switchroom 0.13.54 → 0.13.56

package/telegram-plugin/dist/gateway/gateway.js

@@ -16334,10 +16334,10 @@ __export(exports_client, {
   AuthBrokerClient: () => AuthBrokerClient
 });
 import * as net from "node:net";
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 function reviveDate(v) {
   if (v == null)
     return null;
@@ -16347,7 +16347,7 @@ function reviveDate(v) {
   return Number.isNaN(d.getTime()) ? null : d;
 }
 function operatorSocketPath(home = homedir3()) {
-  return join8(home, ".switchroom", "state", "auth-broker-operator", "sock");
+  return join9(home, ".switchroom", "state", "auth-broker-operator", "sock");
 }
 function resolveAuthBrokerSocketPath(opts) {
   if (opts?.socket)
@@ -16617,7 +16617,7 @@ async function withAuthBrokerClient(fn, opts) {
   }
 }
 function authBrokerSocketExists(opts) {
-  return existsSync6(resolveAuthBrokerSocketPath(opts));
+  return existsSync7(resolveAuthBrokerSocketPath(opts));
 }
 var DEFAULT_TIMEOUT_MS = 5000, AuthBrokerError, AuthBrokerUnreachableError;
 var init_client = __esm(() => {
@@ -23607,7 +23607,7 @@ var init_dist = __esm(() => {
 });
 
 // ../src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, HostdConfigSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, HostdConfigSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   CodeRepoEntrySchema = exports_external.object({
@@ -23792,6 +23792,16 @@ var init_schema = __esm(() => {
     authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
     org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC \u00a76.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false \u2014 personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")
   }).optional();
+  NotionWorkspaceConfigSchema = exports_external.object({
+    vault_key: exports_external.string().min(1).default("notion/integration-token").describe("Vault key holding the Notion internal-integration token. Default " + "`notion/integration-token`. Override only for non-standard vault " + "layouts. The broker's --allow ACL on this key is the authoritative " + "list of which agents may receive the token."),
+    databases: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9_-]{0,62}$/, {
+      message: "notion_workspace.databases friendly names must match " + "/^[a-z0-9][a-z0-9_-]{0,62}$/ \u2014 lowercase letters, digits, " + "hyphens, underscores. Got: '%s'."
+    }), exports_external.string().regex(/^[0-9a-fA-F]{8}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{12}$/, {
+      message: "notion_workspace.databases values must be Notion database " + "UUIDs (32 hex characters, optional dashes)."
+    })).default({}).describe("Friendly-name \u2192 Notion database UUID map. Operator-managed; agents " + "reference databases by friendly name only \u2014 they never see or type " + "UUIDs. Populate via `switchroom notion list-dbs` (PR 4) after " + "vault-putting the integration token and sharing DBs with the " + "integration in Notion's UI."),
+    mcp_version: exports_external.string().min(1).optional().describe("Optional pin for the upstream `@notionhq/notion-mcp-server` npm " + "package version. Default is the build-time `NOTION_MCP_PINNED_VERSION` " + "constant. Override only when reproducing operator-specific bugs."),
+    rate_limit_rps: exports_external.number().int().positive().max(10).optional().describe("Optional global rate-limit budget in requests per second across all " + "switchroom agents sharing this integration token. Defaults to 3 " + "(Notion's documented public-API limit). Lower it if you also use " + "the integration token from outside switchroom and need to share " + "budget. Higher than 10 is rejected \u2014 if you think you need it, " + "your usage probably needs a workspace-tier upgrade with Notion.")
+  }).optional();
   AgentGoogleWorkspaceConfigSchema = exports_external.object({
     account: exports_external.string().regex(/^[^@\s:]+@[^@\s:]+\.[^@\s:]+$/, {
       message: "google_workspace.account must be a Google account email like " + "'alice@example.com' (colons not allowed)"
@@ -23805,6 +23815,13 @@ var init_schema = __esm(() => {
     }).transform((v) => v.trim().toLowerCase()).optional().describe("RFC #1873: the Microsoft account this agent uses for the M365 MCP. " + "Must be a key in top-level `microsoft_accounts:` with this agent " + "listed in its `enabled_for[]`. Read by the auth-broker " + "(get-credentials, provider=microsoft) and by the scaffold to " + "decide whether to emit the `ms-365` MCP entry. Normalized to " + "lowercase so it matches the microsoft_accounts key (which is " + "also normalized)."),
     org_mode: exports_external.boolean().optional().describe("Per-agent org_mode override (RFC #1873 \u00a76.4). When set, replaces " + "the top-level microsoft_workspace.org_mode for this agent. " + "Defaults to top-level value (which defaults to false).")
   }).optional();
+  AgentNotionWorkspaceConfigSchema = exports_external.object({
+    databases: exports_external.array(exports_external.string().regex(/^[a-z0-9][a-z0-9_-]{0,62}$/, {
+      message: "notion_workspace.databases entries must be friendly names " + "matching /^[a-z0-9][a-z0-9_-]{0,62}$/ \u2014 these must appear as " + "keys in top-level notion_workspace.databases."
+    })).min(1, {
+      message: "notion_workspace.databases must list at least one friendly " + "name. An empty list rejects every Notion tool call \u2014 if you " + "want to remove this agent's Notion access, delete the entire " + "notion_workspace block instead."
+    }).optional().describe("Optional per-agent allowlist of database friendly names this " + "agent may read/write. Each name must exist as a key in top-level " + "notion_workspace.databases. Omit the field (or leave it undefined) " + "to grant access to every DB the upstream integration can see \u2014 " + "appropriate for an admin/orchestrator agent. Set the list to " + "narrow access for specialist agents.")
+  }).optional();
   ReactionsSchema = exports_external.object({
     enabled: exports_external.boolean().optional().describe("Master switch for the reaction-trigger path. When false, " + "reactions are still persisted via recordReaction but never " + "dispatched to the agent as synthetic inbound turns. Default true."),
     trigger_emojis: exports_external.array(exports_external.string()).optional().describe("Emoji allowlist that triggers a synthetic inbound when reacted " + "to a bot message. Default ['\uD83D\uDC4E', '\u274c', '\uD83D\uDC4D', '\u2705']. Cascade " + "mode: REPLACE (not union) \u2014 setting this at a layer replaces " + "lower layers entirely, so an operator can narrow to [] to " + "disable triggering without flipping `enabled`."),
@@ -23941,6 +23958,7 @@ var init_schema = __esm(() => {
     drive: AgentGoogleWorkspaceConfigSchema.describe("RFC D legacy key \u2014 use `google_workspace:` instead. Per-agent " + "google_workspace overrides (currently approvers + tier). When set, " + "replaces the top-level approvers list for this agent. " + "google_client_id/secret are not per-agent \u2014 they live at the top level."),
     google_workspace: AgentGoogleWorkspaceConfigSchema.describe("RFC G canonical key. Per-agent Google Workspace overrides \u2014 currently " + "approvers (replaces, does not extend the top-level list) and tier " + "(`core` | `extended` | `complete`, replaces top-level default). " + "google_client_id/secret are not per-agent \u2014 they live at the top level. " + "Mutually exclusive with `drive:` on the same agent (loader fails fast " + "if both are set)."),
     microsoft_workspace: AgentMicrosoftWorkspaceConfigSchema.describe("RFC #1873 (Microsoft 365 integration). Per-agent Microsoft Workspace " + "override \u2014 pins the Microsoft account this agent reads via the " + "auth-broker (must be a key in top-level `microsoft_accounts:` with " + "this agent in its `enabled_for[]`) and optionally overrides org_mode. " + "microsoft_client_id/secret are not per-agent."),
+    notion_workspace: AgentNotionWorkspaceConfigSchema.describe("RFC docs/rfcs/notion-integration.md. Per-agent Notion access. " + "Presence opts the agent IN (launcher scaffolded, MCP entry emitted, " + "broker grants the integration token). Optional `databases:` filter " + "narrows which DBs this agent may read/write \u2014 names must resolve in " + "top-level notion_workspace.databases. Absence opts the agent OUT."),
     repos: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9-]*$/, "Repo slug must be kebab-case ASCII: start with a lowercase letter or digit, contain only lowercase letters, digits, and hyphens"), exports_external.object({
       url: exports_external.string().min(1).describe("Git remote URL for the repo (e.g. 'git@github.com:org/repo.git' or " + "'https://github.com/org/repo.git'). Used verbatim for git clone."),
       branch_default: exports_external.string().optional().describe("Default branch to track (defaults to the remote's HEAD, typically 'main'). " + "The per-agent branch 'agent/<agentName>/main' fast-forwards to this branch " + "when the worktree is clean on session start.")
@@ -24064,6 +24082,7 @@ var init_schema = __esm(() => {
     drive: GoogleWorkspaceConfigSchema.describe("RFC D legacy key \u2014 use `google_workspace:` instead. Optional Google " + "Workspace onboarding configuration. When set, supplies Google OAuth " + "client credentials, the approver allowlist for `switchroom drive " + "connect`, and the optional tier knob. Env vars " + "(SWITCHROOM_GOOGLE_CLIENT_ID, SWITCHROOM_GOOGLE_CLIENT_SECRET, " + "SWITCHROOM_APPROVER_USER_ID) take precedence over this block when " + "set, preserving back-compat with the env-only flow shipped in #766."),
     google_workspace: GoogleWorkspaceConfigSchema.describe("RFC G canonical key. Top-level Google Workspace configuration \u2014 " + "OAuth client credentials, approver allowlist, and tier knob (`core` " + "| `extended` | `complete`, default `core`). Mutually exclusive with " + "`drive:` at the top level (loader fails fast if both are set)."),
     microsoft_workspace: MicrosoftWorkspaceConfigSchema.describe("RFC #1873 (Microsoft 365 integration). Top-level Microsoft Workspace " + "configuration \u2014 OAuth client credentials (Entra app), authority " + "endpoint (defaults to /common for personal MSA + work), and the " + "org_mode opt-in for Teams/SharePoint surfaces. Block is optional; " + "when omitted the broker does not register the Microsoft provider."),
+    notion_workspace: NotionWorkspaceConfigSchema.describe("RFC docs/rfcs/notion-integration.md. Top-level Notion integration " + "config \u2014 vault key for the integration token, friendly-name \u2192 " + "database UUID map, optional MCP-package version pin, and optional " + "global rate-limit override (default 3 rps, Notion's documented " + "public-API limit). Block is optional; when omitted no agent gets a " + "Notion MCP entry regardless of per-agent config."),
     quota: QuotaConfigSchema.optional().describe("Optional weekly/monthly USD spend budgets rendered in the session " + "greeting. Usage is read from ccusage at runtime; no network calls."),
     host_control: HostControlConfigSchema.default({}).describe("Host-control daemon configuration. Defaults to enabled=true since " + "RFC C Phase 2 (docs/rfcs/host-control-daemon.md). Omit the block " + "to accept defaults; set `enabled: false` only on legacy systemd-" + "mode installs (removal tracked as RFC C Phase 3)."),
     hostd: HostdConfigSchema.default({}).describe("hostd verb-level knobs (RFC admin-agent-config-edit). Distinct " + "from `host_control:` which governs whether the daemon runs at " + "all. Currently scopes the opt-in flag and rate cap for the new " + "`config_propose_edit` verb (PR 1a \u2014 disabled by default)."),
@@ -24090,7 +24109,7 @@ var init_schema = __esm(() => {
 });
 
 // ../src/config/paths.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { resolve as resolve2 } from "node:path";
 function home() {
   return process.env.HOME ?? "/root";
@@ -24109,9 +24128,9 @@ function resolveDualPath(pathStr) {
     const absolute = resolve2(h, rest);
     if (rest.startsWith(`${DEFAULT_STATE_DIR}/`)) {
       const frag = rest.slice(DEFAULT_STATE_DIR.length + 1);
-      if (!existsSync7(absolute)) {
+      if (!existsSync8(absolute)) {
         const legacy = resolve2(h, LEGACY_STATE_DIR, frag);
-        if (existsSync7(legacy)) {
+        if (existsSync8(legacy)) {
           warnLegacyStateOnce(legacy);
           return legacy;
         }
@@ -24136,14 +24155,14 @@ var init_overlay_schema = __esm(() => {
 });
 
 // ../src/config/overlay-loader.ts
-import { existsSync as existsSync8, readFileSync as readFileSync4, readdirSync, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync4, readdirSync, statSync as statSync2 } from "node:fs";
 import { resolve as resolve3 } from "node:path";
 function overlayDirFor(agentName3, subdir) {
   const base = resolveDualPath(`~/.switchroom/agents/${agentName3}/${subdir}`);
   return resolve3(base);
 }
 function listYamlFiles(dir) {
-  if (!existsSync8(dir))
+  if (!existsSync9(dir))
     return [];
   let entries;
   try {
@@ -24571,8 +24590,36 @@ var init_merge = __esm(() => {
   })(mergeAgentConfig ||= {});
 });
 
+// ../src/config/notion-workspace-acl.ts
+function validateNotionWorkspaceConfig(config) {
+  const issues = [];
+  const dbMap = config.notion_workspace?.databases ?? {};
+  const known = new Set(Object.keys(dbMap));
+  for (const [agentName3, agentRaw] of Object.entries(config.agents ?? {})) {
+    if (!agentRaw)
+      continue;
+    const dbFilter = agentRaw.notion_workspace?.databases;
+    if (dbFilter === undefined)
+      continue;
+    if (dbFilter.length === 0) {
+      issues.push(`  agents.${agentName3}.notion_workspace.databases is an empty ` + `list. Delete the entire notion_workspace block to remove Notion ` + `access, or list at least one database friendly name.`);
+      continue;
+    }
+    if (config.notion_workspace === undefined) {
+      issues.push(`  agents.${agentName3}.notion_workspace is set but the top-level ` + `notion_workspace block is missing. Configure the integration ` + `globally first (vault_key + databases map), then grant per-agent ` + `access.`);
+      continue;
+    }
+    for (const name of dbFilter) {
+      if (!known.has(name)) {
+        issues.push(`  agents.${agentName3}.notion_workspace.databases references ` + `unknown database "${name}". Add it to top-level ` + `notion_workspace.databases (run \`switchroom notion list-dbs\` ` + `to see the UUIDs the integration can read), or remove the ` + `reference.`);
+      }
+    }
+  }
+  return issues;
+}
+
 // ../src/config/loader.ts
-import { readFileSync as readFileSync5, existsSync as existsSync9 } from "node:fs";
+import { readFileSync as readFileSync5, existsSync as existsSync10 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { resolve as resolve4 } from "node:path";
 function formatZodErrors(error) {
@@ -24639,7 +24686,7 @@ function findConfigFile(startDir) {
     resolve4(userDir, "clerk.yml")
   ].filter(Boolean);
   for (const path of searchPaths) {
-    if (existsSync9(path)) {
+    if (existsSync10(path)) {
       return path;
     }
   }
@@ -24647,7 +24694,7 @@ function findConfigFile(startDir) {
 }
 function loadConfig(configPath) {
   const filePath = configPath ?? findConfigFile();
-  if (!existsSync9(filePath)) {
+  if (!existsSync10(filePath)) {
     throw new ConfigError(`Config file not found: ${filePath}`);
   }
   let raw;
@@ -24685,6 +24732,10 @@ function loadConfig(configPath) {
   }
   applyAgentOverlays(config);
   validateAllCronTopicAliases(config, filePath);
+  const notionIssues = validateNotionWorkspaceConfig(config);
+  if (notionIssues.length > 0) {
+    throw new ConfigError(`Invalid notion_workspace configuration in ${filePath}`, notionIssues);
+  }
   return config;
 }
 function validateAllCronTopicAliases(config, filePath) {
@@ -24751,7 +24802,7 @@ __export(exports_history, {
   _resetForTests: () => _resetForTests
 });
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync9 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function loadDatabaseClass() {
   if (DatabaseClass != null)
     return DatabaseClass;
@@ -24774,7 +24825,7 @@ function initHistory(stateDir, retentionDays = 30) {
     return;
   const Database = loadDatabaseClass();
   mkdirSync9(stateDir, { recursive: true, mode: 448 });
-  const path = join11(stateDir, "history.db");
+  const path = join12(stateDir, "history.db");
   db = new Database(path, { create: true });
   db.exec("PRAGMA journal_mode = WAL");
   db.exec("PRAGMA synchronous = NORMAL");
@@ -24964,11 +25015,11 @@ var DatabaseClass = null, DEFAULT_LIMIT = 10, MAX_LIMIT = 50, db = null;
 var init_history = () => {};
 
 // quota-check.ts
-import { readFileSync as readFileSync8, existsSync as existsSync12 } from "fs";
-import { join as join12 } from "path";
+import { readFileSync as readFileSync8, existsSync as existsSync13 } from "fs";
+import { join as join13 } from "path";
 function readOauthToken(claudeConfigDir) {
-  const tokenFile = join12(claudeConfigDir, ".oauth-token");
-  if (!existsSync12(tokenFile))
+  const tokenFile = join13(claudeConfigDir, ".oauth-token");
+  if (!existsSync13(tokenFile))
     return null;
   try {
     const raw = readFileSync8(tokenFile, "utf-8").trim();
@@ -25450,7 +25501,7 @@ function isDockerRuntime() {
 import * as net3 from "node:net";
 import * as fs from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function defaultBrokerSocketPath() {
   if (fs.existsSync(OPERATOR_SOCKET_PATH))
     return OPERATOR_SOCKET_PATH;
@@ -25459,7 +25510,7 @@ function defaultBrokerSocketPath() {
   return LEGACY_SOCKET_PATH;
 }
 function vaultTokenFilePath(agentSlug) {
-  return join16(homedir7(), ".switchroom", "agents", agentSlug, ".vault-token");
+  return join17(homedir7(), ".switchroom", "agents", agentSlug, ".vault-token");
 }
 function readVaultTokenFile(agentSlug) {
   const filePath = vaultTokenFilePath(agentSlug);
@@ -25614,8 +25665,8 @@ var DEFAULT_TIMEOUT_MS3 = 2000, LEGACY_SOCKET_PATH, OPERATOR_SOCKET_PATH;
 var init_client2 = __esm(() => {
   init_protocol2();
   init_peercred();
-  LEGACY_SOCKET_PATH = join16(homedir7(), ".switchroom", "vault-broker.sock");
-  OPERATOR_SOCKET_PATH = join16(homedir7(), ".switchroom", "broker-operator", "sock");
+  LEGACY_SOCKET_PATH = join17(homedir7(), ".switchroom", "vault-broker.sock");
+  OPERATOR_SOCKET_PATH = join17(homedir7(), ".switchroom", "broker-operator", "sock");
 });
 
 // ../src/drive/deep-links.ts
@@ -27804,15 +27855,15 @@ function renderAuthLine(state4, agentName3, now = Date.now()) {
 }
 
 // gateway/quota-cache.ts
-import { existsSync as existsSync23, readFileSync as readFileSync22, writeFileSync as writeFileSync13, mkdirSync as mkdirSync11 } from "fs";
-import { join as join20, dirname as dirname8 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync22, writeFileSync as writeFileSync13, mkdirSync as mkdirSync11 } from "fs";
+import { join as join21, dirname as dirname8 } from "path";
 function defaultCachePath() {
-  return process.env.SWITCHROOM_QUOTA_CACHE_PATH ?? join20(process.env.HOME ?? "/tmp", ".switchroom", "quota-cache.json");
+  return process.env.SWITCHROOM_QUOTA_CACHE_PATH ?? join21(process.env.HOME ?? "/tmp", ".switchroom", "quota-cache.json");
 }
 function readQuotaCache(opts = {}) {
   const path = opts.path ?? defaultCachePath();
   const now = opts.now ?? Date.now();
-  if (!existsSync23(path))
+  if (!existsSync24(path))
     return null;
   let entry;
   try {
@@ -27853,8 +27904,8 @@ var init_quota_cache = __esm(() => {
 });
 
 // gateway/boot-probes.ts
-import { readFileSync as readFileSync23, readdirSync as readdirSync4, existsSync as existsSync24 } from "fs";
-import { join as join21 } from "path";
+import { readFileSync as readFileSync23, readdirSync as readdirSync4, existsSync as existsSync25 } from "fs";
+import { join as join22 } from "path";
 import { execFile as execFileCb } from "child_process";
 import { promisify as promisify3 } from "util";
 async function withTimeout(label, p, timeoutMs = PROBE_TIMEOUT_MS) {
@@ -27896,8 +27947,8 @@ function mapPlan(billingType, hasExtra) {
 }
 async function probeAccount(agentDir) {
   return withTimeout("Account", (async () => {
-    const claudeDir = join21(agentDir, ".claude");
-    const claudeJsonPath = join21(claudeDir, ".claude.json");
+    const claudeDir = join22(agentDir, ".claude");
+    const claudeJsonPath = join22(claudeDir, ".claude.json");
     let cfg = {};
     try {
       const raw = readFileSync23(claudeJsonPath, "utf8");
@@ -27918,10 +27969,10 @@ async function probeAccount(agentDir) {
     let tokenStr = "";
     let status = "ok";
     for (const candidate of [
-      join21(claudeDir, ".oauth-token.meta.json"),
-      join21(claudeDir, "accounts", "default", ".oauth-token.meta.json")
+      join22(claudeDir, ".oauth-token.meta.json"),
+      join22(claudeDir, "accounts", "default", ".oauth-token.meta.json")
     ]) {
-      if (existsSync24(candidate)) {
+      if (existsSync25(candidate)) {
         try {
           const meta = JSON.parse(readFileSync23(candidate, "utf8"));
           if (meta.expiresAt) {
@@ -28098,7 +28149,7 @@ async function resolveTmuxSupervisorPid(agentName3, execFileImpl) {
     if (!cgroup)
       return null;
     const procsPath = `/sys/fs/cgroup${cgroup}/cgroup.procs`;
-    if (!existsSync24(procsPath))
+    if (!existsSync25(procsPath))
       return null;
     const pidsRaw = readFileSync23(procsPath, "utf-8");
     const pids = pidsRaw.split(`
@@ -28305,9 +28356,9 @@ async function probeQuota(claudeConfigDir, _agentDir, fetchImpl = fetch, opts =
       let claudeDirForProbe = null;
       for (const candidate of [
         claudeConfigDir,
-        join21(claudeConfigDir, "accounts", "default")
+        join22(claudeConfigDir, "accounts", "default")
       ]) {
-        if (existsSync24(join21(candidate, ".oauth-token"))) {
+        if (existsSync25(join22(candidate, ".oauth-token"))) {
           claudeDirForProbe = candidate;
           break;
         }
@@ -28478,7 +28529,7 @@ async function probeUds(label, socketPath, opts = {}) {
   }
   return withTimeout(label, (async () => {
     if (!opts.connectImpl) {
-      if (!existsSync24(socketPath)) {
+      if (!existsSync25(socketPath)) {
         return {
           status: "fail",
           label,
@@ -28542,7 +28593,7 @@ async function probeSkills(agentDir, opts = {}) {
   return withTimeout("Skills", (async () => {
     const fs2 = opts.fs ?? realSkillsFs;
     const max = opts.maxNamesShown ?? 3;
-    const skillsDir = join21(agentDir, ".claude", "skills");
+    const skillsDir = join22(agentDir, ".claude", "skills");
     if (!fs2.exists(skillsDir)) {
       return { status: "ok", label: "Skills", detail: "no skills dir" };
     }
@@ -28557,17 +28608,17 @@ async function probeSkills(agentDir, opts = {}) {
     }
     const dangling = [];
     for (const name of entries) {
-      const skillPath = join21(skillsDir, name);
+      const skillPath = join22(skillsDir, name);
       if (!fs2.exists(skillPath)) {
         dangling.push(name);
         continue;
       }
-      const skillMd = join21(skillPath, "SKILL.md");
+      const skillMd = join22(skillPath, "SKILL.md");
       if (!fs2.exists(skillMd) && !fs2.exists(skillPath + ".md")) {
         continue;
       }
     }
-    const overlayDir = opts.overlaySkillsDir ?? join21(agentDir, "skills.d");
+    const overlayDir = opts.overlaySkillsDir ?? join22(agentDir, "skills.d");
     const overlaySlugs = new Set;
     if (fs2.exists(overlayDir)) {
       let overlayEntries = [];
@@ -28622,16 +28673,16 @@ var init_boot_probes = __esm(() => {
       const { statSync: statSync7 } = __require("fs");
       return statSync7(p).mtimeMs;
     },
-    exists: (p) => existsSync24(p)
+    exists: (p) => existsSync25(p)
   };
   realSkillsFs = {
     readdir: (p) => readdirSync4(p),
-    exists: (p) => existsSync24(p)
+    exists: (p) => existsSync25(p)
   };
 });
 
 // gateway/boot-issue-cache.ts
-import { existsSync as existsSync25, readFileSync as readFileSync24, writeFileSync as writeFileSync14, mkdirSync as mkdirSync12, renameSync as renameSync9 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync24, writeFileSync as writeFileSync14, mkdirSync as mkdirSync12, renameSync as renameSync9 } from "fs";
 import { dirname as dirname9 } from "path";
 function fingerprintProbe(key, r) {
   if (r.status === "ok")
@@ -28711,7 +28762,7 @@ function diffProbes(probes, cache, opts = {}) {
   return out;
 }
 function loadCache(path, now = Date.now) {
-  if (!existsSync25(path))
+  if (!existsSync26(path))
     return { ...EMPTY_CACHE, probes: {} };
   let raw;
   try {
@@ -28782,7 +28833,7 @@ __export(exports_boot_card, {
   renderBootCard: () => renderBootCard,
   renderAccountRows: () => renderAuthLine
 });
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 function resolvePersonaName(slug, loadConfig3) {
   try {
     const config = loadConfig3 ? loadConfig3() : loadConfig();
@@ -28863,7 +28914,7 @@ function renderBootCard(opts) {
 `);
 }
 async function runAllProbes(opts) {
-  const claudeDir = join22(opts.agentDir, ".claude");
+  const claudeDir = join23(opts.agentDir, ".claude");
   const probes = {};
   const slug = opts.agentSlug ?? opts.agentName;
   await Promise.allSettled([
@@ -29107,10 +29158,10 @@ import { randomBytes as randomBytes5, scryptSync, createCipheriv, createDecipher
 import {
   readFileSync as readFileSync31,
   writeFileSync as writeFileSync19,
-  existsSync as existsSync32,
+  existsSync as existsSync33,
   renameSync as renameSync11,
   mkdirSync as mkdirSync18,
-  unlinkSync as unlinkSync12,
+  unlinkSync as unlinkSync13,
   lstatSync,
   realpathSync
 } from "node:fs";
@@ -29145,7 +29196,7 @@ function normalizeSecrets(raw) {
   return out;
 }
 function openVault(passphrase, vaultPath) {
-  if (!existsSync32(vaultPath)) {
+  if (!existsSync33(vaultPath)) {
     throw new VaultError(`Vault file not found: ${vaultPath}`);
   }
   let vaultFile;
@@ -29196,15 +29247,15 @@ var init_vault = __esm(() => {
 // ../src/vault/resolver.ts
 import {
   chmodSync as chmodSync4,
-  closeSync as closeSync7,
+  closeSync as closeSync8,
   mkdirSync as mkdirSync19,
   mkdtempSync as mkdtempSync2,
-  openSync as openSync7,
+  openSync as openSync8,
   rmSync as rmSync3,
   statSync as statSync11,
   writeSync as writeSync2
 } from "node:fs";
-import { join as join31 } from "node:path";
+import { join as join32 } from "node:path";
 import { tmpdir } from "node:os";
 import { constants as fsConstants } from "node:fs";
 function isVaultReference(value) {
@@ -29256,26 +29307,26 @@ function materializationRoot() {
     return cachedRoot;
   const xdg = process.env.XDG_RUNTIME_DIR;
   if (xdg) {
-    const base = join31(xdg, "switchroom", "vault");
+    const base = join32(xdg, "switchroom", "vault");
     mkdirSync19(base, { recursive: true, mode: 448 });
-    cachedRoot = mkdtempSync2(join31(base, "run-"));
+    cachedRoot = mkdtempSync2(join32(base, "run-"));
   } else {
-    cachedRoot = mkdtempSync2(join31(tmpdir(), "switchroom-vault-"));
+    cachedRoot = mkdtempSync2(join32(tmpdir(), "switchroom-vault-"));
   }
   chmodSync4(cachedRoot, 448);
   return cachedRoot;
 }
 function writeFileExclusive(filePath, content) {
   const buf = typeof content === "string" ? Buffer.from(content, "utf8") : content;
-  const fd = openSync7(filePath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
+  const fd = openSync8(filePath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
   try {
     writeSync2(fd, buf);
   } finally {
-    closeSync7(fd);
+    closeSync8(fd);
   }
 }
 function materializeFilesEntry(key, files) {
-  const dir = join31(materializationRoot(), key);
+  const dir = join32(materializationRoot(), key);
   if (materializedDirs.has(dir)) {
     try {
       rmSync3(dir, { recursive: true, force: true });
@@ -29291,7 +29342,7 @@ function materializeFilesEntry(key, files) {
     if (filename.includes("/") || filename.includes("\\") || filename === ".." || filename === "." || filename.includes("\x00")) {
       throw new Error(`Refusing to materialize vault file with unsafe name: ${filename}`);
     }
-    const filePath = join31(dir, filename);
+    const filePath = join32(dir, filename);
     const content = encoding === "base64" ? Buffer.from(value, "base64") : value;
     writeFileExclusive(filePath, content);
   }
@@ -29424,7 +29475,7 @@ __export(exports_materialize_bot_token, {
   materializeBotToken: () => materializeBotToken,
   BotTokenMaterializeError: () => BotTokenMaterializeError
 });
-import { existsSync as existsSync33 } from "node:fs";
+import { existsSync as existsSync34 } from "node:fs";
 function pickConfiguredToken(config, agentName3) {
   if (agentName3) {
     const agent = config.agents?.[agentName3];
@@ -29438,7 +29489,7 @@ function tryDirectVaultRead(ref, config, passphrase) {
   if (!passphrase)
     return null;
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (!existsSync33(vaultPath))
+  if (!existsSync34(vaultPath))
     return null;
   try {
     const secrets = openVault(passphrase, vaultPath);
@@ -29743,7 +29794,7 @@ __export(exports_tmux, {
   captureAgentPane: () => captureAgentPane
 });
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { mkdirSync as mkdirSync20, readdirSync as readdirSync6, statSync as statSync12, unlinkSync as unlinkSync13, writeFileSync as writeFileSync20 } from "node:fs";
+import { mkdirSync as mkdirSync20, readdirSync as readdirSync6, statSync as statSync12, unlinkSync as unlinkSync14, writeFileSync as writeFileSync20 } from "node:fs";
 import { resolve as resolve7 } from "node:path";
 function captureAgentPane(opts) {
   const { agentName: agentName3, agentDir, reason } = opts;
@@ -29857,7 +29908,7 @@ function pruneOldReports(dir, retain) {
   }).sort((a, b) => b.mtimeMs - a.mtimeMs);
   for (const stale of files.slice(retain)) {
     try {
-      unlinkSync13(stale.full);
+      unlinkSync14(stale.full);
     } catch {}
   }
 }
@@ -30453,14 +30504,14 @@ import {
   renameSync as renameSync12,
   realpathSync as realpathSync2,
   chmodSync as chmodSync5,
-  openSync as openSync8,
-  closeSync as closeSync8,
-  existsSync as existsSync34,
-  unlinkSync as unlinkSync14,
+  openSync as openSync9,
+  closeSync as closeSync9,
+  existsSync as existsSync35,
+  unlinkSync as unlinkSync15,
   appendFileSync as appendFileSync3
 } from "fs";
 import { homedir as homedir12 } from "os";
-import { join as join32, extname, sep as sep3, basename as basename7 } from "path";
+import { join as join33, extname, sep as sep3, basename as basename7 } from "path";
 
 // plugin-logger.ts
 import { appendFileSync, mkdirSync, renameSync, statSync, existsSync } from "fs";
@@ -37702,6 +37753,7 @@ function classifyInbound(text) {
 // silence-poke.ts
 var DEFAULT_THRESHOLDS = {
   ack: 1e4,
+  awarenessPing: 60000,
   soft: 75000,
   firm: 180000,
   fallback: 300000,
@@ -37728,6 +37780,7 @@ function startTurn(key, now) {
     lastThinkingAt: null,
     fallbackFired: false,
     ackPokeFired: false,
+    awarenessPingFired: false,
     lastPokeFiredAt: null,
     inFlightTools: new Map
   });
@@ -37845,6 +37898,42 @@ function tick(now) {
       });
       continue;
     }
+    if (!s.awarenessPingFired && s.lastOutboundAt == null && !s.subagentDispatchActive && silence >= thresholds.awarenessPing) {
+      s.awarenessPingFired = true;
+      const { chatId, threadId } = parseKey(key);
+      const recentThinking = s.lastThinkingAt != null && now - s.lastThinkingAt < 30000;
+      const fallbackKind = recentThinking ? "thinking" : "working";
+      const inFlightTools = Array.from(s.inFlightTools.values()).sort((a, b) => a.startedAt - b.startedAt).map((t) => ({
+        name: t.name,
+        label: t.label,
+        durationMs: now - t.startedAt
+      }));
+      activeDeps.emitMetric({
+        kind: "awareness_ping_sent",
+        key,
+        fallback_kind: fallbackKind,
+        silence_ms: silence
+      });
+      try {
+        const ret = activeDeps.onAwarenessPing({
+          key,
+          chatId,
+          threadId,
+          fallbackKind,
+          silenceMs: silence,
+          inFlightTools
+        });
+        if (ret != null && typeof ret.then === "function") {
+          ret.catch((err) => {
+            process.stderr.write(`silence-poke: awareness-ping handler rejected: ${err}
+`);
+          });
+        }
+      } catch (err) {
+        process.stderr.write(`silence-poke: awareness-ping handler threw: ${err}
+`);
+      }
+    }
     if (s.pokesFired === 0 && silence >= softThreshold) {
       s.pokeArmed = { level: "soft" };
       s.pokesFired = 1;
@@ -38167,6 +38256,45 @@ function recordSilentTurnEnd(args, deps) {
 }
 var recordUndeliveredTurnEnd = recordSilentTurnEnd;
 
+// ack-flag.ts
+import { closeSync, existsSync as existsSync6, openSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join7 } from "node:path";
+var ACK_SENT_MARKER = "ack-sent.flag";
+function markerPath() {
+  const dir = process.env.TELEGRAM_STATE_DIR;
+  if (!dir)
+    return null;
+  return join7(dir, ACK_SENT_MARKER);
+}
+function markAckSent() {
+  const path = markerPath();
+  if (path == null)
+    return;
+  if (existsSync6(path))
+    return;
+  try {
+    const fd = openSync(path, "w");
+    closeSync(fd);
+  } catch (err) {
+    process.stderr.write(`ack-flag: markAckSent failed path=${path}: ${err}
+`);
+  }
+}
+function clearAckSent() {
+  const path = markerPath();
+  if (path == null)
+    return;
+  try {
+    unlinkSync2(path);
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT")
+      return;
+    process.stderr.write(`ack-flag: clearAckSent failed path=${path}: ${err}
+`);
+  }
+}
+
 // final-answer-detect.ts
 var FINAL_ANSWER_MIN_CHARS = 200;
 function isFinalAnswerReply(input) {
@@ -38590,7 +38718,7 @@ async function gatewayStartupRetry(fn, opts = {}) {
 
 // gateway/quarantine.ts
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 var QUARANTINE_FILENAME = "quarantine.json";
 function writeQuarantineMarker(telegramStateDir, reason, detail, nowFn = Date.now) {
   mkdirSync6(telegramStateDir, { recursive: true, mode: 448 });
@@ -38600,7 +38728,7 @@ function writeQuarantineMarker(telegramStateDir, reason, detail, nowFn = Date.no
     ts: nowFn(),
     detail
   };
-  writeFileSync4(join7(telegramStateDir, QUARANTINE_FILENAME), JSON.stringify(marker) + `
+  writeFileSync4(join8(telegramStateDir, QUARANTINE_FILENAME), JSON.stringify(marker) + `
 `, "utf-8");
 }
 
@@ -39485,7 +39613,7 @@ import * as net2 from "node:net";
 init_protocol();
 import { homedir as homedir4 } from "node:os";
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 var DEFAULT_TIMEOUT_MS2 = 5000;
 function reviveDate2(v) {
   if (v == null)
@@ -39496,7 +39624,7 @@ function reviveDate2(v) {
   return Number.isNaN(d.getTime()) ? null : d;
 }
 function operatorSocketPath2(home = homedir4()) {
-  return join9(home, ".switchroom", "state", "auth-broker-operator", "sock");
+  return join10(home, ".switchroom", "state", "auth-broker-operator", "sock");
 }
 function resolveAuthBrokerSocketPath2(opts) {
   if (opts?.socket)
@@ -39828,16 +39956,16 @@ function createFleetFallbackGate(opts) {
 
 // gateway/auth-add-flow.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync7, rmSync as rmSync2 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync7, rmSync as rmSync2 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import { randomBytes as randomBytes2 } from "node:crypto";
 
 // ../src/auth/manager.ts
 import {
   readFileSync as readFileSync6,
   readdirSync as readdirSync2,
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   writeFileSync as writeFileSync5,
   mkdirSync as mkdirSync7,
   mkdtempSync,
@@ -39864,7 +39992,7 @@ function parseSetupTokenUrl(output) {
 }
 function readTokenFromCredentialsFile(credentialsFilePath) {
   try {
-    if (!existsSync10(credentialsFilePath))
+    if (!existsSync11(credentialsFilePath))
       return null;
     const raw = readFileSync6(credentialsFilePath, "utf-8");
     const parsed = JSON.parse(raw);
@@ -39883,7 +40011,7 @@ function readTokenFromCredentialsFile(credentialsFilePath) {
 var pendingAuthAddFlows = new Map;
 function pickScratchDir(label, home2 = homedir6()) {
   const suffix = randomBytes2(8).toString("hex");
-  return join10(home2, ".switchroom", "accounts", ".in-progress", `${label}-${suffix}`);
+  return join11(home2, ".switchroom", "accounts", ".in-progress", `${label}-${suffix}`);
 }
 function cleanScratchDir(scratchDir) {
   try {
@@ -39944,7 +40072,7 @@ async function startAccountAuthSession(label, opts = {}) {
 async function submitAccountAuthCode(flow, code, opts = {}) {
   const pollIntervalMs = opts.pollIntervalMs ?? 250;
   const pollTimeoutMs = opts.pollTimeoutMs ?? 120000;
-  const credentialsPath = join10(flow.scratchDir, ".credentials.json");
+  const credentialsPath = join11(flow.scratchDir, ".credentials.json");
   if (!flow.child.stdin || flow.child.stdin.destroyed) {
     cleanScratchDir(flow.scratchDir);
     throw new Error("claude setup-token process stdin is not writable (child may have exited)");
@@ -39954,7 +40082,7 @@ async function submitAccountAuthCode(flow, code, opts = {}) {
   const deadline = Date.now() + pollTimeoutMs;
   while (Date.now() < deadline) {
     await new Promise((r) => setTimeout(r, pollIntervalMs));
-    if (existsSync11(credentialsPath)) {
+    if (existsSync12(credentialsPath)) {
       const token = readTokenFromCredentialsFile(credentialsPath);
       if (token) {
         try {
@@ -41514,8 +41642,8 @@ function isTurnFlushSafetyEnabled(env = process.env) {
 }
 
 // handoff-continuity.ts
-import { readFileSync as readFileSync9, unlinkSync as unlinkSync2, existsSync as existsSync13, writeFileSync as writeFileSync6, renameSync as renameSync2 } from "node:fs";
-import { dirname as dirname7, join as join13 } from "node:path";
+import { readFileSync as readFileSync9, unlinkSync as unlinkSync3, existsSync as existsSync14, writeFileSync as writeFileSync6, renameSync as renameSync2 } from "node:fs";
+import { dirname as dirname7, join as join14 } from "node:path";
 var TOPIC_DISPLAY_MAX = 117;
 var HANDOFF_TOPIC_FILENAME = ".handoff-topic";
 var LAST_TURN_SUMMARY_FILENAME = ".last-turn-summary";
@@ -41526,8 +41654,8 @@ function resolveAgentDirFromEnv() {
   return dirname7(state3);
 }
 function readHandoffTopic(agentDir) {
-  const p = join13(agentDir, HANDOFF_TOPIC_FILENAME);
-  if (!existsSync13(p))
+  const p = join14(agentDir, HANDOFF_TOPIC_FILENAME);
+  if (!existsSync14(p))
     return null;
   let raw;
   try {
@@ -41545,8 +41673,8 @@ function readHandoffTopic(agentDir) {
   return topic;
 }
 function readLastTurnSummary(agentDir) {
-  const p = join13(agentDir, LAST_TURN_SUMMARY_FILENAME);
-  if (!existsSync13(p))
+  const p = join14(agentDir, LAST_TURN_SUMMARY_FILENAME);
+  if (!existsSync14(p))
     return null;
   let raw;
   try {
@@ -41565,16 +41693,16 @@ function readLastTurnSummary(agentDir) {
 }
 function consumeHandoffTopic(agentDir) {
   const primary = readHandoffTopic(agentDir);
-  const primaryPath = join13(agentDir, HANDOFF_TOPIC_FILENAME);
-  const fallbackPath = join13(agentDir, LAST_TURN_SUMMARY_FILENAME);
+  const primaryPath = join14(agentDir, HANDOFF_TOPIC_FILENAME);
+  const fallbackPath = join14(agentDir, LAST_TURN_SUMMARY_FILENAME);
   const removeFallback = () => {
     try {
-      unlinkSync2(fallbackPath);
+      unlinkSync3(fallbackPath);
     } catch {}
   };
   if (primary !== null) {
     try {
-      unlinkSync2(primaryPath);
+      unlinkSync3(primaryPath);
     } catch {}
     removeFallback();
     return primary;
@@ -41619,15 +41747,15 @@ function escapeMarkdownV2(s) {
 }
 
 // active-reactions.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, renameSync as renameSync3, existsSync as existsSync14, unlinkSync as unlinkSync3 } from "node:fs";
-import { join as join14 } from "node:path";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, renameSync as renameSync3, existsSync as existsSync15, unlinkSync as unlinkSync4 } from "node:fs";
+import { join as join15 } from "node:path";
 var ACTIVE_REACTIONS_FILENAME = ".active-reactions.json";
 function reactionsPath(agentDir) {
-  return join14(agentDir, ACTIVE_REACTIONS_FILENAME);
+  return join15(agentDir, ACTIVE_REACTIONS_FILENAME);
 }
 function readActiveReactions(agentDir) {
   const p = reactionsPath(agentDir);
-  if (!existsSync14(p))
+  if (!existsSync15(p))
     return [];
   let raw;
   try {
@@ -41657,7 +41785,7 @@ function writeActiveReactions(agentDir, reactions) {
   const p = reactionsPath(agentDir);
   if (reactions.length === 0) {
     try {
-      unlinkSync3(p);
+      unlinkSync4(p);
     } catch {}
     return;
   }
@@ -41682,20 +41810,20 @@ function removeActiveReaction(agentDir, chatId, messageId) {
 }
 function clearActiveReactions(agentDir) {
   try {
-    unlinkSync3(reactionsPath(agentDir));
+    unlinkSync4(reactionsPath(agentDir));
   } catch {}
 }
 
 // active-reactions.ts
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync8, renameSync as renameSync4, existsSync as existsSync15, unlinkSync as unlinkSync4 } from "node:fs";
-import { join as join15 } from "node:path";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync8, renameSync as renameSync4, existsSync as existsSync16, unlinkSync as unlinkSync5 } from "node:fs";
+import { join as join16 } from "node:path";
 var ACTIVE_REACTIONS_FILENAME2 = ".active-reactions.json";
 function reactionsPath2(agentDir) {
-  return join15(agentDir, ACTIVE_REACTIONS_FILENAME2);
+  return join16(agentDir, ACTIVE_REACTIONS_FILENAME2);
 }
 function readActiveReactions2(agentDir) {
   const p = reactionsPath2(agentDir);
-  if (!existsSync15(p))
+  if (!existsSync16(p))
     return [];
   let raw;
   try {
@@ -41723,7 +41851,7 @@ function readActiveReactions2(agentDir) {
 }
 function clearActiveReactions2(agentDir) {
   try {
-    unlinkSync4(reactionsPath2(agentDir));
+    unlinkSync5(reactionsPath2(agentDir));
   } catch {}
 }
 
@@ -42576,14 +42704,14 @@ async function approvalRecord(args, opts) {
 }
 
 // quota-check.ts
-import { readFileSync as readFileSync13, existsSync as existsSync17 } from "fs";
-import { join as join17 } from "path";
+import { readFileSync as readFileSync13, existsSync as existsSync18 } from "fs";
+import { join as join18 } from "path";
 var OAUTH_BETA2 = "oauth-2025-04-20";
 var DEFAULT_USER_AGENT2 = "claude-cli/1.0.0 (external, cli)";
 var DEFAULT_PROBE_MODEL2 = "claude-haiku-4-5-20251001";
 function readOauthToken2(claudeConfigDir) {
-  const tokenFile = join17(claudeConfigDir, ".oauth-token");
-  if (!existsSync17(tokenFile))
+  const tokenFile = join18(claudeConfigDir, ".oauth-token");
+  if (!existsSync18(tokenFile))
     return null;
   try {
     const raw = readFileSync13(tokenFile, "utf-8").trim();
@@ -43182,7 +43310,7 @@ init_schema();
 init_paths();
 init_overlay_loader();
 init_merge();
-import { readFileSync as readFileSync14, existsSync as existsSync18 } from "node:fs";
+import { readFileSync as readFileSync14, existsSync as existsSync19 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 import { resolve as resolve5 } from "node:path";
 
@@ -43258,7 +43386,7 @@ function findConfigFile2(startDir) {
     resolve5(userDir, "clerk.yml")
   ].filter(Boolean);
   for (const path of searchPaths) {
-    if (existsSync18(path)) {
+    if (existsSync19(path)) {
       return path;
     }
   }
@@ -43266,7 +43394,7 @@ function findConfigFile2(startDir) {
 }
 function loadConfig2(configPath) {
   const filePath = configPath ?? findConfigFile2();
-  if (!existsSync18(filePath)) {
+  if (!existsSync19(filePath)) {
     throw new ConfigError2(`Config file not found: ${filePath}`);
   }
   let raw;
@@ -43304,6 +43432,10 @@ function loadConfig2(configPath) {
   }
   applyAgentOverlays(config);
   validateAllCronTopicAliases2(config, filePath);
+  const notionIssues = validateNotionWorkspaceConfig(config);
+  if (notionIssues.length > 0) {
+    throw new ConfigError2(`Invalid notion_workspace configuration in ${filePath}`, notionIssues);
+  }
   return config;
 }
 function validateAllCronTopicAliases2(config, filePath) {
@@ -43695,9 +43827,9 @@ function resolveOutboundTopic(config, event) {
 }
 
 // ../src/agents/perf.ts
-import { existsSync as existsSync19, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync15 } from "node:fs";
 function readTurnUsages(jsonlPath, lastN) {
-  if (!existsSync19(jsonlPath))
+  if (!existsSync20(jsonlPath))
     return [];
   if (lastN <= 0)
     return [];
@@ -43841,7 +43973,7 @@ function nextCompactNotify(state3, ev) {
 }
 
 // gateway/hostd-dispatch.ts
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync21 } from "node:fs";
 import { randomBytes as randomBytes3 } from "node:crypto";
 
 // ../src/host-control/client.ts
@@ -44132,13 +44264,13 @@ function hostdSocketPath(agentName3) {
 function hostdWillBeUsed(agentName3) {
   if (!isHostdEnabled())
     return false;
-  return existsSync20(hostdSocketPath(agentName3));
+  return existsSync21(hostdSocketPath(agentName3));
 }
 async function tryHostdDispatch(agentName3, req) {
   if (!isHostdEnabled())
     return "not-configured";
   const sockPath = hostdSocketPath(agentName3);
-  if (!existsSync20(sockPath))
+  if (!existsSync21(sockPath))
     return "not-configured";
   try {
     return await hostdRequest({ socketPath: sockPath, timeoutMs: 5000 }, req);
@@ -44162,7 +44294,7 @@ async function hostdGetStatusOnce(agentName3, targetRequestId) {
   if (!isHostdEnabled())
     return "not-configured";
   const sockPath = hostdSocketPath(agentName3);
-  if (!existsSync20(sockPath))
+  if (!existsSync21(sockPath))
     return "not-configured";
   try {
     const resp = await hostdRequest({ socketPath: sockPath, timeoutMs: 3000 }, {
@@ -44183,7 +44315,7 @@ async function pollHostdStatus(agentName3, targetRequestId, opts) {
   if (!isHostdEnabled())
     return "not-configured";
   const sockPath = hostdSocketPath(agentName3);
-  if (!existsSync20(sockPath))
+  if (!existsSync21(sockPath))
     return "not-configured";
   const now = opts.now ?? Date.now;
   const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
@@ -44261,7 +44393,7 @@ function shouldSweepChatAtBoot(chatId) {
 }
 
 // gateway/ipc-server.ts
-import { renameSync as renameSync5, unlinkSync as unlinkSync5 } from "fs";
+import { renameSync as renameSync5, unlinkSync as unlinkSync6 } from "fs";
 var MAX_BUFFER_SIZE = 1024 * 1024;
 var VALID_OPERATOR_KINDS = new Set([
   "credentials-expired",
@@ -44379,7 +44511,7 @@ function createIpcServer(options) {
     renameSync5(socketPath, socketPath + ".bak");
   } catch {}
   try {
-    unlinkSync5(socketPath + ".bak");
+    unlinkSync6(socketPath + ".bak");
   } catch {}
   const clients = new Set;
   const agentIndex = new Map;
@@ -46442,7 +46574,7 @@ function escapeBody(s) {
 }
 
 // gateway/pid-file.ts
-import { writeFileSync as writeFileSync9, readFileSync as readFileSync16, unlinkSync as unlinkSync6, renameSync as renameSync6 } from "node:fs";
+import { writeFileSync as writeFileSync9, readFileSync as readFileSync16, unlinkSync as unlinkSync7, renameSync as renameSync6 } from "node:fs";
 function writePidFile(path, record) {
   const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync9(tmp, JSON.stringify(record), "utf-8");
@@ -46450,7 +46582,7 @@ function writePidFile(path, record) {
 }
 function clearPidFile(path) {
   try {
-    unlinkSync6(path);
+    unlinkSync7(path);
   } catch {}
 }
 
@@ -46667,7 +46799,7 @@ function safeCount(fn) {
 }
 
 // gateway/session-marker.ts
-import { writeFileSync as writeFileSync10, readFileSync as readFileSync18, renameSync as renameSync7, unlinkSync as unlinkSync7 } from "node:fs";
+import { writeFileSync as writeFileSync10, readFileSync as readFileSync18, renameSync as renameSync7, unlinkSync as unlinkSync8 } from "node:fs";
 function writeSessionMarker(path, marker) {
   const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync10(tmp, JSON.stringify(marker), "utf-8");
@@ -46697,7 +46829,7 @@ function shouldFireRestartBanner(input) {
 }
 
 // gateway/clean-shutdown-marker.ts
-import { writeFileSync as writeFileSync11, readFileSync as readFileSync19, renameSync as renameSync8, unlinkSync as unlinkSync8 } from "node:fs";
+import { writeFileSync as writeFileSync11, readFileSync as readFileSync19, renameSync as renameSync8, unlinkSync as unlinkSync9 } from "node:fs";
 var DEFAULT_MAX_AGE_MS = 60000;
 function writeCleanShutdownMarker(path, marker) {
   const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
@@ -46721,7 +46853,7 @@ function readCleanShutdownMarker(path) {
 }
 function clearCleanShutdownMarker(path) {
   try {
-    unlinkSync8(path);
+    unlinkSync9(path);
   } catch {}
 }
 function shouldSuppressRecoveryBanner(marker, now, maxAgeMs = DEFAULT_MAX_AGE_MS) {
@@ -47501,16 +47633,16 @@ function classifyAdminGate(text, myAgentName) {
 
 // subagent-watcher.ts
 import {
-  existsSync as existsSync22,
-  openSync as openSync2,
+  existsSync as existsSync23,
+  openSync as openSync3,
   readSync,
   statSync as statSync6,
-  closeSync as closeSync2,
+  closeSync as closeSync3,
   watch,
   readdirSync as readdirSync3,
   readFileSync as readFileSync21
 } from "fs";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 
 // operator-events.ts
 var DEFAULT_OPERATOR_EVENT_COOLDOWN_MS2 = 5 * 60000;
@@ -47752,29 +47884,29 @@ function bumpSubagentActivity(db2, args) {
 
 // gateway/turn-active-marker.ts
 import {
-  closeSync,
-  existsSync as existsSync21,
+  closeSync as closeSync2,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync10,
-  openSync,
+  openSync as openSync2,
   readFileSync as readFileSync20,
   statSync as statSync5,
-  unlinkSync as unlinkSync9,
+  unlinkSync as unlinkSync10,
   utimesSync,
   writeFileSync as writeFileSync12
 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 var TURN_ACTIVE_MARKER_FILE = "turn-active.json";
 function touchTurnActiveMarker(stateDir) {
-  const path = join18(stateDir, TURN_ACTIVE_MARKER_FILE);
-  if (!existsSync21(path))
+  const path = join19(stateDir, TURN_ACTIVE_MARKER_FILE);
+  if (!existsSync22(path))
     return;
   const now = new Date;
   try {
     utimesSync(path, now, now);
   } catch {
     try {
-      const fd = openSync(path, "r+");
-      closeSync(fd);
+      const fd = openSync2(path, "r+");
+      closeSync2(fd);
     } catch {}
   }
 }
@@ -47988,11 +48120,11 @@ function startSubagentWatcher(config) {
     clearTimeout(ref.ref);
   });
   const fs2 = config.fs ?? {
-    existsSync: existsSync22,
+    existsSync: existsSync23,
     readdirSync: readdirSync3,
     statSync: statSync6,
-    openSync: openSync2,
-    closeSync: closeSync2,
+    openSync: openSync3,
+    closeSync: closeSync3,
     readSync,
     watch
   };
@@ -48222,8 +48354,8 @@ function startSubagentWatcher(config) {
   function rescanSubagentDirs() {
     if (stopped)
       return;
-    const claudeHome = join19(agentDir, ".claude");
-    const projectsRoot = join19(claudeHome, "projects");
+    const claudeHome = join20(agentDir, ".claude");
+    const projectsRoot = join20(claudeHome, "projects");
     if (!fs2.existsSync(projectsRoot))
       return;
     let projectDirs;
@@ -48240,7 +48372,7 @@ function startSubagentWatcher(config) {
         }
         continue;
       }
-      const projectPath = join19(projectsRoot, pDir);
+      const projectPath = join20(projectsRoot, pDir);
       let sessionDirs;
       try {
         sessionDirs = fs2.readdirSync(projectPath);
@@ -48250,7 +48382,7 @@ function startSubagentWatcher(config) {
       for (const sDir of sessionDirs) {
         if (sDir.endsWith(".jsonl"))
           continue;
-        const subagentsPath = join19(projectPath, sDir, "subagents");
+        const subagentsPath = join20(projectPath, sDir, "subagents");
         if (!fs2.existsSync(subagentsPath))
           continue;
         if (!dirWatchers.has(subagentsPath)) {
@@ -48258,7 +48390,7 @@ function startSubagentWatcher(config) {
             const w = fs2.watch(subagentsPath, (_event, filename) => {
               if (!filename || !filename.toString().startsWith("agent-") || !filename.toString().endsWith(".jsonl"))
                 return;
-              const filePath = join19(subagentsPath, filename.toString());
+              const filePath = join20(subagentsPath, filename.toString());
               if (!knownFiles.has(filePath)) {
                 scanSubagentsDir(subagentsPath);
               }
@@ -48283,7 +48415,7 @@ function startSubagentWatcher(config) {
     for (const e of entries) {
       if (!e.startsWith("agent-") || !e.endsWith(".jsonl"))
         continue;
-      const filePath = join19(subagentsPath, e);
+      const filePath = join20(subagentsPath, e);
       if (knownFiles.has(filePath))
         continue;
       const agentId = e.slice("agent-".length, -".jsonl".length);
@@ -48400,15 +48532,15 @@ function determineRestartReason(opts) {
 init_boot_card();
 
 // gateway/update-announce.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync13, openSync as openSync3, closeSync as closeSync3, readFileSync as readFileSync25 } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync13, openSync as openSync4, closeSync as closeSync4, readFileSync as readFileSync25 } from "node:fs";
+import { join as join25 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 
 // ../src/host-control/audit-reader.ts
 import { homedir as homedir9 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 function defaultAuditLogPath(home2 = homedir9()) {
-  return join23(home2, ".switchroom", "host-control-audit.log");
+  return join24(home2, ".switchroom", "host-control-audit.log");
 }
 function parseAuditLine(line) {
   const trimmed = line.trim();
@@ -48514,7 +48646,7 @@ function readAndFilter(raw, filters, limit) {
 var DEFAULT_LOOKBACK_MS = 10 * 60 * 1000;
 function readLastTerminalUpdateAudit(opts = {}) {
   const path = opts.auditLogPath ?? defaultAuditLogPath();
-  const exists = opts.exists ?? existsSync26;
+  const exists = opts.exists ?? existsSync27;
   const readFile = opts.readFile ?? ((p) => readFileSync25(p, "utf-8"));
   if (!exists(path))
     return null;
@@ -48576,18 +48708,18 @@ function renderUpdateOutcomeLine(entry) {
 `);
 }
 function claimUpdateAnnouncement(requestId, opts = {}) {
-  const stateDir = opts.stateDir ?? process.env.TELEGRAM_STATE_DIR ?? join24(homedir10(), ".switchroom");
-  const dir = join24(stateDir, "update-announced");
+  const stateDir = opts.stateDir ?? process.env.TELEGRAM_STATE_DIR ?? join25(homedir10(), ".switchroom");
+  const dir = join25(stateDir, "update-announced");
   try {
     mkdirSync13(dir, { recursive: true });
   } catch {
     return false;
   }
   const safeId = requestId.replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 200);
-  const path = join24(dir, safeId);
+  const path = join25(dir, safeId);
   try {
-    const fd = openSync3(path, "wx");
-    closeSync3(fd);
+    const fd = openSync4(path, "wx");
+    closeSync4(fd);
     return true;
   } catch {
     return false;
@@ -48804,24 +48936,24 @@ function createIssuesCardHandle(opts) {
 }
 
 // issues-watcher.ts
-import { existsSync as existsSync28, statSync as statSync8 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync29, statSync as statSync8 } from "node:fs";
+import { join as join27 } from "node:path";
 
 // ../src/issues/store.ts
 import {
-  closeSync as closeSync4,
-  existsSync as existsSync27,
+  closeSync as closeSync5,
+  existsSync as existsSync28,
   mkdirSync as mkdirSync14,
-  openSync as openSync4,
+  openSync as openSync5,
   readdirSync as readdirSync5,
   readFileSync as readFileSync27,
   renameSync as renameSync10,
   statSync as statSync7,
-  unlinkSync as unlinkSync10,
+  unlinkSync as unlinkSync11,
   writeFileSync as writeFileSync16,
   writeSync
 } from "node:fs";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 import { randomBytes as randomBytes4 } from "node:crypto";
 import { execSync } from "node:child_process";
 
@@ -48837,8 +48969,8 @@ var SEVERITY_RANK2 = {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path = join25(stateDir, ISSUES_FILE);
-  if (!existsSync27(path))
+  const path = join26(stateDir, ISSUES_FILE);
+  if (!existsSync28(path))
     return [];
   let raw;
   try {
@@ -48874,7 +49006,7 @@ function list(stateDir, opts = {}) {
   });
 }
 function resolve6(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync27(join25(stateDir, ISSUES_FILE)))
+  if (!existsSync28(join26(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -48892,7 +49024,7 @@ function resolve6(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function writeAll(stateDir, events) {
-  const path = join25(stateDir, ISSUES_FILE);
+  const path = join26(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path}.tmp-${process.pid}-${randomBytes4(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -48914,11 +49046,11 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath2 = join25(stateDir, entry);
+    const tmpPath2 = join26(stateDir, entry);
     try {
       const stat = statSync7(tmpPath2);
       if (stat.mtimeMs < cutoff) {
-        unlinkSync10(tmpPath2);
+        unlinkSync11(tmpPath2);
       }
     } catch {}
   }
@@ -48926,12 +49058,12 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join25(stateDir, ISSUES_LOCK);
+  const lockPath = join26(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
     try {
-      fd = openSync4(lockPath, "wx");
+      fd = openSync5(lockPath, "wx");
       try {
         writeSync(fd, String(process.pid));
       } catch {}
@@ -48951,10 +49083,10 @@ function withLock(stateDir, fn) {
     return fn();
   } finally {
     try {
-      closeSync4(fd);
+      closeSync5(fd);
     } catch {}
     try {
-      unlinkSync10(lockPath);
+      unlinkSync11(lockPath);
     } catch {}
   }
 }
@@ -48968,13 +49100,13 @@ function tryStealStaleLock(lockPath) {
   const pid = Number(pidStr);
   if (!Number.isFinite(pid) || pid <= 0) {
     try {
-      unlinkSync10(lockPath);
+      unlinkSync11(lockPath);
     } catch {}
     return true;
   }
   if (pid === process.pid) {
     try {
-      unlinkSync10(lockPath);
+      unlinkSync11(lockPath);
     } catch {}
     return true;
   }
@@ -48989,7 +49121,7 @@ function tryStealStaleLock(lockPath) {
       return false;
   }
   try {
-    unlinkSync10(lockPath);
+    unlinkSync11(lockPath);
   } catch {}
   return true;
 }
@@ -49011,7 +49143,7 @@ function isIssueEvent(v) {
 // issues-watcher.ts
 var DEFAULT_POLL_INTERVAL_MS2 = 2000;
 function startIssuesWatcher(opts) {
-  const path = join26(opts.stateDir, ISSUES_FILE);
+  const path = join27(opts.stateDir, ISSUES_FILE);
   const log = opts.log ?? (() => {});
   const intervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS2;
   const setIntervalFn = opts.setInterval ?? setInterval;
@@ -49059,7 +49191,7 @@ function startIssuesWatcher(opts) {
   };
 }
 function defaultSignatureProvider(path) {
-  if (!existsSync28(path))
+  if (!existsSync29(path))
     return null;
   try {
     const stat = statSync8(path);
@@ -49299,8 +49431,8 @@ function skillBasenameFromPath2(input) {
 }
 
 // credits-watch.ts
-import { readFileSync as readFileSync28, writeFileSync as writeFileSync17, existsSync as existsSync29, mkdirSync as mkdirSync15 } from "fs";
-import { join as join27 } from "path";
+import { readFileSync as readFileSync28, writeFileSync as writeFileSync17, existsSync as existsSync30, mkdirSync as mkdirSync15 } from "fs";
+import { join as join28 } from "path";
 var STATE_FILE = "credits-watch.json";
 var FATAL_REASONS = new Set([
   "out_of_credits",
@@ -49312,8 +49444,8 @@ function emptyCreditState() {
   return { lastNotifiedReason: null, lastNotifiedAt: 0 };
 }
 function readClaudeJsonOverage(claudeConfigDir) {
-  const path = join27(claudeConfigDir, ".claude.json");
-  if (!existsSync29(path))
+  const path = join28(claudeConfigDir, ".claude.json");
+  if (!existsSync30(path))
     return null;
   let raw;
   try {
@@ -49397,8 +49529,8 @@ function escapeHtml10(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function loadCreditState(stateDir) {
-  const path = join27(stateDir, STATE_FILE);
-  if (!existsSync29(path))
+  const path = join28(stateDir, STATE_FILE);
+  if (!existsSync30(path))
     return emptyCreditState();
   try {
     const raw = readFileSync28(path, "utf-8");
@@ -49414,54 +49546,54 @@ function loadCreditState(stateDir) {
 }
 function saveCreditState(stateDir, state4) {
   mkdirSync15(stateDir, { recursive: true });
-  const path = join27(stateDir, STATE_FILE);
+  const path = join28(stateDir, STATE_FILE);
   writeFileSync17(path, JSON.stringify(state4, null, 2) + `
 `, { mode: 384 });
 }
 
 // gateway/turn-active-marker.ts
 import {
-  closeSync as closeSync5,
-  existsSync as existsSync30,
+  closeSync as closeSync6,
+  existsSync as existsSync31,
   mkdirSync as mkdirSync16,
-  openSync as openSync5,
+  openSync as openSync6,
   readFileSync as readFileSync29,
   statSync as statSync9,
-  unlinkSync as unlinkSync11,
+  unlinkSync as unlinkSync12,
   utimesSync as utimesSync2,
   writeFileSync as writeFileSync18
 } from "node:fs";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 var TURN_ACTIVE_MARKER_FILE2 = "turn-active.json";
 function writeTurnActiveMarker(stateDir, marker) {
   try {
     mkdirSync16(stateDir, { recursive: true });
-    writeFileSync18(join28(stateDir, TURN_ACTIVE_MARKER_FILE2), JSON.stringify(marker, null, 2) + `
+    writeFileSync18(join29(stateDir, TURN_ACTIVE_MARKER_FILE2), JSON.stringify(marker, null, 2) + `
 `, { mode: 384 });
   } catch {}
 }
 function touchTurnActiveMarker2(stateDir) {
-  const path = join28(stateDir, TURN_ACTIVE_MARKER_FILE2);
-  if (!existsSync30(path))
+  const path = join29(stateDir, TURN_ACTIVE_MARKER_FILE2);
+  if (!existsSync31(path))
     return;
   const now = new Date;
   try {
     utimesSync2(path, now, now);
   } catch {
     try {
-      const fd = openSync5(path, "r+");
-      closeSync5(fd);
+      const fd = openSync6(path, "r+");
+      closeSync6(fd);
     } catch {}
   }
 }
 function removeTurnActiveMarker(stateDir) {
   try {
-    unlinkSync11(join28(stateDir, TURN_ACTIVE_MARKER_FILE2));
+    unlinkSync12(join29(stateDir, TURN_ACTIVE_MARKER_FILE2));
   } catch {}
 }
 function sweepStaleTurnActiveMarker(stateDir, opts) {
-  const path = join28(stateDir, TURN_ACTIVE_MARKER_FILE2);
-  if (!existsSync30(path))
+  const path = join29(stateDir, TURN_ACTIVE_MARKER_FILE2);
+  if (!existsSync31(path))
     return false;
   const now = opts.now ?? Date.now();
   try {
@@ -49475,7 +49607,7 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
     try {
       payload = readFileSync29(path, "utf8");
     } catch {}
-    unlinkSync11(path);
+    unlinkSync12(path);
     if (opts.onRemove) {
       try {
         opts.onRemove({
@@ -49492,10 +49624,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.13.54";
-var COMMIT_SHA = "95784728";
-var COMMIT_DATE = "2026-05-27T05:55:02Z";
-var LATEST_PR = 1894;
+var VERSION = "0.13.56";
+var COMMIT_SHA = "821a114e";
+var COMMIT_DATE = "2026-05-27T20:20:37Z";
+var LATEST_PR = 1923;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -49569,11 +49701,11 @@ init_peercred();
 import * as net4 from "node:net";
 import * as fs2 from "node:fs";
 import { homedir as homedir11 } from "node:os";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 var DEFAULT_TIMEOUT_MS4 = 2000;
 var UNLOCK_TIMEOUT_MS = 30000;
-var LEGACY_SOCKET_PATH2 = join29(homedir11(), ".switchroom", "vault-broker.sock");
-var OPERATOR_SOCKET_PATH2 = join29(homedir11(), ".switchroom", "broker-operator", "sock");
+var LEGACY_SOCKET_PATH2 = join30(homedir11(), ".switchroom", "vault-broker.sock");
+var OPERATOR_SOCKET_PATH2 = join30(homedir11(), ".switchroom", "broker-operator", "sock");
 function defaultBrokerSocketPath2() {
   if (fs2.existsSync(OPERATOR_SOCKET_PATH2))
     return OPERATOR_SOCKET_PATH2;
@@ -49796,7 +49928,7 @@ function resolveVaultApprovalPosture(broker) {
 
 // registry/turns-schema.ts
 import { chmodSync as chmodSync3, mkdirSync as mkdirSync17 } from "fs";
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 var DatabaseClass2 = null;
 function loadDatabaseClass2() {
   if (DatabaseClass2 != null)
@@ -49855,9 +49987,9 @@ function applySchema(db2) {
 }
 function openTurnsDb(agentDir) {
   const Database = loadDatabaseClass2();
-  const dir = join30(agentDir, "telegram");
+  const dir = join31(agentDir, "telegram");
   mkdirSync17(dir, { recursive: true, mode: 448 });
-  const path = join30(dir, "registry.db");
+  const path = join31(dir, "registry.db");
   const db2 = new Database(path, { create: true });
   applySchema(db2);
   try {
@@ -49998,11 +50130,11 @@ installGlobalErrorHandlers();
 process.on("beforeExit", () => {
   shutdownAnalytics();
 });
-var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join32(homedir12(), ".claude", "channels", "telegram");
-var ACCESS_FILE = join32(STATE_DIR, "access.json");
-var APPROVED_DIR = join32(STATE_DIR, "approved");
-var ENV_FILE = join32(STATE_DIR, ".env");
-var INBOX_DIR = join32(STATE_DIR, "inbox");
+var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join33(homedir12(), ".claude", "channels", "telegram");
+var ACCESS_FILE = join33(STATE_DIR, "access.json");
+var APPROVED_DIR = join33(STATE_DIR, "approved");
+var ENV_FILE = join33(STATE_DIR, ".env");
+var INBOX_DIR = join33(STATE_DIR, "inbox");
 function triggerSelfRestart(targetAgent, reason, delayMs = 300) {
   const isDocker = process.env.SWITCHROOM_RUNTIME === "docker";
   const selfAgent = process.env.SWITCHROOM_AGENT_NAME;
@@ -50193,7 +50325,7 @@ function assertSendable(f) {
   } catch {
     throw new Error(`refusing to send file \u2014 cannot resolve real path: ${f}`);
   }
-  const inbox = join32(stateReal, "inbox");
+  const inbox = join33(stateReal, "inbox");
   if (real.startsWith(stateReal + sep3) && !real.startsWith(inbox + sep3)) {
     throw new Error(`refusing to send channel state: ${f}`);
   }
@@ -50299,7 +50431,7 @@ var HISTORY_ENABLED = HISTORY_ACCESS.historyEnabled !== false;
 if (HISTORY_ENABLED) {
   try {
     initHistory(STATE_DIR, HISTORY_ACCESS.historyRetentionDays ?? 30);
-    process.stderr.write(`telegram gateway: history capture enabled at ${join32(STATE_DIR, "history.db")}
+    process.stderr.write(`telegram gateway: history capture enabled at ${join33(STATE_DIR, "history.db")}
 `);
   } catch (err) {
     process.stderr.write(`telegram gateway: history init failed (${err.message}) \u2014 capture disabled
@@ -50316,10 +50448,10 @@ try {
     process.stderr.write(`telegram gateway: turn-registry boot-reaper stamped ${reaped} orphaned turn(s) as ended_via='restart'
 `);
   } else {
-    process.stderr.write(`telegram gateway: turn-registry initialized at ${join32(agentDir, "telegram", "registry.db")}
+    process.stderr.write(`telegram gateway: turn-registry initialized at ${join33(agentDir, "telegram", "registry.db")}
 `);
   }
-  const pendingEnvPath = join32(agentDir, ".pending-turn.env");
+  const pendingEnvPath = join33(agentDir, ".pending-turn.env");
   try {
     const pending2 = findMostRecentInterruptedTurn(turnsDb);
     if (pending2 != null) {
@@ -50339,7 +50471,7 @@ try {
       renameSync12(pendingEnvTmp, pendingEnvPath);
       process.stderr.write(`telegram gateway: pending-turn env written to ${pendingEnvPath} turnKey=${pending2.turn_key} endedVia=${pending2.ended_via ?? "open"}
 `);
-    } else if (existsSync34(pendingEnvPath)) {
+    } else if (existsSync35(pendingEnvPath)) {
       rmSync4(pendingEnvPath, { force: true });
       process.stderr.write(`telegram gateway: pending-turn env cleared (clean previous shutdown)
 `);
@@ -50393,7 +50525,7 @@ function checkApprovals() {
     return;
   }
   for (const senderId of files) {
-    const file = join32(APPROVED_DIR, senderId);
+    const file = join33(APPROVED_DIR, senderId);
     bot.api.sendMessage(senderId, "Paired! Say hi to Claude.").then(() => rmSync4(file, { force: true }), (err) => {
       process.stderr.write(`telegram gateway: failed to send approval confirm: ${err}
 `);
@@ -51270,11 +51402,11 @@ var unpinProgressCardForChat = null;
 var getPinnedProgressCardMessageId = null;
 var completeProgressCardTurn = null;
 var subagentWatcher = null;
-var SOCKET_PATH = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join32(STATE_DIR, "gateway.sock");
+var SOCKET_PATH = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join33(STATE_DIR, "gateway.sock");
 mkdirSync21(STATE_DIR, { recursive: true, mode: 448 });
-var GATEWAY_PID_PATH = process.env.SWITCHROOM_GATEWAY_PID_FILE ?? join32(STATE_DIR, "gateway.pid.json");
-var GATEWAY_SESSION_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_SESSION_MARKER ?? join32(STATE_DIR, "gateway-session.json");
-var GATEWAY_CLEAN_SHUTDOWN_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_CLEAN_SHUTDOWN_MARKER ?? join32(STATE_DIR, "clean-shutdown.json");
+var GATEWAY_PID_PATH = process.env.SWITCHROOM_GATEWAY_PID_FILE ?? join33(STATE_DIR, "gateway.pid.json");
+var GATEWAY_SESSION_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_SESSION_MARKER ?? join33(STATE_DIR, "gateway-session.json");
+var GATEWAY_CLEAN_SHUTDOWN_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_CLEAN_SHUTDOWN_MARKER ?? join33(STATE_DIR, "clean-shutdown.json");
 var GATEWAY_STARTED_AT_MS = Date.now();
 var BOOT_CARD_ENABLED = process.env.SWITCHROOM_BOOT_CARD !== "false";
 var activeBootCard = null;
@@ -51303,7 +51435,7 @@ function ensureIssuesCard(chatId, threadId) {
     bot: botApi,
     log: (msg) => process.stderr.write(`telegram gateway: ${msg}
 `),
-    persistPath: join32(stateDir, "issues-card.json")
+    persistPath: join33(stateDir, "issues-card.json")
   });
   activeIssuesWatcher = startIssuesWatcher({
     stateDir,
@@ -51347,6 +51479,21 @@ startTimer({
   emitMetric: (event) => {
     emitRuntimeMetric(event);
   },
+  onAwarenessPing: async (ctx) => {
+    if (activeTurnStartedAt.get(ctx.key) == null && currentTurn == null) {
+      return;
+    }
+    const text = formatFrameworkFallbackText(ctx.fallbackKind, ctx.silenceMs, ctx.inFlightTools);
+    try {
+      await robustApiCall(() => bot.api.sendMessage(ctx.chatId, text, {
+        ...ctx.threadId != null ? { message_thread_id: ctx.threadId } : {},
+        disable_notification: true
+      }), { chat_id: ctx.chatId, ...ctx.threadId != null ? { threadId: ctx.threadId } : {} });
+    } catch (err) {
+      process.stderr.write(`silence-poke awareness-ping sendMessage failed chat=${ctx.chatId} thread=${ctx.threadId}: ${err}
+`);
+    }
+  },
   onFrameworkFallback: async (ctx) => {
     if (activeTurnStartedAt.get(ctx.key) == null && currentTurn == null) {
       process.stderr.write(`telegram gateway: silence-poke framework-fallback late-fire skipped \u2014 ` + `turn ended cleanly during silence window chat=${ctx.chatId} thread=${ctx.threadId ?? "-"} silence_ms=${ctx.silenceMs}
@@ -51395,7 +51542,6 @@ startTimer({
         longest_silent_gap_ms: outboundMetrics.longestOutboundGapMs,
         ended_via: "framework_fallback"
       });
-      clear(fbKey);
     }
     if (turnsDb != null && turnMatchesFallback && wedgedTurn?.registryKey != null) {
       const _turnKey = wedgedTurn.registryKey;
@@ -51458,13 +51604,13 @@ startTimer2({
   }
 });
 var inboundSpool = STATIC ? undefined : createInboundSpool({
-  path: join32(STATE_DIR, "inbound-spool.jsonl"),
+  path: join33(STATE_DIR, "inbound-spool.jsonl"),
   fs: {
     appendFileSync: (p, d) => appendFileSync3(p, d),
     readFileSync: (p) => readFileSync32(p, "utf8"),
     writeFileSync: (p, d) => writeFileSync21(p, d),
     renameSync: (a, b) => renameSync12(a, b),
-    existsSync: (p) => existsSync34(p),
+    existsSync: (p) => existsSync35(p),
     statSizeSync: (p) => statSync13(p).size
   }
 });
@@ -52277,6 +52423,12 @@ ${url}`;
   });
   noteOutbound(statusKey(chat_id, threadId), Date.now());
   noteOutbound2(statusKey(chat_id, threadId), Date.now());
+  try {
+    markAckSent();
+  } catch (err) {
+    process.stderr.write(`telegram gateway: markAckSent failed: ${err}
+`);
+  }
   if (isFinalAnswerReply({ text: rawText, disableNotification })) {
     clearSilentEndState(statusKey(chat_id, threadId));
   }
@@ -52604,6 +52756,12 @@ async function executeStreamReply(args) {
       const sKey = statusKey(streamChatId, streamThreadId);
       noteOutbound(sKey, Date.now());
       noteOutbound2(sKey, Date.now());
+      try {
+        markAckSent();
+      } catch (err) {
+        process.stderr.write(`telegram gateway: markAckSent (stream_reply) failed: ${err}
+`);
+      }
       if (isFinalAnswerReply({
         text: args.text ?? "",
         disableNotification: args.disable_notification === true,
@@ -52954,10 +53112,10 @@ async function executeSendGif(rawArgs) {
   };
 }
 async function publishToTelegraph(text, shortName, authorName) {
-  const accountPath = join32(STATE_DIR, "telegraph-account.json");
+  const accountPath = join33(STATE_DIR, "telegraph-account.json");
   let account = null;
   try {
-    if (existsSync34(accountPath)) {
+    if (existsSync35(accountPath)) {
       const raw = readFileSync32(accountPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed.shortName && parsed.accessToken) {
@@ -53450,6 +53608,7 @@ function handleSessionEvent(ev) {
       if (ev.chatId) {
         const enqThreadId = ev.threadId != null ? Number(ev.threadId) : undefined;
         clearPending(statusKey(ev.chatId, enqThreadId), "handback");
+        clearAckSent();
       }
       if (ev.chatId) {
         const prior = currentTurn;
@@ -54907,7 +55066,7 @@ function restartMarkerPath() {
   const agentDir = resolveAgentDirFromEnv();
   if (!agentDir)
     return null;
-  return join32(agentDir, "restart-pending.json");
+  return join33(agentDir, "restart-pending.json");
 }
 function writeRestartMarker(marker) {
   const p = restartMarkerPath();
@@ -55031,7 +55190,7 @@ var _dockerReachable;
 function isDockerReachable() {
   if (_dockerReachable !== undefined)
     return _dockerReachable;
-  if (!existsSync34("/var/run/docker.sock")) {
+  if (!existsSync35("/var/run/docker.sock")) {
     _dockerReachable = false;
     return _dockerReachable;
   }
@@ -55048,11 +55207,11 @@ function _resetDockerReachableCache() {
 }
 function spawnSwitchroomDetached(args, onFailure) {
   const fullArgs = SWITCHROOM_CONFIG ? ["--config", SWITCHROOM_CONFIG, ...args] : args;
-  const logPath = join32(STATE_DIR, "detached-spawn.log");
+  const logPath = join33(STATE_DIR, "detached-spawn.log");
   let outFd = null;
   try {
     mkdirSync21(STATE_DIR, { recursive: true });
-    outFd = openSync8(logPath, "a");
+    outFd = openSync9(logPath, "a");
     writeFileSync21(logPath, `
 [${new Date().toISOString()}] spawn ${SWITCHROOM_CLI} ${fullArgs.join(" ")}
 `, { flag: "a" });
@@ -55067,7 +55226,7 @@ function spawnSwitchroomDetached(args, onFailure) {
   });
   if (outFd != null) {
     try {
-      closeSync8(outFd);
+      closeSync9(outFd);
     } catch {}
   }
   if (onFailure) {
@@ -55421,8 +55580,8 @@ bot.use(async (ctx, next) => {
 });
 function readRecentDenialsForAgent(agentName3, windowMs, limit) {
   try {
-    const auditPath = join32(homedir12(), ".switchroom", "vault-audit.log");
-    if (!existsSync34(auditPath))
+    const auditPath = join33(homedir12(), ".switchroom", "vault-audit.log");
+    if (!existsSync35(auditPath))
       return [];
     const raw = readFileSync32(auditPath, "utf8");
     return recentDenialsFromAuditLog(raw, { agentName: agentName3, windowMs, limit });
@@ -55475,7 +55634,7 @@ async function buildAgentMetadata(agentName3) {
   try {
     const agentDir = resolveAgentDirFromEnv();
     if (agentDir) {
-      const raw = readFileSync32(join32(agentDir, ".claude", ".claude.json"), "utf8");
+      const raw = readFileSync32(join33(agentDir, ".claude", ".claude.json"), "utf8");
       claudeJson = JSON.parse(raw);
     }
   } catch {}
@@ -55689,10 +55848,10 @@ bot.command("restart", async (ctx) => {
 function flushAgentHandoff(agentDir) {
   let removed = 0;
   for (const fname of [".handoff.md", ".handoff-topic"]) {
-    const p = join32(agentDir, fname);
+    const p = join33(agentDir, fname);
     try {
-      if (existsSync34(p)) {
-        unlinkSync14(p);
+      if (existsSync35(p)) {
+        unlinkSync15(p);
         removed++;
       }
     } catch (err) {
@@ -55747,7 +55906,7 @@ async function handleNewOrResetCommand(ctx, kind) {
   writeRestartMarker({ chat_id: chatId, thread_id: threadId ?? null, ack_message_id: ackId, ts: Date.now() });
   if (agentDir != null) {
     try {
-      writeFileSync21(join32(agentDir, ".force-fresh-session"), `${kind} at ${new Date().toISOString()}
+      writeFileSync21(join33(agentDir, ".force-fresh-session"), `${kind} at ${new Date().toISOString()}
 `, "utf8");
     } catch (err) {
       process.stderr.write(`telegram gateway: failed to write force-fresh marker: ${err}
@@ -56108,14 +56267,14 @@ bot.command("interrupt", async (ctx) => {
 var lockoutOps = {
   readFileSync: (p, enc) => readFileSync32(p, enc),
   writeFileSync: (p, data, opts) => writeFileSync21(p, data, opts),
-  existsSync: (p) => existsSync34(p),
+  existsSync: (p) => existsSync35(p),
   mkdirSync: (p, opts) => mkdirSync21(p, opts),
-  joinPath: (...parts) => join32(...parts)
+  joinPath: (...parts) => join33(...parts)
 };
 var FLEET_FALLBACK_DEDUP_MS = 30000;
 function isAuthBrokerSocketReachable() {
   try {
-    return existsSync34(resolveAuthBrokerSocketPath2());
+    return existsSync35(resolveAuthBrokerSocketPath2());
   } catch {
     return false;
   }
@@ -56176,7 +56335,7 @@ async function runCreditWatch() {
   if (!agentDir)
     return;
   const agentName3 = getMyAgentName();
-  const claudeConfigDir = join32(agentDir, ".claude");
+  const claudeConfigDir = join33(agentDir, ".claude");
   const stateDir = STATE_DIR;
   const reason = readClaudeJsonOverage(claudeConfigDir);
   const prev = loadCreditState(stateDir);
@@ -56386,9 +56545,9 @@ async function handleVaultRecentDenialCallback(ctx, data) {
     return;
   }
   const { token, id } = result;
-  const tokenPath = join32(homedir12(), ".switchroom", "agents", agentName3, ".vault-token");
+  const tokenPath = join33(homedir12(), ".switchroom", "agents", agentName3, ".vault-token");
   try {
-    mkdirSync21(join32(homedir12(), ".switchroom", "agents", agentName3), { recursive: true });
+    mkdirSync21(join33(homedir12(), ".switchroom", "agents", agentName3), { recursive: true });
     writeFileSync21(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created (${escapeHtmlForTg(id)}) but token write failed:</b> ${escapeHtmlForTg(String(err))}
@@ -56465,9 +56624,9 @@ async function performVaultAccessApproval(ctx, pending2, stageId, senderId, atte
     return;
   }
   const { token, id } = result;
-  const tokenPath = join32(homedir12(), ".switchroom", "agents", pending2.agent, ".vault-token");
+  const tokenPath = join33(homedir12(), ".switchroom", "agents", pending2.agent, ".vault-token");
   try {
-    mkdirSync21(join32(homedir12(), ".switchroom", "agents", pending2.agent), { recursive: true });
+    mkdirSync21(join33(homedir12(), ".switchroom", "agents", pending2.agent), { recursive: true });
     writeFileSync21(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created (${escapeHtmlForTg(id)}) but token write failed:</b> ${escapeHtmlForTg(String(err))}
@@ -56943,9 +57102,9 @@ async function executeGrantWizard(ctx, chatId, state4) {
     return;
   }
   const { token, id } = result;
-  const tokenPath = join32(homedir12(), ".switchroom", "agents", state4.agent, ".vault-token");
+  const tokenPath = join33(homedir12(), ".switchroom", "agents", state4.agent, ".vault-token");
   try {
-    mkdirSync21(join32(homedir12(), ".switchroom", "agents", state4.agent), { recursive: true });
+    mkdirSync21(join33(homedir12(), ".switchroom", "agents", state4.agent), { recursive: true });
     writeFileSync21(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created but token write failed:</b> ${escapeHtmlForTg(String(err))}`, { html: true });
@@ -57803,7 +57962,7 @@ bot.command("usage", async (ctx) => {
     await switchroomReply(ctx, "<b>/usage:</b> cannot resolve agent dir.", { html: true });
     return;
   }
-  const result = await fetchQuota2({ claudeConfigDir: join32(agentDir, ".claude") });
+  const result = await fetchQuota2({ claudeConfigDir: join33(agentDir, ".claude") });
   if (!result.ok) {
     await switchroomReply(ctx, `<b>/usage:</b> ${escapeHtmlForTg(result.reason)}`, { html: true });
     return;
@@ -58348,7 +58507,7 @@ async function maybeTranscribeVoice(fileId, mimeType, language) {
   let apiKey = null;
   try {
     const path = __require("path").join(__require("os").homedir(), ".switchroom", "openai-api-key");
-    if (existsSync34(path)) {
+    if (existsSync35(path)) {
       apiKey = readFileSync32(path, "utf-8").trim();
     }
   } catch (err) {
@@ -59209,7 +59368,7 @@ var didOneTimeSetup = false;
                       agentName: agentDisplayName,
                       agentSlug,
                       version: formatBootVersion(),
-                      agentDir: agentDir ?? join32(homedir12(), ".switchroom", "agents", agentSlug),
+                      agentDir: agentDir ?? join33(homedir12(), ".switchroom", "agents", agentSlug),
                       gatewayInfo: { pid: process.pid, startedAtMs: GATEWAY_STARTED_AT_MS },
                       restartReason: reason,
                       restartAgeMs: markerAgeMs,