switchroom 0.21.13 → 0.21.14

package/dist/host-control/main.js

@@ -21588,7 +21588,7 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.21.13";
+var VERSION = "0.21.14";
 
 // src/setup/hindsight-recall-passthrough.ts
 var HINDSIGHT_RECALL_TAG_WEIGHT_SEED = Object.freeze({ sidechain: 0.8 });
@@ -29064,6 +29064,21 @@ var ROLLOUT_PROBE_TIMEOUT_MS = envMs("SWITCHROOM_ROLLOUT_PROBE_TIMEOUT_MS", 60 *
 import { chownSync as chownSync3 } from "node:fs";
 import { mkdir, readFile, writeFile, rename, copyFile } from "node:fs/promises";
 init_merge();
+
+// src/agents/singleton-reconcile.ts
+var import_yaml4 = __toESM(require_dist(), 1);
+var CORE_SINGLETON_SERVICES = [
+  "vault-broker",
+  "approval-kernel",
+  "switchroom-auth-broker"
+];
+var VOICE_SIDECAR_SERVICE = "voice-sidecar";
+var SINGLETON_SERVICES = [
+  ...CORE_SINGLETON_SERVICES,
+  VOICE_SIDECAR_SERVICE
+];
+
+// src/cli/write-compose.ts
 var AGENT_IMAGE_TAG_RE = /image:\s*\S*switchroom-agent:(\S+)/;
 var BACKUP_SUFFIX = ".bak";
 function composeBackupPath(composePath) {
@@ -29177,19 +29192,6 @@ var MAX_BYTES = 10 * 1024 * 1024;
 // src/agents/docker-fleet.ts
 init_loader();
 
-// src/agents/singleton-reconcile.ts
-var import_yaml4 = __toESM(require_dist(), 1);
-var CORE_SINGLETON_SERVICES = [
-  "vault-broker",
-  "approval-kernel",
-  "switchroom-auth-broker"
-];
-var VOICE_SIDECAR_SERVICE = "voice-sidecar";
-var SINGLETON_SERVICES = [
-  ...CORE_SINGLETON_SERVICES,
-  VOICE_SIDECAR_SERVICE
-];
-
 // src/agents/lifecycle.ts
 function containerName(name) {
   return `switchroom-${name}`;

package/dist/vault/broker/server.js

@@ -19645,7 +19645,7 @@ var init_resolver = __esm(() => {
 
 // src/vault/broker/server.ts
 import * as net from "node:net";
-import { mkdirSync as mkdirSync8, chmodSync as chmodSync5, chownSync as chownSync2, existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync5, statSync as statSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { mkdirSync as mkdirSync8, chmodSync as chmodSync5, chownSync as chownSync2, existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync5, statSync as statSync8, unlinkSync as unlinkSync6, writeFileSync as writeFileSync5 } from "node:fs";
 
 // src/agents/compose.ts
 init_schema();
@@ -21423,6 +21423,66 @@ function createAuditLogger(opts = {}) {
   };
 }
 
+// src/vault/broker/vault-refresh.ts
+init_vault();
+import { statSync as statSync7 } from "node:fs";
+function sameVaultStamp(a, b) {
+  return a.mtimeNs === b.mtimeNs && a.size === b.size && a.ino === b.ino;
+}
+function readVaultStamp(vaultPath) {
+  try {
+    const st = statSync7(vaultPath, { bigint: true });
+    return { mtimeNs: st.mtimeNs, size: st.size, ino: st.ino };
+  } catch {
+    return null;
+  }
+}
+function zeroSecrets(secrets) {
+  for (const [, entry] of Object.entries(secrets)) {
+    try {
+      if (entry.kind === "string" || entry.kind === "binary") {
+        entry.value = "";
+      }
+    } catch {}
+  }
+}
+function refreshVaultIfChanged(state, opts) {
+  const { vaultPath, force = false } = opts;
+  const open = opts.open ?? openVault;
+  const warn = opts.warn ?? ((m) => {
+    process.stderr.write(m);
+  });
+  const secrets = state.secrets;
+  const passphrase = state.passphrase;
+  if (secrets === null || passphrase === null)
+    return state;
+  const known = state.loadedStamp;
+  if (known === null)
+    return state;
+  const current = readVaultStamp(vaultPath);
+  if (current === null)
+    return state;
+  if (!force && sameVaultStamp(current, known))
+    return state;
+  if (!force && state.failedStamp !== null && sameVaultStamp(state.failedStamp, current)) {
+    return state;
+  }
+  opts.beforeOpen?.(vaultPath);
+  let next;
+  try {
+    next = open(passphrase, vaultPath);
+  } catch (err) {
+    const alreadyWarned = state.failedStamp !== null && sameVaultStamp(state.failedStamp, current);
+    if (!alreadyWarned) {
+      warn(`[vault-broker] WARNING: ${vaultPath} changed on disk but ` + `could not be re-opened (${err?.message ?? "unknown error"}) — ` + `continuing to serve the previously loaded secrets; will retry when ` + `the file changes again
+`);
+    }
+    return { ...state, failedStamp: current };
+  }
+  zeroSecrets(secrets);
+  return { secrets: next, passphrase, loadedStamp: current, failedStamp: null };
+}
+
 // src/vault/grants.ts
 import { createHash as createHash5, randomBytes as randomBytes4 } from "node:crypto";
 
@@ -23829,6 +23889,8 @@ class VaultBroker {
   testOpts;
   secrets = null;
   passphrase = null;
+  vaultStamp = null;
+  failedVaultStamp = null;
   config = null;
   startedAt = Date.now();
   server = null;
@@ -23923,13 +23985,53 @@ class VaultBroker {
   }
   unlockFromPassphrase(passphrase) {
     detectVaultLayoutDrift(this.vaultPath);
+    const stamp = this._readVaultStamp();
     const secrets = openVault(passphrase, this.vaultPath);
     this.secrets = secrets;
     this.passphrase = passphrase;
+    this.vaultStamp = stamp;
+    this.failedVaultStamp = null;
     this._setReadinessSentinel(true);
   }
+  _readVaultStamp() {
+    return readVaultStamp(this.vaultPath);
+  }
+  _reloadSecretsIfVaultChanged(force = false) {
+    let next;
+    try {
+      next = refreshVaultIfChanged({
+        secrets: this.secrets,
+        passphrase: this.passphrase,
+        loadedStamp: this.vaultStamp,
+        failedStamp: this.failedVaultStamp
+      }, { vaultPath: this.vaultPath, force, beforeOpen: detectVaultLayoutDrift });
+    } catch (err) {
+      this._failClosedOnVaultDrift(err);
+      return;
+    }
+    this.secrets = next.secrets;
+    this.vaultStamp = next.loadedStamp;
+    this.failedVaultStamp = next.failedStamp;
+  }
+  _failClosedOnVaultDrift(err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[vault-broker] FATAL: ${detail}
+[vault-broker] Refusing to serve secrets from a vault whose on-disk ` + `layout has diverged — locking. Fix the layout and restart the broker ` + `(\`switchroom apply\`); see docs/operators/state-e-recovery.md.
+`);
+    try {
+      this.auditLogger.write({
+        ts: new Date().toISOString(),
+        op: "lock",
+        caller: `pid:${process.pid}`,
+        pid: process.pid,
+        result: "error:vault-layout-drift"
+      });
+    } catch {}
+    this.lock();
+  }
   reload(config) {
     this.config = config;
+    this._reloadSecretsIfVaultChanged(true);
   }
   _setReadinessSentinel(ready) {
     const p = process.env.SWITCHROOM_VAULT_BROKER_READY_PATH;
@@ -23945,15 +24047,11 @@ class VaultBroker {
   }
   lock() {
     if (this.secrets !== null) {
-      for (const [, entry] of Object.entries(this.secrets)) {
-        try {
-          if (entry.kind === "string" || entry.kind === "binary") {
-            entry.value = "";
-          }
-        } catch {}
-      }
+      zeroSecrets(this.secrets);
       this.secrets = null;
     }
+    this.vaultStamp = null;
+    this.failedVaultStamp = null;
     this.passphrase = null;
     this._setReadinessSentinel(false);
   }
@@ -24273,6 +24371,7 @@ class VaultBroker {
         socket.write(encodeResponse(errorResponse("DENIED", "preflight_access is operator-only")));
         return;
       }
+      this._reloadSecretsIfVaultChanged();
       if (this.secrets === null) {
         socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
         return;
@@ -24304,6 +24403,7 @@ class VaultBroker {
       return;
     }
     if (req.op === "list") {
+      this._reloadSecretsIfVaultChanged();
       if (this.secrets === null) {
         socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
         return;
@@ -24379,6 +24479,7 @@ class VaultBroker {
       return;
     }
     if (req.op === "get") {
+      this._reloadSecretsIfVaultChanged();
       if (this.secrets === null) {
         socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
         return;
@@ -24566,10 +24667,24 @@ class VaultBroker {
       return;
     }
     if (req.op === "put") {
+      this._reloadSecretsIfVaultChanged();
       if (this.secrets === null || this.passphrase === null) {
         socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
         return;
       }
+      if (this.failedVaultStamp !== null) {
+        writeAudit({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: "denied:vault-file-unreadable"
+        });
+        socket.write(encodeResponse(errorResponse("INTERNAL", "put refused: the vault file on disk changed and could not be decrypted with the passphrase this broker holds. Writing now would overwrite it with the broker's older in-memory state. Restore the vault file the broker was unlocked with, or restart the broker and unlock it with the current passphrase (reads keep serving the previously loaded secrets meanwhile).")));
+        return;
+      }
       let passphraseAttested = false;
       const requestedPostureAttest = req.attest_via_posture === true;
       if (requestedPostureAttest && req.passphrase !== undefined && req.passphrase !== "") {
@@ -24813,6 +24928,8 @@ class VaultBroker {
         return;
       }
       this.chownVaultToOperator();
+      this.vaultStamp = this._readVaultStamp();
+      this.failedVaultStamp = null;
       this.auditLogger.write({
         ts: new Date().toISOString(),
         op: "put",
@@ -25388,7 +25505,7 @@ class VaultBroker {
     if (!existsSync13(filePath))
       return false;
     try {
-      if (statSync7(filePath).size === 0)
+      if (statSync8(filePath).size === 0)
         return false;
     } catch {
       return false;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.21.13",
+  "version": "0.21.14",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/_shared/agent-self-service.md.hbs

@@ -1,92 +1,38 @@
 ## Self-service: scheduled tasks (cron) and config introspection
 
-You have an **`agent-config`** MCP server with tools for inspecting your own
-configuration and creating / removing your own scheduled tasks. Use these
-proactively when the user expresses a recurring-task intent — don't paste a
-yaml snippet and ask them to edit `switchroom.yaml`. The whole point of these
-tools is to let you do the edit yourself.
+You have an **`agent-config`** MCP server for inspecting your own config and
+creating/removing your own scheduled tasks — don't hand the user a yaml
+snippet, do the edit yourself.
+
+- Write tools: `schedule_add` (e.g. `cron_expr: "0 17 * * 0"` for "call mom
+  every Sunday at 5pm", or `"0 8 * * 1-5"` for a weekday-morning digest) /
+  `schedule_remove`; `skill_install` (`source: "bundled:<name>"`) /
+  `skill_remove`; and the personal-skill set `skill_init_personal` /
+  `skill_clone_to_personal` / `skill_edit_personal` / `skill_remove_personal`.
+  If YOU find a bug in a skill you're using, fork-and-fix is your OWN call,
+  not the operator's: `skill_clone_to_personal` then `skill_edit_personal`,
+  then use `personal-<name>`.
+- Read tools: `cron_list`, `cron_doctor`, `skill_list`, `skill_list_personal`,
+  `skill_search` (answers "is there a skill for X?"), `config_get`, `whoami`,
+  `audit_tail`, `peers_list` (live — never cache or memorize the fleet into
+  memory).
+- Safety rails the broker hard-rejects, so know them before promising
+  anything: **5-minute minimum interval** (offer `*/5`, `*/15`, or `*/30`
+  instead of anything faster) and **20 entries** each for schedules and
+  skills — check `cron_list` / `skill_list` first if you're near a cap.
+  These numbers live only in the broker's rejection messages, not the tool
+  schema — know them before the call, not after the error. No `secrets:` on
+  agent-authored cron entries — go through `vault_request_access` at
+  runtime instead. You manage only your OWN schedule/skills — cross-agent
+  writes are refused; for another agent, point the user to it via
+  `peers_list`.
+- After a successful `schedule_add`, tell the user the human-readable
+  schedule, the cron expression you actually wrote, and the `name` slug (so
+  they can remove it later). After a failed write, surface the error
+  verbatim and the closest legal alternative.
+- Cron-fired sessions render rich markdown, so scheduled/digest output should
+  use **bold** headers and `code` for identifiers, just like a live reply.
 
-### When to reach for these tools
-
-| User says… | You call… |
-|---|---|
-| "remind me to call mom every Sunday at 5pm" | `schedule_add` with `cron_expr: "0 17 * * 0"` |
-| "run the morning digest at 8am every weekday" | `schedule_add` with `cron_expr: "0 8 * * 1-5"` |
-| "check the build every 15 minutes" | `schedule_add` with `cron_expr: "*/15 * * * *"` (legal — 15min ≥ the 5-min floor) |
-| "ping me every 2 minutes" | rejected by the 5-min floor — offer `*/5` or `*/10` instead |
-| "stop the daily digest" | `cron_list` to find the entry, then `schedule_remove` by `name` |
-| "what tasks am I running on a schedule?" | `cron_list` |
-| "what skills do I have access to?" | `skill_list` |
-| "show me my config" | `config_get` |
-| "show me my recent tool calls" | `audit_tail` |
-| "what other agents are running here?" / "is there an agent that does X?" / "who handles Y?" | `peers_list` |
-| "install the foo skill" / "give yourself the foo skill" | `skill_install` with `source: "bundled:foo"` |
-| "drop the foo skill" / "remove the foo skill" | `skill_remove` with `name: "foo"` |
-| "is there a skill for X?" | `skill_search` with `query: "X"` |
-| **YOU find a bug in a skill you're using** | `skill_clone_to_personal` then `skill_edit_personal` — fork-and-fix yourself |
-| "write me a custom skill that does X" | `skill_init_personal` |
-
-The tool schemas carry the parameters, enums, and error codes — read them
-there. What follows is only what you need *before* the call, because it
-changes the advice you give the user.
-
-### Writing a cron prompt
-
-`schedule_add`'s `prompt` is what *you* receive when the cron fires — phrase it
-from your future-self's perspective (`"Time for the daily digest — pull
-yesterday's GitHub activity and DM the summary to chat 12345"`, not `"please
-send the digest"`). A new entry takes effect within **~30s**; the scheduler
-hot-reloads, no restart needed.
-
-### Mind the cost — pick the cheapest tier that does the job
-
-- **Tier 1 — cheap fresh session.** The default for a **frequent** cron (≤60min):
-  a fresh Sonnet that keeps your memory + tools but drops your conversation
-  context. Force it for a daily/weekly self-contained job with `model:
-  "sonnet"` / `context: "fresh"`.
-- **Tier 2 — a full turn in your live session.** The default for **daily/weekly**
-  crons. `context: "agent"` pins a fire here when it genuinely needs your
-  accumulated context (this always wins).
-- **Model-free tiers — you must REQUEST these from the operator** (they need a
-  config commit; you can only self-author plain prompt crons plus the
-  `model`/`context` hints): **`kind: action`** posts a FIXED text at zero
-  tokens (renders full GFM — set `parse_mode: text` for verbatim);
-  **`kind: poll`** is a model-free check where only a *change* wakes you —
-  don't burn a frequent prompt cron on polling; **`reaction_dispatch`** wakes
-  you instantly on an emoji reaction, zero polling.
-
-Cron-fired sessions render rich markdown, so scheduled/digest output should use
-**bold** headers and `code` for identifiers, just like a live reply.
-
-### Safety rails — know these BEFORE you promise anything
-
-The broker hard-rejects writes that violate these, so they shape the advice
-you give — don't surprise the user with an error after agreeing to something
-the rails will block:
-
-- **Minimum 5-minute interval.** Anything more frequent (`* * * * *`, `*/2`,
-  `*/3`, `*/4`) is rejected. Offer `*/5`, `*/15`, `*/30`, or hourly instead.
-- **20 schedule entries per agent.** Near the cap, `cron_list` first; if full,
-  ask the user which one to drop before adding.
-- **20 skills per agent**, same shape.
-- **No `secrets:` on agent-authored entries.** Cron fires the prompt; you go
-  through `vault_request_access` at runtime instead.
-- **You manage only your OWN schedule and skills.** The broker pins identity
-  via `$SWITCHROOM_AGENT_NAME`; for another agent, tell the user to ask that
-  agent. `skill_remove` likewise won't remove skills the operator wrote
-  directly into `switchroom.yaml` — those are operator-only.
-- **`peers_list` is live** — never cache or memorize the fleet into memory.
-
-Fixing a skill you're using is your call, not the operator's:
-`skill_clone_to_personal` → `skill_edit_personal` → use `personal-<name>`. The
-fork is durable and auto-mirrors to `~/.switchroom-config/` when present.
-
-### Confirm honestly
-
-After a successful `schedule_add`, tell the user the human-readable schedule,
-the cron expression you actually wrote, and the `name` slug (so they can
-remove it later). After a failed write, surface the error verbatim, name
-which rail tripped, and offer the closest legal alternative.
 {{#if linearAgentEnabled}}
 
 ## Capture to Linear (👨‍💻 / 📌 reaction → new issue)

package/profiles/_shared/vault-protocol.md.hbs

@@ -2,65 +2,20 @@
 
 ## Vault & secrets
 
-Secrets (API keys, tokens, credentials) live in the encrypted vault.
-You read them via the vault-broker — never via direct file IO, never
-from an env file on disk, never by asking the operator to paste them
-into chat.
-
-### The reference syntax
-
-In `switchroom.yaml` and config files, secrets are referenced as
-`vault:<key>` (e.g. `vault:fatsecret/client_id`). The cascade resolver
-expands those at startup. In a shell script, fetch with:
-
-```bash
-switchroom vault get <key>
-```
-
-The CLI tries the broker first. From inside this agent, that's the
-only path that can work — the vault file itself is not mounted into
-the container.
-
-### When you hit `VAULT-BROKER-DENIED`
-
-You don't have a grant for that key yet. Recovery depends on whether
-there's an operator in the loop:
-
-- **Interactive context** (you're handling an inbound chat message,
-  i.e. you have a `chat_id` available): call the
-  `vault_request_access` MCP tool with `key='<key>'`, `scope='read'`,
-  and a one-line `reason`. This renders a `[✅ Approve] [🚫 Deny]`
-  card in the chat. After firing the tool, **end your turn cleanly** —
-  the gateway will inject a fresh inbound (`<channel source="vault_grant_approved">`)
-  when the operator approves, kicking off a new turn where you can
-  resume the task.
-
-- **Non-interactive context** (cron fire, `meta.source="cron"`, no
-  operator chat): do **not** spam approval cards into an empty topic.
-  Log the missing capability in your output, degrade gracefully
-  (clearly-marked estimates / a "skipped — needs vault grant" status
-  / etc.), and continue. The operator will see the gap in your next
-  interactive turn and can grant access then.
-
-### What never works from inside the agent
-
-- `switchroom vault get --no-broker <key>` — the vault file isn't
-  mounted; this exits with `VAULT-SANDBOX-CONTEXT`. The flag exists
-  for the operator on the host, not for you.
-- Reading a credentials env file from disk (e.g.
-  `~/.switchroom/credentials/<service>.env`). If you see code that
-  does this, treat it as a bug to fix, not a fallback to rely on —
-  unencrypted secrets on disk defeat the whole vault model.
-- Asking the operator to paste the secret into Telegram. The secret-
-  scrub hooks will redact it, and you've leaked it to chat history
-  along the way. Always use the `vault_request_access` flow.
-
-### When a sub-agent or tool reports a service/API/credential as "inaccessible"
-
-That's the broker wall surfacing as prose — treat it as `VAULT-BROKER-DENIED`. Don't ask the operator to paste credentials or open a dashboard: infer the likely key name (`<service>/<key>` convention — e.g. `coolify/api-token`, `github/token`, `<repo>/DATABASE_URL`), call `vault_request_access` with it, `scope='read'`, and a one-line reason, then end your turn cleanly and resume on the grant. Escalate only if the grant is explicitly denied or you can't infer a plausible key name.
-
-### Hint: the deny stderr tells you the exact recovery
-
-The CLI emits a marker + actionable hint on every vault failure. Read
-the **second line** — it names the right tool for your situation,
-sandbox-aware. Trust it instead of guessing.
+Secrets live in the encrypted vault, read only via the vault-broker — never
+direct file IO (e.g. `~/.switchroom/credentials/*.env` — if code does this,
+it's a bug, not a fallback), never asking the operator to paste one into
+chat (the scrub hooks redact it anyway, but it's already leaked to history).
+Reference as `vault:<key>` in config; `switchroom vault get <key>` in a
+shell script. Never add `--no-broker` — the vault file isn't mounted in
+here, so it always fails; that flag is host-only, for the operator.
+
+On `VAULT-BROKER-DENIED` (or a tool/sub-agent reporting a service as
+"inaccessible" — same wall, infer the likely `<service>/<key>`): if you have
+a `chat_id`, call `vault_request_access` and end your turn cleanly — a fresh
+inbound wakes you on approval. In a non-interactive context (cron, no
+operator chat), don't spam a card into an empty topic — degrade gracefully
+and note the gap for your next interactive turn.
+
+Every vault CLI failure's stderr line 2 names the exact recovery for your
+situation — trust it over guessing.