switchroom 0.20.9 → 0.20.11

package/dist/auth-broker/index.js

@@ -10994,7 +10994,7 @@ var init_observation_scopes = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AntiConfabulationDirectiveSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, BuzzChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleServiceTokenSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AntiConfabulationDirectiveSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, BuzzChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleServiceTokenSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, ConfigRepoConfigSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   init_observation_scopes();
@@ -11691,8 +11691,10 @@ var init_schema = __esm(() => {
     bot_username: exports_external.string().optional().describe("Per-agent Telegram bot username (without leading @) when it doesn't " + "contain the agent slug. Replaces the default 'username includes slug' " + "preflight check with an exact (case-insensitive) match. Use when an " + "agent and its bot have intentionally divergent names (e.g. agent " + "'lawgpt' paired with bot '@meken_law_bot')."),
     timezone: exports_external.string().regex(TIMEZONE_REGEX, "timezone must be an IANA zone name like 'Australia/Melbourne' or 'UTC' " + "(three-letter aliases like EST/PST and bare offsets like UTC+10 are not accepted)").optional().describe("Per-agent IANA timezone override. Wins over any profile/defaults " + "value and over the top-level switchroom.timezone global. Controls " + "the UserPromptSubmit timezone hook's emitted local time and the " + "agent container's `environment.TZ` in compose."),
     auth: exports_external.object({
-      override: exports_external.string().min(1).optional().describe("Per-agent override of the fleet-wide `auth.active`. Edge-case use only — " + "this agent talks to the named account regardless of fleet active. See RFC H §4.5.")
-    }).optional().describe("Account routing for switchroom-auth-broker. RFC H schema uses " + "fleet-wide `auth.active` plus per-agent `override:` for edge cases. " + "Pre-RFC-H `auth.accounts: [..]` and `auth_label:` are migrated in-place " + "on first apply (see src/auth/migrate-schema.ts)."),
+      override: exports_external.string().min(1).optional().describe("Per-agent override of the fleet-wide `auth.active`. Edge-case use only — " + "this agent talks to the named account regardless of fleet active. See RFC H §4.5."),
+      strict: exports_external.boolean().optional().describe("Requires `override`. When true, the pin is a hard binding, not a " + "routing preference: the broker NEVER serves this agent from any " + "other account — no failover to `auth.fallback_order` while the " + "pinned account is quota-walled or exhausted. The agent rides out " + "the wall on its own account (surfacing the normal 429/quota " + "cards) instead of silently borrowing fleet quota. Use for " + "accounts that must never cross a billing/compliance boundary " + "(e.g. an employer-provided subscription)."),
+      exclusive: exports_external.boolean().optional().describe("Requires `override`. When true, the pinned account belongs to " + "THIS agent alone: the broker refuses to serve it to any other " + "agent or consumer, refuses `auth use <label>` (set-active) onto " + "it, and refuses pinning another agent to it. Config that routes " + "others to the account (`auth.active`, `auth.fallback_order`, " + "another agent's `override`, a consumer pin) is rejected at load. " + "Usually paired with `strict: true` for full two-way isolation.")
+    }).optional().describe("Account routing for switchroom-auth-broker. RFC H schema uses " + "fleet-wide `auth.active` plus per-agent `override:` for edge cases, " + "with optional `strict:` (never borrow another account) and " + "`exclusive:` (no one else may use the pinned account) hardening. " + "Pre-RFC-H `auth.accounts: [..]` and `auth_label:` are migrated in-place " + "on first apply (see src/auth/migrate-schema.ts)."),
     dm_only: exports_external.boolean().optional().describe("Mark this agent as a DM-only bot — has its own bot_token and lives " + "exclusively in a private chat with the operator. Suppresses " + "scaffolding's default behavior of inheriting the global " + "telegram.forum_chat_id into the agent's access.json `groups` entry " + "(the forum chat the bot isn't a member of, which would otherwise " + "trigger a 'boot-probe-failed: 400 chat not found' warning every " + "restart). topic_name is still schema-required but unused — set it " + "to a display label like 'DM' for /switchroom status output."),
     topic_name: exports_external.string().describe("Telegram forum topic display name"),
     topic_emoji: exports_external.string().optional().describe("Emoji for the topic (e.g., '\uD83C\uDFCB️')"),
@@ -11767,6 +11769,17 @@ var init_schema = __esm(() => {
       tmp_size: exports_external.string().regex(/^\d+(\.\d+)?[kmgKMG]?$/, "tmp_size must be a Docker size string like '1g', '4g', '512m'").refine((v) => parseFloat(v) > 0, "tmp_size must be greater than zero").optional()
     }).optional()
   }).superRefine((agent, ctx) => {
+    if (agent.auth && !agent.auth.override) {
+      for (const flag of ["strict", "exclusive"]) {
+        if (agent.auth[flag]) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            message: `\`auth.${flag}: true\` requires \`auth.override: <account>\` — there is no pinned account for it to apply to.`,
+            path: ["auth", flag]
+          });
+        }
+      }
+    }
     if (agent.dm_only !== true)
       return;
     const tg = agent.channels?.telegram;
@@ -11879,6 +11892,13 @@ var init_schema = __esm(() => {
     profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
     person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system — just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership — never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later — see docs/configuration.md.")
   });
+  ConfigRepoConfigSchema = exports_external.object({
+    enabled: exports_external.boolean().default(false).describe("Master switch for config-repo change control. Default false (opt-in). " + "When false the `config-repo sync` verb still runs on demand but the " + "doctor check and (later) the scheduled tick treat the feature as off."),
+    path: exports_external.string().regex(/^[a-zA-Z0-9~._\-/]+$/, "config_repo.path must not contain shell-special characters ($, `, \", ', \\, etc.)").default("~/.switchroom-config").describe("Filesystem path to the operator's private config repo. Must be a git " + "repo (else `switchroom doctor` FAILs). Tilde-expanded at read time."),
+    push: exports_external.boolean().default(true).describe("When true, `config-repo sync` pushes after committing (subject to the " + "`require_private` gate). When false, it commits locally only — useful " + "for offline hosts or a review-before-push workflow."),
+    remote: exports_external.string().min(1).default("origin").describe("Git remote name to push to. Default `origin`."),
+    require_private: exports_external.boolean().default(true).describe("Refuse to PUSH unless the GitHub API confirms the remote repo is " + "private. On a public remote — or when the API is unreachable — the " + "push is skipped (commits still land locally) and a WARN is emitted. " + "Fail-safe against exfiltrating memory files / workspace state to a " + "repo that has been flipped public. Default true.")
+  });
   SwitchroomConfigSchema = exports_external.object({
     switchroom: exports_external.object({
       version: exports_external.literal(1).describe("Config schema version"),
@@ -11891,6 +11911,7 @@ var init_schema = __esm(() => {
     memory: MemoryBackendConfigSchema.optional(),
     hindsight: HindsightConfigSchema.optional().describe("Fleet-singleton Hindsight (memory backend) configuration. Currently " + "just the LLM knob (provider + model) used for retain/reflect/" + "consolidation. Both fields optional; when unset the container falls " + "back to provider=claude-code + the hard-coded HINDSIGHT_DEFAULT_MODEL " + "so nothing changes for operators who don't set it. Read at container " + "launch by startHindsight() (src/setup/hindsight.ts) — takes effect on " + "the next `switchroom apply` / `memory setup --recreate`."),
     vault: VaultConfigSchema.optional(),
+    config_repo: ConfigRepoConfigSchema.optional().describe("Change control for the operator's private ~/.switchroom-config git repo " + "(backup + audit trail of live host config, agent workspace state, and " + "mirrored personal skills). Consumed by `switchroom config-repo sync` and " + "the `config repo` doctor check. Optional and OFF by default."),
     auth: exports_external.object({
       active: exports_external.string().min(1).optional().describe("Fleet-wide active Anthropic account label. Every agent without " + "an explicit `agent.auth.override` uses this account. See " + "docs/auth.md for the full model. Set by `switchroom auth use <label>`."),
       fallback_order: exports_external.array(exports_external.string().min(1)).optional().describe("Ordered list of account labels for `switchroom auth rotate` to cycle " + "through when the active account hits a quota event. First entry is " + "normally the same as `auth.active`. When unset, `rotate` is a no-op."),
@@ -11958,6 +11979,48 @@ var init_schema = __esm(() => {
     for (const [name, a] of Object.entries(cfg.agents ?? {})) {
       checkServes(a.serves, ["agents", name, "serves"]);
     }
+    for (const [name, a] of Object.entries(cfg.agents ?? {})) {
+      const agentAuth = a.auth;
+      if (!agentAuth?.exclusive || !agentAuth.override)
+        continue;
+      const acct = agentAuth.override;
+      if (cfg.auth?.active === acct) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — it cannot be the fleet \`auth.active\``,
+          path: ["auth", "active"]
+        });
+      }
+      const fbIdx = (cfg.auth?.fallback_order ?? []).indexOf(acct);
+      if (fbIdx !== -1) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — it cannot appear in \`auth.fallback_order\``,
+          path: ["auth", "fallback_order", fbIdx]
+        });
+      }
+      for (const [other, oa] of Object.entries(cfg.agents ?? {})) {
+        if (other === name)
+          continue;
+        const otherOverride = oa.auth?.override;
+        if (otherOverride === acct) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — agent '${other}' cannot pin it`,
+            path: ["agents", other, "auth", "override"]
+          });
+        }
+      }
+      (cfg.auth?.consumers ?? []).forEach((c, i) => {
+        if (c.account === acct) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) — consumer '${c.name}' cannot pin it`,
+            path: ["auth", "consumers", i, "account"]
+          });
+        }
+      });
+    }
     const microsoftAccounts = cfg.microsoft_accounts;
     for (const [name, a] of Object.entries(cfg.agents ?? {})) {
       const mw = a.microsoft_workspace;
@@ -19820,6 +19883,23 @@ function extractApiErrorMessage(bodyText) {
   } catch {}
   return bodyText.trim().slice(0, 500);
 }
+function extractApiErrorCode(bodyText) {
+  if (!bodyText || bodyText.trim().length === 0)
+    return null;
+  try {
+    const parsed = JSON.parse(bodyText);
+    const code = parsed?.error?.details?.error_code;
+    if (typeof code === "string" && code.trim().length > 0)
+      return code.trim();
+  } catch {}
+  return null;
+}
+var ENTITLEMENT_BLOCKED_ERROR_CODES = new Set([
+  "oauth_not_allowed_for_organization"
+]);
+function isEntitlementBlockedErrorCode(code) {
+  return code != null && ENTITLEMENT_BLOCKED_ERROR_CODES.has(code);
+}
 function isEntitlementDisabledMessage(message) {
   if (!message)
     return false;
@@ -19877,7 +19957,8 @@ async function fetchQuota(opts) {
     } catch {}
     clearTimeout(timeout);
     const apiErrorMessage = extractApiErrorMessage(bodyText);
-    const entitlement = resp.status === 403 && isEntitlementDisabledMessage(apiErrorMessage);
+    const apiErrorCode = extractApiErrorCode(bodyText);
+    const entitlement = resp.status === 403 && (isEntitlementBlockedErrorCode(apiErrorCode) || isEntitlementDisabledMessage(apiErrorMessage));
     return {
       ok: false,
       reason: `HTTP ${resp.status} from Anthropic (${parsed.reason})`,
@@ -22165,11 +22246,30 @@ class AuthBroker {
       return override;
     return auth.active ?? null;
   }
+  exclusiveOwnerOf(account) {
+    for (const [name, agent] of Object.entries(this.config.agents ?? {})) {
+      if (agent.auth?.exclusive && agent.auth?.override === account)
+        return name;
+    }
+    return null;
+  }
+  isServableBy(account, forAgent) {
+    const owner = this.exclusiveOwnerOf(account);
+    return owner === null || owner === forAgent;
+  }
   servingAccount(identity) {
-    const account = this.callerAccount(identity);
     if (identity.kind === "operator")
-      return account;
-    return this.accountWithFailover(account);
+      return this.callerAccount(identity);
+    if (identity.kind === "agent")
+      return this.servedAccountForAgent(identity.name);
+    return this.accountWithFailover(this.callerAccount(identity));
+  }
+  servedAccountForAgent(name) {
+    const agent = (this.config.agents ?? {})[name];
+    const override = agent?.auth?.override;
+    if (override && agent?.auth?.strict)
+      return override;
+    return this.accountWithFailover(override ?? this.config.auth?.active ?? null, name);
   }
   isOverageAllowed(account) {
     return (this.config.auth?.allow_overage_accounts ?? []).includes(account);
@@ -22287,6 +22387,8 @@ class AuthBroker {
         continue;
       if (this.isAccountPremiumWalled(cand))
         continue;
+      if (this.exclusiveOwnerOf(cand))
+        continue;
       if (!accountExists(cand, this.home))
         continue;
       if (!readAccountCredentials(cand, this.home))
@@ -22432,15 +22534,30 @@ class AuthBroker {
     if (reselected && this.accountEligibilityOf(reselected) === "eligible")
       return reselected;
     for (const cand of ring) {
-      if (cand && cand !== current && accountExists(cand, this.home) && this.accountEligibilityOf(cand) === "unknown") {
+      if (cand && cand !== current && accountExists(cand, this.home) && !this.exclusiveOwnerOf(cand) && this.accountEligibilityOf(cand) === "unknown") {
         return cand;
       }
     }
     return null;
   }
-  accountWithFailover(account) {
+  accountWithFailover(account, forAgent) {
     if (!account)
       return null;
+    if (!this.isServableBy(account, forAgent)) {
+      for (const cand of this.config.auth?.fallback_order ?? []) {
+        if (cand === account || this.isAccountExhausted(cand))
+          continue;
+        if (!this.isServableBy(cand, forAgent))
+          continue;
+        if (readAccountCredentials(cand, this.home))
+          return cand;
+      }
+      const active2 = this.config.auth?.active;
+      if (active2 && active2 !== account && !this.isAccountExhausted(active2) && this.isServableBy(active2, forAgent) && readAccountCredentials(active2, this.home)) {
+        return active2;
+      }
+      return null;
+    }
     const exhausted = this.isAccountExhausted(account);
     if (!exhausted && !this.isAccountSoftAvoided(account))
       return account;
@@ -22448,6 +22565,8 @@ class AuthBroker {
     for (const cand of this.config.auth?.fallback_order ?? []) {
       if (cand === account || this.isAccountExhausted(cand))
         continue;
+      if (!this.isServableBy(cand, forAgent))
+        continue;
       if (this.isAccountSoftAvoided(cand)) {
         softAvoidExcludedAny = true;
         continue;
@@ -22461,6 +22580,8 @@ class AuthBroker {
       for (const cand of this.config.auth?.fallback_order ?? []) {
         if (cand === account || this.isAccountExhausted(cand))
           continue;
+        if (!this.isServableBy(cand, forAgent))
+          continue;
         if (!readAccountCredentials(cand, this.home))
           continue;
         const score = this.softAvoidUtilScore(cand);
@@ -22475,12 +22596,14 @@ class AuthBroker {
       for (const cand of this.config.auth?.fallback_order ?? []) {
         if (cand === account || this.isAccountExhausted(cand))
           continue;
+        if (!this.isServableBy(cand, forAgent))
+          continue;
         if (readAccountCredentials(cand, this.home))
           return cand;
       }
     }
     const active = this.config.auth?.active;
-    if (active && active !== account && !this.isAccountExhausted(active) && readAccountCredentials(active, this.home)) {
+    if (active && active !== account && !this.isAccountExhausted(active) && this.isServableBy(active, forAgent) && readAccountCredentials(active, this.home)) {
       return active;
     }
     return account;
@@ -22532,7 +22655,9 @@ class AuthBroker {
     const agents = Object.entries(this.config.agents ?? {}).map(([name, agent]) => {
       const override = agent.auth?.override ?? null;
       const account = override ?? auth.active ?? "";
-      return { name, account, override };
+      const strict = Boolean(override && agent.auth?.strict);
+      const exclusive = Boolean(override && agent.auth?.exclusive);
+      return { name, account, override, strict, exclusive };
     });
     const consumers = (auth.consumers ?? []).map((c) => ({
       name: c.name,
@@ -22859,6 +22984,12 @@ class AuthBroker {
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `account '${account}' not found`));
       return;
     }
+    const exclusiveOwner = this.exclusiveOwnerOf(account);
+    if (exclusiveOwner) {
+      this.audit({ op: "set-active", identity, account, accountKind: "claude", ok: false, error: "exclusive-account" });
+      socket.write(encodeError(id, "FORBIDDEN", `account '${account}' is exclusive to agent '${exclusiveOwner}' ` + `(agents.${exclusiveOwner}.auth.exclusive) — it cannot be the fleet active. ` + `Clear the exclusive flag in switchroom.yaml first if you really mean this.`));
+      return;
+    }
     const cfg = {
       ...this.config,
       auth: { ...this.config.auth ?? {}, active: account }
@@ -22870,6 +23001,15 @@ class AuthBroker {
     this.audit({ op: "set-active", identity, account, accountKind: "claude", ok: true });
     socket.write(encodeSuccess(id, { active: account, fanned }));
   }
+  callerStrictPinned(identity) {
+    if (identity.kind !== "agent")
+      return false;
+    const a = (this.config.agents ?? {})[identity.name]?.auth;
+    return Boolean(a?.override && a?.strict);
+  }
+  callerRolledTo(identity, rolledTo) {
+    return this.callerStrictPinned(identity) ? null : rolledTo;
+  }
   async opMarkExhausted(socket, id, identity, until) {
     const account = this.callerAccount(identity);
     if (!account) {
@@ -22879,7 +23019,12 @@ class AuthBroker {
     }
     const { rolled, rolledTo } = await this.markExhaustedAndRoll(account, until, identity);
     this.audit({ op: "mark-exhausted", identity, account, accountKind: "claude", ok: true });
-    socket.write(encodeSuccess(id, { account, rolled, rolledTo }));
+    socket.write(encodeSuccess(id, {
+      account,
+      rolled,
+      rolledTo: this.callerRolledTo(identity, rolledTo),
+      caller_pinned_strict: this.callerStrictPinned(identity)
+    }));
   }
   async opMarkThrottled(socket, id, identity, until, probeOnly = false) {
     const account = this.callerAccount(identity);
@@ -22896,7 +23041,8 @@ class AuthBroker {
         account,
         throttled_until: this.quota[account]?.throttled_until ?? 0,
         escalated: escalated2,
-        rolledTo: escalated2 ? rolledTo2 : null
+        rolledTo: escalated2 ? this.callerRolledTo(identity, rolledTo2) : null,
+        caller_pinned_strict: this.callerStrictPinned(identity)
       }));
       return;
     }
@@ -22939,7 +23085,8 @@ class AuthBroker {
       account,
       throttled_until: throttledUntil,
       escalated,
-      rolledTo: escalated ? rolledTo : null
+      rolledTo: escalated ? this.callerRolledTo(identity, rolledTo) : null,
+      caller_pinned_strict: this.callerStrictPinned(identity)
     }));
   }
   async maybeEscalateThrottle(account, identity, now) {
@@ -23511,6 +23658,22 @@ class AuthBroker {
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `account '${account}' not found`));
       return;
     }
+    if (account !== null) {
+      const exclusiveOwner = this.exclusiveOwnerOf(account);
+      if (exclusiveOwner && exclusiveOwner !== agentName) {
+        this.audit({ op: "set-override", identity, account, accountKind: "claude", ok: false, error: "exclusive-account" });
+        socket.write(encodeError(id, "FORBIDDEN", `account '${account}' is exclusive to agent '${exclusiveOwner}' ` + `(agents.${exclusiveOwner}.auth.exclusive) — agent '${agentName}' cannot pin it.`));
+        return;
+      }
+    }
+    {
+      const curAuth = (this.config.agents ?? {})[agentName]?.auth;
+      if ((curAuth?.strict || curAuth?.exclusive) && account !== (curAuth?.override ?? null)) {
+        this.audit({ op: "set-override", identity, account: account ?? undefined, accountKind: "claude", ok: false, error: "yaml-pinned" });
+        socket.write(encodeError(id, "FORBIDDEN", `agent '${agentName}' has a strict/exclusive pin declared in switchroom.yaml — ` + `edit the yaml (agents.${agentName}.auth) and restart the broker to change it.`));
+        return;
+      }
+    }
     const agents = { ...this.config.agents ?? {} };
     const cur = agents[agentName];
     const auth = { ...cur.auth ?? {} };
@@ -23686,10 +23849,9 @@ class AuthBroker {
     return out;
   }
   fanoutToAffectedAgents(label) {
-    const auth = this.config.auth ?? {};
     const fanned = [];
-    for (const [name, agent] of Object.entries(this.config.agents ?? {})) {
-      const effective = this.accountWithFailover(agent.auth?.override ?? auth.active);
+    for (const name of Object.keys(this.config.agents ?? {})) {
+      const effective = this.servedAccountForAgent(name);
       if (effective === label) {
         if (this.fanoutForAgent(name))
           fanned.push(name);
@@ -23708,10 +23870,9 @@ class AuthBroker {
       const isEffective = effective === label;
       if (!isPinned && !isEffective)
         continue;
-      const toMirror = effective ?? bound;
-      if (toMirror == null)
+      if (effective == null)
         continue;
-      if (this.mirrorAccountToConsumer(toMirror, consumer)) {
+      if (this.mirrorAccountToConsumer(effective, consumer)) {
         fanned.push(consumer.name);
       }
     }
@@ -23812,6 +23973,10 @@ class AuthBroker {
       const effective = agent.auth?.override ?? auth.active;
       if (effective !== label)
         continue;
+      if (agent.auth?.override && agent.auth?.strict)
+        continue;
+      if (!this.isServableBy(next, name))
+        continue;
       if (this.mirrorAccountToAgent(next, name)) {
         rolled.push(name);
       }
@@ -23820,8 +23985,13 @@ class AuthBroker {
   }
   nextHealthyAccount(current, order) {
     const start = order.indexOf(current);
-    if (start === -1)
-      return order[0] ?? null;
+    if (start === -1) {
+      for (const cand of order) {
+        if (cand && !this.exclusiveOwnerOf(cand))
+          return cand;
+      }
+      return null;
+    }
     let bestSoftAvoided = null;
     let bestScore = Number.POSITIVE_INFINITY;
     for (let i = 1;i <= order.length; i++) {
@@ -23830,6 +24000,8 @@ class AuthBroker {
         continue;
       if (this.isAccountExhausted(cand) || !accountExists(cand, this.home))
         continue;
+      if (this.exclusiveOwnerOf(cand))
+        continue;
       if (!this.isAccountSoftAvoided(cand))
         return cand;
       const score = this.softAvoidUtilScore(cand);
@@ -23841,11 +24013,10 @@ class AuthBroker {
     return bestSoftAvoided;
   }
   fanoutForAgent(name) {
-    const auth = this.config.auth ?? {};
     const agent = (this.config.agents ?? {})[name];
     if (!agent)
       return false;
-    const effective = this.accountWithFailover(agent.auth?.override ?? auth.active);
+    const effective = this.servedAccountForAgent(name);
     if (!effective)
       return false;
     return this.mirrorAccountToAgent(effective, name);
@@ -23974,6 +24145,15 @@ class AuthBroker {
 `);
       return;
     }
+    const exclusiveOwner = this.exclusiveOwnerOf(ov.active);
+    if (exclusiveOwner) {
+      process.stdout.write(`auth-broker: active-override dropped — account '${ov.active}' is now exclusive ` + `to agent '${exclusiveOwner}' (agents.${exclusiveOwner}.auth.exclusive); yaml wins
+`);
+      try {
+        unlinkSync(join7(this.stateDir, "active-override.json"));
+      } catch {}
+      return;
+    }
     if (ov.active === this.config.auth?.active)
       return;
     this.config = {

package/dist/cli/notion-write-pretool.mjs

@@ -12427,8 +12427,10 @@ var AgentSchema = exports_external.object({
   bot_username: exports_external.string().optional().describe("Per-agent Telegram bot username (without leading @) when it doesn't " + "contain the agent slug. Replaces the default 'username includes slug' " + "preflight check with an exact (case-insensitive) match. Use when an " + "agent and its bot have intentionally divergent names (e.g. agent " + "'lawgpt' paired with bot '@meken_law_bot')."),
   timezone: exports_external.string().regex(TIMEZONE_REGEX, "timezone must be an IANA zone name like 'Australia/Melbourne' or 'UTC' " + "(three-letter aliases like EST/PST and bare offsets like UTC+10 are not accepted)").optional().describe("Per-agent IANA timezone override. Wins over any profile/defaults " + "value and over the top-level switchroom.timezone global. Controls " + "the UserPromptSubmit timezone hook's emitted local time and the " + "agent container's `environment.TZ` in compose."),
   auth: exports_external.object({
-    override: exports_external.string().min(1).optional().describe("Per-agent override of the fleet-wide `auth.active`. Edge-case use only \u2014 " + "this agent talks to the named account regardless of fleet active. See RFC H \u00a74.5.")
-  }).optional().describe("Account routing for switchroom-auth-broker. RFC H schema uses " + "fleet-wide `auth.active` plus per-agent `override:` for edge cases. " + "Pre-RFC-H `auth.accounts: [..]` and `auth_label:` are migrated in-place " + "on first apply (see src/auth/migrate-schema.ts)."),
+    override: exports_external.string().min(1).optional().describe("Per-agent override of the fleet-wide `auth.active`. Edge-case use only \u2014 " + "this agent talks to the named account regardless of fleet active. See RFC H \u00a74.5."),
+    strict: exports_external.boolean().optional().describe("Requires `override`. When true, the pin is a hard binding, not a " + "routing preference: the broker NEVER serves this agent from any " + "other account \u2014 no failover to `auth.fallback_order` while the " + "pinned account is quota-walled or exhausted. The agent rides out " + "the wall on its own account (surfacing the normal 429/quota " + "cards) instead of silently borrowing fleet quota. Use for " + "accounts that must never cross a billing/compliance boundary " + "(e.g. an employer-provided subscription)."),
+    exclusive: exports_external.boolean().optional().describe("Requires `override`. When true, the pinned account belongs to " + "THIS agent alone: the broker refuses to serve it to any other " + "agent or consumer, refuses `auth use <label>` (set-active) onto " + "it, and refuses pinning another agent to it. Config that routes " + "others to the account (`auth.active`, `auth.fallback_order`, " + "another agent's `override`, a consumer pin) is rejected at load. " + "Usually paired with `strict: true` for full two-way isolation.")
+  }).optional().describe("Account routing for switchroom-auth-broker. RFC H schema uses " + "fleet-wide `auth.active` plus per-agent `override:` for edge cases, " + "with optional `strict:` (never borrow another account) and " + "`exclusive:` (no one else may use the pinned account) hardening. " + "Pre-RFC-H `auth.accounts: [..]` and `auth_label:` are migrated in-place " + "on first apply (see src/auth/migrate-schema.ts)."),
   dm_only: exports_external.boolean().optional().describe("Mark this agent as a DM-only bot \u2014 has its own bot_token and lives " + "exclusively in a private chat with the operator. Suppresses " + "scaffolding's default behavior of inheriting the global " + "telegram.forum_chat_id into the agent's access.json `groups` entry " + "(the forum chat the bot isn't a member of, which would otherwise " + "trigger a 'boot-probe-failed: 400 chat not found' warning every " + "restart). topic_name is still schema-required but unused \u2014 set it " + "to a display label like 'DM' for /switchroom status output."),
   topic_name: exports_external.string().describe("Telegram forum topic display name"),
   topic_emoji: exports_external.string().optional().describe("Emoji for the topic (e.g., '\uD83C\uDFCB\ufe0f')"),
@@ -12503,6 +12505,17 @@ var AgentSchema = exports_external.object({
     tmp_size: exports_external.string().regex(/^\d+(\.\d+)?[kmgKMG]?$/, "tmp_size must be a Docker size string like '1g', '4g', '512m'").refine((v) => parseFloat(v) > 0, "tmp_size must be greater than zero").optional()
   }).optional()
 }).superRefine((agent, ctx) => {
+  if (agent.auth && !agent.auth.override) {
+    for (const flag of ["strict", "exclusive"]) {
+      if (agent.auth[flag]) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `\`auth.${flag}: true\` requires \`auth.override: <account>\` \u2014 there is no pinned account for it to apply to.`,
+          path: ["auth", flag]
+        });
+      }
+    }
+  }
   if (agent.dm_only !== true)
     return;
   const tg = agent.channels?.telegram;
@@ -12615,6 +12628,13 @@ var UserSchema = exports_external.object({
   profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
   person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system \u2014 just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership \u2014 never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later \u2014 see docs/configuration.md.")
 });
+var ConfigRepoConfigSchema = exports_external.object({
+  enabled: exports_external.boolean().default(false).describe("Master switch for config-repo change control. Default false (opt-in). " + "When false the `config-repo sync` verb still runs on demand but the " + "doctor check and (later) the scheduled tick treat the feature as off."),
+  path: exports_external.string().regex(/^[a-zA-Z0-9~._\-/]+$/, "config_repo.path must not contain shell-special characters ($, `, \", ', \\, etc.)").default("~/.switchroom-config").describe("Filesystem path to the operator's private config repo. Must be a git " + "repo (else `switchroom doctor` FAILs). Tilde-expanded at read time."),
+  push: exports_external.boolean().default(true).describe("When true, `config-repo sync` pushes after committing (subject to the " + "`require_private` gate). When false, it commits locally only \u2014 useful " + "for offline hosts or a review-before-push workflow."),
+  remote: exports_external.string().min(1).default("origin").describe("Git remote name to push to. Default `origin`."),
+  require_private: exports_external.boolean().default(true).describe("Refuse to PUSH unless the GitHub API confirms the remote repo is " + "private. On a public remote \u2014 or when the API is unreachable \u2014 the " + "push is skipped (commits still land locally) and a WARN is emitted. " + "Fail-safe against exfiltrating memory files / workspace state to a " + "repo that has been flipped public. Default true.")
+});
 var SwitchroomConfigSchema = exports_external.object({
   switchroom: exports_external.object({
     version: exports_external.literal(1).describe("Config schema version"),
@@ -12627,6 +12647,7 @@ var SwitchroomConfigSchema = exports_external.object({
   memory: MemoryBackendConfigSchema.optional(),
   hindsight: HindsightConfigSchema.optional().describe("Fleet-singleton Hindsight (memory backend) configuration. Currently " + "just the LLM knob (provider + model) used for retain/reflect/" + "consolidation. Both fields optional; when unset the container falls " + "back to provider=claude-code + the hard-coded HINDSIGHT_DEFAULT_MODEL " + "so nothing changes for operators who don't set it. Read at container " + "launch by startHindsight() (src/setup/hindsight.ts) \u2014 takes effect on " + "the next `switchroom apply` / `memory setup --recreate`."),
   vault: VaultConfigSchema.optional(),
+  config_repo: ConfigRepoConfigSchema.optional().describe("Change control for the operator's private ~/.switchroom-config git repo " + "(backup + audit trail of live host config, agent workspace state, and " + "mirrored personal skills). Consumed by `switchroom config-repo sync` and " + "the `config repo` doctor check. Optional and OFF by default."),
   auth: exports_external.object({
     active: exports_external.string().min(1).optional().describe("Fleet-wide active Anthropic account label. Every agent without " + "an explicit `agent.auth.override` uses this account. See " + "docs/auth.md for the full model. Set by `switchroom auth use <label>`."),
     fallback_order: exports_external.array(exports_external.string().min(1)).optional().describe("Ordered list of account labels for `switchroom auth rotate` to cycle " + "through when the active account hits a quota event. First entry is " + "normally the same as `auth.active`. When unset, `rotate` is a no-op."),
@@ -12694,6 +12715,48 @@ var SwitchroomConfigSchema = exports_external.object({
   for (const [name, a] of Object.entries(cfg.agents ?? {})) {
     checkServes(a.serves, ["agents", name, "serves"]);
   }
+  for (const [name, a] of Object.entries(cfg.agents ?? {})) {
+    const agentAuth = a.auth;
+    if (!agentAuth?.exclusive || !agentAuth.override)
+      continue;
+    const acct = agentAuth.override;
+    if (cfg.auth?.active === acct) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) \u2014 it cannot be the fleet \`auth.active\``,
+        path: ["auth", "active"]
+      });
+    }
+    const fbIdx = (cfg.auth?.fallback_order ?? []).indexOf(acct);
+    if (fbIdx !== -1) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) \u2014 it cannot appear in \`auth.fallback_order\``,
+        path: ["auth", "fallback_order", fbIdx]
+      });
+    }
+    for (const [other, oa] of Object.entries(cfg.agents ?? {})) {
+      if (other === name)
+        continue;
+      const otherOverride = oa.auth?.override;
+      if (otherOverride === acct) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) \u2014 agent '${other}' cannot pin it`,
+          path: ["agents", other, "auth", "override"]
+        });
+      }
+    }
+    (cfg.auth?.consumers ?? []).forEach((c, i) => {
+      if (c.account === acct) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          message: `account '${acct}' is exclusive to agent '${name}' ` + `(agents.${name}.auth.exclusive) \u2014 consumer '${c.name}' cannot pin it`,
+          path: ["auth", "consumers", i, "account"]
+        });
+      }
+    });
+  }
   const microsoftAccounts = cfg.microsoft_accounts;
   for (const [name, a] of Object.entries(cfg.agents ?? {})) {
     const mw = a.microsoft_workspace;