switchroom 0.13.64 → 0.14.0

package/dist/cli/switchroom.js

@@ -29685,8 +29685,201 @@ var init_doctor_drive = __esm(() => {
   init_doctor_secret_access();
 });
 
+// src/cli/doctor-webkite.ts
+import {
+  existsSync as realExistsSync2,
+  readFileSync as realReadFileSync2,
+  readdirSync as realReaddirSync,
+  openSync as realOpenSync,
+  readSync as realReadSync,
+  closeSync as realCloseSync
+} from "node:fs";
+import { join as join45 } from "node:path";
+import { homedir as homedir25 } from "node:os";
+function defaultReadHead(p, n) {
+  let fd;
+  try {
+    fd = realOpenSync(p, "r");
+    const buf = Buffer.alloc(n);
+    const read = realReadSync(fd, buf, 0, n, 0);
+    return buf.subarray(0, read);
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) {
+      try {
+        realCloseSync(fd);
+      } catch {}
+    }
+  }
+}
+function resolveDeps2(config, deps) {
+  let agentsDir = deps.agentsDir;
+  if (agentsDir === undefined) {
+    try {
+      agentsDir = resolveAgentsDir(config);
+    } catch {
+      agentsDir = undefined;
+    }
+  }
+  return {
+    homeDir: deps.homeDir ?? homedir25(),
+    agentsDir,
+    existsSync: deps.existsSync ?? ((p) => realExistsSync2(p)),
+    readFileSync: deps.readFileSync ?? ((p) => realReadFileSync2(p, "utf-8")),
+    readdirSync: deps.readdirSync ?? ((p) => realReaddirSync(p)),
+    readHead: deps.readHead ?? defaultReadHead
+  };
+}
+function classifyArch(d, path4) {
+  const head = d.readHead(path4, 20);
+  if (head === null || head.length < 20)
+    return "unreadable";
+  if (!(head[0] === 127 && head[1] === 69 && head[2] === 76 && head[3] === 70)) {
+    return "not-elf";
+  }
+  const eMachine = head[18] | head[19] << 8;
+  return eMachine === 62 ? "elf-x64" : "elf-other-arch";
+}
+function webkiteEnabled(config, agent) {
+  const mcp = config.agents?.[agent]?.mcp_servers;
+  return (mcp ?? {})["webkite"] !== false;
+}
+function runWebkiteChecks(config, deps = {}) {
+  const agents = Object.keys(config.agents ?? {});
+  const enabledAgents = agents.filter((a) => webkiteEnabled(config, a));
+  if (enabledAgents.length === 0)
+    return [];
+  const d = resolveDeps2(config, deps);
+  const results = [];
+  const binPath = join45(d.homeDir, ".switchroom", "bin", "webkite");
+  if (!d.existsSync(binPath)) {
+    results.push({
+      name: "webkite: binary",
+      status: "warn",
+      detail: `not staged at ${binPath} \u2014 agents run in degraded "no-webkite" mode (native WebFetch kept by the fail-safe gate)`,
+      fix: "Stage the private-beta binary: cp <webkite> ~/.switchroom/bin/webkite && chmod +x; then `switchroom update`."
+    });
+  } else {
+    const arch = classifyArch(d, binPath);
+    if (arch === "elf-x64") {
+      results.push({ name: "webkite: binary", status: "ok", detail: `staged, linux x86-64 ELF (${binPath})` });
+    } else if (arch === "unreadable") {
+      results.push({ name: "webkite: binary", status: "skip", detail: `present but unreadable by the operator \u2014 re-run doctor without sudo` });
+    } else if (arch === "not-elf") {
+      results.push({
+        name: "webkite: binary",
+        status: "fail",
+        detail: `${binPath} is not a Linux ELF binary (likely a macOS/other-OS build) \u2014 it cannot run in the agent container`,
+        fix: "Replace with a linux x86-64 build (static musl preferred). See the webkite release artifacts."
+      });
+    } else {
+      results.push({
+        name: "webkite: binary",
+        status: "fail",
+        detail: `${binPath} is an ELF binary for the wrong CPU arch (not x86-64) \u2014 it cannot run in the agent container`,
+        fix: "Replace with a linux x86-64 (amd64) build."
+      });
+    }
+  }
+  const cloakDir = join45(d.homeDir, ".cloakbrowser");
+  let chromeFound = false;
+  if (d.existsSync(cloakDir)) {
+    try {
+      for (const entry of d.readdirSync(cloakDir)) {
+        if (entry.startsWith("chromium-") && d.existsSync(join45(cloakDir, entry, "chrome"))) {
+          chromeFound = true;
+          break;
+        }
+      }
+    } catch {}
+  }
+  if (chromeFound) {
+    results.push({ name: "webkite: cloakbrowser", status: "ok", detail: "stealth Chromium present (local render available)" });
+  } else {
+    results.push({
+      name: "webkite: cloakbrowser",
+      status: "warn",
+      detail: "no local stealth Chromium at ~/.cloakbrowser/chromium-*/chrome \u2014 webkite can only cloud-render (Cloudflare/Firecrawl) and will fail bot-gated sites with no local fallback",
+      fix: "Install once on the host: XDG_DATA_HOME=~/.switchroom/webkite-share webkite setup --yes cloakbrowser"
+    });
+  }
+  if (d.agentsDir === undefined) {
+    results.push({
+      name: "webkite: scaffold",
+      status: "warn",
+      detail: "agents_dir unresolved (no switchroom.agents_dir) \u2014 cannot verify per-agent webkite wiring"
+    });
+    return results;
+  }
+  for (const agent of enabledAgents) {
+    const agentDir = join45(d.agentsDir, agent);
+    const settingsPath = join45(agentDir, ".claude", "settings.json");
+    const mcpPath = join45(agentDir, ".mcp.json");
+    if (!d.existsSync(settingsPath) && !d.existsSync(mcpPath)) {
+      continue;
+    }
+    let settings = null;
+    let mcp = null;
+    let unreadable = false;
+    for (const [path4, set] of [
+      [settingsPath, (v) => {
+        settings = v;
+      }],
+      [mcpPath, (v) => {
+        mcp = v;
+      }]
+    ]) {
+      if (!d.existsSync(path4))
+        continue;
+      try {
+        set(JSON.parse(d.readFileSync(path4)));
+      } catch (err) {
+        const code = err?.code;
+        if (code === "EACCES" || code === "EPERM") {
+          unreadable = true;
+        }
+      }
+    }
+    if (unreadable) {
+      results.push({
+        name: `webkite: ${agent} scaffold`,
+        status: "skip",
+        detail: "scaffold files are agent-UID-owned (0600) \u2014 re-run doctor without sudo to read them"
+      });
+      continue;
+    }
+    const mcpHasWebkite = !!(mcp && mcp.mcpServers?.["webkite"]);
+    const allow = settings?.permissions?.allow ?? [];
+    const deny = settings?.permissions?.deny ?? [];
+    const allowOk = allow.includes("mcp__webkite__*");
+    const denyOk = deny.includes("WebFetch");
+    const problems = [];
+    if (!mcpHasWebkite)
+      problems.push(".mcp.json missing the webkite entry");
+    if (!allowOk)
+      problems.push("permissions.allow missing mcp__webkite__* (first fetch will prompt)");
+    if (!denyOk)
+      problems.push("permissions.deny missing WebFetch (native fetch not disabled)");
+    if (problems.length === 0) {
+      results.push({ name: `webkite: ${agent} scaffold`, status: "ok", detail: "wired + pre-approved + WebFetch denied" });
+    } else {
+      results.push({
+        name: `webkite: ${agent} scaffold`,
+        status: "warn",
+        detail: problems.join("; "),
+        fix: "Run `switchroom apply` (or `switchroom agent restart <agent>`) to re-scaffold the webkite wiring."
+      });
+    }
+  }
+  return results;
+}
+var init_doctor_webkite = __esm(() => {
+  init_loader();
+});
+
 // src/cli/doctor-scaffold-wiring.ts
-import { join as join45, resolve as resolve30 } from "node:path";
+import { join as join46, resolve as resolve30 } from "node:path";
 function readJson2(d, path4) {
   if (!d.existsSync(path4))
     return { kind: "absent" };
@@ -29729,8 +29922,8 @@ function checkIntegrationScaffoldWiring(args) {
       });
       continue;
     }
-    const mcpPath = join45(agentDir, ".mcp.json");
-    const claudeJsonPath = join45(agentDir, ".claude", ".claude.json");
+    const mcpPath = join46(agentDir, ".mcp.json");
+    const claudeJsonPath = join46(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson2(deps, mcpPath);
     const trustRead = readJson2(deps, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -29791,17 +29984,17 @@ var init_doctor_scaffold_wiring = () => {};
 
 // src/cli/doctor-microsoft.ts
 import {
-  existsSync as realExistsSync2,
-  readFileSync as realReadFileSync2
+  existsSync as realExistsSync3,
+  readFileSync as realReadFileSync3
 } from "node:fs";
-import { join as join46 } from "node:path";
-import { homedir as homedir25 } from "node:os";
-function resolveDeps2(deps) {
-  const home2 = deps.homeDir?.() ?? homedir25();
+import { join as join47 } from "node:path";
+import { homedir as homedir26 } from "node:os";
+function resolveDeps3(deps) {
+  const home2 = deps.homeDir?.() ?? homedir26();
   return {
-    existsSync: deps.existsSync ?? realExistsSync2,
-    readFileSync: deps.readFileSync ?? realReadFileSync2,
-    agentsDir: join46(home2, ".switchroom", "agents"),
+    existsSync: deps.existsSync ?? realExistsSync3,
+    readFileSync: deps.readFileSync ?? realReadFileSync3,
+    agentsDir: join47(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now
   };
 }
@@ -29895,7 +30088,7 @@ function checkOAuthClient2(config, anyAgentEnabled) {
   ];
 }
 function readHeartbeat(d, agentName) {
-  const path4 = join46(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
+  const path4 = join47(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
   if (!d.existsSync(path4)) {
     return { error: "heartbeat file missing \u2014 launcher has not yet started" };
   }
@@ -29964,7 +30157,7 @@ function runMicrosoftChecks(config, deps = {}) {
   if (!accountsConfigured && !anyAgentAccount && !config.microsoft_workspace) {
     return [];
   }
-  const d = resolveDeps2(deps);
+  const d = resolveDeps3(deps);
   const results = [];
   results.push(...checkConfigMatrix2(config));
   const msAgents = computeMicrosoftEnabledAgents(config);
@@ -29988,19 +30181,19 @@ var init_doctor_microsoft = __esm(() => {
 
 // src/cli/doctor-notion.ts
 import {
-  existsSync as realExistsSync3,
-  readFileSync as realReadFileSync3,
+  existsSync as realExistsSync4,
+  readFileSync as realReadFileSync4,
   statSync as realStatSync
 } from "node:fs";
-import { join as join47 } from "node:path";
-import { homedir as homedir26 } from "node:os";
-function resolveDeps3(deps) {
-  const home2 = deps.homeDir?.() ?? homedir26();
+import { join as join48 } from "node:path";
+import { homedir as homedir27 } from "node:os";
+function resolveDeps4(deps) {
+  const home2 = deps.homeDir?.() ?? homedir27();
   return {
-    existsSync: deps.existsSync ?? realExistsSync3,
-    readFileSync: deps.readFileSync ?? realReadFileSync3,
+    existsSync: deps.existsSync ?? realExistsSync4,
+    readFileSync: deps.readFileSync ?? realReadFileSync4,
     statSync: deps.statSync ?? realStatSync,
-    agentsDir: join47(home2, ".switchroom", "agents"),
+    agentsDir: join48(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now,
     vaultAclReader: deps.vaultAclReader ?? (async () => ({ kind: "unreachable", msg: "no default reader wired" }))
   };
@@ -30125,7 +30318,7 @@ function checkLauncherHeartbeat2(notionAgents, d) {
     return [];
   const results = [];
   for (const name of notionAgents) {
-    const heartbeatPath = join47(d.agentsDir, name, "notion-launcher.heartbeat.json");
+    const heartbeatPath = join48(d.agentsDir, name, "notion-launcher.heartbeat.json");
     if (!d.existsSync(heartbeatPath)) {
       results.push({
         name: `notion:launcher-heartbeat:${name}`,
@@ -30169,7 +30362,7 @@ async function runNotionChecks(config, deps = {}) {
   if (notionAgents.length === 0 && !config.notion_workspace) {
     return [];
   }
-  const d = resolveDeps3(deps);
+  const d = resolveDeps4(deps);
   const results = [];
   results.push(...checkConfigMatrix3(config));
   if (notionAgents.length > 0 && config.notion_workspace) {
@@ -30196,16 +30389,16 @@ var init_doctor_notion = __esm(() => {
 
 // src/cli/doctor-credentials-migration.ts
 import {
-  existsSync as realExistsSync4,
-  readdirSync as realReaddirSync,
+  existsSync as realExistsSync5,
+  readdirSync as realReaddirSync2,
   statSync as realStatSync2
 } from "node:fs";
-import { homedir as homedir27 } from "node:os";
-import { join as join48 } from "node:path";
+import { homedir as homedir28 } from "node:os";
+import { join as join49 } from "node:path";
 function runCredentialsMigrationChecks(config, deps = {}) {
-  const credDir = deps.credentialsDir ?? join48(homedir27(), ".switchroom", "credentials");
-  const existsSync49 = deps.existsSync ?? ((p) => realExistsSync4(p));
-  const readdirSync19 = deps.readdirSync ?? ((p) => realReaddirSync(p));
+  const credDir = deps.credentialsDir ?? join49(homedir28(), ".switchroom", "credentials");
+  const existsSync49 = deps.existsSync ?? ((p) => realExistsSync5(p));
+  const readdirSync19 = deps.readdirSync ?? ((p) => realReaddirSync2(p));
   const isDirectory = deps.isDirectory ?? ((p) => {
     try {
       return realStatSync2(p).isDirectory();
@@ -30231,7 +30424,7 @@ function runCredentialsMigrationChecks(config, deps = {}) {
   const flat = [];
   const perAgentDirs = [];
   for (const e of entries) {
-    const full = join48(credDir, e);
+    const full = join49(credDir, e);
     if (isDirectory(full) && agentNames.has(e)) {
       perAgentDirs.push(e);
     } else {
@@ -30354,19 +30547,19 @@ var init_doctor_inlined_secrets = __esm(() => {
 
 // src/cli/doctor-audit-integrity.ts
 import { readFileSync as fsReadFileSync2 } from "node:fs";
-import { homedir as homedir28 } from "node:os";
-import { join as join49 } from "node:path";
+import { homedir as homedir29 } from "node:os";
+import { join as join50 } from "node:path";
 function rootWrittenLogs(home2) {
   return [
-    { label: "vault-broker", path: join49(home2, ".switchroom", "vault-audit.log") },
+    { label: "vault-broker", path: join50(home2, ".switchroom", "vault-audit.log") },
     {
       label: "hostd",
-      path: join49(home2, ".switchroom", "host-control-audit.log")
+      path: join50(home2, ".switchroom", "host-control-audit.log")
     }
   ];
 }
 function runAuditIntegrityChecks(deps = {}) {
-  const home2 = deps.homeDir ?? homedir28();
+  const home2 = deps.homeDir ?? homedir29();
   const read = deps.readFileSync ?? ((p) => fsReadFileSync2(p, "utf8"));
   const results = [];
   for (const { label, path: path4 } of rootWrittenLogs(home2)) {
@@ -30504,14 +30697,14 @@ var init_client4 = __esm(() => {
 
 // src/cli/doctor-agent-smoke.ts
 import { existsSync as existsSync49 } from "node:fs";
-import { homedir as homedir29 } from "node:os";
-import { join as join50 } from "node:path";
+import { homedir as homedir30 } from "node:os";
+import { join as join51 } from "node:path";
 import { randomUUID as randomUUID4 } from "node:crypto";
 async function runAgentSmokeChecks(config, deps = {}) {
   if (deps.fast)
     return [];
-  const home2 = deps.homeDir ?? homedir29();
-  const sock = deps.operatorSockPath ?? join50(home2, ".switchroom", "hostd", "operator", "sock");
+  const home2 = deps.homeDir ?? homedir30();
+  const sock = deps.operatorSockPath ?? join51(home2, ".switchroom", "hostd", "operator", "sock");
   if (!deps.hostdRequestImpl && !existsSync49(sock)) {
     return [
       {
@@ -30591,8 +30784,8 @@ var init_doctor_agent_smoke = __esm(() => {
 // src/cli/doctor-vault-broker-durability.ts
 import { execFileSync as execFileSync14 } from "node:child_process";
 import { existsSync as existsSync50, statSync as statSync22 } from "node:fs";
-import { homedir as homedir30 } from "node:os";
-import { join as join51 } from "node:path";
+import { homedir as homedir31 } from "node:os";
+import { join as join52 } from "node:path";
 function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   const statHost = opts?.statHost ?? defaultStatHost;
   const statBroker = opts?.statBroker ?? defaultStatBroker;
@@ -30732,19 +30925,19 @@ function defaultBrokerStatusProbe() {
   }
 }
 function runVaultBrokerDurabilityChecks(_config, opts) {
-  const home2 = homedir30();
+  const home2 = homedir31();
   const probe2 = opts?.inodeProbe ?? probeBindMountInode;
   return [
     probeBrokerUnlocked(opts?.statusProbe),
     probeAutoUnlockBlob(home2),
     probeMachineIdMount(),
-    formatBindMountResult("vault-broker: vault.enc bind mount", join51(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join51(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
-    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join51(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join51(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
-    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join51(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join51(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log"))
+    formatBindMountResult("vault-broker: vault.enc bind mount", join52(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join52(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
+    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join52(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join52(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
+    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join52(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join52(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log"))
   ];
 }
 function probeAutoUnlockBlob(home2) {
-  const blobPath = join51(home2, ".switchroom", "vault-auto-unlock");
+  const blobPath = join52(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync50(blobPath)) {
     return {
       name: "vault-broker: auto-unlock blob",
@@ -30855,16 +31048,16 @@ import {
   readdirSync as readdirSync19,
   statSync as statSync23
 } from "node:fs";
-import { dirname as dirname12, join as join52, resolve as resolve31 } from "node:path";
+import { dirname as dirname12, join as join53, resolve as resolve31 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
-  const nvmRoot = join52(process.env.HOME ?? "", ".nvm", "versions", "node");
+  const nvmRoot = join53(process.env.HOME ?? "", ".nvm", "versions", "node");
   if (!existsSync51(nvmRoot))
     return null;
   try {
     const versions = readdirSync19(nvmRoot).sort().reverse();
     for (const v of versions) {
-      const candidate = join52(nvmRoot, v, "bin", bin);
+      const candidate = join53(nvmRoot, v, "bin", bin);
       try {
         const s = statSync23(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
@@ -31029,7 +31222,7 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
   if (envBrowsersPath && envBrowsersPath.length > 0) {
     cacheLocations.push(envBrowsersPath);
   }
-  cacheLocations.push(join52(homeDir, ".cache", "ms-playwright"));
+  cacheLocations.push(join53(homeDir, ".cache", "ms-playwright"));
   for (const cacheDir of cacheLocations) {
     if (!existsSync51(cacheDir))
       continue;
@@ -31037,10 +31230,10 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
       const entries = readdirSync19(cacheDir).filter((e) => e.startsWith("chromium"));
       for (const entry of entries) {
         const candidates2 = [
-          join52(cacheDir, entry, "chrome-linux64", "chrome"),
-          join52(cacheDir, entry, "chrome-linux", "chrome"),
-          join52(cacheDir, entry, "chrome-linux64", "headless_shell"),
-          join52(cacheDir, entry, "chrome-linux", "headless_shell")
+          join53(cacheDir, entry, "chrome-linux64", "chrome"),
+          join53(cacheDir, entry, "chrome-linux", "chrome"),
+          join53(cacheDir, entry, "chrome-linux64", "headless_shell"),
+          join53(cacheDir, entry, "chrome-linux", "headless_shell")
         ];
         for (const path4 of candidates2) {
           if (existsSync51(path4))
@@ -31150,7 +31343,7 @@ function checkUserDeclaredMcps(name, agentConfig, config, renderedMcpServers) {
 function checkLegacyState() {
   const results = [];
   const h = process.env.HOME ?? "/root";
-  const clerkDir = join52(h, LEGACY_STATE_DIR);
+  const clerkDir = join53(h, LEGACY_STATE_DIR);
   const clerkPresent = existsSync51(clerkDir);
   results.push({
     name: "legacy ~/.clerk state",
@@ -31160,7 +31353,7 @@ function checkLegacyState() {
       fix: "Legacy state detected. Run `mv ~/.clerk ~/.switchroom` and rename " + "any top-level `clerk:` key in switchroom.yaml to `switchroom:`. " + "This back-compat shim is REMOVED in v0.13.0 \u2014 no automatic " + "migration exists."
     } : {}
   });
-  const legacySock = join52(h, ".switchroom", "vault-broker.sock");
+  const legacySock = join53(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
     sockStat = lstatSync5(legacySock);
@@ -31456,7 +31649,7 @@ async function checkHindsight(config) {
 }
 function checkPendingRetainsQueue(dir) {
   const home2 = process.env.HOME ?? "";
-  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join52(home2, ".hindsight", "pending-retains");
+  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join53(home2, ".hindsight", "pending-retains");
   if (!existsSync51(pendingDir)) {
     return {
       name: "pending-retains queue",
@@ -31587,7 +31780,7 @@ async function checkTelegram(config) {
     const plugin = agentConfig.channels?.telegram?.plugin ?? "switchroom";
     if (plugin !== "switchroom")
       continue;
-    const envPath = join52(agentsDir, name, "telegram", ".env");
+    const envPath = join53(agentsDir, name, "telegram", ".env");
     const read = tryReadHostFile(envPath);
     if (read.kind === "eacces") {
       results.push({
@@ -31670,7 +31863,7 @@ function checkStartShStale(agentName, startShPath) {
 }
 function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const label = `${agentName}: $HOME/.switchroom symlink (#910)`;
-  const path4 = join52(agentDir, "home", ".switchroom");
+  const path4 = join53(agentDir, "home", ".switchroom");
   let stats;
   try {
     stats = lstatSync5(path4);
@@ -31707,7 +31900,7 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
 }
 function checkRepoHygiene(repoRoot) {
   const results = [];
-  const exportDir = join52(repoRoot, "clerk-export");
+  const exportDir = join53(repoRoot, "clerk-export");
   if (existsSync51(exportDir)) {
     results.push({
       name: "repo hygiene: clerk-export/ on disk (#1072)",
@@ -31716,7 +31909,7 @@ function checkRepoHygiene(repoRoot) {
       fix: `Run scripts/migrate-clerk-export-to-vault.sh to move the bundle ` + `into the vault, then delete the on-disk copy.`
     });
   }
-  const knownTarball = join52(repoRoot, "clerk-export-with-secrets.tar.gz");
+  const knownTarball = join53(repoRoot, "clerk-export-with-secrets.tar.gz");
   if (existsSync51(knownTarball)) {
     results.push({
       name: "repo hygiene: clerk-export-with-secrets.tar.gz on disk (#1072)",
@@ -31734,7 +31927,7 @@ function checkRepoHygiene(repoRoot) {
         results.push({
           name: `repo hygiene: ${name} on disk (#1072)`,
           status: "warn",
-          detail: `${join52(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
+          detail: `${join53(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
           fix: `Inspect, migrate any secrets into the vault, then delete the ` + `archive.`
         });
       }
@@ -31757,9 +31950,9 @@ function checkRepoHygiene(repoRoot) {
 }
 function isSwitchroomCheckout(dir) {
   try {
-    if (!existsSync51(join52(dir, ".git")))
+    if (!existsSync51(join53(dir, ".git")))
       return false;
-    const pkgPath = join52(dir, "package.json");
+    const pkgPath = join53(dir, "package.json");
     if (!existsSync51(pkgPath))
       return false;
     const pkg = JSON.parse(readFileSync46(pkgPath, "utf-8"));
@@ -31796,7 +31989,7 @@ function checkAgents(config, configPath) {
         fix: `Rotate the bot token (e.g. via \`switchroom vault\`), then run ` + `\`switchroom agent unquarantine ${name}\` and \`switchroom agent restart ${name}\``
       });
     }
-    results.push(checkStartShStale(name, join52(agentDir, "start.sh")));
+    results.push(checkStartShStale(name, join53(agentDir, "start.sh")));
     results.push(checkLeakedHomeSwitchroom(name, agentDir));
     const status = statuses[name];
     const active = status?.active ?? "unknown";
@@ -31873,7 +32066,7 @@ function checkAgents(config, configPath) {
       }
     }
     if (agentConfig.channels?.telegram?.plugin === "switchroom") {
-      const mcpJsonPath = join52(agentDir, ".mcp.json");
+      const mcpJsonPath = join53(agentDir, ".mcp.json");
       if (!existsSync51(mcpJsonPath)) {
         results.push({
           name: `${name}: .mcp.json`,
@@ -32175,7 +32368,7 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
     };
   }
   const credDir = dirname12(envPath);
-  const authScript = join52(credDir, "claude-auth.py");
+  const authScript = join53(credDir, "claude-auth.py");
   if (!existsSync51(authScript)) {
     return {
       name: "mff: auth flow",
@@ -32504,7 +32697,8 @@ function registerDoctorCommand(program3) {
           }
         })
       },
-      { title: "MFF Skill", results: await checkMff(passphrase, vaultPath, config) }
+      { title: "MFF Skill", results: await checkMff(passphrase, vaultPath, config) },
+      { title: "Webkite", results: runWebkiteChecks(config) }
     ];
     const cwd = process.cwd();
     if (isSwitchroomCheckout(cwd)) {
@@ -32563,6 +32757,7 @@ var init_doctor = __esm(() => {
   init_doctor_auth_broker();
   init_doctor_hostd();
   init_doctor_drive();
+  init_doctor_webkite();
   init_doctor_microsoft();
   init_doctor_notion();
   init_doctor_credentials_migration();
@@ -49083,8 +49278,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.13.64";
-var COMMIT_SHA = "52afe8b0";
+var VERSION = "0.14.0";
+var COMMIT_SHA = "d7cd6faa";
 
 // src/cli/agent.ts
 init_source();
@@ -49940,6 +50135,10 @@ var AGENT_CONFIG_MCP_TOOLS = [
 var HOSTD_MCP_TOOLS = [
   "mcp__hostd__update_check"
 ];
+var WEBKITE_MCP_TOOLS = [
+  "mcp__webkite",
+  "mcp__webkite__*"
+];
 var LEGACY_SWITCHROOM_MCP_TOKENS = ["mcp__switchroom", "mcp__switchroom__*"];
 var LEGACY_HOSTD_BLANKET_TOKENS = ["mcp__hostd", "mcp__hostd__*"];
 var DEFAULT_READ_ONLY_PREAPPROVED_TOOLS = [
@@ -50755,7 +50954,8 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
     ...usesSwitchroomTelegramPlugin(agentConfig) ? SWITCHROOM_TELEGRAM_MCP_TOOLS : [],
     ...hindsightEnabled ? HINDSIGHT_MCP_TOOLS : [],
     ...AGENT_CONFIG_MCP_TOOLS,
-    ...HOSTD_MCP_TOOLS
+    ...HOSTD_MCP_TOOLS,
+    ...agentConfig.mcp_servers?.["webkite"] === false ? [] : WEBKITE_MCP_TOOLS
   ]);
   const hindsightAutoRecallEnabled = hindsightEnabled && agentConfig.memory?.auto_recall !== false;
   const hindsightBankId = agentConfig.memory?.collection ?? name;
@@ -50816,7 +51016,8 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
       }
       settings.permissions = settings.permissions ?? {};
       const allow = (Array.isArray(settings.permissions.allow) ? settings.permissions.allow : []).filter((p) => !LEGACY_HOSTD_BLANKET_TOKENS.includes(p));
-      for (const t of [...AGENT_CONFIG_MCP_TOOLS, ...HOSTD_MCP_TOOLS]) {
+      const webkiteAllowTools = agentConfig.mcp_servers?.["webkite"] === false ? [] : WEBKITE_MCP_TOOLS;
+      for (const t of [...AGENT_CONFIG_MCP_TOOLS, ...HOSTD_MCP_TOOLS, ...webkiteAllowTools]) {
         if (!allow.includes(t))
           allow.push(t);
       }
@@ -51539,7 +51740,8 @@ function reconcileAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchr
     ...usesSwitchroomTelegramPlugin(agentConfig) ? SWITCHROOM_TELEGRAM_MCP_TOOLS : [],
     ...hindsightEnabled ? HINDSIGHT_MCP_TOOLS : [],
     ...AGENT_CONFIG_MCP_TOOLS,
-    ...HOSTD_MCP_TOOLS
+    ...HOSTD_MCP_TOOLS,
+    ...agentConfig.mcp_servers?.["webkite"] === false ? [] : WEBKITE_MCP_TOOLS
   ]);
   const desiredDeny = dedupe2([
     ...tools.deny ?? [],
@@ -72402,15 +72604,15 @@ init_loader();
 init_lifecycle();
 import { cpSync as cpSync2, existsSync as existsSync52, mkdirSync as mkdirSync28, readFileSync as readFileSync47, realpathSync as realpathSync5, rmSync as rmSync12, statSync as statSync24 } from "node:fs";
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { join as join53, dirname as dirname13, resolve as resolve32 } from "node:path";
-import { homedir as homedir31 } from "node:os";
-var DEFAULT_COMPOSE_PATH = join53(homedir31(), ".switchroom", "compose", "docker-compose.yml");
+import { join as join54, dirname as dirname13, resolve as resolve32 } from "node:path";
+import { homedir as homedir32 } from "node:os";
+var DEFAULT_COMPOSE_PATH = join54(homedir32(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname13(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync52(join53(dir, ".git"))) {
+    if (existsSync52(join54(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync47(join53(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync47(join54(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -72541,7 +72743,7 @@ function planUpdate(opts) {
         return;
       }
       const source = resolve32(import.meta.dirname, "../../skills");
-      const dest = join53(homedir31(), ".switchroom", "skills", "_bundled");
+      const dest = join54(homedir32(), ".switchroom", "skills", "_bundled");
       if (!existsSync52(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
@@ -72655,7 +72857,7 @@ function defaultStatusProbe(composePath) {
       } catch {}
       let dir = dirname13(scriptPath);
       for (let i = 0;i < 8; i++) {
-        const pkgPath = join53(dir, "package.json");
+        const pkgPath = join54(dir, "package.json");
         if (existsSync52(pkgPath)) {
           try {
             const pkg = JSON.parse(readFileSync47(pkgPath, "utf-8"));
@@ -72875,7 +73077,7 @@ init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
 import { existsSync as existsSync53, readFileSync as readFileSync48 } from "node:fs";
-import { dirname as dirname14, join as join54 } from "node:path";
+import { dirname as dirname14, join as join55 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync4("claude --version 2>/dev/null", {
@@ -72925,11 +73127,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const pkgPath = join54(dir, "package.json");
+    const pkgPath = join55(dir, "package.json");
     if (existsSync53(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync48(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync53(join54(dir, ".git"))) {
+        if (pkg.name === "switchroom" && existsSync53(join55(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -73166,7 +73368,7 @@ import {
   writeFileSync as writeFileSync26,
   writeSync as writeSync7
 } from "node:fs";
-import { join as join55 } from "node:path";
+import { join as join56 } from "node:path";
 import { randomBytes as randomBytes12 } from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
 
@@ -73486,7 +73688,7 @@ function redactedMarker(ruleId) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path4 = join55(stateDir, ISSUES_FILE);
+  const path4 = join56(stateDir, ISSUES_FILE);
   if (!existsSync54(path4))
     return [];
   let raw;
@@ -73564,7 +73766,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve35(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync54(join55(stateDir, ISSUES_FILE)))
+  if (!existsSync54(join56(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -73582,7 +73784,7 @@ function resolve35(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync54(join55(stateDir, ISSUES_FILE)))
+  if (!existsSync54(join56(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -73600,7 +73802,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync54(join55(stateDir, ISSUES_FILE)))
+  if (!existsSync54(join56(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -73633,7 +73835,7 @@ function ensureDir(stateDir) {
   mkdirSync29(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path4 = join55(stateDir, ISSUES_FILE);
+  const path4 = join56(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path4}.tmp-${process.pid}-${randomBytes12(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -73655,7 +73857,7 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join55(stateDir, entry);
+    const tmpPath = join56(stateDir, entry);
     try {
       const stat = statSync25(tmpPath);
       if (stat.mtimeMs < cutoff) {
@@ -73667,7 +73869,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join55(stateDir, ISSUES_LOCK);
+  const lockPath = join56(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -73951,8 +74153,8 @@ function relTime(deltaMs) {
 // src/cli/deps.ts
 init_source();
 import { existsSync as existsSync57 } from "node:fs";
-import { homedir as homedir34 } from "node:os";
-import { join as join58, resolve as resolve36 } from "node:path";
+import { homedir as homedir35 } from "node:os";
+import { join as join59, resolve as resolve36 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash11 } from "node:crypto";
@@ -73963,8 +74165,8 @@ import {
   rmSync as rmSync13,
   writeFileSync as writeFileSync27
 } from "node:fs";
-import { dirname as dirname15, join as join56 } from "node:path";
-import { homedir as homedir32 } from "node:os";
+import { dirname as dirname15, join as join57 } from "node:path";
+import { homedir as homedir33 } from "node:os";
 import { execFileSync as execFileSync15 } from "node:child_process";
 
 class PythonEnvError extends Error {
@@ -73976,7 +74178,7 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join56(homedir32(), ".switchroom", "deps", "python");
+  return join57(homedir33(), ".switchroom", "deps", "python");
 }
 function hashFile(path4) {
   return createHash11("sha256").update(readFileSync50(path4)).digest("hex");
@@ -73988,11 +74190,11 @@ function ensurePythonEnv(opts) {
   if (!existsSync55(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join56(cacheRoot, skillName);
-  const stampPath = join56(venvDir, ".requirements.sha256");
-  const binDir = join56(venvDir, "bin");
-  const pythonBin = join56(binDir, "python");
-  const pipBin = join56(binDir, "pip");
+  const venvDir = join57(cacheRoot, skillName);
+  const stampPath = join57(venvDir, ".requirements.sha256");
+  const binDir = join57(venvDir, "bin");
+  const pythonBin = join57(binDir, "python");
+  const pipBin = join57(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
   if (!force && existsSync55(stampPath) && existsSync55(pythonBin)) {
     const existingHash = readFileSync50(stampPath, "utf8").trim();
@@ -74051,8 +74253,8 @@ import {
   rmSync as rmSync14,
   writeFileSync as writeFileSync28
 } from "node:fs";
-import { dirname as dirname16, join as join57 } from "node:path";
-import { homedir as homedir33 } from "node:os";
+import { dirname as dirname16, join as join58 } from "node:path";
+import { homedir as homedir34 } from "node:os";
 import { execFileSync as execFileSync16 } from "node:child_process";
 
 class NodeEnvError extends Error {
@@ -74075,7 +74277,7 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join57(homedir33(), ".switchroom", "deps", "node");
+  return join58(homedir34(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
   const sourceDir = dirname16(packageJsonPath);
@@ -74084,7 +74286,7 @@ function hashDepInputs(packageJsonPath) {
 `);
   hasher.update(readFileSync51(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join57(sourceDir, lockName);
+    const lockPath = join58(sourceDir, lockName);
     if (existsSync56(lockPath)) {
       hasher.update(`
 `);
@@ -74104,10 +74306,10 @@ function ensureNodeEnv(opts) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
   const sourceDir = dirname16(packageJsonPath);
-  const envDir = join57(cacheRoot, skillName);
-  const stampPath = join57(envDir, ".package.sha256");
-  const nodeModulesDir = join57(envDir, "node_modules");
-  const binDir = join57(nodeModulesDir, ".bin");
+  const envDir = join58(cacheRoot, skillName);
+  const stampPath = join58(envDir, ".package.sha256");
+  const nodeModulesDir = join58(envDir, "node_modules");
+  const binDir = join58(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
   if (!force && existsSync56(stampPath) && existsSync56(nodeModulesDir)) {
     const existingHash = readFileSync51(stampPath, "utf8").trim();
@@ -74125,12 +74327,12 @@ function ensureNodeEnv(opts) {
     rmSync14(envDir, { recursive: true, force: true });
   }
   mkdirSync31(envDir, { recursive: true });
-  copyFileSync9(packageJsonPath, join57(envDir, "package.json"));
+  copyFileSync9(packageJsonPath, join58(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join57(sourceDir, lockName);
+    const lockPath = join58(sourceDir, lockName);
     if (existsSync56(lockPath)) {
-      copyFileSync9(lockPath, join57(envDir, lockName));
+      copyFileSync9(lockPath, join58(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -74159,7 +74361,7 @@ function ensureNodeEnv(opts) {
 
 // src/cli/deps.ts
 function builtinSkillsRoot() {
-  return resolve36(homedir34(), ".switchroom/skills/_bundled");
+  return resolve36(homedir35(), ".switchroom/skills/_bundled");
 }
 function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
@@ -74169,13 +74371,13 @@ function registerDepsCommand(program3) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join58(skillsRoot, skill);
+    const skillDir = join59(skillsRoot, skill);
     if (!existsSync57(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join58(skillDir, "requirements.txt");
-    const packageJsonPath = join58(skillDir, "package.json");
+    const requirementsPath = join59(skillDir, "requirements.txt");
+    const packageJsonPath = join59(skillDir, "package.json");
     const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync57(requirementsPath));
     const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync57(packageJsonPath));
     let did = 0;
@@ -75130,7 +75332,7 @@ init_helpers();
 init_loader();
 init_merge();
 import { copyFileSync as copyFileSync10, existsSync as existsSync59, readFileSync as readFileSync52, writeFileSync as writeFileSync29 } from "node:fs";
-import { join as join59, resolve as resolve38 } from "node:path";
+import { join as join60, resolve as resolve38 } from "node:path";
 init_schema();
 function resolveSoulTargetOrExit(program3, agentName) {
   const config = getConfig(program3);
@@ -75154,7 +75356,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join59(workspaceDir, "SOUL.md"),
+    soulPath: join60(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -75221,7 +75423,7 @@ function registerSoulCommand(program3) {
 init_helpers();
 init_loader();
 import { existsSync as existsSync60, readFileSync as readFileSync53, readdirSync as readdirSync21, statSync as statSync26 } from "node:fs";
-import { resolve as resolve39, join as join60 } from "node:path";
+import { resolve as resolve39, join as join61 } from "node:path";
 import { createHash as createHash13 } from "node:crypto";
 init_merge();
 init_hindsight();
@@ -75235,7 +75437,7 @@ function sha256(content) {
   return createHash13("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join60(claudeConfigDir, "projects");
+  const projectsDir = join61(claudeConfigDir, "projects");
   if (!existsSync60(projectsDir))
     return;
   try {
@@ -75244,8 +75446,8 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join60(projectsDir, entry.name);
-      const transcriptPath = join60(projectPath, "transcript.jsonl");
+      const projectPath = join61(projectsDir, entry.name);
+      const transcriptPath = join61(projectPath, "transcript.jsonl");
       if (!existsSync60(transcriptPath))
         continue;
       const stat3 = statSync26(transcriptPath);
@@ -75314,11 +75516,11 @@ function registerDebugCommand(program3) {
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join60(agentDir, ".claude");
-    const claudeMdPath = join60(agentDir, "CLAUDE.md");
-    const soulMdPath = join60(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join60(workspaceDir, "SOUL.md");
-    const handoffPath = join60(agentDir, ".handoff.md");
+    const claudeConfigDir = join61(agentDir, ".claude");
+    const claudeMdPath = join61(agentDir, "CLAUDE.md");
+    const soulMdPath = join61(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join61(workspaceDir, "SOUL.md");
+    const handoffPath = join61(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -75468,8 +75670,8 @@ init_source();
 // src/worktree/claim.ts
 import { execFileSync as execFileSync17 } from "node:child_process";
 import { closeSync as closeSync12, mkdirSync as mkdirSync33, openSync as openSync12, existsSync as existsSync62, unlinkSync as unlinkSync13 } from "node:fs";
-import { join as join62, resolve as resolve41 } from "node:path";
-import { homedir as homedir36 } from "node:os";
+import { join as join63, resolve as resolve41 } from "node:path";
+import { homedir as homedir37 } from "node:os";
 import { randomBytes as randomBytes13 } from "node:crypto";
 
 // src/worktree/registry.ts
@@ -75482,13 +75684,13 @@ import {
   existsSync as existsSync61,
   renameSync as renameSync12
 } from "node:fs";
-import { join as join61, resolve as resolve40 } from "node:path";
-import { homedir as homedir35 } from "node:os";
+import { join as join62, resolve as resolve40 } from "node:path";
+import { homedir as homedir36 } from "node:os";
 function registryDir() {
-  return resolve40(process.env.SWITCHROOM_WORKTREE_DIR ?? join61(homedir35(), ".switchroom", "worktrees"));
+  return resolve40(process.env.SWITCHROOM_WORKTREE_DIR ?? join62(homedir36(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join61(registryDir(), `${id}.json`);
+  return join62(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
   mkdirSync32(registryDir(), { recursive: true });
@@ -75539,7 +75741,7 @@ function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
   mkdirSync33(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join62(lockDir, `.lock-${lockName}`);
+  const lockPath = join63(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -75566,7 +75768,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve41(process.env.SWITCHROOM_WORKTREE_BASE ?? join62(homedir36(), ".switchroom", "worktree-checkouts"));
+  return resolve41(process.env.SWITCHROOM_WORKTREE_BASE ?? join63(homedir37(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes13(4).toString("hex");
@@ -75588,7 +75790,7 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join62(homedir36(), p.slice(2));
+    return join63(homedir37(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
@@ -75616,7 +75818,7 @@ async function claimWorktree(input, codeRepos) {
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
     mkdirSync33(baseDir, { recursive: true });
-    worktreePath = join62(baseDir, `${id}-${taskSuffix}`);
+    worktreePath = join63(baseDir, `${id}-${taskSuffix}`);
     const now = new Date().toISOString();
     const record2 = {
       id,
@@ -75871,7 +76073,7 @@ import {
   rmSync as rmSync15,
   writeFileSync as writeFileSync31
 } from "node:fs";
-import { join as join63 } from "node:path";
+import { join as join64 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -76061,16 +76263,16 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join63(stateBase, "google-workspace-mcp", "credentials");
+  return join64(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
   mkdirSync34(dir, { recursive: true, mode: 448 });
   chmodSync9(dir, 448);
   for (const name of readdirSync23(dir)) {
-    rmSync15(join63(dir, name), { force: true, recursive: true });
+    rmSync15(join64(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join63(dir, filename);
+  const filePath = join64(dir, filename);
   writeFileSync31(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync9(filePath, 384);
   return filePath;
@@ -76230,7 +76432,7 @@ function registerDriveMcpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
 import { writeFileSync as writeFileSync32, mkdirSync as mkdirSync35 } from "node:fs";
-import { dirname as dirname17, join as join64 } from "node:path";
+import { dirname as dirname17, join as join65 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -76262,7 +76464,7 @@ function writeRefreshHeartbeat(agentName, data) {
 function heartbeatPath(agentName) {
   const override = process.env.SWITCHROOM_M365_HEARTBEAT_DIR;
   if (override) {
-    return join64(override, `m365-launcher-${agentName}.heartbeat.json`);
+    return join65(override, `m365-launcher-${agentName}.heartbeat.json`);
   }
   return "/state/agent/m365-launcher.heartbeat.json";
 }
@@ -77181,8 +77383,8 @@ agents:
 
 // src/cli/apply.ts
 init_resolver();
-import { dirname as dirname21, join as join68, resolve as resolve43 } from "node:path";
-import { homedir as homedir38 } from "node:os";
+import { dirname as dirname21, join as join69, resolve as resolve43 } from "node:path";
+import { homedir as homedir39 } from "node:os";
 import { execFileSync as execFileSync20 } from "node:child_process";
 init_vault();
 init_loader();
@@ -77190,7 +77392,7 @@ init_loader();
 
 // src/cli/update-prompt-hook.ts
 import { existsSync as existsSync66, readFileSync as readFileSync55, writeFileSync as writeFileSync34, chmodSync as chmodSync10, mkdirSync as mkdirSync37 } from "node:fs";
-import { join as join65 } from "node:path";
+import { join as join66 } from "node:path";
 var HOOK_FILENAME = "update-card-on-prompt.sh";
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -77256,9 +77458,9 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join65(agentDir, ".claude", "hooks");
+  const hooksDir = join66(agentDir, ".claude", "hooks");
   mkdirSync37(hooksDir, { recursive: true });
-  const scriptPath = join65(hooksDir, HOOK_FILENAME);
+  const scriptPath = join66(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
   const existing = existsSync66(scriptPath) ? readFileSync55(scriptPath, "utf-8") : "";
@@ -77271,7 +77473,7 @@ function installUpdatePromptHook(agentDir) {
       chmodSync10(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join65(agentDir, ".claude", "settings.json");
+  const settingsPath = join66(agentDir, ".claude", "settings.json");
   if (!existsSync66(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
@@ -77397,7 +77599,7 @@ import {
   realpathSync as realpathSync6,
   statSync as statSync27
 } from "node:fs";
-import { join as join67 } from "node:path";
+import { join as join68 } from "node:path";
 function resolveOperatorUid() {
   const sudoUid = process.env.SUDO_UID;
   if (sudoUid !== undefined) {
@@ -77413,14 +77615,14 @@ function resolveOperatorUid() {
   return;
 }
 function operatorOwnedPaths(home2) {
-  const root = join67(home2, ".switchroom");
+  const root = join68(home2, ".switchroom");
   return [
-    join67(root, "vault"),
-    join67(root, "vault-auto-unlock"),
-    join67(root, "vault-audit.log"),
-    join67(root, "host-control-audit.log"),
-    join67(root, "accounts"),
-    join67(root, "compose")
+    join68(root, "vault"),
+    join68(root, "vault-auto-unlock"),
+    join68(root, "vault-audit.log"),
+    join68(root, "host-control-audit.log"),
+    join68(root, "accounts"),
+    join68(root, "compose")
   ];
 }
 function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
@@ -77469,7 +77671,7 @@ function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
     } catch {}
     if (isDir(target)) {
       for (const entry of readdir2(target)) {
-        visit(join67(target, entry));
+        visit(join68(target, entry));
       }
     }
   };
@@ -77483,14 +77685,14 @@ var EMBEDDED_EXAMPLES = {
   switchroom: switchroom_default,
   minimal: minimal_default
 };
-var DEFAULT_COMPOSE_PATH2 = join68(homedir38(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH2 = join69(homedir39(), ".switchroom", "compose", "docker-compose.yml");
 var COMPOSE_PROJECT2 = "switchroom";
 function resolveVaultBindMountDir(homeDir, ctx) {
   const isCustomPath = ctx.migrationKind === "custom-path-skipped";
   if (isCustomPath && ctx.customVaultPath) {
     return dirname21(ctx.customVaultPath);
   }
-  return join68(homeDir, ".switchroom", "vault");
+  return join69(homeDir, ".switchroom", "vault");
 }
 function inspectVaultBindMountDir(vaultDir) {
   if (!existsSync69(vaultDir))
@@ -77519,44 +77721,44 @@ function hasVaultRefs(value) {
   return false;
 }
 async function ensureHostMountSources(config) {
-  const home2 = homedir38();
+  const home2 = homedir39();
   const dirs = [
-    join68(home2, ".switchroom", "approvals"),
-    join68(home2, ".switchroom", "scheduler"),
-    join68(home2, ".switchroom", "logs"),
-    join68(home2, ".switchroom", "compose"),
-    join68(home2, ".switchroom", "broker-operator")
+    join69(home2, ".switchroom", "approvals"),
+    join69(home2, ".switchroom", "scheduler"),
+    join69(home2, ".switchroom", "logs"),
+    join69(home2, ".switchroom", "compose"),
+    join69(home2, ".switchroom", "broker-operator")
   ];
   for (const name of Object.keys(config.agents)) {
-    dirs.push(join68(home2, ".switchroom", "agents", name));
-    dirs.push(join68(home2, ".switchroom", "logs", name));
-    dirs.push(join68(home2, ".claude", "projects", name));
-    dirs.push(join68(home2, ".switchroom", "audit", name));
-    if (existsSync69(join68(home2, ".switchroom-config"))) {
-      dirs.push(join68(home2, ".switchroom-config", "agents", name, "personal-skills"));
+    dirs.push(join69(home2, ".switchroom", "agents", name));
+    dirs.push(join69(home2, ".switchroom", "logs", name));
+    dirs.push(join69(home2, ".claude", "projects", name));
+    dirs.push(join69(home2, ".switchroom", "audit", name));
+    if (existsSync69(join69(home2, ".switchroom-config"))) {
+      dirs.push(join69(home2, ".switchroom-config", "agents", name, "personal-skills"));
     }
   }
   for (const dir of dirs) {
     await mkdir(dir, { recursive: true });
   }
-  const autoUnlockPath = join68(home2, ".switchroom", "vault-auto-unlock");
+  const autoUnlockPath = join69(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync69(autoUnlockPath)) {
     writeFileSync35(autoUnlockPath, "", { mode: 384 });
   }
-  const auditLogPath = join68(home2, ".switchroom", "vault-audit.log");
+  const auditLogPath = join69(home2, ".switchroom", "vault-audit.log");
   if (!existsSync69(auditLogPath)) {
     writeFileSync35(auditLogPath, "", { mode: 420 });
   }
-  const grantsDbPath = join68(home2, ".switchroom", "vault-grants.db");
+  const grantsDbPath = join69(home2, ".switchroom", "vault-grants.db");
   if (!existsSync69(grantsDbPath)) {
     writeFileSync35(grantsDbPath, "", { mode: 384 });
   }
-  const hostdAuditLogPath = join68(home2, ".switchroom", "host-control-audit.log");
+  const hostdAuditLogPath = join69(home2, ".switchroom", "host-control-audit.log");
   if (!existsSync69(hostdAuditLogPath)) {
     writeFileSync35(hostdAuditLogPath, "", { mode: 420 });
   }
   for (const name of Object.keys(config.agents)) {
-    const tokenPath = join68(home2, ".switchroom", "agents", name, ".vault-token");
+    const tokenPath = join69(home2, ".switchroom", "agents", name, ".vault-token");
     if (!existsSync69(tokenPath)) {
       writeFileSync35(tokenPath, "", { mode: 384 });
     }
@@ -77565,15 +77767,15 @@ async function ensureHostMountSources(config) {
       chownSync4(tokenPath, uid, uid);
     } catch {}
   }
-  const fleetDir = join68(home2, ".switchroom", "fleet");
+  const fleetDir = join69(home2, ".switchroom", "fleet");
   await mkdir(fleetDir, { recursive: true });
-  const invariantsPath = join68(fleetDir, "switchroom-invariants.md");
+  const invariantsPath = join69(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
   const invariantsCurrent = existsSync69(invariantsPath) ? readFileSync56(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
     writeFileSync35(invariantsPath, invariantsCanonical, { mode: 420 });
   }
-  const fleetClaudePath = join68(fleetDir, "CLAUDE.md");
+  const fleetClaudePath = join69(fleetDir, "CLAUDE.md");
   if (!existsSync69(fleetClaudePath)) {
     writeFileSync35(fleetClaudePath, [
       "# Switchroom fleet defaults",
@@ -77656,10 +77858,10 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 `));
   }
 }
-function writeInstallTypeCache(homeDir = homedir38()) {
+function writeInstallTypeCache(homeDir = homedir39()) {
   const ctx = detectInstallType();
-  const dir = join68(homeDir, ".switchroom");
-  const out = join68(dir, "install-type.json");
+  const dir = join69(homeDir, ".switchroom");
+  const out = join69(dir, "install-type.json");
   const tmp = `${out}.tmp`;
   mkdirSync38(dir, { recursive: true });
   const payload = {
@@ -77708,14 +77910,14 @@ Applying switchroom config...
       writeOut(source_default.green(`  + ${name}`) + source_default.gray(` (${agentConfig.extends ?? "default"}) \u2014 ${detail}
 `));
       try {
-        installUpdatePromptHook(join68(agentsDir, name));
+        installUpdatePromptHook(join69(agentsDir, name));
       } catch (hookErr) {
         writeOut(source_default.gray(`    (update-prompt hook install failed for ${name}: ${hookErr.message})
 `));
       }
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join68(agentsDir, name), uid, {
+        alignAgentUid(name, join69(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -77752,7 +77954,7 @@ Applying switchroom config...
     for (const name of agentNames) {
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join68(agentsDir, name), uid, {
+        alignAgentUid(name, join69(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -77766,7 +77968,7 @@ Applying switchroom config...
   }
   const vaultPathConfigured = config.vault?.path;
   const customVaultPath = vaultPathConfigured ? resolvePath(vaultPathConfigured) : undefined;
-  const migrationResult = migrateVaultLayout(homedir38(), {
+  const migrationResult = migrateVaultLayout(homedir39(), {
     customVaultPath
   });
   switch (migrationResult.kind) {
@@ -77792,7 +77994,7 @@ Applying switchroom config...
       writeErr(formatDivergentRecoveryMessage(migrationResult.details));
       process.exit(4);
   }
-  const postMigrationInspect = inspectVaultLayout(homedir38());
+  const postMigrationInspect = inspectVaultLayout(homedir39());
   const acceptable = [
     "no-vault",
     "already-migrated",
@@ -77807,7 +78009,7 @@ Applying switchroom config...
 `));
     process.exit(5);
   }
-  const vaultDir = resolveVaultBindMountDir(homedir38(), {
+  const vaultDir = resolveVaultBindMountDir(homedir39(), {
     migrationKind: migrationResult.kind,
     customVaultPath
   });
@@ -77837,7 +78039,7 @@ Applying switchroom config...
     imageTag: composeImageTag,
     buildMode: options.buildLocal ? "local" : "pull",
     buildContext: options.buildContext,
-    homeDir: homedir38(),
+    homeDir: homedir39(),
     switchroomConfigPath,
     operatorUid
   });
@@ -77857,7 +78059,7 @@ Wrote `) + composePath + source_default.gray(` (${composeBytes} bytes)
   writeOut(source_default.gray(`  (If pull returns 401, login to ghcr.io first: see docs/operators/install.md#ghcr-auth)
 `));
   if (process.geteuid?.() === 0 && operatorUid !== undefined) {
-    const restored = restoreOperatorOwnership(homedir38(), operatorUid);
+    const restored = restoreOperatorOwnership(homedir39(), operatorUid);
     if (restored.length > 0) {
       writeOut(source_default.gray(`  Restored operator ownership of ${restored.length} ~/.switchroom path(s)
 `));
@@ -77927,7 +78129,7 @@ function findUnwritableAgentDirs(config, opts) {
   const targets = opts.only ? [opts.only] : Object.keys(config.agents ?? {});
   const unwritable = [];
   for (const name of targets) {
-    const startSh = join68(agentsDir, name, "start.sh");
+    const startSh = join69(agentsDir, name, "start.sh");
     if (!existsSync69(startSh))
       continue;
     try {
@@ -78107,8 +78309,8 @@ function runRedactStdin() {
 
 // src/cli/status-ask.ts
 import { readFileSync as readFileSync57, existsSync as existsSync70, readdirSync as readdirSync26 } from "node:fs";
-import { join as join69 } from "node:path";
-import { homedir as homedir39 } from "node:os";
+import { join as join70 } from "node:path";
+import { homedir as homedir40 } from "node:os";
 
 // src/status-ask/report.ts
 function parseJsonl(content) {
@@ -78443,7 +78645,7 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join69(homedir39(), ".switchroom", "agents");
+    agentsDir = join70(homedir40(), ".switchroom", "agents");
   }
   if (!existsSync70(agentsDir))
     return [];
@@ -78455,7 +78657,7 @@ function resolveSources(explicitPath) {
     return [];
   }
   for (const name of entries) {
-    const path8 = join69(agentsDir, name, "runtime-metrics.jsonl");
+    const path8 = join70(agentsDir, name, "runtime-metrics.jsonl");
     if (existsSync70(path8)) {
       sources.push({ path: path8, agent: name });
     }
@@ -78477,17 +78679,17 @@ function inferAgentFromPath(p) {
 
 // src/cli/agent-config.ts
 init_helpers();
-import { join as join70 } from "node:path";
-import { homedir as homedir40 } from "node:os";
+import { join as join71 } from "node:path";
+import { homedir as homedir41 } from "node:os";
 import {
   existsSync as existsSync71,
   mkdirSync as mkdirSync39,
   appendFileSync as appendFileSync4,
   readFileSync as readFileSync58
 } from "node:fs";
-var AUDIT_ROOT = join70(homedir40(), ".switchroom", "audit");
+var AUDIT_ROOT = join71(homedir41(), ".switchroom", "audit");
 function auditPathFor(agent) {
-  return join70(AUDIT_ROOT, agent, "agent-config.jsonl");
+  return join71(AUDIT_ROOT, agent, "agent-config.jsonl");
 }
 function appendAudit(agent, cmd, args, exit, opts = {}) {
   const row = {
@@ -78745,21 +78947,21 @@ import {
   unlinkSync as unlinkSync14,
   writeSync as writeSync8
 } from "node:fs";
-import { join as join71, resolve as resolve44 } from "node:path";
+import { join as join72, resolve as resolve44 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
   const base = opts.root ? resolve44(opts.root, agent) : resolve44(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join71(base, "schedule.d");
-  const scheduleStagingDir = join71(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join71(base, "skills.d");
-  const skillsStagingDir = join71(skillsDir, STAGING_SUBDIR);
+  const scheduleDir = join72(base, "schedule.d");
+  const scheduleStagingDir = join72(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join72(base, "skills.d");
+  const skillsStagingDir = join72(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join71(base, ".lock"),
+    lockPath: join72(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
@@ -78813,8 +79015,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join71(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join71(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join72(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join72(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -78830,8 +79032,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join71(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join71(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join72(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join72(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -78846,7 +79048,7 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join71(paths.skillsDir, `${slug}.yaml`);
+    const finalPath = join72(paths.skillsDir, `${slug}.yaml`);
     if (!existsSync72(finalPath))
       return false;
     unlinkSync14(finalPath);
@@ -78861,7 +79063,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync27(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join71(paths.skillsDir, name);
+    const full = join72(paths.skillsDir, name);
     try {
       const raw = readFileSync59(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -78873,7 +79075,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join71(paths.scheduleDir, `${slug}.yaml`);
+    const finalPath = join72(paths.scheduleDir, `${slug}.yaml`);
     if (!existsSync72(finalPath))
       return false;
     unlinkSync14(finalPath);
@@ -78888,7 +79090,7 @@ function listOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync27(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join71(paths.scheduleDir, name);
+    const full = join72(paths.scheduleDir, name);
     try {
       const raw = readFileSync59(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -79044,12 +79246,12 @@ import {
   writeFileSync as writeFileSync36,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join72 } from "node:path";
+import { join as join73 } from "node:path";
 import { randomBytes as randomBytes14 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join72(paths.scheduleDir, ".pending");
+  return join73(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
@@ -79062,8 +79264,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join72(dir, `${stageId}.yaml`);
-  const metaPath = join72(dir, `${stageId}.meta.json`);
+  const yamlPath = join73(dir, `${stageId}.yaml`);
+  const metaPath = join73(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -79097,8 +79299,8 @@ function listPendingScheduleEntries(agent, opts = {}) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join72(dir, name);
-    const yamlPath = join72(dir, `${stageId}.yaml`);
+    const metaPath = join73(dir, name);
+    const yamlPath = join73(dir, `${stageId}.yaml`);
     if (!existsSync73(yamlPath))
       continue;
     try {
@@ -79117,7 +79319,7 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join72(paths.scheduleDir, `${slug}.yaml`);
+  const finalPath = join73(paths.scheduleDir, `${slug}.yaml`);
   if (existsSync73(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
@@ -79623,7 +79825,7 @@ var import_yaml16 = __toESM(require_dist(), 1);
 import { existsSync as existsSync75 } from "node:fs";
 init_reconcile_default_skills();
 var import_yaml17 = __toESM(require_dist(), 1);
-import { join as join73 } from "node:path";
+import { join as join74 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -79698,7 +79900,7 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join73(poolDir, skillName);
+  const skillPath = join74(poolDir, skillName);
   if (!existsSync75(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
@@ -79876,8 +80078,8 @@ import {
   statSync as statSync29,
   writeFileSync as writeFileSync37
 } from "node:fs";
-import { tmpdir as tmpdir4, homedir as homedir41 } from "node:os";
-import { dirname as dirname22, join as join74, relative as relative2, resolve as resolve45 } from "node:path";
+import { tmpdir as tmpdir4, homedir as homedir42 } from "node:os";
+import { dirname as dirname22, join as join75, relative as relative2, resolve as resolve45 } from "node:path";
 import { spawnSync as spawnSync10 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -80071,10 +80273,10 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join74(homedir41(), raw.slice(2));
+    return join75(homedir42(), raw.slice(2));
   }
   if (raw === "~")
-    return homedir41();
+    return homedir42();
   return resolve45(raw);
 }
 function readStdinSync() {
@@ -80110,7 +80312,7 @@ function loadFromDir(dir) {
   const walk2 = (sub) => {
     const entries = readdirSync29(sub, { withFileTypes: true });
     for (const ent of entries) {
-      const full = join74(sub, ent.name);
+      const full = join75(sub, ent.name);
       const rel = relative2(abs, full);
       if (ent.isSymbolicLink()) {
         fail2(`refusing to read symlink inside --from dir: ${rel}`);
@@ -80145,7 +80347,7 @@ function loadFromTarball(tarPath) {
       fail2(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
-  const staging = mkdtempSync5(join74(tmpdir4(), "skill-apply-extract-"));
+  const staging = mkdtempSync5(join75(tmpdir4(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
     const r = spawnSync10("tar", [
@@ -80231,8 +80433,8 @@ function validatePayload(name, files) {
           errors2.push(`${path8} fails \`bash -n\` syntax check: ${(r.stderr ?? "").trim()}`);
         }
       } else if (PY_SCRIPT_RE2.test(path8)) {
-        const tmp = mkdtempSync5(join74(tmpdir4(), "skill-apply-py-"));
-        const tmpPy = join74(tmp, "check.py");
+        const tmp = mkdtempSync5(join75(tmpdir4(), "skill-apply-py-"));
+        const tmpPy = join75(tmp, "check.py");
         try {
           writeFileSync37(tmpPy, content);
           const r = spawnSync10("python3", ["-m", "py_compile", tmpPy], {
@@ -80255,7 +80457,7 @@ function diffSummary(currentDir, files) {
   if (existsSync76(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync29(sub, { withFileTypes: true })) {
-        const full = join74(sub, ent.name);
+        const full = join75(sub, ent.name);
         const rel = relative2(currentDir, full);
         if (ent.isDirectory()) {
           walk2(full);
@@ -80291,7 +80493,7 @@ function writePayload(poolDir, name, files) {
   if (!existsSync76(poolDir)) {
     mkdirSync42(poolDir, { recursive: true, mode: 493 });
   }
-  const target = join74(poolDir, name);
+  const target = join75(poolDir, name);
   let targetIsSymlink = false;
   try {
     const st = lstatSync8(target);
@@ -80302,11 +80504,11 @@ function writePayload(poolDir, name, files) {
   if (targetIsSymlink) {
     fail2(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
-  const staging = mkdtempSync5(join74(poolDir, `.skill-apply-stage-${name}-`));
+  const staging = mkdtempSync5(join75(poolDir, `.skill-apply-stage-${name}-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join74(staging, path8);
+      const full = join75(staging, path8);
       mkdirSync42(dirname22(full), { recursive: true, mode: 493 });
       const fd = openSync15(full, "wx");
       try {
@@ -80384,7 +80586,7 @@ function registerSkillCommand(program3) {
     }
     const config = loadConfig();
     const poolDir = resolveSkillsPoolDir2(config.switchroom?.skills_dir);
-    const currentDir = join74(poolDir, name);
+    const currentDir = join75(poolDir, name);
     console.log(source_default.bold(`Skill: ${name}`) + source_default.gray(` (${Object.keys(files).length} files, ${sumBytes(files)} bytes)`));
     console.log(source_default.bold("Diff vs current pool content:"));
     console.log(diffSummary(currentDir, files));
@@ -80428,8 +80630,8 @@ import {
   utimesSync,
   writeFileSync as writeFileSync38
 } from "node:fs";
-import { dirname as dirname23, join as join75, relative as relative3, resolve as resolve46 } from "node:path";
-import { homedir as homedir42, tmpdir as tmpdir5 } from "node:os";
+import { dirname as dirname23, join as join76, relative as relative3, resolve as resolve46 } from "node:path";
+import { homedir as homedir43, tmpdir as tmpdir5 } from "node:os";
 import { spawnSync as spawnSync11 } from "node:child_process";
 init_helpers();
 init_source();
@@ -80439,10 +80641,10 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve46(override) : join75(homedir42(), ".switchroom-config");
+  const candidate = override ? resolve46(override) : join76(homedir43(), ".switchroom-config");
   if (!existsSync77(candidate))
     return null;
-  return join75(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
+  return join76(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
@@ -80460,7 +80662,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync17(join75(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync17(join76(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -80469,7 +80671,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   const configSkillsRoot = resolveConfigSkillsDir(agent);
   if (!configSkillsRoot)
     return;
-  const dest = join75(configSkillsRoot, name);
+  const dest = join76(configSkillsRoot, name);
   try {
     if (liveSkillDir !== null) {
       try {
@@ -80484,19 +80686,19 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
       if (existsSync77(dest)) {
-        const trash = join75(configSkillsRoot, `.${name}-trash-${Date.now()}`);
+        const trash = join76(configSkillsRoot, `.${name}-trash-${Date.now()}`);
         renameSync17(dest, trash);
       }
       return;
     }
     mkdirSync43(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
-    const staging = mkdtempSync6(join75(configSkillsRoot, `.${name}-staging-`));
+    const staging = mkdtempSync6(join76(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
       mkdirSync43(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync30(src, { withFileTypes: true })) {
-        const s = join75(src, ent.name);
-        const d = join75(dst, ent.name);
+        const s = join76(src, ent.name);
+        const d = join76(dst, ent.name);
         if (ent.isSymbolicLink())
           continue;
         if (ent.isDirectory())
@@ -80508,7 +80710,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     };
     walk2(liveSkillDir, staging);
     if (existsSync77(dest)) {
-      const prior = join75(configSkillsRoot, `.${name}-prior-${Date.now()}`);
+      const prior = join76(configSkillsRoot, `.${name}-prior-${Date.now()}`);
       renameSync17(dest, prior);
     }
     renameSync17(staging, dest);
@@ -80535,13 +80737,13 @@ function resolveAgent(opts) {
 function resolveAgentsRoot(opts) {
   if (opts.root)
     return resolve46(opts.root);
-  return join75(homedir42(), ".switchroom", "agents");
+  return join76(homedir43(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
-  return join75(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
+  return join76(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
 }
 function trashDir(agentsRoot, agent) {
-  return join75(agentsRoot, agent, ".claude", TRASH_DIRNAME);
+  return join76(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
 function readStdinSync2() {
   const chunks = [];
@@ -80571,7 +80773,7 @@ function loadFromDir2(dir) {
   const files = {};
   const walk2 = (sub) => {
     for (const ent of readdirSync30(sub, { withFileTypes: true })) {
-      const full = join75(sub, ent.name);
+      const full = join76(sub, ent.name);
       if (ent.isSymbolicLink()) {
         fail3(`refusing to read symlink in --from dir: ${relative3(abs, full)}`);
       }
@@ -80624,8 +80826,8 @@ function behavioralValidate(files) {
         errors2.push(`${path8} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
     } else if (PY_SCRIPT_RE.test(path8)) {
-      const tmp = mkdtempSync6(join75(tmpdir5(), "skill-personal-py-"));
-      const tmpPy = join75(tmp, "check.py");
+      const tmp = mkdtempSync6(join76(tmpdir5(), "skill-personal-py-"));
+      const tmpPy = join76(tmp, "check.py");
       try {
         writeFileSync38(tmpPy, content);
         const r = spawnSync11("python3", ["-m", "py_compile", tmpPy], {
@@ -80649,7 +80851,7 @@ function sweepTrash(agentsRoot, agent) {
   for (const ent of readdirSync30(trash, { withFileTypes: true })) {
     if (!ent.isDirectory())
       continue;
-    const entPath = join75(trash, ent.name);
+    const entPath = join76(trash, ent.name);
     try {
       const st = statSync30(entPath);
       if (now - st.mtimeMs > TRASH_TTL_MS) {
@@ -80670,11 +80872,11 @@ function writePersonalSkill(targetDir, files) {
     fail3(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
   mkdirSync43(dirname23(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join75(dirname23(targetDir), `.skill-personal-stage-`));
+  const staging = mkdtempSync6(join76(dirname23(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join75(staging, path8);
+      const full = join76(staging, path8);
       mkdirSync43(dirname23(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
@@ -80807,10 +81009,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join75(homedir42(), ".switchroom", "skills");
+  return join76(homedir43(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join75(homedir42(), ".switchroom", "skills", "_bundled");
+  return join76(homedir43(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -80820,7 +81022,7 @@ function resolveCloneSource(source, opts) {
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
-  const dir = join75(root, slug);
+  const dir = join76(root, slug);
   if (!existsSync77(dir)) {
     fail3(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
@@ -80836,7 +81038,7 @@ function readSourceFiles(dir) {
   const skipped = [];
   const walk2 = (sub) => {
     for (const ent of readdirSync30(sub, { withFileTypes: true })) {
-      const full = join75(sub, ent.name);
+      const full = join76(sub, ent.name);
       if (ent.isSymbolicLink()) {
         continue;
       }
@@ -80947,7 +81149,7 @@ function removePersonalAction(name, opts) {
   const trashRoot = trashDir(agentsRoot, agent);
   mkdirSync43(trashRoot, { recursive: true, mode: 493 });
   const ts = Date.now();
-  const trashTarget = join75(trashRoot, `${name}-${ts}`);
+  const trashTarget = join76(trashRoot, `${name}-${ts}`);
   renameSync17(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
@@ -80966,7 +81168,7 @@ function listPersonalAction(opts) {
   const agent = resolveAgent(opts);
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
-  const skillsDir = join75(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join76(agentsRoot, agent, ".claude", "skills");
   const personal = [];
   if (existsSync77(skillsDir)) {
     for (const ent of readdirSync30(skillsDir, { withFileTypes: true })) {
@@ -80975,7 +81177,7 @@ function listPersonalAction(opts) {
       if (!ent.name.startsWith(PERSONAL_PREFIX))
         continue;
       const skillName = ent.name.slice(PERSONAL_PREFIX.length);
-      const skillPath = join75(skillsDir, ent.name);
+      const skillPath = join76(skillsDir, ent.name);
       let fileCount = 0;
       let totalBytes = 0;
       const walk2 = (sub) => {
@@ -80983,10 +81185,10 @@ function listPersonalAction(opts) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync30(join75(sub, e.name)).size;
+              totalBytes += statSync30(join76(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
-            walk2(join75(sub, e.name));
+            walk2(join76(sub, e.name));
           }
         }
       };
@@ -81026,22 +81228,22 @@ function registerSkillPersonalCommands(program3) {
 init_helpers();
 var import_yaml19 = __toESM(require_dist(), 1);
 import { existsSync as existsSync78, readdirSync as readdirSync31, readFileSync as readFileSync64, statSync as statSync31 } from "node:fs";
-import { homedir as homedir43 } from "node:os";
-import { join as join76, resolve as resolve47 } from "node:path";
+import { homedir as homedir44 } from "node:os";
+import { join as join77, resolve as resolve47 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
 function defaultAgentsRoot() {
-  return resolve47(homedir43(), ".switchroom/agents");
+  return resolve47(homedir44(), ".switchroom/agents");
 }
 function defaultSharedRoot2() {
-  return resolve47(homedir43(), ".switchroom/skills");
+  return resolve47(homedir44(), ".switchroom/skills");
 }
 function defaultBundledRoot2() {
-  return resolve47(homedir43(), ".switchroom/skills/_bundled");
+  return resolve47(homedir44(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join76(skillDir, "SKILL.md");
+  const mdPath = join77(skillDir, "SKILL.md");
   if (!existsSync78(mdPath))
     return null;
   let content;
@@ -81074,7 +81276,7 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join76(skillDir, "SKILL.md");
+  const mdPath = join77(skillDir, "SKILL.md");
   try {
     const st = statSync31(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
@@ -81085,7 +81287,7 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join76(agentsRoot, agent, ".claude/skills");
+  const skillsDir = join77(agentsRoot, agent, ".claude/skills");
   if (!existsSync78(skillsDir))
     return [];
   const out = [];
@@ -81098,7 +81300,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join76(skillsDir, ent);
+    const dirPath = join77(skillsDir, ent);
     try {
       if (!statSync31(dirPath).isDirectory())
         continue;
@@ -81138,7 +81340,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join76(sharedRoot, ent);
+    const dirPath = join77(sharedRoot, ent);
     try {
       if (!statSync31(dirPath).isDirectory())
         continue;
@@ -81174,7 +81376,7 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join76(bundledRoot, ent);
+    const dirPath = join77(bundledRoot, ent);
     try {
       if (!statSync31(dirPath).isDirectory())
         continue;
@@ -81319,8 +81521,8 @@ function registerHostdMcpCommand(program3) {
 init_source();
 init_helpers();
 import { existsSync as existsSync80, mkdirSync as mkdirSync44, readdirSync as readdirSync32, readFileSync as readFileSync66, writeFileSync as writeFileSync39, statSync as statSync32, copyFileSync as copyFileSync12 } from "node:fs";
-import { homedir as homedir44 } from "node:os";
-import { join as join77 } from "node:path";
+import { homedir as homedir45 } from "node:os";
+import { join as join78 } from "node:path";
 import { spawnSync as spawnSync13 } from "node:child_process";
 init_audit_reader();
 var DEFAULT_IMAGE_TAG = "latest";
@@ -81411,10 +81613,10 @@ networks:
 `;
 }
 function hostdDir() {
-  return join77(homedir44(), ".switchroom", "hostd");
+  return join78(homedir45(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join77(hostdDir(), "docker-compose.yml");
+  return join78(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
@@ -81453,7 +81655,7 @@ async function doInstall(opts, program3) {
   const composePath = hostdComposePath();
   mkdirSync44(dir, { recursive: true });
   const yaml = renderHostdComposeFile({
-    hostHome: homedir44(),
+    hostHome: homedir45(),
     imageTag: opts.tag ?? DEFAULT_IMAGE_TAG,
     operatorUid: resolveOperatorUid()
   });
@@ -81522,7 +81724,7 @@ function doStatus() {
       for (const name of readdirSync32(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join77(dir, name, "sock");
+        const sockPath = join78(dir, name, "sock");
         if (existsSync80(sockPath)) {
           const st = statSync32(sockPath);
           if ((st.mode & 61440) === 49152) {