switchroom 0.11.1 → 0.12.1

package/telegram-plugin/dist/gateway/gateway.js

@@ -66,7 +66,7 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/filter.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/filter.js
 var require_filter = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.matchFilter = matchFilter;
@@ -430,7 +430,7 @@ var require_filter = __commonJS((exports) => {
   };
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/context.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/context.js
 var require_context = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Context = undefined;
@@ -1457,7 +1457,7 @@ var require_context = __commonJS((exports) => {
   }
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/composer.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/composer.js
 var require_composer = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Composer = exports.BotError = undefined;
@@ -1619,7 +1619,7 @@ var require_composer = __commonJS((exports) => {
   exports.Composer = Composer;
 });
 
-// ../node_modules/.bun/ms@2.1.3/node_modules/ms/index.js
+// ../../switchroom/node_modules/.bun/ms@2.1.3/node_modules/ms/index.js
 var require_ms = __commonJS((exports, module) => {
   var s = 1000;
   var m = s * 60;
@@ -1729,7 +1729,7 @@ var require_ms = __commonJS((exports, module) => {
   }
 });
 
-// ../node_modules/.bun/debug@4.4.3/node_modules/debug/src/common.js
+// ../../switchroom/node_modules/.bun/debug@4.4.3/node_modules/debug/src/common.js
 var require_common = __commonJS((exports, module) => {
   function setup(env) {
     createDebug.debug = createDebug;
@@ -1904,7 +1904,7 @@ var require_common = __commonJS((exports, module) => {
   module.exports = setup;
 });
 
-// ../node_modules/.bun/debug@4.4.3/node_modules/debug/src/browser.js
+// ../../switchroom/node_modules/.bun/debug@4.4.3/node_modules/debug/src/browser.js
 var require_browser = __commonJS((exports, module) => {
   exports.formatArgs = formatArgs;
   exports.save = save;
@@ -2064,7 +2064,7 @@ var require_browser = __commonJS((exports, module) => {
   };
 });
 
-// ../node_modules/.bun/has-flag@4.0.0/node_modules/has-flag/index.js
+// ../../switchroom/node_modules/.bun/has-flag@4.0.0/node_modules/has-flag/index.js
 var require_has_flag = __commonJS((exports, module) => {
   module.exports = (flag, argv = process.argv) => {
     const prefix = flag.startsWith("-") ? "" : flag.length === 1 ? "-" : "--";
@@ -2074,7 +2074,7 @@ var require_has_flag = __commonJS((exports, module) => {
   };
 });
 
-// ../node_modules/.bun/supports-color@7.2.0/node_modules/supports-color/index.js
+// ../../switchroom/node_modules/.bun/supports-color@7.2.0/node_modules/supports-color/index.js
 var require_supports_color = __commonJS((exports, module) => {
   var os = __require("os");
   var tty = __require("tty");
@@ -2173,7 +2173,7 @@ var require_supports_color = __commonJS((exports, module) => {
   };
 });
 
-// ../node_modules/.bun/debug@4.4.3/node_modules/debug/src/node.js
+// ../../switchroom/node_modules/.bun/debug@4.4.3/node_modules/debug/src/node.js
 var require_node = __commonJS((exports, module) => {
   var tty = __require("tty");
   var util = __require("util");
@@ -2344,7 +2344,7 @@ var require_node = __commonJS((exports, module) => {
   };
 });
 
-// ../node_modules/.bun/debug@4.4.3/node_modules/debug/src/index.js
+// ../../switchroom/node_modules/.bun/debug@4.4.3/node_modules/debug/src/index.js
 var require_src = __commonJS((exports, module) => {
   if (typeof process === "undefined" || process.type === "renderer" || false || process.__nwjs) {
     module.exports = require_browser();
@@ -2353,7 +2353,7 @@ var require_src = __commonJS((exports, module) => {
   }
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/platform.node.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/platform.node.js
 var require_platform_node = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.defaultAdapter = exports.itrToStream = exports.debug = undefined;
@@ -2393,7 +2393,7 @@ var require_platform_node = __commonJS((exports) => {
   exports.defaultAdapter = "express";
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/core/error.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/core/error.js
 var require_error = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.HttpError = exports.GrammyError = undefined;
@@ -2449,10 +2449,10 @@ var require_error = __commonJS((exports) => {
   }
 });
 
-// ../node_modules/.bun/@grammyjs+types@3.26.0/node_modules/@grammyjs/types/mod.js
+// ../../switchroom/node_modules/.bun/@grammyjs+types@3.26.0/node_modules/@grammyjs/types/mod.js
 var exports_mod = {};
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/types.node.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/types.node.js
 var require_types_node = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -2543,7 +2543,7 @@ var require_types_node = __commonJS((exports) => {
   }
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/types.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/types.js
 var require_types = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -2569,7 +2569,7 @@ var require_types = __commonJS((exports) => {
   __exportStar(require_types_node(), exports);
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/core/payload.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/core/payload.js
 var require_payload = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.requiresFormDataUpload = requiresFormDataUpload;
@@ -2709,7 +2709,7 @@ content-type:application/octet-stream\r
   }
 });
 
-// ../node_modules/.bun/event-target-shim@5.0.1/node_modules/event-target-shim/dist/event-target-shim.js
+// ../../switchroom/node_modules/.bun/event-target-shim@5.0.1/node_modules/event-target-shim/dist/event-target-shim.js
 var require_event_target_shim = __commonJS((exports, module) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var privateData = new WeakMap;
@@ -3149,7 +3149,7 @@ var require_event_target_shim = __commonJS((exports, module) => {
   module.exports.defineEventAttribute = defineEventAttribute;
 });
 
-// ../node_modules/.bun/abort-controller@3.0.0/node_modules/abort-controller/dist/abort-controller.js
+// ../../switchroom/node_modules/.bun/abort-controller@3.0.0/node_modules/abort-controller/dist/abort-controller.js
 var require_abort_controller = __commonJS((exports, module) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var eventTargetShim = require_event_target_shim();
@@ -3229,7 +3229,7 @@ var require_abort_controller = __commonJS((exports, module) => {
   module.exports.AbortSignal = AbortSignal2;
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/shim.node.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/shim.node.js
 var require_shim_node = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.fetch = exports.AbortController = undefined;
@@ -3243,7 +3243,7 @@ var require_shim_node = __commonJS((exports) => {
   } });
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/core/client.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/core/client.js
 var require_client = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.createRawApi = createRawApi;
@@ -3423,7 +3423,7 @@ If you want to prevent such mistakes in the future, consider using TypeScript. h
   var shim_node_js_1 = require_shim_node();
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/core/api.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/core/api.js
 var require_api = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Api = undefined;
@@ -4041,7 +4041,7 @@ var require_api = __commonJS((exports) => {
   exports.Api = Api;
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/bot.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/bot.js
 var require_bot = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Bot = exports.BotError = exports.DEFAULT_UPDATE_TYPES = undefined;
@@ -4370,7 +4370,7 @@ On the other hand, if you actually know what you're doing and you do need to ins
   var shim_node_js_1 = require_shim_node();
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/constants.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/constants.js
 var require_constants = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.API_CONSTANTS = undefined;
@@ -4406,7 +4406,7 @@ var require_constants = __commonJS((exports) => {
   Object.freeze(exports.API_CONSTANTS);
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/inline_query.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/inline_query.js
 var require_inline_query = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.InlineQueryResultBuilder = undefined;
@@ -4604,7 +4604,7 @@ var require_inline_query = __commonJS((exports) => {
   };
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/input_media.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/input_media.js
 var require_input_media = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.InputMediaBuilder = undefined;
@@ -4627,7 +4627,7 @@ var require_input_media = __commonJS((exports) => {
   };
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/keyboard.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/keyboard.js
 var require_keyboard = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.InlineKeyboard = exports.Keyboard = undefined;
@@ -4985,7 +4985,7 @@ var require_keyboard = __commonJS((exports) => {
   }
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/session.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/session.js
 var require_session = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.MemorySessionStorage = undefined;
@@ -5285,7 +5285,7 @@ var require_session = __commonJS((exports) => {
   }
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/frameworks.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/frameworks.js
 var require_frameworks = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.adapters = undefined;
@@ -5653,7 +5653,7 @@ var require_frameworks = __commonJS((exports) => {
   };
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/webhook.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/convenience/webhook.js
 var require_webhook = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.webhookCallback = webhookCallback;
@@ -5747,7 +5747,7 @@ var require_webhook = __commonJS((exports) => {
   }
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/mod.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/mod.js
 var require_mod = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -5813,7 +5813,7 @@ var require_mod = __commonJS((exports) => {
   } });
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/platform.node.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/platform.node.js
 var require_platform_node2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parentThread = exports.createThread = undefined;
@@ -5844,7 +5844,7 @@ var require_platform_node2 = __commonJS((exports) => {
   exports.parentThread = parentThread;
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/distribute.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/distribute.js
 var require_distribute = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.distribute = undefined;
@@ -5889,7 +5889,7 @@ var require_distribute = __commonJS((exports) => {
   exports.distribute = distribute;
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/queue.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/queue.js
 var require_queue = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.DecayingDeque = undefined;
@@ -6033,7 +6033,7 @@ var require_queue = __commonJS((exports) => {
   exports.DecayingDeque = DecayingDeque;
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/sink.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/sink.js
 var require_sink = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.createConcurrentSink = exports.createBatchSink = exports.createSequentialSink = undefined;
@@ -6078,7 +6078,7 @@ var require_sink = __commonJS((exports) => {
   exports.createConcurrentSink = createConcurrentSink;
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/node-shim.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/node-shim.js
 var require_node_shim = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -6104,7 +6104,7 @@ var require_node_shim = __commonJS((exports) => {
   __exportStar(require_abort_controller(), exports);
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/source.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/source.js
 var require_source = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.createSource = undefined;
@@ -6184,7 +6184,7 @@ var require_source = __commonJS((exports) => {
   var node_shim_js_1 = require_node_shim();
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/runner.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/runner.js
 var require_runner = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.createRunner = exports.createUpdateFetcher = exports.run = undefined;
@@ -6336,7 +6336,7 @@ var require_runner = __commonJS((exports) => {
   }
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/sequentialize.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/sequentialize.js
 var require_sequentialize = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.sequentialize = undefined;
@@ -6379,7 +6379,7 @@ var require_sequentialize = __commonJS((exports) => {
   exports.sequentialize = sequentialize;
 });
 
-// ../node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/mod.js
+// ../../switchroom/node_modules/.bun/grammy@1.42.0/node_modules/grammy/out/mod.js
 var require_mod2 = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -6445,7 +6445,7 @@ var require_mod2 = __commonJS((exports) => {
   } });
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/deps.node.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/deps.node.js
 var require_deps_node = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.BotError = exports.Bot = undefined;
@@ -6458,7 +6458,7 @@ var require_deps_node = __commonJS((exports) => {
   } });
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/worker.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/worker.js
 var require_worker = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.BotWorker = undefined;
@@ -6500,7 +6500,7 @@ var require_worker = __commonJS((exports) => {
   exports.BotWorker = BotWorker;
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/mod.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/mod.js
 var require_mod3 = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -6532,7 +6532,7 @@ var require_mod3 = __commonJS((exports) => {
   __exportStar(require_worker(), exports);
 });
 
-// ../node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/mod.js
+// ../../switchroom/node_modules/.bun/@grammyjs+runner@2.0.3+c6be0243b1bbec89/node_modules/@grammyjs/runner/out/mod.js
 var require_mod4 = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -6564,7 +6564,7 @@ var require_mod4 = __commonJS((exports) => {
   __exportStar(require_worker(), exports);
 });
 
-// ../node_modules/.bun/@xterm+headless@6.0.0/node_modules/@xterm/headless/lib-headless/xterm-headless.js
+// ../../switchroom/node_modules/.bun/@xterm+headless@6.0.0/node_modules/@xterm/headless/lib-headless/xterm-headless.js
 var require_xterm_headless = __commonJS((exports2) => {
   (() => {
     var e = { 5639: (e2, t2, s2) => {
@@ -12119,7 +12119,7 @@ ${i3.join(`
   })();
 });
 
-// ../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// ../../switchroom/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType = (data) => {
   const t = typeof data;
   switch (t) {
@@ -12250,7 +12250,7 @@ var init_util = __esm(() => {
   ]);
 });
 
-// ../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// ../../switchroom/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode, quotelessJson = (obj) => {
   const json = JSON.stringify(obj, null, 2);
   return json.replace(/"([^"]+)":/g, "$1:");
@@ -12371,7 +12371,7 @@ var init_ZodError = __esm(() => {
   };
 });
 
-// ../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// ../../switchroom/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -12478,7 +12478,7 @@ var init_en = __esm(() => {
   en_default = errorMap;
 });
 
-// ../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
+// ../../switchroom/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 function setErrorMap(map) {
   overrideErrorMap = map;
 }
@@ -12491,7 +12491,7 @@ var init_errors = __esm(() => {
   overrideErrorMap = en_default;
 });
 
-// ../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// ../../switchroom/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 function addIssueToContext(ctx, issueData) {
   const overrideMap = getErrorMap();
   const issue = makeIssue({
@@ -12596,10 +12596,10 @@ var init_parseUtil = __esm(() => {
   });
 });
 
-// ../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/typeAliases.js
+// ../../switchroom/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/typeAliases.js
 var init_typeAliases = () => {};
 
-// ../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// ../../switchroom/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 var init_errorUtil = __esm(() => {
   (function(errorUtil2) {
@@ -12608,7 +12608,7 @@ var init_errorUtil = __esm(() => {
   })(errorUtil || (errorUtil = {}));
 });
 
-// ../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
+// ../../switchroom/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -15959,7 +15959,7 @@ var init_types = __esm(() => {
   NEVER = INVALID;
 });
 
-// ../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
+// ../../switchroom/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -16079,7 +16079,7 @@ var init_external = __esm(() => {
   init_ZodError();
 });
 
-// ../node_modules/.bun/zod@3.25.76/node_modules/zod/index.js
+// ../../switchroom/node_modules/.bun/zod@3.25.76/node_modules/zod/index.js
 var init_zod = __esm(() => {
   init_external();
   init_external();
@@ -16323,6 +16323,14 @@ import { existsSync as existsSync6 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { join as join8 } from "node:path";
+function reviveDate(v) {
+  if (v == null)
+    return null;
+  if (v instanceof Date)
+    return Number.isNaN(v.getTime()) ? null : v;
+  const d = new Date(v);
+  return Number.isNaN(d.getTime()) ? null : d;
+}
 function operatorSocketPath(home = homedir3()) {
   return join8(home, ".switchroom", "state", "auth-broker-operator", "sock");
 }
@@ -16398,7 +16406,14 @@ class AuthBrokerClient {
       accounts: [...accounts],
       ...timeoutMs !== undefined ? { timeoutMs } : {}
     });
-    return data;
+    const parsed = data;
+    for (const entry of parsed.results) {
+      if (entry.result.ok) {
+        entry.result.data.fiveHourResetAt = reviveDate(entry.result.data.fiveHourResetAt);
+        entry.result.data.sevenDayResetAt = reviveDate(entry.result.data.sevenDayResetAt);
+      }
+    }
+    return parsed;
   }
   async setActive(account) {
     const data = await this.send({
@@ -16612,7 +16627,7 @@ var init_client = __esm(() => {
   };
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/identity.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS((exports2) => {
   var ALIAS = Symbol.for("yaml.alias");
   var DOC = Symbol.for("yaml.document");
@@ -16666,7 +16681,7 @@ var require_identity = __commonJS((exports2) => {
   exports2.isSeq = isSeq;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/visit.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/visit.js
 var require_visit = __commonJS((exports2) => {
   var identity = require_identity();
   var BREAK = Symbol("break visit");
@@ -16821,7 +16836,7 @@ var require_visit = __commonJS((exports2) => {
   exports2.visitAsync = visitAsync;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/directives.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/directives.js
 var require_directives = __commonJS((exports2) => {
   var identity = require_identity();
   var visit = require_visit();
@@ -16973,7 +16988,7 @@ var require_directives = __commonJS((exports2) => {
   exports2.Directives = Directives;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/anchors.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/anchors.js
 var require_anchors = __commonJS((exports2) => {
   var identity = require_identity();
   var visit = require_visit();
@@ -17035,7 +17050,7 @@ var require_anchors = __commonJS((exports2) => {
   exports2.findNewAnchor = findNewAnchor;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/applyReviver.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/applyReviver.js
 var require_applyReviver = __commonJS((exports2) => {
   function applyReviver(reviver, obj, key, val) {
     if (val && typeof val === "object") {
@@ -17082,7 +17097,7 @@ var require_applyReviver = __commonJS((exports2) => {
   exports2.applyReviver = applyReviver;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/toJS.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/toJS.js
 var require_toJS = __commonJS((exports2) => {
   var identity = require_identity();
   function toJS(value, arg, ctx) {
@@ -17109,7 +17124,7 @@ var require_toJS = __commonJS((exports2) => {
   exports2.toJS = toJS;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Node.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Node.js
 var require_Node = __commonJS((exports2) => {
   var applyReviver = require_applyReviver();
   var identity = require_identity();
@@ -17146,7 +17161,7 @@ var require_Node = __commonJS((exports2) => {
   exports2.NodeBase = NodeBase;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Alias.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Alias.js
 var require_Alias = __commonJS((exports2) => {
   var anchors = require_anchors();
   var visit = require_visit();
@@ -17254,7 +17269,7 @@ var require_Alias = __commonJS((exports2) => {
   exports2.Alias = Alias;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Scalar.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Scalar.js
 var require_Scalar = __commonJS((exports2) => {
   var identity = require_identity();
   var Node = require_Node();
@@ -17282,7 +17297,7 @@ var require_Scalar = __commonJS((exports2) => {
   exports2.isScalarValue = isScalarValue;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/createNode.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/createNode.js
 var require_createNode = __commonJS((exports2) => {
   var Alias = require_Alias();
   var identity = require_identity();
@@ -17354,7 +17369,7 @@ var require_createNode = __commonJS((exports2) => {
   exports2.createNode = createNode;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Collection.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Collection.js
 var require_Collection = __commonJS((exports2) => {
   var createNode = require_createNode();
   var identity = require_identity();
@@ -17469,7 +17484,7 @@ var require_Collection = __commonJS((exports2) => {
   exports2.isEmptyPath = isEmptyPath;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyComment.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyComment.js
 var require_stringifyComment = __commonJS((exports2) => {
   var stringifyComment = (str) => str.replace(/^(?!$)(?: $)?/gm, "#");
   function indentComment(comment, indent) {
@@ -17486,7 +17501,7 @@ var require_stringifyComment = __commonJS((exports2) => {
   exports2.stringifyComment = stringifyComment;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/foldFlowLines.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/foldFlowLines.js
 var require_foldFlowLines = __commonJS((exports2) => {
   var FOLD_FLOW = "flow";
   var FOLD_BLOCK = "block";
@@ -17623,7 +17638,7 @@ ${indent}${text.slice(fold + 1, end2)}`;
   exports2.foldFlowLines = foldFlowLines;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyString.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyString.js
 var require_stringifyString = __commonJS((exports2) => {
   var Scalar = require_Scalar();
   var foldFlowLines = require_foldFlowLines();
@@ -17921,7 +17936,7 @@ ${indent}`);
   exports2.stringifyString = stringifyString;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringify.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringify.js
 var require_stringify = __commonJS((exports2) => {
   var anchors = require_anchors();
   var identity = require_identity();
@@ -18042,7 +18057,7 @@ ${ctx.indent}${str}`;
   exports2.stringify = stringify;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyPair.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyPair.js
 var require_stringifyPair = __commonJS((exports2) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -18178,7 +18193,7 @@ ${ctx.indent}`;
   exports2.stringifyPair = stringifyPair;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/log.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/log.js
 var require_log = __commonJS((exports2) => {
   var node_process = __require("process");
   function debug(logLevel, ...messages) {
@@ -18197,7 +18212,7 @@ var require_log = __commonJS((exports2) => {
   exports2.warn = warn;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/merge.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/merge.js
 var require_merge = __commonJS((exports2) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -18251,7 +18266,7 @@ var require_merge = __commonJS((exports2) => {
   exports2.merge = merge;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/addPairToJSMap.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/addPairToJSMap.js
 var require_addPairToJSMap = __commonJS((exports2) => {
   var log = require_log();
   var merge = require_merge();
@@ -18312,7 +18327,7 @@ var require_addPairToJSMap = __commonJS((exports2) => {
   exports2.addPairToJSMap = addPairToJSMap;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Pair.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Pair.js
 var require_Pair = __commonJS((exports2) => {
   var createNode = require_createNode();
   var stringifyPair = require_stringifyPair();
@@ -18350,7 +18365,7 @@ var require_Pair = __commonJS((exports2) => {
   exports2.createPair = createPair;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyCollection.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyCollection.js
 var require_stringifyCollection = __commonJS((exports2) => {
   var identity = require_identity();
   var stringify = require_stringify();
@@ -18502,7 +18517,7 @@ ${indent}${end}`;
   exports2.stringifyCollection = stringifyCollection;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/YAMLMap.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/YAMLMap.js
 var require_YAMLMap = __commonJS((exports2) => {
   var stringifyCollection = require_stringifyCollection();
   var addPairToJSMap = require_addPairToJSMap();
@@ -18629,7 +18644,7 @@ var require_YAMLMap = __commonJS((exports2) => {
   exports2.findPair = findPair;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/map.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/map.js
 var require_map = __commonJS((exports2) => {
   var identity = require_identity();
   var YAMLMap = require_YAMLMap();
@@ -18648,7 +18663,7 @@ var require_map = __commonJS((exports2) => {
   exports2.map = map;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/YAMLSeq.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/YAMLSeq.js
 var require_YAMLSeq = __commonJS((exports2) => {
   var createNode = require_createNode();
   var stringifyCollection = require_stringifyCollection();
@@ -18741,7 +18756,7 @@ var require_YAMLSeq = __commonJS((exports2) => {
   exports2.YAMLSeq = YAMLSeq;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/seq.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/seq.js
 var require_seq = __commonJS((exports2) => {
   var identity = require_identity();
   var YAMLSeq = require_YAMLSeq();
@@ -18760,7 +18775,7 @@ var require_seq = __commonJS((exports2) => {
   exports2.seq = seq;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/string.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/string.js
 var require_string = __commonJS((exports2) => {
   var stringifyString = require_stringifyString();
   var string = {
@@ -18776,7 +18791,7 @@ var require_string = __commonJS((exports2) => {
   exports2.string = string;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/null.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/null.js
 var require_null = __commonJS((exports2) => {
   var Scalar = require_Scalar();
   var nullTag = {
@@ -18791,7 +18806,7 @@ var require_null = __commonJS((exports2) => {
   exports2.nullTag = nullTag;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/bool.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/bool.js
 var require_bool = __commonJS((exports2) => {
   var Scalar = require_Scalar();
   var boolTag = {
@@ -18812,7 +18827,7 @@ var require_bool = __commonJS((exports2) => {
   exports2.boolTag = boolTag;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyNumber.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyNumber.js
 var require_stringifyNumber = __commonJS((exports2) => {
   function stringifyNumber({ format, minFractionDigits, tag, value }) {
     if (typeof value === "bigint")
@@ -18836,7 +18851,7 @@ var require_stringifyNumber = __commonJS((exports2) => {
   exports2.stringifyNumber = stringifyNumber;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/float.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/float.js
 var require_float = __commonJS((exports2) => {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
@@ -18879,7 +18894,7 @@ var require_float = __commonJS((exports2) => {
   exports2.floatNaN = floatNaN;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/int.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/int.js
 var require_int = __commonJS((exports2) => {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
@@ -18921,7 +18936,7 @@ var require_int = __commonJS((exports2) => {
   exports2.intOct = intOct;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/schema.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/schema.js
 var require_schema = __commonJS((exports2) => {
   var map = require_map();
   var _null = require_null();
@@ -18946,7 +18961,7 @@ var require_schema = __commonJS((exports2) => {
   exports2.schema = schema;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/json/schema.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/json/schema.js
 var require_schema2 = __commonJS((exports2) => {
   var Scalar = require_Scalar();
   var map = require_map();
@@ -19010,7 +19025,7 @@ var require_schema2 = __commonJS((exports2) => {
   exports2.schema = schema;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/binary.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/binary.js
 var require_binary = __commonJS((exports2) => {
   var node_buffer = __require("buffer");
   var Scalar = require_Scalar();
@@ -19065,7 +19080,7 @@ var require_binary = __commonJS((exports2) => {
   exports2.binary = binary;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/pairs.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/pairs.js
 var require_pairs = __commonJS((exports2) => {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -19140,7 +19155,7 @@ ${cn.comment}` : item.comment;
   exports2.resolvePairs = resolvePairs;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/omap.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/omap.js
 var require_omap = __commonJS((exports2) => {
   var identity = require_identity();
   var toJS = require_toJS();
@@ -19212,7 +19227,7 @@ var require_omap = __commonJS((exports2) => {
   exports2.omap = omap;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/bool.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/bool.js
 var require_bool2 = __commonJS((exports2) => {
   var Scalar = require_Scalar();
   function boolStringify({ value, source }, ctx) {
@@ -19241,7 +19256,7 @@ var require_bool2 = __commonJS((exports2) => {
   exports2.trueTag = trueTag;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/float.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/float.js
 var require_float2 = __commonJS((exports2) => {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
@@ -19287,7 +19302,7 @@ var require_float2 = __commonJS((exports2) => {
   exports2.floatNaN = floatNaN;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/int.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/int.js
 var require_int2 = __commonJS((exports2) => {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
@@ -19363,7 +19378,7 @@ var require_int2 = __commonJS((exports2) => {
   exports2.intOct = intOct;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/set.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/set.js
 var require_set = __commonJS((exports2) => {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -19446,7 +19461,7 @@ var require_set = __commonJS((exports2) => {
   exports2.set = set;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/timestamp.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/timestamp.js
 var require_timestamp = __commonJS((exports2) => {
   var stringifyNumber = require_stringifyNumber();
   function parseSexagesimal(str, asBigInt) {
@@ -19528,7 +19543,7 @@ var require_timestamp = __commonJS((exports2) => {
   exports2.timestamp = timestamp;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/schema.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/schema.js
 var require_schema3 = __commonJS((exports2) => {
   var map = require_map();
   var _null = require_null();
@@ -19569,7 +19584,7 @@ var require_schema3 = __commonJS((exports2) => {
   exports2.schema = schema;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/tags.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/tags.js
 var require_tags = __commonJS((exports2) => {
   var map = require_map();
   var _null = require_null();
@@ -19660,7 +19675,7 @@ var require_tags = __commonJS((exports2) => {
   exports2.getTags = getTags;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/Schema.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/Schema.js
 var require_Schema = __commonJS((exports2) => {
   var identity = require_identity();
   var map = require_map();
@@ -19690,7 +19705,7 @@ var require_Schema = __commonJS((exports2) => {
   exports2.Schema = Schema;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyDocument.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyDocument.js
 var require_stringifyDocument = __commonJS((exports2) => {
   var identity = require_identity();
   var stringify = require_stringify();
@@ -19770,7 +19785,7 @@ var require_stringifyDocument = __commonJS((exports2) => {
   exports2.stringifyDocument = stringifyDocument;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/Document.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/Document.js
 var require_Document = __commonJS((exports2) => {
   var Alias = require_Alias();
   var Collection = require_Collection();
@@ -20005,7 +20020,7 @@ var require_Document = __commonJS((exports2) => {
   exports2.Document = Document;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/errors.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/errors.js
 var require_errors = __commonJS((exports2) => {
   class YAMLError extends Error {
     constructor(name, pos, code, message) {
@@ -20070,7 +20085,7 @@ ${pointer}
   exports2.prettifyError = prettifyError;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-props.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-props.js
 var require_resolve_props = __commonJS((exports2) => {
   function resolveProps(tokens, { flow, indicator, next, offset, onError, parentIndent, startOnNewline }) {
     let spaceBefore = false;
@@ -20200,7 +20215,7 @@ var require_resolve_props = __commonJS((exports2) => {
   exports2.resolveProps = resolveProps;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-contains-newline.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-contains-newline.js
 var require_util_contains_newline = __commonJS((exports2) => {
   function containsNewline(key) {
     if (!key)
@@ -20240,7 +20255,7 @@ var require_util_contains_newline = __commonJS((exports2) => {
   exports2.containsNewline = containsNewline;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-flow-indent-check.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-flow-indent-check.js
 var require_util_flow_indent_check = __commonJS((exports2) => {
   var utilContainsNewline = require_util_contains_newline();
   function flowIndentCheck(indent, fc, onError) {
@@ -20255,7 +20270,7 @@ var require_util_flow_indent_check = __commonJS((exports2) => {
   exports2.flowIndentCheck = flowIndentCheck;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-map-includes.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-map-includes.js
 var require_util_map_includes = __commonJS((exports2) => {
   var identity = require_identity();
   function mapIncludes(ctx, items, search) {
@@ -20268,7 +20283,7 @@ var require_util_map_includes = __commonJS((exports2) => {
   exports2.mapIncludes = mapIncludes;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-map.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-map.js
 var require_resolve_block_map = __commonJS((exports2) => {
   var Pair = require_Pair();
   var YAMLMap = require_YAMLMap();
@@ -20375,7 +20390,7 @@ var require_resolve_block_map = __commonJS((exports2) => {
   exports2.resolveBlockMap = resolveBlockMap;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-seq.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-seq.js
 var require_resolve_block_seq = __commonJS((exports2) => {
   var YAMLSeq = require_YAMLSeq();
   var resolveProps = require_resolve_props();
@@ -20423,7 +20438,7 @@ var require_resolve_block_seq = __commonJS((exports2) => {
   exports2.resolveBlockSeq = resolveBlockSeq;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-end.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-end.js
 var require_resolve_end = __commonJS((exports2) => {
   function resolveEnd(end, offset, reqSpace, onError) {
     let comment = "";
@@ -20463,7 +20478,7 @@ var require_resolve_end = __commonJS((exports2) => {
   exports2.resolveEnd = resolveEnd;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-flow-collection.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-flow-collection.js
 var require_resolve_flow_collection = __commonJS((exports2) => {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -20654,7 +20669,7 @@ var require_resolve_flow_collection = __commonJS((exports2) => {
   exports2.resolveFlowCollection = resolveFlowCollection;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-collection.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-collection.js
 var require_compose_collection = __commonJS((exports2) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -20716,7 +20731,7 @@ var require_compose_collection = __commonJS((exports2) => {
   exports2.composeCollection = composeCollection;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-scalar.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-scalar.js
 var require_resolve_block_scalar = __commonJS((exports2) => {
   var Scalar = require_Scalar();
   function resolveBlockScalar(ctx, scalar, onError) {
@@ -20909,7 +20924,7 @@ var require_resolve_block_scalar = __commonJS((exports2) => {
   exports2.resolveBlockScalar = resolveBlockScalar;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-flow-scalar.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-flow-scalar.js
 var require_resolve_flow_scalar = __commonJS((exports2) => {
   var Scalar = require_Scalar();
   var resolveEnd = require_resolve_end();
@@ -21125,7 +21140,7 @@ var require_resolve_flow_scalar = __commonJS((exports2) => {
   exports2.resolveFlowScalar = resolveFlowScalar;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-scalar.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-scalar.js
 var require_compose_scalar = __commonJS((exports2) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -21203,7 +21218,7 @@ var require_compose_scalar = __commonJS((exports2) => {
   exports2.composeScalar = composeScalar;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-empty-scalar-position.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-empty-scalar-position.js
 var require_util_empty_scalar_position = __commonJS((exports2) => {
   function emptyScalarPosition(offset, before, pos) {
     if (before) {
@@ -21230,7 +21245,7 @@ var require_util_empty_scalar_position = __commonJS((exports2) => {
   exports2.emptyScalarPosition = emptyScalarPosition;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-node.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-node.js
 var require_compose_node = __commonJS((exports2) => {
   var Alias = require_Alias();
   var identity = require_identity();
@@ -21333,7 +21348,7 @@ var require_compose_node = __commonJS((exports2) => {
   exports2.composeNode = composeNode;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-doc.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-doc.js
 var require_compose_doc = __commonJS((exports2) => {
   var Document = require_Document();
   var composeNode = require_compose_node();
@@ -21373,7 +21388,7 @@ var require_compose_doc = __commonJS((exports2) => {
   exports2.composeDoc = composeDoc;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/composer.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/composer.js
 var require_composer2 = __commonJS((exports2) => {
   var node_process = __require("process");
   var directives = require_directives();
@@ -21562,7 +21577,7 @@ ${end.comment}` : end.comment;
   exports2.Composer = Composer;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-scalar.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-scalar.js
 var require_cst_scalar = __commonJS((exports2) => {
   var resolveBlockScalar = require_resolve_block_scalar();
   var resolveFlowScalar = require_resolve_flow_scalar();
@@ -21752,7 +21767,7 @@ var require_cst_scalar = __commonJS((exports2) => {
   exports2.setScalarValue = setScalarValue;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-stringify.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-stringify.js
 var require_cst_stringify = __commonJS((exports2) => {
   var stringify = (cst) => ("type" in cst) ? stringifyToken(cst) : stringifyItem(cst);
   function stringifyToken(token) {
@@ -21810,7 +21825,7 @@ var require_cst_stringify = __commonJS((exports2) => {
   exports2.stringify = stringify;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-visit.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-visit.js
 var require_cst_visit = __commonJS((exports2) => {
   var BREAK = Symbol("break visit");
   var SKIP = Symbol("skip children");
@@ -21869,7 +21884,7 @@ var require_cst_visit = __commonJS((exports2) => {
   exports2.visit = visit;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst.js
 var require_cst = __commonJS((exports2) => {
   var cstScalar = require_cst_scalar();
   var cstStringify = require_cst_stringify();
@@ -21970,7 +21985,7 @@ var require_cst = __commonJS((exports2) => {
   exports2.tokenType = tokenType;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/lexer.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/lexer.js
 var require_lexer = __commonJS((exports2) => {
   var cst = require_cst();
   function isEmpty2(ch) {
@@ -22556,7 +22571,7 @@ var require_lexer = __commonJS((exports2) => {
   exports2.Lexer = Lexer;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/line-counter.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/line-counter.js
 var require_line_counter = __commonJS((exports2) => {
   class LineCounter {
     constructor() {
@@ -22584,7 +22599,7 @@ var require_line_counter = __commonJS((exports2) => {
   exports2.LineCounter = LineCounter;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/parser.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/parser.js
 var require_parser = __commonJS((exports2) => {
   var node_process = __require("process");
   var cst = require_cst();
@@ -23433,7 +23448,7 @@ var require_parser = __commonJS((exports2) => {
   exports2.Parser = Parser;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/public-api.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/public-api.js
 var require_public_api = __commonJS((exports2) => {
   var composer = require_composer2();
   var Document = require_Document();
@@ -23527,7 +23542,7 @@ var require_public_api = __commonJS((exports2) => {
   exports2.stringify = stringify;
 });
 
-// ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/index.js
+// ../../switchroom/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/index.js
 var composer, Document, Schema, errors2, Alias, identity, Pair, Scalar, YAMLMap, YAMLSeq, cst, lexer, lineCounter, parser, publicApi, visit, $Composer, $Document, $Schema, $YAMLError, $YAMLParseError, $YAMLWarning, $Alias, $isAlias, $isCollection, $isDocument, $isMap, $isNode, $isPair, $isScalar, $isSeq, $Pair, $Scalar, $YAMLMap, $YAMLSeq, $Lexer, $LineCounter, $Parser, $parse, $parseAllDocuments, $parseDocument, $stringify, $visit, $visitAsync;
 var init_dist = __esm(() => {
   composer = require_composer2();
@@ -23577,7 +23592,7 @@ var init_dist = __esm(() => {
 });
 
 // ../src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, ReactionsSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, HostControlConfigSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, HostControlConfigSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   CodeRepoEntrySchema = exports_external.object({
@@ -23593,7 +23608,7 @@ var init_schema = __esm(() => {
   ScheduleEntrySchema = exports_external.object({
     cron: exports_external.string().describe("Cron expression (e.g., '0 8 * * *')"),
     prompt: exports_external.string().describe("Prompt to send at the scheduled time"),
-    model: exports_external.string().optional().describe("Model for this task. Defaults to claude-sonnet-4-6 (cheap, fast). " + "Use claude-opus-4-7 for tasks needing complex reasoning."),
+    model: exports_external.string().optional().describe("DEPRECATED / IGNORED. Pre-v0.8 the singleton scheduler ran each " + "task as an isolated `claude -p` and could set --model per task. " + "Post cron-fold-in (v0.8) the fire is injected into the agent's " + "running session, so it always uses the agent's configured model " + "\u2014 this field has no effect. Accepted (optional) only so existing " + "configs keep validating; set the model at the agent level instead. " + "See docs/scheduling.md."),
     secrets: exports_external.array(exports_external.string().regex(/^[a-zA-Z0-9_\-/]+$/, "Secret key names must contain only alphanumeric characters, underscores, hyphens, and forward slashes")).default([]).describe("Vault key names this cron task may read via the vault-broker daemon. " + "Empty by default \u2014 broker requests for unlisted keys are denied. " + "Note: this is misconfiguration protection (a typo in cron-A doesn't " + "accidentally read cron-B's keys) rather than a security boundary \u2014 " + "anyone who can edit cron scripts can also edit switchroom.yaml, and " + "anyone with the vault passphrase can read the vault file directly. " + "See docs/configuration.md for the full framing.")
   });
   AgentSoulSchema = exports_external.object({
@@ -23660,6 +23675,7 @@ var init_schema = __esm(() => {
     resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale.")
   }).optional();
   TelegramChannelSchema = exports_external.object({
+    enabled: exports_external.boolean().default(true).describe("Master switch for the per-agent Telegram gateway sidecar. " + "When false, start.sh skips the gateway supervise loop and the " + "agent boots without bot-token requirements (smoke-test + " + "offline-dev use case)."),
     plugin: exports_external.enum(["switchroom", "official"]).optional().describe("Which Telegram MCP plugin to load. Default is 'switchroom' \u2014 the " + "enhanced fork with streaming edits, reactions, history, and " + "access control. Set to 'official' for the upstream marketplace " + "plugin (basic send/receive only)."),
     format: exports_external.enum(["html", "markdownv2", "text"]).optional().describe("Default reply format passed to the plugin"),
     rate_limit_ms: exports_external.number().optional().describe("Minimum delay between outgoing messages in ms"),
@@ -23724,6 +23740,9 @@ var init_schema = __esm(() => {
     tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet \u2014 see RFC G \u00a75).")
   }).optional();
   AgentGoogleWorkspaceConfigSchema = exports_external.object({
+    account: exports_external.string().regex(/^[^@\s:]+@[^@\s:]+\.[^@\s:]+$/, {
+      message: "google_workspace.account must be a Google account email like " + "'alice@example.com' (colons not allowed)"
+    }).transform((v) => v.trim().toLowerCase()).optional().describe("RFC G: the Google account this agent uses for the Workspace MCP. " + "Must be a key in top-level `google_accounts:` with this agent " + "listed in its `enabled_for[]`. Read by the auth-broker " + "(get-credentials, provider=google) and by the scaffold to decide " + "whether to emit the `gdrive` MCP entry. Normalized to lowercase " + "so it matches the google_accounts key (which is also normalized)."),
     approvers: exports_external.array(ApproverIdSchema).min(1).optional().describe("Per-agent approver override. When set, replaces (does not extend) " + "the top-level drive.approvers list for this agent's onboarding card."),
     tier: GoogleWorkspaceTierSchema.optional().describe("Per-agent tier override (RFC G Phase 1). When set, replaces the " + "top-level google_workspace.tier for this agent. Common case: most " + "agents on `core`, one specialist on `extended` for Slides access.")
   }).optional();
@@ -23734,9 +23753,17 @@ var init_schema = __esm(() => {
     per_hour_cap: exports_external.number().int().nonnegative().optional().describe("Max reaction-triggered synthetic turns per chat per rolling hour. " + "Refusals are stderr-logged but not surfaced to the agent. " + "Default 10. Set to 0 to disable triggering via the cap path."),
     group_admin_only: exports_external.boolean().optional().describe("In groups/supergroups (negative chat_id), only trigger a synthetic " + "turn when the reacter is a chat admin (creator or administrator). " + "Failing the lookup is treated as non-admin (fail-closed). " + "DMs are never affected by this flag \u2014 the reacter IS the user. " + "Default true.")
   }).optional();
+  ReleaseBlock = exports_external.object({
+    channel: exports_external.enum(["dev", "rc", "latest"]).optional(),
+    pin: exports_external.string().regex(/^(sha-[0-9a-f]{7,40}|v\d+\.\d+\.\d+)$/).optional()
+  }).strict().refine((r) => !(r.channel && r.pin), {
+    message: "release.channel and release.pin are mutually exclusive"
+  });
+  NetworkIsolationSchema = exports_external.enum(["host", "strict"]).optional().describe("Container network mode (sec WS6-F1 #1390 / feature #1413). " + "'host' (DEFAULT when unset): `network_mode: host` \u2014 the agent " + "shares the host network stack; hindsight 127.0.0.1:18888 and " + "operator-LAN devices are reachable, but there is NO network " + "isolation from sibling agents or host services (the documented, " + "deliberate shared-host tradeoff). 'strict': the agent joins its " + "OWN dedicated docker bridge network instead \u2014 it cannot reach " + "sibling agents; host services are reached via " + "`host.docker.internal`. OPT-IN: validate hindsight / operator-" + "LAN / cron / boot-self-test paths for your deployment before " + "adopting fleet-wide (default-flip is deferred to that validation " + "cycle, #1413). Cascades override (agent \u2192 profile \u2192 defaults).");
   profileFields = {
     extends: exports_external.string().optional(),
     bot_token: exports_external.string().optional(),
+    release: ReleaseBlock.optional().describe("Release-channel pin / pointer. Either `channel` (dev|rc|latest) or " + "`pin` (sha-<hex>|v<semver>) \u2014 mutually exclusive. Per-agent value " + "REPLACES the root entirely (no field merge)."),
     timezone: exports_external.string().regex(TIMEZONE_REGEX, "timezone must be an IANA zone name like 'Australia/Melbourne' or 'UTC' " + "(three-letter aliases like EST/PST and bare offsets like UTC+10 are not accepted)").optional().describe("IANA timezone name (e.g. 'Australia/Melbourne', 'America/New_York', " + "'UTC'). Used to generate the per-turn local-time hint the agent's " + "UserPromptSubmit timezone hook emits, and baked into the systemd " + "unit as TZ= so subprocess `date`/`Date.now()` are correct. If unset " + "at every cascade layer, switchroom auto-detects from /etc/timezone " + "and warns on `reconcile` when the detected zone is UTC."),
     soul: exports_external.object({
       name: exports_external.string().optional(),
@@ -23773,8 +23800,8 @@ var init_schema = __esm(() => {
     session: SessionSchema,
     session_continuity: SessionContinuitySchema,
     channels: ChannelsSchema,
+    network_isolation: NetworkIsolationSchema,
     dangerous_mode: exports_external.boolean().optional(),
-    skip_permission_prompt: exports_external.boolean().optional(),
     settings_raw: exports_external.record(exports_external.string(), exports_external.unknown()).optional(),
     claude_md_raw: exports_external.string().optional(),
     cli_args: exports_external.array(exports_external.string()).optional(),
@@ -23796,6 +23823,7 @@ var init_schema = __esm(() => {
   AgentSchema = exports_external.object({
     extends: exports_external.string().optional().describe("Name of a profile to inherit from (e.g., 'coding', 'health-coach'). " + "Profiles may be defined inline under switchroom.yaml `profiles:` or as a " + "filesystem directory `profiles/<name>/`. Defaults to DEFAULT_PROFILE " + "('default') when unset."),
     bot_token: exports_external.string().optional().describe("Per-agent Telegram bot token or vault reference (overrides global telegram.bot_token)"),
+    release: ReleaseBlock.optional().describe("Per-agent release-channel pin / pointer. REPLACES the root " + "`release` block entirely (no field merge) \u2014 a pinned agent does " + "not inherit the fleet channel, and vice versa."),
     bot_username: exports_external.string().optional().describe("Per-agent Telegram bot username (without leading @) when it doesn't " + "contain the agent slug. Replaces the default 'username includes slug' " + "preflight check with an exact (case-insensitive) match. Use when an " + "agent and its bot have intentionally divergent names (e.g. agent " + "'lawgpt' paired with bot '@meken_law_bot')."),
     timezone: exports_external.string().regex(TIMEZONE_REGEX, "timezone must be an IANA zone name like 'Australia/Melbourne' or 'UTC' " + "(three-letter aliases like EST/PST and bare offsets like UTC+10 are not accepted)").optional().describe("Per-agent IANA timezone override. Wins over any profile/defaults " + "value and over the top-level switchroom.timezone global. Controls " + "the UserPromptSubmit timezone hook's emitted local time and the " + "systemd unit's TZ= env."),
     auth: exports_external.object({
@@ -23840,7 +23868,7 @@ var init_schema = __esm(() => {
     session_continuity: SessionContinuitySchema.describe("Handoff-briefing settings. When enabled (default), a Stop hook " + "summarizes each session at shutdown and start.sh injects that " + "briefing into the next session via --append-system-prompt."),
     channels: ChannelsSchema.describe("Per-channel configuration. Today only `telegram` is defined; the " + "shape is designed to expand to other channels (Slack, Discord, " + "Matrix, Email) as they're added."),
     dangerous_mode: exports_external.boolean().optional().describe("If true, include --dangerously-skip-permissions in start.sh"),
-    skip_permission_prompt: exports_external.boolean().optional().describe("DEPRECATED no-op (accepted for backwards compatibility). Claude Code " + "ignores skipDangerousModePermissionPrompt at project scope; autoaccept " + "(src/agents/autoaccept.ts) handles the bypass-mode prompt instead. " + "Safe to remove from switchroom.yaml."),
+    network_isolation: NetworkIsolationSchema,
     admin: exports_external.boolean().optional().describe("If true, the agent's Telegram gateway intercepts admin slash commands " + "(/agents, /logs, /restart, /delete, /update, /auth, /reconcile, etc.) " + "locally before forwarding to Claude. Commands are handled silently \u2014 " + "Claude never sees them. Requires the agent to use the switchroom-telegram " + "plugin. When false or absent, all messages pass through to Claude unchanged."),
     settings_raw: exports_external.record(exports_external.string(), exports_external.unknown()).optional().describe("Escape hatch: raw object deep-merged into the generated " + "settings.json as the final step. Use for Claude Code settings " + "keys switchroom doesn't wrap directly (e.g. effort, apiKeyHelper). " + "Power-user-only \u2014 prefer the typed fields when they exist."),
     claude_md_raw: exports_external.string().optional().describe("Escape hatch: markdown text appended verbatim to CLAUDE.md on " + "initial scaffold. Not re-applied on reconcile (CLAUDE.md is " + "user-protected). Use for one-off persona tuning that isn't " + "worth a template."),
@@ -23917,6 +23945,7 @@ var init_schema = __esm(() => {
       timezone: exports_external.string().regex(TIMEZONE_REGEX, "timezone must be an IANA zone name like 'Australia/Melbourne' or 'UTC'").optional().describe("Global default IANA timezone applied to every agent unless the " + "agent (or its profile) declares its own. See the per-agent " + "timezone field for the full cascade and auto-detection fallback.")
     }),
     telegram: TelegramConfigSchema,
+    release: ReleaseBlock.optional().describe("Fleet-wide default release-channel pin / pointer for the update " + "flow. Either `channel` (dev|rc|latest) or `pin` (sha-<hex>|v<semver>) " + "\u2014 mutually exclusive. Per-agent `release` REPLACES this entirely."),
     memory: MemoryBackendConfigSchema.optional(),
     vault: VaultConfigSchema.optional(),
     auth: exports_external.object({
@@ -23955,6 +23984,13 @@ import { resolve as resolve2 } from "node:path";
 function home() {
   return process.env.HOME ?? "/root";
 }
+function warnLegacyStateOnce(legacy) {
+  if (_legacyStateWarned)
+    return;
+  _legacyStateWarned = true;
+  process.stderr.write(`[switchroom] DEPRECATED: reading legacy state from ${legacy}. ` + "Run `mv ~/.clerk ~/.switchroom` (and rename any top-level `clerk:` " + "key in switchroom.yaml to `switchroom:`). This back-compat shim is " + `REMOVED in v0.13.0 \u2014 no automatic migration exists.
+`);
+}
 function resolveDualPath(pathStr) {
   const h = home();
   if (pathStr.startsWith("~/")) {
@@ -23964,15 +24000,17 @@ function resolveDualPath(pathStr) {
       const frag = rest.slice(DEFAULT_STATE_DIR.length + 1);
       if (!existsSync7(absolute)) {
         const legacy = resolve2(h, LEGACY_STATE_DIR, frag);
-        if (existsSync7(legacy))
+        if (existsSync7(legacy)) {
+          warnLegacyStateOnce(legacy);
           return legacy;
+        }
       }
     }
     return absolute;
   }
   return resolve2(pathStr);
 }
-var DEFAULT_STATE_DIR = ".switchroom", LEGACY_STATE_DIR = ".clerk";
+var DEFAULT_STATE_DIR = ".switchroom", LEGACY_STATE_DIR = ".clerk", _legacyStateWarned = false;
 var init_paths = () => {};
 
 // ../src/config/overlay-schema.ts
@@ -24607,11 +24645,8 @@ function formatResetRelative(target, now = new Date) {
   const remH = hours % 24;
   return remH > 0 ? `resets in ${days}d ${remH}h` : `resets in ${days}d`;
 }
-var OAUTH_BETA = "oauth-2025-04-20", DEFAULT_USER_AGENT = "claude-cli/1.0.0 (external, cli)", DEFAULT_PROBE_MODEL = "claude-haiku-4-5-20251001", ACCOUNT_QUOTA_CACHE_TTL_MS, accountQuotaCache;
-var init_quota_check = __esm(() => {
-  ACCOUNT_QUOTA_CACHE_TTL_MS = 5 * 60000;
-  accountQuotaCache = new Map;
-});
+var OAUTH_BETA = "oauth-2025-04-20", DEFAULT_USER_AGENT = "claude-cli/1.0.0 (external, cli)", DEFAULT_PROBE_MODEL = "claude-haiku-4-5-20251001";
+var init_quota_check = () => {};
 
 // ../src/vault/broker/protocol.ts
 function encodeRequest2(req) {
@@ -24709,7 +24744,7 @@ var init_protocol2 = __esm(() => {
   ApprovalConsumeRequestSchema = exports_external.object({
     v: exports_external.literal(1),
     op: exports_external.literal("approval_consume"),
-    request_id: exports_external.string().regex(/^[0-9a-f]{8}$/)
+    request_id: exports_external.string().regex(/^[0-9a-f]{32}$/)
   });
   ApprovalRevokeRequestSchema = exports_external.object({
     v: exports_external.literal(1),
@@ -24733,7 +24768,7 @@ var init_protocol2 = __esm(() => {
   ApprovalRecordRequestSchema = exports_external.object({
     v: exports_external.literal(1),
     op: exports_external.literal("approval_record"),
-    request_id: exports_external.string().regex(/^[0-9a-f]{8}$/),
+    request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
     decision: ApprovalDecisionModeSchema,
     approver_set: exports_external.array(exports_external.string()),
     granted_by_user_id: exports_external.number().int(),
@@ -24921,11 +24956,10 @@ import * as fs from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { join as join16 } from "node:path";
 function defaultBrokerSocketPath() {
-  if (isDockerRuntime()) {
-    if (fs.existsSync(OPERATOR_SOCKET_PATH))
-      return OPERATOR_SOCKET_PATH;
+  if (fs.existsSync(OPERATOR_SOCKET_PATH))
+    return OPERATOR_SOCKET_PATH;
+  if (isDockerRuntime())
     return OPERATOR_SOCKET_PATH;
-  }
   return LEGACY_SOCKET_PATH;
 }
 function vaultTokenFilePath(agentSlug) {
@@ -25207,7 +25241,7 @@ function deriveSlug(inputs, existing) {
   return `${base}_${n}`;
 }
 
-// ../node_modules/.bun/boundary@2.0.0/node_modules/boundary/lib/index.js
+// ../../switchroom/node_modules/.bun/boundary@2.0.0/node_modules/boundary/lib/index.js
 var require_lib = __commonJS((exports2) => {
   Object.defineProperty(exports2, "__esModule", { value: true });
   exports2.binarySearch = exports2.upperBound = exports2.lowerBound = exports2.compare = undefined;
@@ -25254,7 +25288,7 @@ var require_lib = __commonJS((exports2) => {
   exports2.binarySearch = binarySearch;
 });
 
-// ../node_modules/.bun/structured-source@4.0.0/node_modules/structured-source/lib/structured-source.js
+// ../../switchroom/node_modules/.bun/structured-source@4.0.0/node_modules/structured-source/lib/structured-source.js
 var require_structured_source = __commonJS((exports2) => {
   Object.defineProperty(exports2, "__esModule", { value: true });
   exports2.StructuredSource = undefined;
@@ -25309,13 +25343,13 @@ var require_structured_source = __commonJS((exports2) => {
   }
   exports2.StructuredSource = StructuredSource;
 });
-// ../node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/SecretLintSourceCodeImpl.js
+// ../../switchroom/node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/SecretLintSourceCodeImpl.js
 var import_structured_source;
 var init_SecretLintSourceCodeImpl = __esm(() => {
   import_structured_source = __toESM(require_structured_source(), 1);
 });
 
-// ../node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/helper/promise-event-emitter.js
+// ../../switchroom/node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/helper/promise-event-emitter.js
 class EventEmitter {
   #listeners = new Map;
   on(type, listener) {
@@ -25354,9 +25388,9 @@ class EventEmitter {
     return Array.from(this.#listeners.get(type) ?? []);
   }
 }
-// ../node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/RuleContext.js
+// ../../switchroom/node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/RuleContext.js
 var init_RuleContext = () => {};
-// ../node_modules/.bun/@secretlint+profiler@12.2.0/node_modules/@secretlint/profiler/module/index.js
+// ../../switchroom/node_modules/.bun/@secretlint+profiler@12.2.0/node_modules/@secretlint/profiler/module/index.js
 class SecretLintProfiler {
   perf;
   entries = [];
@@ -25413,7 +25447,7 @@ class SecretLintProfiler {
   }
 }
 
-// ../node_modules/.bun/@secretlint+profiler@12.2.0/node_modules/@secretlint/profiler/module/node.js
+// ../../switchroom/node_modules/.bun/@secretlint+profiler@12.2.0/node_modules/@secretlint/profiler/module/node.js
 import perf_hooks from "node:perf_hooks";
 
 class NullPerformanceObserver {
@@ -25428,19 +25462,19 @@ var init_node = __esm(() => {
   });
 });
 
-// ../node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/RunningEvents.js
+// ../../switchroom/node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/RunningEvents.js
 var init_RunningEvents = __esm(() => {
   init_node();
 });
 
-// ../node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/RulePresetContext.js
+// ../../switchroom/node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/RulePresetContext.js
 var init_RulePresetContext = __esm(() => {
   init_RuleContext();
 });
-// ../node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/messages/index.js
+// ../../switchroom/node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/messages/index.js
 var init_messages = () => {};
 
-// ../node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/index.js
+// ../../switchroom/node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/index.js
 var import_debug, debug;
 var init_module = __esm(() => {
   init_SecretLintSourceCodeImpl();
@@ -25453,7 +25487,7 @@ var init_module = __esm(() => {
   debug = import_debug.default("@secretlint/core");
 });
 
-// ../node_modules/.bun/@secretlint+secretlint-rule-preset-recommend@12.2.0/node_modules/@secretlint/secretlint-rule-preset-recommend/module/index.js
+// ../../switchroom/node_modules/.bun/@secretlint+secretlint-rule-preset-recommend@12.2.0/node_modules/@secretlint/secretlint-rule-preset-recommend/module/index.js
 function requireLodash_uniq() {
   if (hasRequiredLodash_uniq)
     return lodash_uniq;
@@ -27695,35 +27729,45 @@ async function probeGateway(info) {
     return { status: "ok", label: "Gateway", detail: parts.join(" \u00b7 ") };
   })());
 }
-async function probeQuota(claudeConfigDir, _agentDir, fetchImpl = fetch) {
+async function probeQuota(claudeConfigDir, _agentDir, fetchImpl = fetch, opts = {}) {
   return withTimeout("Quota", (async () => {
     const cached = readQuotaCache();
     if (cached) {
       return cached;
     }
-    let claudeDirForProbe = null;
-    for (const candidate of [
-      claudeConfigDir,
-      join21(claudeConfigDir, "accounts", "default")
-    ]) {
-      if (existsSync23(join21(candidate, ".oauth-token"))) {
-        claudeDirForProbe = candidate;
-        break;
+    let probe = null;
+    if (opts.brokerProbe) {
+      try {
+        probe = await opts.brokerProbe(QUOTA_BROKER_TIMEOUT_MS);
+      } catch {
+        probe = null;
       }
     }
-    if (!claudeDirForProbe) {
-      return {
-        status: "degraded",
-        label: "Quota",
-        detail: "no OAuth token",
-        nextStep: "No OAuth token on disk \u2014 register a fleet account: `switchroom auth add <label> --from-oauth` then `switchroom auth use <label>` (RFC H)"
-      };
+    if (!probe) {
+      let claudeDirForProbe = null;
+      for (const candidate of [
+        claudeConfigDir,
+        join21(claudeConfigDir, "accounts", "default")
+      ]) {
+        if (existsSync23(join21(candidate, ".oauth-token"))) {
+          claudeDirForProbe = candidate;
+          break;
+        }
+      }
+      if (!claudeDirForProbe) {
+        return {
+          status: "degraded",
+          label: "Quota",
+          detail: "no OAuth token",
+          nextStep: "No OAuth token on disk \u2014 register a fleet account: `switchroom auth add <label> --from-oauth` then `switchroom auth use <label>` (RFC H)"
+        };
+      }
+      probe = await fetchQuota({
+        claudeConfigDir: claudeDirForProbe,
+        fetchImpl,
+        timeoutMs: QUOTA_DIRECT_FALLBACK_TIMEOUT_MS
+      });
     }
-    const probe = await fetchQuota({
-      claudeConfigDir: claudeDirForProbe,
-      fetchImpl,
-      timeoutMs: 1800
-    });
     if (!probe.ok) {
       const isAuth = /auth rejected|HTTP 401|HTTP 403/i.test(probe.reason);
       return {
@@ -27740,7 +27784,7 @@ async function probeQuota(claudeConfigDir, _agentDir, fetchImpl = fetch) {
     };
     writeQuotaCache(result);
     return result;
-  })());
+  })(), QUOTA_PROBE_OUTER_TIMEOUT_MS);
 }
 async function probeHindsight(bankName, fetchImpl = fetch) {
   return withTimeout("Hindsight", (async () => {
@@ -27761,7 +27805,7 @@ async function probeHindsight(bankName, fetchImpl = fetch) {
         status: "fail",
         label: "Hindsight",
         detail: "unreachable",
-        nextStep: "Hindsight server not responding on 127.0.0.1:18888 \u2014 start it with `hindsight serve` or check `systemctl --user status hindsight`"
+        nextStep: process.env.SWITCHROOM_RUNTIME === "docker" ? "Hindsight server not responding on 127.0.0.1:18888 \u2014 check the hindsight container (`docker ps` / `docker logs`); it must be reachable on the host network." : "Hindsight server not responding on 127.0.0.1:18888 \u2014 start it with `hindsight serve` (or check `systemctl --user status hindsight`)."
       };
     }
     const bankSuffix = bankName ? ` \u00b7 bank=${bankName}` : "";
@@ -27965,8 +28009,26 @@ async function probeSkills(agentDir, opts = {}) {
         continue;
       }
     }
+    const overlayDir = opts.overlaySkillsDir ?? join21(agentDir, "skills.d");
+    const overlaySlugs = new Set;
+    if (fs2.exists(overlayDir)) {
+      let overlayEntries = [];
+      try {
+        overlayEntries = fs2.readdir(overlayDir);
+      } catch {}
+      for (const name of overlayEntries) {
+        const m = name.match(/^(.+)\.ya?ml$/i);
+        if (!m)
+          continue;
+        overlaySlugs.add(m[1]);
+      }
+    }
+    const liveEntries = entries.filter((n) => !dangling.includes(n)).sort();
+    const switchroomSkills = liveEntries.filter((n) => !overlaySlugs.has(n));
+    const agentSkills = liveEntries.filter((n) => overlaySlugs.has(n));
+    const bucketed = renderBucketedSkills(switchroomSkills, agentSkills);
     if (dangling.length === 0) {
-      return { status: "ok", label: "Skills", detail: `${entries.length} resolved` };
+      return { status: "ok", label: "Skills", detail: bucketed };
     }
     const named = dangling.slice(0, max).join(", ");
     const more = dangling.length > max ? ` +${dangling.length - max} more` : "";
@@ -27974,12 +28036,20 @@ async function probeSkills(agentDir, opts = {}) {
     return {
       status: "degraded",
       label: "Skills",
-      detail: `${dangling.length}/${entries.length} dangling: ${named}${more}`,
+      detail: `${dangling.length}/${entries.length} dangling: ${named}${more} \u00b7 ${bucketed}`,
       nextStep: `Run \`switchroom agent reconcile${reconcileTarget}\` to rebuild symlinks, or remove unused entries from switchroom.yaml`
     };
   })());
 }
-var execFile3, PROBE_TIMEOUT_MS = 2000, TOKEN_EXPIRING_SOON_DAYS = 7, AGENT_RETRY_INTERVAL_MS = 1500, AGENT_RETRY_MAX_MS = 12000, AGENT_LIVE_WINDOW_MS = 45000, AGENT_LIVE_POLL_INTERVAL_MS = 2000, AGENT_LIVE_FOLLOWUP_REPOLL_MS = 30000, realProcFs, SCHEDULER_LOCK_PATH_DEFAULT = "/state/agent/scheduler.lock", SCHEDULER_JSONL_PATH_DEFAULT = "/state/agent/scheduler.jsonl", SCHEDULER_FRESH_BOOT_MS = 30000, realSchedulerFs, realSkillsFs;
+function renderBucketedSkills(switchroom, agent) {
+  const parts = [];
+  if (switchroom.length > 0)
+    parts.push(`Switchroom: ${switchroom.join(", ")}`);
+  if (agent.length > 0)
+    parts.push(`Agent: ${agent.join(", ")}`);
+  return parts.length === 0 ? "none resolved" : parts.join(" \u00b7 ");
+}
+var execFile3, PROBE_TIMEOUT_MS = 2000, QUOTA_BROKER_TIMEOUT_MS = 7000, QUOTA_DIRECT_FALLBACK_TIMEOUT_MS = 5000, QUOTA_PROBE_OUTER_TIMEOUT_MS = 9000, TOKEN_EXPIRING_SOON_DAYS = 7, AGENT_RETRY_INTERVAL_MS = 1500, AGENT_RETRY_MAX_MS = 12000, AGENT_LIVE_WINDOW_MS = 45000, AGENT_LIVE_POLL_INTERVAL_MS = 2000, AGENT_LIVE_FOLLOWUP_REPOLL_MS = 30000, realProcFs, SCHEDULER_LOCK_PATH_DEFAULT = "/state/agent/scheduler.lock", SCHEDULER_JSONL_PATH_DEFAULT = "/state/agent/scheduler.jsonl", SCHEDULER_FRESH_BOOT_MS = 30000, realSchedulerFs, realSkillsFs;
 var init_boot_probes = __esm(() => {
   init_quota_cache();
   init_quota_check();
@@ -28200,7 +28270,8 @@ function renderBootCard(opts) {
   if (restartReason === "crash") {
     const ageStr = restartAgeMs != null && restartAgeMs > 0 ? ` \u00b7 ${(restartAgeMs / 1000).toFixed(1)}s ago` : "";
     degradedRows.push(`\u26a0\ufe0f <b>Restart</b>  ${escapeHtml8(REASON_LABEL.crash)}${ageStr}`);
-    degradedRows.push(`    \u21b3 Tail logs: <code>journalctl --user -u switchroom-${escapeHtml8(agentSlug)} -n 100</code>`);
+    const tailCmd = process.env.SWITCHROOM_RUNTIME === "docker" ? `docker logs --tail 100 switchroom-${escapeHtml8(agentSlug)}` : `journalctl --user -u switchroom-${escapeHtml8(agentSlug)} -n 100`;
+    degradedRows.push(`    \u21b3 Tail logs: <code>${tailCmd}</code>`);
   }
   if (probes) {
     for (const key of PROBE_KEYS) {
@@ -28224,6 +28295,10 @@ function renderBootCard(opts) {
     sections.push("", ...degradedRows);
   if (accountRows.length > 0)
     sections.push("", ...accountRows);
+  if (opts.updateOutcomeLine) {
+    sections.push("", ...opts.updateOutcomeLine.split(`
+`));
+  }
   if (sections.length === 1)
     return ack;
   return sections.join(`
@@ -28243,7 +28318,7 @@ async function runAllProbes(opts) {
     probeGateway(opts.gatewayInfo).then((r) => {
       probes.gateway = r;
     }),
-    probeQuota(claudeDir, opts.agentDir, opts.fetchImpl).then((r) => {
+    probeQuota(claudeDir, opts.agentDir, opts.fetchImpl, { brokerProbe: opts.probeQuotaViaBroker }).then((r) => {
       probes.quota = r;
     }),
     probeHindsight(opts.bankName, opts.fetchImpl).then((r) => {
@@ -28273,7 +28348,8 @@ async function startBootCard(chatId, threadId, bot, opts, ackMessageId, log) {
     agentSlug: opts.agentSlug,
     version: opts.version,
     restartReason: opts.restartReason,
-    restartAgeMs: opts.restartAgeMs
+    restartAgeMs: opts.restartAgeMs,
+    ...opts.updateOutcomeLine ? { updateOutcomeLine: opts.updateOutcomeLine } : {}
   });
   const silentBootCard = opts.restartReasonDetail?.startsWith("operator:") === true;
   let messageId;
@@ -28338,7 +28414,8 @@ async function startBootCard(chatId, threadId, bot, opts, ackMessageId, log) {
           restartAgeMs: opts.restartAgeMs,
           ...accountRows ? { accounts: accountRows } : {},
           ...resolvedRows.length > 0 ? { resolvedRows } : {},
-          ...snoozeRows.length > 0 ? { snoozeRows } : {}
+          ...snoozeRows.length > 0 ? { snoozeRows } : {},
+          ...opts.updateOutcomeLine ? { updateOutcomeLine: opts.updateOutcomeLine } : {}
         });
         if (currentText !== ackText) {
           try {
@@ -28379,7 +28456,8 @@ async function startBootCard(chatId, threadId, bot, opts, ackMessageId, log) {
             restartAgeMs: opts.restartAgeMs,
             ...accountRows ? { accounts: accountRows } : {},
             ...resolvedRows.length > 0 ? { resolvedRows } : {},
-            ...snoozeRows.length > 0 ? { snoozeRows } : {}
+            ...snoozeRows.length > 0 ? { snoozeRows } : {},
+            ...opts.updateOutcomeLine ? { updateOutcomeLine: opts.updateOutcomeLine } : {}
           });
           if (updatedText === currentText)
             continue;
@@ -28469,11 +28547,11 @@ var init_flock = () => {};
 // ../src/vault/vault.ts
 import { randomBytes as randomBytes5, scryptSync, createCipheriv, createDecipheriv } from "node:crypto";
 import {
-  readFileSync as readFileSync29,
+  readFileSync as readFileSync30,
   writeFileSync as writeFileSync19,
-  existsSync as existsSync30,
+  existsSync as existsSync31,
   renameSync as renameSync11,
-  mkdirSync as mkdirSync17,
+  mkdirSync as mkdirSync18,
   unlinkSync as unlinkSync12,
   lstatSync,
   realpathSync
@@ -28509,12 +28587,12 @@ function normalizeSecrets(raw) {
   return out;
 }
 function openVault(passphrase, vaultPath) {
-  if (!existsSync30(vaultPath)) {
+  if (!existsSync31(vaultPath)) {
     throw new VaultError(`Vault file not found: ${vaultPath}`);
   }
   let vaultFile;
   try {
-    vaultFile = JSON.parse(readFileSync29(vaultPath, "utf8"));
+    vaultFile = JSON.parse(readFileSync30(vaultPath, "utf8"));
   } catch {
     throw new VaultError(`Failed to read vault file: ${vaultPath}`);
   }
@@ -28560,15 +28638,15 @@ var init_vault = __esm(() => {
 // ../src/vault/resolver.ts
 import {
   chmodSync as chmodSync4,
-  closeSync as closeSync6,
-  mkdirSync as mkdirSync18,
+  closeSync as closeSync7,
+  mkdirSync as mkdirSync19,
   mkdtempSync as mkdtempSync2,
-  openSync as openSync6,
+  openSync as openSync7,
   rmSync as rmSync3,
   statSync as statSync11,
   writeSync as writeSync2
 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join31 } from "node:path";
 import { tmpdir } from "node:os";
 import { constants as fsConstants } from "node:fs";
 function isVaultReference(value) {
@@ -28620,32 +28698,32 @@ function materializationRoot() {
     return cachedRoot;
   const xdg = process.env.XDG_RUNTIME_DIR;
   if (xdg) {
-    const base = join29(xdg, "switchroom", "vault");
-    mkdirSync18(base, { recursive: true, mode: 448 });
-    cachedRoot = mkdtempSync2(join29(base, "run-"));
+    const base = join31(xdg, "switchroom", "vault");
+    mkdirSync19(base, { recursive: true, mode: 448 });
+    cachedRoot = mkdtempSync2(join31(base, "run-"));
   } else {
-    cachedRoot = mkdtempSync2(join29(tmpdir(), "switchroom-vault-"));
+    cachedRoot = mkdtempSync2(join31(tmpdir(), "switchroom-vault-"));
   }
   chmodSync4(cachedRoot, 448);
   return cachedRoot;
 }
 function writeFileExclusive(filePath, content) {
   const buf = typeof content === "string" ? Buffer.from(content, "utf8") : content;
-  const fd = openSync6(filePath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
+  const fd = openSync7(filePath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
   try {
     writeSync2(fd, buf);
   } finally {
-    closeSync6(fd);
+    closeSync7(fd);
   }
 }
 function materializeFilesEntry(key, files) {
-  const dir = join29(materializationRoot(), key);
+  const dir = join31(materializationRoot(), key);
   if (materializedDirs.has(dir)) {
     try {
       rmSync3(dir, { recursive: true, force: true });
     } catch {}
   }
-  mkdirSync18(dir, { recursive: true, mode: 448 });
+  mkdirSync19(dir, { recursive: true, mode: 448 });
   chmodSync4(dir, 448);
   const st = statSync11(dir);
   if (typeof process.getuid === "function" && st.uid !== process.getuid()) {
@@ -28655,7 +28733,7 @@ function materializeFilesEntry(key, files) {
     if (filename.includes("/") || filename.includes("\\") || filename === ".." || filename === "." || filename.includes("\x00")) {
       throw new Error(`Refusing to materialize vault file with unsafe name: ${filename}`);
     }
-    const filePath = join29(dir, filename);
+    const filePath = join31(dir, filename);
     const content = encoding === "base64" ? Buffer.from(value, "base64") : value;
     writeFileExclusive(filePath, content);
   }
@@ -28788,7 +28866,7 @@ __export(exports_materialize_bot_token, {
   materializeBotToken: () => materializeBotToken,
   BotTokenMaterializeError: () => BotTokenMaterializeError
 });
-import { existsSync as existsSync31 } from "node:fs";
+import { existsSync as existsSync32 } from "node:fs";
 function pickConfiguredToken(config, agentName3) {
   if (agentName3) {
     const agent = config.agents?.[agentName3];
@@ -28802,7 +28880,7 @@ function tryDirectVaultRead(ref, config, passphrase) {
   if (!passphrase)
     return null;
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (!existsSync31(vaultPath))
+  if (!existsSync32(vaultPath))
     return null;
   try {
     const secrets = openVault(passphrase, vaultPath);
@@ -28854,7 +28932,7 @@ async function materializeBotToken(opts = {}) {
     }
   }
   if (!brokerResult.ok && brokerResult.reason === "locked") {
-    throw new BotTokenMaterializeError("Bot token is a vault reference but vault is locked. Run: switchroom vault unlock", "locked");
+    throw new BotTokenMaterializeError("Bot token is a vault reference but the vault is locked. Run `switchroom vault broker unlock` (or set SWITCHROOM_VAULT_PASSPHRASE / enable auto-unlock).", "locked");
   }
   if (!brokerResult.ok && brokerResult.reason === "denied") {
     throw new BotTokenMaterializeError(`Bot token resolution denied by vault broker (ACL). Check that this unit is authorised for the bot_token key in switchroom.yaml.`, "denied");
@@ -28869,7 +28947,7 @@ async function materializeBotToken(opts = {}) {
     }
     return direct;
   }
-  const unlockHint = isDockerRuntime() ? "Bring up the project (docker compose -p switchroom up -d), then `switchroom vault broker unlock` (or `docker exec -it switchroom-vault-broker switchroom vault broker unlock`), or set SWITCHROOM_VAULT_PASSPHRASE." : "Start the broker (switchroom vault unlock) or set SWITCHROOM_VAULT_PASSPHRASE.";
+  const unlockHint = isDockerRuntime() ? "Bring up the project (docker compose -p switchroom up -d), then `switchroom vault broker unlock` (or `docker exec -it switchroom-vault-broker switchroom vault broker unlock`), or set SWITCHROOM_VAULT_PASSPHRASE." : "Start + unlock the broker (`switchroom vault broker unlock`) or set SWITCHROOM_VAULT_PASSPHRASE.";
   throw new BotTokenMaterializeError(`Bot token is a vault reference (${configured}) but vault broker is unreachable and no SWITCHROOM_VAULT_PASSPHRASE is available for direct decrypt. ` + unlockHint, brokerResult.ok ? "unknown" : brokerResult.reason);
 }
 var BotTokenMaterializeError;
@@ -28894,7 +28972,7 @@ __export(exports_tmux, {
   captureAgentPane: () => captureAgentPane
 });
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { mkdirSync as mkdirSync19, readdirSync as readdirSync6, statSync as statSync12, unlinkSync as unlinkSync13, writeFileSync as writeFileSync20 } from "node:fs";
+import { mkdirSync as mkdirSync20, readdirSync as readdirSync6, statSync as statSync12, unlinkSync as unlinkSync13, writeFileSync as writeFileSync20 } from "node:fs";
 import { resolve as resolve7 } from "node:path";
 function captureAgentPane(opts) {
   const { agentName: agentName3, agentDir, reason } = opts;
@@ -28906,7 +28984,7 @@ function captureAgentPane(opts) {
   const reasonSlug = sanitizeReason(reason);
   const outPath = resolve7(outDir, `${ts}-${reasonSlug}.txt`);
   try {
-    mkdirSync19(outDir, { recursive: true, mode: 493 });
+    mkdirSync20(outDir, { recursive: true, mode: 493 });
   } catch (err) {
     const msg = `mkdir crash-reports failed: ${err.message}`;
     console.error(`[tmux-capture] ${agentName3}: ${msg}`);
@@ -29476,7 +29554,7 @@ function parseApprovalCallback(data) {
     return null;
   const request_id = parts[1];
   const choiceStr = parts[2];
-  if (!/^[0-9a-f]{8}$/.test(request_id ?? ""))
+  if (!/^[0-9a-f]{32}$/.test(request_id ?? ""))
     return null;
   switch (choiceStr) {
     case "once":
@@ -29611,22 +29689,22 @@ var import_runner2 = __toESM(require_mod3(), 1);
 import { randomBytes as randomBytes6 } from "crypto";
 import { execFileSync as execFileSync5, execSync as execSync2, spawn as spawn2 } from "child_process";
 import {
-  readFileSync as readFileSync30,
+  readFileSync as readFileSync31,
   writeFileSync as writeFileSync21,
-  mkdirSync as mkdirSync20,
+  mkdirSync as mkdirSync21,
   readdirSync as readdirSync7,
   rmSync as rmSync4,
   statSync as statSync13,
   renameSync as renameSync12,
   realpathSync as realpathSync2,
   chmodSync as chmodSync5,
-  openSync as openSync7,
-  closeSync as closeSync7,
-  existsSync as existsSync32,
+  openSync as openSync8,
+  closeSync as closeSync8,
+  existsSync as existsSync33,
   unlinkSync as unlinkSync14
 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join30, extname, sep as sep3, basename as basename7 } from "path";
+import { homedir as homedir12 } from "os";
+import { join as join32, extname, sep as sep3, basename as basename7 } from "path";
 
 // plugin-logger.ts
 import { appendFileSync, mkdirSync, renameSync, statSync, existsSync } from "fs";
@@ -31760,6 +31838,12 @@ async function retryWithThreadFallback(retry, send, opts) {
     throw err;
   }
 }
+function isHtmlParseRejectError(err) {
+  if (!(err instanceof import_grammy.GrammyError) || err.error_code !== 400)
+    return false;
+  const d = (err.description || "").toLowerCase();
+  return d.includes("can't parse entities") || d.includes("can\u2019t parse entities") || d.includes("unsupported start tag") || d.includes("unclosed start tag") || d.includes("can't find end of the entity") || d.includes("expected end tag");
+}
 
 // shared/bot-runtime.ts
 var import_grammy3 = __toESM(require_mod2(), 1);
@@ -31924,7 +32008,7 @@ function clear(key) {
   state.delete(key);
 }
 
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/modifiers/module.node.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/modifiers/module.node.mjs
 import { dirname as dirname2, posix, sep as sep2 } from "path";
 function createModulerModifier() {
   const getModuleFromFileName = createGetModuleFromFilename();
@@ -31960,7 +32044,7 @@ function normalizeWindowsPath(path) {
   return path.replace(/^[A-Z]:/, "").replace(/\\/g, "/");
 }
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/featureFlagUtils.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/featureFlagUtils.mjs
 var normalizeFlagsResponse = (flagsResponse) => {
   if ("flags" in flagsResponse) {
     const featureFlags = getFlagValuesFromFlags(flagsResponse.flags);
@@ -32031,7 +32115,7 @@ var parsePayload = (response) => {
   }
 };
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/gzip.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/gzip.mjs
 function isGzipSupported() {
   return "CompressionStream" in globalThis;
 }
@@ -32051,7 +32135,7 @@ async function gzipCompress(input, isDebug = true) {
   }
 }
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/vendor/uuidv7.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/vendor/uuidv7.mjs
 /*! For license information please see uuidv7.mjs.LICENSE.txt */
 var DIGITS = "0123456789abcdef";
 
@@ -32229,7 +32313,7 @@ var defaultGenerator;
 var uuidv7 = () => uuidv7obj().toString();
 var uuidv7obj = () => (defaultGenerator || (defaultGenerator = new V7Generator)).generate();
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/types.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/types.mjs
 var types_PostHogPersistedProperty = /* @__PURE__ */ function(PostHogPersistedProperty) {
   PostHogPersistedProperty["AnonymousId"] = "anonymous_id";
   PostHogPersistedProperty["DistinctId"] = "distinct_id";
@@ -32262,7 +32346,7 @@ var types_PostHogPersistedProperty = /* @__PURE__ */ function(PostHogPersistedPr
   return PostHogPersistedProperty;
 }({});
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/bot-detection.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/bot-detection.mjs
 var DEFAULT_BLOCKED_UA_STRS = [
   "amazonbot",
   "amazonproductbot",
@@ -32351,7 +32435,7 @@ var isBlockedUA = function(ua, customBlockedUserAgents = []) {
     return uaLower.indexOf(blockedUaLower) !== -1;
   });
 };
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/type-utils.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/type-utils.mjs
 var nativeIsArray = Array.isArray;
 var ObjProto = Object.prototype;
 var type_utils_hasOwnProperty = ObjProto.hasOwnProperty;
@@ -32388,7 +32472,7 @@ function isInstanceOf(candidate, base) {
   }
 }
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/number-utils.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/number-utils.mjs
 function clampToRange(value, min, max, logger, fallbackValue) {
   if (min > max) {
     logger.warn("min cannot be greater than max.");
@@ -32408,7 +32492,7 @@ function clampToRange(value, min, max, logger, fallbackValue) {
   return clampToRange(fallbackValue || max, min, max, logger);
 }
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/bucketed-rate-limiter.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/bucketed-rate-limiter.mjs
 var ONE_DAY_IN_MS = 86400000;
 
 class BucketedRateLimiter {
@@ -32452,7 +32536,7 @@ class BucketedRateLimiter {
     this._buckets = {};
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/promise-queue.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/promise-queue.mjs
 class PromiseQueue {
   add(promise) {
     const promiseUUID = uuidv7();
@@ -32478,7 +32562,7 @@ class PromiseQueue {
     this.promiseByIds = {};
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/logger.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/logger.mjs
 function createConsole(consoleLike = console) {
   const lockedMethods = {
     log: consoleLike.log.bind(consoleLike),
@@ -32516,7 +32600,7 @@ var passThrough = (fn) => fn();
 function createLogger(prefix, maybeCall = passThrough) {
   return _createLogger(prefix, maybeCall, createConsole());
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/user-agent-utils.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/user-agent-utils.mjs
 var MOBILE = "Mobile";
 var IOS = "iOS";
 var ANDROID = "Android";
@@ -32773,7 +32857,7 @@ var osMatchers = [
   ]
 ];
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/index.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/utils/index.mjs
 var STRING_FORMAT = "utf8";
 function assert(truthyValue, message) {
   if (!truthyValue || typeof truthyValue != "string" || isEmpty(truthyValue))
@@ -32821,7 +32905,7 @@ function allSettled(promises) {
     reason
   }))));
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/eventemitter.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/eventemitter.mjs
 class SimpleEventEmitter {
   constructor() {
     this.events = {};
@@ -32843,7 +32927,7 @@ class SimpleEventEmitter {
   }
 }
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/posthog-core-stateless.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/posthog-core-stateless.mjs
 class PostHogFetchHttpError extends Error {
   constructor(response, reqByteLength) {
     super("HTTP error while fetching PostHog: status=" + response.status + ", reqByteLength=" + reqByteLength), this.response = response, this.reqByteLength = reqByteLength, this.name = "PostHogFetchHttpError";
@@ -33558,7 +33642,7 @@ class PostHogCoreStateless {
     return this.shutdownPromise;
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/index.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/index.mjs
 var exports_error_tracking = {};
 __export(exports_error_tracking, {
   winjsStackLineParser: () => winjsStackLineParser,
@@ -33582,7 +33666,7 @@ __export(exports_error_tracking, {
   DOMExceptionCoercer: () => DOMExceptionCoercer
 });
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/chunk-ids.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/chunk-ids.mjs
 var parsedStackResults;
 var lastKeysCount;
 var cachedFilenameChunkIds;
@@ -33621,7 +33705,7 @@ function getFilenameToChunkIdMap(stackParser) {
   return cachedFilenameChunkIds;
 }
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/error-properties-builder.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/error-properties-builder.mjs
 var MAX_CAUSE_RECURSION = 4;
 
 class ErrorPropertiesBuilder {
@@ -33743,7 +33827,7 @@ class ErrorPropertiesBuilder {
     return context;
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/base.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/base.mjs
 var UNKNOWN_FUNCTION = "?";
 function createFrame(platform, filename, func, lineno, colno) {
   const frame = {
@@ -33759,7 +33843,7 @@ function createFrame(platform, filename, func, lineno, colno) {
   return frame;
 }
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/safari.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/safari.mjs
 var extractSafariExtensionDetails = (func, filename) => {
   const isSafariExtension = func.indexOf("safari-extension") !== -1;
   const isSafariWebExtension = func.indexOf("safari-web-extension") !== -1;
@@ -33772,7 +33856,7 @@ var extractSafariExtensionDetails = (func, filename) => {
   ];
 };
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/chrome.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/chrome.mjs
 var chromeRegexNoFnName = /^\s*at (\S+?)(?::(\d+))(?::(\d+))\s*$/i;
 var chromeRegex = /^\s*at (?:(.+?\)(?: \[.+\])?|.*?) ?\((?:address at )?)?(?:async )?((?:<anonymous>|[-a-z]+:|.*bundle|\/)?.*?)(?::(\d+))?(?::(\d+))?\)?\s*$/i;
 var chromeEvalRegex = /\((\S*)(?::(\d+))(?::(\d+))\)/;
@@ -33798,7 +33882,7 @@ var chromeStackLineParser = (line, platform) => {
   }
 };
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/gecko.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/gecko.mjs
 var geckoREgex = /^\s*(.*?)(?:\((.*?)\))?(?:^|@)?((?:[-a-z]+)?:\/.*?|\[native code\]|[^@]*(?:bundle|\d+\.js)|\/[\w\-. /=]+)(?::(\d+))?(?::(\d+))?\s*$/i;
 var geckoEvalRegex = /(\S+) line (\d+)(?: > eval line \d+)* > eval/i;
 var geckoStackLineParser = (line, platform) => {
@@ -33821,14 +33905,14 @@ var geckoStackLineParser = (line, platform) => {
   }
 };
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/winjs.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/winjs.mjs
 var winjsRegex = /^\s*at (?:((?:\[object object\])?.+) )?\(?((?:[-a-z]+):.*?):(\d+)(?::(\d+))?\)?\s*$/i;
 var winjsStackLineParser = (line, platform) => {
   const parts = winjsRegex.exec(line);
   return parts ? createFrame(platform, parts[2], parts[1] || UNKNOWN_FUNCTION, +parts[3], parts[4] ? +parts[4] : undefined) : undefined;
 };
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/opera.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/opera.mjs
 var opera10Regex = / line (\d+).*script (?:in )?(\S+)(?:: in function (\S+))?$/i;
 var opera10StackLineParser = (line, platform) => {
   const parts = opera10Regex.exec(line);
@@ -33840,7 +33924,7 @@ var opera11StackLineParser = (line, platform) => {
   return parts ? createFrame(platform, parts[5], parts[3] || parts[4] || UNKNOWN_FUNCTION, +parts[1], +parts[2]) : undefined;
 };
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/node.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/node.mjs
 var FILENAME_MATCH = /^\s*[-]{4,}$/;
 var FULL_MATCH = /at (?:async )?(?:(.+?)\s+\()?(?:(.+):(\d+):(\d+)?|([^)]+))\)?/;
 var nodeStackLineParser = (line, platform) => {
@@ -33909,7 +33993,7 @@ function _parseIntOrUndefined(input) {
   return parseInt(input || "", 10) || undefined;
 }
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/index.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/parsers/index.mjs
 var WEBPACK_ERROR_REGEXP = /\(error: (.*)\)/;
 var STACKTRACE_FRAME_LIMIT = 50;
 function reverseAndStripFrames(stack) {
@@ -33954,7 +34038,7 @@ function createStackParser(platform, ...parsers) {
     return reverseAndStripFrames(frames);
   };
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/dom-exception-coercer.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/dom-exception-coercer.mjs
 class DOMExceptionCoercer {
   match(err) {
     return this.isDOMException(err) || this.isDOMError(err);
@@ -33984,7 +34068,7 @@ class DOMExceptionCoercer {
     return isBuiltin(err, "DOMError");
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/error-coercer.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/error-coercer.mjs
 class ErrorCoercer {
   match(err) {
     return isPlainError(err);
@@ -34011,7 +34095,7 @@ class ErrorCoercer {
     return err.stacktrace || err.stack || undefined;
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/error-event-coercer.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/error-event-coercer.mjs
 class ErrorEventCoercer {
   constructor() {}
   match(err) {
@@ -34029,7 +34113,7 @@ class ErrorEventCoercer {
     return exceptionLike;
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/string-coercer.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/string-coercer.mjs
 var ERROR_TYPES_PATTERN = /^(?:[Uu]ncaught (?:exception: )?)?(?:((?:Eval|Internal|Range|Reference|Syntax|Type|URI|)Error): )?(.*)$/i;
 
 class StringCoercer {
@@ -34059,7 +34143,7 @@ class StringCoercer {
     ];
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/types.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/types.mjs
 var severityLevels = [
   "fatal",
   "error",
@@ -34069,7 +34153,7 @@ var severityLevels = [
   "debug"
 ];
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/utils.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/utils.mjs
 function extractExceptionKeysForMessage(err, maxLength = 40) {
   const keys = Object.keys(err);
   keys.sort();
@@ -34086,7 +34170,7 @@ function extractExceptionKeysForMessage(err, maxLength = 40) {
   return "";
 }
 
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/object-coercer.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/object-coercer.mjs
 class ObjectCoercer {
   match(candidate) {
     return typeof candidate == "object" && candidate !== null;
@@ -34139,7 +34223,7 @@ class ObjectCoercer {
     }
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/event-coercer.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/event-coercer.mjs
 class EventCoercer {
   match(err) {
     return isEvent(err);
@@ -34154,7 +34238,7 @@ class EventCoercer {
     };
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/primitive-coercer.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/primitive-coercer.mjs
 class PrimitiveCoercer {
   match(candidate) {
     return isPrimitive(candidate);
@@ -34168,7 +34252,7 @@ class PrimitiveCoercer {
     };
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/promise-rejection-event.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/coercers/promise-rejection-event.mjs
 class PromiseRejectionEventCoercer {
   match(err) {
     return isBuiltin(err, "PromiseRejectionEvent") || this.isCustomEventWrappingRejection(err);
@@ -34204,7 +34288,7 @@ class PromiseRejectionEventCoercer {
     return error;
   }
 }
-// ../node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/utils.mjs
+// ../../switchroom/node_modules/.bun/@posthog+core@1.25.2/node_modules/@posthog/core/dist/error-tracking/utils.mjs
 class ReduceableCache {
   constructor(_maxSize) {
     this._maxSize = _maxSize;
@@ -34229,7 +34313,7 @@ class ReduceableCache {
     }
   }
 }
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/modifiers/context-lines.node.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/modifiers/context-lines.node.mjs
 import { createReadStream } from "node:fs";
 import { createInterface } from "node:readline";
 var LRU_FILE_CONTENTS_CACHE = new exports_error_tracking.ReduceableCache(25);
@@ -34447,7 +34531,7 @@ function snipLine(line, colno) {
   return newLine;
 }
 
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/autocapture.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/autocapture.mjs
 function makeUncaughtExceptionHandler(captureFn, onFatalFn) {
   let calledFatalError = false;
   return Object.assign((error) => {
@@ -34479,7 +34563,7 @@ function addUnhandledRejectionListener(captureFn) {
   }));
 }
 
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/index.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/index.mjs
 var SHUTDOWN_TIMEOUT = 2000;
 
 class ErrorTracking {
@@ -34548,10 +34632,10 @@ class ErrorTracking {
   }
 }
 
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/version.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/version.mjs
 var version = "5.29.2";
 
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/types.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/types.mjs
 var FeatureFlagError2 = {
   ERRORS_WHILE_COMPUTING: "errors_while_computing_flags",
   FLAG_MISSING: "flag_missing",
@@ -34559,7 +34643,7 @@ var FeatureFlagError2 = {
   UNKNOWN_ERROR: "unknown_error"
 };
 
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/feature-flags/crypto.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/feature-flags/crypto.mjs
 async function hashSHA1(text) {
   const subtle = globalThis.crypto?.subtle;
   if (!subtle)
@@ -34569,7 +34653,7 @@ async function hashSHA1(text) {
   return hashArray.map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/feature-flags/feature-flags.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/feature-flags/feature-flags.mjs
 var SIXTY_SECONDS = 60000;
 var LONG_SCALE = 1152921504606847000;
 var NULL_VALUES_ALLOWED_OPERATORS = [
@@ -35443,7 +35527,7 @@ function relativeDateParseForFeatureFlagMatching(value) {
   }
 }
 
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/storage-memory.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/storage-memory.mjs
 class PostHogMemoryStorage {
   getProperty(key) {
     return this._memoryStorage[key];
@@ -35456,7 +35540,7 @@ class PostHogMemoryStorage {
   }
 }
 
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/client.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/client.mjs
 var MINIMUM_POLLING_INTERVAL = 100;
 var THIRTY_SECONDS = 30000;
 var MAX_CACHE_SIZE = 50000;
@@ -36244,7 +36328,7 @@ class PostHogBackendClient extends PostHogCoreStateless {
   }
 }
 
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/context/context.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/context/context.mjs
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 
 class PostHogContext {
@@ -36275,7 +36359,7 @@ class PostHogContext {
   }
 }
 
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/sentry-integration.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/sentry-integration.mjs
 var NAME = "posthog-node";
 function createEventProcessor(_posthog, { organization, projectId, prefix, severityAllowList = [
   "error"
@@ -36343,7 +36427,7 @@ class PostHogSentryIntegration {
     };
   }
 }
-// ../node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/entrypoints/index.node.mjs
+// ../../switchroom/node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/entrypoints/index.node.mjs
 ErrorTracking.errorPropertiesBuilder = new exports_error_tracking.ErrorPropertiesBuilder([
   new exports_error_tracking.EventCoercer,
   new exports_error_tracking.ErrorCoercer,
@@ -38204,6 +38288,14 @@ import { homedir as homedir4 } from "node:os";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { join as join9 } from "node:path";
 var DEFAULT_TIMEOUT_MS2 = 5000;
+function reviveDate2(v) {
+  if (v == null)
+    return null;
+  if (v instanceof Date)
+    return Number.isNaN(v.getTime()) ? null : v;
+  const d = new Date(v);
+  return Number.isNaN(d.getTime()) ? null : d;
+}
 function operatorSocketPath2(home = homedir4()) {
   return join9(home, ".switchroom", "state", "auth-broker-operator", "sock");
 }
@@ -38299,7 +38391,14 @@ class AuthBrokerClient2 {
       accounts: [...accounts],
       ...timeoutMs !== undefined ? { timeoutMs } : {}
     });
-    return data;
+    const parsed = data;
+    for (const entry of parsed.results) {
+      if (entry.result.ok) {
+        entry.result.data.fiveHourResetAt = reviveDate2(entry.result.data.fiveHourResetAt);
+        entry.result.data.sevenDayResetAt = reviveDate2(entry.result.data.sevenDayResetAt);
+      }
+    }
+    return parsed;
   }
   async setActive(account) {
     const data = await this.send({
@@ -39522,6 +39621,28 @@ function markdownToHtml(text) {
 function escapeHtml4(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+function telegramHtmlToPlainText(html) {
+  const decodeEntities = (s) => s.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#0*39;|&#x0*27;|&apos;/gi, "'").replace(/&nbsp;/g, " ").replace(/&#(\d+);/g, (_m, d) => {
+    const cp = Number(d);
+    return Number.isFinite(cp) && cp > 0 && cp <= 1114111 ? String.fromCodePoint(cp) : _m;
+  }).replace(/&#x([0-9a-fA-F]+);/g, (_m, h) => {
+    const cp = parseInt(h, 16);
+    return Number.isFinite(cp) && cp > 0 && cp <= 1114111 ? String.fromCodePoint(cp) : _m;
+  });
+  const stripTags = (s) => decodeEntities(s.replace(/<\s*br\s*\/?\s*>/gi, `
+`).replace(/<\/\s*(?:p|div|li|blockquote|pre|h[1-6])\s*>/gi, `
+`).replace(/<[^>]*>/g, ""));
+  const withPlainLinks = html.replace(/<a\b[^>]*\bhref\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))[^>]*>([\s\S]*?)<\/a>/gi, (_m, dq, sq, uq, label) => {
+    const href = decodeEntities((dq ?? sq ?? uq ?? "").trim());
+    const text = stripTags(label).trim();
+    if (!href)
+      return text;
+    return !text || text === href ? href : `${text} (${href})`;
+  });
+  return stripTags(withPlainLinks).replace(/[ \t]+$/gm, "").replace(/\n{3,}/g, `
+
+`).trim();
+}
 function repairEscapedWhitespace(text) {
   if (text.includes(`
 `) || text.includes("\r"))
@@ -41309,8 +41430,6 @@ function formatQuotaBlock(q, now = new Date) {
   return lines.join(`
 `);
 }
-var ACCOUNT_QUOTA_CACHE_TTL_MS2 = 5 * 60000;
-var accountQuotaCache2 = new Map;
 
 // auto-fallback.ts
 var DEFAULT_FALLBACK_COOLDOWN_MS = 2 * 60000;
@@ -41995,8 +42114,8 @@ function mergeAgentConfig(defaultsIn, agentIn) {
   if (defaults.dangerous_mode !== undefined && merged.dangerous_mode === undefined) {
     merged.dangerous_mode = defaults.dangerous_mode;
   }
-  if (defaults.skip_permission_prompt !== undefined && merged.skip_permission_prompt === undefined) {
-    merged.skip_permission_prompt = defaults.skip_permission_prompt;
+  if (defaults.network_isolation !== undefined && merged.network_isolation === undefined) {
+    merged.network_isolation = defaults.network_isolation;
   }
   if (defaults.thinking_effort !== undefined && merged.thinking_effort === undefined) {
     merged.thinking_effort = defaults.thinking_effort;
@@ -42116,6 +42235,9 @@ function mergeAgentConfig(defaultsIn, agentIn) {
     }
     merged.session_continuity = combined;
   }
+  if (merged.release === undefined && defaults.release !== undefined) {
+    merged.release = defaults.release;
+  }
   if (defaults.channels || merged.channels) {
     const dChan = defaults.channels ?? {};
     const aChan = merged.channels ?? {};
@@ -42247,7 +42369,9 @@ var UpdateApplyRequestSchema = exports_external.object({
   op: exports_external.literal("update_apply"),
   args: exports_external.object({
     skip_images: exports_external.boolean().optional(),
-    rebuild: exports_external.boolean().optional()
+    rebuild: exports_external.boolean().optional(),
+    channel: exports_external.enum(["dev", "rc", "latest"]).nullable().optional(),
+    pin: exports_external.string().regex(/^(sha-[0-9a-f]{7,40}|v\d+\.\d+\.\d+)$/).nullable().optional()
   }).optional()
 });
 var ApplyRequestSchema = exports_external.object({
@@ -43064,7 +43188,7 @@ function clampTtl(requested, fallback, min, max) {
 
 // gateway/diff-preview-card.ts
 var import_grammy5 = __toESM(require_mod2(), 1);
-var REQUEST_ID_RE = /^[0-9a-f]{8}$/;
+var REQUEST_ID_RE = /^[0-9a-f]{32}$/;
 var PENDING_FILE_ID_SENTINEL = "pending-create";
 function buildDiffPreviewCard(input) {
   if (!REQUEST_ID_RE.test(input.suggestRequestId)) {
@@ -45393,8 +45517,211 @@ function determineRestartReason(opts) {
 // gateway/gateway.ts
 init_boot_card();
 
+// gateway/update-announce.ts
+import { existsSync as existsSync25, mkdirSync as mkdirSync13, openSync as openSync3, closeSync as closeSync3, readFileSync as readFileSync24 } from "node:fs";
+import { join as join24 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+
+// ../src/host-control/audit-reader.ts
+import { homedir as homedir9 } from "node:os";
+import { join as join23 } from "node:path";
+function defaultAuditLogPath(home2 = homedir9()) {
+  return join23(home2, ".switchroom", "host-control-audit.log");
+}
+function parseAuditLine(line) {
+  const trimmed = line.trim();
+  if (trimmed.length === 0)
+    return null;
+  let obj;
+  try {
+    obj = JSON.parse(trimmed);
+  } catch {
+    return null;
+  }
+  if (typeof obj !== "object" || obj === null)
+    return null;
+  const o = obj;
+  if (typeof o.ts !== "string" || typeof o.op !== "string")
+    return null;
+  if (typeof o.request_id !== "string" || typeof o.result !== "string")
+    return null;
+  if (typeof o.duration_ms !== "number")
+    return null;
+  const callerRaw = o.caller;
+  let caller;
+  if (callerRaw && callerRaw.kind === "agent" && typeof callerRaw.name === "string") {
+    caller = { kind: "agent", name: callerRaw.name };
+  } else if (callerRaw && callerRaw.kind === "operator") {
+    caller = { kind: "operator" };
+  } else {
+    return null;
+  }
+  const exit_code = o.exit_code === null || typeof o.exit_code === "number" ? o.exit_code : null;
+  const entry = {
+    ts: o.ts,
+    op: o.op,
+    caller,
+    request_id: o.request_id,
+    result: o.result,
+    exit_code,
+    duration_ms: o.duration_ms
+  };
+  if (typeof o.error === "string")
+    entry.error = o.error;
+  if (typeof o.phase === "string")
+    entry.phase = o.phase;
+  if (typeof o.stdout_tail === "string")
+    entry.stdout_tail = o.stdout_tail;
+  if (typeof o.stderr_tail === "string")
+    entry.stderr_tail = o.stderr_tail;
+  if (typeof o.channel === "string")
+    entry.channel = o.channel;
+  if (typeof o.pin === "string")
+    entry.pin = o.pin;
+  if (o.resolved_sha && typeof o.resolved_sha === "object" && !Array.isArray(o.resolved_sha)) {
+    const rs = {};
+    for (const [k, v] of Object.entries(o.resolved_sha)) {
+      if (typeof v === "string")
+        rs[k] = v;
+    }
+    if (Object.keys(rs).length > 0)
+      entry.resolved_sha = rs;
+  }
+  if (o.install_context && typeof o.install_context === "object" && !Array.isArray(o.install_context)) {
+    const ic = o.install_context;
+    if (typeof ic.install_type === "string" && typeof ic.detected_at === "string") {
+      entry.install_context = {
+        install_type: ic.install_type,
+        detected_at: ic.detected_at
+      };
+    }
+  }
+  return entry;
+}
+function filterEntries(entries, filters) {
+  return entries.filter((e) => {
+    if (filters.agent != null) {
+      if (e.caller.kind !== "agent")
+        return false;
+      if (e.caller.name !== filters.agent)
+        return false;
+    }
+    if (filters.op != null && e.op !== filters.op)
+      return false;
+    if (filters.errorOnly) {
+      if (e.result !== "error" && e.result !== "denied")
+        return false;
+    }
+    return true;
+  });
+}
+function readAndFilter(raw, filters, limit) {
+  const lines = raw.split(`
+`);
+  const parsed = [];
+  for (const line of lines) {
+    const e = parseAuditLine(line);
+    if (e != null)
+      parsed.push(e);
+  }
+  const filtered = filterEntries(parsed, filters);
+  return filtered.slice(-Math.max(1, limit));
+}
+
+// gateway/update-announce.ts
+var DEFAULT_LOOKBACK_MS = 10 * 60 * 1000;
+function readLastTerminalUpdateAudit(opts = {}) {
+  const path = opts.auditLogPath ?? defaultAuditLogPath();
+  const exists = opts.exists ?? existsSync25;
+  const readFile = opts.readFile ?? ((p) => readFileSync24(p, "utf-8"));
+  if (!exists(path))
+    return null;
+  let raw;
+  try {
+    raw = readFile(path);
+  } catch {
+    return null;
+  }
+  const recent = readAndFilter(raw, { op: "update_apply" }, 200);
+  const now = opts.now ?? Date.now();
+  const since = now - (opts.lookbackMs ?? DEFAULT_LOOKBACK_MS);
+  let best = null;
+  for (const e of recent) {
+    if (e.phase !== "terminal")
+      continue;
+    const ts = Date.parse(e.ts);
+    if (Number.isNaN(ts))
+      continue;
+    if (ts < since)
+      continue;
+    if (best == null || Date.parse(best.ts) < ts)
+      best = e;
+  }
+  return best;
+}
+var RECOVERY_HINTS = {
+  binary: "curl https://switchroom.ai/install.sh | sh && switchroom update",
+  source: "cd ~/code/switchroom && git pull && bun install && bun run build && switchroom update",
+  "source-unlinked": "cd ~/code/switchroom && bun link && switchroom update  # ensures binary is in PATH first",
+  docker: "docker compose -p switchroom pull && docker compose -p switchroom up -d",
+  unknown: "Cannot auto-detect install type. Run `switchroom apply` to refresh ~/.switchroom/install-type.json, then retry."
+};
+function recoveryHint(installType) {
+  if (!installType)
+    return RECOVERY_HINTS.unknown;
+  return RECOVERY_HINTS[installType] ?? RECOVERY_HINTS.unknown;
+}
+function shortSha(s) {
+  return s.replace(/^sha256:/, "").slice(0, 12);
+}
+function renderUpdateOutcomeLine(entry) {
+  const success = entry.exit_code === 0 && entry.result !== "error" && entry.result !== "denied";
+  if (success) {
+    const channel = entry.channel ? `channel:${entry.channel}` : entry.pin ? `pin:${entry.pin}` : "channel:?";
+    let shaStr = "";
+    if (entry.resolved_sha) {
+      const firstSha = Object.values(entry.resolved_sha)[0];
+      if (firstSha)
+        shaStr = `, sha:${shortSha(firstSha)}`;
+    }
+    return `\u2705 update completed (${channel}${shaStr})`;
+  }
+  const stderrTail = (entry.stderr_tail ?? entry.error ?? "").slice(-400);
+  const opStep = entry.op;
+  const hint = recoveryHint(entry.install_context?.install_type);
+  const lines = [`\u274c update failed at ${opStep}: ${stderrTail || "(no stderr captured)"}`, `    \u21b3 Recovery: ${hint}`];
+  return lines.join(`
+`);
+}
+function claimUpdateAnnouncement(requestId, opts = {}) {
+  const stateDir = opts.stateDir ?? process.env.TELEGRAM_STATE_DIR ?? join24(homedir10(), ".switchroom");
+  const dir = join24(stateDir, "update-announced");
+  try {
+    mkdirSync13(dir, { recursive: true });
+  } catch {
+    return false;
+  }
+  const safeId = requestId.replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 200);
+  const path = join24(dir, safeId);
+  try {
+    const fd = openSync3(path, "wx");
+    closeSync3(fd);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function maybeRenderUpdateAnnouncement(opts = {}) {
+  const entry = readLastTerminalUpdateAudit(opts);
+  if (!entry)
+    return null;
+  if (!claimUpdateAnnouncement(entry.request_id, opts))
+    return null;
+  return renderUpdateOutcomeLine(entry);
+}
+
 // issues-card.ts
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync15 } from "node:fs";
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync15 } from "node:fs";
 var SEVERITY_EMOJI = {
   info: "\u2139\ufe0f",
   warn: "\u26a0\ufe0f",
@@ -45486,7 +45813,7 @@ function extractRetryAfterSecs(err) {
 var COOLDOWN_JITTER_MS = 500;
 function readPersistedMessageId(path, log) {
   try {
-    const raw = readFileSync24(path, "utf8");
+    const raw = readFileSync25(path, "utf8");
     const parsed = JSON.parse(raw);
     const v = parsed.messageId;
     if (typeof v === "number" && Number.isInteger(v) && v > 0)
@@ -45595,24 +45922,24 @@ function createIssuesCardHandle(opts) {
 }
 
 // issues-watcher.ts
-import { existsSync as existsSync26, statSync as statSync8 } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync27, statSync as statSync8 } from "node:fs";
+import { join as join26 } from "node:path";
 
 // ../src/issues/store.ts
 import {
-  closeSync as closeSync3,
-  existsSync as existsSync25,
-  mkdirSync as mkdirSync13,
-  openSync as openSync3,
+  closeSync as closeSync4,
+  existsSync as existsSync26,
+  mkdirSync as mkdirSync14,
+  openSync as openSync4,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync25,
+  readFileSync as readFileSync26,
   renameSync as renameSync10,
   statSync as statSync7,
   unlinkSync as unlinkSync10,
   writeFileSync as writeFileSync16,
   writeSync
 } from "node:fs";
-import { join as join23 } from "node:path";
+import { join as join25 } from "node:path";
 import { randomBytes as randomBytes4 } from "node:crypto";
 import { execSync } from "node:child_process";
 
@@ -45628,12 +45955,12 @@ var SEVERITY_RANK2 = {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path = join23(stateDir, ISSUES_FILE);
-  if (!existsSync25(path))
+  const path = join25(stateDir, ISSUES_FILE);
+  if (!existsSync26(path))
     return [];
   let raw;
   try {
-    raw = readFileSync25(path, "utf-8");
+    raw = readFileSync26(path, "utf-8");
   } catch {
     return [];
   }
@@ -45665,7 +45992,7 @@ function list(stateDir, opts = {}) {
   });
 }
 function resolve6(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync25(join23(stateDir, ISSUES_FILE)))
+  if (!existsSync26(join25(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -45683,7 +46010,7 @@ function resolve6(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function writeAll(stateDir, events) {
-  const path = join23(stateDir, ISSUES_FILE);
+  const path = join25(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path}.tmp-${process.pid}-${randomBytes4(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -45705,7 +46032,7 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath2 = join23(stateDir, entry);
+    const tmpPath2 = join25(stateDir, entry);
     try {
       const stat = statSync7(tmpPath2);
       if (stat.mtimeMs < cutoff) {
@@ -45717,12 +46044,12 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join23(stateDir, ISSUES_LOCK);
+  const lockPath = join25(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
     try {
-      fd = openSync3(lockPath, "wx");
+      fd = openSync4(lockPath, "wx");
       try {
         writeSync(fd, String(process.pid));
       } catch {}
@@ -45742,7 +46069,7 @@ function withLock(stateDir, fn) {
     return fn();
   } finally {
     try {
-      closeSync3(fd);
+      closeSync4(fd);
     } catch {}
     try {
       unlinkSync10(lockPath);
@@ -45752,7 +46079,7 @@ function withLock(stateDir, fn) {
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync25(lockPath, "utf-8").trim();
+    pidStr = readFileSync26(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
@@ -45802,7 +46129,7 @@ function isIssueEvent(v) {
 // issues-watcher.ts
 var DEFAULT_POLL_INTERVAL_MS2 = 2000;
 function startIssuesWatcher(opts) {
-  const path = join24(opts.stateDir, ISSUES_FILE);
+  const path = join26(opts.stateDir, ISSUES_FILE);
   const log = opts.log ?? (() => {});
   const intervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS2;
   const setIntervalFn = opts.setInterval ?? setInterval;
@@ -45850,7 +46177,7 @@ function startIssuesWatcher(opts) {
   };
 }
 function defaultSignatureProvider(path) {
-  if (!existsSync26(path))
+  if (!existsSync27(path))
     return null;
   try {
     const stat = statSync8(path);
@@ -46039,8 +46366,8 @@ function skillBasenameFromPath2(input) {
 }
 
 // credits-watch.ts
-import { readFileSync as readFileSync26, writeFileSync as writeFileSync17, existsSync as existsSync27, mkdirSync as mkdirSync14 } from "fs";
-import { join as join25 } from "path";
+import { readFileSync as readFileSync27, writeFileSync as writeFileSync17, existsSync as existsSync28, mkdirSync as mkdirSync15 } from "fs";
+import { join as join27 } from "path";
 var STATE_FILE = "credits-watch.json";
 var FATAL_REASONS = new Set([
   "out_of_credits",
@@ -46052,12 +46379,12 @@ function emptyCreditState() {
   return { lastNotifiedReason: null, lastNotifiedAt: 0 };
 }
 function readClaudeJsonOverage(claudeConfigDir) {
-  const path = join25(claudeConfigDir, ".claude.json");
-  if (!existsSync27(path))
+  const path = join27(claudeConfigDir, ".claude.json");
+  if (!existsSync28(path))
     return null;
   let raw;
   try {
-    raw = readFileSync26(path, "utf-8");
+    raw = readFileSync27(path, "utf-8");
   } catch {
     return null;
   }
@@ -46137,11 +46464,11 @@ function escapeHtml10(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function loadCreditState(stateDir) {
-  const path = join25(stateDir, STATE_FILE);
-  if (!existsSync27(path))
+  const path = join27(stateDir, STATE_FILE);
+  if (!existsSync28(path))
     return emptyCreditState();
   try {
-    const raw = readFileSync26(path, "utf-8");
+    const raw = readFileSync27(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object" && (parsed.lastNotifiedReason === null || typeof parsed.lastNotifiedReason === "string") && typeof parsed.lastNotifiedAt === "number" && Number.isFinite(parsed.lastNotifiedAt)) {
       return {
@@ -46153,55 +46480,55 @@ function loadCreditState(stateDir) {
   return emptyCreditState();
 }
 function saveCreditState(stateDir, state3) {
-  mkdirSync14(stateDir, { recursive: true });
-  const path = join25(stateDir, STATE_FILE);
+  mkdirSync15(stateDir, { recursive: true });
+  const path = join27(stateDir, STATE_FILE);
   writeFileSync17(path, JSON.stringify(state3, null, 2) + `
 `, { mode: 384 });
 }
 
 // gateway/turn-active-marker.ts
 import {
-  closeSync as closeSync4,
-  existsSync as existsSync28,
-  mkdirSync as mkdirSync15,
-  openSync as openSync4,
-  readFileSync as readFileSync27,
+  closeSync as closeSync5,
+  existsSync as existsSync29,
+  mkdirSync as mkdirSync16,
+  openSync as openSync5,
+  readFileSync as readFileSync28,
   statSync as statSync9,
   unlinkSync as unlinkSync11,
   utimesSync as utimesSync2,
   writeFileSync as writeFileSync18
 } from "node:fs";
-import { join as join26 } from "node:path";
+import { join as join28 } from "node:path";
 var TURN_ACTIVE_MARKER_FILE2 = "turn-active.json";
 function writeTurnActiveMarker(stateDir, marker) {
   try {
-    mkdirSync15(stateDir, { recursive: true });
-    writeFileSync18(join26(stateDir, TURN_ACTIVE_MARKER_FILE2), JSON.stringify(marker, null, 2) + `
+    mkdirSync16(stateDir, { recursive: true });
+    writeFileSync18(join28(stateDir, TURN_ACTIVE_MARKER_FILE2), JSON.stringify(marker, null, 2) + `
 `, { mode: 384 });
   } catch {}
 }
 function touchTurnActiveMarker2(stateDir) {
-  const path = join26(stateDir, TURN_ACTIVE_MARKER_FILE2);
-  if (!existsSync28(path))
+  const path = join28(stateDir, TURN_ACTIVE_MARKER_FILE2);
+  if (!existsSync29(path))
     return;
   const now = new Date;
   try {
     utimesSync2(path, now, now);
   } catch {
     try {
-      const fd = openSync4(path, "r+");
-      closeSync4(fd);
+      const fd = openSync5(path, "r+");
+      closeSync5(fd);
     } catch {}
   }
 }
 function removeTurnActiveMarker(stateDir) {
   try {
-    unlinkSync11(join26(stateDir, TURN_ACTIVE_MARKER_FILE2));
+    unlinkSync11(join28(stateDir, TURN_ACTIVE_MARKER_FILE2));
   } catch {}
 }
 function sweepStaleTurnActiveMarker(stateDir, opts) {
-  const path = join26(stateDir, TURN_ACTIVE_MARKER_FILE2);
-  if (!existsSync28(path))
+  const path = join28(stateDir, TURN_ACTIVE_MARKER_FILE2);
+  if (!existsSync29(path))
     return false;
   const now = opts.now ?? Date.now();
   try {
@@ -46213,7 +46540,7 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
       return false;
     let payload = null;
     try {
-      payload = readFileSync27(path, "utf8");
+      payload = readFileSync28(path, "utf8");
     } catch {}
     unlinkSync11(path);
     if (opts.onRemove) {
@@ -46232,11 +46559,11 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.11.1";
-var COMMIT_SHA = "f5d84dfb";
-var COMMIT_DATE = "2026-05-15T19:01:48+10:00";
-var LATEST_PR = 1342;
-var COMMITS_AHEAD_OF_TAG = 0;
+var VERSION = "0.12.1";
+var COMMIT_SHA = "0de1edd1";
+var COMMIT_DATE = "2026-05-18T08:08:32Z";
+var LATEST_PR = 1503;
+var COMMITS_AHEAD_OF_TAG = null;
 
 // gateway/boot-version.ts
 function formatRelativeAgo(iso) {
@@ -46300,17 +46627,17 @@ init_protocol2();
 init_peercred();
 import * as net4 from "node:net";
 import * as fs2 from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { join as join27 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { join as join29 } from "node:path";
 var DEFAULT_TIMEOUT_MS4 = 2000;
-var LEGACY_SOCKET_PATH2 = join27(homedir9(), ".switchroom", "vault-broker.sock");
-var OPERATOR_SOCKET_PATH2 = join27(homedir9(), ".switchroom", "broker-operator", "sock");
+var UNLOCK_TIMEOUT_MS = 30000;
+var LEGACY_SOCKET_PATH2 = join29(homedir11(), ".switchroom", "vault-broker.sock");
+var OPERATOR_SOCKET_PATH2 = join29(homedir11(), ".switchroom", "broker-operator", "sock");
 function defaultBrokerSocketPath2() {
-  if (isDockerRuntime()) {
-    if (fs2.existsSync(OPERATOR_SOCKET_PATH2))
-      return OPERATOR_SOCKET_PATH2;
+  if (fs2.existsSync(OPERATOR_SOCKET_PATH2))
+    return OPERATOR_SOCKET_PATH2;
+  if (isDockerRuntime())
     return OPERATOR_SOCKET_PATH2;
-  }
   return LEGACY_SOCKET_PATH2;
 }
 function resolveBrokerSocketPath2(opts) {
@@ -46415,7 +46742,7 @@ async function lockViaBroker(opts) {
 async function unlockViaBroker(passphrase, opts) {
   const dataSocketPath = resolveBrokerSocketPath2(opts);
   const unlockSocketPath = unlockSocketFor(dataSocketPath);
-  const timeoutMs = opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS4;
+  const timeoutMs = opts?.timeoutMs ?? UNLOCK_TIMEOUT_MS;
   return new Promise((resolve7) => {
     let settled = false;
     const settle = (val) => {
@@ -46527,8 +46854,8 @@ function resolveVaultApprovalPosture(broker) {
 }
 
 // registry/turns-schema.ts
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync16 } from "fs";
-import { join as join28 } from "path";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync17 } from "fs";
+import { join as join30 } from "path";
 var DatabaseClass2 = null;
 function loadDatabaseClass2() {
   if (DatabaseClass2 != null)
@@ -46587,9 +46914,9 @@ function applySchema(db2) {
 }
 function openTurnsDb(agentDir) {
   const Database = loadDatabaseClass2();
-  const dir = join28(agentDir, "telegram");
-  mkdirSync16(dir, { recursive: true, mode: 448 });
-  const path = join28(dir, "registry.db");
+  const dir = join30(agentDir, "telegram");
+  mkdirSync17(dir, { recursive: true, mode: 448 });
+  const path = join30(dir, "registry.db");
   const db2 = new Database(path, { create: true });
   applySchema(db2);
   try {
@@ -46728,11 +47055,11 @@ installGlobalErrorHandlers();
 process.on("beforeExit", () => {
   shutdownAnalytics();
 });
-var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join30(homedir10(), ".claude", "channels", "telegram");
-var ACCESS_FILE = join30(STATE_DIR, "access.json");
-var APPROVED_DIR = join30(STATE_DIR, "approved");
-var ENV_FILE = join30(STATE_DIR, ".env");
-var INBOX_DIR = join30(STATE_DIR, "inbox");
+var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join32(homedir12(), ".claude", "channels", "telegram");
+var ACCESS_FILE = join32(STATE_DIR, "access.json");
+var APPROVED_DIR = join32(STATE_DIR, "approved");
+var ENV_FILE = join32(STATE_DIR, ".env");
+var INBOX_DIR = join32(STATE_DIR, "inbox");
 function triggerSelfRestart(targetAgent, reason, delayMs = 300) {
   const isDocker = process.env.SWITCHROOM_RUNTIME === "docker";
   const selfAgent = process.env.SWITCHROOM_AGENT_NAME;
@@ -46797,7 +47124,7 @@ function formatBootVersion() {
 }
 try {
   chmodSync5(ENV_FILE, 384);
-  for (const line of readFileSync30(ENV_FILE, "utf8").split(`
+  for (const line of readFileSync31(ENV_FILE, "utf8").split(`
 `)) {
     const m = line.match(/^(\w+)=(.*)$/);
     if (m && process.env[m[1]] === undefined)
@@ -46850,7 +47177,7 @@ installTgPostLogger(bot);
 var _rawSendMessageDraft = bot.api.raw.sendMessageDraft;
 var GRAMMY_VERSION = (() => {
   try {
-    const raw = readFileSync30(new URL("../../node_modules/grammy/package.json", import.meta.url), "utf8");
+    const raw = readFileSync31(new URL("../../node_modules/grammy/package.json", import.meta.url), "utf8");
     return JSON.parse(raw).version ?? "unknown";
   } catch {
     return "unknown";
@@ -46923,7 +47250,7 @@ function assertSendable(f) {
   } catch {
     throw new Error(`refusing to send file \u2014 cannot resolve real path: ${f}`);
   }
-  const inbox = join30(stateReal, "inbox");
+  const inbox = join32(stateReal, "inbox");
   if (real.startsWith(stateReal + sep3) && !real.startsWith(inbox + sep3)) {
     throw new Error(`refusing to send channel state: ${f}`);
   }
@@ -46942,7 +47269,7 @@ function assertSendable(f) {
 }
 function readAccessFile() {
   try {
-    const raw = readFileSync30(ACCESS_FILE, "utf8");
+    const raw = readFileSync31(ACCESS_FILE, "utf8");
     const parsed = JSON.parse(raw);
     const allowFrom = validateStringArray("allowFrom", parsed.allowFrom ?? []);
     const groups = {};
@@ -47007,7 +47334,7 @@ function assertAllowedChat(chat_id) {
 function saveAccess(a) {
   if (STATIC)
     return;
-  mkdirSync20(STATE_DIR, { recursive: true, mode: 448 });
+  mkdirSync21(STATE_DIR, { recursive: true, mode: 448 });
   const tmp = ACCESS_FILE + ".tmp";
   writeFileSync21(tmp, JSON.stringify(a, null, 2) + `
 `, { mode: 384 });
@@ -47029,7 +47356,7 @@ var HISTORY_ENABLED = HISTORY_ACCESS.historyEnabled !== false;
 if (HISTORY_ENABLED) {
   try {
     initHistory(STATE_DIR, HISTORY_ACCESS.historyRetentionDays ?? 30);
-    process.stderr.write(`telegram gateway: history capture enabled at ${join30(STATE_DIR, "history.db")}
+    process.stderr.write(`telegram gateway: history capture enabled at ${join32(STATE_DIR, "history.db")}
 `);
   } catch (err) {
     process.stderr.write(`telegram gateway: history init failed (${err.message}) \u2014 capture disabled
@@ -47046,10 +47373,10 @@ try {
     process.stderr.write(`telegram gateway: turn-registry boot-reaper stamped ${reaped} orphaned turn(s) as ended_via='restart'
 `);
   } else {
-    process.stderr.write(`telegram gateway: turn-registry initialized at ${join30(agentDir, "telegram", "registry.db")}
+    process.stderr.write(`telegram gateway: turn-registry initialized at ${join32(agentDir, "telegram", "registry.db")}
 `);
   }
-  const pendingEnvPath = join30(agentDir, ".pending-turn.env");
+  const pendingEnvPath = join32(agentDir, ".pending-turn.env");
   try {
     const pending = findMostRecentInterruptedTurn(turnsDb);
     if (pending != null) {
@@ -47069,7 +47396,7 @@ try {
       renameSync12(pendingEnvTmp, pendingEnvPath);
       process.stderr.write(`telegram gateway: pending-turn env written to ${pendingEnvPath} turnKey=${pending.turn_key} endedVia=${pending.ended_via ?? "open"}
 `);
-    } else if (existsSync32(pendingEnvPath)) {
+    } else if (existsSync33(pendingEnvPath)) {
       rmSync4(pendingEnvPath, { force: true });
       process.stderr.write(`telegram gateway: pending-turn env cleared (clean previous shutdown)
 `);
@@ -47123,7 +47450,7 @@ function checkApprovals() {
     return;
   }
   for (const senderId of files) {
-    const file = join30(APPROVED_DIR, senderId);
+    const file = join32(APPROVED_DIR, senderId);
     bot.api.sendMessage(senderId, "Paired! Say hi to Claude.").then(() => rmSync4(file, { force: true }), (err) => {
       process.stderr.write(`telegram gateway: failed to send approval confirm: ${err}
 `);
@@ -47769,11 +48096,11 @@ var unpinProgressCardForChat = null;
 var getPinnedProgressCardMessageId = null;
 var completeProgressCardTurn = null;
 var subagentWatcher = null;
-var SOCKET_PATH = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join30(STATE_DIR, "gateway.sock");
-mkdirSync20(STATE_DIR, { recursive: true, mode: 448 });
-var GATEWAY_PID_PATH = process.env.SWITCHROOM_GATEWAY_PID_FILE ?? join30(STATE_DIR, "gateway.pid.json");
-var GATEWAY_SESSION_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_SESSION_MARKER ?? join30(STATE_DIR, "gateway-session.json");
-var GATEWAY_CLEAN_SHUTDOWN_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_CLEAN_SHUTDOWN_MARKER ?? join30(STATE_DIR, "clean-shutdown.json");
+var SOCKET_PATH = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join32(STATE_DIR, "gateway.sock");
+mkdirSync21(STATE_DIR, { recursive: true, mode: 448 });
+var GATEWAY_PID_PATH = process.env.SWITCHROOM_GATEWAY_PID_FILE ?? join32(STATE_DIR, "gateway.pid.json");
+var GATEWAY_SESSION_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_SESSION_MARKER ?? join32(STATE_DIR, "gateway-session.json");
+var GATEWAY_CLEAN_SHUTDOWN_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_CLEAN_SHUTDOWN_MARKER ?? join32(STATE_DIR, "clean-shutdown.json");
 var GATEWAY_STARTED_AT_MS = Date.now();
 var BOOT_CARD_ENABLED = process.env.SWITCHROOM_BOOT_CARD !== "false";
 var activeBootCard = null;
@@ -47802,7 +48129,7 @@ function ensureIssuesCard(chatId, threadId) {
     bot: botApi,
     log: (msg) => process.stderr.write(`telegram gateway: ${msg}
 `),
-    persistPath: join30(stateDir, "issues-card.json")
+    persistPath: join32(stateDir, "issues-card.json")
   });
   activeIssuesWatcher = startIssuesWatcher({
     stateDir,
@@ -47960,6 +48287,13 @@ var ipcServer = createIpcServer({
           const agentDisplayName = resolvePersonaName(agentSlug);
           const botApiForCard = wrapBootCardApi(threadId);
           bootCardPending = true;
+          const updateOutcomeLine = (() => {
+            try {
+              return maybeRenderUpdateAnnouncement() ?? undefined;
+            } catch {
+              return;
+            }
+          })();
           startBootCard(chatId, threadId, botApiForCard, {
             agentName: agentDisplayName,
             agentSlug,
@@ -47970,8 +48304,10 @@ var ipcServer = createIpcServer({
             restartAgeMs: markerAgeMs,
             restartReasonDetail: cleanMarker?.reason,
             loadAccounts: () => loadAccountsForBootCard(agentSlug),
+            probeQuotaViaBroker: (t) => probeQuotaForBootCard(agentSlug, t),
             tmuxSupervisor: process.env.SWITCHROOM_TMUX_SUPERVISOR === "1",
-            dockerMode: process.env.SWITCHROOM_RUNTIME === "docker"
+            dockerMode: process.env.SWITCHROOM_RUNTIME === "docker",
+            ...updateOutcomeLine ? { updateOutcomeLine } : {}
           }, ackMsgId).then((handle) => {
             activeBootCard = handle;
           }).catch((err) => {
@@ -48466,6 +48802,17 @@ ${url}`;
           previewMessageId = null;
         }
       }
+      const sendChunkPlainText = async (opts) => {
+        const plainOpts = { ...opts };
+        delete plainOpts.parse_mode;
+        const stripped = telegramHtmlToPlainText(chunks[i]);
+        const plain = stripped.length > 0 ? stripped : "\u26A0\uFE0F (a formatted fragment could not be rendered for Telegram)";
+        const sent = await lockedBot.api.sendMessage(chat_id, plain, plainOpts);
+        sentIds.push(sent.message_id);
+        logOutbound("reply", chat_id, sent.message_id, plain.length, `chunk=${i + 1}/${chunks.length} plaintext-fallback`);
+        process.stderr.write(`telegram gateway: HTML parse-reject \u2014 resent chunk ${i + 1}/${chunks.length} as plain text
+`);
+      };
       try {
         const sent = await robustApiCall(() => lockedBot.api.sendMessage(chat_id, chunks[i], sendOpts), { threadId, chat_id });
         sentIds.push(sent.message_id);
@@ -48475,8 +48822,17 @@ ${url}`;
           threadId = undefined;
           const retryOpts = { ...sendOpts };
           delete retryOpts.message_thread_id;
-          const sent = await lockedBot.api.sendMessage(chat_id, chunks[i], retryOpts);
-          sentIds.push(sent.message_id);
+          try {
+            const sent = await lockedBot.api.sendMessage(chat_id, chunks[i], retryOpts);
+            sentIds.push(sent.message_id);
+          } catch (retryErr) {
+            if (isHtmlParseRejectError(retryErr))
+              await sendChunkPlainText(retryOpts);
+            else
+              throw retryErr;
+          }
+        } else if (isHtmlParseRejectError(err)) {
+          await sendChunkPlainText(sendOpts);
         } else {
           throw err;
         }
@@ -48936,11 +49292,11 @@ async function executeSendGif(rawArgs) {
   };
 }
 async function publishToTelegraph(text, shortName, authorName) {
-  const accountPath = join30(STATE_DIR, "telegraph-account.json");
+  const accountPath = join32(STATE_DIR, "telegraph-account.json");
   let account = null;
   try {
-    if (existsSync32(accountPath)) {
-      const raw = readFileSync30(accountPath, "utf-8");
+    if (existsSync33(accountPath)) {
+      const raw = readFileSync31(accountPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed.shortName && parsed.accessToken) {
         account = parsed;
@@ -48959,7 +49315,7 @@ async function publishToTelegraph(text, shortName, authorName) {
     }
     account = created.value;
     try {
-      mkdirSync20(STATE_DIR, { recursive: true, mode: 448 });
+      mkdirSync21(STATE_DIR, { recursive: true, mode: 448 });
       writeFileSync21(accountPath, JSON.stringify(account, null, 2), { mode: 384 });
     } catch (err) {
       process.stderr.write(`telegram gateway: telegraph cache write failed: ${err.message}
@@ -49117,6 +49473,21 @@ async function executeVaultRequestAccess(args) {
   }
   assertAllowedChat(chat_id);
   const agentSlug = process.env.SWITCHROOM_AGENT_NAME || "agent";
+  if (scopeRaw === "read") {
+    try {
+      const visible = await listViaBroker();
+      if (visible !== null && visible.includes(key)) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `vault_request_access: '${key}' is ALREADY covered by ${agentSlug}'s ` + `standing ACL (schedule.secrets[]). No approval card or grant is needed \u2014 ` + `read it directly: \`switchroom vault get ${key}\`. Do NOT request a grant for this key (a minted token would shadow the standing ACL). If a read still returns VAULT-BROKER-DENIED, the broker likely needs a restart to ` + `pick up a recent config change \u2014 tell the operator; don't re-request.`
+            }
+          ]
+        };
+      }
+    } catch {}
+  }
   const stageId = randomBytes6(4).toString("hex");
   const pending = {
     agent: agentSlug,
@@ -49185,7 +49556,7 @@ async function executeDownloadAttachment(args) {
     fileUniqueId: file.file_unique_id,
     now: Date.now()
   });
-  mkdirSync20(INBOX_DIR, { recursive: true, mode: 448 });
+  mkdirSync21(INBOX_DIR, { recursive: true, mode: 448 });
   assertInsideInbox(INBOX_DIR, dlPath);
   writeFileSync21(dlPath, buf, { mode: 384 });
   return { content: [{ type: "text", text: dlPath }] };
@@ -50777,7 +51148,7 @@ function restartMarkerPath() {
   const agentDir = resolveAgentDirFromEnv();
   if (!agentDir)
     return null;
-  return join30(agentDir, "restart-pending.json");
+  return join32(agentDir, "restart-pending.json");
 }
 function writeRestartMarker(marker) {
   const p = restartMarkerPath();
@@ -50803,7 +51174,7 @@ function readRestartMarker() {
   if (!p)
     return null;
   try {
-    return JSON.parse(readFileSync30(p, "utf8"));
+    return JSON.parse(readFileSync31(p, "utf8"));
   } catch {
     return null;
   }
@@ -50872,7 +51243,7 @@ var _dockerReachable;
 function isDockerReachable() {
   if (_dockerReachable !== undefined)
     return _dockerReachable;
-  if (!existsSync32("/var/run/docker.sock")) {
+  if (!existsSync33("/var/run/docker.sock")) {
     _dockerReachable = false;
     return _dockerReachable;
   }
@@ -50889,11 +51260,11 @@ function _resetDockerReachableCache() {
 }
 function spawnSwitchroomDetached(args, onFailure) {
   const fullArgs = SWITCHROOM_CONFIG ? ["--config", SWITCHROOM_CONFIG, ...args] : args;
-  const logPath = join30(STATE_DIR, "detached-spawn.log");
+  const logPath = join32(STATE_DIR, "detached-spawn.log");
   let outFd = null;
   try {
-    mkdirSync20(STATE_DIR, { recursive: true });
-    outFd = openSync7(logPath, "a");
+    mkdirSync21(STATE_DIR, { recursive: true });
+    outFd = openSync8(logPath, "a");
     writeFileSync21(logPath, `
 [${new Date().toISOString()}] spawn ${SWITCHROOM_CLI} ${fullArgs.join(" ")}
 `, { flag: "a" });
@@ -50908,7 +51279,7 @@ function spawnSwitchroomDetached(args, onFailure) {
   });
   if (outFd != null) {
     try {
-      closeSync7(outFd);
+      closeSync8(outFd);
     } catch {}
   }
   if (onFailure) {
@@ -50920,7 +51291,7 @@ function spawnSwitchroomDetached(args, onFailure) {
         return;
       let tail = "";
       try {
-        const full = readFileSync30(logPath, "utf8");
+        const full = readFileSync31(logPath, "utf8");
         tail = full.split(`
 `).slice(-30).join(`
 `).trim();
@@ -51235,27 +51606,37 @@ ${preBlock(formatSwitchroomOutput(detail))}`, { html: true });
   }
 }
 bot.use(async (ctx, next) => {
-  if (!AGENT_ADMIN && ctx.message?.text) {
+  if (ctx.message?.text) {
     const myName = getMyAgentName();
     const decision = classifyAdminGate(ctx.message.text, myName);
     if (decision.action === "block") {
-      process.stderr.write(`telegram gateway: admin-gate blocked cmd=/${decision.cmd} agent=${process.env.SWITCHROOM_AGENT_NAME ?? "-"} reason=${decision.reason} (AGENT_ADMIN=false)
-`);
       const cmdHtml = escapeHtmlForTg(`/${decision.cmd}`);
       const nameHtml = escapeHtmlForTg(myName);
-      const text = decision.reason === "other-agent" ? `\u26A0\uFE0F <code>${cmdHtml}</code> targeting another agent is an admin operation \u2014 this agent (<code>${nameHtml}</code>) isn't admin-flagged. Run it from an admin agent, or set <code>admin: true</code> for this agent in switchroom.yaml. (Self-restart is allowed: send <code>/restart</code> with no arg.)` : `\u26A0\uFE0F <code>${cmdHtml}</code> is an admin command \u2014 this agent (<code>${nameHtml}</code>) isn't admin-flagged. Run it from an admin agent, or set <code>admin: true</code> for this agent in switchroom.yaml.`;
-      await switchroomReply(ctx, text, { html: true });
-      return;
+      const notFlagged = decision.reason === "other-agent" ? `\u26A0\uFE0F <code>${cmdHtml}</code> targeting another agent is an admin operation \u2014 this agent (<code>${nameHtml}</code>) isn't admin-flagged. Run it from an admin agent, or set <code>admin: true</code> for this agent in switchroom.yaml. (Self-restart is allowed: send <code>/restart</code> with no arg.)` : `\u26A0\uFE0F <code>${cmdHtml}</code> is an admin command \u2014 this agent (<code>${nameHtml}</code>) isn't admin-flagged. Run it from an admin agent, or set <code>admin: true</code> for this agent in switchroom.yaml.`;
+      if (!AGENT_ADMIN) {
+        process.stderr.write(`telegram gateway: admin-gate blocked cmd=/${decision.cmd} agent=${process.env.SWITCHROOM_AGENT_NAME ?? "-"} reason=${decision.reason} (AGENT_ADMIN=false)
+`);
+        await switchroomReply(ctx, notFlagged, { html: true });
+        return;
+      }
+      const senderId = String(ctx.from?.id ?? "");
+      const operatorPrivate = ctx.chat?.type === "private" && loadAccess().allowFrom.includes(senderId);
+      if (!operatorPrivate) {
+        process.stderr.write(`telegram gateway: admin-gate refused (not operator-private) cmd=/${decision.cmd} agent=${process.env.SWITCHROOM_AGENT_NAME ?? "-"} chat=${ctx.chat?.type ?? "?"} sender=${senderId}
+`);
+        await switchroomReply(ctx, `\u26A0\uFE0F <code>${cmdHtml}</code> is a fleet-admin command \u2014 it is <b>operator-private</b>. Send it as a direct message to me from your operator account (a private chat where your Telegram ID is on the access allowlist), not in a group or forum.`, { html: true });
+        return;
+      }
     }
   }
   await next();
 });
 function readRecentDenialsForAgent(agentName3, windowMs, limit) {
   try {
-    const auditPath = join30(homedir10(), ".switchroom", "vault-audit.log");
-    if (!existsSync32(auditPath))
+    const auditPath = join32(homedir12(), ".switchroom", "vault-audit.log");
+    if (!existsSync33(auditPath))
       return [];
-    const raw = readFileSync30(auditPath, "utf8");
+    const raw = readFileSync31(auditPath, "utf8");
     return recentDenialsFromAuditLog(raw, { agentName: agentName3, windowMs, limit });
   } catch {
     return [];
@@ -51306,7 +51687,7 @@ async function buildAgentMetadata(agentName3) {
   try {
     const agentDir = resolveAgentDirFromEnv();
     if (agentDir) {
-      const raw = readFileSync30(join30(agentDir, ".claude", ".claude.json"), "utf8");
+      const raw = readFileSync31(join32(agentDir, ".claude", ".claude.json"), "utf8");
       claudeJson = JSON.parse(raw);
     }
   } catch {}
@@ -51335,7 +51716,8 @@ async function buildLiveProbeRows(agentName3) {
       agentDir,
       gatewayInfo: { pid: process.pid, startedAtMs: GATEWAY_STARTED_AT_MS },
       tmuxSupervisor: process.env.SWITCHROOM_TMUX_SUPERVISOR === "1",
-      dockerMode: process.env.SWITCHROOM_RUNTIME === "docker"
+      dockerMode: process.env.SWITCHROOM_RUNTIME === "docker",
+      probeQuotaViaBroker: (t) => probeQuotaForBootCard(agentName3, t)
     });
     const rows = [];
     const order = [
@@ -51519,9 +51901,9 @@ bot.command("restart", async (ctx) => {
 function flushAgentHandoff(agentDir) {
   let removed = 0;
   for (const fname of [".handoff.md", ".handoff-topic"]) {
-    const p = join30(agentDir, fname);
+    const p = join32(agentDir, fname);
     try {
-      if (existsSync32(p)) {
+      if (existsSync33(p)) {
         unlinkSync14(p);
         removed++;
       }
@@ -51577,7 +51959,7 @@ async function handleNewOrResetCommand(ctx, kind) {
   writeRestartMarker({ chat_id: chatId, thread_id: threadId ?? null, ack_message_id: ackId, ts: Date.now() });
   if (agentDir != null) {
     try {
-      writeFileSync21(join30(agentDir, ".force-fresh-session"), `${kind} at ${new Date().toISOString()}
+      writeFileSync21(join32(agentDir, ".force-fresh-session"), `${kind} at ${new Date().toISOString()}
 `, "utf8");
     } catch (err) {
       process.stderr.write(`telegram gateway: failed to write force-fresh marker: ${err}
@@ -51746,7 +52128,7 @@ bot.command("audit", async (ctx) => {
     return;
   const arg = (ctx.match ?? "").trim();
   if (arg === "" || arg === "help" || arg === "--help") {
-    await switchroomReply(ctx, "Usage: <code>/audit hostd [--tail N] [--agent &lt;name&gt;] [--op &lt;verb&gt;] [--error]</code>", { html: true });
+    await switchroomReply(ctx, "Usage: <code>/audit hostd [--tail N] [--agent &lt;name&gt;] [--op &lt;verb&gt;] [--error] [--verbose]</code>", { html: true });
     return;
   }
   const tokens = arg.split(/\s+/);
@@ -51775,6 +52157,10 @@ bot.command("audit", async (ctx) => {
       argv.push("--error");
       continue;
     }
+    if (t === "--verbose") {
+      argv.push("--verbose");
+      continue;
+    }
     if (t === "--tail" || t === "--agent" || t === "--op") {
       const v = tokens[++i];
       if (v == null) {
@@ -51796,7 +52182,7 @@ bot.command("audit", async (ctx) => {
       argv.push(t, v);
       continue;
     }
-    await switchroomReply(ctx, `Unknown flag <code>${escapeHtmlForTg(t)}</code>. Allowed: <code>--tail</code>, <code>--agent</code>, <code>--op</code>, <code>--error</code>.`, { html: true });
+    await switchroomReply(ctx, `Unknown flag <code>${escapeHtmlForTg(t)}</code>. Allowed: <code>--tail</code>, <code>--agent</code>, <code>--op</code>, <code>--error</code>, <code>--verbose</code>.`, { html: true });
     return;
   }
   await runSwitchroomCommand(ctx, argv, `hostd audit${argv.length > 2 ? " \u2026" : ""}`);
@@ -51917,16 +52303,16 @@ bot.command("interrupt", async (ctx) => {
   await runSwitchroomCommand(ctx, ["agent", "interrupt", name], `interrupt ${name}`);
 });
 var lockoutOps = {
-  readFileSync: (p, enc) => readFileSync30(p, enc),
+  readFileSync: (p, enc) => readFileSync31(p, enc),
   writeFileSync: (p, data, opts) => writeFileSync21(p, data, opts),
-  existsSync: (p) => existsSync32(p),
-  mkdirSync: (p, opts) => mkdirSync20(p, opts),
-  joinPath: (...parts) => join30(...parts)
+  existsSync: (p) => existsSync33(p),
+  mkdirSync: (p, opts) => mkdirSync21(p, opts),
+  joinPath: (...parts) => join32(...parts)
 };
 var FLEET_FALLBACK_DEDUP_MS = 30000;
 function isAuthBrokerSocketReachable() {
   try {
-    return existsSync32(resolveAuthBrokerSocketPath2());
+    return existsSync33(resolveAuthBrokerSocketPath2());
   } catch {
     return false;
   }
@@ -51987,7 +52373,7 @@ async function runCreditWatch() {
   if (!agentDir)
     return;
   const agentName3 = getMyAgentName();
-  const claudeConfigDir = join30(agentDir, ".claude");
+  const claudeConfigDir = join32(agentDir, ".claude");
   const stateDir = STATE_DIR;
   const reason = readClaudeJsonOverage(claudeConfigDir);
   const prev = loadCreditState(stateDir);
@@ -52015,8 +52401,16 @@ async function runCreditWatch() {
   }
 }
 bot.command("auth", async (ctx) => {
-  if (!isAuthorizedSender(ctx))
+  const authSenderId = String(ctx.from?.id ?? "");
+  const authOperatorPrivate = ctx.chat?.type === "private" && loadAccess().allowFrom.includes(authSenderId);
+  if (!authOperatorPrivate) {
+    if (ctx.chat?.type !== "private") {
+      process.stderr.write(`telegram gateway: /auth refused (not operator-private) agent=${process.env.SWITCHROOM_AGENT_NAME ?? "-"} chat=${ctx.chat?.type ?? "?"} sender=${authSenderId}
+`);
+      await switchroomReply(ctx, `\u26A0\uFE0F <code>/auth</code> manages account credentials \u2014 it is <b>operator-private</b>. Send it as a direct message to me from your operator account (a private chat where your Telegram ID is on the access allowlist), not in a group or forum.`, { html: true }).catch(() => {});
+    }
     return;
+  }
   const text = ctx.message?.text ?? "";
   const parsed = parseAuthCommand(text);
   if (!parsed)
@@ -52133,6 +52527,24 @@ async function loadAccountsForBootCard(agent) {
     return null;
   }
 }
+async function probeQuotaForBootCard(agent, timeoutMs) {
+  try {
+    const client3 = await getAuthBrokerClient(agent);
+    if (!client3)
+      return null;
+    const state3 = await client3.listState();
+    const entry = state3.agents.find((a) => a.name === agent);
+    const label = entry?.override ?? entry?.account ?? state3.active;
+    if (!label)
+      return null;
+    const { results } = await client3.probeQuota([label], timeoutMs);
+    return results.find((r) => r.label === label)?.result ?? null;
+  } catch (err) {
+    process.stderr.write(`telegram gateway: boot-card quota probe failed: ${err?.message ?? String(err)}
+`);
+    return null;
+  }
+}
 async function handleVaultRecentDenialCallback(ctx, data) {
   const senderId = String(ctx.from?.id ?? "");
   const access = loadAccess();
@@ -52170,9 +52582,9 @@ async function handleVaultRecentDenialCallback(ctx, data) {
     return;
   }
   const { token, id } = result;
-  const tokenPath = join30(homedir10(), ".switchroom", "agents", agentName3, ".vault-token");
+  const tokenPath = join32(homedir12(), ".switchroom", "agents", agentName3, ".vault-token");
   try {
-    mkdirSync20(join30(homedir10(), ".switchroom", "agents", agentName3), { recursive: true });
+    mkdirSync21(join32(homedir12(), ".switchroom", "agents", agentName3), { recursive: true });
     writeFileSync21(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created (${escapeHtmlForTg(id)}) but token write failed:</b> ${escapeHtmlForTg(String(err))}
@@ -52192,6 +52604,18 @@ async function handleVaultRecentDenialCallback(ctx, data) {
 }
 async function performVaultAccessApproval(ctx, pending, stageId, senderId, attestation) {
   const brokerAuthOpts = attestation.kind === "passphrase" ? { passphrase: attestation.passphrase } : { attest_via_posture: true };
+  if (pending.scope === "read") {
+    try {
+      const visible = await listViaBroker();
+      if (visible !== null && visible.includes(pending.key)) {
+        pendingVaultRequestAccesses.delete(stageId);
+        if (pending.card_message_id != null) {
+          await ctx.api.editMessageText(pending.chat_id, pending.card_message_id, `\u2139\uFE0F <b>${escapeHtmlForTg(pending.agent)}</b> already has standing-ACL access to <code>${escapeHtmlForTg(pending.key)}</code> (schedule.secrets[]). ` + `<b>No grant minted</b> \u2014 a token would shadow the standing ACL. ` + `The agent can read it directly.`, { parse_mode: "HTML", reply_markup: { inline_keyboard: [] } }).catch(() => {});
+        }
+        return;
+      }
+    } catch {}
+  }
   let existingReadKeys = [];
   let existingWriteKeys = [];
   if (pending.scope === "read" || pending.scope === "write") {
@@ -52237,9 +52661,9 @@ async function performVaultAccessApproval(ctx, pending, stageId, senderId, attes
     return;
   }
   const { token, id } = result;
-  const tokenPath = join30(homedir10(), ".switchroom", "agents", pending.agent, ".vault-token");
+  const tokenPath = join32(homedir12(), ".switchroom", "agents", pending.agent, ".vault-token");
   try {
-    mkdirSync20(join30(homedir10(), ".switchroom", "agents", pending.agent), { recursive: true });
+    mkdirSync21(join32(homedir12(), ".switchroom", "agents", pending.agent), { recursive: true });
     writeFileSync21(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created (${escapeHtmlForTg(id)}) but token write failed:</b> ${escapeHtmlForTg(String(err))}
@@ -52667,9 +53091,9 @@ async function executeGrantWizard(ctx, chatId, state3) {
     return;
   }
   const { token, id } = result;
-  const tokenPath = join30(homedir10(), ".switchroom", "agents", state3.agent, ".vault-token");
+  const tokenPath = join32(homedir12(), ".switchroom", "agents", state3.agent, ".vault-token");
   try {
-    mkdirSync20(join30(homedir10(), ".switchroom", "agents", state3.agent), { recursive: true });
+    mkdirSync21(join32(homedir12(), ".switchroom", "agents", state3.agent), { recursive: true });
     writeFileSync21(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created but token write failed:</b> ${escapeHtmlForTg(String(err))}`, { html: true });
@@ -53526,7 +53950,7 @@ bot.command("usage", async (ctx) => {
     await switchroomReply(ctx, "<b>/usage:</b> cannot resolve agent dir.", { html: true });
     return;
   }
-  const result = await fetchQuota2({ claudeConfigDir: join30(agentDir, ".claude") });
+  const result = await fetchQuota2({ claudeConfigDir: join32(agentDir, ".claude") });
   if (!result.ok) {
     await switchroomReply(ctx, `<b>/usage:</b> ${escapeHtmlForTg(result.reason)}`, { html: true });
     return;
@@ -53656,6 +54080,12 @@ bot.on("callback_query:data", async (ctx) => {
     return;
   }
   if (data.startsWith("apv:")) {
+    const access2 = loadAccess();
+    const senderId2 = String(ctx.from?.id ?? "");
+    if (!access2.allowFrom.includes(senderId2)) {
+      await ctx.answerCallbackQuery({ text: "Not authorized." });
+      return;
+    }
     const { handleApprovalCallback: handleApprovalCallback2 } = await Promise.resolve().then(() => (init_approval_callback(), exports_approval_callback));
     await handleApprovalCallback2(ctx, data);
     return;
@@ -53937,7 +54367,7 @@ bot.on("message:photo", async (ctx) => {
         fileUniqueId: best.file_unique_id,
         now: Date.now()
       });
-      mkdirSync20(INBOX_DIR, { recursive: true, mode: 448 });
+      mkdirSync21(INBOX_DIR, { recursive: true, mode: 448 });
       assertInsideInbox(INBOX_DIR, dlPath);
       writeFileSync21(dlPath, buf, { mode: 384 });
       return dlPath;
@@ -53979,8 +54409,8 @@ async function maybeTranscribeVoice(fileId, mimeType, language) {
   let apiKey = null;
   try {
     const path = __require("path").join(__require("os").homedir(), ".switchroom", "openai-api-key");
-    if (existsSync32(path)) {
-      apiKey = readFileSync30(path, "utf-8").trim();
+    if (existsSync33(path)) {
+      apiKey = readFileSync31(path, "utf-8").trim();
     }
   } catch (err) {
     process.stderr.write(`telegram gateway: voice-in: failed to read api key: ${err.message}
@@ -54823,18 +55253,27 @@ var didOneTimeSetup = false;
                   const botApiForCard = wrapBootCardApi(threadId);
                   bootCardPending = true;
                   try {
+                    const updateOutcomeLine = (() => {
+                      try {
+                        return maybeRenderUpdateAnnouncement() ?? undefined;
+                      } catch {
+                        return;
+                      }
+                    })();
                     const handle = await startBootCard(chatId, threadId, botApiForCard, {
                       agentName: agentDisplayName,
                       agentSlug,
                       version: formatBootVersion(),
-                      agentDir: agentDir ?? join30(homedir10(), ".switchroom", "agents", agentSlug),
+                      agentDir: agentDir ?? join32(homedir12(), ".switchroom", "agents", agentSlug),
                       gatewayInfo: { pid: process.pid, startedAtMs: GATEWAY_STARTED_AT_MS },
                       restartReason: reason,
                       restartAgeMs: markerAgeMs,
                       restartReasonDetail: cleanMarker?.reason,
                       loadAccounts: () => loadAccountsForBootCard(agentSlug),
+                      probeQuotaViaBroker: (t) => probeQuotaForBootCard(agentSlug, t),
                       tmuxSupervisor: process.env.SWITCHROOM_TMUX_SUPERVISOR === "1",
-                      dockerMode: process.env.SWITCHROOM_RUNTIME === "docker"
+                      dockerMode: process.env.SWITCHROOM_RUNTIME === "docker",
+                      ...updateOutcomeLine ? { updateOutcomeLine } : {}
                     }, ackMsgId);
                     activeBootCard = handle;
                   } catch (err) {