switchroom 0.7.10 → 0.7.11

package/dist/cli/switchroom.js

@@ -24035,8 +24035,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.7.10";
-var COMMIT_SHA = "3e362edf";
+var VERSION = "0.7.11";
+var COMMIT_SHA = "69ee15a9";
 
 // src/cli/deprecated.ts
 init_source();
@@ -24330,6 +24330,16 @@ var GetRequestSchema = exports_external.object({
   filename: exports_external.string().optional(),
   token: exports_external.string().optional()
 });
+var PutRequestSchema = exports_external.object({
+  v: exports_external.literal(1),
+  op: exports_external.literal("put"),
+  key: exports_external.string().min(1),
+  entry: exports_external.union([
+    exports_external.object({ kind: exports_external.literal("string"), value: exports_external.string() }),
+    exports_external.object({ kind: exports_external.literal("binary"), value: exports_external.string() })
+  ]),
+  token: exports_external.string().optional()
+});
 var ListRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("list"),
@@ -24414,6 +24424,7 @@ var ApprovalRecordRequestSchema = exports_external.object({
 });
 var RequestSchema = exports_external.discriminatedUnion("op", [
   GetRequestSchema,
+  PutRequestSchema,
   ListRequestSchema,
   StatusRequestSchema,
   LockRequestSchema,
@@ -24466,6 +24477,11 @@ var OkLockResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
   locked: exports_external.literal(true)
 });
+var OkPutResponseSchema = exports_external.object({
+  ok: exports_external.literal(true),
+  put: exports_external.literal(true),
+  key: exports_external.string()
+});
 var OkMintGrantResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
   token: exports_external.string(),
@@ -24551,6 +24567,7 @@ var ResponseSchema = exports_external.union([
   OkKeysResponseSchema,
   OkStatusResponseSchema,
   OkLockResponseSchema,
+  OkPutResponseSchema,
   OkMintGrantResponseSchema,
   OkListGrantsResponseSchema,
   OkRevokeGrantResponseSchema,
@@ -24711,6 +24728,23 @@ async function getViaBrokerStructured(key, opts) {
   }
   return { kind: "unreachable", msg: "unexpected broker response shape" };
 }
+async function putViaBroker(key, entry, opts) {
+  const result = await rpc({ v: 1, op: "put", key, entry }, opts);
+  if (result.kind === "unreachable") {
+    return { kind: "unreachable", msg: result.msg };
+  }
+  const resp = result.resp;
+  if (resp.ok && "put" in resp) {
+    return { kind: "ok" };
+  }
+  if (!resp.ok) {
+    if (resp.code === "UNKNOWN_KEY") {
+      return { kind: "not_found", code: resp.code, msg: resp.msg };
+    }
+    return { kind: "denied", code: resp.code, msg: resp.msg };
+  }
+  return { kind: "unreachable", msg: "unexpected broker response shape" };
+}
 async function statusViaBroker(opts) {
   const result = await rpc({ v: 1, op: "status" }, opts);
   if (result.kind === "unreachable")
@@ -41373,6 +41407,7 @@ var PID_FILE_DEFAULT = "~/.switchroom/vault-broker.pid";
 class VaultBroker {
   testOpts;
   secrets = null;
+  passphrase = null;
   config = null;
   startedAt = Date.now();
   server = null;
@@ -41444,6 +41479,7 @@ class VaultBroker {
   unlockFromPassphrase(passphrase) {
     const secrets = openVault(passphrase, this.vaultPath);
     this.secrets = secrets;
+    this.passphrase = passphrase;
   }
   lock() {
     if (this.secrets !== null) {
@@ -41456,6 +41492,7 @@ class VaultBroker {
       }
       this.secrets = null;
     }
+    this.passphrase = null;
   }
   stop() {
     this.lock();
@@ -41869,6 +41906,90 @@ class VaultBroker {
       socket.write(encodeResponse(entryResponse(entry)));
       return;
     }
+    if (req.op === "put") {
+      if (this.secrets === null || this.passphrase === null) {
+        socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
+        return;
+      }
+      if (agentName === null) {
+        socket.write(encodeResponse(errorResponse("DENIED", "put requires path-as-identity (token-based grants are read-only)")));
+        return;
+      }
+      if (this.config === null) {
+        socket.write(encodeResponse(errorResponse("INTERNAL", "Broker config not loaded")));
+        return;
+      }
+      const aclResult = checkAclByAgent(this.config, agentName, req.key);
+      if (!aclResult.allow) {
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: `denied:${aclResult.reason}`
+        });
+        socket.write(encodeResponse(errorResponse("DENIED", aclResult.reason)));
+        return;
+      }
+      const existing = this.secrets[req.key];
+      if (existing === undefined) {
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: "denied:unknown_key"
+        });
+        socket.write(encodeResponse(errorResponse("UNKNOWN_KEY", `Key not found: ${req.key} (broker put cannot introduce new keys; ask operator to set it once via 'switchroom vault set' from the host)`)));
+        return;
+      }
+      if (existing.kind !== req.entry.kind) {
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: `denied:kind_mismatch ${existing.kind}\u2192${req.entry.kind}`
+        });
+        socket.write(encodeResponse(errorResponse("BAD_REQUEST", `kind mismatch: existing entry is '${existing.kind}', new entry is '${req.entry.kind}'`)));
+        return;
+      }
+      const previousEntry = existing;
+      this.secrets[req.key] = req.entry;
+      try {
+        saveVault(this.passphrase, this.vaultPath, this.secrets);
+      } catch (err) {
+        this.secrets[req.key] = previousEntry;
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: `error:${err?.message ?? "save failed"}`
+        });
+        socket.write(encodeResponse(errorResponse("INTERNAL", `Failed to persist: ${err?.message ?? "unknown"}`)));
+        return;
+      }
+      this.auditLogger.write({
+        ts: new Date().toISOString(),
+        op: "put",
+        key: req.key,
+        caller: auditCaller,
+        pid: auditPid,
+        cgroup: auditCgroup,
+        result: "allowed"
+      });
+      socket.write(encodeResponse({ ok: true, put: true, key: req.key }));
+      return;
+    }
     if (req.op === "approval_request" || req.op === "approval_lookup" || req.op === "approval_consume" || req.op === "approval_revoke" || req.op === "approval_list" || req.op === "approval_record") {
       await this._handleApprovalOp(socket, req);
       return;
@@ -43355,9 +43476,41 @@ function registerVaultCommand(program3) {
         }
         formatHint = opts.format;
       }
-      if (!process.stdin.isTTY && !process.env.SWITCHROOM_VAULT_PASSPHRASE && !opts.file) {
-        console.error(source_default.red("Error: piping a value to `vault set` requires SWITCHROOM_VAULT_PASSPHRASE to be set"));
-        process.exit(1);
+      if (!process.stdin.isTTY && !process.env.SWITCHROOM_VAULT_PASSPHRASE && !opts.file && opts.allow === undefined && opts.deny === undefined) {
+        const value2 = await readStdinToEnd();
+        if (!value2) {
+          console.error(source_default.red("Error: Value cannot be empty"));
+          process.exit(1);
+        }
+        if (formatHint) {
+          const validationError = validateFormatHint(value2, formatHint);
+          if (validationError) {
+            console.error(source_default.red(`Error: format validation failed for --format ${formatHint}: ${validationError}`));
+            process.exit(1);
+          }
+        }
+        let brokerSocket;
+        try {
+          const config = loadConfig(parentOpts.config);
+          brokerSocket = resolveBrokerSocketPath({
+            vaultBrokerSocket: config.vault?.broker?.socket ? resolvePath(config.vault.broker.socket) : undefined
+          });
+        } catch {
+          brokerSocket = resolveBrokerSocketPath();
+        }
+        const result = await putViaBroker(key, { kind: "string", value: value2 }, { socket: brokerSocket });
+        if (result.kind === "ok") {
+          return;
+        }
+        if (result.kind === "unreachable") {
+          console.error(source_default.red("Error: piping a value to `vault set` requires SWITCHROOM_VAULT_PASSPHRASE " + "to be set OR a reachable vault-broker (broker " + (result.msg ?? "unreachable") + ")"));
+          process.exit(1);
+        }
+        console.error(source_default.red(`VAULT-BROKER-DENIED [${result.code}]: ${result.msg}`));
+        if (result.kind === "not_found") {
+          console.error(source_default.yellow(`Hint: broker put cannot introduce new keys. Run ` + `'switchroom vault set ${key}' once from the host (with the ` + `vault passphrase) to create the entry; agents can rotate it ` + `from then on.`));
+        }
+        process.exit(2);
       }
       const passphrase = await getPassphrase();
       let value;

package/dist/vault/approvals/kernel-server.js

@@ -11399,6 +11399,16 @@ var GetRequestSchema = exports_external.object({
   filename: exports_external.string().optional(),
   token: exports_external.string().optional()
 });
+var PutRequestSchema = exports_external.object({
+  v: exports_external.literal(1),
+  op: exports_external.literal("put"),
+  key: exports_external.string().min(1),
+  entry: exports_external.union([
+    exports_external.object({ kind: exports_external.literal("string"), value: exports_external.string() }),
+    exports_external.object({ kind: exports_external.literal("binary"), value: exports_external.string() })
+  ]),
+  token: exports_external.string().optional()
+});
 var ListRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("list"),
@@ -11483,6 +11493,7 @@ var ApprovalRecordRequestSchema = exports_external.object({
 });
 var RequestSchema = exports_external.discriminatedUnion("op", [
   GetRequestSchema,
+  PutRequestSchema,
   ListRequestSchema,
   StatusRequestSchema,
   LockRequestSchema,
@@ -11535,6 +11546,11 @@ var OkLockResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
   locked: exports_external.literal(true)
 });
+var OkPutResponseSchema = exports_external.object({
+  ok: exports_external.literal(true),
+  put: exports_external.literal(true),
+  key: exports_external.string()
+});
 var OkMintGrantResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
   token: exports_external.string(),
@@ -11620,6 +11636,7 @@ var ResponseSchema = exports_external.union([
   OkKeysResponseSchema,
   OkStatusResponseSchema,
   OkLockResponseSchema,
+  OkPutResponseSchema,
   OkMintGrantResponseSchema,
   OkListGrantsResponseSchema,
   OkRevokeGrantResponseSchema,

package/dist/vault/broker/server.js

@@ -11258,7 +11258,7 @@ var init_schema = __esm(() => {
 
 // src/config/paths.ts
 import { existsSync as existsSync2 } from "node:fs";
-import { resolve } from "node:path";
+import { resolve as resolve2 } from "node:path";
 function home() {
   return process.env.HOME ?? "/root";
 }
@@ -11266,18 +11266,18 @@ function resolveDualPath(pathStr) {
   const h = home();
   if (pathStr.startsWith("~/")) {
     const rest = pathStr.slice(2);
-    const absolute = resolve(h, rest);
+    const absolute = resolve2(h, rest);
     if (rest.startsWith(`${DEFAULT_STATE_DIR}/`)) {
       const frag = rest.slice(DEFAULT_STATE_DIR.length + 1);
       if (!existsSync2(absolute)) {
-        const legacy = resolve(h, LEGACY_STATE_DIR, frag);
+        const legacy = resolve2(h, LEGACY_STATE_DIR, frag);
         if (existsSync2(legacy))
           return legacy;
       }
     }
     return absolute;
   }
-  return resolve(pathStr);
+  return resolve2(pathStr);
 }
 var DEFAULT_STATE_DIR = ".switchroom", LEGACY_STATE_DIR = ".clerk";
 var init_paths = () => {};
@@ -11293,7 +11293,7 @@ __export(exports_loader, {
 });
 import { readFileSync as readFileSync2, existsSync as existsSync3 } from "node:fs";
 import { homedir } from "node:os";
-import { resolve as resolve2 } from "node:path";
+import { resolve as resolve3 } from "node:path";
 function formatZodErrors(error) {
   return error.errors.map((e) => {
     const path = e.path.join(".");
@@ -11303,21 +11303,21 @@ function formatZodErrors(error) {
 function findConfigFile(startDir) {
   const envPath = process.env.SWITCHROOM_CONFIG;
   const home2 = homedir();
-  const userDir = resolve2(home2, ".switchroom");
+  const userDir = resolve3(home2, ".switchroom");
   const searchPaths = [
-    envPath ? resolve2(envPath) : null,
-    startDir ? resolve2(startDir, "switchroom.yaml") : null,
-    startDir ? resolve2(startDir, "switchroom.yml") : null,
-    startDir ? resolve2(startDir, "clerk.yaml") : null,
-    startDir ? resolve2(startDir, "clerk.yml") : null,
-    resolve2(process.cwd(), "switchroom.yaml"),
-    resolve2(process.cwd(), "switchroom.yml"),
-    resolve2(process.cwd(), "clerk.yaml"),
-    resolve2(process.cwd(), "clerk.yml"),
-    resolve2(userDir, "switchroom.yaml"),
-    resolve2(userDir, "switchroom.yml"),
-    resolve2(userDir, "clerk.yaml"),
-    resolve2(userDir, "clerk.yml")
+    envPath ? resolve3(envPath) : null,
+    startDir ? resolve3(startDir, "switchroom.yaml") : null,
+    startDir ? resolve3(startDir, "switchroom.yml") : null,
+    startDir ? resolve3(startDir, "clerk.yaml") : null,
+    startDir ? resolve3(startDir, "clerk.yml") : null,
+    resolve3(process.cwd(), "switchroom.yaml"),
+    resolve3(process.cwd(), "switchroom.yml"),
+    resolve3(process.cwd(), "clerk.yaml"),
+    resolve3(process.cwd(), "clerk.yml"),
+    resolve3(userDir, "switchroom.yaml"),
+    resolve3(userDir, "switchroom.yml"),
+    resolve3(userDir, "clerk.yaml"),
+    resolve3(userDir, "clerk.yml")
   ].filter(Boolean);
   for (const path of searchPaths) {
     if (existsSync3(path)) {
@@ -11676,7 +11676,7 @@ function allocateAgentUid(name) {
 }
 
 // src/vault/broker/server.ts
-import { dirname as dirname2, resolve as resolve3 } from "node:path";
+import { dirname as dirname3, resolve as resolve4 } from "node:path";
 import * as os3 from "node:os";
 import * as path3 from "node:path";
 
@@ -11690,10 +11690,26 @@ import {
   mkdirSync,
   unlinkSync
 } from "node:fs";
+import { dirname, basename, resolve } from "node:path";
 var SCRYPT_N = 32768;
 var SCRYPT_R = 8;
 var SCRYPT_P = 1;
 var SCRYPT_MAXMEM = 128 * 1024 * 1024;
+function atomicWriteFileSync(path, data, mode) {
+  const dir = dirname(resolve(path));
+  const tmp = resolve(dir, `.${basename(path)}.${process.pid}.${Date.now()}.tmp`);
+  try {
+    writeFileSync(tmp, data, { encoding: "utf8", mode });
+    renameSync(tmp, path);
+  } catch (err) {
+    try {
+      if (existsSync(tmp))
+        unlinkSync(tmp);
+    } catch {}
+    throw err;
+  }
+}
+
 class VaultError extends Error {
   constructor(message) {
     super(message);
@@ -11709,6 +11725,17 @@ function deriveKey(passphrase, salt, params = { N: SCRYPT_N, r: SCRYPT_R, p: SCR
     maxmem: SCRYPT_MAXMEM
   });
 }
+function encrypt(key, plaintext) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    iv: iv.toString("hex"),
+    data: encrypted.toString("hex"),
+    tag: tag.toString("hex")
+  };
+}
 function decrypt(key, iv, data, tag) {
   const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"));
   decipher.setAuthTag(Buffer.from(tag, "hex"));
@@ -11758,6 +11785,26 @@ function openVault(passphrase, vaultPath) {
   }
   return normalizeSecrets(vaultData.secrets ?? {});
 }
+function saveVault(passphrase, vaultPath, secrets) {
+  if (!existsSync(vaultPath)) {
+    throw new VaultError(`Vault file not found: ${vaultPath}`);
+  }
+  let vaultFile;
+  try {
+    vaultFile = JSON.parse(readFileSync(vaultPath, "utf8"));
+  } catch {
+    throw new VaultError(`Failed to read vault file: ${vaultPath}`);
+  }
+  const salt = Buffer.from(vaultFile.salt, "hex");
+  const key = deriveKey(passphrase, salt, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+  vaultFile.kdf = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
+  const vaultData = { secrets };
+  const { iv, data, tag } = encrypt(key, JSON.stringify(vaultData));
+  vaultFile.iv = iv;
+  vaultFile.data = data;
+  vaultFile.tag = tag;
+  atomicWriteFileSync(vaultPath, JSON.stringify(vaultFile, null, 2), 384);
+}
 
 // src/vault/broker/server.ts
 init_loader();
@@ -12243,6 +12290,16 @@ var GetRequestSchema = exports_external.object({
   filename: exports_external.string().optional(),
   token: exports_external.string().optional()
 });
+var PutRequestSchema = exports_external.object({
+  v: exports_external.literal(1),
+  op: exports_external.literal("put"),
+  key: exports_external.string().min(1),
+  entry: exports_external.union([
+    exports_external.object({ kind: exports_external.literal("string"), value: exports_external.string() }),
+    exports_external.object({ kind: exports_external.literal("binary"), value: exports_external.string() })
+  ]),
+  token: exports_external.string().optional()
+});
 var ListRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("list"),
@@ -12327,6 +12384,7 @@ var ApprovalRecordRequestSchema = exports_external.object({
 });
 var RequestSchema = exports_external.discriminatedUnion("op", [
   GetRequestSchema,
+  PutRequestSchema,
   ListRequestSchema,
   StatusRequestSchema,
   LockRequestSchema,
@@ -12379,6 +12437,11 @@ var OkLockResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
   locked: exports_external.literal(true)
 });
+var OkPutResponseSchema = exports_external.object({
+  ok: exports_external.literal(true),
+  put: exports_external.literal(true),
+  key: exports_external.string()
+});
 var OkMintGrantResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
   token: exports_external.string(),
@@ -12464,6 +12527,7 @@ var ResponseSchema = exports_external.union([
   OkKeysResponseSchema,
   OkStatusResponseSchema,
   OkLockResponseSchema,
+  OkPutResponseSchema,
   OkMintGrantResponseSchema,
   OkListGrantsResponseSchema,
   OkRevokeGrantResponseSchema,
@@ -12613,13 +12677,13 @@ function genSalt(rounds, seed_length, callback) {
       throw Error("Illegal callback: " + typeof callback);
     _async(callback);
   } else
-    return new Promise(function(resolve3, reject) {
+    return new Promise(function(resolve4, reject) {
       _async(function(err, res) {
         if (err) {
           reject(err);
           return;
         }
-        resolve3(res);
+        resolve4(res);
       });
     });
 }
@@ -12639,13 +12703,13 @@ function hash(password, salt, callback, progressCallback) {
       throw Error("Illegal callback: " + typeof callback);
     _async(callback);
   } else
-    return new Promise(function(resolve3, reject) {
+    return new Promise(function(resolve4, reject) {
       _async(function(err, res) {
         if (err) {
           reject(err);
           return;
         }
-        resolve3(res);
+        resolve4(res);
       });
     });
 }
@@ -12678,13 +12742,13 @@ function compare(password, hashValue, callback, progressCallback) {
       throw Error("Illegal callback: " + typeof callback);
     _async(callback);
   } else
-    return new Promise(function(resolve3, reject) {
+    return new Promise(function(resolve4, reject) {
       _async(function(err, res) {
         if (err) {
           reject(err);
           return;
         }
-        resolve3(res);
+        resolve4(res);
       });
     });
 }
@@ -14709,6 +14773,7 @@ var PID_FILE_DEFAULT = "~/.switchroom/vault-broker.pid";
 class VaultBroker {
   testOpts;
   secrets = null;
+  passphrase = null;
   config = null;
   startedAt = Date.now();
   server = null;
@@ -14736,7 +14801,7 @@ class VaultBroker {
     if (process.platform !== "linux" && process.env.SWITCHROOM_BROKER_ALLOW_NON_LINUX !== "1") {
       throw new Error(`vault-broker is Linux-only (running on ${process.platform}). ` + `The broker's ACL relies on cgroup-based systemd unit identification, ` + `which is not available on this platform. ` + `Use 'switchroom vault get --no-broker' for direct vault access. ` + `If you need to run the broker for development on this platform, ` + `set SWITCHROOM_BROKER_ALLOW_NON_LINUX=1 — but understand that the ` + `broker will accept any same-user caller without per-cron ACL enforcement.`);
     }
-    this.socketPath = resolve3(socketPath);
+    this.socketPath = resolve4(socketPath);
     this.unlockSocketPath = this.socketPath.replace(/\.sock$/, ".unlock.sock");
     this.startedAt = Date.now();
     if (this.testOpts._testConfig) {
@@ -14746,7 +14811,7 @@ class VaultBroker {
       this.config = loadConfig2(configPath);
     }
     if (vaultPath) {
-      this.vaultPath = resolve3(vaultPath);
+      this.vaultPath = resolve4(vaultPath);
     } else {
       this.vaultPath = resolvePath(this.config.vault?.path ?? "~/.switchroom/vault.enc");
     }
@@ -14754,7 +14819,7 @@ class VaultBroker {
       this.secrets = { ...this.testOpts._testSecrets };
     }
     process.umask(63);
-    const parentDir = dirname2(this.socketPath);
+    const parentDir = dirname3(this.socketPath);
     mkdirSync4(parentDir, { recursive: true, mode: 448 });
     try {
       chmodSync3(parentDir, 448);
@@ -14780,6 +14845,7 @@ class VaultBroker {
   unlockFromPassphrase(passphrase) {
     const secrets = openVault(passphrase, this.vaultPath);
     this.secrets = secrets;
+    this.passphrase = passphrase;
   }
   lock() {
     if (this.secrets !== null) {
@@ -14792,6 +14858,7 @@ class VaultBroker {
       }
       this.secrets = null;
     }
+    this.passphrase = null;
   }
   stop() {
     this.lock();
@@ -14838,7 +14905,7 @@ class VaultBroker {
     return this.secrets;
   }
   bindAgentSocket(socketPath) {
-    const abs = resolve3(socketPath);
+    const abs = resolve4(socketPath);
     const agentName = socketPathToAgent(abs);
     if (agentName === null) {
       return Promise.reject(new Error(`bindAgentSocket: socket path '${abs}' does not match the canonical ` + `/run/switchroom/broker/<agent>.sock shape — refusing to bind without ` + `a verifiable agent identity`));
@@ -14890,7 +14957,7 @@ class VaultBroker {
     });
   }
   _bindDataSocket() {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const server = net.createServer((socket) => {
         this._handleDataConnection(socket);
       });
@@ -14902,12 +14969,12 @@ class VaultBroker {
           chmodSync3(this.socketPath, 384);
         } catch {}
         this.server = server;
-        resolve4();
+        resolve5();
       });
     });
   }
   _bindUnlockSocket() {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const server = net.createServer((socket) => {
         this._handleUnlockConnection(socket);
       });
@@ -14919,7 +14986,7 @@ class VaultBroker {
           chmodSync3(this.unlockSocketPath, 384);
         } catch {}
         this.unlockServer = server;
-        resolve4();
+        resolve5();
       });
     });
   }
@@ -15205,6 +15272,90 @@ class VaultBroker {
       socket.write(encodeResponse(entryResponse(entry)));
       return;
     }
+    if (req.op === "put") {
+      if (this.secrets === null || this.passphrase === null) {
+        socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
+        return;
+      }
+      if (agentName === null) {
+        socket.write(encodeResponse(errorResponse("DENIED", "put requires path-as-identity (token-based grants are read-only)")));
+        return;
+      }
+      if (this.config === null) {
+        socket.write(encodeResponse(errorResponse("INTERNAL", "Broker config not loaded")));
+        return;
+      }
+      const aclResult = checkAclByAgent(this.config, agentName, req.key);
+      if (!aclResult.allow) {
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: `denied:${aclResult.reason}`
+        });
+        socket.write(encodeResponse(errorResponse("DENIED", aclResult.reason)));
+        return;
+      }
+      const existing = this.secrets[req.key];
+      if (existing === undefined) {
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: "denied:unknown_key"
+        });
+        socket.write(encodeResponse(errorResponse("UNKNOWN_KEY", `Key not found: ${req.key} (broker put cannot introduce new keys; ask operator to set it once via 'switchroom vault set' from the host)`)));
+        return;
+      }
+      if (existing.kind !== req.entry.kind) {
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: `denied:kind_mismatch ${existing.kind}→${req.entry.kind}`
+        });
+        socket.write(encodeResponse(errorResponse("BAD_REQUEST", `kind mismatch: existing entry is '${existing.kind}', new entry is '${req.entry.kind}'`)));
+        return;
+      }
+      const previousEntry = existing;
+      this.secrets[req.key] = req.entry;
+      try {
+        saveVault(this.passphrase, this.vaultPath, this.secrets);
+      } catch (err) {
+        this.secrets[req.key] = previousEntry;
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: `error:${err?.message ?? "save failed"}`
+        });
+        socket.write(encodeResponse(errorResponse("INTERNAL", `Failed to persist: ${err?.message ?? "unknown"}`)));
+        return;
+      }
+      this.auditLogger.write({
+        ts: new Date().toISOString(),
+        op: "put",
+        key: req.key,
+        caller: auditCaller,
+        pid: auditPid,
+        cgroup: auditCgroup,
+        result: "allowed"
+      });
+      socket.write(encodeResponse({ ok: true, put: true, key: req.key }));
+      return;
+    }
     if (req.op === "approval_request" || req.op === "approval_lookup" || req.op === "approval_consume" || req.op === "approval_revoke" || req.op === "approval_list" || req.op === "approval_record") {
       await this._handleApprovalOp(socket, req);
       return;
@@ -15672,11 +15823,11 @@ async function main() {
         if (e.name.startsWith("."))
           continue;
         if ((e.isFile() || e.isSocket()) && e.name.endsWith(".sock")) {
-          flat.push(resolve3(perAgentDir, e.name));
+          flat.push(resolve4(perAgentDir, e.name));
           continue;
         }
         if (e.isDirectory()) {
-          const candidate = resolve3(perAgentDir, e.name, "sock");
+          const candidate = resolve4(perAgentDir, e.name, "sock");
           if (socketPathToAgent(candidate) !== null) {
             subdirs.push(candidate);
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.7.10",
+  "version": "0.7.11",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/foreman/foreman.js

@@ -23553,7 +23553,7 @@ function decodeResponse(line) {
   const obj = JSON.parse(line);
   return ResponseSchema.parse(obj);
 }
-var MAX_FRAME_BYTES, GetRequestSchema, ListRequestSchema, MintGrantRequestSchema, ListGrantsRequestSchema, RevokeGrantRequestSchema, StatusRequestSchema, LockRequestSchema, ApprovalRequestRequestSchema, ApprovalLookupRequestSchema, ApprovalConsumeRequestSchema, ApprovalRevokeRequestSchema, ApprovalListRequestSchema, ApprovalDecisionModeSchema, ApprovalRecordRequestSchema, RequestSchema, VaultEntrySchema, ErrorCode, OkEntryResponseSchema, OkKeysResponseSchema, BrokerStatus, OkStatusResponseSchema, OkLockResponseSchema, OkMintGrantResponseSchema, GrantMetaSchema, OkListGrantsResponseSchema, OkRevokeGrantResponseSchema, OkApprovalRequestResponseSchema, ApprovalDecisionMetaSchema, OkApprovalLookupResponseSchema, OkApprovalConsumeResponseSchema, OkApprovalRevokeResponseSchema, OkApprovalListResponseSchema, OkApprovalRecordResponseSchema, ErrorResponseSchema, ResponseSchema;
+var MAX_FRAME_BYTES, GetRequestSchema, PutRequestSchema, ListRequestSchema, MintGrantRequestSchema, ListGrantsRequestSchema, RevokeGrantRequestSchema, StatusRequestSchema, LockRequestSchema, ApprovalRequestRequestSchema, ApprovalLookupRequestSchema, ApprovalConsumeRequestSchema, ApprovalRevokeRequestSchema, ApprovalListRequestSchema, ApprovalDecisionModeSchema, ApprovalRecordRequestSchema, RequestSchema, VaultEntrySchema, ErrorCode, OkEntryResponseSchema, OkKeysResponseSchema, BrokerStatus, OkStatusResponseSchema, OkLockResponseSchema, OkPutResponseSchema, OkMintGrantResponseSchema, GrantMetaSchema, OkListGrantsResponseSchema, OkRevokeGrantResponseSchema, OkApprovalRequestResponseSchema, ApprovalDecisionMetaSchema, OkApprovalLookupResponseSchema, OkApprovalConsumeResponseSchema, OkApprovalRevokeResponseSchema, OkApprovalListResponseSchema, OkApprovalRecordResponseSchema, ErrorResponseSchema, ResponseSchema;
 var init_protocol = __esm(() => {
   init_zod();
   MAX_FRAME_BYTES = 64 * 1024;
@@ -23564,6 +23564,16 @@ var init_protocol = __esm(() => {
     filename: exports_external.string().optional(),
     token: exports_external.string().optional()
   });
+  PutRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("put"),
+    key: exports_external.string().min(1),
+    entry: exports_external.union([
+      exports_external.object({ kind: exports_external.literal("string"), value: exports_external.string() }),
+      exports_external.object({ kind: exports_external.literal("binary"), value: exports_external.string() })
+    ]),
+    token: exports_external.string().optional()
+  });
   ListRequestSchema = exports_external.object({
     v: exports_external.literal(1),
     op: exports_external.literal("list"),
@@ -23648,6 +23658,7 @@ var init_protocol = __esm(() => {
   });
   RequestSchema = exports_external.discriminatedUnion("op", [
     GetRequestSchema,
+    PutRequestSchema,
     ListRequestSchema,
     StatusRequestSchema,
     LockRequestSchema,
@@ -23700,6 +23711,11 @@ var init_protocol = __esm(() => {
     ok: exports_external.literal(true),
     locked: exports_external.literal(true)
   });
+  OkPutResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    put: exports_external.literal(true),
+    key: exports_external.string()
+  });
   OkMintGrantResponseSchema = exports_external.object({
     ok: exports_external.literal(true),
     token: exports_external.string(),
@@ -23785,6 +23801,7 @@ var init_protocol = __esm(() => {
     OkKeysResponseSchema,
     OkStatusResponseSchema,
     OkLockResponseSchema,
+    OkPutResponseSchema,
     OkMintGrantResponseSchema,
     OkListGrantsResponseSchema,
     OkRevokeGrantResponseSchema,

package/telegram-plugin/dist/gateway/gateway.js

@@ -26791,7 +26791,7 @@ function decodeResponse(line) {
   const obj = JSON.parse(line);
   return ResponseSchema.parse(obj);
 }
-var MAX_FRAME_BYTES, GetRequestSchema, ListRequestSchema, MintGrantRequestSchema, ListGrantsRequestSchema, RevokeGrantRequestSchema, StatusRequestSchema, LockRequestSchema, ApprovalRequestRequestSchema, ApprovalLookupRequestSchema, ApprovalConsumeRequestSchema, ApprovalRevokeRequestSchema, ApprovalListRequestSchema, ApprovalDecisionModeSchema, ApprovalRecordRequestSchema, RequestSchema, VaultEntrySchema, ErrorCode, OkEntryResponseSchema, OkKeysResponseSchema, BrokerStatus, OkStatusResponseSchema, OkLockResponseSchema, OkMintGrantResponseSchema, GrantMetaSchema, OkListGrantsResponseSchema, OkRevokeGrantResponseSchema, OkApprovalRequestResponseSchema, ApprovalDecisionMetaSchema, OkApprovalLookupResponseSchema, OkApprovalConsumeResponseSchema, OkApprovalRevokeResponseSchema, OkApprovalListResponseSchema, OkApprovalRecordResponseSchema, ErrorResponseSchema, ResponseSchema;
+var MAX_FRAME_BYTES, GetRequestSchema, PutRequestSchema, ListRequestSchema, MintGrantRequestSchema, ListGrantsRequestSchema, RevokeGrantRequestSchema, StatusRequestSchema, LockRequestSchema, ApprovalRequestRequestSchema, ApprovalLookupRequestSchema, ApprovalConsumeRequestSchema, ApprovalRevokeRequestSchema, ApprovalListRequestSchema, ApprovalDecisionModeSchema, ApprovalRecordRequestSchema, RequestSchema, VaultEntrySchema, ErrorCode, OkEntryResponseSchema, OkKeysResponseSchema, BrokerStatus, OkStatusResponseSchema, OkLockResponseSchema, OkPutResponseSchema, OkMintGrantResponseSchema, GrantMetaSchema, OkListGrantsResponseSchema, OkRevokeGrantResponseSchema, OkApprovalRequestResponseSchema, ApprovalDecisionMetaSchema, OkApprovalLookupResponseSchema, OkApprovalConsumeResponseSchema, OkApprovalRevokeResponseSchema, OkApprovalListResponseSchema, OkApprovalRecordResponseSchema, ErrorResponseSchema, ResponseSchema;
 var init_protocol = __esm(() => {
   init_zod();
   MAX_FRAME_BYTES = 64 * 1024;
@@ -26802,6 +26802,16 @@ var init_protocol = __esm(() => {
     filename: exports_external.string().optional(),
     token: exports_external.string().optional()
   });
+  PutRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("put"),
+    key: exports_external.string().min(1),
+    entry: exports_external.union([
+      exports_external.object({ kind: exports_external.literal("string"), value: exports_external.string() }),
+      exports_external.object({ kind: exports_external.literal("binary"), value: exports_external.string() })
+    ]),
+    token: exports_external.string().optional()
+  });
   ListRequestSchema = exports_external.object({
     v: exports_external.literal(1),
     op: exports_external.literal("list"),
@@ -26886,6 +26896,7 @@ var init_protocol = __esm(() => {
   });
   RequestSchema = exports_external.discriminatedUnion("op", [
     GetRequestSchema,
+    PutRequestSchema,
     ListRequestSchema,
     StatusRequestSchema,
     LockRequestSchema,
@@ -26938,6 +26949,11 @@ var init_protocol = __esm(() => {
     ok: exports_external.literal(true),
     locked: exports_external.literal(true)
   });
+  OkPutResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    put: exports_external.literal(true),
+    key: exports_external.string()
+  });
   OkMintGrantResponseSchema = exports_external.object({
     ok: exports_external.literal(true),
     token: exports_external.string(),
@@ -27023,6 +27039,7 @@ var init_protocol = __esm(() => {
     OkKeysResponseSchema,
     OkStatusResponseSchema,
     OkLockResponseSchema,
+    OkPutResponseSchema,
     OkMintGrantResponseSchema,
     OkListGrantsResponseSchema,
     OkRevokeGrantResponseSchema,
@@ -40750,10 +40767,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.7.10";
-var COMMIT_SHA = "3e362edf";
-var COMMIT_DATE = "2026-05-10T22:18:36+10:00";
-var LATEST_PR = 950;
+var VERSION = "0.7.11";
+var COMMIT_SHA = "69ee15a9";
+var COMMIT_DATE = "2026-05-10T23:42:16+10:00";
+var LATEST_PR = 953;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/unhandled-rejection-policy.ts