switchroom 0.21.6 → 0.21.8

package/bin/autoaccept.exp

@@ -86,8 +86,28 @@ expect {
         send "\r"
         exp_continue
     }
+    -re {Continue with Fable} {
+        # Fable-5 usage-credits consent modal:
+        #     Fable 5 runs on usage credits, purchased separately from your plan.
+        #       1. Continue with Fable 5
+        #     ❯ 2. Switch to Sonnet 5 and continue
+        #     Enter to confirm · Esc to cancel
+        # MUST precede the generic "Enter to confirm" branch below: that
+        # footer matches this modal too, and the CLI focuses option 2 by
+        # default (`defaultFocusValue:"switch"`), so a bare Return silently
+        # declines Fable and downgrades the agent to Sonnet. Select option 1
+        # by digit instead. Kept in sync with the `fable-usage-credits-consent`
+        # rule in src/agents/autoaccept.ts.
+        sleep 0.5
+        send "1\r"
+        exp_continue
+    }
     -re {Enter.{1,30}confirm} {
-        # Generic "Enter to confirm" prompt (dev channels, trust dialog)
+        # Generic "Enter to confirm" prompt (dev channels, trust dialog).
+        # NOTE: the TS poller additionally guards this catch-all against
+        # numbered selectors (NUMBERED_CHOICE_SIGNATURE). expect matches a
+        # STREAM in branch order, so here the equivalent protection is
+        # ordering: every option-selecting branch must sit above this one.
         sleep 0.8
         send "\r"
         exp_continue

package/bin/tmp-reaper.sh

@@ -0,0 +1,234 @@
+#!/usr/bin/env bash
+# switchroom-tmp-reaper — bounded janitor for the agent container's /tmp tmpfs.
+#
+# WHY THIS EXISTS
+# ---------------
+# An agent container mounts /tmp as a RAM-backed tmpfs, sized by
+# `resources.tmp_size` (src/agents/compose.ts, DEFAULT_TMP_SIZE = 2g), with
+# Docker's default tmpfs flags — `rw,nosuid,nodev,noexec`. Two consequences:
+#
+#   1. It is a hard ceiling. Nothing ages out of a tmpfs; a long-running
+#      container accumulates every scratch dir any tool ever forgot to
+#      remove until writes start failing ENOSPC. Observed on a live agent:
+#      4,462 top-level entries, 490 MiB used, of which 204 MiB was two
+#      orphaned `bun build --compile` artifacts from a single test run
+#      (fixed at source in tests/install/static-binary.test.ts, but that
+#      only fixes the leak we already found).
+#   2. The failure is NOT localised. Once /tmp is full, everything that
+#      stages through it fails — `npm ci`, git, the claude CLI's own
+#      scratch — with errors that name the victim, never the cause.
+#
+# The size is deliberately NOT the lever. Raising the tmpfs converts a fast,
+# loud failure into a slow leak that eats host RAM instead. This reaper
+# bounds the accumulation itself.
+#
+# SAFETY CONTRACT (each clause is pinned by tests/tmp-reaper.test.ts)
+# -------------------------------------------------------------------
+#   * Scope. Only direct children of the root are considered, the root
+#     itself is never removed, and every traversal is `-xdev` with no
+#     symlink dereference — so a symlink under /tmp pointing at, say,
+#     /state/agent can have the LINK reaped but never its target.
+#   * Age. An entry is a candidate only when NOTHING anywhere in its
+#     subtree has been modified or accessed within the age threshold
+#     (default 24h). A directory's own mtime does not change when a
+#     grandchild is written, so checking the entry alone would reap a
+#     live tree — the whole subtree is checked.
+#   * Open files. An entry is skipped when it, or anything beneath it, is
+#     open by any process in the container: /proc/*/fd, /proc/*/cwd,
+#     /proc/*/exe and mmapped regions from /proc/*/maps are all consulted.
+#   * Logging. Every reaped entry is logged with its size and age, and every
+#     pass emits a one-line summary — including passes that reap nothing.
+#
+# TUNING (all validated; garbage falls back to the default)
+#   SWITCHROOM_TMP_REAPER=0                     disable entirely
+#   SWITCHROOM_TMP_REAPER_MIN_AGE_SEC=86400     age threshold (min 3600)
+#   SWITCHROOM_TMP_REAPER_INTERVAL_SEC=3600     seconds between passes
+#   SWITCHROOM_TMP_REAPER_ROOT=/tmp             root (test harness only)
+#
+# Run standalone for a one-shot pass:  tmp-reaper.sh --once
+set -uo pipefail
+
+REAPER_NAME="switchroom-tmp-reaper"
+
+TMP_REAPER_ROOT="${SWITCHROOM_TMP_REAPER_ROOT:-/tmp}"
+
+# Age below which an entry is NEVER touched. One hour is the hard floor even
+# if an operator sets something smaller: this reaper cannot distinguish "a
+# build wrote this five minutes ago and will read it back in ten" from
+# garbage, and the age bound is the only thing standing between it and a
+# live workload.
+MIN_AGE_SEC="${SWITCHROOM_TMP_REAPER_MIN_AGE_SEC:-86400}"
+case "$MIN_AGE_SEC" in ''|*[!0-9]*) MIN_AGE_SEC=86400;; esac
+[ "$MIN_AGE_SEC" -lt 3600 ] && MIN_AGE_SEC=3600
+
+INTERVAL_SEC="${SWITCHROOM_TMP_REAPER_INTERVAL_SEC:-3600}"
+case "$INTERVAL_SEC" in ''|0|*[!0-9]*) INTERVAL_SEC=3600;; esac
+[ "$INTERVAL_SEC" -lt 60 ] && INTERVAL_SEC=60
+
+# Never-reap names. These are conventional tmpfs fixtures whose mtime can sit
+# still for weeks while they are very much in use, and whose removal breaks
+# things in ways that are hard to trace back here.
+TMP_REAPER_KEEP_DEFAULT=".X11-unix .ICE-unix .font-unix .Test-unix .XIM-unix"
+TMP_REAPER_KEEP="${SWITCHROOM_TMP_REAPER_KEEP:-$TMP_REAPER_KEEP_DEFAULT}"
+
+_log() { printf '[%s] %s %s\n' "$REAPER_NAME" "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$*"; }
+
+# Refuse to operate on a root that is not a plain, existing directory, or that
+# is the filesystem root. The default is /tmp and the override exists for the
+# test harness; this guard is what keeps a mis-set override from being
+# catastrophic rather than merely wrong.
+_root_ok() {
+  local r="$1"
+  [ -n "$r" ] || { _log "refusing: empty root"; return 1; }
+  [ "$r" != "/" ] || { _log "refusing: root is /"; return 1; }
+  case "$r" in
+    /*) ;;
+    *) _log "refusing: root '$r' is not absolute"; return 1;;
+  esac
+  case "$r" in
+    *..*) _log "refusing: root '$r' contains '..'"; return 1;;
+  esac
+  [ -d "$r" ] || { _log "refusing: root '$r' is not a directory"; return 1; }
+  [ ! -L "$r" ] || { _log "refusing: root '$r' is a symlink"; return 1; }
+  return 0
+}
+
+# Emit every path under $1 that some process in this container currently has
+# open — as an fd, as its cwd, as its executable, or as an mmapped region.
+# Unreadable /proc entries (a process owned by another uid, or one that exited
+# mid-scan) are skipped: they can only cause us to reap LESS, never more.
+#
+# Cost matters here: a busy container has hundreds of processes and thousands
+# of fds, so this uses ONE `find` (with -printf '%l' to read the link targets
+# in-process) and ONE `grep`+`awk` pipeline over the maps files, rather than a
+# readlink fork per fd. A per-fd fork loop measured multiple seconds per pass.
+#
+# CRITICAL: neither traversal may ABORT on an unreadable input. `find` reports
+# a vanished/denied start point and keeps going, which is what we need. `awk`
+# does NOT: the image ships mawk 1.3.4, which stops at the FIRST file it cannot
+# open and never reads the rest of its argument list. Handing mawk the raw
+# /proc/[0-9]*/maps glob therefore meant that one PID exiting between bash's
+# glob expansion and mawk's serial open (ESRCH), or one EPERM, silently
+# discarded every LATER process's mappings — a fail-OPEN in a safety guard,
+# after which the reaper would delete a tree a live process still had mapped.
+# So `grep` (GNU grep continues past unreadable files, exit 2) does the
+# multi-file read and `awk` only ever sees a single stdin stream.
+#
+# `awk substr` rather than `grep -o`: a maps line is
+# "addr perms offset dev inode <pathname>", so the path runs to end-of-line and
+# MAY CONTAIN SPACES. `grep -oE "$root/[^ ]*"` would truncate
+# "/tmp/my dir/lib.so" to "/tmp/my", which no longer prefix-matches the entry
+# in the caller below — fail-open again, for any /tmp entry with a space.
+_open_paths() {
+  local root="$1"
+  find /proc/[0-9]*/fd /proc/[0-9]*/cwd /proc/[0-9]*/exe \
+       -maxdepth 1 -type l -printf '%l\n' 2>/dev/null \
+    | grep -F -- "$root/" 2>/dev/null
+  # mmapped files (a running binary, a memory-mapped DB) do not appear as an
+  # fd once mapped and the fd is closed, but are absolutely still in use.
+  grep -haF -- "$root/" /proc/[0-9]*/maps 2>/dev/null \
+    | awk -v r="$root/" '{ p=index($0, r); if (p) print substr($0, p) }'
+}
+
+_human() {
+  local b="${1:-0}"
+  if   [ "$b" -ge 1073741824 ] 2>/dev/null; then echo "$((b / 1073741824))G"
+  elif [ "$b" -ge 1048576 ]    2>/dev/null; then echo "$((b / 1048576))M"
+  elif [ "$b" -ge 1024 ]       2>/dev/null; then echo "$((b / 1024))K"
+  else echo "${b}B"; fi
+}
+
+# One pass. Returns 0 always; a failure to remove one entry must not abort
+# the pass (the next entry may be the one actually holding the space).
+tmp_reaper_pass() {
+  local root="$TMP_REAPER_ROOT"
+  _root_ok "$root" || return 1
+  # Canonicalise. /proc/*/fd link targets are already fully resolved, so an
+  # un-canonicalised root with a symlinked ancestor would never prefix-match
+  # them and the open-file check would silently pass everything through —
+  # the guard would look present and do nothing.
+  root=$(readlink -f -- "$root" 2>/dev/null) || root="$TMP_REAPER_ROOT"
+  [ -n "$root" ] || root="$TMP_REAPER_ROOT"
+  _root_ok "$root" || return 1
+
+  local now cutoff
+  now=$(date +%s)
+  cutoff=$((now - MIN_AGE_SEC))
+
+  local open_list
+  open_list=$(_open_paths "$root")
+
+  local reaped=0 freed=0 kept_open=0 kept_young=0 kept_pinned=0 failed=0
+  local entry base
+
+  while IFS= read -r -d '' entry; do
+    base="${entry##*/}"
+
+    # 1. Never-reap list.
+    local pinned=0 k
+    for k in $TMP_REAPER_KEEP; do
+      [ "$base" = "$k" ] && { pinned=1; break; }
+    done
+    if [ "$pinned" -eq 1 ]; then kept_pinned=$((kept_pinned + 1)); continue; fi
+
+    # 2. Age — nothing ANYWHERE in the subtree may be newer than the cutoff,
+    #    by mtime or atime. `-print -quit` stops at the first offender.
+    local young
+    young=$(find "$entry" -xdev \( -newermt "@$cutoff" -o -newerat "@$cutoff" \) \
+              -print -quit 2>/dev/null)
+    if [ -n "$young" ]; then kept_young=$((kept_young + 1)); continue; fi
+
+    # 3. Open by a live process (the entry itself, or anything under it).
+    local is_open=0 p
+    while IFS= read -r p; do
+      [ -n "$p" ] || continue
+      if [ "$p" = "$entry" ] || [ "${p#"$entry"/}" != "$p" ]; then
+        is_open=1; break
+      fi
+    done <<< "$open_list"
+    if [ "$is_open" -eq 1 ]; then kept_open=$((kept_open + 1)); continue; fi
+
+    # Size and age for the log line, computed BEFORE removal.
+    local bytes mtime age_h
+    bytes=$(du -sxb -- "$entry" 2>/dev/null | cut -f1)
+    case "$bytes" in ''|*[!0-9]*) bytes=0;; esac
+    mtime=$(stat -c %Y -- "$entry" 2>/dev/null || echo "$now")
+    age_h=$(( (now - mtime) / 3600 ))
+
+    if rm -rf --one-file-system --preserve-root -- "$entry" 2>/dev/null; then
+      reaped=$((reaped + 1))
+      freed=$((freed + bytes))
+      _log "reaped $entry ($(_human "$bytes"), idle ${age_h}h)"
+    else
+      failed=$((failed + 1))
+      _log "could NOT remove $entry ($(_human "$bytes"), idle ${age_h}h)"
+    fi
+  done < <(find "$root" -xdev -mindepth 1 -maxdepth 1 -print0 2>/dev/null)
+
+  _log "pass complete on $root: reaped=$reaped freed=$(_human "$freed")" \
+       "kept_young=$kept_young kept_open=$kept_open kept_pinned=$kept_pinned" \
+       "failed=$failed min_age=${MIN_AGE_SEC}s"
+  return 0
+}
+
+tmp_reaper_main() {
+  if [ "${SWITCHROOM_TMP_REAPER:-1}" = "0" ]; then
+    _log "disabled via SWITCHROOM_TMP_REAPER=0 — not starting"
+    return 0
+  fi
+  if [ "${1:-}" = "--once" ]; then
+    tmp_reaper_pass
+    return $?
+  fi
+  _log "starting: root=$TMP_REAPER_ROOT min_age=${MIN_AGE_SEC}s interval=${INTERVAL_SEC}s"
+  while true; do
+    tmp_reaper_pass
+    sleep "$INTERVAL_SEC"
+  done
+}
+
+# Only auto-run when EXECUTED. Sourcing (the test harness, and any future
+# caller that wants a single pass inline) gets the functions and nothing else.
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+  tmp_reaper_main "$@"
+fi

package/dist/agent-scheduler/index.js

@@ -11738,7 +11738,7 @@ var AgentSchema = exports_external.object({
   repos: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9-]*$/, "Repo slug must be kebab-case ASCII: start with a lowercase letter or digit, contain only lowercase letters, digits, and hyphens"), exports_external.object({
     url: exports_external.string().min(1).describe("Git remote URL for the repo (e.g. 'git@github.com:org/repo.git' or " + "'https://github.com/org/repo.git'). Used verbatim for git clone."),
     branch_default: exports_external.string().optional().describe("Default branch to track (defaults to the remote's HEAD, typically 'main'). " + "The per-agent branch 'agent/<agentName>/main' fast-forwards to this branch " + "when the worktree is clean on session start.")
-  })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated worktree for each " + "repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main, backed by a " + "shared bare clone at ~/.switchroom/repos/<slug>.git. The worktree path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
+  })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated standing tree for " + "each repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main — an " + "independent clone (own refs/stash, hardlinked objects) seeded from a shared bare " + "clone at ~/.switchroom/repos/<slug>.git. The tree's path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
   experimental: exports_external.object({
     legacy_pty: exports_external.boolean().optional().describe("Opt out of the default tmux supervisor (#725) and run the agent " + "under the legacy PTY supervisor instead. Default: false."),
     legacy_autoaccept_expect: exports_external.boolean().optional().describe("Opt the autoaccept gateway back into the legacy expect-script " + "behaviour instead of the tmux send-keys path. Default: false.")

package/dist/auth-broker/index.js

@@ -11763,7 +11763,7 @@ var init_schema = __esm(() => {
     repos: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9-]*$/, "Repo slug must be kebab-case ASCII: start with a lowercase letter or digit, contain only lowercase letters, digits, and hyphens"), exports_external.object({
       url: exports_external.string().min(1).describe("Git remote URL for the repo (e.g. 'git@github.com:org/repo.git' or " + "'https://github.com/org/repo.git'). Used verbatim for git clone."),
       branch_default: exports_external.string().optional().describe("Default branch to track (defaults to the remote's HEAD, typically 'main'). " + "The per-agent branch 'agent/<agentName>/main' fast-forwards to this branch " + "when the worktree is clean on session start.")
-    })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated worktree for each " + "repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main, backed by a " + "shared bare clone at ~/.switchroom/repos/<slug>.git. The worktree path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
+    })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated standing tree for " + "each repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main — an " + "independent clone (own refs/stash, hardlinked objects) seeded from a shared bare " + "clone at ~/.switchroom/repos/<slug>.git. The tree's path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
     experimental: exports_external.object({
       legacy_pty: exports_external.boolean().optional().describe("Opt out of the default tmux supervisor (#725) and run the agent " + "under the legacy PTY supervisor instead. Default: false."),
       legacy_autoaccept_expect: exports_external.boolean().optional().describe("Opt the autoaccept gateway back into the legacy expect-script " + "behaviour instead of the tmux send-keys path. Default: false.")
@@ -19111,7 +19111,7 @@ import_handlebars.default.registerHelper("isNumber", (value) => {
   return typeof value === "number" && Number.isFinite(value);
 });
 var SHARED_FRAGMENTS_DIR = resolve5(PROFILES_ROOT, "_shared");
-var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
+var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol", "local-time"];
 for (const name of SHARED_FRAGMENTS) {
   const fragPath = join2(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
   if (existsSync5(fragPath)) {

package/dist/cli/autoaccept-poll.js

@@ -20,6 +20,29 @@ import { execFileSync as execFileSync3 } from "child_process";
 
 // src/agents/autoaccept.ts
 import { execFileSync } from "node:child_process";
+var NUMBERED_CHOICE_SIGNATURE = /(?=[\s\S]*^[^\S\n]*(?:\u276f[^\S\n]*)?1\.[^\S\n]+\S)(?=[\s\S]*^[^\S\n]*(?:\u276f[^\S\n]*)?2\.[^\S\n]+\S)/m;
+var FABLE_CONSENT_SIGNATURE = /(?=[\s\S]*Continue with Fable)(?=[\s\S]*usage credits)/i;
+function fableConsentNav(text) {
+  for (const line of text.split(`
+`)) {
+    const m = line.match(/^\s*(\u276f)?\s*(\d+)\.\s+(.*\S)\s*$/);
+    if (!m)
+      continue;
+    if (/Continue with Fable/i.test(m[3]))
+      return [m[2], "Enter"];
+  }
+  return null;
+}
+function ruleMatches(rule, text) {
+  if (!rule.match.test(text))
+    return false;
+  if (rule.notMatch && rule.notMatch.test(text))
+    return false;
+  return true;
+}
+function resolveRuleKeys(rule, text) {
+  return rule.keysFor?.(text) ?? rule.keys;
+}
 var PROMPTS = [
   {
     name: "dev-channels-loading",
@@ -57,9 +80,16 @@ var PROMPTS = [
     keys: ["Escape"],
     maxFires: 5
   },
+  {
+    name: "fable-usage-credits-consent",
+    match: FABLE_CONSENT_SIGNATURE,
+    keysFor: fableConsentNav,
+    keys: ["1", "Enter"]
+  },
   {
     name: "enter-to-confirm",
     match: /Enter.{1,30}confirm/,
+    notMatch: NUMBERED_CHOICE_SIGNATURE,
     keys: ["Enter"]
   }
 ];
@@ -117,12 +147,13 @@ async function runAutoaccept(opts) {
       for (const entry of rules) {
         if (entry.fired >= entry.cap)
           continue;
-        if (entry.rule.match.test(text)) {
+        if (ruleMatches(entry.rule, text)) {
+          const keys = resolveRuleKeys(entry.rule, text);
           entry.fired++;
           matchedThisPoll = true;
           fired.push(entry.rule.name);
-          console.error(`[autoaccept] ${opts.agentName}: fired ${entry.rule.name} (${entry.rule.keys.join("+")})`);
-          sendKeys(opts.agentName, entry.rule.keys);
+          console.error(`[autoaccept] ${opts.agentName}: fired ${entry.rule.name} (${keys.join("+")})`);
+          sendKeys(opts.agentName, keys);
         }
       }
     }
@@ -141,6 +172,26 @@ async function runAutoaccept(opts) {
 
 // src/agents/autoaccept.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
+var NUMBERED_CHOICE_SIGNATURE2 = /(?=[\s\S]*^[^\S\n]*(?:\u276f[^\S\n]*)?1\.[^\S\n]+\S)(?=[\s\S]*^[^\S\n]*(?:\u276f[^\S\n]*)?2\.[^\S\n]+\S)/m;
+var FABLE_CONSENT_SIGNATURE2 = /(?=[\s\S]*Continue with Fable)(?=[\s\S]*usage credits)/i;
+function fableConsentNav2(text) {
+  for (const line of text.split(`
+`)) {
+    const m = line.match(/^\s*(\u276f)?\s*(\d+)\.\s+(.*\S)\s*$/);
+    if (!m)
+      continue;
+    if (/Continue with Fable/i.test(m[3]))
+      return [m[2], "Enter"];
+  }
+  return null;
+}
+function ruleMatches2(rule, text) {
+  if (!rule.match.test(text))
+    return false;
+  if (rule.notMatch && rule.notMatch.test(text))
+    return false;
+  return true;
+}
 var PROMPTS2 = [
   {
     name: "dev-channels-loading",
@@ -178,9 +229,16 @@ var PROMPTS2 = [
     keys: ["Escape"],
     maxFires: 5
   },
+  {
+    name: "fable-usage-credits-consent",
+    match: FABLE_CONSENT_SIGNATURE2,
+    keysFor: fableConsentNav2,
+    keys: ["1", "Enter"]
+  },
   {
     name: "enter-to-confirm",
     match: /Enter.{1,30}confirm/,
+    notMatch: NUMBERED_CHOICE_SIGNATURE2,
     keys: ["Enter"]
   }
 ];
@@ -613,6 +671,7 @@ var DEFAULT_STABILITY_THRESHOLD = 3;
 var DEFAULT_COOLDOWN_MS = 60000;
 var DEFAULT_CONFIRM_MODAL_POLLS = 3;
 var DEFAULT_MANIFEST_STALL_POLLS = 60;
+var DEFAULT_FABLE_CONSENT_POLLS = 3;
 var DEFAULT_PERMISSION_PROMPT_POLLS = 3;
 var DEFAULT_PERMISSION_CARDLESS_POLLS = 24;
 var DEFAULT_PERMISSION_FLOOD_MAX_POLLS = 120;
@@ -643,6 +702,8 @@ async function runWedgeWatchdog(opts) {
   const parseReset = opts.parseReset ?? parseWeeklyReset;
   const confirmModalSignature = opts.confirmModalSignature === null ? null : opts.confirmModalSignature ?? CONFIRM_MODAL_SIGNATURE;
   const confirmModalPolls = opts.confirmModalPolls ?? envInt("SWITCHROOM_WEDGE_CONFIRM_POLLS", DEFAULT_CONFIRM_MODAL_POLLS);
+  const fableConsentSignature = opts.fableConsentSignature === null ? null : opts.fableConsentSignature ?? FABLE_CONSENT_SIGNATURE2;
+  const fableConsentPolls = opts.fableConsentPolls ?? envInt("SWITCHROOM_WEDGE_FABLE_POLLS", DEFAULT_FABLE_CONSENT_POLLS);
   const permissionPromptSignature = opts.permissionPromptSignature === null ? null : opts.permissionPromptSignature ?? PERMISSION_PROMPT_SIGNATURE;
   const permissionPromptPolls = opts.permissionPromptPolls ?? envInt("SWITCHROOM_WEDGE_PERMISSION_POLLS", DEFAULT_PERMISSION_PROMPT_POLLS);
   const permissionCardlessPolls = Math.max(permissionPromptPolls, opts.permissionCardlessPolls ?? envInt("SWITCHROOM_WEDGE_PERMISSION_CARDLESS_POLLS", DEFAULT_PERMISSION_CARDLESS_POLLS));
@@ -664,6 +725,7 @@ async function runWedgeWatchdog(opts) {
   let rateLimitFires = 0;
   let overageCreditSelections = 0;
   let confirmModalFires = 0;
+  let fableConsentFires = 0;
   let permissionPromptFires = 0;
   let permissionPromptDeferrals = 0;
   let permissionPromptFloodHolds = 0;
@@ -671,10 +733,12 @@ async function runWedgeWatchdog(opts) {
   let restartEscalations = 0;
   let polls = 0;
   let confirmModalPresent = 0;
+  let fableConsentPresent = 0;
   let permissionPromptPresent = 0;
   let manifestStallPresent = 0;
   let lastManifestKey = null;
   let confirmCooldownUntil = 0;
+  let fableCooldownUntil = 0;
   let permissionCooldownUntil = 0;
   let lastPermissionHoldLogAt = Number.NEGATIVE_INFINITY;
   while (polls < maxPolls) {
@@ -687,9 +751,10 @@ async function runWedgeWatchdog(opts) {
       text = "";
     }
     const isRateLimitMenu = !!text && rateLimitSignature !== null && rateLimitSignature.test(text);
-    const isPermissionPrompt = !isRateLimitMenu && !!text && permissionPromptSignature !== null && permissionPromptSignature.test(text);
-    const isConfirmModal = !isRateLimitMenu && !isPermissionPrompt && !!text && confirmModalSignature !== null && confirmModalSignature.test(text);
-    const isBlockingModal = !isRateLimitMenu && !isPermissionPrompt && !isConfirmModal && !!text && signature.test(text) && !deferToPrompts.some((p) => p.match.test(text));
+    const isFableConsent = !isRateLimitMenu && !!text && fableConsentSignature !== null && fableConsentSignature.test(text);
+    const isPermissionPrompt = !isRateLimitMenu && !isFableConsent && !!text && permissionPromptSignature !== null && permissionPromptSignature.test(text);
+    const isConfirmModal = !isRateLimitMenu && !isFableConsent && !isPermissionPrompt && !!text && confirmModalSignature !== null && confirmModalSignature.test(text);
+    const isBlockingModal = !isRateLimitMenu && !isFableConsent && !isPermissionPrompt && !isConfirmModal && !!text && signature.test(text) && !deferToPrompts.some((p) => ruleMatches2(p, text));
     const manifestSignatureHit = !!text && manifestStallSignature !== null && manifestStallSignature.test(text);
     const manifestKey = manifestSignatureHit ? stabilityKey(text) : null;
     const stopHookPresent = !!text && STOP_HOOK_ERROR_SIGNATURE.test(text);
@@ -767,10 +832,30 @@ async function runWedgeWatchdog(opts) {
         stableCount = 0;
         lastKey = null;
       }
+    } else if (isFableConsent) {
+      fableConsentPresent++;
+      stableCount = 0;
+      lastKey = null;
+      permissionPromptPresent = 0;
+      confirmModalPresent = 0;
+      if (fableConsentPresent >= fableConsentPolls && now() >= fableCooldownUntil) {
+        const nav = fableConsentNav2(text) ?? ["1", "Enter"];
+        console.error(`[wedge-watchdog] ${opts.agentName}: Fable-5 usage-credits consent modal present ` + `${fableConsentPresent} polls ` + `(~${Math.round(fableConsentPresent * pollIntervalMs / 1000)}s) \u2014 ` + `selecting "Continue with Fable 5" (${nav.join(" ")}); the session is on fable ` + `because the operator configured it, and Enter/Esc here would silently decline it`);
+        try {
+          send(opts.agentName, nav);
+        } catch (err) {
+          console.error(`[wedge-watchdog] ${opts.agentName}: send threw: ${err.message}`);
+        }
+        fires++;
+        fableConsentFires++;
+        fableCooldownUntil = now() + cooldownMs;
+        fableConsentPresent = 0;
+      }
     } else if (isPermissionPrompt) {
       permissionPromptPresent++;
       stableCount = 0;
       lastKey = null;
+      fableConsentPresent = 0;
       if (permissionPromptPresent >= permissionPromptPolls && now() >= permissionCooldownUntil) {
         let status = null;
         if (queryPendingPermission2) {
@@ -824,6 +909,7 @@ async function runWedgeWatchdog(opts) {
       stableCount = 0;
       lastKey = null;
       permissionPromptPresent = 0;
+      fableConsentPresent = 0;
       if (confirmModalPresent >= confirmModalPolls && now() >= confirmCooldownUntil) {
         console.error(`[wedge-watchdog] ${opts.agentName}: dismissing stuck confirmation modal ` + `(Esc == "No, go back") after ${confirmModalPresent} polls present ` + `(~${Math.round(confirmModalPresent * pollIntervalMs / 1000)}s, flicker-immune) ` + `\u2014 no human to answer it`);
         try {
@@ -861,6 +947,7 @@ async function runWedgeWatchdog(opts) {
       lastKey = null;
       confirmModalPresent = 0;
       permissionPromptPresent = 0;
+      fableConsentPresent = 0;
     }
     await sleep(pollIntervalMs);
   }
@@ -869,6 +956,7 @@ async function runWedgeWatchdog(opts) {
     rateLimitFires,
     overageCreditSelections,
     confirmModalFires,
+    fableConsentFires,
     permissionPromptFires,
     permissionPromptDeferrals,
     permissionPromptFloodHolds,
@@ -5628,7 +5716,7 @@ async function main() {
       queryPendingPermission: permissionCardAware ? undefined : null,
       floodPressure: permissionFloodAware ? undefined : null
     });
-    console.error(`[autoaccept-poll] ${agentName}: wedge-watchdog returned reason=${res.reason} fires=${res.fires} rateLimitFires=${res.rateLimitFires} overageCreditSelections=${res.overageCreditSelections} confirmModalFires=${res.confirmModalFires} permissionPromptFires=${res.permissionPromptFires} permissionPromptDeferrals=${res.permissionPromptDeferrals} permissionPromptFloodHolds=${res.permissionPromptFloodHolds} permissionPromptCardlessHolds=${res.permissionPromptCardlessHolds} restartEscalations=${res.restartEscalations}`);
+    console.error(`[autoaccept-poll] ${agentName}: wedge-watchdog returned reason=${res.reason} fires=${res.fires} rateLimitFires=${res.rateLimitFires} overageCreditSelections=${res.overageCreditSelections} confirmModalFires=${res.confirmModalFires} fableConsentFires=${res.fableConsentFires} permissionPromptFires=${res.permissionPromptFires} permissionPromptDeferrals=${res.permissionPromptDeferrals} permissionPromptFloodHolds=${res.permissionPromptFloodHolds} permissionPromptCardlessHolds=${res.permissionPromptCardlessHolds} restartEscalations=${res.restartEscalations}`);
   } catch (err) {
     console.error(`[autoaccept-poll] ${agentName}: wedge-watchdog unexpected throw: ${err.message}`);
   }

package/dist/cli/notion-write-pretool.mjs

@@ -12499,7 +12499,7 @@ var AgentSchema = exports_external.object({
   repos: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9-]*$/, "Repo slug must be kebab-case ASCII: start with a lowercase letter or digit, contain only lowercase letters, digits, and hyphens"), exports_external.object({
     url: exports_external.string().min(1).describe("Git remote URL for the repo (e.g. 'git@github.com:org/repo.git' or " + "'https://github.com/org/repo.git'). Used verbatim for git clone."),
     branch_default: exports_external.string().optional().describe("Default branch to track (defaults to the remote's HEAD, typically 'main'). " + "The per-agent branch 'agent/<agentName>/main' fast-forwards to this branch " + "when the worktree is clean on session start.")
-  })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated worktree for each " + "repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main, backed by a " + "shared bare clone at ~/.switchroom/repos/<slug>.git. The worktree path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
+  })).optional().describe("Repos this agent operates on. Switchroom provisions a dedicated standing tree for " + "each repo at <agentDir>/work/<slug>/ on branch agent/<agentName>/main \u2014 an " + "independent clone (own refs/stash, hardlinked objects) seeded from a shared bare " + "clone at ~/.switchroom/repos/<slug>.git. The tree's path is injected " + "into the agent's environment as SWITCHROOM_REPO_<SLUG_UPPER>. " + "Agents without this field continue to work unchanged."),
   experimental: exports_external.object({
     legacy_pty: exports_external.boolean().optional().describe("Opt out of the default tmux supervisor (#725) and run the agent " + "under the legacy PTY supervisor instead. Default: false."),
     legacy_autoaccept_expect: exports_external.boolean().optional().describe("Opt the autoaccept gateway back into the legacy expect-script " + "behaviour instead of the tmux send-keys path. Default: false.")