switchroom 0.20.9 → 0.20.11

package/bin/handoff-briefing.sh

@@ -34,9 +34,32 @@
 #   - AGENT_DIR               — output destination (if HANDOFF_BRIEFING_STDOUT!=1)
 #
 # Usage:
-#   handoff-briefing.sh [--stdout]
+#   handoff-briefing.sh [--stdout] [--lean]
 #
 # The --stdout flag overrides HANDOFF_BRIEFING_STDOUT=1.
+#
+# LEAN MODE (--lean, alias --mode=compaction)
+# -------------------------------------------
+# The compaction re-seat path (bin/working-state-reload-hook.sh, wired as the
+# SessionStart(compact) hook) invokes this script with --lean so BOTH legacy-
+# and gateway-briefing agents share ONE assembler at the compaction boundary —
+# no copy of the sqlite/recall logic lives in the hook. Lean mode differs from
+# the boot briefing in three deliberate ways:
+#
+#   1. It emits ONLY the recent-Telegram-tail + Hindsight-recall sections.
+#      Daily-memory (Source 3) and the "You just restarted at …" header are
+#      SKIPPED. Rationale is token duplication, not latency: Claude Code's
+#      native compaction summary already preserves the recent turns, so
+#      re-injecting the full boot briefing on every compaction of a long
+#      session partially triples coverage.
+#   2. It IGNORES the SWITCHROOM_PENDING_* env (boot-time pending-turn scope).
+#      Those name the surface that was mid-turn at the PREVIOUS boot; at a
+#      compaction hours into a live session they are stale and would brief the
+#      WRONG chat surface. Lean mode zeroes them so the python scoper derives
+#      the single most-recently-active (chat_id, thread_id) straight from the
+#      DB (scope_source=db-latest).
+#   3. It forces stdout and never touches AGENT_DIR (no output file), so it is
+#      safe to call from the hook regardless of whether AGENT_DIR is exported.
 
 set -u
 
@@ -71,12 +94,32 @@ HINDSIGHT_TIMEOUT="${HANDOFF_BRIEFING_HINDSIGHT_TIMEOUT:-3}"
 TARGET_CHAT_ID="${SWITCHROOM_PENDING_CHAT_ID:-}"
 TARGET_THREAD_ID="${SWITCHROOM_PENDING_THREAD_ID:-}"
 
-# Determine output mode
+# Determine output + lean mode. Parse every arg (order-independent) so
+# `--lean`, `--stdout`, or both, work regardless of position.
 STDOUT_MODE=0
-if [ "${HANDOFF_BRIEFING_STDOUT:-}" = "1" ] || [ "${1:-}" = "--stdout" ]; then
+LEAN_MODE=0
+for _arg in "$@"; do
+  case "$_arg" in
+    --stdout) STDOUT_MODE=1 ;;
+    --lean|--mode=compaction) LEAN_MODE=1 ;;
+    *) : ;;
+  esac
+done
+if [ "${HANDOFF_BRIEFING_STDOUT:-}" = "1" ]; then
   STDOUT_MODE=1
 fi
 
+# Lean (compaction) mode: force stdout, and ZERO the pending-turn env scope so
+# the python scoper falls through to db-latest (see LEAN MODE note in header).
+# This is the load-bearing correctness fix for a mid-session compaction: the
+# SWITCHROOM_PENDING_* surface is the previous boot's, not the currently-active
+# chat. Clearing them here (not in the hook) keeps the single scoping code path.
+if [ "$LEAN_MODE" = "1" ]; then
+  STDOUT_MODE=1
+  TARGET_CHAT_ID=""
+  TARGET_THREAD_ID=""
+fi
+
 # ── Source 1: Recent Telegram messages ─────────────────────────────────────────
 TELEGRAM_SECTION=""
 if [ -n "$TELEGRAM_STATE" ] && [ -d "$TELEGRAM_STATE" ]; then
@@ -362,7 +405,9 @@ fi
 # dropping today's memory.
 DAILY_SECTION=""
 TODAY=$(TZ="$_TZ_VAL" date +%Y-%m-%d 2>/dev/null || date +%Y-%m-%d 2>/dev/null || true)
-if [ -n "$TODAY" ] && [ -n "$WORKSPACE_DIR" ]; then
+# Lean/compaction mode SKIPS daily memory (token duplication — the native
+# summary already carries recent context; see LEAN MODE note in header).
+if [ "$LEAN_MODE" != "1" ] && [ -n "$TODAY" ] && [ -n "$WORKSPACE_DIR" ]; then
   DAILY_FILE="$WORKSPACE_DIR/memory/${TODAY}.md"
   if [ -f "$DAILY_FILE" ] && [ -s "$DAILY_FILE" ]; then
     DAILY_CONTENT=$(cat "$DAILY_FILE")
@@ -391,7 +436,14 @@ if [ -n "$OUTPUT_FILE" ]; then
 else
   # stdout / no-AGENT_DIR mode — buffered; print the whole briefing once.
   if [ -n "$STDOUT_BUFFER" ]; then
-    printf '%s\n\n---\n\n%s\n' "$BRIEFING_HEADER" "$STDOUT_BUFFER"
+    if [ "$LEAN_MODE" = "1" ]; then
+      # Lean/compaction: no "You just restarted at …" boot header — this is a
+      # mid-conversation compaction, not a restart, and the hook emits its own
+      # <compact-recovery> framing. Print only the assembled sections.
+      printf '%s\n' "$STDOUT_BUFFER"
+    else
+      printf '%s\n\n---\n\n%s\n' "$BRIEFING_HEADER" "$STDOUT_BUFFER"
+    fi
   fi
 fi
 

package/bin/working-state-reload-hook.sh

@@ -0,0 +1,262 @@
+#!/bin/bash
+# working-state-reload-hook.sh — deliver post-compaction continuation into
+# context immediately after context compaction.
+#
+# WHY THIS EXISTS
+# ---------------
+# Claude Code auto-compacts late in the context window. The native
+# auto-summarizer produces a structured summary of intent/changes/pending
+# work, but it is lossy: fast-moving detail an agent is actively juggling
+# mid-task (a checklist, the current plan, in-flight IDs, the exact "where
+# was I" scratch, recent phrasing) is exactly what a summary flattens or
+# drops. Worse, the model resuming from a summary can read it as a FRESH
+# start and re-greet the user, breaking a conversation the user experiences
+# as unbroken.
+#
+# This hook closes that gap deterministically, in three layers:
+#   1. It ALWAYS emits a short, static recovery/orientation block — for
+#      EVERY agent, whether or not it maintains a working-state file. This
+#      is the load-bearing default: it tells the model its context was just
+#      compacted mid-conversation, that the native summary is lossy, and
+#      which concrete recovery tools exist in this environment.
+#   2. If the agent maintains a working-state file AND it is non-empty, the
+#      hook additionally appends that file verbatim (with its last-modified
+#      time, so a stale/forgotten file is visibly stale rather than silently
+#      steering).
+#   3. It emits a LEAN briefing (P1) — a scoped recent Telegram tail + a
+#      Hindsight recall — so the compacted session gets fresh-boot PARITY:
+#      it picks up the actual conversation, not just the fact it was
+#      compacted. This is delegated to handoff-briefing.sh --lean (the SINGLE
+#      briefing assembler; no copy of the sqlite/recall logic here), so BOTH
+#      legacy- and gateway-briefing agents share one compaction re-seat path.
+#      Lean by design: it skips daily-memory/workspace re-render (token
+#      duplication — the native summary already keeps recent turns) and
+#      ignores SWITCHROOM_PENDING_* to brief the db-latest chat surface rather
+#      than a stale pending-turn one. Graceful: if history.db or Hindsight is
+#      unavailable it emits what it can (or nothing) and never fails the hook.
+#
+# It is wired as a SessionStart hook with matcher "compact" (see
+# src/agents/scaffold.ts buildSettingsHooksBlock). Per Claude Code's hook
+# contract:
+#   - SessionStart fires with source="compact" on auto OR manual compaction,
+#     mid-turn, right after the compaction boundary.
+#   - Text a SessionStart hook prints to stdout IS added to the model's
+#     context (unlike PreCompact stdout, which is NOT injected).
+# So printing here re-seats orientation (and any working state) into context
+# the instant the summary replaces the transcript — no marker file, no
+# gateway round-trip, no waiting for the next user message.
+#
+# The matcher "compact" is load-bearing: it scopes this hook to compaction
+# ONLY. A bare (matcher-less) SessionStart also fires on "startup", "resume",
+# "clear", and "fork", which would inject the recovery block on every boot —
+# noise, and prompt-cache churn. We rely on the matcher AND, belt-and-braces,
+# re-check the `source` field from stdin below so a future Claude Code matcher
+# regression can never turn this into an every-boot inject.
+#
+# THE WORKING-STATE FILE CONVENTION
+# ---------------------------------
+#   $TELEGRAM_STATE_DIR/.working-state.md
+# i.e. <agentDir>/telegram/.working-state.md (TELEGRAM_STATE_DIR is exported
+# by start.sh as "<agentDir>/telegram"). An agent maintains this file itself
+# as its durable scratch of "what I'm mid-way through". If the file is absent
+# or empty — the common case for agents that don't use it — the hook simply
+# skips the append; the static recovery block is still emitted. No file is
+# ever created here.
+#
+# PERFORMANCE
+# -----------
+# The static recovery block and working-state append are local-only (a heredoc
+# plus at most one `stat`/`cat` of a small file) — sub-second. The lean
+# briefing (layer 3) adds one local SQLite read and ONE network hop to
+# Hindsight, which handoff-briefing.sh caps (HANDOFF_BRIEFING_HINDSIGHT_TIMEOUT,
+# default 3s). Worst-case runtime is therefore a few seconds, dominated by that
+# cap; the SessionStart(compact) hook's Claude Code timeout is set accordingly
+# in src/agents/scaffold.ts. Latency here is a non-issue by design: compaction
+# itself takes far longer, and the prompt cache is already invalidated by the
+# summary replacing the transcript. (Contrast the hindsight session_start.py
+# SessionStart hook, which times out at its 5s budget on every firing — a
+# separate, independent context-loss cause tracked against the hindsight-memory
+# plugin, NOT fixed here.)
+#
+# Failure modes are all silent: a hook that errors would surface on the issues
+# card via run-hook.sh, but a missing/absent working-state file, an unreadable
+# mtime, a missing history.db, or an unreachable Hindsight is never an error —
+# the recovery block still emits and the hook exits 0.
+
+set -u
+
+# ---------------------------------------------------------------------------
+# Defensive source guard. The matcher "compact" in settings.json already
+# scopes Claude Code to fire this hook only on compaction, but we re-verify
+# the source from the hook's stdin JSON so a matcher regression (or a manual
+# mis-wire) can never cause this to inject on a normal startup/resume/clear/
+# fork boot. If stdin carries a `source` and it is not "compact", exit
+# silently. If there is no stdin (e.g. a unit test invoking the script
+# directly), fall through and trust the matcher.
+# ---------------------------------------------------------------------------
+if ! [ -t 0 ]; then
+  STDIN_JSON=$(cat 2>/dev/null || true)
+  if [ -n "${STDIN_JSON:-}" ]; then
+    SOURCE=""
+    if command -v jq >/dev/null 2>&1; then
+      SOURCE=$(printf '%s' "$STDIN_JSON" | jq -r '.source // empty' 2>/dev/null || true)
+    else
+      SOURCE=$(printf '%s' "$STDIN_JSON" \
+        | grep -o '"source"[[:space:]]*:[[:space:]]*"[^"]*"' \
+        | head -1 \
+        | sed 's/.*"source"[[:space:]]*:[[:space:]]*"//;s/"$//' 2>/dev/null || true)
+    fi
+    if [ -n "$SOURCE" ] && [ "$SOURCE" != "compact" ]; then
+      exit 0
+    fi
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Static recovery/orientation block. ALWAYS emitted on a compaction start,
+# for EVERY agent — this is the load-bearing default. Plain stdout from a
+# SessionStart hook IS added to the model's context by Claude Code, so this
+# re-orients the model the instant the native summary replaces the transcript.
+# Deterministic heredoc string: no network, no CLI fork.
+# ---------------------------------------------------------------------------
+cat <<'EOF'
+<compact-recovery source="switchroom working-state-reload hook">
+Your context was just COMPACTED mid-conversation. This is NOT a fresh start:
+you are CONTINUING a conversation the user experiences as unbroken. The native
+summary above is lossy — it flattens or drops fast-moving detail (in-flight
+IDs, the exact "where was I", recent phrasing). Do not greet the user or act
+as if starting over; pick up where the conversation left off.
+
+Re-orient using the recovery tools in THIS environment before continuing:
+  - Telegram chat history: the get_recent_messages MCP tool
+    (mcp__switchroom-telegram__get_recent_messages) to re-read what was just
+    being discussed.
+  - Hindsight memory: recall / reflect (mcp__hindsight__recall,
+    mcp__hindsight__reflect) for facts and decisions from earlier sessions.
+  - Workspace files for durable task state.
+</compact-recovery>
+EOF
+
+# ---------------------------------------------------------------------------
+# Resolve the working-state file. Primary: $TELEGRAM_STATE_DIR (exported by
+# start.sh for telegram-plugin agents). Fallback: derive the conventional
+# telegram state dir from the agent name, so the hook still works if invoked
+# in a context where TELEGRAM_STATE_DIR is not exported. If neither resolves,
+# skip the working-state append — the recovery block above already emitted,
+# and the lean briefing below still runs.
+#
+# NOTE: this is a GUARDED block (not an early `exit`), because the lean
+# post-compaction briefing further down must run for EVERY compaction,
+# including the common case of an agent that keeps no working-state file.
+# ---------------------------------------------------------------------------
+STATE_DIR="${TELEGRAM_STATE_DIR:-}"
+if [ -z "$STATE_DIR" ]; then
+  AGENT_NAME="${SWITCHROOM_AGENT_NAME:-}"
+  if [ -n "$AGENT_NAME" ] && [ -n "${HOME:-}" ]; then
+    STATE_DIR="$HOME/.switchroom/agents/$AGENT_NAME/telegram"
+  fi
+fi
+
+WORKING_STATE_FILE=""
+if [ -n "$STATE_DIR" ]; then
+  WORKING_STATE_FILE="$STATE_DIR/.working-state.md"
+fi
+
+# Append the working state only when the file resolves AND is non-empty.
+if [ -n "$WORKING_STATE_FILE" ] && [ -s "$WORKING_STATE_FILE" ]; then
+  # -------------------------------------------------------------------------
+  # Resolve the working-state file's last-modified time so a stale, forgotten
+  # file is VISIBLY stale to the model rather than silently steering it. Try a
+  # portable sequence: GNU/busybox `stat -c %y`, then BSD/macOS `stat -f %Sm`,
+  # then GNU `date -r <file>`. If none work, omit the mtime — never fail the
+  # hook over it.
+  # -------------------------------------------------------------------------
+  MTIME=""
+  if MTIME=$(stat -c %y "$WORKING_STATE_FILE" 2>/dev/null) && [ -n "$MTIME" ]; then
+    :
+  elif MTIME=$(stat -f '%Sm' "$WORKING_STATE_FILE" 2>/dev/null) && [ -n "$MTIME" ]; then
+    :
+  elif MTIME=$(date -r "$WORKING_STATE_FILE" 2>/dev/null) && [ -n "$MTIME" ]; then
+    :
+  else
+    MTIME=""
+  fi
+
+  # -------------------------------------------------------------------------
+  # Append the working state verbatim, wrapped in its own delimiter block. The
+  # header line carries the mtime (when resolvable) so a stale file reads as
+  # stale.
+  # -------------------------------------------------------------------------
+  printf '%s\n' '<working-state source="switchroom working-state-reload hook">'
+  if [ -n "$MTIME" ]; then
+    printf '%s\n' 'The following is your working-state file ('"$WORKING_STATE_FILE"', last updated '"$MTIME"'),'
+  else
+    printf '%s\n' 'The following is your working-state file ('"$WORKING_STATE_FILE"'),'
+  fi
+  printf '%s\n' 'reloaded verbatim so in-flight task state survives the summarizer. It may'
+  printf '%s\n' 'be stale — reconcile it against the summary and the recovery tools above'
+  printf '%s\n' 'before trusting it, then continue.'
+  printf '%s\n' '---'
+  cat "$WORKING_STATE_FILE"
+  printf '\n%s\n' '</working-state>'
+fi
+
+# ---------------------------------------------------------------------------
+# Lean post-compaction briefing (P1). ADDITIVE on source=compact, after the
+# static recovery block and the optional working-state append. It re-seats the
+# compacted session to fresh-boot PARITY: a scoped recent Telegram tail + a
+# Hindsight recall, so the agent picks up the actual conversation rather than
+# only being TOLD it was compacted.
+#
+# DRY: the assembly is delegated to handoff-briefing.sh --lean — the SINGLE
+# briefing assembler. No copy of the sqlite/recall logic lives here. Lean mode
+# emits ONLY the Telegram-tail + recall (daily-memory and the boot header are
+# skipped — token duplication, the native summary already keeps recent turns),
+# and IGNORES SWITCHROOM_PENDING_* to derive the db-latest surface (a stale
+# pending-turn scope would brief the wrong chat at a mid-session compaction).
+#
+# SHARED PATH: this hook fires on SessionStart(compact) for EVERY agent,
+# regardless of session_continuity.briefing mode (legacy vs gateway), so both
+# modes get identical compaction re-seat through this one path.
+#
+# GRACEFUL: if the assembler script is not found, or emits nothing (no
+# history.db, Hindsight unreachable), the block is simply omitted. The lean
+# briefing NEVER fails the hook — the recovery block above already stands on
+# its own. handoff-briefing.sh caps its only network hop (Hindsight) at a few
+# seconds, so runtime is bounded.
+# ---------------------------------------------------------------------------
+BRIEFING_SCRIPT=""
+_HOOK_DIR=$(dirname -- "$0" 2>/dev/null || true)
+if [ -n "$_HOOK_DIR" ] && [ -r "$_HOOK_DIR/handoff-briefing.sh" ]; then
+  BRIEFING_SCRIPT="$_HOOK_DIR/handoff-briefing.sh"
+elif command -v handoff-briefing.sh >/dev/null 2>&1; then
+  BRIEFING_SCRIPT="handoff-briefing.sh"
+fi
+
+if [ -n "$BRIEFING_SCRIPT" ]; then
+  # Inner timeout, SHORTER than the 8s Claude Code hook budget, so a slow
+  # assembler degrades to "recovery block only" instead of losing everything.
+  # Without it, if the assembler runs long (e.g. an operator raises
+  # HANDOFF_BRIEFING_HINDSIGHT_TIMEOUT past the hook budget) Claude Code kills
+  # the WHOLE hook at 8s and discards ALL stdout — including the near-unkillable
+  # <compact-recovery> orientation block already printed above. Capping the
+  # assembler at 5s keeps the #4390 recovery floor intact. `timeout` is
+  # coreutils (present in the agent image); fall back to an un-timed call if it
+  # is somehow unavailable, so the lean briefing still works.
+  if command -v timeout >/dev/null 2>&1; then
+    LEAN_BRIEFING=$(timeout 5 bash "$BRIEFING_SCRIPT" --lean 2>/dev/null || true)
+  else
+    LEAN_BRIEFING=$(bash "$BRIEFING_SCRIPT" --lean 2>/dev/null || true)
+  fi
+  if [ -n "$LEAN_BRIEFING" ]; then
+    printf '%s\n' '<compact-briefing source="switchroom working-state-reload hook">'
+    printf '%s\n' 'The recent conversation and recalled memory below are re-seated so this'
+    printf '%s\n' 'compacted session has the same footing as a fresh boot. Use them to pick up'
+    printf '%s\n' 'the thread; reconcile against the native summary above before trusting either.'
+    printf '%s\n' '---'
+    printf '%s\n' "$LEAN_BRIEFING"
+    printf '%s\n' '</compact-briefing>'
+  fi
+fi
+
+exit 0

package/dist/agent-scheduler/index.js

@@ -11666,8 +11666,10 @@ var AgentSchema = exports_external.object({
   bot_username: exports_external.string().optional().describe("Per-agent Telegram bot username (without leading @) when it doesn't " + "contain the agent slug. Replaces the default 'username includes slug' " + "preflight check with an exact (case-insensitive) match. Use when an " + "agent and its bot have intentionally divergent names (e.g. agent " + "'lawgpt' paired with bot '@meken_law_bot')."),
   timezone: exports_external.string().regex(TIMEZONE_REGEX, "timezone must be an IANA zone name like 'Australia/Melbourne' or 'UTC' " + "(three-letter aliases like EST/PST and bare offsets like UTC+10 are not accepted)").optional().describe("Per-agent IANA timezone override. Wins over any profile/defaults " + "value and over the top-level switchroom.timezone global. Controls " + "the UserPromptSubmit timezone hook's emitted local time and the " + "agent container's `environment.TZ` in compose."),
   auth: exports_external.object({
-    override: exports_external.string().min(1).optional().describe("Per-agent override of the fleet-wide `auth.active`. Edge-case use only — " + "this agent talks to the named account regardless of fleet active. See RFC H §4.5.")
-  }).optional().describe("Account routing for switchroom-auth-broker. RFC H schema uses " + "fleet-wide `auth.active` plus per-agent `override:` for edge cases. " + "Pre-RFC-H `auth.accounts: [..]` and `auth_label:` are migrated in-place " + "on first apply (see src/auth/migrate-schema.ts)."),
+    override: exports_external.string().min(1).optional().describe("Per-agent override of the fleet-wide `auth.active`. Edge-case use only — " + "this agent talks to the named account regardless of fleet active. See RFC H §4.5."),
+    strict: exports_external.boolean().optional().describe("Requires `override`. When true, the pin is a hard binding, not a " + "routing preference: the broker NEVER serves this agent from any " + "other account — no failover to `auth.fallback_order` while the " + "pinned account is quota-walled or exhausted. The agent rides out " + "the wall on its own account (surfacing the normal 429/quota " + "cards) instead of silently borrowing fleet quota. Use for " + "accounts that must never cross a billing/compliance boundary " + "(e.g. an employer-provided subscription)."),
+    exclusive: exports_external.boolean().optional().describe("Requires `override`. When true, the pinned account belongs to " + "THIS agent alone: the broker refuses to serve it to any other " + "agent or consumer, refuses `auth use <label>` (set-active) onto " + "it, and refuses pinning another agent to it. Config that routes " + "others to the account (`auth.active`, `auth.fallback_order`, " + "another agent's `override`, a consumer pin) is rejected at load. " + "Usually paired with `strict: true` for full two-way isolation.")
+  }).optional().describe("Account routing for switchroom-auth-broker. RFC H schema uses " + "fleet-wide `auth.active` plus per-agent `override:` for edge cases, " + "with optional `strict:` (never borrow another account) and " + "`exclusive:` (no one else may use the pinned account) hardening. " + "Pre-RFC-H `auth.accounts: [..]` and `auth_label:` are migrated in-place " + "on first apply (see src/auth/migrate-schema.ts)."),
   dm_only: exports_external.boolean().optional().describe("Mark this agent as a DM-only bot — has its own bot_token and lives " + "exclusively in a private chat with the operator. Suppresses " + "scaffolding's default behavior of inheriting the global " + "telegram.forum_chat_id into the agent's access.json `groups` entry " + "(the forum chat the bot isn't a member of, which would otherwise " + "trigger a 'boot-probe-failed: 400 chat not found' warning every " + "restart). topic_name is still schema-required but unused — set it " + "to a display label like 'DM' for /switchroom status output."),
   topic_name: exports_external.string().describe("Telegram forum topic display name"),
   topic_emoji: exports_external.string().optional().describe("Emoji for the topic (e.g., '\uD83C\uDFCB️')"),
@@ -11742,6 +11744,17 @@ var AgentSchema = exports_external.object({
     tmp_size: exports_external.string().regex(/^\d+(\.\d+)?[kmgKMG]?$/, "tmp_size must be a Docker size string like '1g', '4g', '512m'").refine((v) => parseFloat(v) > 0, "tmp_size must be greater than zero").optional()
   }).optional()
 }).superRefine((agent, ctx) => {
+  if (agent.auth && !agent.auth.override) {
+    for (const flag of ["strict", "exclusive"]) {
+      if (agent.auth[flag]) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `\`auth.${flag}: true\` requires \`auth.override: <account>\` — there is no pinned account for it to apply to.`,
+          path: ["auth", flag]
+        });
+      }
+    }
+  }
   if (agent.dm_only !== true)
     return;
   const tg = agent.channels?.telegram;
@@ -11854,6 +11867,13 @@ var UserSchema = exports_external.object({
   profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
   person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system — just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership — never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later — see docs/configuration.md.")
 });
+var ConfigRepoConfigSchema = exports_external.object({
+  enabled: exports_external.boolean().default(false).describe("Master switch for config-repo change control. Default false (opt-in). " + "When false the `config-repo sync` verb still runs on demand but the " + "doctor check and (later) the scheduled tick treat the feature as off."),
+  path: exports_external.string().regex(/^[a-zA-Z0-9~._\-/]+$/, "config_repo.path must not contain shell-special characters ($, `, \", ', \\, etc.)").default("~/.switchroom-config").describe("Filesystem path to the operator's private config repo. Must be a git " + "repo (else `switchroom doctor` FAILs). Tilde-expanded at read time."),
+  push: exports_external.boolean().default(true).describe("When true, `config-repo sync` pushes after committing (subject to the " + "`require_private` gate). When false, it commits locally only — useful " + "for offline hosts or a review-before-push workflow."),
+  remote: exports_external.string().min(1).default("origin").describe("Git remote name to push to. Default `origin`."),
+  require_private: exports_external.boolean().default(true).describe("Refuse to PUSH unless the GitHub API confirms the remote repo is " + "private. On a public remote — or when the API is unreachable — the " + "push is skipped (commits still land locally) and a WARN is emitted. " + "Fail-safe against exfiltrating memory files / workspace state to a " + "repo that has been flipped public. Default true.")
+});
 var SwitchroomConfigSchema = exports_external.object({
   switchroom: exports_external.object({
     version: exports_external.literal(1).describe("Config schema version"),
@@ -11866,6 +11886,7 @@ var SwitchroomConfigSchema = exports_external.object({
   memory: MemoryBackendConfigSchema.optional(),
   hindsight: HindsightConfigSchema.optional().describe("Fleet-singleton Hindsight (memory backend) configuration. Currently " + "just the LLM knob (provider + model) used for retain/reflect/" + "consolidation. Both fields optional; when unset the container falls " + "back to provider=claude-code + the hard-coded HINDSIGHT_DEFAULT_MODEL " + "so nothing changes for operators who don't set it. Read at container " + "launch by startHindsight() (src/setup/hindsight.ts) — takes effect on " + "the next `switchroom apply` / `memory setup --recreate`."),
   vault: VaultConfigSchema.optional(),
+  config_repo: ConfigRepoConfigSchema.optional().describe("Change control for the operator's private ~/.switchroom-config git repo " + "(backup + audit trail of live host config, agent workspace state, and " + "mirrored personal skills). Consumed by `switchroom config-repo sync` and " + "the `config repo` doctor check. Optional and OFF by default."),
   auth: exports_external.object({
     active: exports_external.string().min(1).optional().describe("Fleet-wide active Anthropic account label. Every agent without " + "an explicit `agent.auth.override` uses this account. See " + "docs/auth.md for the full model. Set by `switchroom auth use <label>`."),
     fallback_order: exports_external.array(exports_external.string().min(1)).optional().describe("Ordered list of account labels for `switchroom auth rotate` to cycle " + "through when the active account hits a quota event. First entry is " + "normally the same as `auth.active`. When unset, `rotate` is a no-op."),
@@ -11933,6 +11954,48 @@ var SwitchroomConfigSchema = exports_external.object({
   for (const [name, a] of Object.entries(cfg.agents ?? {})) {
     checkServes(a.serves, ["agents", name, "serves"]);
   }
+  for (const [name, a] of Object.entries(cfg.agents ?? {})) {
+    const agentAuth = a.auth;
+    if (!agentAuth?.exclusive || !agentAuth.override)
+      continue;
+    const acct = agentAuth.override;
+    if (cfg.auth?.active === acct) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — it cannot be the fleet \`auth.active\``,
+        path: ["auth", "active"]
+      });
+    }
+    const fbIdx = (cfg.auth?.fallback_order ?? []).indexOf(acct);
+    if (fbIdx !== -1) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — it cannot appear in \`auth.fallback_order\``,
+        path: ["auth", "fallback_order", fbIdx]
+      });
+    }
+    for (const [other, oa] of Object.entries(cfg.agents ?? {})) {
+      if (other === name)
+        continue;
+      const otherOverride = oa.auth?.override;
+      if (otherOverride === acct) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — agent '${other}' cannot pin it`,
+          path: ["agents", other, "auth", "override"]
+        });
+      }
+    }
+    (cfg.auth?.consumers ?? []).forEach((c, i) => {
+      if (c.account === acct) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — consumer '${c.name}' cannot pin it`,
+          path: ["auth", "consumers", i, "account"]
+        });
+      }
+    });
+  }
   const microsoftAccounts = cfg.microsoft_accounts;
   for (const [name, a] of Object.entries(cfg.agents ?? {})) {
     const mw = a.microsoft_workspace;