switchroom 0.13.31 → 0.13.33

package/dist/cli/switchroom.js

@@ -22983,6 +22983,7 @@ function generateCompose(opts) {
   lines.push(`      - ${homePrefix}/.switchroom/vault:/state/vault:rw`);
   lines.push(`      - ${homePrefix}/.switchroom/vault-auto-unlock:/state/vault-auto-unlock:ro`);
   lines.push(`      - ${homePrefix}/.switchroom/vault-audit.log:/root/.switchroom/vault-audit.log`);
+  lines.push(`      - ${homePrefix}/.switchroom/vault-grants.db:/root/.switchroom/vault-grants.db`);
   lines.push(`      - /etc/machine-id:/etc/machine-id:ro`);
   lines.push(``);
   lines.push(`  approval-kernel:`);
@@ -29399,6 +29400,220 @@ var init_doctor_agent_smoke = __esm(() => {
   init_client4();
 });
 
+// src/cli/doctor-vault-broker-durability.ts
+import { execFileSync as execFileSync14 } from "node:child_process";
+import { existsSync as existsSync50, statSync as statSync22 } from "node:fs";
+import { homedir as homedir27 } from "node:os";
+import { join as join46 } from "node:path";
+function probeBindMountInode(hostPath, brokerContainerPath, opts) {
+  const statHost = opts?.statHost ?? defaultStatHost;
+  const statBroker = opts?.statBroker ?? defaultStatBroker;
+  const host = statHost(hostPath);
+  if (host === null)
+    return { kind: "host-missing", hostPath };
+  const broker = statBroker(brokerContainerPath);
+  if (broker.kind !== "ok-with-stat")
+    return broker;
+  if (String(host.ino) === broker.ino && host.size === broker.size) {
+    return { kind: "ok" };
+  }
+  return {
+    kind: "mismatch",
+    hostInode: String(host.ino),
+    brokerInode: broker.ino,
+    hostSize: host.size,
+    brokerSize: broker.size
+  };
+}
+function defaultStatHost(p) {
+  if (!existsSync50(p))
+    return null;
+  try {
+    const s = statSync22(p, { bigint: true });
+    return { ino: s.ino, size: Number(s.size) };
+  } catch {
+    return null;
+  }
+}
+function defaultStatBroker(p) {
+  const r = spawnDockerStat(p);
+  if (r.error || r.status === null)
+    return { kind: "broker-unreachable" };
+  if (r.status !== 0) {
+    if (r.status >= 125)
+      return { kind: "broker-unreachable" };
+    return {
+      kind: "broker-stat-failed",
+      msg: r.stderr?.trim() || `exit ${r.status}`
+    };
+  }
+  const out = r.stdout.trim();
+  const [inoStr, sizeStr] = out.split(/\s+/);
+  const size = Number(sizeStr);
+  if (!inoStr || !Number.isFinite(size)) {
+    return {
+      kind: "broker-stat-failed",
+      msg: `unparseable stat output: ${out}`
+    };
+  }
+  return { kind: "ok-with-stat", ino: inoStr, size };
+}
+function spawnDockerStat(p) {
+  try {
+    const stdout = execFileSync14("docker", ["exec", "switchroom-vault-broker", "stat", "-c", "%i %s", p], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
+    return { status: 0, stdout, stderr: "", error: null };
+  } catch (err) {
+    const e = err;
+    return {
+      status: typeof e.status === "number" ? e.status : null,
+      stdout: e.stdout ?? "",
+      stderr: e.stderr ?? "",
+      error: e.status === undefined ? new Error(e.message ?? "spawn failed") : null
+    };
+  }
+}
+function formatBindMountResult(name, hostPath, brokerContainerPath, result) {
+  if (result.kind === "ok") {
+    return {
+      name,
+      status: "ok",
+      detail: `${hostPath} == ${brokerContainerPath} (same inode)`
+    };
+  }
+  if (result.kind === "host-missing") {
+    return {
+      name,
+      status: "warn",
+      detail: `host file ${hostPath} missing \u2014 pre-created by \`switchroom apply\` on greenfield`,
+      fix: "Run `switchroom apply` to pre-create the host file at the correct mode"
+    };
+  }
+  if (result.kind === "broker-unreachable") {
+    return {
+      name,
+      status: "skip",
+      detail: "vault-broker container unreachable \u2014 bind mount unverified"
+    };
+  }
+  if (result.kind === "broker-stat-failed") {
+    return {
+      name,
+      status: "warn",
+      detail: `broker stat failed: ${result.msg}`
+    };
+  }
+  return {
+    name,
+    status: "fail",
+    detail: `inode mismatch \u2014 bind mount is NOT wiring host to broker. ` + `host inode=${result.hostInode} size=${result.hostSize}; ` + `broker inode=${result.brokerInode} size=${result.brokerSize}. ` + `The broker is operating on an ephemeral container-local file; ` + `data written there evaporates on container recreate.`,
+    fix: "Run `switchroom apply` to regenerate compose with the correct " + "bind mount, then `docker compose -p switchroom up -d vault-broker` " + "to recreate the broker container."
+  };
+}
+function probeBrokerUnlocked(opts) {
+  const status = (opts?.statusProbe ?? defaultBrokerStatusProbe)();
+  if (status === null) {
+    return {
+      name: "vault-broker unlocked (state)",
+      status: "skip",
+      detail: "vault-broker container unreachable"
+    };
+  }
+  if (!status.unlocked) {
+    return {
+      name: "vault-broker unlocked (state)",
+      status: "fail",
+      detail: `broker reports locked despite config \u2014 auto-unlock failed silently. ` + `Common causes: \`/etc/machine-id\` mount missing or differs from the ` + `host the blob was sealed on; vault-auto-unlock blob corrupted; ` + `vault passphrase was rotated without re-running ` + `\`switchroom vault broker enable-auto-unlock\`.`,
+      fix: "Re-run `switchroom vault broker enable-auto-unlock` on the host " + "to re-seal the blob against the current machine-id + passphrase. " + "Then restart the broker (`docker compose -p switchroom restart vault-broker`)."
+    };
+  }
+  return {
+    name: "vault-broker unlocked (state)",
+    status: "ok",
+    detail: `${status.keyCount} key(s) loaded`
+  };
+}
+function defaultBrokerStatusProbe() {
+  try {
+    const out = execFileSync14("switchroom", ["vault", "broker", "status"], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
+    const parsed = JSON.parse(out.trim());
+    if (!parsed.running)
+      return null;
+    return { unlocked: parsed.unlocked, keyCount: parsed.keyCount };
+  } catch {
+    return null;
+  }
+}
+function runVaultBrokerDurabilityChecks(_config, opts) {
+  const home2 = homedir27();
+  const probe2 = opts?.inodeProbe ?? probeBindMountInode;
+  return [
+    probeBrokerUnlocked(opts?.statusProbe),
+    probeAutoUnlockBlob(home2),
+    probeMachineIdMount(),
+    formatBindMountResult("vault-broker: vault.enc bind mount", join46(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join46(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
+    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join46(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join46(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
+    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join46(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join46(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log"))
+  ];
+}
+function probeAutoUnlockBlob(home2) {
+  const blobPath = join46(home2, ".switchroom", "vault-auto-unlock");
+  if (!existsSync50(blobPath)) {
+    return {
+      name: "vault-broker: auto-unlock blob",
+      status: "warn",
+      detail: `${blobPath} not present \u2014 broker will fall back to interactive unlock`,
+      fix: "Run `switchroom vault broker enable-auto-unlock` to seal the blob with the current passphrase + machine-id"
+    };
+  }
+  const sz = statSync22(blobPath).size;
+  if (sz === 0) {
+    return {
+      name: "vault-broker: auto-unlock blob",
+      status: "warn",
+      detail: `${blobPath} is 0 bytes (placeholder) \u2014 broker will fall back to interactive unlock`,
+      fix: "Run `switchroom vault broker enable-auto-unlock` to actually seal the blob"
+    };
+  }
+  return {
+    name: "vault-broker: auto-unlock blob",
+    status: "ok",
+    detail: `${blobPath} present (${sz} bytes, machine-bound)`
+  };
+}
+function probeMachineIdMount() {
+  const hostExists = existsSync50("/etc/machine-id");
+  if (!hostExists) {
+    return {
+      name: "vault-broker: machine-id passthrough",
+      status: "fail",
+      detail: "/etc/machine-id missing on host \u2014 auto-unlock key derivation impossible",
+      fix: "Generate a machine-id (`systemd-machine-id-setup`) and re-seal the auto-unlock blob"
+    };
+  }
+  const r = spawnDockerStat("/etc/machine-id");
+  if (r.error || r.status === null || r.status >= 125) {
+    return {
+      name: "vault-broker: machine-id passthrough",
+      status: "skip",
+      detail: "vault-broker container unreachable"
+    };
+  }
+  if (r.status !== 0) {
+    return {
+      name: "vault-broker: machine-id passthrough",
+      status: "fail",
+      detail: "broker container has no /etc/machine-id \u2014 compose `/etc/machine-id:/etc/machine-id:ro` mount is missing",
+      fix: "Run `switchroom apply` to regenerate compose with the machine-id passthrough"
+    };
+  }
+  return {
+    name: "vault-broker: machine-id passthrough",
+    status: "ok",
+    detail: "broker reads the host machine-id"
+  };
+}
+var init_doctor_vault_broker_durability = () => {};
+
 // src/cli/doctor.ts
 var exports_doctor = {};
 __export(exports_doctor, {
@@ -29444,25 +29659,25 @@ import { execSync as execSync3, spawnSync as spawnSync7 } from "node:child_proce
 import {
   accessSync as accessSync2,
   constants as fsConstants5,
-  existsSync as existsSync50,
+  existsSync as existsSync51,
   lstatSync as lstatSync5,
   mkdirSync as mkdirSync27,
   readFileSync as readFileSync45,
   readdirSync as readdirSync19,
-  statSync as statSync22
+  statSync as statSync23
 } from "node:fs";
-import { dirname as dirname12, join as join46, resolve as resolve30 } from "node:path";
+import { dirname as dirname12, join as join47, resolve as resolve30 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
-  const nvmRoot = join46(process.env.HOME ?? "", ".nvm", "versions", "node");
-  if (!existsSync50(nvmRoot))
+  const nvmRoot = join47(process.env.HOME ?? "", ".nvm", "versions", "node");
+  if (!existsSync51(nvmRoot))
     return null;
   try {
     const versions = readdirSync19(nvmRoot).sort().reverse();
     for (const v of versions) {
-      const candidate = join46(nvmRoot, v, "bin", bin);
+      const candidate = join47(nvmRoot, v, "bin", bin);
       try {
-        const s = statSync22(candidate);
+        const s = statSync23(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
           return candidate;
         }
@@ -29625,21 +29840,21 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
   if (envBrowsersPath && envBrowsersPath.length > 0) {
     cacheLocations.push(envBrowsersPath);
   }
-  cacheLocations.push(join46(homeDir, ".cache", "ms-playwright"));
+  cacheLocations.push(join47(homeDir, ".cache", "ms-playwright"));
   for (const cacheDir of cacheLocations) {
-    if (!existsSync50(cacheDir))
+    if (!existsSync51(cacheDir))
       continue;
     try {
       const entries = readdirSync19(cacheDir).filter((e) => e.startsWith("chromium"));
       for (const entry of entries) {
         const candidates2 = [
-          join46(cacheDir, entry, "chrome-linux64", "chrome"),
-          join46(cacheDir, entry, "chrome-linux", "chrome"),
-          join46(cacheDir, entry, "chrome-linux64", "headless_shell"),
-          join46(cacheDir, entry, "chrome-linux", "headless_shell")
+          join47(cacheDir, entry, "chrome-linux64", "chrome"),
+          join47(cacheDir, entry, "chrome-linux", "chrome"),
+          join47(cacheDir, entry, "chrome-linux64", "headless_shell"),
+          join47(cacheDir, entry, "chrome-linux", "headless_shell")
         ];
         for (const path4 of candidates2) {
-          if (existsSync50(path4))
+          if (existsSync51(path4))
             return path4;
         }
       }
@@ -29719,8 +29934,8 @@ function checkConfig(config, configPath) {
 function checkLegacyState() {
   const results = [];
   const h = process.env.HOME ?? "/root";
-  const clerkDir = join46(h, LEGACY_STATE_DIR);
-  const clerkPresent = existsSync50(clerkDir);
+  const clerkDir = join47(h, LEGACY_STATE_DIR);
+  const clerkPresent = existsSync51(clerkDir);
   results.push({
     name: "legacy ~/.clerk state",
     status: clerkPresent ? "warn" : "ok",
@@ -29729,7 +29944,7 @@ function checkLegacyState() {
       fix: "Legacy state detected. Run `mv ~/.clerk ~/.switchroom` and rename " + "any top-level `clerk:` key in switchroom.yaml to `switchroom:`. " + "This back-compat shim is REMOVED in v0.13.0 \u2014 no automatic " + "migration exists."
     } : {}
   });
-  const legacySock = join46(h, ".switchroom", "vault-broker.sock");
+  const legacySock = join47(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
     sockStat = lstatSync5(legacySock);
@@ -29850,7 +30065,7 @@ function checkVault(config) {
     detail: "Approval auth: passphrase (two-factor)"
   };
   const pairsResult = checkVaultBrokerSocketPairs(config);
-  if (!existsSync50(vaultPath)) {
+  if (!existsSync51(vaultPath)) {
     return [
       postureResult,
       {
@@ -30025,8 +30240,8 @@ async function checkHindsight(config) {
 }
 function checkPendingRetainsQueue(dir) {
   const home2 = process.env.HOME ?? "";
-  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join46(home2, ".hindsight", "pending-retains");
-  if (!existsSync50(pendingDir)) {
+  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join47(home2, ".hindsight", "pending-retains");
+  if (!existsSync51(pendingDir)) {
     return {
       name: "pending-retains queue",
       status: "ok",
@@ -30097,7 +30312,7 @@ function tryReadHostFile(path4) {
   }
 }
 function parseEnvFile(path4) {
-  if (!existsSync50(path4))
+  if (!existsSync51(path4))
     return {};
   let content;
   try {
@@ -30156,7 +30371,7 @@ async function checkTelegram(config) {
     const plugin = agentConfig.channels?.telegram?.plugin ?? "switchroom";
     if (plugin !== "switchroom")
       continue;
-    const envPath = join46(agentsDir, name, "telegram", ".env");
+    const envPath = join47(agentsDir, name, "telegram", ".env");
     const read = tryReadHostFile(envPath);
     if (read.kind === "eacces") {
       results.push({
@@ -30208,7 +30423,7 @@ async function checkTelegram(config) {
 }
 function checkStartShStale(agentName, startShPath) {
   const label = `${agentName}: start.sh scheduler block`;
-  if (!existsSync50(startShPath)) {
+  if (!existsSync51(startShPath)) {
     return {
       name: label,
       status: "warn",
@@ -30239,7 +30454,7 @@ function checkStartShStale(agentName, startShPath) {
 }
 function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const label = `${agentName}: $HOME/.switchroom symlink (#910)`;
-  const path4 = join46(agentDir, "home", ".switchroom");
+  const path4 = join47(agentDir, "home", ".switchroom");
   let stats;
   try {
     stats = lstatSync5(path4);
@@ -30276,8 +30491,8 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
 }
 function checkRepoHygiene(repoRoot) {
   const results = [];
-  const exportDir = join46(repoRoot, "clerk-export");
-  if (existsSync50(exportDir)) {
+  const exportDir = join47(repoRoot, "clerk-export");
+  if (existsSync51(exportDir)) {
     results.push({
       name: "repo hygiene: clerk-export/ on disk (#1072)",
       status: "warn",
@@ -30285,8 +30500,8 @@ function checkRepoHygiene(repoRoot) {
       fix: `Run scripts/migrate-clerk-export-to-vault.sh to move the bundle ` + `into the vault, then delete the on-disk copy.`
     });
   }
-  const knownTarball = join46(repoRoot, "clerk-export-with-secrets.tar.gz");
-  if (existsSync50(knownTarball)) {
+  const knownTarball = join47(repoRoot, "clerk-export-with-secrets.tar.gz");
+  if (existsSync51(knownTarball)) {
     results.push({
       name: "repo hygiene: clerk-export-with-secrets.tar.gz on disk (#1072)",
       status: "warn",
@@ -30303,7 +30518,7 @@ function checkRepoHygiene(repoRoot) {
         results.push({
           name: `repo hygiene: ${name} on disk (#1072)`,
           status: "warn",
-          detail: `${join46(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
+          detail: `${join47(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
           fix: `Inspect, migrate any secrets into the vault, then delete the ` + `archive.`
         });
       }
@@ -30326,10 +30541,10 @@ function checkRepoHygiene(repoRoot) {
 }
 function isSwitchroomCheckout(dir) {
   try {
-    if (!existsSync50(join46(dir, ".git")))
+    if (!existsSync51(join47(dir, ".git")))
       return false;
-    const pkgPath = join46(dir, "package.json");
-    if (!existsSync50(pkgPath))
+    const pkgPath = join47(dir, "package.json");
+    if (!existsSync51(pkgPath))
       return false;
     const pkg = JSON.parse(readFileSync45(pkgPath, "utf-8"));
     return pkg.name === "switchroom";
@@ -30344,7 +30559,7 @@ function checkAgents(config, configPath) {
   const authStatuses = getAllAuthStatuses(config);
   for (const [name, agentConfig] of Object.entries(config.agents)) {
     const agentDir = resolve30(agentsDir, name);
-    if (!existsSync50(agentDir)) {
+    if (!existsSync51(agentDir)) {
       results.push({
         name: `${name}: scaffold`,
         status: "fail",
@@ -30365,7 +30580,7 @@ function checkAgents(config, configPath) {
         fix: `Rotate the bot token (e.g. via \`switchroom vault\`), then run ` + `\`switchroom agent unquarantine ${name}\` and \`switchroom agent restart ${name}\``
       });
     }
-    results.push(checkStartShStale(name, join46(agentDir, "start.sh")));
+    results.push(checkStartShStale(name, join47(agentDir, "start.sh")));
     results.push(checkLeakedHomeSwitchroom(name, agentDir));
     const status = statuses[name];
     const active = status?.active ?? "unknown";
@@ -30442,8 +30657,8 @@ function checkAgents(config, configPath) {
       }
     }
     if (agentConfig.channels?.telegram?.plugin === "switchroom") {
-      const mcpJsonPath = join46(agentDir, ".mcp.json");
-      if (!existsSync50(mcpJsonPath)) {
+      const mcpJsonPath = join47(agentDir, ".mcp.json");
+      if (!existsSync51(mcpJsonPath)) {
         results.push({
           name: `${name}: .mcp.json`,
           status: "fail",
@@ -30528,7 +30743,7 @@ function mffEnvPath(config) {
   return agent ? resolve30(home2, ".switchroom/credentials", agent, "my-family-finance/.env") : resolve30(home2, ".switchroom/credentials/my-family-finance/.env");
 }
 function mffEnvState(envPath) {
-  if (!existsSync50(envPath))
+  if (!existsSync51(envPath))
     return "absent";
   try {
     accessSync2(envPath, fsConstants5.R_OK);
@@ -30546,7 +30761,7 @@ function checkMffVaultKeyPresent(passphrase, vaultPath) {
       fix: "Export SWITCHROOM_VAULT_PASSPHRASE to enable MFF vault probes"
     };
   }
-  if (!existsSync50(vaultPath)) {
+  if (!existsSync51(vaultPath)) {
     return {
       name: "mff: vault key present",
       status: "fail",
@@ -30599,7 +30814,7 @@ function deriveEd25519PublicKeyBytes(keyMaterial) {
   }
 }
 function checkMffVaultKeyFormat(passphrase, vaultPath) {
-  if (!passphrase || !existsSync50(vaultPath)) {
+  if (!passphrase || !existsSync51(vaultPath)) {
     return {
       name: "mff: vault key format",
       status: "warn",
@@ -30743,8 +30958,8 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
     };
   }
   const credDir = dirname12(envPath);
-  const authScript = join46(credDir, "claude-auth.py");
-  if (!existsSync50(authScript)) {
+  const authScript = join47(credDir, "claude-auth.py");
+  if (!existsSync51(authScript)) {
     return {
       name: "mff: auth flow",
       status: "warn",
@@ -31022,6 +31237,10 @@ function registerDoctorCommand(program3) {
       },
       { title: "Legacy State", results: checkLegacyState() },
       { title: "Vault", results: checkVault(config) },
+      {
+        title: "Vault-broker durability",
+        results: runVaultBrokerDurabilityChecks(config)
+      },
       { title: "Vault access", results: await runSecretAccessChecks(config) },
       { title: "Memory (Hindsight)", results: await checkHindsight(config) },
       { title: "Telegram", results: await checkTelegram(config) },
@@ -31105,6 +31324,7 @@ var init_doctor = __esm(() => {
   init_doctor_inlined_secrets();
   init_doctor_audit_integrity();
   init_doctor_agent_smoke();
+  init_doctor_vault_broker_durability();
   MANIFEST_WARN_ONLY = new Set([
     "@playwright/mcp",
     "hindsight.backend",
@@ -47033,7 +47253,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes14 } from "node:crypto";
-import { existsSync as existsSync74, readFileSync as readFileSync60 } from "node:fs";
+import { existsSync as existsSync75, readFileSync as readFileSync60 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -47048,7 +47268,7 @@ async function dispatchTool2(name, args) {
     return errorText2("hostd MCP: SWITCHROOM_AGENT_NAME env var is not set \u2014 cannot " + "determine which per-agent socket to talk to.");
   }
   const sockPath = selfSocketPath();
-  if (!existsSync74(sockPath)) {
+  if (!existsSync75(sockPath)) {
     return errorText2(`hostd MCP: socket not bound at ${sockPath}. The host-control ` + `daemon is either not installed (run \`switchroom hostd install\`) ` + `or this agent isn't admin-flagged in switchroom.yaml. RFC C ` + `bind-mounts the per-agent socket only when host_control.enabled ` + `is true AND the agent has admin: true.`);
   }
   let req;
@@ -47192,13 +47412,13 @@ function resolveAuditLogPath() {
   if (process.env.HOSTD_AUDIT_LOG_PATH)
     return process.env.HOSTD_AUDIT_LOG_PATH;
   const bindMounted = "/host-home/.switchroom/host-control-audit.log";
-  if (existsSync74(bindMounted))
+  if (existsSync75(bindMounted))
     return bindMounted;
   return defaultAuditLogPath2();
 }
 function getLastUpdateApplyStatus() {
   const path8 = resolveAuditLogPath();
-  if (!existsSync74(path8)) {
+  if (!existsSync75(path8)) {
     return errorText2(`get_status: audit log not found at ${path8}. No update_apply has run yet?`);
   }
   let raw;
@@ -47436,8 +47656,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.13.31";
-var COMMIT_SHA = "061eead1";
+var VERSION = "0.13.33";
+var COMMIT_SHA = "a8018071";
 
 // src/cli/agent.ts
 init_source();
@@ -69810,17 +70030,17 @@ init_doctor();
 init_source();
 init_loader();
 init_lifecycle();
-import { cpSync as cpSync2, existsSync as existsSync51, mkdirSync as mkdirSync28, readFileSync as readFileSync46, realpathSync as realpathSync5, rmSync as rmSync12, statSync as statSync23 } from "node:fs";
+import { cpSync as cpSync2, existsSync as existsSync52, mkdirSync as mkdirSync28, readFileSync as readFileSync46, realpathSync as realpathSync5, rmSync as rmSync12, statSync as statSync24 } from "node:fs";
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { join as join47, dirname as dirname13, resolve as resolve31 } from "node:path";
-import { homedir as homedir27 } from "node:os";
-var DEFAULT_COMPOSE_PATH = join47(homedir27(), ".switchroom", "compose", "docker-compose.yml");
+import { join as join48, dirname as dirname13, resolve as resolve31 } from "node:path";
+import { homedir as homedir28 } from "node:os";
+var DEFAULT_COMPOSE_PATH = join48(homedir28(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname13(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync51(join47(dir, ".git"))) {
+    if (existsSync52(join48(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync46(join47(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync46(join48(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -69872,7 +70092,7 @@ function planUpdate(opts) {
   steps.push({
     name: "pull-images",
     description: "Pull broker / kernel / agent images from GHCR",
-    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync51(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
+    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync52(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
     run: () => {
       const r = runner("docker", [
         "compose",
@@ -69951,14 +70171,14 @@ function planUpdate(opts) {
         return;
       }
       const source = resolve31(import.meta.dirname, "../../skills");
-      const dest = join47(homedir27(), ".switchroom", "skills", "_bundled");
-      if (!existsSync51(source)) {
+      const dest = join48(homedir28(), ".switchroom", "skills", "_bundled");
+      if (!existsSync52(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
         return;
       }
       try {
-        if (existsSync51(dest)) {
+        if (existsSync52(dest)) {
           rmSync12(dest, { recursive: true, force: true });
         }
         mkdirSync28(dirname13(dest), { recursive: true });
@@ -70061,12 +70281,12 @@ function defaultStatusProbe(composePath) {
     } catch {}
     if (scriptPath) {
       try {
-        cliBuiltAt = new Date(statSync23(scriptPath).mtimeMs).toISOString();
+        cliBuiltAt = new Date(statSync24(scriptPath).mtimeMs).toISOString();
       } catch {}
       let dir = dirname13(scriptPath);
       for (let i = 0;i < 8; i++) {
-        const pkgPath = join47(dir, "package.json");
-        if (existsSync51(pkgPath)) {
+        const pkgPath = join48(dir, "package.json");
+        if (existsSync52(pkgPath)) {
           try {
             const pkg = JSON.parse(readFileSync46(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
@@ -70089,7 +70309,7 @@ function defaultStatusProbe(composePath) {
     warnings.push("could not resolve CLI version (no package.json found above the resolved script path)");
   }
   const services = [];
-  if (!existsSync51(composePath)) {
+  if (!existsSync52(composePath)) {
     warnings.push(`compose file not found at ${composePath}; service status unknown`);
     return { cliVersion, cliBuiltAt, services, warnings };
   }
@@ -70284,8 +70504,8 @@ init_source();
 init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
-import { existsSync as existsSync52, readFileSync as readFileSync47 } from "node:fs";
-import { dirname as dirname14, join as join48 } from "node:path";
+import { existsSync as existsSync53, readFileSync as readFileSync47 } from "node:fs";
+import { dirname as dirname14, join as join49 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync4("claude --version 2>/dev/null", {
@@ -70335,11 +70555,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const pkgPath = join48(dir, "package.json");
-    if (existsSync52(pkgPath)) {
+    const pkgPath = join49(dir, "package.json");
+    if (existsSync53(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync47(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync52(join48(dir, ".git"))) {
+        if (pkg.name === "switchroom" && existsSync53(join49(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -70554,18 +70774,18 @@ function registerHandoffCommand(program3) {
 // src/issues/store.ts
 import {
   closeSync as closeSync11,
-  existsSync as existsSync53,
+  existsSync as existsSync54,
   mkdirSync as mkdirSync29,
   openSync as openSync11,
   readdirSync as readdirSync20,
   readFileSync as readFileSync48,
   renameSync as renameSync11,
-  statSync as statSync24,
+  statSync as statSync25,
   unlinkSync as unlinkSync11,
   writeFileSync as writeFileSync25,
   writeSync as writeSync7
 } from "node:fs";
-import { join as join49 } from "node:path";
+import { join as join50 } from "node:path";
 import { randomBytes as randomBytes11 } from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
 
@@ -70885,8 +71105,8 @@ function redactedMarker(ruleId) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path4 = join49(stateDir, ISSUES_FILE);
-  if (!existsSync53(path4))
+  const path4 = join50(stateDir, ISSUES_FILE);
+  if (!existsSync54(path4))
     return [];
   let raw;
   try {
@@ -70963,7 +71183,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve34(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync53(join49(stateDir, ISSUES_FILE)))
+  if (!existsSync54(join50(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -70981,7 +71201,7 @@ function resolve34(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync53(join49(stateDir, ISSUES_FILE)))
+  if (!existsSync54(join50(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -70999,7 +71219,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync53(join49(stateDir, ISSUES_FILE)))
+  if (!existsSync54(join50(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -71032,7 +71252,7 @@ function ensureDir(stateDir) {
   mkdirSync29(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path4 = join49(stateDir, ISSUES_FILE);
+  const path4 = join50(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path4}.tmp-${process.pid}-${randomBytes11(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -71054,9 +71274,9 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join49(stateDir, entry);
+    const tmpPath = join50(stateDir, entry);
     try {
-      const stat = statSync24(tmpPath);
+      const stat = statSync25(tmpPath);
       if (stat.mtimeMs < cutoff) {
         unlinkSync11(tmpPath);
       }
@@ -71066,7 +71286,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join49(stateDir, ISSUES_LOCK);
+  const lockPath = join50(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -71349,22 +71569,22 @@ function relTime(deltaMs) {
 
 // src/cli/deps.ts
 init_source();
-import { existsSync as existsSync56 } from "node:fs";
-import { homedir as homedir30 } from "node:os";
-import { join as join52, resolve as resolve35 } from "node:path";
+import { existsSync as existsSync57 } from "node:fs";
+import { homedir as homedir31 } from "node:os";
+import { join as join53, resolve as resolve35 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash10 } from "node:crypto";
 import {
-  existsSync as existsSync54,
+  existsSync as existsSync55,
   mkdirSync as mkdirSync30,
   readFileSync as readFileSync49,
   rmSync as rmSync13,
   writeFileSync as writeFileSync26
 } from "node:fs";
-import { dirname as dirname15, join as join50 } from "node:path";
-import { homedir as homedir28 } from "node:os";
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { dirname as dirname15, join as join51 } from "node:path";
+import { homedir as homedir29 } from "node:os";
+import { execFileSync as execFileSync15 } from "node:child_process";
 
 class PythonEnvError extends Error {
   stderr;
@@ -71375,7 +71595,7 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join50(homedir28(), ".switchroom", "deps", "python");
+  return join51(homedir29(), ".switchroom", "deps", "python");
 }
 function hashFile(path4) {
   return createHash10("sha256").update(readFileSync49(path4)).digest("hex");
@@ -71384,16 +71604,16 @@ function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultPythonCacheRoot();
   const hostPython = opts.pythonBin ?? "python3";
-  if (!existsSync54(requirementsPath)) {
+  if (!existsSync55(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join50(cacheRoot, skillName);
-  const stampPath = join50(venvDir, ".requirements.sha256");
-  const binDir = join50(venvDir, "bin");
-  const pythonBin = join50(binDir, "python");
-  const pipBin = join50(binDir, "pip");
+  const venvDir = join51(cacheRoot, skillName);
+  const stampPath = join51(venvDir, ".requirements.sha256");
+  const binDir = join51(venvDir, "bin");
+  const pythonBin = join51(binDir, "python");
+  const pipBin = join51(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
-  if (!force && existsSync54(stampPath) && existsSync54(pythonBin)) {
+  if (!force && existsSync55(stampPath) && existsSync55(pythonBin)) {
     const existingHash = readFileSync49(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
@@ -71406,12 +71626,12 @@ function ensurePythonEnv(opts) {
       };
     }
   }
-  if (existsSync54(venvDir)) {
+  if (existsSync55(venvDir)) {
     rmSync13(venvDir, { recursive: true, force: true });
   }
   mkdirSync30(dirname15(venvDir), { recursive: true });
   try {
-    execFileSync14(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
+    execFileSync15(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
   } catch (err) {
     const e = err;
     throw new PythonEnvError(`Failed to create venv for skill "${skillName}" with ${hostPython}: ${e.message}`, e.stderr?.toString());
@@ -71423,7 +71643,7 @@ function ensurePythonEnv(opts) {
     delete childEnv.PIP_TARGET;
     delete childEnv.PIP_PREFIX;
     delete childEnv.PYTHONUSERBASE;
-    execFileSync14(pipBin, ["install", "--disable-pip-version-check", "-r", requirementsPath], { stdio: "pipe", env: childEnv });
+    execFileSync15(pipBin, ["install", "--disable-pip-version-check", "-r", requirementsPath], { stdio: "pipe", env: childEnv });
   } catch (err) {
     const e = err;
     throw new PythonEnvError(`Failed to install requirements for skill "${skillName}": ${e.message}`, e.stderr?.toString());
@@ -71444,15 +71664,15 @@ function ensurePythonEnv(opts) {
 import { createHash as createHash11 } from "node:crypto";
 import {
   copyFileSync as copyFileSync9,
-  existsSync as existsSync55,
+  existsSync as existsSync56,
   mkdirSync as mkdirSync31,
   readFileSync as readFileSync50,
   rmSync as rmSync14,
   writeFileSync as writeFileSync27
 } from "node:fs";
-import { dirname as dirname16, join as join51 } from "node:path";
-import { homedir as homedir29 } from "node:os";
-import { execFileSync as execFileSync15 } from "node:child_process";
+import { dirname as dirname16, join as join52 } from "node:path";
+import { homedir as homedir30 } from "node:os";
+import { execFileSync as execFileSync16 } from "node:child_process";
 
 class NodeEnvError extends Error {
   stderr;
@@ -71474,7 +71694,7 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join51(homedir29(), ".switchroom", "deps", "node");
+  return join52(homedir30(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
   const sourceDir = dirname16(packageJsonPath);
@@ -71483,8 +71703,8 @@ function hashDepInputs(packageJsonPath) {
 `);
   hasher.update(readFileSync50(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join51(sourceDir, lockName);
-    if (existsSync55(lockPath)) {
+    const lockPath = join52(sourceDir, lockName);
+    if (existsSync56(lockPath)) {
       hasher.update(`
 `);
       hasher.update(lockName);
@@ -71499,16 +71719,16 @@ function ensureNodeEnv(opts) {
   const { skillName, packageJsonPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultNodeCacheRoot();
   const installer = opts.installer ?? "bun";
-  if (!existsSync55(packageJsonPath)) {
+  if (!existsSync56(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
   const sourceDir = dirname16(packageJsonPath);
-  const envDir = join51(cacheRoot, skillName);
-  const stampPath = join51(envDir, ".package.sha256");
-  const nodeModulesDir = join51(envDir, "node_modules");
-  const binDir = join51(nodeModulesDir, ".bin");
+  const envDir = join52(cacheRoot, skillName);
+  const stampPath = join52(envDir, ".package.sha256");
+  const nodeModulesDir = join52(envDir, "node_modules");
+  const binDir = join52(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
-  if (!force && existsSync55(stampPath) && existsSync55(nodeModulesDir)) {
+  if (!force && existsSync56(stampPath) && existsSync56(nodeModulesDir)) {
     const existingHash = readFileSync50(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
@@ -71520,26 +71740,26 @@ function ensureNodeEnv(opts) {
       };
     }
   }
-  if (existsSync55(envDir)) {
+  if (existsSync56(envDir)) {
     rmSync14(envDir, { recursive: true, force: true });
   }
   mkdirSync31(envDir, { recursive: true });
-  copyFileSync9(packageJsonPath, join51(envDir, "package.json"));
+  copyFileSync9(packageJsonPath, join52(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join51(sourceDir, lockName);
-    if (existsSync55(lockPath)) {
-      copyFileSync9(lockPath, join51(envDir, lockName));
+    const lockPath = join52(sourceDir, lockName);
+    if (existsSync56(lockPath)) {
+      copyFileSync9(lockPath, join52(envDir, lockName));
       copiedLockfile = true;
     }
   }
   try {
     if (installer === "bun") {
       const args = copiedLockfile ? ["install", "--frozen-lockfile"] : ["install"];
-      execFileSync15("bun", args, { cwd: envDir, stdio: "pipe" });
+      execFileSync16("bun", args, { cwd: envDir, stdio: "pipe" });
     } else {
       const args = copiedLockfile ? ["ci"] : ["install"];
-      execFileSync15("npm", args, { cwd: envDir, stdio: "pipe" });
+      execFileSync16("npm", args, { cwd: envDir, stdio: "pipe" });
     }
   } catch (err) {
     const e = err;
@@ -71558,28 +71778,28 @@ function ensureNodeEnv(opts) {
 
 // src/cli/deps.ts
 function builtinSkillsRoot() {
-  return resolve35(homedir30(), ".switchroom/skills/_bundled");
+  return resolve35(homedir31(), ".switchroom/skills/_bundled");
 }
 function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
   deps.command("rebuild <skill>").description("Rebuild the Python venv and/or Node node_modules cache for a skill").option("-p, --python", "Rebuild only the Python env").option("-n, --node", "Rebuild only the Node env").action(async (skill, opts) => {
     const skillsRoot = builtinSkillsRoot();
-    if (!existsSync56(skillsRoot)) {
+    if (!existsSync57(skillsRoot)) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join52(skillsRoot, skill);
-    if (!existsSync56(skillDir)) {
+    const skillDir = join53(skillsRoot, skill);
+    if (!existsSync57(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join52(skillDir, "requirements.txt");
-    const packageJsonPath = join52(skillDir, "package.json");
-    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync56(requirementsPath));
-    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync56(packageJsonPath));
+    const requirementsPath = join53(skillDir, "requirements.txt");
+    const packageJsonPath = join53(skillDir, "package.json");
+    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync57(requirementsPath));
+    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync57(packageJsonPath));
     let did = 0;
     if (wantPython) {
-      if (!existsSync56(requirementsPath)) {
+      if (!existsSync57(requirementsPath)) {
         console.error(source_default.red(`Skill "${skill}" has no requirements.txt at ${requirementsPath}`));
         process.exit(1);
       }
@@ -71603,7 +71823,7 @@ function registerDepsCommand(program3) {
       }
     }
     if (wantNode) {
-      if (!existsSync56(packageJsonPath)) {
+      if (!existsSync57(packageJsonPath)) {
         console.error(source_default.red(`Skill "${skill}" has no package.json at ${packageJsonPath}`));
         process.exit(1);
       }
@@ -71636,7 +71856,7 @@ function registerDepsCommand(program3) {
 // src/cli/workspace.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync57 } from "node:fs";
+import { existsSync as existsSync58 } from "node:fs";
 import { resolve as resolve36, sep as sep3 } from "node:path";
 import { spawnSync as spawnSync9 } from "node:child_process";
 
@@ -72413,7 +72633,7 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve36(dir, ".git");
-    if (!existsSync57(gitDir)) {
+    if (!existsSync58(gitDir)) {
       process.stdout.write(`Workspace is not a git repository. Re-run \`switchroom agent create ${agentName}\` ` + `or manually \`git init\` in ${dir} to enable versioning.
 `);
       return;
@@ -72467,7 +72687,7 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve36(dir, ".git");
-    if (!existsSync57(gitDir)) {
+    if (!existsSync58(gitDir)) {
       process.stdout.write(`Workspace is not a git repository.
 `);
       return;
@@ -72492,7 +72712,7 @@ function resolveAgentWorkspaceDirOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve36(agentsDir, agentName);
   const dir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync57(dir)) {
+  if (!existsSync58(dir)) {
     process.stderr.write(`workspace: ${dir} does not exist yet. Run \`switchroom setup\` or \`switchroom agent scaffold ${agentName}\` to seed it.
 `);
     return;
@@ -72528,8 +72748,8 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync10, existsSync as existsSync58, readFileSync as readFileSync51, writeFileSync as writeFileSync28 } from "node:fs";
-import { join as join53, resolve as resolve37 } from "node:path";
+import { copyFileSync as copyFileSync10, existsSync as existsSync59, readFileSync as readFileSync51, writeFileSync as writeFileSync28 } from "node:fs";
+import { join as join54, resolve as resolve37 } from "node:path";
 init_schema();
 function resolveSoulTargetOrExit(program3, agentName) {
   const config = getConfig(program3);
@@ -72544,7 +72764,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve37(agentsDir, agentName);
   const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync58(workspaceDir)) {
+  if (!existsSync59(workspaceDir)) {
     console.error(`soul: ${workspaceDir} does not exist yet. Run \`switchroom setup\` ` + `or \`switchroom agent scaffold ${agentName}\` to seed it.`);
     process.exit(1);
   }
@@ -72553,7 +72773,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join53(workspaceDir, "SOUL.md"),
+    soulPath: join54(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -72570,7 +72790,7 @@ function registerSoulCommand(program3) {
     const t = resolveSoulTargetOrExit(program3, agentName);
     if (!t)
       return;
-    if (!existsSync58(t.soulPath)) {
+    if (!existsSync59(t.soulPath)) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
@@ -72585,7 +72805,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: profile "${t.profileName}" ships no SOUL.md.hbs \u2014 ` + `nothing to re-seed from.`);
       process.exit(1);
     }
-    const exists = existsSync58(t.soulPath);
+    const exists = existsSync59(t.soulPath);
     if (exists && !opts.yes) {
       if (!isInteractive()) {
         console.error(`soul: ${t.soulPath} already exists. Re-run with --yes to ` + `replace it (the current file is backed up to SOUL.md.bak).`);
@@ -72600,7 +72820,7 @@ function registerSoulCommand(program3) {
     let backupPath;
     if (exists) {
       backupPath = `${t.soulPath}.bak`;
-      if (existsSync58(backupPath)) {
+      if (existsSync59(backupPath)) {
         backupPath = `${t.soulPath}.bak.${Date.now()}`;
       }
       copyFileSync10(t.soulPath, backupPath);
@@ -72619,8 +72839,8 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync59, readFileSync as readFileSync52, readdirSync as readdirSync21, statSync as statSync25 } from "node:fs";
-import { resolve as resolve38, join as join54 } from "node:path";
+import { existsSync as existsSync60, readFileSync as readFileSync52, readdirSync as readdirSync21, statSync as statSync26 } from "node:fs";
+import { resolve as resolve38, join as join55 } from "node:path";
 import { createHash as createHash12 } from "node:crypto";
 init_merge();
 init_hindsight();
@@ -72634,8 +72854,8 @@ function sha256(content) {
   return createHash12("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join54(claudeConfigDir, "projects");
-  if (!existsSync59(projectsDir))
+  const projectsDir = join55(claudeConfigDir, "projects");
+  if (!existsSync60(projectsDir))
     return;
   try {
     const entries = readdirSync21(projectsDir, { withFileTypes: true });
@@ -72643,11 +72863,11 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join54(projectsDir, entry.name);
-      const transcriptPath = join54(projectPath, "transcript.jsonl");
-      if (!existsSync59(transcriptPath))
+      const projectPath = join55(projectsDir, entry.name);
+      const transcriptPath = join55(projectPath, "transcript.jsonl");
+      if (!existsSync60(transcriptPath))
         continue;
-      const stat3 = statSync25(transcriptPath);
+      const stat3 = statSync26(transcriptPath);
       if (!latest || stat3.mtimeMs > latest.mtime) {
         latest = { path: transcriptPath, mtime: stat3.mtimeMs };
       }
@@ -72708,16 +72928,16 @@ function registerDebugCommand(program3) {
     }
     const agentsDir = resolveAgentsDir(config);
     const agentDir = resolve38(agentsDir, agentName);
-    if (!existsSync59(agentDir)) {
+    if (!existsSync60(agentDir)) {
       console.error(`Agent directory not found: ${agentDir}`);
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join54(agentDir, ".claude");
-    const claudeMdPath = join54(agentDir, "CLAUDE.md");
-    const soulMdPath = join54(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join54(workspaceDir, "SOUL.md");
-    const handoffPath = join54(agentDir, ".handoff.md");
+    const claudeConfigDir = join55(agentDir, ".claude");
+    const claudeMdPath = join55(agentDir, "CLAUDE.md");
+    const soulMdPath = join55(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join55(workspaceDir, "SOUL.md");
+    const handoffPath = join55(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -72763,7 +72983,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Append System Prompt (per-session) ===
 `);
-    const handoffContent = existsSync59(handoffPath) ? readFileSync52(handoffPath, "utf-8") : "";
+    const handoffContent = existsSync60(handoffPath) ? readFileSync52(handoffPath, "utf-8") : "";
     if (handoffContent.trim().length > 0) {
       console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
       console.log(handoffContent);
@@ -72774,7 +72994,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
 `);
-    const claudeMdContent = existsSync59(claudeMdPath) ? readFileSync52(claudeMdPath, "utf-8") : "";
+    const claudeMdContent = existsSync60(claudeMdPath) ? readFileSync52(claudeMdPath, "utf-8") : "";
     if (claudeMdContent.trim().length > 0) {
       console.log(`(${formatBytes(claudeMdContent.length)})`);
       console.log(claudeMdContent);
@@ -72785,7 +73005,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Persona (SOUL.md) ===
 `);
-    const soulMdContent = existsSync59(soulMdPath) ? readFileSync52(soulMdPath, "utf-8") : existsSync59(workspaceSoulMdPath) ? readFileSync52(workspaceSoulMdPath, "utf-8") : "";
+    const soulMdContent = existsSync60(soulMdPath) ? readFileSync52(soulMdPath, "utf-8") : existsSync60(workspaceSoulMdPath) ? readFileSync52(workspaceSoulMdPath, "utf-8") : "";
     if (soulMdContent.trim().length > 0) {
       console.log(`(${formatBytes(soulMdContent.length)})`);
       console.log(soulMdContent);
@@ -72865,10 +73085,10 @@ function registerDebugCommand(program3) {
 init_source();
 
 // src/worktree/claim.ts
-import { execFileSync as execFileSync16 } from "node:child_process";
-import { closeSync as closeSync12, mkdirSync as mkdirSync33, openSync as openSync12, existsSync as existsSync61, unlinkSync as unlinkSync13 } from "node:fs";
-import { join as join56, resolve as resolve40 } from "node:path";
-import { homedir as homedir32 } from "node:os";
+import { execFileSync as execFileSync17 } from "node:child_process";
+import { closeSync as closeSync12, mkdirSync as mkdirSync33, openSync as openSync12, existsSync as existsSync62, unlinkSync as unlinkSync13 } from "node:fs";
+import { join as join57, resolve as resolve40 } from "node:path";
+import { homedir as homedir33 } from "node:os";
 import { randomBytes as randomBytes12 } from "node:crypto";
 
 // src/worktree/registry.ts
@@ -72878,16 +73098,16 @@ import {
   readFileSync as readFileSync53,
   readdirSync as readdirSync22,
   unlinkSync as unlinkSync12,
-  existsSync as existsSync60,
+  existsSync as existsSync61,
   renameSync as renameSync12
 } from "node:fs";
-import { join as join55, resolve as resolve39 } from "node:path";
-import { homedir as homedir31 } from "node:os";
+import { join as join56, resolve as resolve39 } from "node:path";
+import { homedir as homedir32 } from "node:os";
 function registryDir() {
-  return resolve39(process.env.SWITCHROOM_WORKTREE_DIR ?? join55(homedir31(), ".switchroom", "worktrees"));
+  return resolve39(process.env.SWITCHROOM_WORKTREE_DIR ?? join56(homedir32(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join55(registryDir(), `${id}.json`);
+  return join56(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
   mkdirSync32(registryDir(), { recursive: true });
@@ -72938,7 +73158,7 @@ function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
   mkdirSync33(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join56(lockDir, `.lock-${lockName}`);
+  const lockPath = join57(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -72965,7 +73185,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve40(process.env.SWITCHROOM_WORKTREE_BASE ?? join56(homedir32(), ".switchroom", "worktree-checkouts"));
+  return resolve40(process.env.SWITCHROOM_WORKTREE_BASE ?? join57(homedir33(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes12(4).toString("hex");
@@ -72987,12 +73207,12 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join56(homedir32(), p.slice(2));
+    return join57(homedir33(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
   const repoPath = resolveRepoPath(input.repo, codeRepos);
-  if (!existsSync61(repoPath)) {
+  if (!existsSync62(repoPath)) {
     throw new Error(`Repository path does not exist: ${repoPath}`);
   }
   let concurrencyCap = DEFAULT_CONCURRENCY;
@@ -73015,7 +73235,7 @@ async function claimWorktree(input, codeRepos) {
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
     mkdirSync33(baseDir, { recursive: true });
-    worktreePath = join56(baseDir, `${id}-${taskSuffix}`);
+    worktreePath = join57(baseDir, `${id}-${taskSuffix}`);
     const now = new Date().toISOString();
     const record2 = {
       id,
@@ -73032,7 +73252,7 @@ async function claimWorktree(input, codeRepos) {
     releaseLock();
   }
   try {
-    execFileSync16("git", ["worktree", "add", "-b", branch, worktreePath], {
+    execFileSync17("git", ["worktree", "add", "-b", branch, worktreePath], {
       cwd: repoPath,
       stdio: "pipe"
     });
@@ -73045,8 +73265,8 @@ async function claimWorktree(input, codeRepos) {
 }
 
 // src/worktree/release.ts
-import { execFileSync as execFileSync17 } from "node:child_process";
-import { existsSync as existsSync62 } from "node:fs";
+import { execFileSync as execFileSync18 } from "node:child_process";
+import { existsSync as existsSync63 } from "node:fs";
 function releaseWorktree(input) {
   const { id } = input;
   const record2 = readRecord(id);
@@ -73054,9 +73274,9 @@ function releaseWorktree(input) {
     return { released: true };
   }
   let gitSuccess = true;
-  if (existsSync62(record2.path)) {
+  if (existsSync63(record2.path)) {
     try {
-      execFileSync17("git", ["worktree", "remove", "--force", record2.path], {
+      execFileSync18("git", ["worktree", "remove", "--force", record2.path], {
         cwd: record2.repo,
         stdio: "pipe"
       });
@@ -73092,16 +73312,16 @@ function listWorktrees() {
 }
 
 // src/worktree/reaper.ts
-import { execFileSync as execFileSync18 } from "node:child_process";
-import { existsSync as existsSync63 } from "node:fs";
+import { execFileSync as execFileSync19 } from "node:child_process";
+import { existsSync as existsSync64 } from "node:fs";
 var STALE_THRESHOLD_MS = 10 * 60 * 1000;
 function isPathInUse(path7) {
   try {
-    execFileSync18("fuser", [path7], { stdio: "pipe" });
+    execFileSync19("fuser", [path7], { stdio: "pipe" });
     return true;
   } catch {}
   try {
-    const out = execFileSync18("lsof", ["-t", path7], {
+    const out = execFileSync19("lsof", ["-t", path7], {
       stdio: ["ignore", "pipe", "ignore"]
     }).toString().trim();
     if (out.length > 0)
@@ -73111,7 +73331,7 @@ function isPathInUse(path7) {
 }
 function hasUncommittedChanges(repoPath, worktreePath) {
   try {
-    const out = execFileSync18("git", ["-C", worktreePath, "status", "--porcelain"], { stdio: "pipe" }).toString();
+    const out = execFileSync19("git", ["-C", worktreePath, "status", "--porcelain"], { stdio: "pipe" }).toString();
     return out.trim().length > 0;
   } catch {
     return false;
@@ -73120,12 +73340,12 @@ function hasUncommittedChanges(repoPath, worktreePath) {
 function reapRecord(record2) {
   const { id, path: path7, repo, branch, ownerAgent } = record2;
   let warning = null;
-  if (existsSync63(path7)) {
+  if (existsSync64(path7)) {
     if (hasUncommittedChanges(repo, path7)) {
       warning = `[worktree-reaper] Reaped worktree with uncommitted changes: ` + `id=${id} branch=${branch} agent=${ownerAgent ?? "unknown"} path=${path7}`;
     }
     try {
-      execFileSync18("git", ["worktree", "remove", "--force", path7], {
+      execFileSync19("git", ["worktree", "remove", "--force", path7], {
         cwd: repo,
         stdio: "pipe"
       });
@@ -73141,7 +73361,7 @@ function runReaper(nowMs) {
   const warnings = [];
   for (const record2 of records) {
     const heartbeatAge = now - new Date(record2.heartbeatAt).getTime();
-    const worktreeExists = existsSync63(record2.path);
+    const worktreeExists = existsSync64(record2.path);
     if (!worktreeExists) {
       deleteRecord(record2.id);
       reaped.push(record2.id);
@@ -73270,7 +73490,7 @@ import {
   rmSync as rmSync15,
   writeFileSync as writeFileSync30
 } from "node:fs";
-import { join as join57 } from "node:path";
+import { join as join58 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -73460,16 +73680,16 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join57(stateBase, "google-workspace-mcp", "credentials");
+  return join58(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
   mkdirSync34(dir, { recursive: true, mode: 448 });
   chmodSync9(dir, 448);
   for (const name of readdirSync23(dir)) {
-    rmSync15(join57(dir, name), { force: true, recursive: true });
+    rmSync15(join58(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join57(dir, filename);
+  const filePath = join58(dir, filename);
   writeFileSync30(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync9(filePath, 384);
   return filePath;
@@ -73627,7 +73847,7 @@ function registerDriveMcpLauncherCommand(program3) {
 
 // src/cli/apply.ts
 init_source();
-import { accessSync as accessSync3, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync67, mkdirSync as mkdirSync36, readdirSync as readdirSync25, renameSync as renameSync13, writeFileSync as writeFileSync32 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync68, mkdirSync as mkdirSync36, readdirSync as readdirSync25, renameSync as renameSync13, writeFileSync as writeFileSync32 } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
@@ -73990,16 +74210,16 @@ agents:
 
 // src/cli/apply.ts
 init_resolver();
-import { dirname as dirname19, join as join61, resolve as resolve42 } from "node:path";
-import { homedir as homedir34 } from "node:os";
-import { execFileSync as execFileSync19 } from "node:child_process";
+import { dirname as dirname19, join as join62, resolve as resolve42 } from "node:path";
+import { homedir as homedir35 } from "node:os";
+import { execFileSync as execFileSync20 } from "node:child_process";
 init_vault();
 init_loader();
 init_loader();
 
 // src/cli/update-prompt-hook.ts
-import { existsSync as existsSync64, readFileSync as readFileSync54, writeFileSync as writeFileSync31, chmodSync as chmodSync10, mkdirSync as mkdirSync35 } from "node:fs";
-import { join as join58 } from "node:path";
+import { existsSync as existsSync65, readFileSync as readFileSync54, writeFileSync as writeFileSync31, chmodSync as chmodSync10, mkdirSync as mkdirSync35 } from "node:fs";
+import { join as join59 } from "node:path";
 var HOOK_FILENAME = "update-card-on-prompt.sh";
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -74065,12 +74285,12 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join58(agentDir, ".claude", "hooks");
+  const hooksDir = join59(agentDir, ".claude", "hooks");
   mkdirSync35(hooksDir, { recursive: true });
-  const scriptPath = join58(hooksDir, HOOK_FILENAME);
+  const scriptPath = join59(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
-  const existing = existsSync64(scriptPath) ? readFileSync54(scriptPath, "utf-8") : "";
+  const existing = existsSync65(scriptPath) ? readFileSync54(scriptPath, "utf-8") : "";
   if (existing !== desired) {
     writeFileSync31(scriptPath, desired, { mode: 493 });
     chmodSync10(scriptPath, 493);
@@ -74080,8 +74300,8 @@ function installUpdatePromptHook(agentDir) {
       chmodSync10(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join58(agentDir, ".claude", "settings.json");
-  if (!existsSync64(settingsPath)) {
+  const settingsPath = join59(agentDir, ".claude", "settings.json");
+  if (!existsSync65(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
   const raw = readFileSync54(settingsPath, "utf-8");
@@ -74200,13 +74420,13 @@ function detectInstallType() {
 // src/cli/operator-uid.ts
 import {
   chownSync as chownSync3,
-  existsSync as existsSync66,
+  existsSync as existsSync67,
   lstatSync as lstatSync7,
   readdirSync as readdirSync24,
   realpathSync as realpathSync6,
-  statSync as statSync26
+  statSync as statSync27
 } from "node:fs";
-import { join as join60 } from "node:path";
+import { join as join61 } from "node:path";
 function resolveOperatorUid() {
   const sudoUid = process.env.SUDO_UID;
   if (sudoUid !== undefined) {
@@ -74222,19 +74442,19 @@ function resolveOperatorUid() {
   return;
 }
 function operatorOwnedPaths(home2) {
-  const root = join60(home2, ".switchroom");
+  const root = join61(home2, ".switchroom");
   return [
-    join60(root, "vault"),
-    join60(root, "vault-auto-unlock"),
-    join60(root, "vault-audit.log"),
-    join60(root, "host-control-audit.log"),
-    join60(root, "accounts"),
-    join60(root, "compose")
+    join61(root, "vault"),
+    join61(root, "vault-auto-unlock"),
+    join61(root, "vault-audit.log"),
+    join61(root, "host-control-audit.log"),
+    join61(root, "accounts"),
+    join61(root, "compose")
   ];
 }
 function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
   const chown = deps.chown ?? ((p, u, g) => chownSync3(p, u, g));
-  const exists = deps.exists ?? ((p) => existsSync66(p));
+  const exists = deps.exists ?? ((p) => existsSync67(p));
   const isSymlink = deps.isSymlink ?? ((p) => {
     try {
       return lstatSync7(p).isSymbolicLink();
@@ -74244,7 +74464,7 @@ function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
   });
   const isDir = deps.isDir ?? ((p) => {
     try {
-      return statSync26(p).isDirectory();
+      return statSync27(p).isDirectory();
     } catch {
       return false;
     }
@@ -74278,7 +74498,7 @@ function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
     } catch {}
     if (isDir(target)) {
       for (const entry of readdir2(target)) {
-        visit(join60(target, entry));
+        visit(join61(target, entry));
       }
     }
   };
@@ -74292,17 +74512,17 @@ var EMBEDDED_EXAMPLES = {
   switchroom: switchroom_default,
   minimal: minimal_default
 };
-var DEFAULT_COMPOSE_PATH2 = join61(homedir34(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH2 = join62(homedir35(), ".switchroom", "compose", "docker-compose.yml");
 var COMPOSE_PROJECT2 = "switchroom";
 function resolveVaultBindMountDir(homeDir, ctx) {
   const isCustomPath = ctx.migrationKind === "custom-path-skipped";
   if (isCustomPath && ctx.customVaultPath) {
     return dirname19(ctx.customVaultPath);
   }
-  return join61(homeDir, ".switchroom", "vault");
+  return join62(homeDir, ".switchroom", "vault");
 }
 function inspectVaultBindMountDir(vaultDir) {
-  if (!existsSync67(vaultDir))
+  if (!existsSync68(vaultDir))
     return { kind: "missing" };
   const entries = readdirSync25(vaultDir);
   const unknown = [];
@@ -74328,38 +74548,42 @@ function hasVaultRefs(value) {
   return false;
 }
 async function ensureHostMountSources(config) {
-  const home2 = homedir34();
+  const home2 = homedir35();
   const dirs = [
-    join61(home2, ".switchroom", "approvals"),
-    join61(home2, ".switchroom", "scheduler"),
-    join61(home2, ".switchroom", "logs"),
-    join61(home2, ".switchroom", "compose"),
-    join61(home2, ".switchroom", "broker-operator")
+    join62(home2, ".switchroom", "approvals"),
+    join62(home2, ".switchroom", "scheduler"),
+    join62(home2, ".switchroom", "logs"),
+    join62(home2, ".switchroom", "compose"),
+    join62(home2, ".switchroom", "broker-operator")
   ];
   for (const name of Object.keys(config.agents)) {
-    dirs.push(join61(home2, ".switchroom", "agents", name));
-    dirs.push(join61(home2, ".switchroom", "logs", name));
-    dirs.push(join61(home2, ".claude", "projects", name));
+    dirs.push(join62(home2, ".switchroom", "agents", name));
+    dirs.push(join62(home2, ".switchroom", "logs", name));
+    dirs.push(join62(home2, ".claude", "projects", name));
   }
   for (const dir of dirs) {
     await mkdir(dir, { recursive: true });
   }
-  const autoUnlockPath = join61(home2, ".switchroom", "vault-auto-unlock");
-  if (!existsSync67(autoUnlockPath)) {
+  const autoUnlockPath = join62(home2, ".switchroom", "vault-auto-unlock");
+  if (!existsSync68(autoUnlockPath)) {
     writeFileSync32(autoUnlockPath, "", { mode: 384 });
   }
-  const auditLogPath = join61(home2, ".switchroom", "vault-audit.log");
-  if (!existsSync67(auditLogPath)) {
+  const auditLogPath = join62(home2, ".switchroom", "vault-audit.log");
+  if (!existsSync68(auditLogPath)) {
     writeFileSync32(auditLogPath, "", { mode: 420 });
   }
-  const hostdAuditLogPath = join61(home2, ".switchroom", "host-control-audit.log");
-  if (!existsSync67(hostdAuditLogPath)) {
+  const grantsDbPath = join62(home2, ".switchroom", "vault-grants.db");
+  if (!existsSync68(grantsDbPath)) {
+    writeFileSync32(grantsDbPath, "", { mode: 384 });
+  }
+  const hostdAuditLogPath = join62(home2, ".switchroom", "host-control-audit.log");
+  if (!existsSync68(hostdAuditLogPath)) {
     writeFileSync32(hostdAuditLogPath, "", { mode: 420 });
   }
 }
 function detectComposeV2() {
   try {
-    const out = execFileSync19("docker", ["compose", "version"], {
+    const out = execFileSync20("docker", ["compose", "version"], {
       stdio: ["ignore", "pipe", "pipe"],
       encoding: "utf8"
     });
@@ -74374,7 +74598,7 @@ ${out.trim()}`;
 }
 function runApplyPreflight(config, opts = {}) {
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (hasVaultRefs(config) && !existsSync67(vaultPath)) {
+  if (hasVaultRefs(config) && !existsSync68(vaultPath)) {
     throw new Error(`Config references vault keys (vault:<name>) but ${vaultPath} is missing. ` + `Run \`switchroom setup\` first to initialise the vault.`);
   }
   const detect = opts.detectComposeV2 ?? detectComposeV2;
@@ -74385,7 +74609,7 @@ function runApplyPreflight(config, opts = {}) {
   detectAndReportLegacyGdriveSlots(vaultPath);
 }
 function detectAndReportLegacyGdriveSlots(vaultPath) {
-  if (!existsSync67(vaultPath))
+  if (!existsSync68(vaultPath))
     return;
   const passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
   if (!passphrase)
@@ -74424,10 +74648,10 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 `));
   }
 }
-function writeInstallTypeCache(homeDir = homedir34()) {
+function writeInstallTypeCache(homeDir = homedir35()) {
   const ctx = detectInstallType();
-  const dir = join61(homeDir, ".switchroom");
-  const out = join61(dir, "install-type.json");
+  const dir = join62(homeDir, ".switchroom");
+  const out = join62(dir, "install-type.json");
   const tmp = `${out}.tmp`;
   mkdirSync36(dir, { recursive: true });
   const payload = {
@@ -74476,14 +74700,14 @@ Applying switchroom config...
       writeOut(source_default.green(`  + ${name}`) + source_default.gray(` (${agentConfig.extends ?? "default"}) \u2014 ${detail}
 `));
       try {
-        installUpdatePromptHook(join61(agentsDir, name));
+        installUpdatePromptHook(join62(agentsDir, name));
       } catch (hookErr) {
         writeOut(source_default.gray(`    (update-prompt hook install failed for ${name}: ${hookErr.message})
 `));
       }
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join61(agentsDir, name), uid, {
+        alignAgentUid(name, join62(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -74520,7 +74744,7 @@ Applying switchroom config...
     for (const name of agentNames) {
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join61(agentsDir, name), uid, {
+        alignAgentUid(name, join62(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -74534,7 +74758,7 @@ Applying switchroom config...
   }
   const vaultPathConfigured = config.vault?.path;
   const customVaultPath = vaultPathConfigured ? resolvePath(vaultPathConfigured) : undefined;
-  const migrationResult = migrateVaultLayout(homedir34(), {
+  const migrationResult = migrateVaultLayout(homedir35(), {
     customVaultPath
   });
   switch (migrationResult.kind) {
@@ -74560,7 +74784,7 @@ Applying switchroom config...
       writeErr(formatDivergentRecoveryMessage(migrationResult.details));
       process.exit(4);
   }
-  const postMigrationInspect = inspectVaultLayout(homedir34());
+  const postMigrationInspect = inspectVaultLayout(homedir35());
   const acceptable = [
     "no-vault",
     "already-migrated",
@@ -74575,7 +74799,7 @@ Applying switchroom config...
 `));
     process.exit(5);
   }
-  const vaultDir = resolveVaultBindMountDir(homedir34(), {
+  const vaultDir = resolveVaultBindMountDir(homedir35(), {
     migrationKind: migrationResult.kind,
     customVaultPath
   });
@@ -74605,7 +74829,7 @@ Applying switchroom config...
     imageTag: composeImageTag,
     buildMode: options.buildLocal ? "local" : "pull",
     buildContext: options.buildContext,
-    homeDir: homedir34(),
+    homeDir: homedir35(),
     switchroomConfigPath,
     operatorUid
   });
@@ -74625,7 +74849,7 @@ Wrote `) + composePath + source_default.gray(` (${composeBytes} bytes)
   writeOut(source_default.gray(`  (If pull returns 401, login to ghcr.io first: see docs/operators/install.md#ghcr-auth)
 `));
   if (process.geteuid?.() === 0 && operatorUid !== undefined) {
-    const restored = restoreOperatorOwnership(homedir34(), operatorUid);
+    const restored = restoreOperatorOwnership(homedir35(), operatorUid);
     if (restored.length > 0) {
       writeOut(source_default.gray(`  Restored operator ownership of ${restored.length} ~/.switchroom path(s)
 `));
@@ -74673,7 +74897,7 @@ function copyExampleConfig2(name) {
     throw new Error(`Invalid example name: ${name} (must match /^[a-z0-9_-]+$/)`);
   }
   const dest = resolve42(process.cwd(), "switchroom.yaml");
-  if (existsSync67(dest)) {
+  if (existsSync68(dest)) {
     console.error(source_default.yellow("switchroom.yaml already exists \u2014 skipping example copy"));
     return;
   }
@@ -74684,7 +74908,7 @@ function copyExampleConfig2(name) {
     return;
   }
   const exampleFile = resolve42(import.meta.dirname, `../../examples/${name}.yaml`);
-  if (!existsSync67(exampleFile)) {
+  if (!existsSync68(exampleFile)) {
     throw new Error(`Example config not found: ${name}.yaml (available: ${Object.keys(EMBEDDED_EXAMPLES).join(", ")})`);
   }
   copyFileSync11(exampleFile, dest);
@@ -74695,8 +74919,8 @@ function findUnwritableAgentDirs(config, opts) {
   const targets = opts.only ? [opts.only] : Object.keys(config.agents ?? {});
   const unwritable = [];
   for (const name of targets) {
-    const startSh = join61(agentsDir, name, "start.sh");
-    if (!existsSync67(startSh))
+    const startSh = join62(agentsDir, name, "start.sh");
+    if (!existsSync68(startSh))
       continue;
     try {
       accessSync3(startSh, fsConstants6.W_OK);
@@ -74874,9 +75098,9 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync55, existsSync as existsSync68, readdirSync as readdirSync26 } from "node:fs";
-import { join as join62 } from "node:path";
-import { homedir as homedir35 } from "node:os";
+import { readFileSync as readFileSync55, existsSync as existsSync69, readdirSync as readdirSync26 } from "node:fs";
+import { join as join63 } from "node:path";
+import { homedir as homedir36 } from "node:os";
 
 // src/status-ask/report.ts
 function parseJsonl(content) {
@@ -75197,7 +75421,7 @@ function runReport(opts) {
 function resolveSources(explicitPath) {
   if (explicitPath != null && explicitPath.trim() !== "") {
     const trimmed = explicitPath.trim();
-    if (!existsSync68(trimmed)) {
+    if (!existsSync69(trimmed)) {
       process.stderr.write(`status-ask report: ${trimmed}: file not found
 `);
       process.exit(1);
@@ -75211,9 +75435,9 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join62(homedir35(), ".switchroom", "agents");
+    agentsDir = join63(homedir36(), ".switchroom", "agents");
   }
-  if (!existsSync68(agentsDir))
+  if (!existsSync69(agentsDir))
     return [];
   const sources = [];
   let entries;
@@ -75223,8 +75447,8 @@ function resolveSources(explicitPath) {
     return [];
   }
   for (const name of entries) {
-    const path8 = join62(agentsDir, name, "runtime-metrics.jsonl");
-    if (existsSync68(path8)) {
+    const path8 = join63(agentsDir, name, "runtime-metrics.jsonl");
+    if (existsSync69(path8)) {
       sources.push({ path: path8, agent: name });
     }
   }
@@ -75245,17 +75469,17 @@ function inferAgentFromPath(p) {
 
 // src/cli/agent-config.ts
 init_helpers();
-import { join as join63 } from "node:path";
-import { homedir as homedir36 } from "node:os";
+import { join as join64 } from "node:path";
+import { homedir as homedir37 } from "node:os";
 import {
-  existsSync as existsSync69,
+  existsSync as existsSync70,
   mkdirSync as mkdirSync37,
   appendFileSync as appendFileSync4,
   readFileSync as readFileSync56
 } from "node:fs";
-var AUDIT_ROOT = join63(homedir36(), ".switchroom", "audit");
+var AUDIT_ROOT = join64(homedir37(), ".switchroom", "audit");
 function auditPathFor(agent) {
-  return join63(AUDIT_ROOT, agent, "agent-config.jsonl");
+  return join64(AUDIT_ROOT, agent, "agent-config.jsonl");
 }
 function appendAudit(agent, cmd, args, exit, opts = {}) {
   const row = {
@@ -75269,7 +75493,7 @@ function appendAudit(agent, cmd, args, exit, opts = {}) {
   const path8 = opts.auditPath ?? auditPathFor(agent);
   const dir = path8.slice(0, path8.lastIndexOf("/"));
   try {
-    if (!existsSync69(dir)) {
+    if (!existsSync70(dir)) {
       mkdirSync37(dir, { recursive: true });
     }
     appendFileSync4(path8, JSON.stringify(row) + `
@@ -75281,7 +75505,7 @@ function isContainerContext(env2 = process.env, opts = {}) {
     return true;
   const probe2 = opts.dockerEnvPath ?? "/.dockerenv";
   try {
-    if (existsSync69(probe2))
+    if (existsSync70(probe2))
       return true;
   } catch {}
   return false;
@@ -75342,7 +75566,7 @@ function getAgentSlice(config, agent) {
 }
 function readAuditTail(agent, limit, opts = {}) {
   const path8 = opts.auditPath ?? auditPathFor(agent);
-  if (!existsSync69(path8))
+  if (!existsSync70(path8))
     return [];
   let raw;
   try {
@@ -75502,32 +75726,32 @@ var import_yaml14 = __toESM(require_dist(), 1);
 init_paths();
 import {
   closeSync as closeSync13,
-  existsSync as existsSync70,
+  existsSync as existsSync71,
   fsyncSync as fsyncSync6,
   mkdirSync as mkdirSync38,
   openSync as openSync13,
   readdirSync as readdirSync27,
   readFileSync as readFileSync57,
   renameSync as renameSync14,
-  statSync as statSync27,
+  statSync as statSync28,
   unlinkSync as unlinkSync14,
   writeSync as writeSync8
 } from "node:fs";
-import { join as join64, resolve as resolve43 } from "node:path";
+import { join as join65, resolve as resolve43 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
   const base = opts.root ? resolve43(opts.root, agent) : resolve43(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join64(base, "schedule.d");
-  const scheduleStagingDir = join64(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join64(base, "skills.d");
-  const skillsStagingDir = join64(skillsDir, STAGING_SUBDIR);
+  const scheduleDir = join65(base, "schedule.d");
+  const scheduleStagingDir = join65(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join65(base, "skills.d");
+  const skillsStagingDir = join65(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join64(base, ".lock"),
+    lockPath: join65(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
@@ -75553,7 +75777,7 @@ function withAgentLock(paths, fn) {
       if (e.code !== "EEXIST")
         throw err;
       try {
-        const age = Date.now() - statSync27(paths.lockPath).mtimeMs;
+        const age = Date.now() - statSync28(paths.lockPath).mtimeMs;
         if (age > 30000) {
           unlinkSync14(paths.lockPath);
           continue;
@@ -75581,8 +75805,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join64(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join64(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join65(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join65(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -75598,8 +75822,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join64(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join64(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join65(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join65(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -75614,8 +75838,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join64(paths.skillsDir, `${slug}.yaml`);
-    if (!existsSync70(finalPath))
+    const finalPath = join65(paths.skillsDir, `${slug}.yaml`);
+    if (!existsSync71(finalPath))
       return false;
     unlinkSync14(finalPath);
     return true;
@@ -75623,13 +75847,13 @@ function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
 }
 function listSkillsOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync70(paths.skillsDir))
+  if (!existsSync71(paths.skillsDir))
     return [];
   const out = [];
   for (const name of readdirSync27(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join64(paths.skillsDir, name);
+    const full = join65(paths.skillsDir, name);
     try {
       const raw = readFileSync57(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -75641,8 +75865,8 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join64(paths.scheduleDir, `${slug}.yaml`);
-    if (!existsSync70(finalPath))
+    const finalPath = join65(paths.scheduleDir, `${slug}.yaml`);
+    if (!existsSync71(finalPath))
       return false;
     unlinkSync14(finalPath);
     return true;
@@ -75650,13 +75874,13 @@ function deleteOverlayEntry(agent, slug, opts = {}) {
 }
 function listOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync70(paths.scheduleDir))
+  if (!existsSync71(paths.scheduleDir))
     return [];
   const out = [];
   for (const name of readdirSync27(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join64(paths.scheduleDir, name);
+    const full = join65(paths.scheduleDir, name);
     try {
       const raw = readFileSync57(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -75801,7 +76025,7 @@ function reconcileAgentCronOnly(agent) {
 // src/cli/agent-config-pending.ts
 import {
   closeSync as closeSync14,
-  existsSync as existsSync71,
+  existsSync as existsSync72,
   fsyncSync as fsyncSync7,
   mkdirSync as mkdirSync39,
   openSync as openSync14,
@@ -75812,12 +76036,12 @@ import {
   writeFileSync as writeFileSync33,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join65 } from "node:path";
+import { join as join66 } from "node:path";
 import { randomBytes as randomBytes13 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join65(paths.scheduleDir, ".pending");
+  return join66(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
@@ -75830,8 +76054,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join65(dir, `${stageId}.yaml`);
-  const metaPath = join65(dir, `${stageId}.meta.json`);
+  const yamlPath = join66(dir, `${stageId}.yaml`);
+  const metaPath = join66(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -75858,16 +76082,16 @@ function stagePendingScheduleEntry(opts) {
 }
 function listPendingScheduleEntries(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  if (!existsSync71(dir))
+  if (!existsSync72(dir))
     return [];
   const out = [];
   for (const name of readdirSync28(dir).sort()) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join65(dir, name);
-    const yamlPath = join65(dir, `${stageId}.yaml`);
-    if (!existsSync71(yamlPath))
+    const metaPath = join66(dir, name);
+    const yamlPath = join66(dir, `${stageId}.yaml`);
+    if (!existsSync72(yamlPath))
       continue;
     try {
       const meta = JSON.parse(readFileSync58(metaPath, "utf-8"));
@@ -75885,8 +76109,8 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join65(paths.scheduleDir, `${slug}.yaml`);
-  if (existsSync71(finalPath)) {
+  const finalPath = join66(paths.scheduleDir, `${slug}.yaml`);
+  if (existsSync72(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
   renameSync15(match.yamlPath, finalPath);
@@ -75908,7 +76132,7 @@ function denyPendingScheduleEntry(opts) {
 }
 
 // src/cli/agent-config-write.ts
-import { existsSync as existsSync72, readFileSync as readFileSync59 } from "node:fs";
+import { existsSync as existsSync73, readFileSync as readFileSync59 } from "node:fs";
 var MAX_ENTRIES_PER_AGENT = 20;
 function checkOperatorContext(verb, env2 = process.env) {
   if (env2.SWITCHROOM_OPERATOR === "1")
@@ -76142,7 +76366,7 @@ function scheduleRemove(opts) {
   }
   let priorContent = null;
   try {
-    if (existsSync72(match.path))
+    if (existsSync73(match.path))
       priorContent = readFileSync59(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
@@ -76335,10 +76559,10 @@ function registerAgentConfigWriteCommands(program3) {
 
 // src/cli/agent-config-skill-write.ts
 var import_yaml15 = __toESM(require_dist(), 1);
-import { existsSync as existsSync73 } from "node:fs";
+import { existsSync as existsSync74 } from "node:fs";
 init_reconcile_default_skills();
 var import_yaml16 = __toESM(require_dist(), 1);
-import { join as join66 } from "node:path";
+import { join as join67 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -76413,8 +76637,8 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join66(poolDir, skillName);
-  if (!existsSync73(skillPath)) {
+  const skillPath = join67(poolDir, skillName);
+  if (!existsSync74(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
   const yamlText = import_yaml15.stringify({ skills: [skillName] });
@@ -76598,23 +76822,23 @@ init_source();
 init_helpers();
 init_loader();
 import {
-  existsSync as existsSync75,
+  existsSync as existsSync76,
   readdirSync as readdirSync29,
   readFileSync as readFileSync61,
   renameSync as renameSync16,
-  statSync as statSync28,
+  statSync as statSync29,
   unlinkSync as unlinkSync16
 } from "node:fs";
 import { createHash as createHash13 } from "node:crypto";
-import { join as join67 } from "node:path";
+import { join as join68 } from "node:path";
 function planCronUnitRenames(agentsDir, agents) {
   const plans = [];
   for (const [agentName, agentConfig] of Object.entries(agents)) {
     const schedule = agentConfig.schedule ?? [];
     if (schedule.length === 0)
       continue;
-    const telegramDir = join67(agentsDir, agentName, "telegram");
-    if (!existsSync75(telegramDir))
+    const telegramDir = join68(agentsDir, agentName, "telegram");
+    if (!existsSync76(telegramDir))
       continue;
     let entries;
     try {
@@ -76635,8 +76859,8 @@ function planCronUnitRenames(agentsDir, agents) {
         continue;
       plans.push({
         agent: agentName,
-        from: join67(telegramDir, file),
-        to: join67(telegramDir, canonical),
+        from: join68(telegramDir, file),
+        to: join68(telegramDir, canonical),
         scheduleIdx: idx,
         entry
       });
@@ -76648,7 +76872,7 @@ function sha256File2(path8) {
   return createHash13("sha256").update(readFileSync61(path8)).digest("hex");
 }
 function renamePair(from, to, opts = {}) {
-  if (existsSync75(to)) {
+  if (existsSync76(to)) {
     let identical = false;
     try {
       identical = sha256File2(from) === sha256File2(to);
@@ -76741,7 +76965,7 @@ function registerMigrateCommand(program3) {
         const fromSidecar = p.from.replace(/\.sh$/, ".source");
         const toSidecar = p.to.replace(/\.sh$/, ".source");
         let sidecarStatus = null;
-        if (existsSync75(fromSidecar) && statSync28(fromSidecar).isFile()) {
+        if (existsSync76(fromSidecar) && statSync29(fromSidecar).isFile()) {
           sidecarStatus = renamePair(fromSidecar, toSidecar);
         }
         switch (status.kind) {
@@ -76773,9 +76997,9 @@ function registerMigrateCommand(program3) {
 // src/cli/hostd.ts
 init_source();
 init_helpers();
-import { existsSync as existsSync76, mkdirSync as mkdirSync40, readdirSync as readdirSync30, readFileSync as readFileSync62, writeFileSync as writeFileSync34, statSync as statSync29, copyFileSync as copyFileSync12 } from "node:fs";
-import { homedir as homedir37 } from "node:os";
-import { join as join68 } from "node:path";
+import { existsSync as existsSync77, mkdirSync as mkdirSync40, readdirSync as readdirSync30, readFileSync as readFileSync62, writeFileSync as writeFileSync34, statSync as statSync30, copyFileSync as copyFileSync12 } from "node:fs";
+import { homedir as homedir38 } from "node:os";
+import { join as join69 } from "node:path";
 import { spawnSync as spawnSync11 } from "node:child_process";
 init_audit_reader();
 var DEFAULT_IMAGE_TAG = "latest";
@@ -76866,14 +77090,14 @@ networks:
 `;
 }
 function hostdDir() {
-  return join68(homedir37(), ".switchroom", "hostd");
+  return join69(homedir38(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join68(hostdDir(), "docker-compose.yml");
+  return join69(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
-  if (!existsSync76(p))
+  if (!existsSync77(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -76908,7 +77132,7 @@ async function doInstall(opts, program3) {
   const composePath = hostdComposePath();
   mkdirSync40(dir, { recursive: true });
   const yaml = renderHostdComposeFile({
-    hostHome: homedir37(),
+    hostHome: homedir38(),
     imageTag: opts.tag ?? DEFAULT_IMAGE_TAG,
     operatorUid: resolveOperatorUid()
   });
@@ -76950,7 +77174,7 @@ function doStatus() {
   const composeYml = hostdComposePath();
   console.log(source_default.bold("switchroom-hostd"));
   console.log("");
-  if (!existsSync76(composeYml)) {
+  if (!existsSync77(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom hostd install` to set up."));
     return;
@@ -76971,15 +77195,15 @@ function doStatus() {
   } else {
     console.log(source_default.green(`  container:  ${ps.stdout.trim()}`));
   }
-  if (existsSync76(dir)) {
+  if (existsSync77(dir)) {
     const entries = [];
     try {
       for (const name of readdirSync30(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join68(dir, name, "sock");
-        if (existsSync76(sockPath)) {
-          const st = statSync29(sockPath);
+        const sockPath = join69(dir, name, "sock");
+        if (existsSync77(sockPath)) {
+          const st = statSync30(sockPath);
           if ((st.mode & 61440) === 49152) {
             entries.push(`${name} \u2192 ${sockPath}`);
           }
@@ -76997,7 +77221,7 @@ function doStatus() {
 }
 function doUninstall() {
   const composeYml = hostdComposePath();
-  if (!existsSync76(composeYml)) {
+  if (!existsSync77(composeYml)) {
     console.log(source_default.yellow("  No hostd install detected (no compose file at this path)."));
     return;
   }
@@ -77021,7 +77245,7 @@ function registerHostdCommand(program3) {
   hostd.command("uninstall").description("Stop the hostd container. Leaves the compose file in place for re-install.").action(() => doUninstall());
   hostd.command("audit").description("Tail and filter the hostd audit log (privileged-verb call history)").option("--tail <n>", "Number of matching entries to show (default: 50)", "50").option("--agent <name>", "Filter to a specific caller agent").option("--op <verb>", "Filter to a specific hostd verb (e.g. update_apply, agent_restart)").option("--error", "Show only failed (error/denied) entries").option("--verbose", "Show the captured stderr / error tail under each failed row").option("--path <file>", "Override audit log path (for debugging)").action((opts) => {
     const logPath = opts.path ?? defaultAuditLogPath2();
-    if (!existsSync76(logPath)) {
+    if (!existsSync77(logPath)) {
       console.error(source_default.yellow(`Audit log not found at ${logPath}.`) + source_default.gray(`
 The log is created when hostd handles its first privileged-verb request.`));
       return;