switchroom 0.13.53 → 0.13.55

package/dist/cli/switchroom.js

@@ -13520,7 +13520,7 @@ var init_zod = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, DEFAULT_PROFILE = "default", AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, HostdConfigSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, DEFAULT_PROFILE = "default", AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, HostdConfigSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   CodeRepoEntrySchema = exports_external.object({
@@ -13561,7 +13561,8 @@ var init_schema = __esm(() => {
     recall: exports_external.object({
       max_memories: exports_external.number().int().min(0).optional().describe("Cap on the number of memories injected into the prompt by " + "auto-recall, regardless of token budget. Plugin default is 12. " + "0 disables the cap (all memories Hindsight returns are injected)."),
       cache_ttl_secs: exports_external.number().int().min(0).optional().describe("Per-session recall cache TTL in seconds. When > 0, identical " + "(prompt, bank) within the same session reuse the cached recall " + "result instead of round-tripping to Hindsight. 0 disables. " + "Default is 600 (10 min) for switchroom-managed agents."),
-      min_overlap: exports_external.number().min(0).max(1).optional().describe("Minimum Jaccard token overlap [0.0\u20131.0] between the user " + "prompt and a memory's text for the memory to be injected. " + "Drops low-relevance matches before the count cap so weak hits " + "don't fill the slot on real queries. 0.0 disables (default \u2014 " + "current behaviour). Try 0.10\u20130.20 to start; observe the " + "`overlap_dropped` field via `switchroom memory recall-log`.")
+      min_overlap: exports_external.number().min(0).max(1).optional().describe("Minimum Jaccard token overlap [0.0\u20131.0] between the user " + "prompt and a memory's text for the memory to be injected. " + "Drops low-relevance matches before the count cap so weak hits " + "don't fill the slot on real queries. 0.0 disables (default \u2014 " + "current behaviour). Try 0.10\u20130.20 to start; observe the " + "`overlap_dropped` field via `switchroom memory recall-log`."),
+      topic_filter_mode: exports_external.enum(["soft-preamble", "hard-filter"]).optional().describe("Supergroup-mode cross-topic memory behaviour. Default " + "(unset) \u2192 soft-preamble: recall returns memories from all " + "topics, and a 'Current topic: \u2026' preamble tells the model " + "to self-scope. hard-filter: drop any recalled memory whose " + "metadata.thread_id differs from the active inbound's topic. " + "Flip to hard-filter when the recall_log shows binding " + "failures (model surfacing the right memory but applying " + "it to the wrong topic).")
     }).optional().describe("Auto-recall tuning knobs")
   }).optional();
   HookEntrySchema = exports_external.object({
@@ -13704,6 +13705,16 @@ var init_schema = __esm(() => {
     authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
     org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC \u00a76.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false \u2014 personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")
   }).optional();
+  NotionWorkspaceConfigSchema = exports_external.object({
+    vault_key: exports_external.string().min(1).default("notion/integration-token").describe("Vault key holding the Notion internal-integration token. Default " + "`notion/integration-token`. Override only for non-standard vault " + "layouts. The broker's --allow ACL on this key is the authoritative " + "list of which agents may receive the token."),
+    databases: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9_-]{0,62}$/, {
+      message: "notion_workspace.databases friendly names must match " + "/^[a-z0-9][a-z0-9_-]{0,62}$/ \u2014 lowercase letters, digits, " + "hyphens, underscores. Got: '%s'."
+    }), exports_external.string().regex(/^[0-9a-fA-F]{8}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{12}$/, {
+      message: "notion_workspace.databases values must be Notion database " + "UUIDs (32 hex characters, optional dashes)."
+    })).default({}).describe("Friendly-name \u2192 Notion database UUID map. Operator-managed; agents " + "reference databases by friendly name only \u2014 they never see or type " + "UUIDs. Populate via `switchroom notion list-dbs` (PR 4) after " + "vault-putting the integration token and sharing DBs with the " + "integration in Notion's UI."),
+    mcp_version: exports_external.string().min(1).optional().describe("Optional pin for the upstream `@notionhq/notion-mcp-server` npm " + "package version. Default is the build-time `NOTION_MCP_PINNED_VERSION` " + "constant. Override only when reproducing operator-specific bugs."),
+    rate_limit_rps: exports_external.number().int().positive().max(10).optional().describe("Optional global rate-limit budget in requests per second across all " + "switchroom agents sharing this integration token. Defaults to 3 " + "(Notion's documented public-API limit). Lower it if you also use " + "the integration token from outside switchroom and need to share " + "budget. Higher than 10 is rejected \u2014 if you think you need it, " + "your usage probably needs a workspace-tier upgrade with Notion.")
+  }).optional();
   AgentGoogleWorkspaceConfigSchema = exports_external.object({
     account: exports_external.string().regex(/^[^@\s:]+@[^@\s:]+\.[^@\s:]+$/, {
       message: "google_workspace.account must be a Google account email like " + "'alice@example.com' (colons not allowed)"
@@ -13717,6 +13728,13 @@ var init_schema = __esm(() => {
     }).transform((v) => v.trim().toLowerCase()).optional().describe("RFC #1873: the Microsoft account this agent uses for the M365 MCP. " + "Must be a key in top-level `microsoft_accounts:` with this agent " + "listed in its `enabled_for[]`. Read by the auth-broker " + "(get-credentials, provider=microsoft) and by the scaffold to " + "decide whether to emit the `ms-365` MCP entry. Normalized to " + "lowercase so it matches the microsoft_accounts key (which is " + "also normalized)."),
     org_mode: exports_external.boolean().optional().describe("Per-agent org_mode override (RFC #1873 \u00a76.4). When set, replaces " + "the top-level microsoft_workspace.org_mode for this agent. " + "Defaults to top-level value (which defaults to false).")
   }).optional();
+  AgentNotionWorkspaceConfigSchema = exports_external.object({
+    databases: exports_external.array(exports_external.string().regex(/^[a-z0-9][a-z0-9_-]{0,62}$/, {
+      message: "notion_workspace.databases entries must be friendly names " + "matching /^[a-z0-9][a-z0-9_-]{0,62}$/ \u2014 these must appear as " + "keys in top-level notion_workspace.databases."
+    })).min(1, {
+      message: "notion_workspace.databases must list at least one friendly " + "name. An empty list rejects every Notion tool call \u2014 if you " + "want to remove this agent's Notion access, delete the entire " + "notion_workspace block instead."
+    }).optional().describe("Optional per-agent allowlist of database friendly names this " + "agent may read/write. Each name must exist as a key in top-level " + "notion_workspace.databases. Omit the field (or leave it undefined) " + "to grant access to every DB the upstream integration can see \u2014 " + "appropriate for an admin/orchestrator agent. Set the list to " + "narrow access for specialist agents.")
+  }).optional();
   ReactionsSchema = exports_external.object({
     enabled: exports_external.boolean().optional().describe("Master switch for the reaction-trigger path. When false, " + "reactions are still persisted via recordReaction but never " + "dispatched to the agent as synthetic inbound turns. Default true."),
     trigger_emojis: exports_external.array(exports_external.string()).optional().describe("Emoji allowlist that triggers a synthetic inbound when reacted " + "to a bot message. Default ['\uD83D\uDC4E', '\u274c', '\uD83D\uDC4D', '\u2705']. Cascade " + "mode: REPLACE (not union) \u2014 setting this at a layer replaces " + "lower layers entirely, so an operator can narrow to [] to " + "disable triggering without flipping `enabled`."),
@@ -13853,6 +13871,7 @@ var init_schema = __esm(() => {
     drive: AgentGoogleWorkspaceConfigSchema.describe("RFC D legacy key \u2014 use `google_workspace:` instead. Per-agent " + "google_workspace overrides (currently approvers + tier). When set, " + "replaces the top-level approvers list for this agent. " + "google_client_id/secret are not per-agent \u2014 they live at the top level."),
     google_workspace: AgentGoogleWorkspaceConfigSchema.describe("RFC G canonical key. Per-agent Google Workspace overrides \u2014 currently " + "approvers (replaces, does not extend the top-level list) and tier " + "(`core` | `extended` | `complete`, replaces top-level default). " + "google_client_id/secret are not per-agent \u2014 they live at the top level. " + "Mutually exclusive with `drive:` on the same agent (loader fails fast " + "if both are set)."),
     microsoft_workspace: AgentMicrosoftWorkspaceConfigSchema.describe("RFC #1873 (Microsoft 365 integration). Per-agent Microsoft Workspace " + "override \u2014 pins the Microsoft account this agent reads via the " + "auth-broker (must be a key in top-level `microsoft_accounts:` with " + "this agent in its `enabled_for[]`) and optionally overrides org_mode. " + "microsoft_client_id/secret are not per-agent."),
+    notion_workspace: AgentNotionWorkspaceConfigSchema.describe("RFC docs/rfcs/notion-integration.md. Per-agent Notion access. " + "Presence opts the agent IN (launcher scaffolded, MCP entry emitted, " + "broker grants the integration token). Optional `databases:` filter " + "narrows which DBs this agent may read/write \u2014 names must resolve in " + "top-level notion_workspace.databases. Absence opts the agent OUT."),
     repos: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9-]*$/, "Repo slug must be kebab-case ASCII: start with a lowercase letter or digit, contain only lowercase letters, digits, and hyphens"), exports_external.object({
       url: exports_external.string().min(1).describe("Git remote URL for the repo (e.g. 'git@github.com:org/repo.git' or " + "'https://github.com/org/repo.git'). Used verbatim for git clone."),
       branch_default: exports_external.string().optional().describe("Default branch to track (defaults to the remote's HEAD, typically 'main'). " + "The per-agent branch 'agent/<agentName>/main' fast-forwards to this branch " + "when the worktree is clean on session start.")
@@ -13976,6 +13995,7 @@ var init_schema = __esm(() => {
     drive: GoogleWorkspaceConfigSchema.describe("RFC D legacy key \u2014 use `google_workspace:` instead. Optional Google " + "Workspace onboarding configuration. When set, supplies Google OAuth " + "client credentials, the approver allowlist for `switchroom drive " + "connect`, and the optional tier knob. Env vars " + "(SWITCHROOM_GOOGLE_CLIENT_ID, SWITCHROOM_GOOGLE_CLIENT_SECRET, " + "SWITCHROOM_APPROVER_USER_ID) take precedence over this block when " + "set, preserving back-compat with the env-only flow shipped in #766."),
     google_workspace: GoogleWorkspaceConfigSchema.describe("RFC G canonical key. Top-level Google Workspace configuration \u2014 " + "OAuth client credentials, approver allowlist, and tier knob (`core` " + "| `extended` | `complete`, default `core`). Mutually exclusive with " + "`drive:` at the top level (loader fails fast if both are set)."),
     microsoft_workspace: MicrosoftWorkspaceConfigSchema.describe("RFC #1873 (Microsoft 365 integration). Top-level Microsoft Workspace " + "configuration \u2014 OAuth client credentials (Entra app), authority " + "endpoint (defaults to /common for personal MSA + work), and the " + "org_mode opt-in for Teams/SharePoint surfaces. Block is optional; " + "when omitted the broker does not register the Microsoft provider."),
+    notion_workspace: NotionWorkspaceConfigSchema.describe("RFC docs/rfcs/notion-integration.md. Top-level Notion integration " + "config \u2014 vault key for the integration token, friendly-name \u2192 " + "database UUID map, optional MCP-package version pin, and optional " + "global rate-limit override (default 3 rps, Notion's documented " + "public-API limit). Block is optional; when omitted no agent gets a " + "Notion MCP entry regardless of per-agent config."),
     quota: QuotaConfigSchema.optional().describe("Optional weekly/monthly USD spend budgets rendered in the session " + "greeting. Usage is read from ccusage at runtime; no network calls."),
     host_control: HostControlConfigSchema.default({}).describe("Host-control daemon configuration. Defaults to enabled=true since " + "RFC C Phase 2 (docs/rfcs/host-control-daemon.md). Omit the block " + "to accept defaults; set `enabled: false` only on legacy systemd-" + "mode installs (removal tracked as RFC C Phase 3)."),
     hostd: HostdConfigSchema.default({}).describe("hostd verb-level knobs (RFC admin-agent-config-edit). Distinct " + "from `host_control:` which governs whether the daemon runs at " + "all. Currently scopes the opt-in flag and rate cap for the new " + "`config_propose_edit` verb (PR 1a \u2014 disabled by default)."),
@@ -14525,6 +14545,46 @@ var init_merge = __esm(() => {
   })(mergeAgentConfig ||= {});
 });
 
+// src/config/notion-workspace-acl.ts
+function shouldEmitNotionMcp(agentName, config) {
+  if (!agentName)
+    return false;
+  if (!config.notion_workspace)
+    return false;
+  const agentConfig = config.agents?.[agentName];
+  if (!agentConfig)
+    return false;
+  if (agentConfig.notion_workspace === undefined)
+    return false;
+  return true;
+}
+function validateNotionWorkspaceConfig(config) {
+  const issues = [];
+  const dbMap = config.notion_workspace?.databases ?? {};
+  const known = new Set(Object.keys(dbMap));
+  for (const [agentName, agentRaw] of Object.entries(config.agents ?? {})) {
+    if (!agentRaw)
+      continue;
+    const dbFilter = agentRaw.notion_workspace?.databases;
+    if (dbFilter === undefined)
+      continue;
+    if (dbFilter.length === 0) {
+      issues.push(`  agents.${agentName}.notion_workspace.databases is an empty ` + `list. Delete the entire notion_workspace block to remove Notion ` + `access, or list at least one database friendly name.`);
+      continue;
+    }
+    if (config.notion_workspace === undefined) {
+      issues.push(`  agents.${agentName}.notion_workspace is set but the top-level ` + `notion_workspace block is missing. Configure the integration ` + `globally first (vault_key + databases map), then grant per-agent ` + `access.`);
+      continue;
+    }
+    for (const name of dbFilter) {
+      if (!known.has(name)) {
+        issues.push(`  agents.${agentName}.notion_workspace.databases references ` + `unknown database "${name}". Add it to top-level ` + `notion_workspace.databases (run \`switchroom notion list-dbs\` ` + `to see the UUIDs the integration can read), or remove the ` + `reference.`);
+      }
+    }
+  }
+  return issues;
+}
+
 // src/config/loader.ts
 var exports_loader = {};
 __export(exports_loader, {
@@ -14647,6 +14707,10 @@ function loadConfig(configPath) {
   }
   applyAgentOverlays(config);
   validateAllCronTopicAliases(config, filePath);
+  const notionIssues = validateNotionWorkspaceConfig(config);
+  if (notionIssues.length > 0) {
+    throw new ConfigError(`Invalid notion_workspace configuration in ${filePath}`, notionIssues);
+  }
   return config;
 }
 function validateAllCronTopicAliases(config, filePath) {
@@ -20767,6 +20831,30 @@ function getGdriveMcpSettingsEntry(switchroomCliPath, options = {}) {
     }
   };
 }
+function getMs365McpSettingsEntry(switchroomCliPath, options = {}) {
+  const orgArgs = options.orgMode ? ["--org-mode"] : [];
+  return {
+    key: "ms-365",
+    value: {
+      command: switchroomCliPath,
+      args: ["m365-mcp-launcher", ...orgArgs]
+    }
+  };
+}
+function getNotionMcpSettingsEntry(switchroomCliPath, options = {}) {
+  const args = ["notion-mcp-launcher"];
+  if (options.vaultKey)
+    args.push("--vault-key", options.vaultKey);
+  if (options.mcpVersion)
+    args.push("--mcp-version", options.mcpVersion);
+  return {
+    key: "notion",
+    value: {
+      command: switchroomCliPath,
+      args
+    }
+  };
+}
 function getBuiltinDefaultMcpEntries() {
   const playwright = getPlaywrightMcpSettingsEntry();
   return [
@@ -20794,7 +20882,7 @@ function getBuiltinDefaultSkillEntries() {
     ...switchroomCore.map((key) => ({ key, optOutKey: key, source: "switchroom" }))
   ];
 }
-var GOOGLE_WORKSPACE_MCP_PINNED_SHA = "9d69115b63e6bc2ef0d4b5d7a3b962396382b44c";
+var GOOGLE_WORKSPACE_MCP_PINNED_SHA = "9d69115b63e6bc2ef0d4b5d7a3b962396382b44c", MICROSOFT_WORKSPACE_MCP_PINNED_VERSION = "0.113.0", MICROSOFT_WORKSPACE_MCP_PACKAGE = "@softeria/ms-365-mcp-server", NOTION_MCP_PINNED_VERSION = "1.8.1", NOTION_MCP_PACKAGE = "@notionhq/notion-mcp-server", NOTION_TOKEN_ENV = "NOTION_TOKEN";
 var init_scaffold_integration = __esm(() => {
   init_hindsight();
 });
@@ -29571,21 +29659,403 @@ var init_doctor_drive = __esm(() => {
   init_doctor_secret_access();
 });
 
-// src/cli/doctor-credentials-migration.ts
+// src/cli/doctor-microsoft.ts
 import {
   existsSync as realExistsSync2,
-  readdirSync as realReaddirSync,
-  statSync as realStatSync
+  readFileSync as realReadFileSync2
 } from "node:fs";
-import { homedir as homedir25 } from "node:os";
 import { join as join45 } from "node:path";
+import { homedir as homedir25 } from "node:os";
+function resolveDeps2(deps) {
+  const home2 = deps.homeDir?.() ?? homedir25();
+  return {
+    existsSync: deps.existsSync ?? realExistsSync2,
+    readFileSync: deps.readFileSync ?? realReadFileSync2,
+    agentsDir: join45(home2, ".switchroom", "agents"),
+    now: deps.now ?? Date.now
+  };
+}
+function agentMicrosoftAccount(config, agentName) {
+  const agent = config.agents?.[agentName];
+  if (!agent)
+    return;
+  return agent.microsoft_workspace?.account;
+}
+function clientValuePresent2(v) {
+  return typeof v === "string" && v.length > 0;
+}
+function checkConfigMatrix2(config) {
+  const results = [];
+  const accounts = config.microsoft_accounts ?? {};
+  for (const [name, agent] of Object.entries(config.agents ?? {})) {
+    const acct = agent.microsoft_workspace?.account;
+    if (!acct)
+      continue;
+    const entry = accounts[acct];
+    if (!entry) {
+      results.push({
+        name: `microsoft:matrix:${name}`,
+        status: "fail",
+        detail: `agent '${name}' has microsoft_workspace.account=${acct} but no microsoft_accounts.${acct} block`,
+        fix: `Run 'switchroom auth microsoft account add ${acct}' to register, then 'switchroom auth microsoft enable ${acct} ${name}'.`
+      });
+      continue;
+    }
+    if (!(entry.enabled_for ?? []).includes(name)) {
+      results.push({
+        name: `microsoft:matrix:${name}`,
+        status: "fail",
+        detail: `agent '${name}' is selected to use microsoft account ${acct}, but not listed in microsoft_accounts.${acct}.enabled_for[]`,
+        fix: `Run 'switchroom auth microsoft enable ${acct} ${name}' to grant access.`
+      });
+      continue;
+    }
+    results.push({
+      name: `microsoft:matrix:${name}`,
+      status: "ok",
+      detail: `agent '${name}' aligned with account ${acct}`
+    });
+  }
+  for (const [acct, entry] of Object.entries(accounts)) {
+    for (const name of entry.enabled_for ?? []) {
+      const agentAcct = agentMicrosoftAccount(config, name);
+      if (agentAcct !== acct) {
+        const got = agentAcct ?? "(unset)";
+        results.push({
+          name: `microsoft:matrix:reverse:${name}:${acct}`,
+          status: "fail",
+          detail: `microsoft_accounts.${acct}.enabled_for[] includes '${name}', but agent's microsoft_workspace.account is '${got}' \u2014 broker will return ACCOUNT_NOT_FOUND for this agent`,
+          fix: `Either set agents.${name}.microsoft_workspace.account=${acct}, or remove '${name}' from microsoft_accounts.${acct}.enabled_for[] via 'switchroom auth microsoft disable ${acct} ${name}'.`
+        });
+      }
+    }
+  }
+  return results;
+}
+function checkOAuthClient2(config, anyAgentEnabled) {
+  if (!anyAgentEnabled)
+    return [];
+  const mw = config.microsoft_workspace;
+  if (!mw) {
+    return [
+      {
+        name: "microsoft:oauth-client-configured",
+        status: "fail",
+        detail: "agents have microsoft_workspace.account set but the top-level microsoft_workspace: block is missing",
+        fix: "Add a microsoft_workspace block with microsoft_client_id (and optionally microsoft_client_secret) to switchroom.yaml. See `switchroom auth microsoft account add` error output for the full walkthrough."
+      }
+    ];
+  }
+  if (!clientValuePresent2(mw.microsoft_client_id)) {
+    return [
+      {
+        name: "microsoft:oauth-client-configured",
+        status: "fail",
+        detail: "microsoft_workspace block present but microsoft_client_id is empty",
+        fix: "Register an Entra app at https://entra.microsoft.com \u2192 App registrations \u2192 New. Copy the Application (client) ID and vault it: `switchroom vault set microsoft-oauth-client-id`."
+      }
+    ];
+  }
+  return [
+    {
+      name: "microsoft:oauth-client-configured",
+      status: "ok",
+      detail: clientValuePresent2(mw.microsoft_client_secret) ? "microsoft_client_id + microsoft_client_secret present (confidential client)" : "microsoft_client_id present (public-client app, no secret)"
+    }
+  ];
+}
+function readHeartbeat(d, agentName) {
+  const path4 = join45(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
+  if (!d.existsSync(path4)) {
+    return { error: "heartbeat file missing \u2014 launcher has not yet started" };
+  }
+  try {
+    const raw = d.readFileSync(path4, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.lastRefreshMs !== "number" || typeof parsed.nextRefreshMs !== "number" || typeof parsed.expiresAtMs !== "number") {
+      return { error: "heartbeat file malformed (missing required numeric fields)" };
+    }
+    return parsed;
+  } catch (err) {
+    return { error: `heartbeat parse error: ${err instanceof Error ? err.message : String(err)}` };
+  }
+}
+function checkLauncherHeartbeat(msEnabledAgents, d) {
+  const results = [];
+  for (const name of msEnabledAgents) {
+    const hb = readHeartbeat(d, name);
+    if ("error" in hb) {
+      results.push({
+        name: `microsoft:launcher-heartbeat:${name}`,
+        status: "warn",
+        detail: `${hb.error} (path: ~/.switchroom/agents/${name}/m365-launcher.heartbeat.json)`,
+        fix: `Launcher writes the heartbeat on its first refresh tick. If agent has been running for >5min and the file is still missing, check the launcher log via 'docker logs switchroom-${name}'.`
+      });
+      continue;
+    }
+    const now = d.now();
+    const ageSinceLastRefresh = now - hb.lastRefreshMs;
+    const untilNextRefresh = hb.nextRefreshMs - now;
+    if (ageSinceLastRefresh > 90 * 60 * 1000) {
+      results.push({
+        name: `microsoft:launcher-heartbeat:${name}`,
+        status: "fail",
+        detail: `last refresh was ${Math.round(ageSinceLastRefresh / 60000)}min ago (>90min) \u2014 launcher refresh loop appears dead`,
+        fix: `Restart the agent: 'switchroom agent restart ${name}'. If problem recurs, check launcher logs for broker/network failures.`
+      });
+    } else if (untilNextRefresh < -5 * 60 * 1000) {
+      results.push({
+        name: `microsoft:launcher-heartbeat:${name}`,
+        status: "warn",
+        detail: `nextRefreshMs was ${Math.round(-untilNextRefresh / 60000)}min ago \u2014 refresh tick missed its scheduled time`,
+        fix: `Tick is overdue but not yet stale. Monitor; if it doesn't update within a few minutes, restart the agent.`
+      });
+    } else {
+      results.push({
+        name: `microsoft:launcher-heartbeat:${name}`,
+        status: "ok",
+        detail: `last refresh ${Math.round(ageSinceLastRefresh / 60000)}min ago, next in ${Math.round(untilNextRefresh / 60000)}min`
+      });
+    }
+  }
+  return results;
+}
+function computeMicrosoftEnabledAgents(config) {
+  const accounts = config.microsoft_accounts ?? {};
+  return Object.keys(config.agents ?? {}).filter((name) => {
+    const acct = agentMicrosoftAccount(config, name);
+    return !!acct && !!accounts[acct] && (accounts[acct].enabled_for ?? []).includes(name);
+  });
+}
+function runMicrosoftChecks(config, deps = {}) {
+  const accounts = config.microsoft_accounts;
+  const anyAgentAccount = Object.keys(config.agents ?? {}).some((n) => agentMicrosoftAccount(config, n) !== undefined);
+  const accountsConfigured = !!accounts && Object.keys(accounts).length > 0;
+  if (!accountsConfigured && !anyAgentAccount && !config.microsoft_workspace) {
+    return [];
+  }
+  const d = resolveDeps2(deps);
+  const results = [];
+  results.push(...checkConfigMatrix2(config));
+  const msAgents = computeMicrosoftEnabledAgents(config);
+  results.push(...checkOAuthClient2(config, msAgents.length > 0));
+  results.push(...checkLauncherHeartbeat(msAgents, d));
+  return results;
+}
+var init_doctor_microsoft = () => {};
+
+// src/cli/doctor-notion.ts
+import {
+  existsSync as realExistsSync3,
+  readFileSync as realReadFileSync3,
+  statSync as realStatSync
+} from "node:fs";
+import { join as join46 } from "node:path";
+import { homedir as homedir26 } from "node:os";
+function resolveDeps3(deps) {
+  const home2 = deps.homeDir?.() ?? homedir26();
+  return {
+    existsSync: deps.existsSync ?? realExistsSync3,
+    readFileSync: deps.readFileSync ?? realReadFileSync3,
+    statSync: deps.statSync ?? realStatSync,
+    agentsDir: join46(home2, ".switchroom", "agents"),
+    now: deps.now ?? Date.now,
+    vaultAclReader: deps.vaultAclReader ?? (async () => ({ kind: "unreachable", msg: "no default reader wired" }))
+  };
+}
+function computeNotionEnabledAgents(config) {
+  return Object.entries(config.agents ?? {}).filter(([, a]) => a && a.notion_workspace !== undefined).map(([name]) => name);
+}
+function checkConfigMatrix3(config) {
+  const results = [];
+  const agents = computeNotionEnabledAgents(config);
+  if (agents.length === 0) {
+    return [];
+  }
+  if (!config.notion_workspace) {
+    results.push({
+      name: "notion:top-level-block-present",
+      status: "fail",
+      detail: `${agents.length} agent(s) have notion_workspace: set but the top-level notion_workspace: block is missing`,
+      fix: "Add `notion_workspace:` to switchroom.yaml with at least `databases:` populated. Run `switchroom notion list-dbs` to print a template after putting the integration token in the vault."
+    });
+    return results;
+  }
+  results.push({
+    name: "notion:top-level-block-present",
+    status: "ok"
+  });
+  const known = new Set(Object.keys(config.notion_workspace.databases ?? {}));
+  let any = false;
+  for (const name of agents) {
+    const filter = config.agents?.[name]?.notion_workspace?.databases;
+    if (!filter)
+      continue;
+    any = true;
+    const missing = filter.filter((n) => !known.has(n));
+    if (missing.length > 0) {
+      results.push({
+        name: `notion:db-references-resolvable:${name}`,
+        status: "fail",
+        detail: `agent '${name}' references unknown databases: ${missing.join(", ")}`,
+        fix: `Add the database(s) to notion_workspace.databases in switchroom.yaml, or remove the references from agents.${name}.notion_workspace.databases. Run \`switchroom notion list-dbs\` to see UUIDs.`
+      });
+    } else {
+      results.push({
+        name: `notion:db-references-resolvable:${name}`,
+        status: "ok",
+        detail: `${filter.length} db(s) all resolved`
+      });
+    }
+  }
+  if (!any) {
+    results.push({
+      name: "notion:db-references-resolvable",
+      status: "ok",
+      detail: "no per-agent databases filter set; all admin-shaped"
+    });
+  }
+  return results;
+}
+async function checkVaultAclAligned(config, notionAgents, d) {
+  if (notionAgents.length === 0)
+    return [];
+  const key = config.notion_workspace?.vault_key ?? "notion/integration-token";
+  const acl = await d.vaultAclReader(key);
+  if (acl.kind === "unreachable") {
+    return [
+      {
+        name: "notion:vault-acl-aligned",
+        status: "warn",
+        detail: `vault-broker unreachable: ${acl.msg}`,
+        fix: "Ensure the vault-broker is running and the operator socket is reachable, then re-run doctor."
+      }
+    ];
+  }
+  if (acl.kind === "not_found") {
+    return [
+      {
+        name: "notion:integration-token-present",
+        status: "fail",
+        detail: `vault key '${key}' is missing but ${notionAgents.length} agent(s) want Notion`,
+        fix: `Create the Notion integration in Notion settings, then \`switchroom vault set ${key} --allow ${notionAgents.join(",")}\` on the host.`
+      }
+    ];
+  }
+  const allowedSet = new Set(acl.allow);
+  const results = [];
+  results.push({
+    name: "notion:integration-token-present",
+    status: "ok",
+    detail: `vault key '${key}' exists; ${acl.allow.length} agent(s) on ACL`
+  });
+  for (const name of notionAgents) {
+    if (!allowedSet.has(name)) {
+      const updated = [...acl.allow, name].join(",");
+      results.push({
+        name: `notion:vault-acl-aligned:${name}`,
+        status: "fail",
+        detail: `agent '${name}' has notion_workspace: set but is NOT in the vault ACL for ${key} \u2014 launcher will 503 at runtime`,
+        fix: `Re-run \`switchroom vault set ${key} --allow ${updated}\` on the host (vault set overwrites the scope, so re-state the full list including '${name}').`
+      });
+    } else {
+      results.push({
+        name: `notion:vault-acl-aligned:${name}`,
+        status: "ok"
+      });
+    }
+  }
+  for (const a of acl.allow) {
+    if (!notionAgents.includes(a)) {
+      const trimmed = acl.allow.filter((x) => x !== a).join(",");
+      results.push({
+        name: `notion:vault-acl-aligned:${a}`,
+        status: "warn",
+        detail: `agent '${a}' is on the vault ACL for ${key} but has no notion_workspace: block \u2014 never reads the token`,
+        fix: trimmed.length > 0 ? `Re-run \`switchroom vault set ${key} --allow ${trimmed}\` to drop '${a}' from the allowlist, or add a notion_workspace: block to agent '${a}' in switchroom.yaml.` : `Re-run \`switchroom vault set ${key} --allow ''\` to clear the allowlist (no other agent uses this key), or add a notion_workspace: block to agent '${a}' in switchroom.yaml.`
+      });
+    }
+  }
+  return results;
+}
+function checkLauncherHeartbeat2(notionAgents, d) {
+  if (notionAgents.length === 0)
+    return [];
+  const results = [];
+  for (const name of notionAgents) {
+    const heartbeatPath = join46(d.agentsDir, name, "notion-launcher.heartbeat.json");
+    if (!d.existsSync(heartbeatPath)) {
+      results.push({
+        name: `notion:launcher-heartbeat:${name}`,
+        status: "warn",
+        detail: `heartbeat file missing at ${heartbeatPath}`,
+        fix: `Verify the launcher started \u2014 \`switchroom agent restart ${name} --wait\` and check the agent's logs for "notion-mcp-launcher" stderr.`
+      });
+      continue;
+    }
+    let mtimeMs;
+    try {
+      mtimeMs = d.statSync(heartbeatPath).mtimeMs;
+    } catch (err) {
+      results.push({
+        name: `notion:launcher-heartbeat:${name}`,
+        status: "warn",
+        detail: `cannot stat heartbeat: ${err.message}`
+      });
+      continue;
+    }
+    const age = d.now() - mtimeMs;
+    if (age > HEARTBEAT_STALE_MS) {
+      results.push({
+        name: `notion:launcher-heartbeat:${name}`,
+        status: "warn",
+        detail: `heartbeat is ${Math.round(age / 1000)}s old (stale: >${HEARTBEAT_STALE_MS / 1000}s)`,
+        fix: `Restart the agent: \`switchroom agent restart ${name} --wait\`.`
+      });
+    } else {
+      results.push({
+        name: `notion:launcher-heartbeat:${name}`,
+        status: "ok",
+        detail: `heartbeat ${Math.round(age / 1000)}s old`
+      });
+    }
+  }
+  return results;
+}
+async function runNotionChecks(config, deps = {}) {
+  const notionAgents = computeNotionEnabledAgents(config);
+  if (notionAgents.length === 0 && !config.notion_workspace) {
+    return [];
+  }
+  const d = resolveDeps3(deps);
+  const results = [];
+  results.push(...checkConfigMatrix3(config));
+  if (notionAgents.length > 0 && config.notion_workspace) {
+    results.push(...await checkVaultAclAligned(config, notionAgents, d));
+    results.push(...checkLauncherHeartbeat2(notionAgents, d));
+  }
+  return results;
+}
+var HEARTBEAT_STALE_MS;
+var init_doctor_notion = __esm(() => {
+  HEARTBEAT_STALE_MS = 60 * 1000;
+});
+
+// src/cli/doctor-credentials-migration.ts
+import {
+  existsSync as realExistsSync4,
+  readdirSync as realReaddirSync,
+  statSync as realStatSync2
+} from "node:fs";
+import { homedir as homedir27 } from "node:os";
+import { join as join47 } from "node:path";
 function runCredentialsMigrationChecks(config, deps = {}) {
-  const credDir = deps.credentialsDir ?? join45(homedir25(), ".switchroom", "credentials");
-  const existsSync49 = deps.existsSync ?? ((p) => realExistsSync2(p));
+  const credDir = deps.credentialsDir ?? join47(homedir27(), ".switchroom", "credentials");
+  const existsSync49 = deps.existsSync ?? ((p) => realExistsSync4(p));
   const readdirSync19 = deps.readdirSync ?? ((p) => realReaddirSync(p));
   const isDirectory = deps.isDirectory ?? ((p) => {
     try {
-      return realStatSync(p).isDirectory();
+      return realStatSync2(p).isDirectory();
     } catch {
       return false;
     }
@@ -29608,7 +30078,7 @@ function runCredentialsMigrationChecks(config, deps = {}) {
   const flat = [];
   const perAgentDirs = [];
   for (const e of entries) {
-    const full = join45(credDir, e);
+    const full = join47(credDir, e);
     if (isDirectory(full) && agentNames.has(e)) {
       perAgentDirs.push(e);
     } else {
@@ -29731,19 +30201,19 @@ var init_doctor_inlined_secrets = __esm(() => {
 
 // src/cli/doctor-audit-integrity.ts
 import { readFileSync as fsReadFileSync2 } from "node:fs";
-import { homedir as homedir26 } from "node:os";
-import { join as join46 } from "node:path";
+import { homedir as homedir28 } from "node:os";
+import { join as join48 } from "node:path";
 function rootWrittenLogs(home2) {
   return [
-    { label: "vault-broker", path: join46(home2, ".switchroom", "vault-audit.log") },
+    { label: "vault-broker", path: join48(home2, ".switchroom", "vault-audit.log") },
     {
       label: "hostd",
-      path: join46(home2, ".switchroom", "host-control-audit.log")
+      path: join48(home2, ".switchroom", "host-control-audit.log")
     }
   ];
 }
 function runAuditIntegrityChecks(deps = {}) {
-  const home2 = deps.homeDir ?? homedir26();
+  const home2 = deps.homeDir ?? homedir28();
   const read = deps.readFileSync ?? ((p) => fsReadFileSync2(p, "utf8"));
   const results = [];
   for (const { label, path: path4 } of rootWrittenLogs(home2)) {
@@ -29881,14 +30351,14 @@ var init_client4 = __esm(() => {
 
 // src/cli/doctor-agent-smoke.ts
 import { existsSync as existsSync49 } from "node:fs";
-import { homedir as homedir27 } from "node:os";
-import { join as join47 } from "node:path";
+import { homedir as homedir29 } from "node:os";
+import { join as join49 } from "node:path";
 import { randomUUID as randomUUID4 } from "node:crypto";
 async function runAgentSmokeChecks(config, deps = {}) {
   if (deps.fast)
     return [];
-  const home2 = deps.homeDir ?? homedir27();
-  const sock = deps.operatorSockPath ?? join47(home2, ".switchroom", "hostd", "operator", "sock");
+  const home2 = deps.homeDir ?? homedir29();
+  const sock = deps.operatorSockPath ?? join49(home2, ".switchroom", "hostd", "operator", "sock");
   if (!deps.hostdRequestImpl && !existsSync49(sock)) {
     return [
       {
@@ -29968,8 +30438,8 @@ var init_doctor_agent_smoke = __esm(() => {
 // src/cli/doctor-vault-broker-durability.ts
 import { execFileSync as execFileSync14 } from "node:child_process";
 import { existsSync as existsSync50, statSync as statSync22 } from "node:fs";
-import { homedir as homedir28 } from "node:os";
-import { join as join48 } from "node:path";
+import { homedir as homedir30 } from "node:os";
+import { join as join50 } from "node:path";
 function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   const statHost = opts?.statHost ?? defaultStatHost;
   const statBroker = opts?.statBroker ?? defaultStatBroker;
@@ -30109,19 +30579,19 @@ function defaultBrokerStatusProbe() {
   }
 }
 function runVaultBrokerDurabilityChecks(_config, opts) {
-  const home2 = homedir28();
+  const home2 = homedir30();
   const probe2 = opts?.inodeProbe ?? probeBindMountInode;
   return [
     probeBrokerUnlocked(opts?.statusProbe),
     probeAutoUnlockBlob(home2),
     probeMachineIdMount(),
-    formatBindMountResult("vault-broker: vault.enc bind mount", join48(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join48(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
-    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join48(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join48(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
-    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join48(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join48(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log"))
+    formatBindMountResult("vault-broker: vault.enc bind mount", join50(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join50(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
+    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join50(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join50(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
+    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join50(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join50(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log"))
   ];
 }
 function probeAutoUnlockBlob(home2) {
-  const blobPath = join48(home2, ".switchroom", "vault-auto-unlock");
+  const blobPath = join50(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync50(blobPath)) {
     return {
       name: "vault-broker: auto-unlock blob",
@@ -30232,16 +30702,16 @@ import {
   readdirSync as readdirSync19,
   statSync as statSync23
 } from "node:fs";
-import { dirname as dirname12, join as join49, resolve as resolve30 } from "node:path";
+import { dirname as dirname12, join as join51, resolve as resolve30 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
-  const nvmRoot = join49(process.env.HOME ?? "", ".nvm", "versions", "node");
+  const nvmRoot = join51(process.env.HOME ?? "", ".nvm", "versions", "node");
   if (!existsSync51(nvmRoot))
     return null;
   try {
     const versions = readdirSync19(nvmRoot).sort().reverse();
     for (const v of versions) {
-      const candidate = join49(nvmRoot, v, "bin", bin);
+      const candidate = join51(nvmRoot, v, "bin", bin);
       try {
         const s = statSync23(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
@@ -30406,7 +30876,7 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
   if (envBrowsersPath && envBrowsersPath.length > 0) {
     cacheLocations.push(envBrowsersPath);
   }
-  cacheLocations.push(join49(homeDir, ".cache", "ms-playwright"));
+  cacheLocations.push(join51(homeDir, ".cache", "ms-playwright"));
   for (const cacheDir of cacheLocations) {
     if (!existsSync51(cacheDir))
       continue;
@@ -30414,10 +30884,10 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
       const entries = readdirSync19(cacheDir).filter((e) => e.startsWith("chromium"));
       for (const entry of entries) {
         const candidates2 = [
-          join49(cacheDir, entry, "chrome-linux64", "chrome"),
-          join49(cacheDir, entry, "chrome-linux", "chrome"),
-          join49(cacheDir, entry, "chrome-linux64", "headless_shell"),
-          join49(cacheDir, entry, "chrome-linux", "headless_shell")
+          join51(cacheDir, entry, "chrome-linux64", "chrome"),
+          join51(cacheDir, entry, "chrome-linux", "chrome"),
+          join51(cacheDir, entry, "chrome-linux64", "headless_shell"),
+          join51(cacheDir, entry, "chrome-linux", "headless_shell")
         ];
         for (const path4 of candidates2) {
           if (existsSync51(path4))
@@ -30527,7 +30997,7 @@ function checkUserDeclaredMcps(name, agentConfig, config, renderedMcpServers) {
 function checkLegacyState() {
   const results = [];
   const h = process.env.HOME ?? "/root";
-  const clerkDir = join49(h, LEGACY_STATE_DIR);
+  const clerkDir = join51(h, LEGACY_STATE_DIR);
   const clerkPresent = existsSync51(clerkDir);
   results.push({
     name: "legacy ~/.clerk state",
@@ -30537,7 +31007,7 @@ function checkLegacyState() {
       fix: "Legacy state detected. Run `mv ~/.clerk ~/.switchroom` and rename " + "any top-level `clerk:` key in switchroom.yaml to `switchroom:`. " + "This back-compat shim is REMOVED in v0.13.0 \u2014 no automatic " + "migration exists."
     } : {}
   });
-  const legacySock = join49(h, ".switchroom", "vault-broker.sock");
+  const legacySock = join51(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
     sockStat = lstatSync5(legacySock);
@@ -30833,7 +31303,7 @@ async function checkHindsight(config) {
 }
 function checkPendingRetainsQueue(dir) {
   const home2 = process.env.HOME ?? "";
-  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join49(home2, ".hindsight", "pending-retains");
+  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join51(home2, ".hindsight", "pending-retains");
   if (!existsSync51(pendingDir)) {
     return {
       name: "pending-retains queue",
@@ -30964,7 +31434,7 @@ async function checkTelegram(config) {
     const plugin = agentConfig.channels?.telegram?.plugin ?? "switchroom";
     if (plugin !== "switchroom")
       continue;
-    const envPath = join49(agentsDir, name, "telegram", ".env");
+    const envPath = join51(agentsDir, name, "telegram", ".env");
     const read = tryReadHostFile(envPath);
     if (read.kind === "eacces") {
       results.push({
@@ -31047,7 +31517,7 @@ function checkStartShStale(agentName, startShPath) {
 }
 function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const label = `${agentName}: $HOME/.switchroom symlink (#910)`;
-  const path4 = join49(agentDir, "home", ".switchroom");
+  const path4 = join51(agentDir, "home", ".switchroom");
   let stats;
   try {
     stats = lstatSync5(path4);
@@ -31084,7 +31554,7 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
 }
 function checkRepoHygiene(repoRoot) {
   const results = [];
-  const exportDir = join49(repoRoot, "clerk-export");
+  const exportDir = join51(repoRoot, "clerk-export");
   if (existsSync51(exportDir)) {
     results.push({
       name: "repo hygiene: clerk-export/ on disk (#1072)",
@@ -31093,7 +31563,7 @@ function checkRepoHygiene(repoRoot) {
       fix: `Run scripts/migrate-clerk-export-to-vault.sh to move the bundle ` + `into the vault, then delete the on-disk copy.`
     });
   }
-  const knownTarball = join49(repoRoot, "clerk-export-with-secrets.tar.gz");
+  const knownTarball = join51(repoRoot, "clerk-export-with-secrets.tar.gz");
   if (existsSync51(knownTarball)) {
     results.push({
       name: "repo hygiene: clerk-export-with-secrets.tar.gz on disk (#1072)",
@@ -31111,7 +31581,7 @@ function checkRepoHygiene(repoRoot) {
         results.push({
           name: `repo hygiene: ${name} on disk (#1072)`,
           status: "warn",
-          detail: `${join49(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
+          detail: `${join51(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
           fix: `Inspect, migrate any secrets into the vault, then delete the ` + `archive.`
         });
       }
@@ -31134,9 +31604,9 @@ function checkRepoHygiene(repoRoot) {
 }
 function isSwitchroomCheckout(dir) {
   try {
-    if (!existsSync51(join49(dir, ".git")))
+    if (!existsSync51(join51(dir, ".git")))
       return false;
-    const pkgPath = join49(dir, "package.json");
+    const pkgPath = join51(dir, "package.json");
     if (!existsSync51(pkgPath))
       return false;
     const pkg = JSON.parse(readFileSync46(pkgPath, "utf-8"));
@@ -31173,7 +31643,7 @@ function checkAgents(config, configPath) {
         fix: `Rotate the bot token (e.g. via \`switchroom vault\`), then run ` + `\`switchroom agent unquarantine ${name}\` and \`switchroom agent restart ${name}\``
       });
     }
-    results.push(checkStartShStale(name, join49(agentDir, "start.sh")));
+    results.push(checkStartShStale(name, join51(agentDir, "start.sh")));
     results.push(checkLeakedHomeSwitchroom(name, agentDir));
     const status = statuses[name];
     const active = status?.active ?? "unknown";
@@ -31250,7 +31720,7 @@ function checkAgents(config, configPath) {
       }
     }
     if (agentConfig.channels?.telegram?.plugin === "switchroom") {
-      const mcpJsonPath = join49(agentDir, ".mcp.json");
+      const mcpJsonPath = join51(agentDir, ".mcp.json");
       if (!existsSync51(mcpJsonPath)) {
         results.push({
           name: `${name}: .mcp.json`,
@@ -31552,7 +32022,7 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
     };
   }
   const credDir = dirname12(envPath);
-  const authScript = join49(credDir, "claude-auth.py");
+  const authScript = join51(credDir, "claude-auth.py");
   if (!existsSync51(authScript)) {
     return {
       name: "mff: auth flow",
@@ -31855,6 +32325,32 @@ function registerDoctorCommand(program3) {
           ...await runDriveBrokerReachabilityChecks(config)
         ]
       },
+      {
+        title: "Microsoft 365 (RFC #1873)",
+        results: runMicrosoftChecks(config)
+      },
+      {
+        title: "Notion (RFC notion-integration)",
+        results: await runNotionChecks(config, {
+          vaultAclReader: async (key) => {
+            try {
+              const { getViaBrokerStructured: getViaBrokerStructured2 } = await Promise.resolve().then(() => (init_client(), exports_client));
+              const result = await getViaBrokerStructured2(key);
+              if (result.kind === "ok") {
+                return {
+                  kind: "ok",
+                  allow: result.entry.scope?.allow ?? []
+                };
+              }
+              if (result.kind === "not_found")
+                return { kind: "not_found" };
+              return { kind: "unreachable", msg: result.msg };
+            } catch (err) {
+              return { kind: "unreachable", msg: err.message };
+            }
+          }
+        })
+      },
       { title: "MFF Skill", results: await checkMff(passphrase, vaultPath, config) }
     ];
     const cwd = process.cwd();
@@ -31914,6 +32410,8 @@ var init_doctor = __esm(() => {
   init_doctor_auth_broker();
   init_doctor_hostd();
   init_doctor_drive();
+  init_doctor_microsoft();
+  init_doctor_notion();
   init_doctor_credentials_migration();
   init_doctor_secret_access();
   init_doctor_inlined_secrets();
@@ -48021,7 +48519,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes15 } from "node:crypto";
-import { existsSync as existsSync78, readFileSync as readFileSync65 } from "node:fs";
+import { existsSync as existsSync79, readFileSync as readFileSync65 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -48036,7 +48534,7 @@ async function dispatchTool2(name, args) {
     return errorText2("hostd MCP: SWITCHROOM_AGENT_NAME env var is not set \u2014 cannot " + "determine which per-agent socket to talk to.");
   }
   const sockPath = selfSocketPath();
-  if (!existsSync78(sockPath)) {
+  if (!existsSync79(sockPath)) {
     return errorText2(`hostd MCP: socket not bound at ${sockPath}. The host-control ` + `daemon is either not installed (run \`switchroom hostd install\`) ` + `or this agent isn't admin-flagged in switchroom.yaml. RFC C ` + `bind-mounts the per-agent socket only when host_control.enabled ` + `is true AND the agent has admin: true.`);
   }
   let req;
@@ -48188,13 +48686,13 @@ function resolveAuditLogPath() {
   if (process.env.HOSTD_AUDIT_LOG_PATH)
     return process.env.HOSTD_AUDIT_LOG_PATH;
   const bindMounted = "/host-home/.switchroom/host-control-audit.log";
-  if (existsSync78(bindMounted))
+  if (existsSync79(bindMounted))
     return bindMounted;
   return defaultAuditLogPath2();
 }
 function getLastUpdateApplyStatus() {
   const path8 = resolveAuditLogPath();
-  if (!existsSync78(path8)) {
+  if (!existsSync79(path8)) {
     return errorText2(`get_status: audit log not found at ${path8}. No update_apply has run yet?`);
   }
   let raw;
@@ -48432,8 +48930,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.13.53";
-var COMMIT_SHA = "08726c33";
+var VERSION = "0.13.55";
+var COMMIT_SHA = "98cf8e68";
 
 // src/cli/agent.ts
 init_source();
@@ -48680,6 +49178,22 @@ function renderProfileClaudeTemplate(profileName, profilesRoot = PROFILES_ROOT)
 
 // src/agents/scaffold.ts
 init_scaffold_integration();
+
+// src/config/microsoft-workspace-acl.ts
+function shouldEmitMs365Mcp(agentName, agentMicrosoftAccount, microsoftAccounts) {
+  if (!agentMicrosoftAccount)
+    return false;
+  const account = agentMicrosoftAccount.trim().toLowerCase();
+  if (account.length === 0)
+    return false;
+  const acctEntry = microsoftAccounts?.[account];
+  if (!acctEntry)
+    return false;
+  const enabledFor = acctEntry.enabled_for ?? [];
+  return enabledFor.includes(agentName);
+}
+
+// src/agents/scaffold.ts
 init_reconcile_default_skills();
 
 // src/agents/sub-agent-telegram-prompt.ts
@@ -49799,7 +50313,9 @@ function buildWorkspaceContext(args) {
     hindsightApiBaseUrl,
     hindsightRecallMaxMemories,
     hindsightRecallCacheTtlSecs,
-    hindsightRecallMinOverlap
+    hindsightRecallMinOverlap,
+    hindsightTopicAliasesJson,
+    hindsightTopicFilterMode
   } = args;
   return {
     name,
@@ -49833,6 +50349,8 @@ function buildWorkspaceContext(args) {
     hindsightRecallMaxMemories,
     hindsightRecallCacheTtlSecs,
     hindsightRecallMinOverlap,
+    hindsightTopicAliasesJsonQ: hindsightTopicAliasesJson ? shellSingleQuote(hindsightTopicAliasesJson) : undefined,
+    hindsightTopicFilterMode,
     switchroomConfigPathQ: switchroomConfigPath ? shellSingleQuote(resolve10(switchroomConfigPath)) : undefined,
     hostHomeQ: process.env.HOME ? shellSingleQuote(process.env.HOME) : undefined,
     modelQ: shellSingleQuote(agentConfig.model ?? SWITCHROOM_DEFAULT_MAIN_MODEL),
@@ -49917,6 +50435,46 @@ function resolveGdriveMcpEntry(agentName, agentConfig, switchroomConfig) {
   };
   return entry;
 }
+function resolveMs365McpEntry(agentName, agentConfig, switchroomConfig) {
+  if ((agentConfig.mcp_servers ?? {})["ms-365"] === false)
+    return null;
+  const account = agentConfig.microsoft_workspace?.account;
+  const microsoftAccounts = switchroomConfig?.microsoft_accounts;
+  if (!shouldEmitMs365Mcp(agentName, account, microsoftAccounts))
+    return null;
+  const orgMode = agentConfig.microsoft_workspace?.org_mode ?? switchroomConfig?.microsoft_workspace?.org_mode ?? false;
+  const entry = getMs365McpSettingsEntry(DOCKER_SWITCHROOM_CLI_PATH, orgMode ? { orgMode: true } : {});
+  entry.value.env = {
+    SWITCHROOM_CONFIG: DOCKER_CONFIG_PATH,
+    SWITCHROOM_AGENT_NAME: agentName,
+    SWITCHROOM_CONTAINER: "1",
+    SWITCHROOM_AUTH_BROKER_SOCKET: DOCKER_AUTH_BROKER_SOCKET,
+    HOME: DOCKER_AGENT_HOME
+  };
+  return entry;
+}
+function resolveNotionMcpEntry(agentName, agentConfig, switchroomConfig) {
+  if ((agentConfig.mcp_servers ?? {})["notion"] === false)
+    return null;
+  if (!switchroomConfig)
+    return null;
+  if (!shouldEmitNotionMcp(agentName, switchroomConfig))
+    return null;
+  const vaultKey = switchroomConfig.notion_workspace?.vault_key ?? "notion/integration-token";
+  const mcpVersion = switchroomConfig.notion_workspace?.mcp_version;
+  const entry = getNotionMcpSettingsEntry(DOCKER_SWITCHROOM_CLI_PATH, {
+    vaultKey,
+    mcpVersion
+  });
+  entry.value.env = {
+    SWITCHROOM_CONFIG: DOCKER_CONFIG_PATH,
+    SWITCHROOM_AGENT_NAME: agentName,
+    SWITCHROOM_CONTAINER: "1",
+    SWITCHROOM_VAULT_BROKER_SOCK: DOCKER_VAULT_BROKER_SOCKET,
+    HOME: DOCKER_AGENT_HOME
+  };
+  return entry;
+}
 function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchroomConfig, userIdOverride, switchroomConfigPath) {
   const agentConfig = resolveAgentConfig(switchroomConfig?.defaults, switchroomConfig?.profiles, agentConfigRaw);
   const agentDir = resolve10(agentsDir, name);
@@ -49958,6 +50516,9 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
   const hindsightRecallMaxMemories = agentConfig.memory?.recall?.max_memories;
   const hindsightRecallCacheTtlSecs = agentConfig.memory?.recall?.cache_ttl_secs;
   const hindsightRecallMinOverlap = agentConfig.memory?.recall?.min_overlap;
+  const topicAliases = agentConfig.channels?.telegram?.topic_aliases;
+  const hindsightTopicAliasesJson = topicAliases && Object.keys(topicAliases).length > 0 ? JSON.stringify(topicAliases) : undefined;
+  const hindsightTopicFilterMode = agentConfig.memory?.recall?.topic_filter_mode;
   const context = buildWorkspaceContext({
     name,
     agentDir,
@@ -49976,7 +50537,9 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
     hindsightApiBaseUrl,
     hindsightRecallMaxMemories,
     hindsightRecallCacheTtlSecs,
-    hindsightRecallMinOverlap
+    hindsightRecallMinOverlap,
+    hindsightTopicAliasesJson,
+    hindsightTopicFilterMode
   });
   const dirs = [
     agentDir,
@@ -50025,6 +50588,14 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
         if (gdrive && !settings.mcpServers[gdrive.key]) {
           settings.mcpServers[gdrive.key] = gdrive.value;
         }
+        const ms365 = resolveMs365McpEntry(name, agentConfig, switchroomConfig);
+        if (ms365 && !settings.mcpServers[ms365.key]) {
+          settings.mcpServers[ms365.key] = ms365.value;
+        }
+        const notion = resolveNotionMcpEntry(name, agentConfig, switchroomConfig);
+        if (notion && !settings.mcpServers[notion.key]) {
+          settings.mcpServers[notion.key] = notion.value;
+        }
       }
       installHindsightPlugin(name, agentDir, switchroomConfig);
       const hindsightOn = isHindsightEnabled(switchroomConfig) && switchroomConfig.agents[name]?.memory?.auto_recall !== false;
@@ -50053,12 +50624,13 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
     const pluginDir = DOCKER_TELEGRAM_PLUGIN_PATH;
     const switchroomCliPath = "/usr/local/bin/switchroom";
     const resolvedConfigPath = DOCKER_CONFIG_PATH;
+    const telegramStateDir = `${DOCKER_AGENT_HOME}/.switchroom/agents/${name}/telegram`;
     const mcpServers = {
       "switchroom-telegram": {
         command: "bun",
         args: ["run", "--cwd", pluginDir, "--shell=bun", "--silent", "start"],
         env: {
-          TELEGRAM_STATE_DIR: join8(agentDir, "telegram"),
+          TELEGRAM_STATE_DIR: telegramStateDir,
           SWITCHROOM_CONFIG: resolvedConfigPath,
           SWITCHROOM_CLI_PATH: switchroomCliPath
         }
@@ -50093,6 +50665,14 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
       if (gdrive) {
         mcpServers[gdrive.key] = gdrive.value;
       }
+      const ms365 = resolveMs365McpEntry(name, agentConfig, switchroomConfig);
+      if (ms365) {
+        mcpServers[ms365.key] = ms365.value;
+      }
+      const notion = resolveNotionMcpEntry(name, agentConfig, switchroomConfig);
+      if (notion) {
+        mcpServers[notion.key] = notion.value;
+      }
     }
     if (agentConfig.mcp_servers) {
       const filtered = filterMcpServers(agentConfig.mcp_servers);
@@ -50475,6 +51055,26 @@ function buildSettingsHooksBlock(p) {
         }
       ]
     },
+    {
+      matcher: "^mcp__ms-365__",
+      hooks: [
+        {
+          type: "command",
+          command: wrap("hook:ms-365-write-pretool", `node "${join8(DOCKER_BUNDLED_HOOKS_PATH, "ms-365-write-pretool.mjs")}"`),
+          timeout: 5 * 60 + 30
+        }
+      ]
+    },
+    {
+      matcher: "^mcp__notion__",
+      hooks: [
+        {
+          type: "command",
+          command: wrap("hook:notion-write-pretool", `node "${join8(DOCKER_BUNDLED_HOOKS_PATH, "notion-write-pretool.mjs")}"`),
+          timeout: 30
+        }
+      ]
+    },
     {
       matcher: "^(Write|Edit|MultiEdit)$",
       hooks: [
@@ -50715,6 +51315,9 @@ function reconcileAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchr
   const hindsightRecallMaxMemories = agentConfig.memory?.recall?.max_memories;
   const hindsightRecallCacheTtlSecs = agentConfig.memory?.recall?.cache_ttl_secs;
   const hindsightRecallMinOverlap = agentConfig.memory?.recall?.min_overlap;
+  const topicAliases = agentConfig.channels?.telegram?.topic_aliases;
+  const hindsightTopicAliasesJson = topicAliases && Object.keys(topicAliases).length > 0 ? JSON.stringify(topicAliases) : undefined;
+  const hindsightTopicFilterMode = agentConfig.memory?.recall?.topic_filter_mode;
   const startShPath = join8(agentDir, "start.sh");
   if (!options.skipProfileTemplates) {
     const basePath = getBaseProfilePath();
@@ -50735,6 +51338,8 @@ function reconcileAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchr
       hindsightRecallMaxMemories,
       hindsightRecallCacheTtlSecs,
       hindsightRecallMinOverlap,
+      hindsightTopicAliasesJsonQ: hindsightTopicAliasesJson ? shellSingleQuote(hindsightTopicAliasesJson) : undefined,
+      hindsightTopicFilterMode,
       hostHomeQ: process.env.HOME ? shellSingleQuote(process.env.HOME) : undefined,
       modelQ: shellSingleQuote(agentConfig.model ?? SWITCHROOM_DEFAULT_MAIN_MODEL),
       thinkingEffort: agentConfig.thinking_effort ?? SWITCHROOM_DEFAULT_THINKING_EFFORT,
@@ -50870,6 +51475,18 @@ function reconcileAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchr
       } else {
         delete mcpServers["gdrive"];
       }
+      const ms365 = resolveMs365McpEntry(name, agentConfig, switchroomConfig);
+      if (ms365) {
+        mcpServers[ms365.key] = ms365.value;
+      } else {
+        delete mcpServers["ms-365"];
+      }
+      const notion = resolveNotionMcpEntry(name, agentConfig, switchroomConfig);
+      if (notion) {
+        mcpServers[notion.key] = notion.value;
+      } else {
+        delete mcpServers["notion"];
+      }
     }
     if (agentConfig.mcp_servers) {
       for (const [key, value] of Object.entries(agentConfig.mcp_servers)) {
@@ -51014,12 +51631,13 @@ ${body}
     const pluginDir = DOCKER_TELEGRAM_PLUGIN_PATH;
     const switchroomCliPath = "/usr/local/bin/switchroom";
     const resolvedConfigPath = DOCKER_CONFIG_PATH;
+    const telegramStateDir = `${DOCKER_AGENT_HOME}/.switchroom/agents/${name}/telegram`;
     const mcpServers = {
       "switchroom-telegram": {
         command: "bun",
         args: ["run", "--cwd", pluginDir, "--shell=bun", "--silent", "start"],
         env: {
-          TELEGRAM_STATE_DIR: join8(agentDir, "telegram"),
+          TELEGRAM_STATE_DIR: telegramStateDir,
           SWITCHROOM_CONFIG: resolvedConfigPath,
           SWITCHROOM_CLI_PATH: switchroomCliPath
         }
@@ -51054,6 +51672,14 @@ ${body}
       if (gdrive) {
         mcpServers[gdrive.key] = gdrive.value;
       }
+      const ms365 = resolveMs365McpEntry(name, agentConfig, switchroomConfig);
+      if (ms365) {
+        mcpServers[ms365.key] = ms365.value;
+      }
+      const notion = resolveNotionMcpEntry(name, agentConfig, switchroomConfig);
+      if (notion) {
+        mcpServers[notion.key] = notion.value;
+      }
     }
     if (agentConfig.mcp_servers) {
       const filtered = filterMcpServers(agentConfig.mcp_servers);
@@ -51094,7 +51720,9 @@ ${body}
       hindsightApiBaseUrl,
       hindsightRecallMaxMemories,
       hindsightRecallCacheTtlSecs,
-      hindsightRecallMinOverlap
+      hindsightRecallMinOverlap,
+      hindsightTopicAliasesJson,
+      hindsightTopicFilterMode
     });
     mkdirSync7(reconcileWorkspaceDir, { recursive: true });
     migrateLegacyAgentsMdIfPresent(reconcileWorkspaceDir, changes);
@@ -71545,15 +72173,15 @@ init_loader();
 init_lifecycle();
 import { cpSync as cpSync2, existsSync as existsSync52, mkdirSync as mkdirSync28, readFileSync as readFileSync47, realpathSync as realpathSync5, rmSync as rmSync12, statSync as statSync24 } from "node:fs";
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { join as join50, dirname as dirname13, resolve as resolve31 } from "node:path";
-import { homedir as homedir29 } from "node:os";
-var DEFAULT_COMPOSE_PATH = join50(homedir29(), ".switchroom", "compose", "docker-compose.yml");
+import { join as join52, dirname as dirname13, resolve as resolve31 } from "node:path";
+import { homedir as homedir31 } from "node:os";
+var DEFAULT_COMPOSE_PATH = join52(homedir31(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname13(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync52(join50(dir, ".git"))) {
+    if (existsSync52(join52(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync47(join50(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync47(join52(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -71684,7 +72312,7 @@ function planUpdate(opts) {
         return;
       }
       const source = resolve31(import.meta.dirname, "../../skills");
-      const dest = join50(homedir29(), ".switchroom", "skills", "_bundled");
+      const dest = join52(homedir31(), ".switchroom", "skills", "_bundled");
       if (!existsSync52(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
@@ -71798,7 +72426,7 @@ function defaultStatusProbe(composePath) {
       } catch {}
       let dir = dirname13(scriptPath);
       for (let i = 0;i < 8; i++) {
-        const pkgPath = join50(dir, "package.json");
+        const pkgPath = join52(dir, "package.json");
         if (existsSync52(pkgPath)) {
           try {
             const pkg = JSON.parse(readFileSync47(pkgPath, "utf-8"));
@@ -72018,7 +72646,7 @@ init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
 import { existsSync as existsSync53, readFileSync as readFileSync48 } from "node:fs";
-import { dirname as dirname14, join as join51 } from "node:path";
+import { dirname as dirname14, join as join53 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync4("claude --version 2>/dev/null", {
@@ -72068,11 +72696,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const pkgPath = join51(dir, "package.json");
+    const pkgPath = join53(dir, "package.json");
     if (existsSync53(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync48(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync53(join51(dir, ".git"))) {
+        if (pkg.name === "switchroom" && existsSync53(join53(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -72309,7 +72937,7 @@ import {
   writeFileSync as writeFileSync26,
   writeSync as writeSync7
 } from "node:fs";
-import { join as join52 } from "node:path";
+import { join as join54 } from "node:path";
 import { randomBytes as randomBytes12 } from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
 
@@ -72629,7 +73257,7 @@ function redactedMarker(ruleId) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path4 = join52(stateDir, ISSUES_FILE);
+  const path4 = join54(stateDir, ISSUES_FILE);
   if (!existsSync54(path4))
     return [];
   let raw;
@@ -72707,7 +73335,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve34(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync54(join52(stateDir, ISSUES_FILE)))
+  if (!existsSync54(join54(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -72725,7 +73353,7 @@ function resolve34(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync54(join52(stateDir, ISSUES_FILE)))
+  if (!existsSync54(join54(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -72743,7 +73371,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync54(join52(stateDir, ISSUES_FILE)))
+  if (!existsSync54(join54(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -72776,7 +73404,7 @@ function ensureDir(stateDir) {
   mkdirSync29(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path4 = join52(stateDir, ISSUES_FILE);
+  const path4 = join54(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path4}.tmp-${process.pid}-${randomBytes12(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -72798,7 +73426,7 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join52(stateDir, entry);
+    const tmpPath = join54(stateDir, entry);
     try {
       const stat = statSync25(tmpPath);
       if (stat.mtimeMs < cutoff) {
@@ -72810,7 +73438,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join52(stateDir, ISSUES_LOCK);
+  const lockPath = join54(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -73094,8 +73722,8 @@ function relTime(deltaMs) {
 // src/cli/deps.ts
 init_source();
 import { existsSync as existsSync57 } from "node:fs";
-import { homedir as homedir32 } from "node:os";
-import { join as join55, resolve as resolve35 } from "node:path";
+import { homedir as homedir34 } from "node:os";
+import { join as join57, resolve as resolve35 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash11 } from "node:crypto";
@@ -73106,8 +73734,8 @@ import {
   rmSync as rmSync13,
   writeFileSync as writeFileSync27
 } from "node:fs";
-import { dirname as dirname15, join as join53 } from "node:path";
-import { homedir as homedir30 } from "node:os";
+import { dirname as dirname15, join as join55 } from "node:path";
+import { homedir as homedir32 } from "node:os";
 import { execFileSync as execFileSync15 } from "node:child_process";
 
 class PythonEnvError extends Error {
@@ -73119,7 +73747,7 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join53(homedir30(), ".switchroom", "deps", "python");
+  return join55(homedir32(), ".switchroom", "deps", "python");
 }
 function hashFile(path4) {
   return createHash11("sha256").update(readFileSync50(path4)).digest("hex");
@@ -73131,11 +73759,11 @@ function ensurePythonEnv(opts) {
   if (!existsSync55(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join53(cacheRoot, skillName);
-  const stampPath = join53(venvDir, ".requirements.sha256");
-  const binDir = join53(venvDir, "bin");
-  const pythonBin = join53(binDir, "python");
-  const pipBin = join53(binDir, "pip");
+  const venvDir = join55(cacheRoot, skillName);
+  const stampPath = join55(venvDir, ".requirements.sha256");
+  const binDir = join55(venvDir, "bin");
+  const pythonBin = join55(binDir, "python");
+  const pipBin = join55(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
   if (!force && existsSync55(stampPath) && existsSync55(pythonBin)) {
     const existingHash = readFileSync50(stampPath, "utf8").trim();
@@ -73194,8 +73822,8 @@ import {
   rmSync as rmSync14,
   writeFileSync as writeFileSync28
 } from "node:fs";
-import { dirname as dirname16, join as join54 } from "node:path";
-import { homedir as homedir31 } from "node:os";
+import { dirname as dirname16, join as join56 } from "node:path";
+import { homedir as homedir33 } from "node:os";
 import { execFileSync as execFileSync16 } from "node:child_process";
 
 class NodeEnvError extends Error {
@@ -73218,7 +73846,7 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join54(homedir31(), ".switchroom", "deps", "node");
+  return join56(homedir33(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
   const sourceDir = dirname16(packageJsonPath);
@@ -73227,7 +73855,7 @@ function hashDepInputs(packageJsonPath) {
 `);
   hasher.update(readFileSync51(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join54(sourceDir, lockName);
+    const lockPath = join56(sourceDir, lockName);
     if (existsSync56(lockPath)) {
       hasher.update(`
 `);
@@ -73247,10 +73875,10 @@ function ensureNodeEnv(opts) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
   const sourceDir = dirname16(packageJsonPath);
-  const envDir = join54(cacheRoot, skillName);
-  const stampPath = join54(envDir, ".package.sha256");
-  const nodeModulesDir = join54(envDir, "node_modules");
-  const binDir = join54(nodeModulesDir, ".bin");
+  const envDir = join56(cacheRoot, skillName);
+  const stampPath = join56(envDir, ".package.sha256");
+  const nodeModulesDir = join56(envDir, "node_modules");
+  const binDir = join56(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
   if (!force && existsSync56(stampPath) && existsSync56(nodeModulesDir)) {
     const existingHash = readFileSync51(stampPath, "utf8").trim();
@@ -73268,12 +73896,12 @@ function ensureNodeEnv(opts) {
     rmSync14(envDir, { recursive: true, force: true });
   }
   mkdirSync31(envDir, { recursive: true });
-  copyFileSync9(packageJsonPath, join54(envDir, "package.json"));
+  copyFileSync9(packageJsonPath, join56(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join54(sourceDir, lockName);
+    const lockPath = join56(sourceDir, lockName);
     if (existsSync56(lockPath)) {
-      copyFileSync9(lockPath, join54(envDir, lockName));
+      copyFileSync9(lockPath, join56(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -73302,7 +73930,7 @@ function ensureNodeEnv(opts) {
 
 // src/cli/deps.ts
 function builtinSkillsRoot() {
-  return resolve35(homedir32(), ".switchroom/skills/_bundled");
+  return resolve35(homedir34(), ".switchroom/skills/_bundled");
 }
 function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
@@ -73312,13 +73940,13 @@ function registerDepsCommand(program3) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join55(skillsRoot, skill);
+    const skillDir = join57(skillsRoot, skill);
     if (!existsSync57(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join55(skillDir, "requirements.txt");
-    const packageJsonPath = join55(skillDir, "package.json");
+    const requirementsPath = join57(skillDir, "requirements.txt");
+    const packageJsonPath = join57(skillDir, "package.json");
     const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync57(requirementsPath));
     const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync57(packageJsonPath));
     let did = 0;
@@ -74273,7 +74901,7 @@ init_helpers();
 init_loader();
 init_merge();
 import { copyFileSync as copyFileSync10, existsSync as existsSync59, readFileSync as readFileSync52, writeFileSync as writeFileSync29 } from "node:fs";
-import { join as join56, resolve as resolve37 } from "node:path";
+import { join as join58, resolve as resolve37 } from "node:path";
 init_schema();
 function resolveSoulTargetOrExit(program3, agentName) {
   const config = getConfig(program3);
@@ -74297,7 +74925,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join56(workspaceDir, "SOUL.md"),
+    soulPath: join58(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -74364,7 +74992,7 @@ function registerSoulCommand(program3) {
 init_helpers();
 init_loader();
 import { existsSync as existsSync60, readFileSync as readFileSync53, readdirSync as readdirSync21, statSync as statSync26 } from "node:fs";
-import { resolve as resolve38, join as join57 } from "node:path";
+import { resolve as resolve38, join as join59 } from "node:path";
 import { createHash as createHash13 } from "node:crypto";
 init_merge();
 init_hindsight();
@@ -74378,7 +75006,7 @@ function sha256(content) {
   return createHash13("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join57(claudeConfigDir, "projects");
+  const projectsDir = join59(claudeConfigDir, "projects");
   if (!existsSync60(projectsDir))
     return;
   try {
@@ -74387,8 +75015,8 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join57(projectsDir, entry.name);
-      const transcriptPath = join57(projectPath, "transcript.jsonl");
+      const projectPath = join59(projectsDir, entry.name);
+      const transcriptPath = join59(projectPath, "transcript.jsonl");
       if (!existsSync60(transcriptPath))
         continue;
       const stat3 = statSync26(transcriptPath);
@@ -74457,11 +75085,11 @@ function registerDebugCommand(program3) {
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join57(agentDir, ".claude");
-    const claudeMdPath = join57(agentDir, "CLAUDE.md");
-    const soulMdPath = join57(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join57(workspaceDir, "SOUL.md");
-    const handoffPath = join57(agentDir, ".handoff.md");
+    const claudeConfigDir = join59(agentDir, ".claude");
+    const claudeMdPath = join59(agentDir, "CLAUDE.md");
+    const soulMdPath = join59(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join59(workspaceDir, "SOUL.md");
+    const handoffPath = join59(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -74611,8 +75239,8 @@ init_source();
 // src/worktree/claim.ts
 import { execFileSync as execFileSync17 } from "node:child_process";
 import { closeSync as closeSync12, mkdirSync as mkdirSync33, openSync as openSync12, existsSync as existsSync62, unlinkSync as unlinkSync13 } from "node:fs";
-import { join as join59, resolve as resolve40 } from "node:path";
-import { homedir as homedir34 } from "node:os";
+import { join as join61, resolve as resolve40 } from "node:path";
+import { homedir as homedir36 } from "node:os";
 import { randomBytes as randomBytes13 } from "node:crypto";
 
 // src/worktree/registry.ts
@@ -74625,13 +75253,13 @@ import {
   existsSync as existsSync61,
   renameSync as renameSync12
 } from "node:fs";
-import { join as join58, resolve as resolve39 } from "node:path";
-import { homedir as homedir33 } from "node:os";
+import { join as join60, resolve as resolve39 } from "node:path";
+import { homedir as homedir35 } from "node:os";
 function registryDir() {
-  return resolve39(process.env.SWITCHROOM_WORKTREE_DIR ?? join58(homedir33(), ".switchroom", "worktrees"));
+  return resolve39(process.env.SWITCHROOM_WORKTREE_DIR ?? join60(homedir35(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join58(registryDir(), `${id}.json`);
+  return join60(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
   mkdirSync32(registryDir(), { recursive: true });
@@ -74682,7 +75310,7 @@ function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
   mkdirSync33(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join59(lockDir, `.lock-${lockName}`);
+  const lockPath = join61(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -74709,7 +75337,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve40(process.env.SWITCHROOM_WORKTREE_BASE ?? join59(homedir34(), ".switchroom", "worktree-checkouts"));
+  return resolve40(process.env.SWITCHROOM_WORKTREE_BASE ?? join61(homedir36(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes13(4).toString("hex");
@@ -74731,7 +75359,7 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join59(homedir34(), p.slice(2));
+    return join61(homedir36(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
@@ -74759,7 +75387,7 @@ async function claimWorktree(input, codeRepos) {
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
     mkdirSync33(baseDir, { recursive: true });
-    worktreePath = join59(baseDir, `${id}-${taskSuffix}`);
+    worktreePath = join61(baseDir, `${id}-${taskSuffix}`);
     const now = new Date().toISOString();
     const record2 = {
       id,
@@ -75014,7 +75642,7 @@ import {
   rmSync as rmSync15,
   writeFileSync as writeFileSync31
 } from "node:fs";
-import { join as join60 } from "node:path";
+import { join as join62 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -75204,16 +75832,16 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join60(stateBase, "google-workspace-mcp", "credentials");
+  return join62(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
   mkdirSync34(dir, { recursive: true, mode: 448 });
   chmodSync9(dir, 448);
   for (const name of readdirSync23(dir)) {
-    rmSync15(join60(dir, name), { force: true, recursive: true });
+    rmSync15(join62(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join60(dir, filename);
+  const filePath = join62(dir, filename);
   writeFileSync31(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync9(filePath, 384);
   return filePath;
@@ -75369,9 +75997,599 @@ function registerDriveMcpLauncherCommand(program3) {
   });
 }
 
+// src/cli/m365-mcp-launcher.ts
+init_scaffold_integration();
+import { spawn as spawn6 } from "node:child_process";
+import { writeFileSync as writeFileSync32, mkdirSync as mkdirSync35 } from "node:fs";
+import { dirname as dirname17, join as join63 } from "node:path";
+var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
+var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
+var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
+function buildSofteriaArgs(opts = {}) {
+  const pkg = `${MICROSOFT_WORKSPACE_MCP_PACKAGE}@${MICROSOFT_WORKSPACE_MCP_PINNED_VERSION}`;
+  const args = ["-y", pkg];
+  if (opts.orgMode)
+    args.push("--org-mode");
+  return args;
+}
+function buildSofteriaEnv(accessToken, parentEnv = process.env) {
+  const env2 = { ...parentEnv };
+  env2[SOFTERIA_TOKEN_ENV] = accessToken;
+  return env2;
+}
+function computeRefreshDelayMs(expiresAt, now, leadMs = DEFAULT_REFRESH_LEAD_MS) {
+  const remaining = expiresAt - now - leadMs;
+  if (remaining <= 0)
+    return 0;
+  return Math.min(remaining, MAX_REFRESH_INTERVAL_MS);
+}
+function writeRefreshHeartbeat(agentName, data) {
+  const path7 = heartbeatPath(agentName);
+  try {
+    mkdirSync35(dirname17(path7), { recursive: true });
+    writeFileSync32(path7, JSON.stringify(data, null, 2), { mode: 420 });
+  } catch {}
+}
+function heartbeatPath(agentName) {
+  const override = process.env.SWITCHROOM_M365_HEARTBEAT_DIR;
+  if (override) {
+    return join63(override, `m365-launcher-${agentName}.heartbeat.json`);
+  }
+  return "/state/agent/m365-launcher.heartbeat.json";
+}
+function wireStdio(child) {
+  const onParentStdin = (chunk2) => {
+    try {
+      child.stdin?.write(chunk2);
+    } catch {}
+  };
+  process.stdin.on("data", onParentStdin);
+  child.stdout?.pipe(process.stdout, { end: false });
+  child.stderr?.pipe(process.stderr, { end: false });
+  return () => {
+    process.stdin.off("data", onParentStdin);
+    try {
+      child.stdout?.unpipe(process.stdout);
+      child.stderr?.unpipe(process.stderr);
+    } catch {}
+  };
+}
+async function killChild(child, gracefulMs = 3000) {
+  if (child.exitCode !== null || child.signalCode !== null)
+    return;
+  return new Promise((resolve41) => {
+    let killTimer = null;
+    const onExit = () => {
+      if (killTimer) {
+        clearTimeout(killTimer);
+        killTimer = null;
+      }
+      resolve41();
+    };
+    child.once("exit", onExit);
+    try {
+      child.kill("SIGTERM");
+    } catch {
+      resolve41();
+      return;
+    }
+    killTimer = setTimeout(() => {
+      if (child.exitCode === null && child.signalCode === null) {
+        try {
+          child.kill("SIGKILL");
+        } catch {}
+      }
+    }, gracefulMs);
+  });
+}
+async function runMs365McpLauncher(opts, rt) {
+  const setTimer = rt.setTimer ?? setTimeout;
+  const clearTimer = rt.clearTimer ?? clearTimeout;
+  const now = rt.now ?? Date.now;
+  const log = rt.log ?? ((msg) => process.stderr.write(`${msg}
+`));
+  const agentName = process.env.SWITCHROOM_AGENT_NAME ?? "unknown";
+  let currentChild = null;
+  let teardownStdio = null;
+  let refreshTimer = null;
+  let restartingForRefresh = false;
+  let resolveLauncher = null;
+  const exitLauncher = (code) => {
+    if (refreshTimer) {
+      clearTimer(refreshTimer);
+      refreshTimer = null;
+    }
+    if (resolveLauncher) {
+      const r = resolveLauncher;
+      resolveLauncher = null;
+      r(code);
+    }
+  };
+  const launchChild = (accessToken) => {
+    const env2 = buildSofteriaEnv(accessToken);
+    const child = rt.spawnSofteria(env2);
+    teardownStdio = wireStdio(child);
+    child.once("exit", (code, signal) => {
+      if (teardownStdio) {
+        teardownStdio();
+        teardownStdio = null;
+      }
+      if (restartingForRefresh) {
+        return;
+      }
+      const resolved = code ?? (signal ? 128 : 0);
+      log(`m365-launcher: softeria exited unexpectedly code=${resolved} signal=${signal}`);
+      exitLauncher(resolved);
+    });
+    return child;
+  };
+  const scheduleRefresh = (expiresAtMs) => {
+    const delayMs = computeRefreshDelayMs(expiresAtMs, now());
+    const nextRefreshMs = now() + delayMs;
+    writeRefreshHeartbeat(agentName, {
+      lastRefreshMs: now(),
+      nextRefreshMs,
+      expiresAtMs
+    });
+    log(`m365-launcher: scheduled refresh in ${Math.round(delayMs / 1000)}s (token expires at ${new Date(expiresAtMs).toISOString()})`);
+    refreshTimer = setTimer(async () => {
+      try {
+        log("m365-launcher: refreshing token + restarting softeria");
+        restartingForRefresh = true;
+        try {
+          process.stdin.pause();
+        } catch {}
+        const fresh = await rt.fetchCreds();
+        if (currentChild) {
+          await killChild(currentChild);
+        }
+        restartingForRefresh = false;
+        currentChild = launchChild(fresh.accessToken);
+        try {
+          process.stdin.resume();
+        } catch {}
+        scheduleRefresh(fresh.expiresAt);
+      } catch (err) {
+        restartingForRefresh = false;
+        try {
+          process.stdin.resume();
+        } catch {}
+        const msg = err instanceof Error ? err.message : String(err);
+        log(`m365-launcher: refresh failed \u2014 ${msg}`);
+        refreshTimer = setTimer(() => {
+          scheduleRefresh(now() + 60000);
+        }, 30000);
+      }
+    }, delayMs);
+  };
+  let initial;
+  try {
+    initial = await rt.fetchCreds();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log(`m365-launcher: initial broker call failed \u2014 ${msg}`);
+    return 1;
+  }
+  currentChild = launchChild(initial.accessToken);
+  scheduleRefresh(initial.expiresAt);
+  const onSignal = (signal) => {
+    log(`m365-launcher: received ${signal}, shutting down`);
+    if (currentChild) {
+      try {
+        currentChild.kill(signal);
+      } catch {}
+    }
+    const sigCode = signal === "SIGTERM" ? 143 : signal === "SIGINT" ? 130 : 0;
+    exitLauncher(sigCode);
+  };
+  process.on("SIGINT", onSignal);
+  process.on("SIGTERM", onSignal);
+  return new Promise((resolve41) => {
+    resolveLauncher = resolve41;
+  });
+}
+function registerM365McpLauncherCommand(program3) {
+  program3.command("m365-mcp-launcher", { hidden: true }).option("--org-mode", "Pass --org-mode to softeria (Teams/SharePoint tools).", false).description("Internal \u2014 Microsoft 365 MCP launcher. Acquires a fresh access token from the auth-broker and execs softeria/ms-365-mcp-server in BYOT mode, restarting it ~55min before token expiry. RFC #1873 PR 3.").action(async (opts) => {
+    const { brokerCall: brokerCall2 } = await Promise.resolve().then(() => (init_broker_call(), exports_broker_call));
+    const code = await runMs365McpLauncher(opts, {
+      fetchCreds: async () => {
+        return await brokerCall2(async (client2) => {
+          const data = await client2.getCredentials("microsoft");
+          const mc = data.credentials ?? {};
+          const accessToken = mc.microsoftOauth?.accessToken;
+          const expiresAt = mc.microsoftOauth?.expiresAt;
+          if (!accessToken || typeof expiresAt !== "number") {
+            throw new Error("auth-broker returned credentials without microsoftOauth.accessToken or .expiresAt");
+          }
+          return { accessToken, expiresAt };
+        });
+      },
+      spawnSofteria: (env2) => {
+        return spawn6("npx", buildSofteriaArgs(opts), {
+          env: env2,
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+      }
+    });
+    process.exit(code);
+  });
+}
+
+// src/cli/notion-mcp-launcher.ts
+init_scaffold_integration();
+import { spawn as spawn7 } from "node:child_process";
+import { existsSync as existsSync65, mkdirSync as mkdirSync36, writeFileSync as writeFileSync33 } from "node:fs";
+import { dirname as dirname18 } from "node:path";
+var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
+var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
+var DEFAULT_VAULT_KEY = "notion/integration-token";
+function buildNotionMcpArgs(opts) {
+  const version2 = opts.mcpVersion ?? NOTION_MCP_PINNED_VERSION;
+  return ["-y", `${NOTION_MCP_PACKAGE}@${version2}`];
+}
+function defaultWriteHeartbeat(path7, contents) {
+  try {
+    const dir = dirname18(path7);
+    if (!existsSync65(dir))
+      mkdirSync36(dir, { recursive: true });
+    writeFileSync33(path7, contents);
+  } catch {}
+}
+async function runNotionMcpLauncher(opts, runtime) {
+  const heartbeatPath2 = opts.heartbeatPath ?? DEFAULT_HEARTBEAT_PATH;
+  const writeHeartbeat = runtime.writeHeartbeat ?? defaultWriteHeartbeat;
+  const setTimer = runtime.setTimer ?? ((cb, ms) => setInterval(cb, ms));
+  const clearTimer = runtime.clearTimer ?? clearInterval;
+  const now = runtime.now ?? (() => Date.now());
+  let token;
+  try {
+    token = await runtime.fetchToken();
+  } catch (err) {
+    process.stderr.write(`notion-mcp-launcher: failed to fetch token from vault-broker: ${err.message}
+`);
+    return 1;
+  }
+  if (!token || typeof token !== "string") {
+    process.stderr.write(`notion-mcp-launcher: vault-broker returned an empty/invalid token.
+`);
+    return 1;
+  }
+  const childEnv = {
+    ...process.env,
+    [NOTION_TOKEN_ENV]: token
+  };
+  const args = buildNotionMcpArgs(opts);
+  const child = runtime.spawnMcp(childEnv, args);
+  if (child.stdin == null || child.stdout == null || child.stderr == null) {
+    process.stderr.write(`notion-mcp-launcher: child stdio handles missing \u2014 aborting.
+`);
+    return 1;
+  }
+  process.stdin.pipe(child.stdin);
+  child.stdout.pipe(process.stdout);
+  child.stderr.pipe(process.stderr);
+  const writeOne = () => {
+    const payload = {
+      ts: now(),
+      pid: process.pid,
+      agent: process.env.SWITCHROOM_AGENT_NAME,
+      mcp_package: NOTION_MCP_PACKAGE,
+      mcp_version: opts.mcpVersion ?? NOTION_MCP_PINNED_VERSION
+    };
+    writeHeartbeat(heartbeatPath2, JSON.stringify(payload, null, 2));
+  };
+  writeOne();
+  const heartbeatHandle = setTimer(writeOne, HEARTBEAT_WRITE_INTERVAL_MS);
+  const forward = (sig) => {
+    try {
+      child.kill(sig);
+    } catch {}
+  };
+  process.on("SIGTERM", () => forward("SIGTERM"));
+  process.on("SIGINT", () => forward("SIGINT"));
+  const exitCode = await new Promise((resolve41) => {
+    child.once("exit", (code, signal) => {
+      clearTimer(heartbeatHandle);
+      if (typeof code === "number") {
+        resolve41(code);
+      } else if (signal) {
+        const sigCode = { SIGTERM: 15, SIGINT: 2, SIGKILL: 9 }[signal] ?? 1;
+        resolve41(128 + sigCode);
+      } else {
+        resolve41(1);
+      }
+    });
+    child.once("error", (err) => {
+      clearTimer(heartbeatHandle);
+      process.stderr.write(`notion-mcp-launcher: child spawn error: ${err.message}
+`);
+      resolve41(1);
+    });
+  });
+  return exitCode;
+}
+function registerNotionMcpLauncherCommand(program3) {
+  program3.command("notion-mcp-launcher", { hidden: true }).option("--vault-key <key>", "Override the vault key holding the Notion integration token. " + "Defaults to `notion/integration-token`.", DEFAULT_VAULT_KEY).option("--mcp-version <semver>", "Override the @notionhq/notion-mcp-server version to spawn.").option("--heartbeat-path <path>", "Override the heartbeat file path. Default: /state/agent/notion-launcher.heartbeat.json").description("Internal \u2014 Notion MCP launcher. Fetches the integration token from the vault-broker and execs @notionhq/notion-mcp-server in stdio mode. RFC docs/rfcs/notion-integration.md PR 2.").action(async (opts) => {
+    const { getViaBrokerStructured: getViaBrokerStructured2 } = await Promise.resolve().then(() => (init_client(), exports_client));
+    const code = await runNotionMcpLauncher(opts, {
+      fetchToken: async () => {
+        const key = opts.vaultKey ?? DEFAULT_VAULT_KEY;
+        const result = await getViaBrokerStructured2(key);
+        if (result.kind === "unreachable") {
+          throw new Error(`vault-broker unreachable: ${result.msg}. Is the broker socket mounted?`);
+        }
+        if (result.kind === "not_found") {
+          throw new Error(`vault key ${key} is missing. Run \`switchroom vault set ${key}\` on the host to populate it.`);
+        }
+        if (result.kind === "denied") {
+          throw new Error(`vault-broker denied access to ${key}: ${result.msg}. Re-run \`switchroom vault set ${key} --allow <comma-separated-agents>\` on the host including this agent.`);
+        }
+        if (result.entry.kind !== "string") {
+          throw new Error(`vault key ${key} is not a string entry \u2014 Notion expects an integration token string.`);
+        }
+        return result.entry.value;
+      },
+      spawnMcp: (env2, args) => {
+        return spawn7("npx", args, {
+          env: env2,
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+      }
+    });
+    process.exit(code);
+  });
+}
+
+// src/cli/notion.ts
+init_loader();
+
+// src/notion/api-client.ts
+var DEFAULT_BASE = "https://api.notion.com";
+var DEFAULT_VERSION = "2022-06-28";
+var DEFAULT_TIMEOUT_MS4 = 5000;
+function createNotionApiClient(opts) {
+  const base = opts.base ?? DEFAULT_BASE;
+  const version2 = opts.notionVersion ?? DEFAULT_VERSION;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS4;
+  async function request(method, path7, body) {
+    const ac = new AbortController;
+    const timeout = setTimeout(() => ac.abort(), timeoutMs);
+    try {
+      const res = await fetchImpl(`${base}${path7}`, {
+        method,
+        headers: {
+          Authorization: `Bearer ${opts.token}`,
+          "Notion-Version": version2,
+          "Content-Type": "application/json"
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal: ac.signal
+      });
+      if (!res.ok) {
+        let detail = "";
+        try {
+          detail = await res.text();
+        } catch {}
+        throw new Error(`Notion API ${method} ${path7} failed: ${res.status} ${res.statusText}${detail ? ` \u2014 ${detail.slice(0, 200)}` : ""}`);
+      }
+      return await res.json();
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  return {
+    async getPage(pageId) {
+      const data = await request("GET", `/v1/pages/${encodeURIComponent(pageId)}`);
+      return { parent: data.parent };
+    },
+    async getBlock(blockId) {
+      const data = await request("GET", `/v1/blocks/${encodeURIComponent(blockId)}`);
+      return { parent: data.parent };
+    },
+    async search(query, pageSize = 20) {
+      return await request("POST", "/v1/search", {
+        query,
+        page_size: pageSize
+      });
+    }
+  };
+}
+
+// src/cli/notion.ts
+init_client();
+function registerNotionCommand(program3) {
+  const cmd = program3.command("notion").description("Notion integration operator helpers (list-dbs, test). See docs/rfcs/notion-integration.md.");
+  cmd.command("list-dbs").description("List the databases the Notion integration can access. Output is a ready-to-paste YAML block for `notion_workspace.databases`.").option("--vault-key <key>", "Override the vault key holding the integration token.", "notion/integration-token").action(async (opts) => {
+    const code = await runListDbs(opts);
+    process.exit(code);
+  });
+  cmd.command("test <agent>").description("Smoke-test Notion access for an agent. Calls /v1/users/me via the broker and prints the integration's bot user.").option("--vault-key <key>", "Override the vault key holding the integration token.", "notion/integration-token").action(async (agent, opts) => {
+    const code = await runTest(agent, opts);
+    process.exit(code);
+  });
+}
+async function runListDbs(opts) {
+  let token;
+  try {
+    token = await fetchToken(opts.vaultKey);
+  } catch (err) {
+    process.stderr.write(`switchroom notion list-dbs: ${err.message}
+`);
+    return 1;
+  }
+  const client2 = createNotionApiClient({ token });
+  let dbs;
+  try {
+    dbs = await searchAllDatabases(token);
+  } catch (err) {
+    process.stderr.write(`switchroom notion list-dbs: failed to enumerate databases: ${err.message}
+`);
+    return 1;
+  }
+  if (dbs.length === 0) {
+    process.stderr.write(`switchroom notion list-dbs: the integration has no databases shared with it.
+` + "Open Notion \u2192 page/database you want switchroom to access \u2192 top-right \u22ef \u2192 Connections \u2192 add `switchroom`, then re-run.\n");
+    return 1;
+  }
+  process.stdout.write("# Paste under `notion_workspace:` in switchroom.yaml:\n");
+  process.stdout.write(`databases:
+`);
+  const seen = new Set;
+  for (const db of dbs) {
+    const slug = toFriendlyName(db.title || db.id, seen);
+    seen.add(slug);
+    process.stdout.write(`  ${slug}: "${db.id}"
+`);
+  }
+  if (process.stdout.isTTY) {
+    process.stderr.write(`
+Found ${dbs.length} database(s). Edit the friendly names to taste \u2014 agents reference them by name in \`agents.<name>.notion_workspace.databases\`.
+`);
+  }
+  return 0;
+}
+function toFriendlyName(title, seen) {
+  let base = title.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
+  if (!base || !/^[a-z0-9]/.test(base))
+    base = `db-${base.replace(/^[^a-z0-9]+/, "")}`;
+  if (!base)
+    base = "db";
+  let candidate = base;
+  let i = 2;
+  while (seen.has(candidate)) {
+    candidate = `${base}-${i}`;
+    i += 1;
+  }
+  return candidate;
+}
+async function searchAllDatabases(token) {
+  const out = [];
+  let cursor = null;
+  for (let i = 0;i < 10; i += 1) {
+    const body = {
+      filter: { value: "database", property: "object" },
+      page_size: 100
+    };
+    if (cursor)
+      body.start_cursor = cursor;
+    const res = await postSearch(token, body);
+    for (const hit of res.results) {
+      const title = extractDbTitle(hit) || hit.id;
+      out.push({ id: hit.id, title });
+    }
+    if (!res.next_cursor)
+      break;
+    cursor = res.next_cursor;
+  }
+  return out;
+}
+function extractDbTitle(hit) {
+  if (!hit.title || !Array.isArray(hit.title))
+    return null;
+  return hit.title.map((t) => t.plain_text ?? "").join("").trim() || null;
+}
+async function postSearch(token, body) {
+  const ac = new AbortController;
+  const timeout = setTimeout(() => ac.abort(), 1e4);
+  try {
+    const res = await fetch("https://api.notion.com/v1/search", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Notion-Version": "2022-06-28",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body),
+      signal: ac.signal
+    });
+    if (!res.ok) {
+      throw new Error(`Notion /v1/search ${res.status}: ${await res.text()}`);
+    }
+    return await res.json();
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function runTest(agent, opts) {
+  let config;
+  try {
+    config = loadConfig();
+  } catch (err) {
+    process.stderr.write(`switchroom notion test: failed to load switchroom.yaml: ${err.message}
+`);
+    return 1;
+  }
+  const agentCfg = config.agents?.[agent];
+  if (!agentCfg) {
+    process.stderr.write(`switchroom notion test: agent '${agent}' not found in switchroom.yaml.
+`);
+    return 1;
+  }
+  if (!agentCfg.notion_workspace) {
+    process.stderr.write(`switchroom notion test: agent '${agent}' has no notion_workspace block. Set \`agents.${agent}.notion_workspace: {}\` (or with databases:) in switchroom.yaml.
+`);
+    return 1;
+  }
+  let token;
+  try {
+    token = await fetchToken(opts.vaultKey);
+  } catch (err) {
+    process.stderr.write(`switchroom notion test: ${err.message}
+`);
+    return 1;
+  }
+  try {
+    const ac = new AbortController;
+    const timeout = setTimeout(() => ac.abort(), 1e4);
+    let res;
+    try {
+      res = await fetch("https://api.notion.com/v1/users/me", {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Notion-Version": "2022-06-28"
+        },
+        signal: ac.signal
+      });
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (!res.ok) {
+      process.stderr.write(`switchroom notion test: Notion API returned ${res.status} \u2014 token may be revoked. Detail: ${await res.text()}
+`);
+      return 1;
+    }
+    const data = await res.json();
+    process.stdout.write(`OK \u2014 agent='${agent}', integration bot='${data.name ?? "?"}', workspace='${data.bot?.workspace_name ?? "?"}'
+`);
+    return 0;
+  } catch (err) {
+    process.stderr.write(`switchroom notion test: ${err.message}
+`);
+    return 1;
+  }
+}
+async function fetchToken(vaultKey) {
+  const result = await getViaBrokerStructured(vaultKey);
+  if (result.kind === "unreachable") {
+    throw new Error(`vault-broker unreachable: ${result.msg}`);
+  }
+  if (result.kind === "not_found") {
+    throw new Error(`vault key '${vaultKey}' is missing. Run \`switchroom vault set ${vaultKey}\` first.`);
+  }
+  if (result.kind === "denied") {
+    throw new Error(`vault-broker denied access to '${vaultKey}': ${result.msg}`);
+  }
+  if (result.entry.kind !== "string") {
+    throw new Error(`vault key '${vaultKey}' is not a string entry`);
+  }
+  return result.entry.value;
+}
+
 // src/cli/apply.ts
 init_source();
-import { accessSync as accessSync3, chownSync as chownSync4, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync68, mkdirSync as mkdirSync36, readFileSync as readFileSync56, readdirSync as readdirSync25, renameSync as renameSync13, writeFileSync as writeFileSync33 } from "node:fs";
+import { accessSync as accessSync3, chownSync as chownSync4, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync69, mkdirSync as mkdirSync38, readFileSync as readFileSync56, readdirSync as readdirSync25, renameSync as renameSync13, writeFileSync as writeFileSync35 } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
@@ -75734,16 +76952,16 @@ agents:
 
 // src/cli/apply.ts
 init_resolver();
-import { dirname as dirname19, join as join64, resolve as resolve42 } from "node:path";
-import { homedir as homedir36 } from "node:os";
+import { dirname as dirname21, join as join67, resolve as resolve42 } from "node:path";
+import { homedir as homedir38 } from "node:os";
 import { execFileSync as execFileSync20 } from "node:child_process";
 init_vault();
 init_loader();
 init_loader();
 
 // src/cli/update-prompt-hook.ts
-import { existsSync as existsSync65, readFileSync as readFileSync55, writeFileSync as writeFileSync32, chmodSync as chmodSync10, mkdirSync as mkdirSync35 } from "node:fs";
-import { join as join61 } from "node:path";
+import { existsSync as existsSync66, readFileSync as readFileSync55, writeFileSync as writeFileSync34, chmodSync as chmodSync10, mkdirSync as mkdirSync37 } from "node:fs";
+import { join as join64 } from "node:path";
 var HOOK_FILENAME = "update-card-on-prompt.sh";
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -75809,14 +77027,14 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join61(agentDir, ".claude", "hooks");
-  mkdirSync35(hooksDir, { recursive: true });
-  const scriptPath = join61(hooksDir, HOOK_FILENAME);
+  const hooksDir = join64(agentDir, ".claude", "hooks");
+  mkdirSync37(hooksDir, { recursive: true });
+  const scriptPath = join64(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
-  const existing = existsSync65(scriptPath) ? readFileSync55(scriptPath, "utf-8") : "";
+  const existing = existsSync66(scriptPath) ? readFileSync55(scriptPath, "utf-8") : "";
   if (existing !== desired) {
-    writeFileSync32(scriptPath, desired, { mode: 493 });
+    writeFileSync34(scriptPath, desired, { mode: 493 });
     chmodSync10(scriptPath, 493);
     installed = true;
   } else {
@@ -75824,8 +77042,8 @@ function installUpdatePromptHook(agentDir) {
       chmodSync10(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join61(agentDir, ".claude", "settings.json");
-  if (!existsSync65(settingsPath)) {
+  const settingsPath = join64(agentDir, ".claude", "settings.json");
+  if (!existsSync66(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
   const raw = readFileSync55(settingsPath, "utf-8");
@@ -75861,7 +77079,7 @@ function installUpdatePromptHook(agentDir) {
     });
     hooks.UserPromptSubmit = list2;
     parsed.hooks = hooks;
-    writeFileSync32(settingsPath, JSON.stringify(parsed, null, 2) + `
+    writeFileSync34(settingsPath, JSON.stringify(parsed, null, 2) + `
 `, { mode: 384 });
     installed = true;
   }
@@ -75944,13 +77162,13 @@ function detectInstallType() {
 // src/cli/operator-uid.ts
 import {
   chownSync as chownSync3,
-  existsSync as existsSync67,
+  existsSync as existsSync68,
   lstatSync as lstatSync7,
   readdirSync as readdirSync24,
   realpathSync as realpathSync6,
   statSync as statSync27
 } from "node:fs";
-import { join as join63 } from "node:path";
+import { join as join66 } from "node:path";
 function resolveOperatorUid() {
   const sudoUid = process.env.SUDO_UID;
   if (sudoUid !== undefined) {
@@ -75966,19 +77184,19 @@ function resolveOperatorUid() {
   return;
 }
 function operatorOwnedPaths(home2) {
-  const root = join63(home2, ".switchroom");
+  const root = join66(home2, ".switchroom");
   return [
-    join63(root, "vault"),
-    join63(root, "vault-auto-unlock"),
-    join63(root, "vault-audit.log"),
-    join63(root, "host-control-audit.log"),
-    join63(root, "accounts"),
-    join63(root, "compose")
+    join66(root, "vault"),
+    join66(root, "vault-auto-unlock"),
+    join66(root, "vault-audit.log"),
+    join66(root, "host-control-audit.log"),
+    join66(root, "accounts"),
+    join66(root, "compose")
   ];
 }
 function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
   const chown = deps.chown ?? ((p, u, g) => chownSync3(p, u, g));
-  const exists = deps.exists ?? ((p) => existsSync67(p));
+  const exists = deps.exists ?? ((p) => existsSync68(p));
   const isSymlink = deps.isSymlink ?? ((p) => {
     try {
       return lstatSync7(p).isSymbolicLink();
@@ -76022,7 +77240,7 @@ function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
     } catch {}
     if (isDir(target)) {
       for (const entry of readdir2(target)) {
-        visit(join63(target, entry));
+        visit(join66(target, entry));
       }
     }
   };
@@ -76036,17 +77254,17 @@ var EMBEDDED_EXAMPLES = {
   switchroom: switchroom_default,
   minimal: minimal_default
 };
-var DEFAULT_COMPOSE_PATH2 = join64(homedir36(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH2 = join67(homedir38(), ".switchroom", "compose", "docker-compose.yml");
 var COMPOSE_PROJECT2 = "switchroom";
 function resolveVaultBindMountDir(homeDir, ctx) {
   const isCustomPath = ctx.migrationKind === "custom-path-skipped";
   if (isCustomPath && ctx.customVaultPath) {
-    return dirname19(ctx.customVaultPath);
+    return dirname21(ctx.customVaultPath);
   }
-  return join64(homeDir, ".switchroom", "vault");
+  return join67(homeDir, ".switchroom", "vault");
 }
 function inspectVaultBindMountDir(vaultDir) {
-  if (!existsSync68(vaultDir))
+  if (!existsSync69(vaultDir))
     return { kind: "missing" };
   const entries = readdirSync25(vaultDir);
   const unknown = [];
@@ -76072,63 +77290,63 @@ function hasVaultRefs(value) {
   return false;
 }
 async function ensureHostMountSources(config) {
-  const home2 = homedir36();
+  const home2 = homedir38();
   const dirs = [
-    join64(home2, ".switchroom", "approvals"),
-    join64(home2, ".switchroom", "scheduler"),
-    join64(home2, ".switchroom", "logs"),
-    join64(home2, ".switchroom", "compose"),
-    join64(home2, ".switchroom", "broker-operator")
+    join67(home2, ".switchroom", "approvals"),
+    join67(home2, ".switchroom", "scheduler"),
+    join67(home2, ".switchroom", "logs"),
+    join67(home2, ".switchroom", "compose"),
+    join67(home2, ".switchroom", "broker-operator")
   ];
   for (const name of Object.keys(config.agents)) {
-    dirs.push(join64(home2, ".switchroom", "agents", name));
-    dirs.push(join64(home2, ".switchroom", "logs", name));
-    dirs.push(join64(home2, ".claude", "projects", name));
-    dirs.push(join64(home2, ".switchroom", "audit", name));
-    if (existsSync68(join64(home2, ".switchroom-config"))) {
-      dirs.push(join64(home2, ".switchroom-config", "agents", name, "personal-skills"));
+    dirs.push(join67(home2, ".switchroom", "agents", name));
+    dirs.push(join67(home2, ".switchroom", "logs", name));
+    dirs.push(join67(home2, ".claude", "projects", name));
+    dirs.push(join67(home2, ".switchroom", "audit", name));
+    if (existsSync69(join67(home2, ".switchroom-config"))) {
+      dirs.push(join67(home2, ".switchroom-config", "agents", name, "personal-skills"));
     }
   }
   for (const dir of dirs) {
     await mkdir(dir, { recursive: true });
   }
-  const autoUnlockPath = join64(home2, ".switchroom", "vault-auto-unlock");
-  if (!existsSync68(autoUnlockPath)) {
-    writeFileSync33(autoUnlockPath, "", { mode: 384 });
+  const autoUnlockPath = join67(home2, ".switchroom", "vault-auto-unlock");
+  if (!existsSync69(autoUnlockPath)) {
+    writeFileSync35(autoUnlockPath, "", { mode: 384 });
   }
-  const auditLogPath = join64(home2, ".switchroom", "vault-audit.log");
-  if (!existsSync68(auditLogPath)) {
-    writeFileSync33(auditLogPath, "", { mode: 420 });
+  const auditLogPath = join67(home2, ".switchroom", "vault-audit.log");
+  if (!existsSync69(auditLogPath)) {
+    writeFileSync35(auditLogPath, "", { mode: 420 });
   }
-  const grantsDbPath = join64(home2, ".switchroom", "vault-grants.db");
-  if (!existsSync68(grantsDbPath)) {
-    writeFileSync33(grantsDbPath, "", { mode: 384 });
+  const grantsDbPath = join67(home2, ".switchroom", "vault-grants.db");
+  if (!existsSync69(grantsDbPath)) {
+    writeFileSync35(grantsDbPath, "", { mode: 384 });
   }
-  const hostdAuditLogPath = join64(home2, ".switchroom", "host-control-audit.log");
-  if (!existsSync68(hostdAuditLogPath)) {
-    writeFileSync33(hostdAuditLogPath, "", { mode: 420 });
+  const hostdAuditLogPath = join67(home2, ".switchroom", "host-control-audit.log");
+  if (!existsSync69(hostdAuditLogPath)) {
+    writeFileSync35(hostdAuditLogPath, "", { mode: 420 });
   }
   for (const name of Object.keys(config.agents)) {
-    const tokenPath = join64(home2, ".switchroom", "agents", name, ".vault-token");
-    if (!existsSync68(tokenPath)) {
-      writeFileSync33(tokenPath, "", { mode: 384 });
+    const tokenPath = join67(home2, ".switchroom", "agents", name, ".vault-token");
+    if (!existsSync69(tokenPath)) {
+      writeFileSync35(tokenPath, "", { mode: 384 });
     }
     try {
       const uid = allocateAgentUid(name);
       chownSync4(tokenPath, uid, uid);
     } catch {}
   }
-  const fleetDir = join64(home2, ".switchroom", "fleet");
+  const fleetDir = join67(home2, ".switchroom", "fleet");
   await mkdir(fleetDir, { recursive: true });
-  const invariantsPath = join64(fleetDir, "switchroom-invariants.md");
+  const invariantsPath = join67(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
-  const invariantsCurrent = existsSync68(invariantsPath) ? readFileSync56(invariantsPath, "utf-8") : null;
+  const invariantsCurrent = existsSync69(invariantsPath) ? readFileSync56(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
-    writeFileSync33(invariantsPath, invariantsCanonical, { mode: 420 });
+    writeFileSync35(invariantsPath, invariantsCanonical, { mode: 420 });
   }
-  const fleetClaudePath = join64(fleetDir, "CLAUDE.md");
-  if (!existsSync68(fleetClaudePath)) {
-    writeFileSync33(fleetClaudePath, [
+  const fleetClaudePath = join67(fleetDir, "CLAUDE.md");
+  if (!existsSync69(fleetClaudePath)) {
+    writeFileSync35(fleetClaudePath, [
       "# Switchroom fleet defaults",
       "",
       "Operator-owned fleet brain. Every agent reads this via",
@@ -76159,7 +77377,7 @@ ${out.trim()}`;
 }
 function runApplyPreflight(config, opts = {}) {
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (hasVaultRefs(config) && !existsSync68(vaultPath)) {
+  if (hasVaultRefs(config) && !existsSync69(vaultPath)) {
     throw new Error(`Config references vault keys (vault:<name>) but ${vaultPath} is missing. ` + `Run \`switchroom setup\` first to initialise the vault.`);
   }
   const detect = opts.detectComposeV2 ?? detectComposeV2;
@@ -76170,7 +77388,7 @@ function runApplyPreflight(config, opts = {}) {
   detectAndReportLegacyGdriveSlots(vaultPath);
 }
 function detectAndReportLegacyGdriveSlots(vaultPath) {
-  if (!existsSync68(vaultPath))
+  if (!existsSync69(vaultPath))
     return;
   const passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
   if (!passphrase)
@@ -76209,18 +77427,18 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 `));
   }
 }
-function writeInstallTypeCache(homeDir = homedir36()) {
+function writeInstallTypeCache(homeDir = homedir38()) {
   const ctx = detectInstallType();
-  const dir = join64(homeDir, ".switchroom");
-  const out = join64(dir, "install-type.json");
+  const dir = join67(homeDir, ".switchroom");
+  const out = join67(dir, "install-type.json");
   const tmp = `${out}.tmp`;
-  mkdirSync36(dir, { recursive: true });
+  mkdirSync38(dir, { recursive: true });
   const payload = {
     install_type: ctx.install_type,
     detected_at: new Date().toISOString(),
     source_paths: ctx.source_paths
   };
-  writeFileSync33(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
+  writeFileSync35(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
   renameSync13(tmp, out);
   return out;
 }
@@ -76261,14 +77479,14 @@ Applying switchroom config...
       writeOut(source_default.green(`  + ${name}`) + source_default.gray(` (${agentConfig.extends ?? "default"}) \u2014 ${detail}
 `));
       try {
-        installUpdatePromptHook(join64(agentsDir, name));
+        installUpdatePromptHook(join67(agentsDir, name));
       } catch (hookErr) {
         writeOut(source_default.gray(`    (update-prompt hook install failed for ${name}: ${hookErr.message})
 `));
       }
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join64(agentsDir, name), uid, {
+        alignAgentUid(name, join67(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -76305,7 +77523,7 @@ Applying switchroom config...
     for (const name of agentNames) {
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join64(agentsDir, name), uid, {
+        alignAgentUid(name, join67(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -76319,7 +77537,7 @@ Applying switchroom config...
   }
   const vaultPathConfigured = config.vault?.path;
   const customVaultPath = vaultPathConfigured ? resolvePath(vaultPathConfigured) : undefined;
-  const migrationResult = migrateVaultLayout(homedir36(), {
+  const migrationResult = migrateVaultLayout(homedir38(), {
     customVaultPath
   });
   switch (migrationResult.kind) {
@@ -76345,7 +77563,7 @@ Applying switchroom config...
       writeErr(formatDivergentRecoveryMessage(migrationResult.details));
       process.exit(4);
   }
-  const postMigrationInspect = inspectVaultLayout(homedir36());
+  const postMigrationInspect = inspectVaultLayout(homedir38());
   const acceptable = [
     "no-vault",
     "already-migrated",
@@ -76360,7 +77578,7 @@ Applying switchroom config...
 `));
     process.exit(5);
   }
-  const vaultDir = resolveVaultBindMountDir(homedir36(), {
+  const vaultDir = resolveVaultBindMountDir(homedir38(), {
     migrationKind: migrationResult.kind,
     customVaultPath
   });
@@ -76390,11 +77608,11 @@ Applying switchroom config...
     imageTag: composeImageTag,
     buildMode: options.buildLocal ? "local" : "pull",
     buildContext: options.buildContext,
-    homeDir: homedir36(),
+    homeDir: homedir38(),
     switchroomConfigPath,
     operatorUid
   });
-  await mkdir(dirname19(composePath), { recursive: true });
+  await mkdir(dirname21(composePath), { recursive: true });
   await writeFile(composePath, composeContent, {
     encoding: "utf8",
     mode: 384
@@ -76410,7 +77628,7 @@ Wrote `) + composePath + source_default.gray(` (${composeBytes} bytes)
   writeOut(source_default.gray(`  (If pull returns 401, login to ghcr.io first: see docs/operators/install.md#ghcr-auth)
 `));
   if (process.geteuid?.() === 0 && operatorUid !== undefined) {
-    const restored = restoreOperatorOwnership(homedir36(), operatorUid);
+    const restored = restoreOperatorOwnership(homedir38(), operatorUid);
     if (restored.length > 0) {
       writeOut(source_default.gray(`  Restored operator ownership of ${restored.length} ~/.switchroom path(s)
 `));
@@ -76458,18 +77676,18 @@ function copyExampleConfig2(name) {
     throw new Error(`Invalid example name: ${name} (must match /^[a-z0-9_-]+$/)`);
   }
   const dest = resolve42(process.cwd(), "switchroom.yaml");
-  if (existsSync68(dest)) {
+  if (existsSync69(dest)) {
     console.error(source_default.yellow("switchroom.yaml already exists \u2014 skipping example copy"));
     return;
   }
   const embedded = EMBEDDED_EXAMPLES[name];
   if (embedded !== undefined) {
-    writeFileSync33(dest, embedded, { encoding: "utf8" });
+    writeFileSync35(dest, embedded, { encoding: "utf8" });
     console.log(source_default.green(`Copied ${name}.yaml -> switchroom.yaml`));
     return;
   }
   const exampleFile = resolve42(import.meta.dirname, `../../examples/${name}.yaml`);
-  if (!existsSync68(exampleFile)) {
+  if (!existsSync69(exampleFile)) {
     throw new Error(`Example config not found: ${name}.yaml (available: ${Object.keys(EMBEDDED_EXAMPLES).join(", ")})`);
   }
   copyFileSync11(exampleFile, dest);
@@ -76480,8 +77698,8 @@ function findUnwritableAgentDirs(config, opts) {
   const targets = opts.only ? [opts.only] : Object.keys(config.agents ?? {});
   const unwritable = [];
   for (const name of targets) {
-    const startSh = join64(agentsDir, name, "start.sh");
-    if (!existsSync68(startSh))
+    const startSh = join67(agentsDir, name, "start.sh");
+    if (!existsSync69(startSh))
       continue;
     try {
       accessSync3(startSh, fsConstants6.W_OK);
@@ -76659,9 +77877,9 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync57, existsSync as existsSync69, readdirSync as readdirSync26 } from "node:fs";
-import { join as join65 } from "node:path";
-import { homedir as homedir37 } from "node:os";
+import { readFileSync as readFileSync57, existsSync as existsSync70, readdirSync as readdirSync26 } from "node:fs";
+import { join as join68 } from "node:path";
+import { homedir as homedir39 } from "node:os";
 
 // src/status-ask/report.ts
 function parseJsonl(content) {
@@ -76982,7 +78200,7 @@ function runReport(opts) {
 function resolveSources(explicitPath) {
   if (explicitPath != null && explicitPath.trim() !== "") {
     const trimmed = explicitPath.trim();
-    if (!existsSync69(trimmed)) {
+    if (!existsSync70(trimmed)) {
       process.stderr.write(`status-ask report: ${trimmed}: file not found
 `);
       process.exit(1);
@@ -76996,9 +78214,9 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join65(homedir37(), ".switchroom", "agents");
+    agentsDir = join68(homedir39(), ".switchroom", "agents");
   }
-  if (!existsSync69(agentsDir))
+  if (!existsSync70(agentsDir))
     return [];
   const sources = [];
   let entries;
@@ -77008,8 +78226,8 @@ function resolveSources(explicitPath) {
     return [];
   }
   for (const name of entries) {
-    const path8 = join65(agentsDir, name, "runtime-metrics.jsonl");
-    if (existsSync69(path8)) {
+    const path8 = join68(agentsDir, name, "runtime-metrics.jsonl");
+    if (existsSync70(path8)) {
       sources.push({ path: path8, agent: name });
     }
   }
@@ -77030,17 +78248,17 @@ function inferAgentFromPath(p) {
 
 // src/cli/agent-config.ts
 init_helpers();
-import { join as join66 } from "node:path";
-import { homedir as homedir38 } from "node:os";
+import { join as join69 } from "node:path";
+import { homedir as homedir40 } from "node:os";
 import {
-  existsSync as existsSync70,
-  mkdirSync as mkdirSync37,
+  existsSync as existsSync71,
+  mkdirSync as mkdirSync39,
   appendFileSync as appendFileSync4,
   readFileSync as readFileSync58
 } from "node:fs";
-var AUDIT_ROOT = join66(homedir38(), ".switchroom", "audit");
+var AUDIT_ROOT = join69(homedir40(), ".switchroom", "audit");
 function auditPathFor(agent) {
-  return join66(AUDIT_ROOT, agent, "agent-config.jsonl");
+  return join69(AUDIT_ROOT, agent, "agent-config.jsonl");
 }
 function appendAudit(agent, cmd, args, exit, opts = {}) {
   const row = {
@@ -77054,8 +78272,8 @@ function appendAudit(agent, cmd, args, exit, opts = {}) {
   const path8 = opts.auditPath ?? auditPathFor(agent);
   const dir = path8.slice(0, path8.lastIndexOf("/"));
   try {
-    if (!existsSync70(dir)) {
-      mkdirSync37(dir, { recursive: true });
+    if (!existsSync71(dir)) {
+      mkdirSync39(dir, { recursive: true });
     }
     appendFileSync4(path8, JSON.stringify(row) + `
 `, { flag: "a" });
@@ -77066,7 +78284,7 @@ function isContainerContext(env2 = process.env, opts = {}) {
     return true;
   const probe2 = opts.dockerEnvPath ?? "/.dockerenv";
   try {
-    if (existsSync70(probe2))
+    if (existsSync71(probe2))
       return true;
   } catch {}
   return false;
@@ -77127,7 +78345,7 @@ function getAgentSlice(config, agent) {
 }
 function readAuditTail(agent, limit, opts = {}) {
   const path8 = opts.auditPath ?? auditPathFor(agent);
-  if (!existsSync70(path8))
+  if (!existsSync71(path8))
     return [];
   let raw;
   try {
@@ -77287,9 +78505,9 @@ var import_yaml15 = __toESM(require_dist(), 1);
 init_paths();
 import {
   closeSync as closeSync13,
-  existsSync as existsSync71,
+  existsSync as existsSync72,
   fsyncSync as fsyncSync6,
-  mkdirSync as mkdirSync38,
+  mkdirSync as mkdirSync40,
   openSync as openSync13,
   readdirSync as readdirSync27,
   readFileSync as readFileSync59,
@@ -77298,34 +78516,34 @@ import {
   unlinkSync as unlinkSync14,
   writeSync as writeSync8
 } from "node:fs";
-import { join as join67, resolve as resolve43 } from "node:path";
+import { join as join70, resolve as resolve43 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
   const base = opts.root ? resolve43(opts.root, agent) : resolve43(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join67(base, "schedule.d");
-  const scheduleStagingDir = join67(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join67(base, "skills.d");
-  const skillsStagingDir = join67(skillsDir, STAGING_SUBDIR);
+  const scheduleDir = join70(base, "schedule.d");
+  const scheduleStagingDir = join70(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join70(base, "skills.d");
+  const skillsStagingDir = join70(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join67(base, ".lock"),
+    lockPath: join70(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
 function ensureDirs(paths) {
-  mkdirSync38(paths.scheduleDir, { recursive: true });
-  mkdirSync38(paths.scheduleStagingDir, { recursive: true });
+  mkdirSync40(paths.scheduleDir, { recursive: true });
+  mkdirSync40(paths.scheduleStagingDir, { recursive: true });
 }
 function ensureSkillsDirs(paths) {
-  mkdirSync38(paths.skillsDir, { recursive: true });
-  mkdirSync38(paths.skillsStagingDir, { recursive: true });
+  mkdirSync40(paths.skillsDir, { recursive: true });
+  mkdirSync40(paths.skillsStagingDir, { recursive: true });
 }
 function withAgentLock(paths, fn) {
-  mkdirSync38(paths.agentRoot, { recursive: true });
+  mkdirSync40(paths.agentRoot, { recursive: true });
   const start = Date.now();
   const TIMEOUT_MS = 5000;
   let fd = null;
@@ -77366,8 +78584,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join67(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join67(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join70(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join70(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -77383,8 +78601,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join67(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join67(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join70(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join70(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -77399,8 +78617,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join67(paths.skillsDir, `${slug}.yaml`);
-    if (!existsSync71(finalPath))
+    const finalPath = join70(paths.skillsDir, `${slug}.yaml`);
+    if (!existsSync72(finalPath))
       return false;
     unlinkSync14(finalPath);
     return true;
@@ -77408,13 +78626,13 @@ function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
 }
 function listSkillsOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync71(paths.skillsDir))
+  if (!existsSync72(paths.skillsDir))
     return [];
   const out = [];
   for (const name of readdirSync27(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join67(paths.skillsDir, name);
+    const full = join70(paths.skillsDir, name);
     try {
       const raw = readFileSync59(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -77426,8 +78644,8 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join67(paths.scheduleDir, `${slug}.yaml`);
-    if (!existsSync71(finalPath))
+    const finalPath = join70(paths.scheduleDir, `${slug}.yaml`);
+    if (!existsSync72(finalPath))
       return false;
     unlinkSync14(finalPath);
     return true;
@@ -77435,13 +78653,13 @@ function deleteOverlayEntry(agent, slug, opts = {}) {
 }
 function listOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync71(paths.scheduleDir))
+  if (!existsSync72(paths.scheduleDir))
     return [];
   const out = [];
   for (const name of readdirSync27(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join67(paths.scheduleDir, name);
+    const full = join70(paths.scheduleDir, name);
     try {
       const raw = readFileSync59(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -77586,27 +78804,27 @@ function reconcileAgentCronOnly(agent) {
 // src/cli/agent-config-pending.ts
 import {
   closeSync as closeSync14,
-  existsSync as existsSync72,
+  existsSync as existsSync73,
   fsyncSync as fsyncSync7,
-  mkdirSync as mkdirSync39,
+  mkdirSync as mkdirSync41,
   openSync as openSync14,
   readdirSync as readdirSync28,
   readFileSync as readFileSync60,
   renameSync as renameSync15,
   unlinkSync as unlinkSync15,
-  writeFileSync as writeFileSync34,
+  writeFileSync as writeFileSync36,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join68 } from "node:path";
+import { join as join71 } from "node:path";
 import { randomBytes as randomBytes14 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join68(paths.scheduleDir, ".pending");
+  return join71(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  mkdirSync39(dir, { recursive: true });
+  mkdirSync41(dir, { recursive: true });
   return dir;
 }
 function newStageId() {
@@ -77615,8 +78833,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join68(dir, `${stageId}.yaml`);
-  const metaPath = join68(dir, `${stageId}.meta.json`);
+  const yamlPath = join71(dir, `${stageId}.yaml`);
+  const metaPath = join71(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -77637,22 +78855,22 @@ function stagePendingScheduleEntry(opts) {
     }
     renameSync15(yamlTmp, yamlPath);
   }
-  writeFileSync34(metaPath, JSON.stringify(meta, null, 2) + `
+  writeFileSync36(metaPath, JSON.stringify(meta, null, 2) + `
 `, { mode: 384 });
   return { stageId, yamlPath, metaPath };
 }
 function listPendingScheduleEntries(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  if (!existsSync72(dir))
+  if (!existsSync73(dir))
     return [];
   const out = [];
   for (const name of readdirSync28(dir).sort()) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join68(dir, name);
-    const yamlPath = join68(dir, `${stageId}.yaml`);
-    if (!existsSync72(yamlPath))
+    const metaPath = join71(dir, name);
+    const yamlPath = join71(dir, `${stageId}.yaml`);
+    if (!existsSync73(yamlPath))
       continue;
     try {
       const meta = JSON.parse(readFileSync60(metaPath, "utf-8"));
@@ -77670,8 +78888,8 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join68(paths.scheduleDir, `${slug}.yaml`);
-  if (existsSync72(finalPath)) {
+  const finalPath = join71(paths.scheduleDir, `${slug}.yaml`);
+  if (existsSync73(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
   renameSync15(match.yamlPath, finalPath);
@@ -77694,7 +78912,7 @@ function denyPendingScheduleEntry(opts) {
 
 // src/cli/agent-config-write.ts
 init_protocol3();
-import { existsSync as existsSync73, readFileSync as readFileSync61 } from "node:fs";
+import { existsSync as existsSync74, readFileSync as readFileSync61 } from "node:fs";
 var MAX_ENTRIES_PER_AGENT = 20;
 var MIN_CRON_INTERVAL_MIN = 5;
 function extractCronSmallestGapMin(expr) {
@@ -77980,7 +79198,7 @@ function scheduleRemove(opts) {
   }
   let priorContent = null;
   try {
-    if (existsSync73(match.path))
+    if (existsSync74(match.path))
       priorContent = readFileSync61(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
@@ -78173,10 +79391,10 @@ function registerAgentConfigWriteCommands(program3) {
 
 // src/cli/agent-config-skill-write.ts
 var import_yaml16 = __toESM(require_dist(), 1);
-import { existsSync as existsSync74 } from "node:fs";
+import { existsSync as existsSync75 } from "node:fs";
 init_reconcile_default_skills();
 var import_yaml17 = __toESM(require_dist(), 1);
-import { join as join69 } from "node:path";
+import { join as join72 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -78251,8 +79469,8 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join69(poolDir, skillName);
-  if (!existsSync74(skillPath)) {
+  const skillPath = join72(poolDir, skillName);
+  if (!existsSync75(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
   const yamlText = import_yaml16.stringify({ skills: [skillName] });
@@ -78416,9 +79634,9 @@ function registerAgentConfigSkillWriteCommands(program3) {
 // src/cli/skill.ts
 import {
   closeSync as closeSync15,
-  existsSync as existsSync75,
+  existsSync as existsSync76,
   lstatSync as lstatSync8,
-  mkdirSync as mkdirSync40,
+  mkdirSync as mkdirSync42,
   mkdtempSync as mkdtempSync5,
   openSync as openSync15,
   readFileSync as readFileSync62,
@@ -78427,10 +79645,10 @@ import {
   renameSync as renameSync16,
   rmSync as rmSync16,
   statSync as statSync29,
-  writeFileSync as writeFileSync35
+  writeFileSync as writeFileSync37
 } from "node:fs";
-import { tmpdir as tmpdir4, homedir as homedir39 } from "node:os";
-import { dirname as dirname20, join as join70, relative as relative2, resolve as resolve44 } from "node:path";
+import { tmpdir as tmpdir4, homedir as homedir41 } from "node:os";
+import { dirname as dirname22, join as join73, relative as relative2, resolve as resolve44 } from "node:path";
 import { spawnSync as spawnSync10 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -78624,10 +79842,10 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join70(homedir39(), raw.slice(2));
+    return join73(homedir41(), raw.slice(2));
   }
   if (raw === "~")
-    return homedir39();
+    return homedir41();
   return resolve44(raw);
 }
 function readStdinSync() {
@@ -78663,7 +79881,7 @@ function loadFromDir(dir) {
   const walk2 = (sub) => {
     const entries = readdirSync29(sub, { withFileTypes: true });
     for (const ent of entries) {
-      const full = join70(sub, ent.name);
+      const full = join73(sub, ent.name);
       const rel = relative2(abs, full);
       if (ent.isSymbolicLink()) {
         fail2(`refusing to read symlink inside --from dir: ${rel}`);
@@ -78698,7 +79916,7 @@ function loadFromTarball(tarPath) {
       fail2(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
-  const staging = mkdtempSync5(join70(tmpdir4(), "skill-apply-extract-"));
+  const staging = mkdtempSync5(join73(tmpdir4(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
     const r = spawnSync10("tar", [
@@ -78784,10 +80002,10 @@ function validatePayload(name, files) {
           errors2.push(`${path8} fails \`bash -n\` syntax check: ${(r.stderr ?? "").trim()}`);
         }
       } else if (PY_SCRIPT_RE2.test(path8)) {
-        const tmp = mkdtempSync5(join70(tmpdir4(), "skill-apply-py-"));
-        const tmpPy = join70(tmp, "check.py");
+        const tmp = mkdtempSync5(join73(tmpdir4(), "skill-apply-py-"));
+        const tmpPy = join73(tmp, "check.py");
         try {
-          writeFileSync35(tmpPy, content);
+          writeFileSync37(tmpPy, content);
           const r = spawnSync10("python3", ["-m", "py_compile", tmpPy], {
             encoding: "utf-8"
           });
@@ -78805,10 +80023,10 @@ function validatePayload(name, files) {
 function diffSummary(currentDir, files) {
   const lines = [];
   const currentFiles = {};
-  if (existsSync75(currentDir)) {
+  if (existsSync76(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync29(sub, { withFileTypes: true })) {
-        const full = join70(sub, ent.name);
+        const full = join73(sub, ent.name);
         const rel = relative2(currentDir, full);
         if (ent.isDirectory()) {
           walk2(full);
@@ -78841,10 +80059,10 @@ function diffSummary(currentDir, files) {
 `);
 }
 function writePayload(poolDir, name, files) {
-  if (!existsSync75(poolDir)) {
-    mkdirSync40(poolDir, { recursive: true, mode: 493 });
+  if (!existsSync76(poolDir)) {
+    mkdirSync42(poolDir, { recursive: true, mode: 493 });
   }
-  const target = join70(poolDir, name);
+  const target = join73(poolDir, name);
   let targetIsSymlink = false;
   try {
     const st = lstatSync8(target);
@@ -78855,15 +80073,15 @@ function writePayload(poolDir, name, files) {
   if (targetIsSymlink) {
     fail2(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
-  const staging = mkdtempSync5(join70(poolDir, `.skill-apply-stage-${name}-`));
+  const staging = mkdtempSync5(join73(poolDir, `.skill-apply-stage-${name}-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join70(staging, path8);
-      mkdirSync40(dirname20(full), { recursive: true, mode: 493 });
+      const full = join73(staging, path8);
+      mkdirSync42(dirname22(full), { recursive: true, mode: 493 });
       const fd = openSync15(full, "wx");
       try {
-        writeFileSync35(fd, content);
+        writeFileSync37(fd, content);
       } finally {
         closeSync15(fd);
       }
@@ -78890,9 +80108,9 @@ function writePayload(poolDir, name, files) {
     try {
       rmSync16(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync75(oldRename)) {
+    if (oldRename && existsSync76(oldRename)) {
       try {
-        if (existsSync75(target)) {
+        if (existsSync76(target)) {
           rmSync16(target, { recursive: true, force: true });
         }
         renameSync16(oldRename, target);
@@ -78913,7 +80131,7 @@ function registerSkillCommand(program3) {
       files = loadFromStdin();
     } else {
       const fromPath = resolve44(opts.from);
-      if (!existsSync75(fromPath)) {
+      if (!existsSync76(fromPath)) {
         fail2(`--from path does not exist: ${opts.from}`);
       }
       const st = statSync29(fromPath);
@@ -78937,7 +80155,7 @@ function registerSkillCommand(program3) {
     }
     const config = loadConfig();
     const poolDir = resolveSkillsPoolDir2(config.switchroom?.skills_dir);
-    const currentDir = join70(poolDir, name);
+    const currentDir = join73(poolDir, name);
     console.log(source_default.bold(`Skill: ${name}`) + source_default.gray(` (${Object.keys(files).length} files, ${sumBytes(files)} bytes)`));
     console.log(source_default.bold("Diff vs current pool content:"));
     console.log(diffSummary(currentDir, files));
@@ -78968,9 +80186,9 @@ function sumBytes(files) {
 // src/cli/skill-personal.ts
 import {
   closeSync as closeSync16,
-  existsSync as existsSync76,
+  existsSync as existsSync77,
   lstatSync as lstatSync9,
-  mkdirSync as mkdirSync41,
+  mkdirSync as mkdirSync43,
   mkdtempSync as mkdtempSync6,
   openSync as openSync16,
   readFileSync as readFileSync63,
@@ -78979,10 +80197,10 @@ import {
   rmSync as rmSync17,
   statSync as statSync30,
   utimesSync,
-  writeFileSync as writeFileSync36
+  writeFileSync as writeFileSync38
 } from "node:fs";
-import { dirname as dirname21, join as join71, relative as relative3, resolve as resolve45 } from "node:path";
-import { homedir as homedir40, tmpdir as tmpdir5 } from "node:os";
+import { dirname as dirname23, join as join74, relative as relative3, resolve as resolve45 } from "node:path";
+import { homedir as homedir42, tmpdir as tmpdir5 } from "node:os";
 import { spawnSync as spawnSync11 } from "node:child_process";
 init_helpers();
 init_source();
@@ -78992,15 +80210,15 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve45(override) : join71(homedir40(), ".switchroom-config");
-  if (!existsSync76(candidate))
+  const candidate = override ? resolve45(override) : join74(homedir42(), ".switchroom-config");
+  if (!existsSync77(candidate))
     return null;
-  return join71(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
+  return join74(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
   try {
-    if (!existsSync76(configSkillsRoot))
+    if (!existsSync77(configSkillsRoot))
       return;
     const now = Date.now();
     for (const ent of readdirSync30(configSkillsRoot)) {
@@ -79013,7 +80231,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync17(join71(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync17(join74(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -79022,7 +80240,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   const configSkillsRoot = resolveConfigSkillsDir(agent);
   if (!configSkillsRoot)
     return;
-  const dest = join71(configSkillsRoot, name);
+  const dest = join74(configSkillsRoot, name);
   try {
     if (liveSkillDir !== null) {
       try {
@@ -79036,32 +80254,32 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     }
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
-      if (existsSync76(dest)) {
-        const trash = join71(configSkillsRoot, `.${name}-trash-${Date.now()}`);
+      if (existsSync77(dest)) {
+        const trash = join74(configSkillsRoot, `.${name}-trash-${Date.now()}`);
         renameSync17(dest, trash);
       }
       return;
     }
-    mkdirSync41(configSkillsRoot, { recursive: true, mode: 493 });
+    mkdirSync43(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
-    const staging = mkdtempSync6(join71(configSkillsRoot, `.${name}-staging-`));
+    const staging = mkdtempSync6(join74(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
-      mkdirSync41(dst, { recursive: true, mode: 493 });
+      mkdirSync43(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync30(src, { withFileTypes: true })) {
-        const s = join71(src, ent.name);
-        const d = join71(dst, ent.name);
+        const s = join74(src, ent.name);
+        const d = join74(dst, ent.name);
         if (ent.isSymbolicLink())
           continue;
         if (ent.isDirectory())
           walk2(s, d);
         else if (ent.isFile()) {
-          writeFileSync36(d, readFileSync63(s));
+          writeFileSync38(d, readFileSync63(s));
         }
       }
     };
     walk2(liveSkillDir, staging);
-    if (existsSync76(dest)) {
-      const prior = join71(configSkillsRoot, `.${name}-prior-${Date.now()}`);
+    if (existsSync77(dest)) {
+      const prior = join74(configSkillsRoot, `.${name}-prior-${Date.now()}`);
       renameSync17(dest, prior);
     }
     renameSync17(staging, dest);
@@ -79088,13 +80306,13 @@ function resolveAgent(opts) {
 function resolveAgentsRoot(opts) {
   if (opts.root)
     return resolve45(opts.root);
-  return join71(homedir40(), ".switchroom", "agents");
+  return join74(homedir42(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
-  return join71(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
+  return join74(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
 }
 function trashDir(agentsRoot, agent) {
-  return join71(agentsRoot, agent, ".claude", TRASH_DIRNAME);
+  return join74(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
 function readStdinSync2() {
   const chunks = [];
@@ -79124,7 +80342,7 @@ function loadFromDir2(dir) {
   const files = {};
   const walk2 = (sub) => {
     for (const ent of readdirSync30(sub, { withFileTypes: true })) {
-      const full = join71(sub, ent.name);
+      const full = join74(sub, ent.name);
       if (ent.isSymbolicLink()) {
         fail3(`refusing to read symlink in --from dir: ${relative3(abs, full)}`);
       }
@@ -79177,10 +80395,10 @@ function behavioralValidate(files) {
         errors2.push(`${path8} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
     } else if (PY_SCRIPT_RE.test(path8)) {
-      const tmp = mkdtempSync6(join71(tmpdir5(), "skill-personal-py-"));
-      const tmpPy = join71(tmp, "check.py");
+      const tmp = mkdtempSync6(join74(tmpdir5(), "skill-personal-py-"));
+      const tmpPy = join74(tmp, "check.py");
       try {
-        writeFileSync36(tmpPy, content);
+        writeFileSync38(tmpPy, content);
         const r = spawnSync11("python3", ["-m", "py_compile", tmpPy], {
           encoding: "utf-8"
         });
@@ -79196,13 +80414,13 @@ function behavioralValidate(files) {
 }
 function sweepTrash(agentsRoot, agent) {
   const trash = trashDir(agentsRoot, agent);
-  if (!existsSync76(trash))
+  if (!existsSync77(trash))
     return;
   const now = Date.now();
   for (const ent of readdirSync30(trash, { withFileTypes: true })) {
     if (!ent.isDirectory())
       continue;
-    const entPath = join71(trash, ent.name);
+    const entPath = join74(trash, ent.name);
     try {
       const st = statSync30(entPath);
       if (now - st.mtimeMs > TRASH_TTL_MS) {
@@ -79222,16 +80440,16 @@ function writePersonalSkill(targetDir, files) {
   if (targetIsSymlink) {
     fail3(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
-  mkdirSync41(dirname21(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join71(dirname21(targetDir), `.skill-personal-stage-`));
+  mkdirSync43(dirname23(targetDir), { recursive: true, mode: 493 });
+  const staging = mkdtempSync6(join74(dirname23(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join71(staging, path8);
-      mkdirSync41(dirname21(full), { recursive: true, mode: 493 });
+      const full = join74(staging, path8);
+      mkdirSync43(dirname23(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
-        writeFileSync36(fd, content);
+        writeFileSync38(fd, content);
       } finally {
         closeSync16(fd);
       }
@@ -79258,9 +80476,9 @@ function writePersonalSkill(targetDir, files) {
     try {
       rmSync17(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync76(oldRename)) {
+    if (oldRename && existsSync77(oldRename)) {
       try {
-        if (existsSync76(targetDir)) {
+        if (existsSync77(targetDir)) {
           rmSync17(targetDir, { recursive: true, force: true });
         }
         renameSync17(oldRename, targetDir);
@@ -79312,7 +80530,7 @@ function loadFiles(opts) {
     return loadFromStdin2();
   }
   const p = resolve45(opts.from);
-  if (!existsSync76(p)) {
+  if (!existsSync77(p)) {
     fail3(`--from path does not exist: ${opts.from}`);
   }
   const st = statSync30(p);
@@ -79360,10 +80578,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join71(homedir40(), ".switchroom", "skills");
+  return join74(homedir42(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join71(homedir40(), ".switchroom", "skills", "_bundled");
+  return join74(homedir42(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -79373,8 +80591,8 @@ function resolveCloneSource(source, opts) {
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
-  const dir = join71(root, slug);
-  if (!existsSync76(dir)) {
+  const dir = join74(root, slug);
+  if (!existsSync77(dir)) {
     fail3(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
   const st = lstatSync9(dir);
@@ -79389,7 +80607,7 @@ function readSourceFiles(dir) {
   const skipped = [];
   const walk2 = (sub) => {
     for (const ent of readdirSync30(sub, { withFileTypes: true })) {
-      const full = join71(sub, ent.name);
+      const full = join74(sub, ent.name);
       if (ent.isSymbolicLink()) {
         continue;
       }
@@ -79498,9 +80716,9 @@ function removePersonalAction(name, opts) {
     throw err2;
   }
   const trashRoot = trashDir(agentsRoot, agent);
-  mkdirSync41(trashRoot, { recursive: true, mode: 493 });
+  mkdirSync43(trashRoot, { recursive: true, mode: 493 });
   const ts = Date.now();
-  const trashTarget = join71(trashRoot, `${name}-${ts}`);
+  const trashTarget = join74(trashRoot, `${name}-${ts}`);
   renameSync17(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
@@ -79519,16 +80737,16 @@ function listPersonalAction(opts) {
   const agent = resolveAgent(opts);
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
-  const skillsDir = join71(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join74(agentsRoot, agent, ".claude", "skills");
   const personal = [];
-  if (existsSync76(skillsDir)) {
+  if (existsSync77(skillsDir)) {
     for (const ent of readdirSync30(skillsDir, { withFileTypes: true })) {
       if (!ent.isDirectory())
         continue;
       if (!ent.name.startsWith(PERSONAL_PREFIX))
         continue;
       const skillName = ent.name.slice(PERSONAL_PREFIX.length);
-      const skillPath = join71(skillsDir, ent.name);
+      const skillPath = join74(skillsDir, ent.name);
       let fileCount = 0;
       let totalBytes = 0;
       const walk2 = (sub) => {
@@ -79536,10 +80754,10 @@ function listPersonalAction(opts) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync30(join71(sub, e.name)).size;
+              totalBytes += statSync30(join74(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
-            walk2(join71(sub, e.name));
+            walk2(join74(sub, e.name));
           }
         }
       };
@@ -79578,24 +80796,24 @@ function registerSkillPersonalCommands(program3) {
 // src/cli/skill-search.ts
 init_helpers();
 var import_yaml19 = __toESM(require_dist(), 1);
-import { existsSync as existsSync77, readdirSync as readdirSync31, readFileSync as readFileSync64, statSync as statSync31 } from "node:fs";
-import { homedir as homedir41 } from "node:os";
-import { join as join72, resolve as resolve46 } from "node:path";
+import { existsSync as existsSync78, readdirSync as readdirSync31, readFileSync as readFileSync64, statSync as statSync31 } from "node:fs";
+import { homedir as homedir43 } from "node:os";
+import { join as join75, resolve as resolve46 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
 function defaultAgentsRoot() {
-  return resolve46(homedir41(), ".switchroom/agents");
+  return resolve46(homedir43(), ".switchroom/agents");
 }
 function defaultSharedRoot2() {
-  return resolve46(homedir41(), ".switchroom/skills");
+  return resolve46(homedir43(), ".switchroom/skills");
 }
 function defaultBundledRoot2() {
-  return resolve46(homedir41(), ".switchroom/skills/_bundled");
+  return resolve46(homedir43(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join72(skillDir, "SKILL.md");
-  if (!existsSync77(mdPath))
+  const mdPath = join75(skillDir, "SKILL.md");
+  if (!existsSync78(mdPath))
     return null;
   let content;
   try {
@@ -79627,7 +80845,7 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join72(skillDir, "SKILL.md");
+  const mdPath = join75(skillDir, "SKILL.md");
   try {
     const st = statSync31(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
@@ -79638,8 +80856,8 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join72(agentsRoot, agent, ".claude/skills");
-  if (!existsSync77(skillsDir))
+  const skillsDir = join75(agentsRoot, agent, ".claude/skills");
+  if (!existsSync78(skillsDir))
     return [];
   const out = [];
   let entries;
@@ -79651,7 +80869,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join72(skillsDir, ent);
+    const dirPath = join75(skillsDir, ent);
     try {
       if (!statSync31(dirPath).isDirectory())
         continue;
@@ -79677,7 +80895,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   return out;
 }
 function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
-  if (!existsSync77(sharedRoot))
+  if (!existsSync78(sharedRoot))
     return [];
   const out = [];
   let entries;
@@ -79691,7 +80909,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join72(sharedRoot, ent);
+    const dirPath = join75(sharedRoot, ent);
     try {
       if (!statSync31(dirPath).isDirectory())
         continue;
@@ -79715,7 +80933,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
   return out;
 }
 function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
-  if (!existsSync77(bundledRoot))
+  if (!existsSync78(bundledRoot))
     return [];
   const out = [];
   let entries;
@@ -79727,7 +80945,7 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join72(bundledRoot, ent);
+    const dirPath = join75(bundledRoot, ent);
     try {
       if (!statSync31(dirPath).isDirectory())
         continue;
@@ -79871,9 +81089,9 @@ function registerHostdMcpCommand(program3) {
 // src/cli/hostd.ts
 init_source();
 init_helpers();
-import { existsSync as existsSync79, mkdirSync as mkdirSync42, readdirSync as readdirSync32, readFileSync as readFileSync66, writeFileSync as writeFileSync37, statSync as statSync32, copyFileSync as copyFileSync12 } from "node:fs";
-import { homedir as homedir42 } from "node:os";
-import { join as join73 } from "node:path";
+import { existsSync as existsSync80, mkdirSync as mkdirSync44, readdirSync as readdirSync32, readFileSync as readFileSync66, writeFileSync as writeFileSync39, statSync as statSync32, copyFileSync as copyFileSync12 } from "node:fs";
+import { homedir as homedir44 } from "node:os";
+import { join as join76 } from "node:path";
 import { spawnSync as spawnSync13 } from "node:child_process";
 init_audit_reader();
 var DEFAULT_IMAGE_TAG = "latest";
@@ -79964,14 +81182,14 @@ networks:
 `;
 }
 function hostdDir() {
-  return join73(homedir42(), ".switchroom", "hostd");
+  return join76(homedir44(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join73(hostdDir(), "docker-compose.yml");
+  return join76(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
-  if (!existsSync79(p))
+  if (!existsSync80(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -80004,9 +81222,9 @@ async function doInstall(opts, program3) {
   }
   const dir = hostdDir();
   const composePath = hostdComposePath();
-  mkdirSync42(dir, { recursive: true });
+  mkdirSync44(dir, { recursive: true });
   const yaml = renderHostdComposeFile({
-    hostHome: homedir42(),
+    hostHome: homedir44(),
     imageTag: opts.tag ?? DEFAULT_IMAGE_TAG,
     operatorUid: resolveOperatorUid()
   });
@@ -80019,7 +81237,7 @@ async function doInstall(opts, program3) {
   const bak = backupExistingCompose();
   if (bak)
     console.log(source_default.dim(`  Backed up existing compose to ${bak}`));
-  writeFileSync37(composePath, yaml, "utf8");
+  writeFileSync39(composePath, yaml, "utf8");
   console.log(source_default.green(`  \u2713 Wrote ${composePath}`));
   console.log(source_default.dim(`    admin agents: ${adminAgents.length === 0 ? "(none)" : adminAgents.join(", ")}`));
   console.log(source_default.dim(`    Pulling ghcr.io/switchroom/switchroom-hostd:${opts.tag ?? DEFAULT_IMAGE_TAG}\u2026`));
@@ -80048,7 +81266,7 @@ function doStatus() {
   const composeYml = hostdComposePath();
   console.log(source_default.bold("switchroom-hostd"));
   console.log("");
-  if (!existsSync79(composeYml)) {
+  if (!existsSync80(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom hostd install` to set up."));
     return;
@@ -80069,14 +81287,14 @@ function doStatus() {
   } else {
     console.log(source_default.green(`  container:  ${ps.stdout.trim()}`));
   }
-  if (existsSync79(dir)) {
+  if (existsSync80(dir)) {
     const entries = [];
     try {
       for (const name of readdirSync32(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join73(dir, name, "sock");
-        if (existsSync79(sockPath)) {
+        const sockPath = join76(dir, name, "sock");
+        if (existsSync80(sockPath)) {
           const st = statSync32(sockPath);
           if ((st.mode & 61440) === 49152) {
             entries.push(`${name} \u2192 ${sockPath}`);
@@ -80095,7 +81313,7 @@ function doStatus() {
 }
 function doUninstall() {
   const composeYml = hostdComposePath();
-  if (!existsSync79(composeYml)) {
+  if (!existsSync80(composeYml)) {
     console.log(source_default.yellow("  No hostd install detected (no compose file at this path)."));
     return;
   }
@@ -80119,7 +81337,7 @@ function registerHostdCommand(program3) {
   hostd.command("uninstall").description("Stop the hostd container. Leaves the compose file in place for re-install.").action(() => doUninstall());
   hostd.command("audit").description("Tail and filter the hostd audit log (privileged-verb call history)").option("--tail <n>", "Number of matching entries to show (default: 50)", "50").option("--agent <name>", "Filter to a specific caller agent").option("--op <verb>", "Filter to a specific hostd verb (e.g. update_apply, agent_restart)").option("--error", "Show only failed (error/denied) entries").option("--verbose", "Show the captured stderr / error tail under each failed row").option("--path <file>", "Override audit log path (for debugging)").action((opts) => {
     const logPath = opts.path ?? defaultAuditLogPath2();
-    if (!existsSync79(logPath)) {
+    if (!existsSync80(logPath)) {
       console.error(source_default.yellow(`Audit log not found at ${logPath}.`) + source_default.gray(`
 The log is created when hostd handles its first privileged-verb request.`));
       return;
@@ -80196,6 +81414,9 @@ registerDebugCommand(program3);
 registerWorktreeCommand(program3);
 registerDriveCommand(program3);
 registerDriveMcpLauncherCommand(program3);
+registerM365McpLauncherCommand(program3);
+registerNotionMcpLauncherCommand(program3);
+registerNotionCommand(program3);
 registerApplyCommand(program3);
 registerSecretDetectCommand(program3);
 registerStatusAskCommand(program3);