive:` (no one else may use the pinned account) hardening. " + "Pre-RFC-H `auth.accounts: [..]` and `auth_label:` are migrated in-place " + "on first apply (see src/auth/migrate-schema.ts)."),
     dm_only: exports_external.boolean().optional().describe("Mark this agent as a DM-only bot — has its own bot_token and lives " + "exclusively in a private chat with the operator. Suppresses " + "scaffolding's default behavior of inheriting the global " + "telegram.forum_chat_id into the agent's access.json `groups` entry " + "(the forum chat the bot isn't a member of, which would otherwise " + "trigger a 'boot-probe-failed: 400 chat not found' warning every " + "restart). topic_name is still schema-required but unused — set it " + "to a display label like 'DM' for /switchroom status output."),
     topic_name: exports_external.string().describe("Telegram forum topic display name"),
     topic_emoji: exports_external.string().optional().describe("Emoji for the topic (e.g., '\uD83C\uDFCB️')"),
@@ -4803,6 +4805,17 @@ var init_schema = __esm(() => {
       tmp_size: exports_external.string().regex(/^\d+(\.\d+)?[kmgKMG]?$/, "tmp_size must be a Docker size string like '1g', '4g', '512m'").refine((v) => parseFloat(v) > 0, "tmp_size must be greater than zero").optional()
     }).optional()
   }).superRefine((agent, ctx) => {
+    if (agent.auth && !agent.auth.override) {
+      for (const flag of ["strict", "exclusive"]) {
+        if (agent.auth[flag]) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            message: `\`auth.${flag}: true\` requires \`auth.override: <account>\` — there is no pinned account for it to apply to.`,
+            path: ["auth", flag]
+          });
+        }
+      }
+    }
     if (agent.dm_only !== true)
       return;
     const tg = agent.channels?.telegram;
@@ -4915,6 +4928,15 @@ var init_schema = __esm(() => {
     profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
     person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system — just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership — never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later — see docs/configuration.md.")
   });
+  ConfigRepoConfigSchema = exports_external.object({
+    enabled: exports_external.boolean().default(false).describe("Master switch for config-repo change control. Default false (opt-in). " + "When false the `config-repo sync` verb still runs on demand but the " + "doctor check and (later) the scheduled tick treat the feature as off."),
+    path: exports_external.string().regex(/^[a-zA-Z0-9~._\-/]+$/, "config_repo.path must not contain shell-special characters ($, `, \", ', \\, etc.)").default("~/.switchroom-config").describe("Filesystem path to the operator's private config repo. Must be a git " + "repo (else `switchroom doctor` FAILs). Tilde-expanded at read time."),
+    push: exports_external.boolean().default(true).describe("When true, `config-repo sync` pushes after committing (subject to the " + "`require_private` gate). When false, it commits locally only — useful " + "for offline hosts or a review-before-push workflow."),
+    remote: exports_external.string().min(1).default("origin").describe("Git remote name to push to. Default `origin`."),
+    require_private: exports_external.boolean().default(true).describe("Refuse to PUSH unless the GitHub API confirms the remote repo is " + "private. On a public remote — or when the API is unreachable — the " + "push is skipped (commits still land locally) and a WARN is emitted. " + "Fail-safe against exfiltrating memory files / workspace state to a " + "repo that has been flipped public. Default true."),
+    interval_minutes: exports_external.number().int().min(5).max(59).default(30).describe("Cadence (minutes) of the scheduled `config-repo sync` tick installed " + "by `switchroom config-repo --install-cron`. Rendered as a cron " + "`*/N * * * *` minute field, so it must be 5..59 (the 5-min floor " + "matches the rest of the fleet's cron floor). Default 30 (Ken's " + "approved cadence). Changing it takes effect on the next " + "`--install-cron` / `switchroom update` reconcile."),
+    include_vault_backup: exports_external.enum(["off", "daily", "every_tick"]).default("daily").describe("Whether the scheduled tick also runs `switchroom vault backup` " + "(an encrypted vault/memory snapshot into <path>/vault-backups/) " + "before the sync. `off`: sync only. `daily`: an extra once-per-day " + "cron leg runs `vault backup && config-repo sync` (the 30-min legs " + "stay sync-only). `every_tick`: every tick runs the backup first. " + "Default `daily` — the first automated vault backup on this host.")
+  });
   SwitchroomConfigSchema = exports_external.object({
     switchroom: exports_external.object({
       version: exports_external.literal(1).describe("Config schema version"),
@@ -4927,6 +4949,7 @@ var init_schema = __esm(() => {
     memory: MemoryBackendConfigSchema.optional(),
     hindsight: HindsightConfigSchema.optional().describe("Fleet-singleton Hindsight (memory backend) configuration. Currently " + "just the LLM knob (provider + model) used for retain/reflect/" + "consolidation. Both fields optional; when unset the container falls " + "back to provider=claude-code + the hard-coded HINDSIGHT_DEFAULT_MODEL " + "so nothing changes for operators who don't set it. Read at container " + "launch by startHindsight() (src/setup/hindsight.ts) — takes effect on " + "the next `switchroom apply` / `memory setup --recreate`."),
     vault: VaultConfigSchema.optional(),
+    config_repo: ConfigRepoConfigSchema.optional().describe("Change control for the operator's private ~/.switchroom-config git repo " + "(backup + audit trail of live host config, agent workspace state, and " + "mirrored personal skills). Consumed by `switchroom config-repo sync` and " + "the `config repo` doctor check. Optional and OFF by default."),
     auth: exports_external.object({
       active: exports_external.string().min(1).optional().describe("Fleet-wide active Anthropic account label. Every agent without " + "an explicit `agent.auth.override` uses this account. See " + "docs/auth.md for the full model. Set by `switchroom auth use <label>`."),
       fallback_order: exports_external.array(exports_external.string().min(1)).optional().describe("Ordered list of account labels for `switchroom auth rotate` to cycle " + "through when the active account hits a quota event. First entry is " + "normally the same as `auth.active`. When unset, `rotate` is a no-op."),
@@ -4994,6 +5017,48 @@ var init_schema = __esm(() => {
     for (const [name, a] of Object.entries(cfg.agents ?? {})) {
       checkServes(a.serves, ["agents", name, "serves"]);
     }
+    for (const [name, a] of Object.entries(cfg.agents ?? {})) {
+      const agentAuth = a.auth;
+      if (!agentAuth?.exclusive || !agentAuth.override)
+        continue;
+      const acct = agentAuth.override;
+      if (cfg.auth?.active === acct) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — it cannot be the fleet \`auth.active\``,
+          path: ["auth", "active"]
+        });
+      }
+      const fbIdx = (cfg.auth?.fallback_order ?? []).indexOf(acct);
+      if (fbIdx !== -1) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — it cannot appear in \`auth.fallback_order\``,
+          path: ["auth", "fallback_order", fbIdx]
+        });
+      }
+      for (const [other, oa] of Object.entries(cfg.agents ?? {})) {
+        if (other === name)
+          continue;
+        const otherOverride = oa.auth?.override;
+        if (otherOverride === acct) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — agent '${other}' cannot pin it`,
+            path: ["agents", other, "auth", "override"]
+          });
+        }
+      }
+      (cfg.auth?.consumers ?? []).forEach((c, i) => {
+        if (c.account === acct) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — consumer '${c.name}' cannot pin it`,
+            path: ["auth", "consumers", i, "account"]
+          });
+        }
+      });
+    }
     const microsoftAccounts = cfg.microsoft_accounts;
     for (const [name, a] of Object.entries(cfg.agents ?? {})) {
       const mw = a.microsoft_workspace;
@@ -19631,6 +19696,27 @@ function allocateAgentUid(name) {
   return AGENT_UID_MIN + u32 % range;
 }
 
+// src/setup/hindsight-recall-passthrough.ts
+var HINDSIGHT_RECALL_TAG_WEIGHT_SEED = Object.freeze({ sidechain: 0.8 });
+var HINDSIGHT_RECALL_PROMPT_PREAMBLE_DEFAULT = "Relevant memories from past conversations (prioritize recent when " + "conflicting). Only use memories that are directly useful to continue " + "this conversation; ignore the rest:";
+var RECALL_PASSTHROUGH_DEFAULTS = Object.freeze({
+  budget: "low",
+  maxTokens: 1024,
+  preferObservations: true,
+  contextTurns: 2,
+  roles: ["user", "assistant"],
+  promptPreamble: HINDSIGHT_RECALL_PROMPT_PREAMBLE_DEFAULT,
+  tags: [],
+  tagsMatch: "any",
+  tagGroups: {},
+  tagWeights: HINDSIGHT_RECALL_TAG_WEIGHT_SEED,
+  additionalBankFilters: {},
+  transcriptFallback: true,
+  transcriptTailBytes: 262144,
+  maxQueryChars: 800,
+  parallel: true
+});
+
 // src/setup/hindsight-recall-tunables.ts
 var RECALL_DEADLINE_HEADROOM_SECONDS = 2;
 var MIN_RECALL_HOOK_TIMEOUT_SECONDS = RECALL_DEADLINE_HEADROOM_SECONDS + 1;
@@ -20078,7 +20164,8 @@ var HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS = new Set([
   "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT",
   "HINDSIGHT_MM_REFRESH_MIN_INTERVAL_S",
   "HINDSIGHT_API_TEMPORAL_LANGUAGES",
-  "HINDSIGHT_API_TEMPORAL_MAX_QUERY_CHARS"
+  "HINDSIGHT_API_TEMPORAL_MAX_QUERY_CHARS",
+  "HINDSIGHT_API_TEXT_SEARCH_EXTENSION_NATIVE_LANGUAGE"
 ]);
 var HINDSIGHT_WORKER_SLOT_TYPES = [
   "consolidation",
@@ -20500,27 +20587,6 @@ init_vault();
 // src/setup/onboarding.ts
 init_paths();
 
-// src/setup/hindsight-recall-passthrough.ts
-var HINDSIGHT_RECALL_TAG_WEIGHT_SEED = Object.freeze({ sidechain: 0.8 });
-var HINDSIGHT_RECALL_PROMPT_PREAMBLE_DEFAULT = "Relevant memories from past conversations (prioritize recent when " + "conflicting). Only use memories that are directly useful to continue " + "this conversation; ignore the rest:";
-var RECALL_PASSTHROUGH_DEFAULTS = Object.freeze({
-  budget: "low",
-  maxTokens: 1024,
-  preferObservations: true,
-  contextTurns: 2,
-  roles: ["user", "assistant"],
-  promptPreamble: HINDSIGHT_RECALL_PROMPT_PREAMBLE_DEFAULT,
-  tags: [],
-  tagsMatch: "any",
-  tagGroups: {},
-  tagWeights: HINDSIGHT_RECALL_TAG_WEIGHT_SEED,
-  additionalBankFilters: {},
-  transcriptFallback: true,
-  transcriptTailBytes: 262144,
-  maxQueryChars: 800,
-  parallel: true
-});
-
 // src/repos/bare-clone.ts
 init_paths();
 

package/examples/personal-google-workspace-mcp/compose.yaml

@@ -38,7 +38,7 @@ services:
       # Pinned: bumping is a deliberate operator decision, not a silent
       # surprise. Bump in lockstep with retesting the OAuth flow.
       - --from
-      - workspace-mcp==1.20.4
+      - workspace-mcp==1.23.1
       - workspace-mcp
       # streamable-http (not stdio) is required for OAuth 2.1 PKCE per
       # upstream README.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.20.10",
+  "version": "0.20.12",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/_shared/agent-self-service.md.hbs

@@ -48,16 +48,12 @@ hot-reloads, no restart needed.
   crons. `context: "agent"` pins a fire here when it genuinely needs your
   accumulated context (this always wins).
 - **Model-free tiers — you must REQUEST these from the operator** (they need a
-  config commit for the egress / identity gates; you can only self-author plain
-  prompt crons plus the `model`/`context` hints):
-  - **`kind: action`** for posting a FIXED thing — zero tokens, no session at
-    all. Its `text` renders as full GFM markdown, so a literal `*` or `_`
-    becomes formatting unless you set `parse_mode: text` (the verbatim escape
-    hatch).
-  - **`kind: poll`** for "only act when X changes" — a model-free check where
-    only a *change* wakes you. Don't burn a frequent prompt cron on polling.
-  - **`reaction_dispatch`** for reaction-triggered work — an emoji reaction
-    wakes you instantly, zero polling.
+  config commit; you can only self-author plain prompt crons plus the
+  `model`/`context` hints): **`kind: action`** posts a FIXED text at zero
+  tokens (renders full GFM — set `parse_mode: text` for verbatim);
+  **`kind: poll`** is a model-free check where only a *change* wakes you —
+  don't burn a frequent prompt cron on polling; **`reaction_dispatch`** wakes
+  you instantly on an emoji reaction, zero polling.
 
 Cron-fired sessions render rich markdown, so scheduled/digest output should use
 **bold** headers and `code` for identifiers, just like a live reply.
@@ -87,11 +83,10 @@ fork is durable and auto-mirrors to `~/.switchroom-config/` when present.
 
 ### Confirm honestly
 
-After a successful `schedule_add`, tell the user the human-readable schedule
-("every Sunday at 5pm"), the cron expression you actually wrote, the `name`
-slug (so they can remove it later), and when it first fires if that isn't
-obvious. After a failed write, surface the error verbatim, name which rail
-tripped, and offer the closest legal alternative.
+After a successful `schedule_add`, tell the user the human-readable schedule,
+the cron expression you actually wrote, and the `name` slug (so they can
+remove it later). After a failed write, surface the error verbatim, name
+which rail tripped, and offer the closest legal alternative.
 {{#if linearAgentEnabled}}
 
 ## Capture to Linear (👨‍💻 / 📌 reaction → new issue)
@@ -157,10 +152,8 @@ config or paste them into a normal message; pass them straight to the tool.
 
 ### Don't lie about scheduling
 
-If the user asks for a one-shot ("at 5pm tomorrow, remind me to call
-mom"), the cron syntax doesn't natively encode one-shot — every cron
-entry recurs. Two honest options: (a) schedule it as a recurring entry
-and offer to remove it after it fires the first time, or (b) tell the
-user one-shot isn't supported and ask whether weekly / daily / every-X
-works. Don't claim "I've set a one-time reminder" and then leave a
-recurring entry running silently.
+Cron can't encode a one-shot — every entry recurs. For "at 5pm tomorrow,
+remind me": either (a) schedule it recurring and offer to remove it after
+the first fire, or (b) say one-shot isn't supported and ask what cadence
+works. Never claim "one-time reminder" while leaving a recurring entry
+running silently.

package/profiles/_shared/delegation-golden-rule.md.hbs

@@ -4,6 +4,6 @@ Execution belongs in sub-agents. **When in doubt, delegate.** A task is executio
 
 Acting in-turn and delegating are the same move: for an execution-class task the in-turn act IS dispatching the worker, so dispatch and acknowledge — that IS the fast response, not a slower one. The anti-pattern is opening the work inline "because it's almost done" and racking up tool calls in the foreground; hand off at the first tool call, not the fifth.
 
-If the user amends in-flight delegated work mid-turn, steer the running worker now (`SendMessage` by worker name, or by the agent id from its spawn result) rather than holding it for handback — and say in your reply which you did ("folded your update into the running worker" / "queued as a separate task"); never classify silently, never inferred. Unsure which it is? Queue it and say so — queue is the default. If the worker is effectively done and the steer lands too late, say so and apply the update yourself in the parent.
+If the user amends in-flight delegated work mid-turn, steer the running worker now (`SendMessage` by worker name or agent id) rather than holding it for handback — and say in your reply which you did ("folded your update into the running worker" / "queued as a separate task"); never classify silently, never inferred. Unsure? Queue it and say so — queue is the default. If the worker is effectively done and the steer lands too late, say so and apply the update yourself in the parent.
 
 If no sub-agents are configured, do the work yourself.

package/profiles/_shared/dev-protocol.md.hbs

@@ -9,6 +9,6 @@ This governs HOW delegated work is done, and is **not a license to do it inline*
 - **Design report before implementation, when the change is large.** Architecturally significant, cross-cutting, or ambiguous-approach work earns an evidence-grounded design report and a red-team pass before code, and ships as focused single-concern PRs.
 - **Run `git fetch origin` first, then branch off `origin/main`.** Never branch off the working copy as-is: you do not start in the repo you are coding in, and the checkout on disk may be many commits stale. Scoped tests + lint locally; CI is the full-suite authority.
 - **Adversarial review of the diff.** Read every change as an adversary would: what breaks, what's untested, what's inconsistent.
-- **Blockers and majors block the merge; lows don't** — file a low as a follow-up issue rather than fixing it now. Filing is mandatory. Fix what blocks, then merge on CI green. Do not count review rounds and do not run a mandatory re-review pass: verifying your own fix is part of making it, not a separate step.
+- **Blockers and majors block the merge; prefer fixing lows before merge too** — ship reliable code with a slight delay over filing tech debt that never gets addressed. Fix a low now unless it's genuinely out of scope or disproportionate to the change; only then file it as a tracked follow-up (filing is mandatory, and a filed low is a commitment to fix it, not a way to forget it). Fix what blocks, then merge on CI green. Do not count review rounds and do not run a mandatory re-review pass: verifying your own fix is part of making it, not a separate step. When that fix-vs-defer call is a genuine judgment call, don't decide it silently — surface it to the user as choice / user-impact / recommendation: name the options (fix now vs defer), their user-outcome impact, and which you recommend.
 - **Durable fixes over hack patches. Deterministic mechanisms over model-dependent behaviour** — if code can enforce a guarantee, don't leave it to prompt discipline. **Tests assert outcomes, not just code paths:** one that wouldn't fail on the bug it guards is not a test.
 - **Communicate as you go.** Consolidated messages — one substantive update beats five fragments; never go dark; no foreground watch over 30 seconds (background it); max 15 parallel sub-agents.

package/profiles/_shared/execution-discipline.md.hbs

@@ -1,10 +1,10 @@
 ## Grounding — check before you assert
 
-Your memory and prior context are leads, not facts. Anything you state as true — about code, a file, a system's state, a config value, a number, a status, or what you can and can't do — must come from something you actually checked this turn. When you have a way to look, look.
+Your memory and prior context are leads, not facts. Anything you state as true — code, config, a system's state, a number, a status, or what you can and can't do — must come from something you actually checked this turn.
 
-- **Read the ground truth live.** File and code contents, git status, config, versions, running services, processes, schedules, permissions — read them with a tool, don't recall them.
-- **Prefer finding over guessing.** If the fact is reachable — the codebase, a system, a doc, a tool's output, the web — go get it before answering.
-- **Don't assert a limit you haven't tested.** Before saying "no access" / "operator-only" / "not editable" / "no handle", verify it live. A fabricated boundary is as wrong as a fabricated fact, and it stops work that was actually possible.
+- **Read the ground truth live.** Files, git status, config, versions, running services, schedules, permissions — read them with a tool, don't recall them.
+- **Training memory is a lead, not a source — prefer finding over guessing.** A library's API, a version, a CLI flag, whether a repo exists — but equally a real-world fact: who a person is, what a company does, a product, a current event: validate against the real thing (the web, docs, the repo) before you assert it. Never answer "I don't recognize X" from model recall when X is one search away.
+- **Don't assert a limit you haven't tested.** Before saying "no access" / "operator-only" / "not editable", verify it live. A fabricated boundary is as wrong as a fabricated fact.
 - **A weak or empty result isn't a conclusion.** Vary the query, path, command, or source before deciding something doesn't exist.
 - **Final answers carry evidence** — tool output, a file you read, a check you ran, or a named blocker; not "it should work."
 

package/profiles/_shared/vault-protocol.md.hbs

@@ -1,12 +1,4 @@
-<!--
-  Switchroom-managed: vault protocol.
-  Rendered automatically by `switchroom apply` / `agent reconcile` from
-  profiles/_shared/vault-protocol.md.hbs. Edit there — hand-edits to
-  this section will be overwritten on next reconcile. To add agent-
-  specific guidance, edit CLAUDE.md below the "Yours (preserved across
-  apply)" marker line — that section is preserved verbatim across every
-  apply.
--->
+<!-- Switchroom-managed: rendered from profiles/_shared/vault-protocol.md.hbs — edit there; hand-edits here are overwritten on reconcile. -->
 
 ## Vault & secrets
 
@@ -65,15 +57,7 @@ there's an operator in the loop:
 
 ### When a sub-agent or tool reports a service/API/credential as "inaccessible"
 
-Treat this as the same signal as `VAULT-BROKER-DENIED` from your own tools. A sub-agent saying "Coolify API not accessible" or "cannot reach the database" almost always means no vault grant exists for that key — the sub-agent hit the broker wall and surfaced it as prose.
-
-Don't escalate to the operator to paste credentials or open a dashboard. Instead:
-
-1. Infer the likely key name (`<service>/<key>` convention — e.g. `coolify/api-token`, `github/token`, `<repo>/DATABASE_URL`).
-2. Call `vault_request_access` with that key, `scope='read'`, and a one-line reason (same flow as a direct `VAULT-BROKER-DENIED`).
-3. End your turn cleanly and resume when the grant is approved.
-
-Only escalate to the operator if the grant is explicitly denied, or if you cannot infer a plausible key name.
+That's the broker wall surfacing as prose — treat it as `VAULT-BROKER-DENIED`. Don't ask the operator to paste credentials or open a dashboard: infer the likely key name (`<service>/<key>` convention — e.g. `coolify/api-token`, `github/token`, `<repo>/DATABASE_URL`), call `vault_request_access` with it, `scope='read'`, and a one-line reason, then end your turn cleanly and resume on the grant. Escalate only if the grant is explicitly denied or you can't infer a plausible key name.
 
 ### Hint: the deny stderr tells you the exact recovery
 

package/profiles/default/CLAUDE.md.hbs

@@ -28,7 +28,7 @@ You are operating in the **{{topicName}}** {{#if topicEmoji}}{{topicEmoji}} {{/i
 - Prefer `trash` over `rm` when available (recoverable beats gone forever).
 - Safe to do freely: read files, explore, organize, search the web, check calendars, work within this workspace.
 - Ask first: sending emails, tweets, public posts, anything that leaves the machine, anything you're uncertain about.
-- **Batch foreseeable approvals; don't drip surprises.** When you can already see that several actions will each need the user's approval, tell them up front which approvals are coming and why. Request independent ones together so they can decide once; for dependent ones (one's input comes from another), say what you're doing first and what approval comes next — a permission card should never arrive out of the blue.
+- **Batch foreseeable approvals; don't drip surprises.** When several actions will each need the user's approval, say up front which are coming and why: request independent ones together so they decide once; for dependent ones, say what's next — a permission card should never arrive out of the blue.
 - **A timed-out approval isn't a denial.** If a request came back denied only because the user was away (a timeout, not an explicit "no"), don't silently abandon it. When they're back, remind them it's still pending and re-offer it if they still want it.
 
 ## Memory — Hindsight is your single backend
@@ -52,7 +52,7 @@ Hard rules the agent must follow during reflect — guardrails that are always a
 
 - `mcp__hindsight__create_directive(text)` — e.g., `create_directive("Always prefer TypeScript over JavaScript for this user's projects")`. When the user gives you a correction or "always do X" rule, create a directive instead of writing a feedback `.md` file. If the rule can be enforced deterministically — a settings.json hook, a permission rule, a skill/script edit, or a config change — prefer that (instead of, or in addition to, the directive) and say which you did; reserve directives for judgment rules code can't enforce.
 
-(Read-only inspection tools like `list_memories`, `list_mental_models`, `get_mental_model`, `list_directives` are available under the `mcp__hindsight__*` namespace if you ever need them, but you rarely should — Hindsight's own auto-recall surfaces what matters and the operator handles bank curation out-of-band. The mental-model WRITE tools — `create`/`update`/`refresh`/`delete_mental_model` — are gated: propose via `mcp__switchroom-telegram__mental_model_propose`, don't call them directly.)
+(Read-only inspection tools — `list_memories`, `list_mental_models`, `get_mental_model`, `list_directives` — exist under `mcp__hindsight__*` if you ever need them, but you rarely should: auto-recall surfaces what matters and the operator curates the bank out-of-band.)
 
 ### What to retain — and what NOT to retain
 
@@ -68,7 +68,7 @@ Don't retain:
 - Sensitive content the user explicitly asked you to not remember
 - Things already in a mental model — they'll be re-derived from underlying memories
 
-The plugin's auto-retain (Stop hook) runs in chunked mode — it fires every 3rd turn by default and processes only the recent window (~4 turns) — so storage stays prompt and cheap and survives restarts without re-sending the whole transcript, and you don't need to manually retain everything. Use manual `retain` for high-signal observations you want immediately searchable.
+Auto-retain (see above) covers routine capture; use manual `retain` for high-signal observations you want immediately searchable.
 
 ### When to synthesize — concrete triggers
 
@@ -93,8 +93,6 @@ By default, every restart starts a **fresh `claude` session** — the in-flight
 
 A config-summary greeting card is sent automatically by the SessionStart hook — you don't need to announce yourself. If your context feels thin (after compaction or any fresh session), proactively recall from Hindsight before proceeding.
 
-(Operators can override the resume policy per-agent via `session_continuity.resume_mode` in switchroom.yaml — `auto`, `continue`, `handoff`, or `none`. The default is `handoff`.)
-
 {{#if admin}}
 ## Admin surface
 

package/skills/switchroom-architecture/telegram.md

@@ -11,7 +11,6 @@ Switchroom ships an enhanced `switchroom-telegram` MCP plugin that replaces the
 | `edit_message` | Update a previously sent message. Edits are silent (no push notification). |
 | `delete_message` | Remove a bot-sent message (48h Telegram API limit). |
 | `forward_message` | Quote/resurface earlier messages with thread support. |
-| `pin_message` | Pin important outputs (requires bot admin). |
 | `send_typing` | Show typing indicator (5s auto-expire). Use during long operations. |
 | `download_attachment` | Fetch files attached to inbound messages. |
 | `get_recent_messages` | Query SQLite history buffer with pagination and thread filtering. |

package/skills/switchroom-cli/SKILL.md

@@ -299,7 +299,6 @@ The `switchroom-telegram` plugin is an enhanced fork of the official Telegram MC
 | `edit_message` | Modify an earlier bot message's text |
 | `delete_message` | Remove an earlier bot message |
 | `forward_message` | Forward a message from another chat |
-| `pin_message` | Pin a message in the current chat |
 | `send_typing` | Show the "typing…" indicator |
 | `download_attachment` | Save a Telegram file attachment to the agent's inbox |
 | `get_recent_messages` | Fetch recent history for context |

package/telegram-plugin/README.md

@@ -38,8 +38,8 @@ adds the ergonomics and reliability that an always-on agent fleet needs:
 - **Switchroom slash-commands** — `/agents`, `/restart`, `/logs`, `/memory`,
   `/grant`, `/dangerous`, `/permissions`, `/reconcile` etc., handled by the
   plugin without consuming Claude Code tokens.
-- **11 MCP tools** — `reply`, `react`, `edit_message`,
-  `delete_message`, `forward_message`, `pin_message`, `send_typing`,
+- **10 MCP tools** — `reply`, `react`, `edit_message`,
+  `delete_message`, `forward_message`, `send_typing`,
   `download_attachment`, `get_recent_messages`, `send_checklist`,
   `update_checklist` (the latter two ship native Telegram checklists,
   see #272).
@@ -228,15 +228,6 @@ Sends a typing indicator ("Bot is typing...") to a chat. Auto-expires after ~5 s
 |-----------|----------|-------------|
 | `chat_id` | yes | Target chat ID |
 
-### `pin_message` tool
-
-Pins a message in a chat. Requires admin rights in groups.
-
-| Parameter | Required | Description |
-|-----------|----------|-------------|
-| `chat_id` | yes | Chat ID |
-| `message_id` | yes | Message to pin |
-
 ### `forward_message` tool
 
 Forwards an existing message to a chat, preserving original sender attribution. In forum topics, the forwarded message lands in the correct thread (auto-detected or explicit).

package/telegram-plugin/auto-fallback-fleet.ts

@@ -159,6 +159,18 @@ export type FleetFallbackOutcome =
       oldLabel: string;
       announcement: string;
       oldQuota: QuotaUtilization | null;
+    }
+  | {
+      /** The triggering agent has a strict pin (`auth.strict`) — the broker
+       *  marked its account but deliberately did not roll it. Distinct from
+       *  'no-eligible-target' so the gateway can apply its own notice
+       *  cooldown: like all-blocked, this is a no-op outcome the ~60s
+       *  quota_wall_detected re-trigger would otherwise re-broadcast for
+       *  the life of the wall. */
+      kind: 'strict-pinned';
+      oldLabel: string;
+      announcement: string;
+      oldQuota: QuotaUtilization | null;
     };
 
 export interface FleetFallbackDeps {
@@ -177,7 +189,14 @@ export interface FleetFallbackDeps {
    *  /auth button uses) is gated to admin agents, so a non-admin agent that
    *  429'd could never self-heal. mark-exhausted derives the account from the
    *  caller's own identity, so it needs no admin. */
-  failover: () => Promise<{ rolledTo: string | null; rolled: string[] }>;
+  failover: () => Promise<{
+    rolledTo: string | null;
+    rolled: string[];
+    /** True when the triggering agent has a strict pin (`auth.strict`): its
+     *  null `rolledTo` means it rides out the wall on its own account — NOT
+     *  a fleet-wide all-blocked. Absent from pre-flag brokers → false. */
+    callerPinnedStrict?: boolean;
+  }>;
   /** Agent that triggered this fallback (for the announcement byline). */
   triggerAgent: string;
   /** Operator timezone for absolute reset times in the announcement. */
@@ -259,7 +278,23 @@ export async function runFleetAutoFallback(
   // choice (same `nextHealthyAccount` selection /auth rotate uses) rather than
   // picking here, so the announcement matches what actually happened. Caller
   // catches and surfaces failures — we don't double-wrap.
-  const { rolledTo } = await deps.failover();
+  const { rolledTo, callerPinnedStrict } = await deps.failover();
+
+  if (!rolledTo && callerPinnedStrict) {
+    // Strict pin: the broker marked the account but deliberately did not roll
+    // the caller (agents.<name>.auth.strict). Rendering the all-blocked card
+    // here would tell the operator the whole fleet is exhausted while the
+    // snapshots in that very card show healthy accounts.
+    return {
+      kind: 'strict-pinned',
+      oldLabel: oldSnap.label,
+      oldQuota: oldSnap.quota,
+      announcement:
+        `_**${escapeMarkdown(deps.triggerAgent)}** is strictly pinned to ` +
+        `${escapeMarkdown(oldSnap.label)} (\`auth.strict\`) — riding out the wall ` +
+        `on its own account. The rest of the fleet is unaffected._`,
+    };
+  }
 
   if (!rolledTo) {
     // All-blocked path: the broker found no non-exhausted fallback. The active

package/telegram-plugin/bridge/bridge.ts

@@ -213,18 +213,6 @@ const TOOL_SCHEMAS = [
       required: ['chat_id'],
     },
   },
-  {
-    name: 'pin_message',
-    description: 'Pin a message in a Telegram chat. Useful for important outputs the user wants to find later. Requires admin rights in groups.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        chat_id: { type: 'string' },
-        message_id: { type: 'string' },
-      },
-      required: ['chat_id', 'message_id'],
-    },
-  },
   {
     name: 'delete_message',
     description: 'Delete a message the bot previously sent. Prefer edit_message if you just want to update text — delete_message is for true removal.',

package/telegram-plugin/chat-lock.ts

@@ -2,7 +2,7 @@
  * Per-(chat, thread) FIFO serialization for outbound Telegram API calls.
  *
  * Without this, concurrent MCP tool handlers (reply, stream_reply, react,
- * edit_message, delete_message, pin_message, forward_message) all call
+ * edit_message, delete_message, forward_message) all call
  * `bot.api.*` independently. When two calls race, HTTP latency can flip
  * their delivery order — a later `reply` can land before an earlier
  * `stream_reply` edit, or a `react` can resolve before the `reply` it

package/telegram-plugin/dist/bridge/bridge.js

@@ -25196,18 +25196,6 @@ var TOOL_SCHEMAS = [
       required: ["chat_id"]
     }
   },
-  {
-    name: "pin_message",
-    description: "Pin a message in a Telegram chat. Useful for important outputs the user wants to find later. Requires admin rights in groups.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        chat_id: { type: "string" },
-        message_id: { type: "string" }
-      },
-      required: ["chat_id", "message_id"]
-    }
-  },
   {
     name: "delete_message",
     description: "Delete a message the bot previously sent. Prefer edit_message if you just want to update text \u2014 delete_message is for true removal.",