switchroom 0.14.0 → 0.14.1

package/telegram-plugin/dist/gateway/gateway.js

@@ -28823,6 +28823,115 @@ var init_boot_issue_cache = __esm(() => {
   EMPTY_CACHE = { schema: 1, probes: {} };
 });
 
+// gateway/config-snapshot.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync26, readFileSync as readFileSync25, writeFileSync as writeFileSync15, mkdirSync as mkdirSync13, renameSync as renameSync10 } from "fs";
+import { dirname as dirname10 } from "path";
+function hashStringArray(items) {
+  if (!items || items.length === 0)
+    return null;
+  const sorted = [...items].sort();
+  const raw = createHash2("sha256").update(sorted.join("\x00")).digest("hex");
+  return raw.slice(0, 12);
+}
+function normalizeModel(model) {
+  if (!model || model.trim().length === 0)
+    return null;
+  return model.trim().toLowerCase();
+}
+function captureConfigSnapshot(input) {
+  return {
+    schema: 1,
+    capturedAtMs: (input.now ?? Date.now)(),
+    model: normalizeModel(input.model),
+    toolsHash: hashStringArray(input.toolsAllow ?? null),
+    skillsHash: hashStringArray(input.skills ?? null),
+    memoryBackend: input.memoryCollection?.trim() || null
+  };
+}
+function diffSnapshots(current, previous) {
+  if (previous === null)
+    return [];
+  const changes = [];
+  if (current.model !== previous.model) {
+    changes.push({ field: "model", from: previous.model, to: current.model });
+  }
+  if (current.toolsHash !== previous.toolsHash) {
+    changes.push({ field: "tools", from: previous.toolsHash, to: current.toolsHash });
+  }
+  if (current.skillsHash !== previous.skillsHash) {
+    changes.push({ field: "skills", from: previous.skillsHash, to: current.skillsHash });
+  }
+  if (current.memoryBackend !== previous.memoryBackend) {
+    changes.push({
+      field: "memoryBackend",
+      from: previous.memoryBackend,
+      to: current.memoryBackend
+    });
+  }
+  return changes;
+}
+function renderConfigChangeDim(dim) {
+  switch (dim.field) {
+    case "model": {
+      const from = escapeHtml8(dim.from ?? "(default)");
+      const to = escapeHtml8(dim.to ?? "(default)");
+      return `\u2699\ufe0f <b>Config</b>  model: ${from} \u2192 ${to}`;
+    }
+    case "memoryBackend": {
+      const from = escapeHtml8(dim.from ?? "(default)");
+      const to = escapeHtml8(dim.to ?? "(default)");
+      return `\u2699\ufe0f <b>Config</b>  memory backend: ${from} \u2192 ${to}`;
+    }
+    case "tools":
+      return `\u2699\ufe0f <b>Config</b>  tools allowlist changed \u2014 run /status for details`;
+    case "skills":
+      return `\u2699\ufe0f <b>Config</b>  skills changed \u2014 run /status for details`;
+  }
+}
+function loadSnapshot(path, now = Date.now) {
+  if (!existsSync26(path))
+    return null;
+  let raw;
+  try {
+    raw = readFileSync25(path, "utf-8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    try {
+      renameSync10(path, `${path}.corrupt-${now()}`);
+    } catch {}
+    return null;
+  }
+  const obj = parsed;
+  if (!obj || obj.schema !== 1)
+    return null;
+  if (typeof obj.capturedAtMs !== "number" || !("model" in obj) || !("toolsHash" in obj) || !("skillsHash" in obj) || !("memoryBackend" in obj)) {
+    return null;
+  }
+  return {
+    schema: 1,
+    capturedAtMs: obj.capturedAtMs,
+    model: obj.model ?? null,
+    toolsHash: obj.toolsHash ?? null,
+    skillsHash: obj.skillsHash ?? null,
+    memoryBackend: obj.memoryBackend ?? null
+  };
+}
+function persistSnapshot(path, snapshot) {
+  try {
+    mkdirSync13(dirname10(path), { recursive: true });
+    const tmp = `${path}.tmp`;
+    writeFileSync15(tmp, JSON.stringify(snapshot), { mode: 384 });
+    renameSync10(tmp, path);
+  } catch {}
+}
+var init_config_snapshot = () => {};
+
 // gateway/boot-card.ts
 var exports_boot_card = {};
 __export(exports_boot_card, {
@@ -28899,6 +29008,12 @@ function renderBootCard(opts) {
     }
   }
   const accountRows = opts.accounts ? renderAuthLine(opts.accounts, agentName3, (opts.now ?? new Date).getTime()) : [];
+  const configChangeRows = [];
+  if (opts.configChanges && opts.configChanges.length > 0) {
+    for (const dim of opts.configChanges) {
+      configChangeRows.push(renderConfigChangeDim(dim));
+    }
+  }
   const sections = [ack];
   if (degradedRows.length > 0)
     sections.push("", ...degradedRows);
@@ -28908,6 +29023,9 @@ function renderBootCard(opts) {
     sections.push("", ...opts.updateOutcomeLine.split(`
 `));
   }
+  if (configChangeRows.length > 0) {
+    sections.push("", ...configChangeRows);
+  }
   if (sections.length === 1)
     return ack;
   return sections.join(`
@@ -29011,6 +29129,38 @@ async function startBootCard(chatId, threadId, bot, opts, ackMessageId, log) {
             applyAndSave(opts.bootIssueCachePath, cache, diff);
           } catch (diffErr) {
             logger2(`telegram gateway: boot-card: issue-dedup diff failed: ${diffErr?.message ?? String(diffErr)}
+`);
+          }
+        }
+        let configChanges = [];
+        if (opts.configSnapshotPath) {
+          try {
+            const agentSlug = opts.agentSlug ?? opts.agentName;
+            const agentName3 = process.env.SWITCHROOM_AGENT_NAME ?? agentSlug;
+            let currentCfg;
+            try {
+              const loaded = loadConfig();
+              const rawAgent = loaded.agents?.[agentName3] ?? {};
+              const resolved = resolveAgentConfig(loaded.defaults, loaded.profiles, rawAgent);
+              currentCfg = captureConfigSnapshot({
+                agentName: agentName3,
+                model: resolved.model,
+                toolsAllow: resolved.tools?.allow,
+                skills: resolved.skills,
+                memoryCollection: resolved.memory?.collection
+              });
+            } catch {}
+            if (currentCfg != null) {
+              const previousSnapshot = loadSnapshot(opts.configSnapshotPath);
+              configChanges = diffSnapshots(currentCfg, previousSnapshot);
+              persistSnapshot(opts.configSnapshotPath, currentCfg);
+              if (configChanges.length > 0) {
+                logger2(`telegram gateway: boot-card: config-snapshot diff detected ${configChanges.length} change(s): ${configChanges.map((d) => d.field).join(", ")}
+`);
+              }
+            }
+          } catch (snapErr) {
+            logger2(`telegram gateway: boot-card: config-snapshot diff failed: ${snapErr?.message ?? String(snapErr)}
 `);
           }
         }
@@ -29024,7 +29174,8 @@ async function startBootCard(chatId, threadId, bot, opts, ackMessageId, log) {
           ...accountRows ? { accounts: accountRows } : {},
           ...resolvedRows.length > 0 ? { resolvedRows } : {},
           ...snoozeRows.length > 0 ? { snoozeRows } : {},
-          ...opts.updateOutcomeLine ? { updateOutcomeLine: opts.updateOutcomeLine } : {}
+          ...opts.updateOutcomeLine ? { updateOutcomeLine: opts.updateOutcomeLine } : {},
+          ...configChanges.length > 0 ? { configChanges } : {}
         });
         if (currentText !== ackText) {
           try {
@@ -29066,7 +29217,8 @@ async function startBootCard(chatId, threadId, bot, opts, ackMessageId, log) {
             ...accountRows ? { accounts: accountRows } : {},
             ...resolvedRows.length > 0 ? { resolvedRows } : {},
             ...snoozeRows.length > 0 ? { snoozeRows } : {},
-            ...opts.updateOutcomeLine ? { updateOutcomeLine: opts.updateOutcomeLine } : {}
+            ...opts.updateOutcomeLine ? { updateOutcomeLine: opts.updateOutcomeLine } : {},
+            ...configChanges.length > 0 ? { configChanges } : {}
           });
           if (updatedText === currentText)
             continue;
@@ -29108,7 +29260,9 @@ var SETTLE_WINDOW_MS = 6000, DOT, PROBE_LABELS, PROBE_KEYS, REASON_EMOJI, REASON
 var init_boot_card = __esm(() => {
   init_boot_probes();
   init_boot_issue_cache();
+  init_config_snapshot();
   init_loader();
+  init_merge();
   DOT = {
     ok: "\uD83D\uDFE2",
     degraded: "\uD83D\uDFE1",
@@ -29150,17 +29304,357 @@ var init_boot_card = __esm(() => {
   };
 });
 
+// auth-snapshot-format.ts
+var exports_auth_snapshot_format = {};
+__export(exports_auth_snapshot_format, {
+  reviveLastQuota: () => reviveLastQuota,
+  renderFallbackAnnouncement: () => renderFallbackAnnouncement2,
+  renderAuthSnapshotFormat2: () => renderAuthSnapshotFormat22,
+  recommendation: () => recommendation2,
+  formatRelative: () => formatRelative2,
+  formatAbsolute: () => formatAbsolute2,
+  fmtPct: () => fmtPct2,
+  classifyHealth: () => classifyHealth2,
+  buildSnapshotsFromState: () => buildSnapshotsFromState2,
+  buildSnapshotsFromCachedState: () => buildSnapshotsFromCachedState,
+  buildSnapshotKeyboard: () => buildSnapshotKeyboard2,
+  bindingWindow: () => bindingWindow3,
+  THROTTLING_THRESHOLD_PCT: () => THROTTLING_THRESHOLD_PCT2
+});
+function classifyHealth2(snap) {
+  if (!snap.quota)
+    return "unknown";
+  const q = snap.quota;
+  const max = Math.max(q.fiveHourUtilizationPct, q.sevenDayUtilizationPct);
+  if (max >= 99.5)
+    return "blocked";
+  if (max >= THROTTLING_THRESHOLD_PCT2)
+    return "throttling";
+  return "healthy";
+}
+function bindingWindow3(q) {
+  if (q.representativeClaim === "seven_day")
+    return "7d";
+  if (q.representativeClaim === "five_hour")
+    return "5h";
+  return q.sevenDayUtilizationPct >= q.fiveHourUtilizationPct ? "7d" : "5h";
+}
+function formatRelative2(target, now = new Date) {
+  if (!target)
+    return "\u2014";
+  const deltaMs = target.getTime() - now.getTime();
+  if (deltaMs <= 0)
+    return "now";
+  const totalMin = Math.round(deltaMs / 60000);
+  if (totalMin < 60)
+    return `${totalMin}m`;
+  const h = Math.floor(totalMin / 60);
+  const m = totalMin % 60;
+  if (h < 24)
+    return m > 0 ? `${h}h ${m}m` : `${h}h`;
+  const d = Math.floor(h / 24);
+  const rh = h % 24;
+  return rh > 0 ? `${d}d ${rh}h` : `${d}d`;
+}
+function formatAbsolute2(target, tz = "UTC") {
+  if (!target)
+    return "\u2014";
+  return target.toLocaleString("en-US", {
+    timeZone: tz,
+    weekday: "short",
+    hour: "numeric",
+    minute: "2-digit",
+    hour12: true
+  });
+}
+function fmtPct2(pct) {
+  return `${Math.round(pct)}%`;
+}
+function groupHeader2(health, count) {
+  const emoji = HEALTH_EMOJI2[health];
+  const title = HEALTH_TITLE2[health];
+  return `${emoji} <b>${title}</b> (${count})`;
+}
+function renderAccountRow2(snap, opts) {
+  const now = opts.now ?? new Date;
+  const tz = opts.tz ?? "UTC";
+  const lines = [];
+  const marker = snap.isActive ? "\u25cf " : "";
+  if (!snap.quota) {
+    lines.push(`${marker}<code>${escapeHtml12(snap.label)}</code>  <i>quota probe failed</i>`);
+    if (snap.quotaError) {
+      lines.push(`  <i>${escapeHtml12(snap.quotaError)}</i>`);
+    }
+    return lines;
+  }
+  const q = snap.quota;
+  const fiveStr = fmtPct2(q.fiveHourUtilizationPct);
+  const sevenStr = fmtPct2(q.sevenDayUtilizationPct);
+  lines.push(`${marker}<code>${escapeHtml12(snap.label)}</code>  ${fiveStr} / ${sevenStr}`);
+  const health = classifyHealth2(snap);
+  if (health === "blocked") {
+    const win = bindingWindow3(q);
+    const reset2 = win === "5h" ? q.fiveHourResetAt : q.sevenDayResetAt;
+    const winLabel = win === "5h" ? "5-hour" : "7-day";
+    lines.push(`  <i>back ${formatAbsolute2(reset2, tz)} (in ${formatRelative2(reset2, now)}, ${winLabel} cap)</i>`);
+    return lines;
+  }
+  const fiveResetIn = q.fiveHourResetAt ? q.fiveHourResetAt.getTime() - now.getTime() : Infinity;
+  const sevenResetIn = q.sevenDayResetAt ? q.sevenDayResetAt.getTime() - now.getTime() : Infinity;
+  const fiveFirst = fiveResetIn <= sevenResetIn;
+  const fiveSeg = q.fiveHourResetAt ? `5h refills ${formatAbsolute2(q.fiveHourResetAt, tz)} (in ${formatRelative2(q.fiveHourResetAt, now)})` : "5h refills \u2014";
+  const sevenSeg = q.sevenDayResetAt ? `7d resets ${formatAbsolute2(q.sevenDayResetAt, tz)} (in ${formatRelative2(q.sevenDayResetAt, now)})` : "7d resets \u2014";
+  lines.push(`  <i>${fiveFirst ? fiveSeg : sevenSeg}  \u00b7  ${fiveFirst ? sevenSeg : fiveSeg}</i>`);
+  return lines;
+}
+function renderAuthSnapshotFormat22(snapshots, opts = {}) {
+  const now = opts.now ?? new Date;
+  const lines = [];
+  lines.push("\uD83D\uDD0B <b>Auth \u2014 fleet status</b>");
+  const order = ["blocked", "throttling", "healthy", "unknown"];
+  const grouped = new Map;
+  for (const s of snapshots) {
+    const h = classifyHealth2(s);
+    if (!grouped.has(h))
+      grouped.set(h, []);
+    grouped.get(h).push(s);
+  }
+  for (const arr of grouped.values()) {
+    arr.sort((a, b) => Number(b.isActive) - Number(a.isActive));
+  }
+  for (const h of order) {
+    const arr = grouped.get(h);
+    if (!arr || arr.length === 0)
+      continue;
+    lines.push("");
+    lines.push(groupHeader2(h, arr.length));
+    for (const s of arr) {
+      for (const ln of renderAccountRow2(s, opts))
+        lines.push(ln);
+    }
+  }
+  lines.push("");
+  lines.push("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  lines.push(`<i>${recommendation2(snapshots, now)}</i>`);
+  if (opts.liveProbedAtMs != null) {
+    const ageSec = Math.max(0, Math.round((Date.now() - opts.liveProbedAtMs) / 1000));
+    const ageStr = ageSec < 60 ? `${ageSec}s ago` : `${Math.round(ageSec / 60)}m ago`;
+    lines.push(`<i>Live \u00b7 refreshed ${ageStr}</i>`);
+  } else {
+    lines.push("<i>Live</i>");
+  }
+  return lines.join(`
+`);
+}
+function recommendation2(snapshots, now = new Date) {
+  const active = snapshots.find((s) => s.isActive);
+  if (!active)
+    return "No active account set.";
+  const activeHealth = classifyHealth2(active);
+  const others = snapshots.filter((s) => !s.isActive);
+  const healthyAlt = others.find((s) => classifyHealth2(s) === "healthy");
+  if (activeHealth === "healthy") {
+    return `Recommendation: stay on ${active.label}.`;
+  }
+  if (activeHealth === "throttling") {
+    if (healthyAlt) {
+      return `Recommendation: active ${active.label} is throttling. Switch to ${healthyAlt.label} for headroom.`;
+    }
+    return `Recommendation: active ${active.label} is throttling; no healthy alternative \u2014 wait for refill.`;
+  }
+  if (activeHealth === "blocked") {
+    if (healthyAlt) {
+      return `Recommendation: active ${active.label} is BLOCKED \u2014 switch to ${healthyAlt.label} now.`;
+    }
+    const earliestRecovery = pickEarliestRecovery2(snapshots, now);
+    if (earliestRecovery) {
+      return `All accounts blocked. Earliest recovery: ${earliestRecovery.label} in ${formatRelative2(earliestRecovery.at, now)}.`;
+    }
+    return `All accounts blocked. Run /auth add to attach another subscription.`;
+  }
+  return `Active ${active.label}: quota probe failed; broker last_seen unknown.`;
+}
+function pickEarliestRecovery2(snapshots, now) {
+  let best = null;
+  for (const s of snapshots) {
+    if (!s.quota)
+      continue;
+    const win = bindingWindow3(s.quota);
+    const at = win === "5h" ? s.quota.fiveHourResetAt : s.quota.sevenDayResetAt;
+    if (!at || at.getTime() <= now.getTime())
+      continue;
+    if (!best || at.getTime() < best.at.getTime()) {
+      best = { label: s.label, at };
+    }
+  }
+  return best;
+}
+function renderFallbackAnnouncement2(input) {
+  const now = input.now ?? new Date;
+  const tz = input.tz ?? "UTC";
+  const lines = [];
+  const limitWord = input.oldQuota ? limitWordFor2(input.oldQuota) : "quota";
+  const headerLimit = limitWord === "quota" ? "quota cap" : `${limitWord} limit`;
+  if (!input.newLabel) {
+    lines.push(`\uD83D\uDD34 <b>All accounts blocked \u00b7 ${headerLimit} on ${escapeHtml12(input.oldLabel)}</b>`);
+    lines.push("");
+    lines.push(`Triggered by: agent <b>${escapeHtml12(input.triggerAgent)}</b>`);
+    if (input.oldQuota) {
+      const recovery = recoveryAtFor2(input.oldQuota);
+      if (recovery) {
+        lines.push(`${escapeHtml12(input.oldLabel)} recovers ${formatAbsolute2(recovery, tz)} ` + `(in ${formatRelative2(recovery, now)})`);
+      }
+    }
+    lines.push("");
+    lines.push(`Run <code>/auth add &lt;label&gt;</code> to attach another subscription, ` + `or <code>/auth refresh</code> to re-probe.`);
+    return lines.join(`
+`);
+  }
+  lines.push(`\u2713 <b>Switched fleet \u00b7 ${headerLimit} on ${escapeHtml12(input.oldLabel)}</b>`);
+  lines.push("");
+  lines.push(`<code>${escapeHtml12(input.oldLabel)}</code> \u2192 <code>${escapeHtml12(input.newLabel)}</code>`);
+  lines.push(`Triggered by: agent <b>${escapeHtml12(input.triggerAgent)}</b>`);
+  lines.push("");
+  if (input.oldQuota) {
+    const recovery = recoveryAtFor2(input.oldQuota);
+    if (recovery) {
+      lines.push(`<code>${escapeHtml12(input.oldLabel)}</code> recovers ` + `${formatAbsolute2(recovery, tz)} (in ${formatRelative2(recovery, now)})`);
+    }
+  }
+  if (input.newQuota) {
+    const fiveStr = fmtPct2(input.newQuota.fiveHourUtilizationPct);
+    const sevenStr = fmtPct2(input.newQuota.sevenDayUtilizationPct);
+    const hasHeadroom = input.newQuota.fiveHourUtilizationPct < THROTTLING_THRESHOLD_PCT2 && input.newQuota.sevenDayUtilizationPct < THROTTLING_THRESHOLD_PCT2;
+    const headroomStr = hasHeadroom ? "<i>(plenty of headroom)</i>" : "<i>(near limit \u2014 watch this)</i>";
+    lines.push(`<code>${escapeHtml12(input.newLabel)}</code> now: ${fiveStr} of 5h \u00b7 ${sevenStr} of 7d ${headroomStr}`);
+  } else {
+    lines.push(`<i>(quota probe for new account is pending \u2014 will reflect on next /auth)</i>`);
+  }
+  return lines.join(`
+`);
+}
+function limitWordFor2(q) {
+  if (q.representativeClaim === "seven_day" && q.sevenDayUtilizationPct >= 99)
+    return "7-day";
+  if (q.representativeClaim === "five_hour" && q.fiveHourUtilizationPct >= 99)
+    return "5-hour";
+  if (q.sevenDayUtilizationPct >= 99)
+    return "7-day";
+  if (q.fiveHourUtilizationPct >= 99)
+    return "5-hour";
+  return q.sevenDayUtilizationPct >= q.fiveHourUtilizationPct ? "7-day" : "5-hour";
+}
+function recoveryAtFor2(q) {
+  const word = limitWordFor2(q);
+  if (word === "7-day")
+    return q.sevenDayResetAt;
+  if (word === "5-hour")
+    return q.fiveHourResetAt;
+  if (!q.fiveHourResetAt)
+    return q.sevenDayResetAt;
+  if (!q.sevenDayResetAt)
+    return q.fiveHourResetAt;
+  return q.fiveHourResetAt.getTime() < q.sevenDayResetAt.getTime() ? q.fiveHourResetAt : q.sevenDayResetAt;
+}
+function buildSnapshotKeyboard2(snapshots, opts = {}) {
+  const max = opts.maxSwitchButtons ?? 3;
+  const rows = [];
+  const switchTargets = snapshots.filter((s) => !s.isActive).sort((a, b) => switchPriority2(a) - switchPriority2(b)).filter((s) => classifyHealth2(s) !== "blocked" && classifyHealth2(s) !== "unknown").slice(0, max);
+  for (const t of switchTargets) {
+    rows.push([
+      {
+        text: `Switch fleet \u2192 ${t.label}`,
+        callbackData: `auth:use:${t.label}`
+      }
+    ]);
+  }
+  rows.push([
+    { text: "\u21bb Refresh", callbackData: "auth:refresh" },
+    { text: "/usage", insertText: "/usage" },
+    { text: "+ Add", insertText: "/auth add " }
+  ]);
+  return rows;
+}
+function switchPriority2(s) {
+  const h = classifyHealth2(s);
+  if (h === "healthy")
+    return 0;
+  if (h === "throttling")
+    return 1;
+  if (h === "unknown")
+    return 2;
+  return 3;
+}
+function escapeHtml12(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function buildSnapshotsFromState2(state4, quotas) {
+  const out = [];
+  for (let i = 0;i < state4.accounts.length; i++) {
+    const acc = state4.accounts[i];
+    const q = quotas[i];
+    out.push({
+      label: acc.label,
+      isActive: acc.label === state4.active,
+      quota: q && q.ok ? q.data : null,
+      quotaError: q && !q.ok ? q.reason : undefined,
+      expiresAtMs: acc.expiresAt
+    });
+  }
+  return out;
+}
+function reviveLastQuota(snap) {
+  if (!snap)
+    return null;
+  return {
+    fiveHourUtilizationPct: snap.fiveHourUtilizationPct,
+    sevenDayUtilizationPct: snap.sevenDayUtilizationPct,
+    fiveHourResetAt: snap.fiveHourResetAt ? new Date(snap.fiveHourResetAt) : null,
+    sevenDayResetAt: snap.sevenDayResetAt ? new Date(snap.sevenDayResetAt) : null,
+    representativeClaim: snap.representativeClaim,
+    overageStatus: snap.overageStatus,
+    overageDisabledReason: snap.overageDisabledReason
+  };
+}
+function buildSnapshotsFromCachedState(state4) {
+  return state4.accounts.map((acc) => {
+    const lq = acc.last_quota ?? null;
+    return {
+      label: acc.label,
+      isActive: acc.label === state4.active,
+      quota: reviveLastQuota(lq),
+      quotaError: lq ? undefined : "no cached quota (no probe since broker start)",
+      expiresAtMs: acc.expiresAt
+    };
+  });
+}
+var THROTTLING_THRESHOLD_PCT2 = 80, HEALTH_EMOJI2, HEALTH_TITLE2;
+var init_auth_snapshot_format = __esm(() => {
+  HEALTH_EMOJI2 = {
+    healthy: "\uD83D\uDFE2",
+    throttling: "\uD83D\uDFE1",
+    blocked: "\uD83D\uDD34",
+    unknown: "\u26aa"
+  };
+  HEALTH_TITLE2 = {
+    healthy: "HEALTHY",
+    throttling: "THROTTLING",
+    blocked: "BLOCKED",
+    unknown: "UNKNOWN"
+  };
+});
+
 // ../src/vault/flock.ts
 var init_flock = () => {};
 
 // ../src/vault/vault.ts
 import { randomBytes as randomBytes5, scryptSync, createCipheriv, createDecipheriv } from "node:crypto";
 import {
-  readFileSync as readFileSync31,
-  writeFileSync as writeFileSync19,
-  existsSync as existsSync32,
-  renameSync as renameSync11,
-  mkdirSync as mkdirSync18,
+  readFileSync as readFileSync33,
+  writeFileSync as writeFileSync21,
+  existsSync as existsSync34,
+  renameSync as renameSync12,
+  mkdirSync as mkdirSync20,
   unlinkSync as unlinkSync12,
   lstatSync,
   realpathSync
@@ -29196,12 +29690,12 @@ function normalizeSecrets(raw) {
   return out;
 }
 function openVault(passphrase, vaultPath) {
-  if (!existsSync32(vaultPath)) {
+  if (!existsSync34(vaultPath)) {
     throw new VaultError(`Vault file not found: ${vaultPath}`);
   }
   let vaultFile;
   try {
-    vaultFile = JSON.parse(readFileSync31(vaultPath, "utf8"));
+    vaultFile = JSON.parse(readFileSync33(vaultPath, "utf8"));
   } catch {
     throw new VaultError(`Failed to read vault file: ${vaultPath}`);
   }
@@ -29248,14 +29742,14 @@ var init_vault = __esm(() => {
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync7,
-  mkdirSync as mkdirSync19,
+  mkdirSync as mkdirSync21,
   mkdtempSync as mkdtempSync2,
   openSync as openSync7,
   rmSync as rmSync3,
   statSync as statSync11,
   writeSync as writeSync2
 } from "node:fs";
-import { join as join31 } from "node:path";
+import { join as join32 } from "node:path";
 import { tmpdir } from "node:os";
 import { constants as fsConstants } from "node:fs";
 function isVaultReference(value) {
@@ -29307,11 +29801,11 @@ function materializationRoot() {
     return cachedRoot;
   const xdg = process.env.XDG_RUNTIME_DIR;
   if (xdg) {
-    const base = join31(xdg, "switchroom", "vault");
-    mkdirSync19(base, { recursive: true, mode: 448 });
-    cachedRoot = mkdtempSync2(join31(base, "run-"));
+    const base = join32(xdg, "switchroom", "vault");
+    mkdirSync21(base, { recursive: true, mode: 448 });
+    cachedRoot = mkdtempSync2(join32(base, "run-"));
   } else {
-    cachedRoot = mkdtempSync2(join31(tmpdir(), "switchroom-vault-"));
+    cachedRoot = mkdtempSync2(join32(tmpdir(), "switchroom-vault-"));
   }
   chmodSync4(cachedRoot, 448);
   return cachedRoot;
@@ -29326,13 +29820,13 @@ function writeFileExclusive(filePath, content) {
   }
 }
 function materializeFilesEntry(key, files) {
-  const dir = join31(materializationRoot(), key);
+  const dir = join32(materializationRoot(), key);
   if (materializedDirs.has(dir)) {
     try {
       rmSync3(dir, { recursive: true, force: true });
     } catch {}
   }
-  mkdirSync19(dir, { recursive: true, mode: 448 });
+  mkdirSync21(dir, { recursive: true, mode: 448 });
   chmodSync4(dir, 448);
   const st = statSync11(dir);
   if (typeof process.getuid === "function" && st.uid !== process.getuid()) {
@@ -29342,7 +29836,7 @@ function materializeFilesEntry(key, files) {
     if (filename.includes("/") || filename.includes("\\") || filename === ".." || filename === "." || filename.includes("\x00")) {
       throw new Error(`Refusing to materialize vault file with unsafe name: ${filename}`);
     }
-    const filePath = join31(dir, filename);
+    const filePath = join32(dir, filename);
     const content = encoding === "base64" ? Buffer.from(value, "base64") : value;
     writeFileExclusive(filePath, content);
   }
@@ -29475,7 +29969,7 @@ __export(exports_materialize_bot_token, {
   materializeBotToken: () => materializeBotToken,
   BotTokenMaterializeError: () => BotTokenMaterializeError
 });
-import { existsSync as existsSync33 } from "node:fs";
+import { existsSync as existsSync35 } from "node:fs";
 function pickConfiguredToken(config, agentName3) {
   if (agentName3) {
     const agent = config.agents?.[agentName3];
@@ -29489,7 +29983,7 @@ function tryDirectVaultRead(ref, config, passphrase) {
   if (!passphrase)
     return null;
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (!existsSync33(vaultPath))
+  if (!existsSync35(vaultPath))
     return null;
   try {
     const secrets = openVault(passphrase, vaultPath);
@@ -29607,7 +30101,7 @@ function truncateDiffForCard(unifiedDiff, maxLines = 50, maxChars = 3000) {
   }
   return out === unifiedDiff ? out : out + sentinel;
 }
-function escapeHtml11(s) {
+function escapeHtml13(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 function clipReason(reason) {
@@ -29618,10 +30112,10 @@ function clipReason(reason) {
 function buildConfigApprovalCardBody(args) {
   const safeReason = clipReason(args.reason);
   const render = (diff) => `\uD83D\uDEE0 <b>Config edit proposed</b>
-` + `Agent: <code>${escapeHtml11(args.agentName)}</code>
-` + `Reason: ${escapeHtml11(safeReason)}
+` + `Agent: <code>${escapeHtml13(args.agentName)}</code>
+` + `Reason: ${escapeHtml13(safeReason)}
 
-` + `<pre>${escapeHtml11(diff)}</pre>`;
+` + `<pre>${escapeHtml13(diff)}</pre>`;
   return truncateRawToFit({
     raw: args.unifiedDiff,
     render,
@@ -29728,8 +30222,8 @@ async function handleRequestConfigFinalize(_client, msg, deps) {
   }
   pending.delete(msg.requestId);
   const body = msg.outcome === "applied" ? `\u2705 <b>Applied</b>${msg.detail ? `
-${escapeHtml11(msg.detail)}` : ""}` : `\u26a0\ufe0f <b>Reconcile failed; rolled back</b>${msg.detail ? `
-${escapeHtml11(msg.detail)}` : ""}`;
+${escapeHtml13(msg.detail)}` : ""}` : `\u26a0\ufe0f <b>Reconcile failed; rolled back</b>${msg.detail ? `
+${escapeHtml13(msg.detail)}` : ""}`;
   try {
     await deps.editCard({
       chatId: entry.chatId,
@@ -29794,7 +30288,7 @@ __export(exports_tmux, {
   captureAgentPane: () => captureAgentPane
 });
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { mkdirSync as mkdirSync20, readdirSync as readdirSync6, statSync as statSync12, unlinkSync as unlinkSync13, writeFileSync as writeFileSync20 } from "node:fs";
+import { mkdirSync as mkdirSync22, readdirSync as readdirSync6, statSync as statSync12, unlinkSync as unlinkSync13, writeFileSync as writeFileSync22 } from "node:fs";
 import { resolve as resolve7 } from "node:path";
 function captureAgentPane(opts) {
   const { agentName: agentName3, agentDir, reason } = opts;
@@ -29806,7 +30300,7 @@ function captureAgentPane(opts) {
   const reasonSlug = sanitizeReason(reason);
   const outPath = resolve7(outDir, `${ts}-${reasonSlug}.txt`);
   try {
-    mkdirSync20(outDir, { recursive: true, mode: 493 });
+    mkdirSync22(outDir, { recursive: true, mode: 493 });
   } catch (err) {
     const msg = `mkdir crash-reports failed: ${err.message}`;
     console.error(`[tmux-capture] ${agentName3}: ${msg}`);
@@ -29840,7 +30334,7 @@ function captureAgentPane(opts) {
 ` + `
 `;
   try {
-    writeFileSync20(outPath, Buffer.concat([Buffer.from(header, "utf8"), body]), {
+    writeFileSync22(outPath, Buffer.concat([Buffer.from(header, "utf8"), body]), {
       mode: 420
     });
   } catch (err) {
@@ -29998,367 +30492,54 @@ function registerApprovalsCommands(bot, opts) {
         await ctx.reply("Approval kernel unreachable (vault broker not running?).");
         return;
       }
-      if (decisions.length === 0) {
-        await ctx.reply(agentFilter ? `No active approvals for <code>${escapeHtml12(agentFilter)}</code>.` : "No active approvals.", { parse_mode: "HTML" });
-        return;
-      }
-      const byAgent = new Map;
-      for (const d of decisions)
-        byAgent.set(d.agent_unit, (byAgent.get(d.agent_unit) ?? 0) + 1);
-      const summary = Array.from(byAgent.entries()).map(([a, n]) => `\u2022 <b>${escapeHtml12(a)}</b>: ${n}`).join(`
-`);
-      const detail = decisions.slice(0, 20).map((d) => {
-        const ttl = d.ttl_expires_at === null ? "always" : `until ${new Date(d.ttl_expires_at).toISOString().slice(0, 16).replace("T", " ")}`;
-        return `<code>${escapeHtml12(d.id.slice(0, 8))}</code> ` + `${escapeHtml12(d.agent_unit)} \u2192 ` + `<code>${escapeHtml12(d.scope)}</code> ` + `(${escapeHtml12(d.action)}, ${ttl}) ` + `\u00b7 /approvals revoke ${escapeHtml12(d.id)}`;
-      }).join(`
-`);
-      await ctx.reply(`<b>Active approvals</b>
-
-${summary}
-
-${detail}`, {
-        parse_mode: "HTML"
-      });
-      return;
-    }
-    if (sub === "revoke") {
-      const id = args[1];
-      if (!id) {
-        await ctx.reply("Usage: <code>/approvals revoke &lt;id&gt;</code>", {
-          parse_mode: "HTML"
-        });
-        return;
-      }
-      const actor = ctx.from?.id?.toString() ?? "unknown";
-      const ok = await approvalRevoke(id, actor, "manual /approvals revoke");
-      if (ok === null) {
-        await ctx.reply("Approval kernel unreachable.");
-        return;
-      }
-      await ctx.reply(ok ? `Revoked <code>${escapeHtml12(id)}</code>.` : `No such active decision <code>${escapeHtml12(id)}</code>.`, { parse_mode: "HTML" });
-      return;
-    }
-    await ctx.reply(`Unknown subcommand <code>${escapeHtml12(sub)}</code>. ` + `Use <code>/approvals list</code> or <code>/approvals revoke &lt;id&gt;</code>. ` + `(<code>add</code> and <code>stats</code> are coming in a follow-up.)`, { parse_mode: "HTML" });
-  });
-}
-function escapeHtml12(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-var init_approvals_commands = __esm(() => {
-  init_client3();
-});
-
-// auth-snapshot-format.ts
-var exports_auth_snapshot_format = {};
-__export(exports_auth_snapshot_format, {
-  renderFallbackAnnouncement: () => renderFallbackAnnouncement2,
-  renderAuthSnapshotFormat2: () => renderAuthSnapshotFormat22,
-  recommendation: () => recommendation2,
-  formatRelative: () => formatRelative2,
-  formatAbsolute: () => formatAbsolute2,
-  fmtPct: () => fmtPct2,
-  classifyHealth: () => classifyHealth2,
-  buildSnapshotsFromState: () => buildSnapshotsFromState2,
-  buildSnapshotKeyboard: () => buildSnapshotKeyboard2,
-  bindingWindow: () => bindingWindow2,
-  THROTTLING_THRESHOLD_PCT: () => THROTTLING_THRESHOLD_PCT2
-});
-function classifyHealth2(snap) {
-  if (!snap.quota)
-    return "unknown";
-  const q = snap.quota;
-  const max = Math.max(q.fiveHourUtilizationPct, q.sevenDayUtilizationPct);
-  if (max >= 99.5)
-    return "blocked";
-  if (max >= THROTTLING_THRESHOLD_PCT2)
-    return "throttling";
-  return "healthy";
-}
-function bindingWindow2(q) {
-  if (q.representativeClaim === "seven_day")
-    return "7d";
-  if (q.representativeClaim === "five_hour")
-    return "5h";
-  return q.sevenDayUtilizationPct >= q.fiveHourUtilizationPct ? "7d" : "5h";
-}
-function formatRelative2(target, now = new Date) {
-  if (!target)
-    return "\u2014";
-  const deltaMs = target.getTime() - now.getTime();
-  if (deltaMs <= 0)
-    return "now";
-  const totalMin = Math.round(deltaMs / 60000);
-  if (totalMin < 60)
-    return `${totalMin}m`;
-  const h = Math.floor(totalMin / 60);
-  const m = totalMin % 60;
-  if (h < 24)
-    return m > 0 ? `${h}h ${m}m` : `${h}h`;
-  const d = Math.floor(h / 24);
-  const rh = h % 24;
-  return rh > 0 ? `${d}d ${rh}h` : `${d}d`;
-}
-function formatAbsolute2(target, tz = "UTC") {
-  if (!target)
-    return "\u2014";
-  return target.toLocaleString("en-US", {
-    timeZone: tz,
-    weekday: "short",
-    hour: "numeric",
-    minute: "2-digit",
-    hour12: true
-  });
-}
-function fmtPct2(pct) {
-  return `${Math.round(pct)}%`;
-}
-function groupHeader2(health, count) {
-  const emoji = HEALTH_EMOJI2[health];
-  const title = HEALTH_TITLE2[health];
-  return `${emoji} <b>${title}</b> (${count})`;
-}
-function renderAccountRow2(snap, opts) {
-  const now = opts.now ?? new Date;
-  const tz = opts.tz ?? "UTC";
-  const lines = [];
-  const marker = snap.isActive ? "\u25cf " : "";
-  if (!snap.quota) {
-    lines.push(`${marker}<code>${escapeHtml13(snap.label)}</code>  <i>quota probe failed</i>`);
-    if (snap.quotaError) {
-      lines.push(`  <i>${escapeHtml13(snap.quotaError)}</i>`);
-    }
-    return lines;
-  }
-  const q = snap.quota;
-  const fiveStr = fmtPct2(q.fiveHourUtilizationPct);
-  const sevenStr = fmtPct2(q.sevenDayUtilizationPct);
-  lines.push(`${marker}<code>${escapeHtml13(snap.label)}</code>  ${fiveStr} / ${sevenStr}`);
-  const health = classifyHealth2(snap);
-  if (health === "blocked") {
-    const win = bindingWindow2(q);
-    const reset2 = win === "5h" ? q.fiveHourResetAt : q.sevenDayResetAt;
-    const winLabel = win === "5h" ? "5-hour" : "7-day";
-    lines.push(`  <i>back ${formatAbsolute2(reset2, tz)} (in ${formatRelative2(reset2, now)}, ${winLabel} cap)</i>`);
-    return lines;
-  }
-  const fiveResetIn = q.fiveHourResetAt ? q.fiveHourResetAt.getTime() - now.getTime() : Infinity;
-  const sevenResetIn = q.sevenDayResetAt ? q.sevenDayResetAt.getTime() - now.getTime() : Infinity;
-  const fiveFirst = fiveResetIn <= sevenResetIn;
-  const fiveSeg = q.fiveHourResetAt ? `5h refills ${formatAbsolute2(q.fiveHourResetAt, tz)} (in ${formatRelative2(q.fiveHourResetAt, now)})` : "5h refills \u2014";
-  const sevenSeg = q.sevenDayResetAt ? `7d resets ${formatAbsolute2(q.sevenDayResetAt, tz)} (in ${formatRelative2(q.sevenDayResetAt, now)})` : "7d resets \u2014";
-  lines.push(`  <i>${fiveFirst ? fiveSeg : sevenSeg}  \u00b7  ${fiveFirst ? sevenSeg : fiveSeg}</i>`);
-  return lines;
-}
-function renderAuthSnapshotFormat22(snapshots, opts = {}) {
-  const now = opts.now ?? new Date;
-  const lines = [];
-  lines.push("\uD83D\uDD0B <b>Auth \u2014 fleet status</b>");
-  const order = ["blocked", "throttling", "healthy", "unknown"];
-  const grouped = new Map;
-  for (const s of snapshots) {
-    const h = classifyHealth2(s);
-    if (!grouped.has(h))
-      grouped.set(h, []);
-    grouped.get(h).push(s);
-  }
-  for (const arr of grouped.values()) {
-    arr.sort((a, b) => Number(b.isActive) - Number(a.isActive));
-  }
-  for (const h of order) {
-    const arr = grouped.get(h);
-    if (!arr || arr.length === 0)
-      continue;
-    lines.push("");
-    lines.push(groupHeader2(h, arr.length));
-    for (const s of arr) {
-      for (const ln of renderAccountRow2(s, opts))
-        lines.push(ln);
-    }
-  }
-  lines.push("");
-  lines.push("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  lines.push(`<i>${recommendation2(snapshots, now)}</i>`);
-  if (opts.liveProbedAtMs != null) {
-    const ageSec = Math.max(0, Math.round((Date.now() - opts.liveProbedAtMs) / 1000));
-    const ageStr = ageSec < 60 ? `${ageSec}s ago` : `${Math.round(ageSec / 60)}m ago`;
-    lines.push(`<i>Live \u00b7 refreshed ${ageStr}</i>`);
-  } else {
-    lines.push("<i>Live</i>");
-  }
-  return lines.join(`
-`);
-}
-function recommendation2(snapshots, now = new Date) {
-  const active = snapshots.find((s) => s.isActive);
-  if (!active)
-    return "No active account set.";
-  const activeHealth = classifyHealth2(active);
-  const others = snapshots.filter((s) => !s.isActive);
-  const healthyAlt = others.find((s) => classifyHealth2(s) === "healthy");
-  if (activeHealth === "healthy") {
-    return `Recommendation: stay on ${active.label}.`;
-  }
-  if (activeHealth === "throttling") {
-    if (healthyAlt) {
-      return `Recommendation: active ${active.label} is throttling. Switch to ${healthyAlt.label} for headroom.`;
-    }
-    return `Recommendation: active ${active.label} is throttling; no healthy alternative \u2014 wait for refill.`;
-  }
-  if (activeHealth === "blocked") {
-    if (healthyAlt) {
-      return `Recommendation: active ${active.label} is BLOCKED \u2014 switch to ${healthyAlt.label} now.`;
-    }
-    const earliestRecovery = pickEarliestRecovery2(snapshots, now);
-    if (earliestRecovery) {
-      return `All accounts blocked. Earliest recovery: ${earliestRecovery.label} in ${formatRelative2(earliestRecovery.at, now)}.`;
-    }
-    return `All accounts blocked. Run /auth add to attach another subscription.`;
-  }
-  return `Active ${active.label}: quota probe failed; broker last_seen unknown.`;
-}
-function pickEarliestRecovery2(snapshots, now) {
-  let best = null;
-  for (const s of snapshots) {
-    if (!s.quota)
-      continue;
-    const win = bindingWindow2(s.quota);
-    const at = win === "5h" ? s.quota.fiveHourResetAt : s.quota.sevenDayResetAt;
-    if (!at || at.getTime() <= now.getTime())
-      continue;
-    if (!best || at.getTime() < best.at.getTime()) {
-      best = { label: s.label, at };
-    }
-  }
-  return best;
-}
-function renderFallbackAnnouncement2(input) {
-  const now = input.now ?? new Date;
-  const tz = input.tz ?? "UTC";
-  const lines = [];
-  const limitWord = input.oldQuota ? limitWordFor2(input.oldQuota) : "quota";
-  const headerLimit = limitWord === "quota" ? "quota cap" : `${limitWord} limit`;
-  if (!input.newLabel) {
-    lines.push(`\uD83D\uDD34 <b>All accounts blocked \u00b7 ${headerLimit} on ${escapeHtml13(input.oldLabel)}</b>`);
-    lines.push("");
-    lines.push(`Triggered by: agent <b>${escapeHtml13(input.triggerAgent)}</b>`);
-    if (input.oldQuota) {
-      const recovery = recoveryAtFor2(input.oldQuota);
-      if (recovery) {
-        lines.push(`${escapeHtml13(input.oldLabel)} recovers ${formatAbsolute2(recovery, tz)} ` + `(in ${formatRelative2(recovery, now)})`);
-      }
-    }
-    lines.push("");
-    lines.push(`Run <code>/auth add &lt;label&gt;</code> to attach another subscription, ` + `or <code>/auth refresh</code> to re-probe.`);
-    return lines.join(`
-`);
-  }
-  lines.push(`\u2713 <b>Switched fleet \u00b7 ${headerLimit} on ${escapeHtml13(input.oldLabel)}</b>`);
-  lines.push("");
-  lines.push(`<code>${escapeHtml13(input.oldLabel)}</code> \u2192 <code>${escapeHtml13(input.newLabel)}</code>`);
-  lines.push(`Triggered by: agent <b>${escapeHtml13(input.triggerAgent)}</b>`);
-  lines.push("");
-  if (input.oldQuota) {
-    const recovery = recoveryAtFor2(input.oldQuota);
-    if (recovery) {
-      lines.push(`<code>${escapeHtml13(input.oldLabel)}</code> recovers ` + `${formatAbsolute2(recovery, tz)} (in ${formatRelative2(recovery, now)})`);
-    }
-  }
-  if (input.newQuota) {
-    const fiveStr = fmtPct2(input.newQuota.fiveHourUtilizationPct);
-    const sevenStr = fmtPct2(input.newQuota.sevenDayUtilizationPct);
-    const hasHeadroom = input.newQuota.fiveHourUtilizationPct < THROTTLING_THRESHOLD_PCT2 && input.newQuota.sevenDayUtilizationPct < THROTTLING_THRESHOLD_PCT2;
-    const headroomStr = hasHeadroom ? "<i>(plenty of headroom)</i>" : "<i>(near limit \u2014 watch this)</i>";
-    lines.push(`<code>${escapeHtml13(input.newLabel)}</code> now: ${fiveStr} of 5h \u00b7 ${sevenStr} of 7d ${headroomStr}`);
-  } else {
-    lines.push(`<i>(quota probe for new account is pending \u2014 will reflect on next /auth)</i>`);
-  }
-  return lines.join(`
+      if (decisions.length === 0) {
+        await ctx.reply(agentFilter ? `No active approvals for <code>${escapeHtml14(agentFilter)}</code>.` : "No active approvals.", { parse_mode: "HTML" });
+        return;
+      }
+      const byAgent = new Map;
+      for (const d of decisions)
+        byAgent.set(d.agent_unit, (byAgent.get(d.agent_unit) ?? 0) + 1);
+      const summary = Array.from(byAgent.entries()).map(([a, n]) => `\u2022 <b>${escapeHtml14(a)}</b>: ${n}`).join(`
 `);
-}
-function limitWordFor2(q) {
-  if (q.representativeClaim === "seven_day" && q.sevenDayUtilizationPct >= 99)
-    return "7-day";
-  if (q.representativeClaim === "five_hour" && q.fiveHourUtilizationPct >= 99)
-    return "5-hour";
-  if (q.sevenDayUtilizationPct >= 99)
-    return "7-day";
-  if (q.fiveHourUtilizationPct >= 99)
-    return "5-hour";
-  return q.sevenDayUtilizationPct >= q.fiveHourUtilizationPct ? "7-day" : "5-hour";
-}
-function recoveryAtFor2(q) {
-  const word = limitWordFor2(q);
-  if (word === "7-day")
-    return q.sevenDayResetAt;
-  if (word === "5-hour")
-    return q.fiveHourResetAt;
-  if (!q.fiveHourResetAt)
-    return q.sevenDayResetAt;
-  if (!q.sevenDayResetAt)
-    return q.fiveHourResetAt;
-  return q.fiveHourResetAt.getTime() < q.sevenDayResetAt.getTime() ? q.fiveHourResetAt : q.sevenDayResetAt;
-}
-function buildSnapshotKeyboard2(snapshots, opts = {}) {
-  const max = opts.maxSwitchButtons ?? 3;
-  const rows = [];
-  const switchTargets = snapshots.filter((s) => !s.isActive).sort((a, b) => switchPriority2(a) - switchPriority2(b)).filter((s) => classifyHealth2(s) !== "blocked" && classifyHealth2(s) !== "unknown").slice(0, max);
-  for (const t of switchTargets) {
-    rows.push([
-      {
-        text: `Switch fleet \u2192 ${t.label}`,
-        callbackData: `auth:use:${t.label}`
+      const detail = decisions.slice(0, 20).map((d) => {
+        const ttl = d.ttl_expires_at === null ? "always" : `until ${new Date(d.ttl_expires_at).toISOString().slice(0, 16).replace("T", " ")}`;
+        return `<code>${escapeHtml14(d.id.slice(0, 8))}</code> ` + `${escapeHtml14(d.agent_unit)} \u2192 ` + `<code>${escapeHtml14(d.scope)}</code> ` + `(${escapeHtml14(d.action)}, ${ttl}) ` + `\u00b7 /approvals revoke ${escapeHtml14(d.id)}`;
+      }).join(`
+`);
+      await ctx.reply(`<b>Active approvals</b>
+
+${summary}
+
+${detail}`, {
+        parse_mode: "HTML"
+      });
+      return;
+    }
+    if (sub === "revoke") {
+      const id = args[1];
+      if (!id) {
+        await ctx.reply("Usage: <code>/approvals revoke &lt;id&gt;</code>", {
+          parse_mode: "HTML"
+        });
+        return;
       }
-    ]);
-  }
-  rows.push([
-    { text: "\u21bb Refresh", callbackData: "auth:refresh" },
-    { text: "/usage", insertText: "/usage" },
-    { text: "+ Add", insertText: "/auth add " }
-  ]);
-  return rows;
-}
-function switchPriority2(s) {
-  const h = classifyHealth2(s);
-  if (h === "healthy")
-    return 0;
-  if (h === "throttling")
-    return 1;
-  if (h === "unknown")
-    return 2;
-  return 3;
+      const actor = ctx.from?.id?.toString() ?? "unknown";
+      const ok = await approvalRevoke(id, actor, "manual /approvals revoke");
+      if (ok === null) {
+        await ctx.reply("Approval kernel unreachable.");
+        return;
+      }
+      await ctx.reply(ok ? `Revoked <code>${escapeHtml14(id)}</code>.` : `No such active decision <code>${escapeHtml14(id)}</code>.`, { parse_mode: "HTML" });
+      return;
+    }
+    await ctx.reply(`Unknown subcommand <code>${escapeHtml14(sub)}</code>. ` + `Use <code>/approvals list</code> or <code>/approvals revoke &lt;id&gt;</code>. ` + `(<code>add</code> and <code>stats</code> are coming in a follow-up.)`, { parse_mode: "HTML" });
+  });
 }
-function escapeHtml13(s) {
+function escapeHtml14(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function buildSnapshotsFromState2(state4, quotas) {
-  const out = [];
-  for (let i = 0;i < state4.accounts.length; i++) {
-    const acc = state4.accounts[i];
-    const q = quotas[i];
-    out.push({
-      label: acc.label,
-      isActive: acc.label === state4.active,
-      quota: q && q.ok ? q.data : null,
-      quotaError: q && !q.ok ? q.reason : undefined,
-      expiresAtMs: acc.expiresAt
-    });
-  }
-  return out;
-}
-var THROTTLING_THRESHOLD_PCT2 = 80, HEALTH_EMOJI2, HEALTH_TITLE2;
-var init_auth_snapshot_format = __esm(() => {
-  HEALTH_EMOJI2 = {
-    healthy: "\uD83D\uDFE2",
-    throttling: "\uD83D\uDFE1",
-    blocked: "\uD83D\uDD34",
-    unknown: "\u26aa"
-  };
-  HEALTH_TITLE2 = {
-    healthy: "HEALTHY",
-    throttling: "THROTTLING",
-    blocked: "BLOCKED",
-    unknown: "UNKNOWN"
-  };
+var init_approvals_commands = __esm(() => {
+  init_client3();
 });
 
 // gateway/approval-card.ts
@@ -30495,23 +30676,23 @@ var import_runner2 = __toESM(require_mod3(), 1);
 import { randomBytes as randomBytes6 } from "crypto";
 import { execFileSync as execFileSync5, execSync as execSync2, spawn as spawn2 } from "child_process";
 import {
-  readFileSync as readFileSync32,
-  writeFileSync as writeFileSync21,
-  mkdirSync as mkdirSync21,
+  readFileSync as readFileSync34,
+  writeFileSync as writeFileSync23,
+  mkdirSync as mkdirSync23,
   readdirSync as readdirSync7,
   rmSync as rmSync4,
   statSync as statSync13,
-  renameSync as renameSync12,
+  renameSync as renameSync13,
   realpathSync as realpathSync2,
   chmodSync as chmodSync5,
   openSync as openSync8,
   closeSync as closeSync8,
-  existsSync as existsSync34,
+  existsSync as existsSync36,
   unlinkSync as unlinkSync14,
   appendFileSync as appendFileSync3
 } from "fs";
 import { homedir as homedir12 } from "os";
-import { join as join32, extname, sep as sep3, basename as basename7 } from "path";
+import { join as join33, extname, sep as sep3, basename as basename7 } from "path";
 
 // plugin-logger.ts
 import { appendFileSync, mkdirSync, renameSync, statSync, existsSync } from "fs";
@@ -38520,6 +38701,7 @@ function isSilentFlushMarker(text) {
   }
   return SILENT_MARKERS.has(trimmed.toUpperCase());
 }
+var TRIVIAL_CONFIRMATIONS = new Set(["SENT", "DONE", "OK", "OKAY", "ACK"]);
 
 // answer-stream.ts
 var MIN_INITIAL_CHARS = 50;
@@ -40488,15 +40670,11 @@ function renderOperatorEvent(ev) {
         text: [
           `\uD83D\uDCB3 <b>Credit balance too low</b> for <b>${agent}</b>.`,
           detail ? `<i>${detail}</i>` : "",
-          `Swap to another account slot or add a new one.`
+          `Use <code>/auth use &lt;label&gt;</code> to switch account slot or <code>/auth add</code> to add one.`
         ].filter(Boolean).join(`
 `),
         keyboard: {
           inline_keyboard: [
-            [
-              { text: "\uD83D\uDD04 Swap slot", callback_data: `op:swap-slot:${encodeURIComponent(ev.agent)}` },
-              { text: "\u2795 Add slot", callback_data: `op:add-slot:${encodeURIComponent(ev.agent)}` }
-            ],
             [{ text: "\u23f3 Wait", callback_data: `op:dismiss:${encodeURIComponent(ev.agent)}` }]
           ]
         }
@@ -40506,15 +40684,11 @@ function renderOperatorEvent(ev) {
         text: [
           `\u26a0\ufe0f <b>Quota exhausted</b> for <b>${agent}</b>.`,
           detail ? `<i>${detail}</i>` : "",
-          `All account slots are at the usage limit. Switchroom will auto-fallback when another slot is available.`
+          `All account slots are at the usage limit. Switchroom will auto-fallback when another slot is available. Use <code>/auth use &lt;label&gt;</code> to switch manually.`
         ].filter(Boolean).join(`
 `),
         keyboard: {
           inline_keyboard: [
-            [
-              { text: "\uD83D\uDD04 Swap slot", callback_data: `op:swap-slot:${encodeURIComponent(ev.agent)}` },
-              { text: "\u2795 Add slot", callback_data: `op:add-slot:${encodeURIComponent(ev.agent)}` }
-            ],
             [{ text: "\u23f3 Wait", callback_data: `op:dismiss:${encodeURIComponent(ev.agent)}` }]
           ]
         }
@@ -41812,6 +41986,27 @@ function isSilentFlushMarker2(text) {
   }
   return SILENT_MARKERS2.has(trimmed.toUpperCase());
 }
+var TRIVIAL_CONFIRMATIONS2 = new Set(["SENT", "DONE", "OK", "OKAY", "ACK"]);
+function isTrivialConfirmationLine(line) {
+  let t = line.trim();
+  if (t.length === 0 || t.length > 8)
+    return false;
+  if (/\W$/.test(t))
+    t = t.slice(0, -1);
+  return TRIVIAL_CONFIRMATIONS2.has(t.toUpperCase());
+}
+function isCompositeSilentNoise(text) {
+  if (typeof text !== "string")
+    return false;
+  const lines = text.split(`
+`).map((l) => l.trim()).filter((l) => l.length > 0);
+  if (lines.length === 0)
+    return false;
+  const hasMarker = lines.some((l) => isSilentFlushMarker2(l));
+  if (!hasMarker)
+    return false;
+  return lines.every((l) => isSilentFlushMarker2(l) || isTrivialConfirmationLine(l));
+}
 function decideTurnFlush(input) {
   const flushEnabled = input.flushEnabled !== false;
   if (!flushEnabled)
@@ -41826,6 +42021,8 @@ function decideTurnFlush(input) {
     return { kind: "skip", reason: "empty-text" };
   if (isSilentFlushMarker2(joined))
     return { kind: "skip", reason: "silent-marker" };
+  if (isCompositeSilentNoise(joined))
+    return { kind: "skip", reason: "silent-marker" };
   return { kind: "flush", text: joined };
 }
 function isTurnFlushSafetyEnabled(env = process.env) {
@@ -48729,7 +48926,7 @@ function determineRestartReason(opts) {
 init_boot_card();
 
 // gateway/update-announce.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync13, openSync as openSync3, closeSync as closeSync3, readFileSync as readFileSync25 } from "node:fs";
+import { existsSync as existsSync27, mkdirSync as mkdirSync14, openSync as openSync3, closeSync as closeSync3, readFileSync as readFileSync26 } from "node:fs";
 import { join as join24 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 
@@ -48843,8 +49040,8 @@ function readAndFilter(raw, filters, limit) {
 var DEFAULT_LOOKBACK_MS = 10 * 60 * 1000;
 function readLastTerminalUpdateAudit(opts = {}) {
   const path = opts.auditLogPath ?? defaultAuditLogPath();
-  const exists = opts.exists ?? existsSync26;
-  const readFile = opts.readFile ?? ((p) => readFileSync25(p, "utf-8"));
+  const exists = opts.exists ?? existsSync27;
+  const readFile = opts.readFile ?? ((p) => readFileSync26(p, "utf-8"));
   if (!exists(path))
     return null;
   let raw;
@@ -48908,7 +49105,7 @@ function claimUpdateAnnouncement(requestId, opts = {}) {
   const stateDir = opts.stateDir ?? process.env.TELEGRAM_STATE_DIR ?? join24(homedir10(), ".switchroom");
   const dir = join24(stateDir, "update-announced");
   try {
-    mkdirSync13(dir, { recursive: true });
+    mkdirSync14(dir, { recursive: true });
   } catch {
     return false;
   }
@@ -48932,7 +49129,7 @@ function maybeRenderUpdateAnnouncement(opts = {}) {
 }
 
 // issues-card.ts
-import { readFileSync as readFileSync26, writeFileSync as writeFileSync15 } from "node:fs";
+import { readFileSync as readFileSync27, writeFileSync as writeFileSync16 } from "node:fs";
 var SEVERITY_EMOJI = {
   info: "\u2139\ufe0f",
   warn: "\u26a0\ufe0f",
@@ -49024,7 +49221,7 @@ function extractRetryAfterSecs(err) {
 var COOLDOWN_JITTER_MS = 500;
 function readPersistedMessageId(path, log) {
   try {
-    const raw = readFileSync26(path, "utf8");
+    const raw = readFileSync27(path, "utf8");
     const parsed = JSON.parse(raw);
     const v = parsed.messageId;
     if (typeof v === "number" && Number.isInteger(v) && v > 0)
@@ -49040,7 +49237,7 @@ function readPersistedMessageId(path, log) {
 }
 function writePersistedMessageId(path, messageId, log) {
   try {
-    writeFileSync15(path, JSON.stringify({ messageId }) + `
+    writeFileSync16(path, JSON.stringify({ messageId }) + `
 `, { mode: 384 });
   } catch (err) {
     log(`issues-card: persist write failed (${err.message})`);
@@ -49133,21 +49330,21 @@ function createIssuesCardHandle(opts) {
 }
 
 // issues-watcher.ts
-import { existsSync as existsSync28, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync29, statSync as statSync8 } from "node:fs";
 import { join as join26 } from "node:path";
 
 // ../src/issues/store.ts
 import {
   closeSync as closeSync4,
-  existsSync as existsSync27,
-  mkdirSync as mkdirSync14,
+  existsSync as existsSync28,
+  mkdirSync as mkdirSync15,
   openSync as openSync4,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync27,
-  renameSync as renameSync10,
+  readFileSync as readFileSync28,
+  renameSync as renameSync11,
   statSync as statSync7,
   unlinkSync as unlinkSync10,
-  writeFileSync as writeFileSync16,
+  writeFileSync as writeFileSync17,
   writeSync
 } from "node:fs";
 import { join as join25 } from "node:path";
@@ -49167,11 +49364,11 @@ var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
   const path = join25(stateDir, ISSUES_FILE);
-  if (!existsSync27(path))
+  if (!existsSync28(path))
     return [];
   let raw;
   try {
-    raw = readFileSync27(path, "utf-8");
+    raw = readFileSync28(path, "utf-8");
   } catch {
     return [];
   }
@@ -49203,7 +49400,7 @@ function list(stateDir, opts = {}) {
   });
 }
 function resolve6(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync27(join25(stateDir, ISSUES_FILE)))
+  if (!existsSync28(join25(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -49227,8 +49424,8 @@ function writeAll(stateDir, events) {
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
 `) + `
 `;
-  writeFileSync16(tmp, body, "utf-8");
-  renameSync10(tmp, path);
+  writeFileSync17(tmp, body, "utf-8");
+  renameSync11(tmp, path);
 }
 var ORPHAN_TMP_TTL_MS = 60000;
 var TMP_PREFIX = `${ISSUES_FILE}.tmp-`;
@@ -49290,7 +49487,7 @@ function withLock(stateDir, fn) {
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync27(lockPath, "utf-8").trim();
+    pidStr = readFileSync28(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
@@ -49388,7 +49585,7 @@ function startIssuesWatcher(opts) {
   };
 }
 function defaultSignatureProvider(path) {
-  if (!existsSync28(path))
+  if (!existsSync29(path))
     return null;
   try {
     const stat = statSync8(path);
@@ -49628,7 +49825,7 @@ function skillBasenameFromPath2(input) {
 }
 
 // credits-watch.ts
-import { readFileSync as readFileSync28, writeFileSync as writeFileSync17, existsSync as existsSync29, mkdirSync as mkdirSync15 } from "fs";
+import { readFileSync as readFileSync29, writeFileSync as writeFileSync18, existsSync as existsSync30, mkdirSync as mkdirSync16 } from "fs";
 import { join as join27 } from "path";
 var STATE_FILE = "credits-watch.json";
 var FATAL_REASONS = new Set([
@@ -49642,11 +49839,11 @@ function emptyCreditState() {
 }
 function readClaudeJsonOverage(claudeConfigDir) {
   const path = join27(claudeConfigDir, ".claude.json");
-  if (!existsSync29(path))
+  if (!existsSync30(path))
     return null;
   let raw;
   try {
-    raw = readFileSync28(path, "utf-8");
+    raw = readFileSync29(path, "utf-8");
   } catch {
     return null;
   }
@@ -49727,10 +49924,10 @@ function escapeHtml10(s) {
 }
 function loadCreditState(stateDir) {
   const path = join27(stateDir, STATE_FILE);
-  if (!existsSync29(path))
+  if (!existsSync30(path))
     return emptyCreditState();
   try {
-    const raw = readFileSync28(path, "utf-8");
+    const raw = readFileSync29(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object" && (parsed.lastNotifiedReason === null || typeof parsed.lastNotifiedReason === "string") && typeof parsed.lastNotifiedAt === "number" && Number.isFinite(parsed.lastNotifiedAt)) {
       return {
@@ -49742,36 +49939,161 @@ function loadCreditState(stateDir) {
   return emptyCreditState();
 }
 function saveCreditState(stateDir, state4) {
-  mkdirSync15(stateDir, { recursive: true });
+  mkdirSync16(stateDir, { recursive: true });
   const path = join27(stateDir, STATE_FILE);
-  writeFileSync17(path, JSON.stringify(state4, null, 2) + `
+  writeFileSync18(path, JSON.stringify(state4, null, 2) + `
+`, { mode: 384 });
+}
+
+// quota-watch.ts
+import { readFileSync as readFileSync30, writeFileSync as writeFileSync19, existsSync as existsSync31, mkdirSync as mkdirSync17 } from "fs";
+import { join as join28 } from "path";
+var STATE_FILE2 = "quota-watch.json";
+function emptyQuotaWatchState() {
+  return {};
+}
+function emptyAccountState() {
+  return { lastNotifiedHealth: null, lastNotifiedAt: 0 };
+}
+function evaluateQuotaWatchAccount(args) {
+  const { agentName: agentName3, snap, prev, now } = args;
+  const label = snap.label;
+  const currentHealth = classifyHealth(snap);
+  if (currentHealth === "unknown" || currentHealth === "blocked") {
+    return { kind: "skip", accountLabel: label, reason: `${currentHealth}-not-our-domain` };
+  }
+  const prevHealth = prev.lastNotifiedHealth ?? "healthy";
+  if (currentHealth === prevHealth) {
+    return { kind: "skip", accountLabel: label, reason: "steady-state" };
+  }
+  if (currentHealth === "throttling" && prevHealth === "healthy") {
+    const newState = {
+      lastNotifiedHealth: "throttling",
+      lastNotifiedAt: now
+    };
+    return {
+      kind: "notify",
+      accountLabel: label,
+      message: buildThrottlingMessage(agentName3, snap),
+      newAccountState: newState,
+      transition: "entered-throttling"
+    };
+  }
+  if (currentHealth === "healthy" && prevHealth === "throttling") {
+    const newState = {
+      lastNotifiedHealth: "healthy",
+      lastNotifiedAt: now
+    };
+    return {
+      kind: "notify",
+      accountLabel: label,
+      message: buildRecoveryMessage(agentName3, snap),
+      newAccountState: newState,
+      transition: "recovered-to-healthy"
+    };
+  }
+  return { kind: "skip", accountLabel: label, reason: "no-matching-transition" };
+}
+function buildThrottlingMessage(agentName3, snap) {
+  const q = snap.quota;
+  const fiveStr = fmtPct(q.fiveHourUtilizationPct);
+  const sevenStr = fmtPct(q.sevenDayUtilizationPct);
+  const max = Math.max(q.fiveHourUtilizationPct, q.sevenDayUtilizationPct);
+  const win = max === q.fiveHourUtilizationPct ? "5h" : "7d";
+  const winLabel = win === "5h" ? "5-hour" : "7-day";
+  const resetAt = win === "5h" ? q.fiveHourResetAt : q.sevenDayResetAt;
+  const resetStr = resetAt ? ` \u00b7 refills in ${formatRelative(resetAt, new Date)}` : "";
+  const activeNote = snap.isActive ? "" : `
+This is a non-active account. Consider <code>/auth use ${escapeHtml11(snap.label)}</code> to switch, or keep it as a fallback reserve.`;
+  const altNote = snap.isActive ? `
+Consider <code>/auth use &lt;other-account&gt;</code> if you have a healthier account, or wait for the ${winLabel} window to refill${resetStr}.` : "";
+  return [
+    `\uD83D\uDFE1 <b>Quota approaching limit</b> \u2014 <code>${escapeHtml11(snap.label)}</code>`,
+    ``,
+    `${fiveStr} of 5h  \u00b7  ${sevenStr} of 7d`,
+    `Binding window: ${winLabel}${resetStr}`,
+    `${activeNote}${altNote}`,
+    ``,
+    `<i>Threshold: ${THROTTLING_THRESHOLD_PCT}% on either window. Source: broker quota cache.</i>`,
+    `<i>Run /auth for full fleet status or /usage for the active account.</i>`
+  ].join(`
+`).replace(/\n\n\n+/g, `
+
+`).trim();
+}
+function buildRecoveryMessage(agentName3, snap) {
+  const q = snap.quota;
+  const utilLine = q ? `Current: ${fmtPct(q.fiveHourUtilizationPct)} of 5h  \u00b7  ${fmtPct(q.sevenDayUtilizationPct)} of 7d` : "Current quota data unavailable.";
+  return [
+    `\uD83D\uDFE2 <b>Quota back in healthy range</b> \u2014 <code>${escapeHtml11(snap.label)}</code>`,
+    ``,
+    utilLine,
+    ``,
+    `<i>Below ${THROTTLING_THRESHOLD_PCT}% on both windows.</i>`
+  ].join(`
+`);
+}
+function escapeHtml11(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function loadQuotaWatchState(stateDir) {
+  const path = join28(stateDir, STATE_FILE2);
+  if (!existsSync31(path))
+    return emptyQuotaWatchState();
+  try {
+    const raw = readFileSync30(path, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return emptyQuotaWatchState();
+    }
+    const result = {};
+    for (const [key, val] of Object.entries(parsed)) {
+      if (val && typeof val === "object" && !Array.isArray(val) && (val.lastNotifiedHealth === null || val.lastNotifiedHealth === "healthy" || val.lastNotifiedHealth === "throttling") && typeof val.lastNotifiedAt === "number" && Number.isFinite(val.lastNotifiedAt)) {
+        result[key] = val;
+      }
+    }
+    return result;
+  } catch {
+    return emptyQuotaWatchState();
+  }
+}
+function saveQuotaWatchState(stateDir, state4) {
+  mkdirSync17(stateDir, { recursive: true });
+  const path = join28(stateDir, STATE_FILE2);
+  writeFileSync19(path, JSON.stringify(state4, null, 2) + `
 `, { mode: 384 });
 }
+function patchQuotaWatchState(current, accountLabel, accountState) {
+  return { ...current, [accountLabel]: accountState };
+}
+
+// gateway/gateway.ts
+init_auth_snapshot_format();
 
 // gateway/turn-active-marker.ts
 import {
   closeSync as closeSync5,
-  existsSync as existsSync30,
-  mkdirSync as mkdirSync16,
+  existsSync as existsSync32,
+  mkdirSync as mkdirSync18,
   openSync as openSync5,
-  readFileSync as readFileSync29,
+  readFileSync as readFileSync31,
   statSync as statSync9,
   unlinkSync as unlinkSync11,
   utimesSync as utimesSync2,
-  writeFileSync as writeFileSync18
+  writeFileSync as writeFileSync20
 } from "node:fs";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 var TURN_ACTIVE_MARKER_FILE2 = "turn-active.json";
 function writeTurnActiveMarker(stateDir, marker) {
   try {
-    mkdirSync16(stateDir, { recursive: true });
-    writeFileSync18(join28(stateDir, TURN_ACTIVE_MARKER_FILE2), JSON.stringify(marker, null, 2) + `
+    mkdirSync18(stateDir, { recursive: true });
+    writeFileSync20(join29(stateDir, TURN_ACTIVE_MARKER_FILE2), JSON.stringify(marker, null, 2) + `
 `, { mode: 384 });
   } catch {}
 }
 function touchTurnActiveMarker2(stateDir) {
-  const path = join28(stateDir, TURN_ACTIVE_MARKER_FILE2);
-  if (!existsSync30(path))
+  const path = join29(stateDir, TURN_ACTIVE_MARKER_FILE2);
+  if (!existsSync32(path))
     return;
   const now = new Date;
   try {
@@ -49785,12 +50107,12 @@ function touchTurnActiveMarker2(stateDir) {
 }
 function removeTurnActiveMarker(stateDir) {
   try {
-    unlinkSync11(join28(stateDir, TURN_ACTIVE_MARKER_FILE2));
+    unlinkSync11(join29(stateDir, TURN_ACTIVE_MARKER_FILE2));
   } catch {}
 }
 function sweepStaleTurnActiveMarker(stateDir, opts) {
-  const path = join28(stateDir, TURN_ACTIVE_MARKER_FILE2);
-  if (!existsSync30(path))
+  const path = join29(stateDir, TURN_ACTIVE_MARKER_FILE2);
+  if (!existsSync32(path))
     return false;
   const now = opts.now ?? Date.now();
   try {
@@ -49802,7 +50124,7 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
       return false;
     let payload = null;
     try {
-      payload = readFileSync29(path, "utf8");
+      payload = readFileSync31(path, "utf8");
     } catch {}
     unlinkSync11(path);
     if (opts.onRemove) {
@@ -49821,10 +50143,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.0";
-var COMMIT_SHA = "d7cd6faa";
-var COMMIT_DATE = "2026-05-28T06:28:21Z";
-var LATEST_PR = 1954;
+var VERSION = "0.14.1";
+var COMMIT_SHA = "e51a8794";
+var COMMIT_DATE = "2026-05-28T07:24:12Z";
+var LATEST_PR = 1956;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -49898,11 +50220,11 @@ init_peercred();
 import * as net4 from "node:net";
 import * as fs2 from "node:fs";
 import { homedir as homedir11 } from "node:os";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 var DEFAULT_TIMEOUT_MS4 = 2000;
 var UNLOCK_TIMEOUT_MS = 30000;
-var LEGACY_SOCKET_PATH2 = join29(homedir11(), ".switchroom", "vault-broker.sock");
-var OPERATOR_SOCKET_PATH2 = join29(homedir11(), ".switchroom", "broker-operator", "sock");
+var LEGACY_SOCKET_PATH2 = join30(homedir11(), ".switchroom", "vault-broker.sock");
+var OPERATOR_SOCKET_PATH2 = join30(homedir11(), ".switchroom", "broker-operator", "sock");
 function defaultBrokerSocketPath2() {
   if (fs2.existsSync(OPERATOR_SOCKET_PATH2))
     return OPERATOR_SOCKET_PATH2;
@@ -50124,8 +50446,8 @@ function resolveVaultApprovalPosture(broker) {
 }
 
 // registry/turns-schema.ts
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync17 } from "fs";
-import { join as join30 } from "path";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync19 } from "fs";
+import { join as join31 } from "path";
 var DatabaseClass2 = null;
 function loadDatabaseClass2() {
   if (DatabaseClass2 != null)
@@ -50184,9 +50506,9 @@ function applySchema(db2) {
 }
 function openTurnsDb(agentDir) {
   const Database = loadDatabaseClass2();
-  const dir = join30(agentDir, "telegram");
-  mkdirSync17(dir, { recursive: true, mode: 448 });
-  const path = join30(dir, "registry.db");
+  const dir = join31(agentDir, "telegram");
+  mkdirSync19(dir, { recursive: true, mode: 448 });
+  const path = join31(dir, "registry.db");
   const db2 = new Database(path, { create: true });
   applySchema(db2);
   try {
@@ -50327,11 +50649,11 @@ installGlobalErrorHandlers();
 process.on("beforeExit", () => {
   shutdownAnalytics();
 });
-var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join32(homedir12(), ".claude", "channels", "telegram");
-var ACCESS_FILE = join32(STATE_DIR, "access.json");
-var APPROVED_DIR = join32(STATE_DIR, "approved");
-var ENV_FILE = join32(STATE_DIR, ".env");
-var INBOX_DIR = join32(STATE_DIR, "inbox");
+var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join33(homedir12(), ".claude", "channels", "telegram");
+var ACCESS_FILE = join33(STATE_DIR, "access.json");
+var APPROVED_DIR = join33(STATE_DIR, "approved");
+var ENV_FILE = join33(STATE_DIR, ".env");
+var INBOX_DIR = join33(STATE_DIR, "inbox");
 function triggerSelfRestart(targetAgent, reason, delayMs = 300) {
   const isDocker = process.env.SWITCHROOM_RUNTIME === "docker";
   const selfAgent = process.env.SWITCHROOM_AGENT_NAME;
@@ -50396,7 +50718,7 @@ function formatBootVersion() {
 }
 try {
   chmodSync5(ENV_FILE, 384);
-  for (const line of readFileSync32(ENV_FILE, "utf8").split(`
+  for (const line of readFileSync34(ENV_FILE, "utf8").split(`
 `)) {
     const m = line.match(/^(\w+)=(.*)$/);
     if (m && process.env[m[1]] === undefined)
@@ -50449,7 +50771,7 @@ installTgPostLogger(bot);
 var _rawSendMessageDraft = bot.api.raw.sendMessageDraft;
 var GRAMMY_VERSION = (() => {
   try {
-    const raw = readFileSync32(new URL("../../node_modules/grammy/package.json", import.meta.url), "utf8");
+    const raw = readFileSync34(new URL("../../node_modules/grammy/package.json", import.meta.url), "utf8");
     return JSON.parse(raw).version ?? "unknown";
   } catch {
     return "unknown";
@@ -50522,7 +50844,7 @@ function assertSendable(f) {
   } catch {
     throw new Error(`refusing to send file \u2014 cannot resolve real path: ${f}`);
   }
-  const inbox = join32(stateReal, "inbox");
+  const inbox = join33(stateReal, "inbox");
   if (real.startsWith(stateReal + sep3) && !real.startsWith(inbox + sep3)) {
     throw new Error(`refusing to send channel state: ${f}`);
   }
@@ -50541,7 +50863,7 @@ function assertSendable(f) {
 }
 function readAccessFile() {
   try {
-    const raw = readFileSync32(ACCESS_FILE, "utf8");
+    const raw = readFileSync34(ACCESS_FILE, "utf8");
     const parsed = JSON.parse(raw);
     const allowFrom = validateStringArray("allowFrom", parsed.allowFrom ?? []);
     const groups = {};
@@ -50575,7 +50897,7 @@ function readAccessFile() {
     if (err.code === "ENOENT")
       return defaultAccess();
     try {
-      renameSync12(ACCESS_FILE, `${ACCESS_FILE}.corrupt-${Date.now()}`);
+      renameSync13(ACCESS_FILE, `${ACCESS_FILE}.corrupt-${Date.now()}`);
     } catch {}
     process.stderr.write(`telegram gateway: access.json is corrupt, moved aside. Starting fresh.
 `);
@@ -50606,11 +50928,11 @@ function assertAllowedChat(chat_id) {
 function saveAccess(a) {
   if (STATIC)
     return;
-  mkdirSync21(STATE_DIR, { recursive: true, mode: 448 });
+  mkdirSync23(STATE_DIR, { recursive: true, mode: 448 });
   const tmp = ACCESS_FILE + ".tmp";
-  writeFileSync21(tmp, JSON.stringify(a, null, 2) + `
+  writeFileSync23(tmp, JSON.stringify(a, null, 2) + `
 `, { mode: 384 });
-  renameSync12(tmp, ACCESS_FILE);
+  renameSync13(tmp, ACCESS_FILE);
 }
 function pruneExpired(a) {
   const now = Date.now();
@@ -50628,7 +50950,7 @@ var HISTORY_ENABLED = HISTORY_ACCESS.historyEnabled !== false;
 if (HISTORY_ENABLED) {
   try {
     initHistory(STATE_DIR, HISTORY_ACCESS.historyRetentionDays ?? 30);
-    process.stderr.write(`telegram gateway: history capture enabled at ${join32(STATE_DIR, "history.db")}
+    process.stderr.write(`telegram gateway: history capture enabled at ${join33(STATE_DIR, "history.db")}
 `);
   } catch (err) {
     process.stderr.write(`telegram gateway: history init failed (${err.message}) \u2014 capture disabled
@@ -50645,10 +50967,10 @@ try {
     process.stderr.write(`telegram gateway: turn-registry boot-reaper stamped ${reaped} orphaned turn(s) as ended_via='restart'
 `);
   } else {
-    process.stderr.write(`telegram gateway: turn-registry initialized at ${join32(agentDir, "telegram", "registry.db")}
+    process.stderr.write(`telegram gateway: turn-registry initialized at ${join33(agentDir, "telegram", "registry.db")}
 `);
   }
-  const pendingEnvPath = join32(agentDir, ".pending-turn.env");
+  const pendingEnvPath = join33(agentDir, ".pending-turn.env");
   try {
     const pending2 = findMostRecentInterruptedTurn(turnsDb);
     if (pending2 != null) {
@@ -50662,13 +50984,13 @@ try {
         `SWITCHROOM_PENDING_STARTED_AT=${pending2.started_at}`
       ];
       const pendingEnvTmp = `${pendingEnvPath}.tmp-${process.pid}`;
-      writeFileSync21(pendingEnvTmp, lines.join(`
+      writeFileSync23(pendingEnvTmp, lines.join(`
 `) + `
 `, { mode: 384 });
-      renameSync12(pendingEnvTmp, pendingEnvPath);
+      renameSync13(pendingEnvTmp, pendingEnvPath);
       process.stderr.write(`telegram gateway: pending-turn env written to ${pendingEnvPath} turnKey=${pending2.turn_key} endedVia=${pending2.ended_via ?? "open"}
 `);
-    } else if (existsSync34(pendingEnvPath)) {
+    } else if (existsSync36(pendingEnvPath)) {
       rmSync4(pendingEnvPath, { force: true });
       process.stderr.write(`telegram gateway: pending-turn env cleared (clean previous shutdown)
 `);
@@ -50722,7 +51044,7 @@ function checkApprovals() {
     return;
   }
   for (const senderId of files) {
-    const file = join32(APPROVED_DIR, senderId);
+    const file = join33(APPROVED_DIR, senderId);
     bot.api.sendMessage(senderId, "Paired! Say hi to Claude.").then(() => rmSync4(file, { force: true }), (err) => {
       process.stderr.write(`telegram gateway: failed to send approval confirm: ${err}
 `);
@@ -51606,11 +51928,11 @@ var unpinProgressCardForChat = null;
 var getPinnedProgressCardMessageId = null;
 var completeProgressCardTurn = null;
 var subagentWatcher = null;
-var SOCKET_PATH = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join32(STATE_DIR, "gateway.sock");
-mkdirSync21(STATE_DIR, { recursive: true, mode: 448 });
-var GATEWAY_PID_PATH = process.env.SWITCHROOM_GATEWAY_PID_FILE ?? join32(STATE_DIR, "gateway.pid.json");
-var GATEWAY_SESSION_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_SESSION_MARKER ?? join32(STATE_DIR, "gateway-session.json");
-var GATEWAY_CLEAN_SHUTDOWN_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_CLEAN_SHUTDOWN_MARKER ?? join32(STATE_DIR, "clean-shutdown.json");
+var SOCKET_PATH = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join33(STATE_DIR, "gateway.sock");
+mkdirSync23(STATE_DIR, { recursive: true, mode: 448 });
+var GATEWAY_PID_PATH = process.env.SWITCHROOM_GATEWAY_PID_FILE ?? join33(STATE_DIR, "gateway.pid.json");
+var GATEWAY_SESSION_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_SESSION_MARKER ?? join33(STATE_DIR, "gateway-session.json");
+var GATEWAY_CLEAN_SHUTDOWN_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_CLEAN_SHUTDOWN_MARKER ?? join33(STATE_DIR, "clean-shutdown.json");
 var GATEWAY_STARTED_AT_MS = Date.now();
 var BOOT_CARD_ENABLED = process.env.SWITCHROOM_BOOT_CARD !== "false";
 var activeBootCard = null;
@@ -51639,7 +51961,7 @@ function ensureIssuesCard(chatId, threadId) {
     bot: botApi,
     log: (msg) => process.stderr.write(`telegram gateway: ${msg}
 `),
-    persistPath: join32(stateDir, "issues-card.json")
+    persistPath: join33(stateDir, "issues-card.json")
   });
   activeIssuesWatcher = startIssuesWatcher({
     stateDir,
@@ -51808,13 +52130,13 @@ startTimer2({
   }
 });
 var inboundSpool = STATIC ? undefined : createInboundSpool({
-  path: join32(STATE_DIR, "inbound-spool.jsonl"),
+  path: join33(STATE_DIR, "inbound-spool.jsonl"),
   fs: {
     appendFileSync: (p, d) => appendFileSync3(p, d),
-    readFileSync: (p) => readFileSync32(p, "utf8"),
-    writeFileSync: (p, d) => writeFileSync21(p, d),
-    renameSync: (a, b) => renameSync12(a, b),
-    existsSync: (p) => existsSync34(p),
+    readFileSync: (p) => readFileSync34(p, "utf8"),
+    writeFileSync: (p, d) => writeFileSync23(p, d),
+    renameSync: (a, b) => renameSync13(a, b),
+    existsSync: (p) => existsSync36(p),
     statSizeSync: (p) => statSync13(p).size
   }
 });
@@ -51927,11 +52249,12 @@ var ipcServer = createIpcServer({
               return;
             }
           })();
+          const resolvedAgentDirForCard = agentDir ?? (process.env.TELEGRAM_STATE_DIR ? __require("path").dirname(process.env.TELEGRAM_STATE_DIR) : "/tmp");
           startBootCard(chatId, threadId, botApiForCard, {
             agentName: agentDisplayName,
             agentSlug,
             version: formatBootVersion(),
-            agentDir: agentDir ?? (process.env.TELEGRAM_STATE_DIR ? __require("path").dirname(process.env.TELEGRAM_STATE_DIR) : "/tmp"),
+            agentDir: resolvedAgentDirForCard,
             gatewayInfo: { pid: process.pid, startedAtMs: GATEWAY_STARTED_AT_MS },
             restartReason: reason,
             restartAgeMs: markerAgeMs,
@@ -51940,6 +52263,7 @@ var ipcServer = createIpcServer({
             probeQuotaViaBroker: (t) => probeQuotaForBootCard(agentSlug, t),
             tmuxSupervisor: process.env.SWITCHROOM_TMUX_SUPERVISOR === "1",
             dockerMode: process.env.SWITCHROOM_RUNTIME === "docker",
+            configSnapshotPath: join33(resolvedAgentDirForCard, ".config-snapshot.json"),
             ...updateOutcomeLine ? { updateOutcomeLine } : {}
           }, ackMsgId).then((handle) => {
             activeBootCard = handle;
@@ -53304,11 +53628,11 @@ async function executeSendGif(rawArgs) {
   };
 }
 async function publishToTelegraph(text, shortName, authorName) {
-  const accountPath = join32(STATE_DIR, "telegraph-account.json");
+  const accountPath = join33(STATE_DIR, "telegraph-account.json");
   let account = null;
   try {
-    if (existsSync34(accountPath)) {
-      const raw = readFileSync32(accountPath, "utf-8");
+    if (existsSync36(accountPath)) {
+      const raw = readFileSync34(accountPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed.shortName && parsed.accessToken) {
         account = parsed;
@@ -53327,8 +53651,8 @@ async function publishToTelegraph(text, shortName, authorName) {
     }
     account = created.value;
     try {
-      mkdirSync21(STATE_DIR, { recursive: true, mode: 448 });
-      writeFileSync21(accountPath, JSON.stringify(account, null, 2), { mode: 384 });
+      mkdirSync23(STATE_DIR, { recursive: true, mode: 448 });
+      writeFileSync23(accountPath, JSON.stringify(account, null, 2), { mode: 384 });
     } catch (err) {
       process.stderr.write(`telegram gateway: telegraph cache write failed: ${err.message}
 `);
@@ -53570,9 +53894,9 @@ async function executeDownloadAttachment(args) {
     fileUniqueId: file.file_unique_id,
     now: Date.now()
   });
-  mkdirSync21(INBOX_DIR, { recursive: true, mode: 448 });
+  mkdirSync23(INBOX_DIR, { recursive: true, mode: 448 });
   assertInsideInbox(INBOX_DIR, dlPath);
-  writeFileSync21(dlPath, buf, { mode: 384 });
+  writeFileSync23(dlPath, buf, { mode: 384 });
   return { content: [{ type: "text", text: dlPath }] };
 }
 async function executeEditMessage(args) {
@@ -55344,14 +55668,14 @@ function restartMarkerPath() {
   const agentDir = resolveAgentDirFromEnv();
   if (!agentDir)
     return null;
-  return join32(agentDir, "restart-pending.json");
+  return join33(agentDir, "restart-pending.json");
 }
 function writeRestartMarker(marker) {
   const p = restartMarkerPath();
   if (!p)
     return;
   try {
-    writeFileSync21(p, JSON.stringify(marker));
+    writeFileSync23(p, JSON.stringify(marker));
     lastPlannedRestartAt = Date.now();
     process.stderr.write(`telegram gateway: restart-marker: write chat_id=${marker.chat_id} thread_id=${marker.thread_id ?? "-"} ack=${marker.ack_message_id ?? "-"} path=${p}
 `);
@@ -55370,7 +55694,7 @@ function readRestartMarker() {
   if (!p)
     return null;
   try {
-    return JSON.parse(readFileSync32(p, "utf8"));
+    return JSON.parse(readFileSync34(p, "utf8"));
   } catch {
     return null;
   }
@@ -55468,7 +55792,7 @@ var _dockerReachable;
 function isDockerReachable() {
   if (_dockerReachable !== undefined)
     return _dockerReachable;
-  if (!existsSync34("/var/run/docker.sock")) {
+  if (!existsSync36("/var/run/docker.sock")) {
     _dockerReachable = false;
     return _dockerReachable;
   }
@@ -55485,12 +55809,12 @@ function _resetDockerReachableCache() {
 }
 function spawnSwitchroomDetached(args, onFailure) {
   const fullArgs = SWITCHROOM_CONFIG ? ["--config", SWITCHROOM_CONFIG, ...args] : args;
-  const logPath = join32(STATE_DIR, "detached-spawn.log");
+  const logPath = join33(STATE_DIR, "detached-spawn.log");
   let outFd = null;
   try {
-    mkdirSync21(STATE_DIR, { recursive: true });
+    mkdirSync23(STATE_DIR, { recursive: true });
     outFd = openSync8(logPath, "a");
-    writeFileSync21(logPath, `
+    writeFileSync23(logPath, `
 [${new Date().toISOString()}] spawn ${SWITCHROOM_CLI} ${fullArgs.join(" ")}
 `, { flag: "a" });
   } catch {}
@@ -55516,7 +55840,7 @@ function spawnSwitchroomDetached(args, onFailure) {
         return;
       let tail = "";
       try {
-        const full = readFileSync32(logPath, "utf8");
+        const full = readFileSync34(logPath, "utf8");
         tail = full.split(`
 `).slice(-30).join(`
 `).trim();
@@ -55858,10 +56182,10 @@ bot.use(async (ctx, next) => {
 });
 function readRecentDenialsForAgent(agentName3, windowMs, limit) {
   try {
-    const auditPath = join32(homedir12(), ".switchroom", "vault-audit.log");
-    if (!existsSync34(auditPath))
+    const auditPath = join33(homedir12(), ".switchroom", "vault-audit.log");
+    if (!existsSync36(auditPath))
       return [];
-    const raw = readFileSync32(auditPath, "utf8");
+    const raw = readFileSync34(auditPath, "utf8");
     return recentDenialsFromAuditLog(raw, { agentName: agentName3, windowMs, limit });
   } catch {
     return [];
@@ -55912,7 +56236,7 @@ async function buildAgentMetadata(agentName3) {
   try {
     const agentDir = resolveAgentDirFromEnv();
     if (agentDir) {
-      const raw = readFileSync32(join32(agentDir, ".claude", ".claude.json"), "utf8");
+      const raw = readFileSync34(join33(agentDir, ".claude", ".claude.json"), "utf8");
       claudeJson = JSON.parse(raw);
     }
   } catch {}
@@ -56126,9 +56450,9 @@ bot.command("restart", async (ctx) => {
 function flushAgentHandoff(agentDir) {
   let removed = 0;
   for (const fname of [".handoff.md", ".handoff-topic"]) {
-    const p = join32(agentDir, fname);
+    const p = join33(agentDir, fname);
     try {
-      if (existsSync34(p)) {
+      if (existsSync36(p)) {
         unlinkSync14(p);
         removed++;
       }
@@ -56184,7 +56508,7 @@ async function handleNewOrResetCommand(ctx, kind) {
   writeRestartMarker({ chat_id: chatId, thread_id: threadId ?? null, ack_message_id: ackId, ts: Date.now() });
   if (agentDir != null) {
     try {
-      writeFileSync21(join32(agentDir, ".force-fresh-session"), `${kind} at ${new Date().toISOString()}
+      writeFileSync23(join33(agentDir, ".force-fresh-session"), `${kind} at ${new Date().toISOString()}
 `, "utf8");
     } catch (err) {
       process.stderr.write(`telegram gateway: failed to write force-fresh marker: ${err}
@@ -56543,16 +56867,16 @@ bot.command("interrupt", async (ctx) => {
   await runSwitchroomCommand(ctx, ["agent", "interrupt", name], `interrupt ${name}`);
 });
 var lockoutOps = {
-  readFileSync: (p, enc) => readFileSync32(p, enc),
-  writeFileSync: (p, data, opts) => writeFileSync21(p, data, opts),
-  existsSync: (p) => existsSync34(p),
-  mkdirSync: (p, opts) => mkdirSync21(p, opts),
-  joinPath: (...parts) => join32(...parts)
+  readFileSync: (p, enc) => readFileSync34(p, enc),
+  writeFileSync: (p, data, opts) => writeFileSync23(p, data, opts),
+  existsSync: (p) => existsSync36(p),
+  mkdirSync: (p, opts) => mkdirSync23(p, opts),
+  joinPath: (...parts) => join33(...parts)
 };
 var FLEET_FALLBACK_DEDUP_MS = 30000;
 function isAuthBrokerSocketReachable() {
   try {
-    return existsSync34(resolveAuthBrokerSocketPath2());
+    return existsSync36(resolveAuthBrokerSocketPath2());
   } catch {
     return false;
   }
@@ -56613,7 +56937,7 @@ async function runCreditWatch() {
   if (!agentDir)
     return;
   const agentName3 = getMyAgentName();
-  const claudeConfigDir = join32(agentDir, ".claude");
+  const claudeConfigDir = join33(agentDir, ".claude");
   const stateDir = STATE_DIR;
   const reason = readClaudeJsonOverage(claudeConfigDir);
   const prev = loadCreditState(stateDir);
@@ -56640,6 +56964,99 @@ async function runCreditWatch() {
 `);
   }
 }
+async function runQuotaWatch() {
+  const agentName3 = getMyAgentName();
+  const stateDir = STATE_DIR;
+  const brokerClient = await getAuthBrokerClient(agentName3);
+  if (!brokerClient) {
+    process.stderr.write(`telegram gateway: quota-watch: broker client unavailable \u2014 skipping
+`);
+    return;
+  }
+  let listStateData;
+  try {
+    listStateData = await brokerClient.listState();
+  } catch (err) {
+    process.stderr.write(`telegram gateway: quota-watch: listState failed: ${err}
+`);
+    return;
+  }
+  if (!listStateData.accounts || listStateData.accounts.length === 0) {
+    return;
+  }
+  const snapshots = buildSnapshotsFromCachedState(listStateData);
+  let watchState = loadQuotaWatchState(stateDir);
+  const now = Date.now();
+  const access = loadAccess();
+  const pendingTransitions = [];
+  const labelToSnapIndex = new Map(snapshots.map((s, i) => [s.label, i]));
+  for (const snap of snapshots) {
+    const prev = watchState[snap.label] ?? emptyAccountState();
+    const decision = evaluateQuotaWatchAccount({ agentName: agentName3, snap, prev, now });
+    if (decision.kind !== "skip") {
+      pendingTransitions.push({
+        accountLabel: snap.label,
+        snapIndex: labelToSnapIndex.get(snap.label) ?? -1,
+        decision
+      });
+    }
+  }
+  if (pendingTransitions.length === 0) {
+    return;
+  }
+  const crossingLabels = pendingTransitions.map((t) => t.accountLabel);
+  let freshProbeMap = new Map;
+  try {
+    const probeData = await brokerClient.probeQuota(crossingLabels, 8000);
+    for (const entry of probeData.results) {
+      freshProbeMap.set(entry.label, entry.result);
+    }
+  } catch (err) {
+    process.stderr.write(`telegram gateway: quota-watch: probe for crossing accounts failed: ${err}
+`);
+  }
+  let mutatedState = watchState;
+  const notifications = [];
+  for (const { accountLabel, snapIndex, decision } of pendingTransitions) {
+    const freshResult = freshProbeMap.get(accountLabel);
+    let enrichedDecision = decision;
+    if (decision.kind !== "notify")
+      continue;
+    if (freshResult && freshResult.ok && snapIndex >= 0) {
+      const enrichedSnap = { ...snapshots[snapIndex], quota: freshResult.data };
+      const prev = watchState[accountLabel] ?? emptyAccountState();
+      const re = evaluateQuotaWatchAccount({ agentName: agentName3, snap: enrichedSnap, prev, now });
+      if (re.kind === "notify" && re.transition === decision.transition) {
+        enrichedDecision = re;
+      } else if (re.kind === "skip") {
+        continue;
+      }
+    }
+    if (enrichedDecision.kind !== "notify")
+      continue;
+    notifications.push({ message: enrichedDecision.message, accountLabel });
+    mutatedState = patchQuotaWatchState(mutatedState, accountLabel, enrichedDecision.newAccountState);
+  }
+  if (notifications.length === 0) {
+    return;
+  }
+  for (const { message, accountLabel } of notifications) {
+    for (const chat_id of access.allowFrom) {
+      await swallowingApiCall(() => bot.api.sendMessage(chat_id, message, {
+        parse_mode: "HTML",
+        link_preview_options: { is_disabled: true }
+      }), { chat_id, verb: "quota-watch.notify" });
+    }
+    process.stderr.write(`telegram gateway: quota-watch: notified transition for account=${accountLabel}
+`);
+  }
+  try {
+    saveQuotaWatchState(stateDir, mutatedState);
+  } catch (err) {
+    process.stderr.write(`telegram gateway: quota-watch state persist failed: ${err}
+`);
+  }
+}
 bot.command("auth", async (ctx) => {
   const authSenderId = String(ctx.from?.id ?? "");
   const authOperatorPrivate = ctx.chat?.type === "private" && loadAccess().allowFrom.includes(authSenderId);
@@ -56823,10 +57240,10 @@ async function handleVaultRecentDenialCallback(ctx, data) {
     return;
   }
   const { token, id } = result;
-  const tokenPath = join32(homedir12(), ".switchroom", "agents", agentName3, ".vault-token");
+  const tokenPath = join33(homedir12(), ".switchroom", "agents", agentName3, ".vault-token");
   try {
-    mkdirSync21(join32(homedir12(), ".switchroom", "agents", agentName3), { recursive: true });
-    writeFileSync21(tokenPath, token, { mode: 384 });
+    mkdirSync23(join33(homedir12(), ".switchroom", "agents", agentName3), { recursive: true });
+    writeFileSync23(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created (${escapeHtmlForTg(id)}) but token write failed:</b> ${escapeHtmlForTg(String(err))}
 <i>Recover with: <code>switchroom vault grant ${escapeHtmlForTg(agentName3)} --keys ${escapeHtmlForTg(keyName)} --duration 30d</code> on the host.</i>`, { html: true });
@@ -56902,10 +57319,10 @@ async function performVaultAccessApproval(ctx, pending2, stageId, senderId, atte
     return;
   }
   const { token, id } = result;
-  const tokenPath = join32(homedir12(), ".switchroom", "agents", pending2.agent, ".vault-token");
+  const tokenPath = join33(homedir12(), ".switchroom", "agents", pending2.agent, ".vault-token");
   try {
-    mkdirSync21(join32(homedir12(), ".switchroom", "agents", pending2.agent), { recursive: true });
-    writeFileSync21(tokenPath, token, { mode: 384 });
+    mkdirSync23(join33(homedir12(), ".switchroom", "agents", pending2.agent), { recursive: true });
+    writeFileSync23(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created (${escapeHtmlForTg(id)}) but token write failed:</b> ${escapeHtmlForTg(String(err))}
 <i>Recover with: <code>switchroom vault grant ${escapeHtmlForTg(pending2.agent)} --keys ${escapeHtmlForTg(pending2.key)} --duration ${Math.round(pending2.ttl_seconds / 86400)}d</code> on the host.</i>`, { html: true });
@@ -57380,10 +57797,10 @@ async function executeGrantWizard(ctx, chatId, state4) {
     return;
   }
   const { token, id } = result;
-  const tokenPath = join32(homedir12(), ".switchroom", "agents", state4.agent, ".vault-token");
+  const tokenPath = join33(homedir12(), ".switchroom", "agents", state4.agent, ".vault-token");
   try {
-    mkdirSync21(join32(homedir12(), ".switchroom", "agents", state4.agent), { recursive: true });
-    writeFileSync21(tokenPath, token, { mode: 384 });
+    mkdirSync23(join33(homedir12(), ".switchroom", "agents", state4.agent), { recursive: true });
+    writeFileSync23(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created but token write failed:</b> ${escapeHtmlForTg(String(err))}`, { html: true });
     return;
@@ -57731,15 +58148,6 @@ async function handleOperatorEventCallback(ctx, data) {
       }
       return;
     }
-    case "swap-slot":
-    case "add-slot": {
-      await ctx.answerCallbackQuery({ text: "Phase 4c will wire this" }).catch(() => {});
-      const cmd = action === "swap-slot" ? `auth use ${agent} <slot-name>` : `auth add ${agent}`;
-      await ctx.reply(`Phase 4c will wire ${action} buttons. Until then, run in terminal: <code>switchroom ${cmd}</code>`, {
-        parse_mode: "HTML"
-      });
-      return;
-    }
     default: {
       await ctx.answerCallbackQuery({ text: `Unknown action: ${action}` }).catch(() => {});
       return;
@@ -57823,8 +58231,8 @@ async function handleAuthDashboardCallback(ctx) {
         return hit?.result ?? { ok: false, reason: "broker returned no result for account" };
       });
       const tz = process.env.SWITCHROOM_TIMEZONE ?? process.env.TZ ?? "UTC";
-      const { renderAuthSnapshotFormat2: renderAuthSnapshotFormat23, buildSnapshotsFromState: buildSnapshotsFromState3, buildSnapshotKeyboard: buildSnapshotKeyboard3 } = await Promise.resolve().then(() => (init_auth_snapshot_format(), exports_auth_snapshot_format));
-      const snapshots = buildSnapshotsFromState3(state4, quotas);
+      const { renderAuthSnapshotFormat2: renderAuthSnapshotFormat23, buildSnapshotsFromState: buildSnapshotsFromState4, buildSnapshotKeyboard: buildSnapshotKeyboard3 } = await Promise.resolve().then(() => (init_auth_snapshot_format(), exports_auth_snapshot_format));
+      const snapshots = buildSnapshotsFromState4(state4, quotas);
       const text = renderAuthSnapshotFormat23(snapshots, {
         tz,
         now: new Date,
@@ -58219,9 +58627,9 @@ bot.command("usage", async (ctx) => {
           const hit = probeResp.results.find((r) => r.label === a.label);
           return hit?.result ?? { ok: false, reason: "broker returned no result for account" };
         });
-        const { renderAuthSnapshotFormat2: renderAuthSnapshotFormat23, buildSnapshotsFromState: buildSnapshotsFromState3 } = await Promise.resolve().then(() => (init_auth_snapshot_format(), exports_auth_snapshot_format));
+        const { renderAuthSnapshotFormat2: renderAuthSnapshotFormat23, buildSnapshotsFromState: buildSnapshotsFromState4 } = await Promise.resolve().then(() => (init_auth_snapshot_format(), exports_auth_snapshot_format));
         const tz = process.env.SWITCHROOM_TIMEZONE ?? process.env.TZ ?? "UTC";
-        const snapshots = buildSnapshotsFromState3(state4, quotas);
+        const snapshots = buildSnapshotsFromState4(state4, quotas);
         const text = renderAuthSnapshotFormat23(snapshots, {
           tz,
           now: new Date,
@@ -58240,7 +58648,7 @@ bot.command("usage", async (ctx) => {
     await switchroomReply(ctx, "<b>/usage:</b> cannot resolve agent dir.", { html: true });
     return;
   }
-  const result = await fetchQuota2({ claudeConfigDir: join32(agentDir, ".claude") });
+  const result = await fetchQuota2({ claudeConfigDir: join33(agentDir, ".claude") });
   if (!result.ok) {
     await switchroomReply(ctx, `<b>/usage:</b> ${escapeHtmlForTg(result.reason)}`, { html: true });
     return;
@@ -58743,9 +59151,9 @@ bot.on("message:photo", async (ctx) => {
         fileUniqueId: best.file_unique_id,
         now: Date.now()
       });
-      mkdirSync21(INBOX_DIR, { recursive: true, mode: 448 });
+      mkdirSync23(INBOX_DIR, { recursive: true, mode: 448 });
       assertInsideInbox(INBOX_DIR, dlPath);
-      writeFileSync21(dlPath, buf, { mode: 384 });
+      writeFileSync23(dlPath, buf, { mode: 384 });
       return dlPath;
     } catch (err) {
       const msg = err instanceof Error ? err.message : "unknown error";
@@ -58785,8 +59193,8 @@ async function maybeTranscribeVoice(fileId, mimeType, language) {
   let apiKey = null;
   try {
     const path = __require("path").join(__require("os").homedir(), ".switchroom", "openai-api-key");
-    if (existsSync34(path)) {
-      apiKey = readFileSync32(path, "utf-8").trim();
+    if (existsSync36(path)) {
+      apiKey = readFileSync34(path, "utf-8").trim();
     }
   } catch (err) {
     process.stderr.write(`telegram gateway: voice-in: failed to read api key: ${err.message}
@@ -59642,11 +60050,12 @@ var didOneTimeSetup = false;
                         return;
                       }
                     })();
+                    const resolvedAgentDirForBootCard = agentDir ?? join33(homedir12(), ".switchroom", "agents", agentSlug);
                     const handle = await startBootCard(chatId, threadId, botApiForCard, {
                       agentName: agentDisplayName,
                       agentSlug,
                       version: formatBootVersion(),
-                      agentDir: agentDir ?? join32(homedir12(), ".switchroom", "agents", agentSlug),
+                      agentDir: resolvedAgentDirForBootCard,
                       gatewayInfo: { pid: process.pid, startedAtMs: GATEWAY_STARTED_AT_MS },
                       restartReason: reason,
                       restartAgeMs: markerAgeMs,
@@ -59655,6 +60064,7 @@ var didOneTimeSetup = false;
                       probeQuotaViaBroker: (t) => probeQuotaForBootCard(agentSlug, t),
                       tmuxSupervisor: process.env.SWITCHROOM_TMUX_SUPERVISOR === "1",
                       dockerMode: process.env.SWITCHROOM_RUNTIME === "docker",
+                      configSnapshotPath: join33(resolvedAgentDirForBootCard, ".config-snapshot.json"),
                       ...updateOutcomeLine ? { updateOutcomeLine } : {}
                     }, ackMsgId);
                     activeBootCard = handle;
@@ -59694,6 +60104,21 @@ var didOneTimeSetup = false;
             });
           }, CREDIT_WATCH_POLL_MS).unref();
         }
+        const QUOTA_WATCH_POLL_MS = Number(process.env.SWITCHROOM_QUOTA_WATCH_POLL_MS ?? 900000);
+        if (QUOTA_WATCH_POLL_MS > 0) {
+          setTimeout(() => {
+            runQuotaWatch().catch((err) => {
+              process.stderr.write(`telegram gateway: quota-watch initial run failed: ${err}
+`);
+            });
+          }, 30000);
+          setInterval(() => {
+            runQuotaWatch().catch((err) => {
+              process.stderr.write(`telegram gateway: quota-watch scheduled run failed: ${err}
+`);
+            });
+          }, QUOTA_WATCH_POLL_MS).unref();
+        }
         const RESTART_WATCHDOG_POLL_MS = Number(process.env.SWITCHROOM_RESTART_WATCHDOG_POLL_MS ?? 30000);
         const watchdogAgentName = process.env.SWITCHROOM_AGENT_NAME;
         const watchdogDockerMode = process.env.SWITCHROOM_RUNTIME === "docker";