switchroom 0.20.8 → 0.20.10

package/dist/auth-broker/index.js

@@ -12053,7 +12053,7 @@ function deriveOverlayTitle(raw, fileName) {
     return;
   return base.length > 0 ? base : undefined;
 }
-function readOverlayFile(agentName, file, agentCfg, warnings) {
+function readOverlayFile(agentName, file, agentCfg, warnings, source) {
   try {
     return readFileSync(file, "utf-8");
   } catch (err) {
@@ -12066,7 +12066,7 @@ function readOverlayFile(agentName, file, agentCfg, warnings) {
       reason: `read error: ${err.message}`,
       code: code ?? "EUNKNOWN"
     };
-    recordReadFailure(agentCfg, { file, code: w.code });
+    recordReadFailure(agentCfg, { file, code: w.code, source });
     warnings.push(w);
     console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${file}': ${w.reason}`);
     return;
@@ -12130,14 +12130,14 @@ function applyAgentOverlays(config) {
           reason: `read error: cannot list overlay directory (${code})`,
           code
         };
-        recordReadFailure(agentCfg, { file: scheduleDir, code });
+        recordReadFailure(agentCfg, { file: scheduleDir, code, source: "schedule" });
         warnings.push(w);
         console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${scheduleDir}': ${w.reason}`);
       });
       if (files.length > 0) {
         const merged = [...agentCfg.schedule ?? []];
         for (const file of files) {
-          const raw = readOverlayFile(agentName, file, agentCfg, warnings);
+          const raw = readOverlayFile(agentName, file, agentCfg, warnings, "schedule");
           if (raw === undefined)
             continue;
           try {
@@ -12182,7 +12182,7 @@ function applyAgentOverlays(config) {
           reason: `read error: cannot list overlay directory (${code})`,
           code
         };
-        recordReadFailure(agentCfg, { file: skillsDir, code });
+        recordReadFailure(agentCfg, { file: skillsDir, code, source: "skills" });
         warnings.push(w);
         console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${skillsDir}': ${w.reason}`);
       });
@@ -12190,7 +12190,7 @@ function applyAgentOverlays(config) {
         const merged = [...agentCfg.skills ?? []];
         const seen = new Set(merged);
         for (const file of skillFiles) {
-          const raw = readOverlayFile(agentName, file, agentCfg, warnings);
+          const raw = readOverlayFile(agentName, file, agentCfg, warnings, "skills");
           if (raw === undefined)
             continue;
           try {
@@ -19820,6 +19820,23 @@ function extractApiErrorMessage(bodyText) {
   } catch {}
   return bodyText.trim().slice(0, 500);
 }
+function extractApiErrorCode(bodyText) {
+  if (!bodyText || bodyText.trim().length === 0)
+    return null;
+  try {
+    const parsed = JSON.parse(bodyText);
+    const code = parsed?.error?.details?.error_code;
+    if (typeof code === "string" && code.trim().length > 0)
+      return code.trim();
+  } catch {}
+  return null;
+}
+var ENTITLEMENT_BLOCKED_ERROR_CODES = new Set([
+  "oauth_not_allowed_for_organization"
+]);
+function isEntitlementBlockedErrorCode(code) {
+  return code != null && ENTITLEMENT_BLOCKED_ERROR_CODES.has(code);
+}
 function isEntitlementDisabledMessage(message) {
   if (!message)
     return false;
@@ -19877,7 +19894,8 @@ async function fetchQuota(opts) {
     } catch {}
     clearTimeout(timeout);
     const apiErrorMessage = extractApiErrorMessage(bodyText);
-    const entitlement = resp.status === 403 && isEntitlementDisabledMessage(apiErrorMessage);
+    const apiErrorCode = extractApiErrorCode(bodyText);
+    const entitlement = resp.status === 403 && (isEntitlementBlockedErrorCode(apiErrorCode) || isEntitlementDisabledMessage(apiErrorMessage));
     return {
       ok: false,
       reason: `HTTP ${resp.status} from Anthropic (${parsed.reason})`,
@@ -21286,7 +21304,8 @@ var MarkThrottledRequestSchema = exports_external.object({
   v: exports_external.literal(PROTOCOL_VERSION),
   op: exports_external.literal("mark-throttled"),
   id: exports_external.string().min(1),
-  until: exports_external.number().int().positive()
+  until: exports_external.number().int().positive(),
+  probeOnly: exports_external.boolean().optional()
 });
 var RefreshAccountRequestSchema = exports_external.object({
   v: exports_external.literal(PROTOCOL_VERSION),
@@ -21568,8 +21587,8 @@ var AUTH_BROKER_ROOT2 = "/run/switchroom/auth-broker";
 var REFRESH_TICK_INTERVAL_MS = 60 * 1000;
 var MARK_EXHAUSTED_DEFAULT_MS = 5 * 60 * 60 * 1000;
 var MARK_THROTTLED_MAX_MS = 30 * 60 * 1000;
-var THROTTLE_ESCALATION_HITS = 3;
 var THROTTLE_ESCALATION_WINDOW_MS = 10 * 60 * 1000;
+var THROTTLE_ESCALATION_PROBE_MIN_INTERVAL_MS = 60 * 1000;
 var MARK_THROTTLED_MIN_INTERVAL_MS = 5 * 1000;
 var MARK_CORROBORATION_PROBE_DELAY_MS = 90 * 1000;
 var AUDIT_ROTATE_BYTES = 10 * 1024 * 1024;
@@ -21663,6 +21682,7 @@ class AuthBroker {
   externalSpendCache = null;
   externalSpendInFlight = null;
   probeInFlight = new Map;
+  lastEscalationProbeAt = {};
   shaIndex = {};
   thresholdViolations = {};
   notificationClaims = {};
@@ -22047,7 +22067,7 @@ class AuthBroker {
           await this.opMarkExhausted(socket, reqId, identity, req.until);
           break;
         case "mark-throttled":
-          await this.opMarkThrottled(socket, reqId, identity, req.until);
+          await this.opMarkThrottled(socket, reqId, identity, req.until, req.probeOnly);
           break;
         case "refresh-account": {
           const provider = req.provider ?? "anthropic";
@@ -22879,7 +22899,7 @@ class AuthBroker {
     this.audit({ op: "mark-exhausted", identity, account, accountKind: "claude", ok: true });
     socket.write(encodeSuccess(id, { account, rolled, rolledTo }));
   }
-  async opMarkThrottled(socket, id, identity, until) {
+  async opMarkThrottled(socket, id, identity, until, probeOnly = false) {
     const account = this.callerAccount(identity);
     if (!account) {
       this.audit({ op: "mark-throttled", identity, accountKind: "claude", ok: false, error: "no-active-account" });
@@ -22887,6 +22907,17 @@ class AuthBroker {
       return;
     }
     const now = this.now();
+    if (probeOnly) {
+      const { escalated: escalated2, rolledTo: rolledTo2 } = await this.maybeEscalateThrottle(account, identity, now);
+      this.audit({ op: "mark-throttled", identity, account, accountKind: "claude", ok: true });
+      socket.write(encodeSuccess(id, {
+        account,
+        throttled_until: this.quota[account]?.throttled_until ?? 0,
+        escalated: escalated2,
+        rolledTo: escalated2 ? rolledTo2 : null
+      }));
+      return;
+    }
     const throttledUntil = Math.min(Math.max(until, now + 1000), now + MARK_THROTTLED_MAX_MS);
     const entry = this.quota[account] ?? {};
     const priorHits = entry.throttle_hits ?? [];
@@ -22908,31 +22939,19 @@ class AuthBroker {
     }
     const hits = priorHits.filter((t) => now - t < THROTTLE_ESCALATION_WINDOW_MS);
     hits.push(now);
-    const escalate = hits.length >= THROTTLE_ESCALATION_HITS;
     this.quota[account] = {
       ...entry,
       throttled_until: throttledUntil,
-      throttle_hits: escalate ? [] : hits
+      throttle_hits: hits
     };
     this.persistQuota();
     this.audit({ op: "mark-throttled", identity, account, accountKind: "claude", ok: true });
-    process.stdout.write(`auth-broker: mark-throttled ${account} until ${new Date(throttledUntil).toISOString()} ` + `(hit ${hits.length}/${THROTTLE_ESCALATION_HITS} in window)
-`);
-    let escalated = false;
-    let rolledTo = null;
-    if (escalate) {
-      const probe = await this.probeThrottleEscalation(account);
-      if (probe.exhausted) {
-        escalated = true;
-        process.stdout.write(`auth-broker: throttle-escalation probe corroborates wall on ${account} — mark-exhausted + roll
-`);
-        this.audit({ op: "mark-exhausted", identity, account, accountKind: "claude", ok: true, reason: "throttle-escalation" });
-        const roll = await this.markExhaustedAndRoll(account, probe.until ?? undefined, identity);
-        rolledTo = roll.rolledTo;
-      } else {
-        process.stdout.write(`auth-broker: throttle-escalation probe on ${account} did NOT corroborate a wall — staying throttled
+    process.stdout.write(`auth-broker: mark-throttled ${account} until ${new Date(throttledUntil).toISOString()} ` + `(hit ${hits.length} in window)
 `);
-      }
+    const { escalated, rolledTo } = await this.maybeEscalateThrottle(account, identity, now);
+    if (escalated) {
+      this.quota[account] = { ...this.quota[account], throttle_hits: [] };
+      this.persistQuota();
     }
     socket.write(encodeSuccess(id, {
       account,
@@ -22941,6 +22960,27 @@ class AuthBroker {
       rolledTo: escalated ? rolledTo : null
     }));
   }
+  async maybeEscalateThrottle(account, identity, now) {
+    const lastProbeAt = this.lastEscalationProbeAt[account];
+    const probeAllowed = lastProbeAt === undefined || now - lastProbeAt >= THROTTLE_ESCALATION_PROBE_MIN_INTERVAL_MS;
+    if (!probeAllowed) {
+      process.stdout.write(`auth-broker: throttle-escalation probe on ${account} rate-bounded — skipped
+`);
+      return { escalated: false, rolledTo: null };
+    }
+    this.lastEscalationProbeAt[account] = now;
+    const probe = await this.probeThrottleEscalation(account);
+    if (!probe.exhausted) {
+      process.stdout.write(`auth-broker: throttle-escalation probe on ${account} did NOT corroborate a wall — staying put
+`);
+      return { escalated: false, rolledTo: null };
+    }
+    process.stdout.write(`auth-broker: throttle-escalation probe corroborates wall on ${account} — mark-exhausted + roll
+`);
+    this.audit({ op: "mark-exhausted", identity, account, accountKind: "claude", ok: true, reason: "throttle-escalation" });
+    const roll = await this.markExhaustedAndRoll(account, probe.until ?? undefined, identity);
+    return { escalated: true, rolledTo: roll.rolledTo };
+  }
   async probeThrottleEscalation(account) {
     const creds = readAccountCredentials(account, this.home);
     const token = creds?.claudeAiOauth?.accessToken;
@@ -22948,7 +22988,7 @@ class AuthBroker {
       return { exhausted: false, until: null };
     let result;
     try {
-      result = await this.fetchQuotaImpl({ accessToken: token });
+      result = await this.probeQuotaSingleFlight(account, token);
     } catch (err) {
       this.logErr(`throttle-escalation probe ${account}: ${err.message}`);
       return { exhausted: false, until: null };

package/dist/cli/autoaccept-poll.js

@@ -4958,7 +4958,8 @@ var MarkThrottledRequestSchema = exports_external.object({
   v: exports_external.literal(PROTOCOL_VERSION),
   op: exports_external.literal("mark-throttled"),
   id: exports_external.string().min(1),
-  until: exports_external.number().int().positive()
+  until: exports_external.number().int().positive(),
+  probeOnly: exports_external.boolean().optional()
 });
 var RefreshAccountRequestSchema = exports_external.object({
   v: exports_external.literal(PROTOCOL_VERSION),
@@ -5375,12 +5376,13 @@ class AuthBrokerClient {
     const data = await this.send(req);
     return data;
   }
-  async markThrottled(until) {
+  async markThrottled(until, probeOnly = false) {
     const data = await this.send({
       v: PROTOCOL_VERSION,
       id: randomUUID2(),
       op: "mark-throttled",
-      until
+      until,
+      ...probeOnly ? { probeOnly: true } : {}
     });
     return data;
   }

package/dist/cli/drive-write-pretool.mjs

@@ -4034,7 +4034,8 @@ var init_protocol = __esm(() => {
     v: exports_external.literal(PROTOCOL_VERSION),
     op: exports_external.literal("mark-throttled"),
     id: exports_external.string().min(1),
-    until: exports_external.number().int().positive()
+    until: exports_external.number().int().positive(),
+    probeOnly: exports_external.boolean().optional()
   });
   RefreshAccountRequestSchema = exports_external.object({
     v: exports_external.literal(PROTOCOL_VERSION),
@@ -4430,12 +4431,13 @@ class AuthBrokerClient {
     const data = await this.send(req);
     return data;
   }
-  async markThrottled(until) {
+  async markThrottled(until, probeOnly = false) {
     const data = await this.send({
       v: PROTOCOL_VERSION,
       id: randomUUID(),
       op: "mark-throttled",
-      until
+      until,
+      ...probeOnly ? { probeOnly: true } : {}
     });
     return data;
   }

package/dist/cli/ms-365-write-pretool.mjs

@@ -4036,7 +4036,8 @@ var init_protocol = __esm(() => {
     v: exports_external.literal(PROTOCOL_VERSION),
     op: exports_external.literal("mark-throttled"),
     id: exports_external.string().min(1),
-    until: exports_external.number().int().positive()
+    until: exports_external.number().int().positive(),
+    probeOnly: exports_external.boolean().optional()
   });
   RefreshAccountRequestSchema = exports_external.object({
     v: exports_external.literal(PROTOCOL_VERSION),
@@ -4432,12 +4433,13 @@ class AuthBrokerClient {
     const data = await this.send(req);
     return data;
   }
-  async markThrottled(until) {
+  async markThrottled(until, probeOnly = false) {
     const data = await this.send({
       v: PROTOCOL_VERSION,
       id: randomUUID(),
       op: "mark-throttled",
-      until
+      until,
+      ...probeOnly ? { probeOnly: true } : {}
     });
     return data;
   }

package/dist/cli/notion-write-pretool.mjs

@@ -12791,7 +12791,7 @@ function deriveOverlayTitle(raw, fileName) {
     return;
   return base.length > 0 ? base : undefined;
 }
-function readOverlayFile(agentName, file, agentCfg, warnings) {
+function readOverlayFile(agentName, file, agentCfg, warnings, source) {
   try {
     return readFileSync(file, "utf-8");
   } catch (err) {
@@ -12804,7 +12804,7 @@ function readOverlayFile(agentName, file, agentCfg, warnings) {
       reason: `read error: ${err.message}`,
       code: code ?? "EUNKNOWN"
     };
-    recordReadFailure(agentCfg, { file, code: w.code });
+    recordReadFailure(agentCfg, { file, code: w.code, source });
     warnings.push(w);
     console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${file}': ${w.reason}`);
     return;
@@ -12868,14 +12868,14 @@ function applyAgentOverlays(config) {
           reason: `read error: cannot list overlay directory (${code})`,
           code
         };
-        recordReadFailure(agentCfg, { file: scheduleDir, code });
+        recordReadFailure(agentCfg, { file: scheduleDir, code, source: "schedule" });
         warnings.push(w);
         console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${scheduleDir}': ${w.reason}`);
       });
       if (files.length > 0) {
         const merged = [...agentCfg.schedule ?? []];
         for (const file of files) {
-          const raw = readOverlayFile(agentName, file, agentCfg, warnings);
+          const raw = readOverlayFile(agentName, file, agentCfg, warnings, "schedule");
           if (raw === undefined)
             continue;
           try {
@@ -12920,7 +12920,7 @@ function applyAgentOverlays(config) {
           reason: `read error: cannot list overlay directory (${code})`,
           code
         };
-        recordReadFailure(agentCfg, { file: skillsDir, code });
+        recordReadFailure(agentCfg, { file: skillsDir, code, source: "skills" });
         warnings.push(w);
         console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${skillsDir}': ${w.reason}`);
       });
@@ -12928,7 +12928,7 @@ function applyAgentOverlays(config) {
         const merged = [...agentCfg.skills ?? []];
         const seen = new Set(merged);
         for (const file of skillFiles) {
-          const raw = readOverlayFile(agentName, file, agentCfg, warnings);
+          const raw = readOverlayFile(agentName, file, agentCfg, warnings, "skills");
           if (raw === undefined)
             continue;
           try {

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.20.8", COMMIT_SHA = "a6efc10f";
+var VERSION = "0.20.10", COMMIT_SHA = "ebb54738";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -14664,7 +14664,7 @@ function deriveOverlayTitle(raw, fileName) {
     return;
   return base.length > 0 ? base : undefined;
 }
-function readOverlayFile(agentName, file, agentCfg, warnings) {
+function readOverlayFile(agentName, file, agentCfg, warnings, source) {
   try {
     return readFileSync2(file, "utf-8");
   } catch (err) {
@@ -14677,7 +14677,7 @@ function readOverlayFile(agentName, file, agentCfg, warnings) {
       reason: `read error: ${err.message}`,
       code: code ?? "EUNKNOWN"
     };
-    recordReadFailure(agentCfg, { file, code: w.code });
+    recordReadFailure(agentCfg, { file, code: w.code, source });
     warnings.push(w);
     console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${file}': ${w.reason}`);
     return;
@@ -14741,14 +14741,14 @@ function applyAgentOverlays(config) {
           reason: `read error: cannot list overlay directory (${code})`,
           code
         };
-        recordReadFailure(agentCfg, { file: scheduleDir, code });
+        recordReadFailure(agentCfg, { file: scheduleDir, code, source: "schedule" });
         warnings.push(w);
         console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${scheduleDir}': ${w.reason}`);
       });
       if (files.length > 0) {
         const merged = [...agentCfg.schedule ?? []];
         for (const file of files) {
-          const raw = readOverlayFile(agentName, file, agentCfg, warnings);
+          const raw = readOverlayFile(agentName, file, agentCfg, warnings, "schedule");
           if (raw === undefined)
             continue;
           try {
@@ -14793,7 +14793,7 @@ function applyAgentOverlays(config) {
           reason: `read error: cannot list overlay directory (${code})`,
           code
         };
-        recordReadFailure(agentCfg, { file: skillsDir, code });
+        recordReadFailure(agentCfg, { file: skillsDir, code, source: "skills" });
         warnings.push(w);
         console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${skillsDir}': ${w.reason}`);
       });
@@ -14801,7 +14801,7 @@ function applyAgentOverlays(config) {
         const merged = [...agentCfg.skills ?? []];
         const seen = new Set(merged);
         for (const file of skillFiles) {
-          const raw = readOverlayFile(agentName, file, agentCfg, warnings);
+          const raw = readOverlayFile(agentName, file, agentCfg, warnings, "skills");
           if (raw === undefined)
             continue;
           try {
@@ -18815,7 +18815,9 @@ function hindsightContainerEnvPairs(opts) {
     ...hindsightLlmBudgetEnv(llm),
     ["HINDSIGHT_API_WORKER_ID", HINDSIGHT_DEFAULT_WORKER_ID],
     ...hindsightPerfEnvPairs(llm, litellm, gpu, perf),
-    ...hindsightPgEnvPairs(perf)
+    ...hindsightPgEnvPairs(perf),
+    ["SWITCHROOM_HINDSIGHT_REQUEUE_DEAD_LETTERS", HINDSIGHT_DEFAULT_REQUEUE_DEAD_LETTERS],
+    ["SWITCHROOM_HINDSIGHT_REQUEUE_MAX", HINDSIGHT_DEFAULT_REQUEUE_MAX]
   ];
   if (llmProvider === "claude-code") {
     pairs.push(["ANTHROPIC_MODEL", llmModel]);
@@ -19086,6 +19088,8 @@ function generateHindsightComposeSnippet(llm, mirrorDir, litellm, gpu, perf, cpA
     `      - HINDSIGHT_API_WORKER_ID=${HINDSIGHT_DEFAULT_WORKER_ID}`,
     ...hindsightPerfEnvPairs(llm, litellm, gpu, perf).map(([k, v]) => `      - ${k}=${v}`),
     ...hindsightPgEnvPairs(perf).map(([k, v]) => `      - ${k}=${v}`),
+    `      - SWITCHROOM_HINDSIGHT_REQUEUE_DEAD_LETTERS=${HINDSIGHT_DEFAULT_REQUEUE_DEAD_LETTERS}`,
+    `      - SWITCHROOM_HINDSIGHT_REQUEUE_MAX=${HINDSIGHT_DEFAULT_REQUEUE_MAX}`,
     `    mem_limit: ${HINDSIGHT_DEFAULT_MEM_LIMIT}`,
     `    mem_reservation: ${HINDSIGHT_DEFAULT_MEM_RESERVATION}`,
     `    pids_limit: ${HINDSIGHT_DEFAULT_PIDS_LIMIT}`,
@@ -19184,7 +19188,7 @@ async function ensureHindsightConsumer(configPath, account, uid = HINDSIGHT_DEFA
   atomicWriteFileSync3(configPath, tail, mode);
   return { added: true, reason: "added" };
 }
-var HINDSIGHT_DEFAULT_API_PORT = 18888, HINDSIGHT_DEFAULT_UI_PORT = 9999, HINDSIGHT_DEFAULT_MCP_URL, HINDSIGHT_DEFAULT_API_BASE_URL, HINDSIGHT_CONSUMER_NAME = "hindsight", HINDSIGHT_DEFAULT_WORKER_ID = "switchroom-hindsight", HINDSIGHT_DATA_VOLUME = "switchroom-hindsight-data", HINDSIGHT_DEFAULT_UID = 11000, HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight", HINDSIGHT_IMAGE, HINDSIGHT_DEFAULT_MODEL = "claude-sonnet-5", HINDSIGHT_DEFAULT_LITELLM_MODEL = "openrouter/google/gemini-3.1-flash-lite", HINDSIGHT_DEFAULT_MCP_STATELESS = true, HINDSIGHT_BROKER_SOCK_VOLUME, HINDSIGHT_CREDS_MIRROR_VOLUME, HINDSIGHT_CRED_DIR = "/run/claude-creds", HINDSIGHT_RETAIN_CHUNK_SIZE = 3000, HINDSIGHT_DEFAULT_RETAIN_MAX_COMPLETION_TOKENS = 16384, HINDSIGHT_RETAIN_MIN_TOKENS_PER_SECOND = 80.6, HINDSIGHT_RETAIN_CLIENT_DEADLINE_S, HINDSIGHT_DEFAULT_MEM_LIMIT = "16g", HINDSIGHT_DEFAULT_MEM_RESERVATION = "4g", HINDSIGHT_DEFAULT_PIDS_LIMIT = 1000, HINDSIGHT_DEFAULT_SHM_SIZE = "2g", HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)', HINDSIGHT_HEALTHCHECK_CMD, DOCKER_PROBE_TIMEOUT_MS, defaultDockerProbe = (args) => {
+var HINDSIGHT_DEFAULT_API_PORT = 18888, HINDSIGHT_DEFAULT_UI_PORT = 9999, HINDSIGHT_DEFAULT_MCP_URL, HINDSIGHT_DEFAULT_API_BASE_URL, HINDSIGHT_CONSUMER_NAME = "hindsight", HINDSIGHT_DEFAULT_WORKER_ID = "switchroom-hindsight", HINDSIGHT_DATA_VOLUME = "switchroom-hindsight-data", HINDSIGHT_DEFAULT_UID = 11000, HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight", HINDSIGHT_IMAGE, HINDSIGHT_DEFAULT_MODEL = "claude-sonnet-5", HINDSIGHT_DEFAULT_LITELLM_MODEL = "openrouter/google/gemini-3.1-flash-lite", HINDSIGHT_DEFAULT_MCP_STATELESS = true, HINDSIGHT_DEFAULT_REQUEUE_DEAD_LETTERS = "1", HINDSIGHT_DEFAULT_REQUEUE_MAX = "25", HINDSIGHT_BROKER_SOCK_VOLUME, HINDSIGHT_CREDS_MIRROR_VOLUME, HINDSIGHT_CRED_DIR = "/run/claude-creds", HINDSIGHT_RETAIN_CHUNK_SIZE = 3000, HINDSIGHT_DEFAULT_RETAIN_MAX_COMPLETION_TOKENS = 16384, HINDSIGHT_RETAIN_MIN_TOKENS_PER_SECOND = 80.6, HINDSIGHT_RETAIN_CLIENT_DEADLINE_S, HINDSIGHT_DEFAULT_MEM_LIMIT = "16g", HINDSIGHT_DEFAULT_MEM_RESERVATION = "4g", HINDSIGHT_DEFAULT_PIDS_LIMIT = 1000, HINDSIGHT_DEFAULT_SHM_SIZE = "2g", HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)', HINDSIGHT_HEALTHCHECK_CMD, DOCKER_PROBE_TIMEOUT_MS, defaultDockerProbe = (args) => {
   try {
     return execFileSync2("docker", args, {
       stdio: "pipe",
@@ -31105,6 +31109,18 @@ function buildSettingsHooksBlock(p) {
       ]
     }
   ];
+  const switchroomSessionStart = [
+    {
+      matcher: "compact",
+      hooks: [
+        {
+          type: "command",
+          command: wrap("hook:working-state-reload", `bash "${join12(DOCKER_BIN_PATH, "working-state-reload-hook.sh")}"`),
+          timeout: 8
+        }
+      ]
+    }
+  ];
   if (userHooks) {
     return {
       ...userHooks,
@@ -31112,6 +31128,10 @@ function buildSettingsHooksBlock(p) {
         ...userHooks.UserPromptSubmit ?? [],
         ...switchroomUserPromptSubmit
       ],
+      SessionStart: [
+        ...userHooks.SessionStart ?? [],
+        ...switchroomSessionStart
+      ],
       ...switchroomPreToolUse.length > 0 ? {
         PreToolUse: [
           ...userHooks.PreToolUse ?? [],
@@ -31134,6 +31154,7 @@ function buildSettingsHooksBlock(p) {
   }
   return {
     UserPromptSubmit: switchroomUserPromptSubmit,
+    SessionStart: switchroomSessionStart,
     ...switchroomPreToolUse.length > 0 ? { PreToolUse: switchroomPreToolUse } : {},
     ...switchroomPostToolUse.length > 0 ? { PostToolUse: switchroomPostToolUse } : {},
     ...switchroomStop.length > 0 ? { Stop: switchroomStop } : {}
@@ -36014,7 +36035,8 @@ var init_protocol2 = __esm(() => {
     v: exports_external.literal(PROTOCOL_VERSION),
     op: exports_external.literal("mark-throttled"),
     id: exports_external.string().min(1),
-    until: exports_external.number().int().positive()
+    until: exports_external.number().int().positive(),
+    probeOnly: exports_external.boolean().optional()
   });
   RefreshAccountRequestSchema = exports_external.object({
     v: exports_external.literal(PROTOCOL_VERSION),
@@ -36410,12 +36432,13 @@ class AuthBrokerClient {
     const data = await this.send(req);
     return data;
   }
-  async markThrottled(until) {
+  async markThrottled(until, probeOnly = false) {
     const data = await this.send({
       v: PROTOCOL_VERSION,
       id: randomUUID(),
       op: "mark-throttled",
-      until
+      until,
+      ...probeOnly ? { probeOnly: true } : {}
     });
     return data;
   }
@@ -63669,7 +63692,7 @@ function checkNodeVersion() {
   }
   return { name: "Node 18+", status: "ok", detail: label };
 }
-function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = process.env.PLAYWRIGHT_BROWSERS_PATH) {
+function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = process.env.PLAYWRIGHT_BROWSERS_PATH, bakedBrowsersPath = "/opt/playwright/browsers") {
   const candidates = [
     "chromium",
     "chromium-browser",
@@ -63686,6 +63709,9 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
     cacheLocations.push(envBrowsersPath);
   }
   cacheLocations.push(join74(homeDir, ".cache", "ms-playwright"));
+  if (bakedBrowsersPath && bakedBrowsersPath.length > 0) {
+    cacheLocations.push(bakedBrowsersPath);
+  }
   for (const cacheDir of cacheLocations) {
     if (!existsSync69(cacheDir))
       continue;
@@ -88253,6 +88279,9 @@ function refillNormalizedUtils(q, now) {
     sevenDayRefilled
   };
 }
+var ENTITLEMENT_BLOCKED_ERROR_CODES = new Set([
+  "oauth_not_allowed_for_organization"
+]);
 
 // src/cli/auth-schedule.ts
 function overageReasonBlocks(reason) {

package/dist/host-control/main.js

@@ -12063,7 +12063,7 @@ function deriveOverlayTitle(raw, fileName) {
     return;
   return base.length > 0 ? base : undefined;
 }
-function readOverlayFile(agentName, file, agentCfg, warnings) {
+function readOverlayFile(agentName, file, agentCfg, warnings, source) {
   try {
     return readFileSync(file, "utf-8");
   } catch (err) {
@@ -12076,7 +12076,7 @@ function readOverlayFile(agentName, file, agentCfg, warnings) {
       reason: `read error: ${err.message}`,
       code: code ?? "EUNKNOWN"
     };
-    recordReadFailure(agentCfg, { file, code: w.code });
+    recordReadFailure(agentCfg, { file, code: w.code, source });
     warnings.push(w);
     console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${file}': ${w.reason}`);
     return;
@@ -12140,14 +12140,14 @@ function applyAgentOverlays(config) {
           reason: `read error: cannot list overlay directory (${code})`,
           code
         };
-        recordReadFailure(agentCfg, { file: scheduleDir, code });
+        recordReadFailure(agentCfg, { file: scheduleDir, code, source: "schedule" });
         warnings.push(w);
         console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${scheduleDir}': ${w.reason}`);
       });
       if (files.length > 0) {
         const merged = [...agentCfg.schedule ?? []];
         for (const file of files) {
-          const raw = readOverlayFile(agentName, file, agentCfg, warnings);
+          const raw = readOverlayFile(agentName, file, agentCfg, warnings, "schedule");
           if (raw === undefined)
             continue;
           try {
@@ -12192,7 +12192,7 @@ function applyAgentOverlays(config) {
           reason: `read error: cannot list overlay directory (${code})`,
           code
         };
-        recordReadFailure(agentCfg, { file: skillsDir, code });
+        recordReadFailure(agentCfg, { file: skillsDir, code, source: "skills" });
         warnings.push(w);
         console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${skillsDir}': ${w.reason}`);
       });
@@ -12200,7 +12200,7 @@ function applyAgentOverlays(config) {
         const merged = [...agentCfg.skills ?? []];
         const seen = new Set(merged);
         for (const file of skillFiles) {
-          const raw = readOverlayFile(agentName, file, agentCfg, warnings);
+          const raw = readOverlayFile(agentName, file, agentCfg, warnings, "skills");
           if (raw === undefined)
             continue;
           try {
@@ -21493,7 +21493,7 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.20.8";
+var VERSION = "0.20.10";
 
 // src/setup/hindsight-recall-tunables.ts
 var RECALL_DEADLINE_HEADROOM_SECONDS = 2;

package/dist/vault/approvals/kernel-server.js

@@ -12867,7 +12867,7 @@ function deriveOverlayTitle(raw, fileName) {
     return;
   return base.length > 0 ? base : undefined;
 }
-function readOverlayFile(agentName, file, agentCfg, warnings) {
+function readOverlayFile(agentName, file, agentCfg, warnings, source) {
   try {
     return readFileSync2(file, "utf-8");
   } catch (err) {
@@ -12880,7 +12880,7 @@ function readOverlayFile(agentName, file, agentCfg, warnings) {
       reason: `read error: ${err.message}`,
       code: code ?? "EUNKNOWN"
     };
-    recordReadFailure(agentCfg, { file, code: w.code });
+    recordReadFailure(agentCfg, { file, code: w.code, source });
     warnings.push(w);
     console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${file}': ${w.reason}`);
     return;
@@ -12944,14 +12944,14 @@ function applyAgentOverlays(config) {
           reason: `read error: cannot list overlay directory (${code})`,
           code
         };
-        recordReadFailure(agentCfg, { file: scheduleDir, code });
+        recordReadFailure(agentCfg, { file: scheduleDir, code, source: "schedule" });
         warnings.push(w);
         console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${scheduleDir}': ${w.reason}`);
       });
       if (files.length > 0) {
         const merged = [...agentCfg.schedule ?? []];
         for (const file of files) {
-          const raw = readOverlayFile(agentName, file, agentCfg, warnings);
+          const raw = readOverlayFile(agentName, file, agentCfg, warnings, "schedule");
           if (raw === undefined)
             continue;
           try {
@@ -12996,7 +12996,7 @@ function applyAgentOverlays(config) {
           reason: `read error: cannot list overlay directory (${code})`,
           code
         };
-        recordReadFailure(agentCfg, { file: skillsDir, code });
+        recordReadFailure(agentCfg, { file: skillsDir, code, source: "skills" });
         warnings.push(w);
         console.warn(`[switchroom] overlay-loader: agent='${agentName}' file='${skillsDir}': ${w.reason}`);
       });
@@ -13004,7 +13004,7 @@ function applyAgentOverlays(config) {
         const merged = [...agentCfg.skills ?? []];
         const seen = new Set(merged);
         for (const file of skillFiles) {
-          const raw = readOverlayFile(agentName, file, agentCfg, warnings);
+          const raw = readOverlayFile(agentName, file, agentCfg, warnings, "skills");
           if (raw === undefined)
             continue;
           try {