switchroom 0.14.66 → 0.14.68

package/dist/cli/switchroom.js

@@ -14593,6 +14593,35 @@ function shouldEmitNotionMcp(agentName, config) {
     return false;
   return true;
 }
+function normalizeNotionUuid(uuid) {
+  if (typeof uuid !== "string")
+    return null;
+  const stripped = uuid.replace(/-/g, "").toLowerCase();
+  if (!/^[0-9a-f]{32}$/.test(stripped))
+    return null;
+  return stripped;
+}
+function agentCanAccessNotionDB(config, agentName, dbUuid) {
+  if (!shouldEmitNotionMcp(agentName, config))
+    return false;
+  const targetNorm = normalizeNotionUuid(dbUuid);
+  if (targetNorm === null)
+    return false;
+  const agentConfig = config.agents?.[agentName];
+  const allowedNames = agentConfig?.notion_workspace?.databases;
+  if (allowedNames === undefined || allowedNames.length === 0) {
+    return true;
+  }
+  const dbMap = config.notion_workspace?.databases ?? {};
+  for (const name of allowedNames) {
+    const uuid = dbMap[name];
+    if (!uuid)
+      continue;
+    if (normalizeNotionUuid(uuid) === targetNorm)
+      return true;
+  }
+  return false;
+}
 function validateNotionWorkspaceConfig(config) {
   const issues = [];
   const dbMap = config.notion_workspace?.databases ?? {};
@@ -23623,7 +23652,7 @@ function bringUpAgentService(opts) {
   writeFileSync6(composePath, compose, { mode: 384 });
   const dockerBin = opts.dockerBin ?? "docker";
   const stdio = opts.stdio ?? "inherit";
-  for (const svc of ["vault-broker", "approval-kernel"]) {
+  for (const svc of ["vault-broker", "approval-kernel", "switchroom-auth-broker"]) {
     execFileSync6(dockerBin, [
       "compose",
       "-f",
@@ -23651,9 +23680,93 @@ var init_docker_fleet = __esm(() => {
   init_loader();
 });
 
+// src/agents/singleton-reconcile.ts
+import { execFileSync as execFileSync7 } from "node:child_process";
+import { readFileSync as readFileSync13 } from "node:fs";
+function singletonContainerName(svc) {
+  return svc.startsWith("switchroom-") ? svc : `switchroom-${svc}`;
+}
+function readPinnedSingletonImages(composeText) {
+  let doc;
+  try {
+    doc = import_yaml3.parse(composeText);
+  } catch {
+    return {};
+  }
+  const out = {};
+  for (const svc of SINGLETON_SERVICES) {
+    const img = doc?.services?.[svc]?.image;
+    if (typeof img === "string" && img.length > 0)
+      out[svc] = img;
+  }
+  return out;
+}
+function defaultInspectImage(dockerBin, container) {
+  try {
+    const out = execFileSync7(dockerBin, ["inspect", "-f", "{{.Config.Image}}", container], { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: 5000 }).trim();
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+function detectSingletonDrift(deps) {
+  const dockerBin = deps.dockerBin ?? "docker";
+  const readCompose = deps.readCompose ?? ((p) => readFileSync13(p, "utf-8"));
+  const inspectImage = deps.inspectImage ?? ((c) => defaultInspectImage(dockerBin, c));
+  let pinned = {};
+  try {
+    pinned = readPinnedSingletonImages(readCompose(deps.composeFile));
+  } catch {
+    pinned = {};
+  }
+  return SINGLETON_SERVICES.map((service) => {
+    const container = singletonContainerName(service);
+    const running = inspectImage(container);
+    const pin = pinned[service] ?? null;
+    const needsRecreate = pin !== null && running !== pin;
+    return { service, container, running, pinned: pin, needsRecreate };
+  });
+}
+function defaultRecreate(dockerBin, project, composeFile, service) {
+  execFileSync7(dockerBin, ["compose", "-p", project, "-f", composeFile, "up", "-d", "--no-deps", service], { stdio: ["ignore", "pipe", "pipe"], timeout: 120000 });
+}
+function reconcileSingletons(deps) {
+  const dockerBin = deps.dockerBin ?? "docker";
+  const project = deps.project ?? "switchroom";
+  const log = deps.log ?? ((m) => process.stderr.write(m + `
+`));
+  const recreate = deps.recreate ?? ((svc) => defaultRecreate(dockerBin, project, deps.composeFile, svc));
+  const drift = detectSingletonDrift(deps);
+  const recreated = [];
+  const failed = [];
+  for (const d of drift) {
+    if (!d.needsRecreate)
+      continue;
+    log(`singleton-reconcile: ${d.service} drift ${d.running ?? "<absent>"} \u2192 ${d.pinned} \u2014 recreating`);
+    try {
+      recreate(d.service);
+      recreated.push(d.service);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      log(`singleton-reconcile: ${d.service} recreate FAILED: ${msg}`);
+      failed.push({ service: d.service, error: msg });
+    }
+  }
+  return { drift, recreated, failed };
+}
+var import_yaml3, SINGLETON_SERVICES;
+var init_singleton_reconcile = __esm(() => {
+  import_yaml3 = __toESM(require_dist(), 1);
+  SINGLETON_SERVICES = [
+    "vault-broker",
+    "approval-kernel",
+    "switchroom-auth-broker"
+  ];
+});
+
 // src/agents/lifecycle.ts
-import { execFileSync as execFileSync7, spawn, spawnSync } from "node:child_process";
-import { existsSync as existsSync15, mkdirSync as mkdirSync12, writeFileSync as writeFileSync7, renameSync as renameSync4, readFileSync as readFileSync13 } from "node:fs";
+import { execFileSync as execFileSync8, spawn, spawnSync } from "node:child_process";
+import { existsSync as existsSync15, mkdirSync as mkdirSync12, writeFileSync as writeFileSync7, renameSync as renameSync4, readFileSync as readFileSync14 } from "node:fs";
 import { resolve as resolve13, join as join10 } from "node:path";
 import { connect } from "node:net";
 function cleanShutdownMarkerPathForAgent(name) {
@@ -23666,7 +23779,7 @@ function writeRestartReasonMarker(name, reason, opts = {}) {
     mkdirSync12(join10(path, ".."), { recursive: true });
     if (opts.preserveExisting && existsSync15(path)) {
       try {
-        const prev = JSON.parse(readFileSync13(path, "utf-8"));
+        const prev = JSON.parse(readFileSync14(path, "utf-8"));
         if (prev && typeof prev.ts === "number" && Date.now() - prev.ts < 30000 && prev.reason) {
           return;
         }
@@ -23683,7 +23796,7 @@ function buildCliRestartReason(opts) {
   if (!buildCommit)
     return "cli: restart";
   try {
-    const head = execFileSync7("git", ["rev-parse", "HEAD"], {
+    const head = execFileSync8("git", ["rev-parse", "HEAD"], {
       cwd: cwd ?? process.cwd(),
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -23694,7 +23807,7 @@ function buildCliRestartReason(opts) {
       return "cli: restart";
     let subject = "";
     try {
-      subject = execFileSync7("git", ["log", "-1", "--pretty=%s", head], {
+      subject = execFileSync8("git", ["log", "-1", "--pretty=%s", head], {
         cwd: cwd ?? process.cwd(),
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "ignore"]
@@ -23719,9 +23832,12 @@ function composeFilePath() {
     return override;
   return resolve13(resolveSwitchroomHome(), "compose", "docker-compose.yml");
 }
+function reconcileSingletonImages(log) {
+  return reconcileSingletons({ composeFile: composeFilePath(), log });
+}
 function dockerSync(args) {
   try {
-    return execFileSync7("docker", args, {
+    return execFileSync8("docker", args, {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -24103,15 +24219,16 @@ var init_lifecycle = __esm(() => {
   init_loader();
   init_tmux();
   init_docker_fleet();
+  init_singleton_reconcile();
 });
 
 // src/auth/pane-ready-probe.ts
-import { execFileSync as execFileSync9 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 function defaultPaneReadyDeps() {
   return {
     capturePane(sessionName) {
       try {
-        return execFileSync9("tmux", ["capture-pane", "-p", "-t", sessionName, "-S", "-200"], {
+        return execFileSync10("tmux", ["capture-pane", "-p", "-t", sessionName, "-S", "-200"], {
           encoding: "utf-8",
           stdio: ["pipe", "pipe", "pipe"]
         }).trim();
@@ -24151,7 +24268,7 @@ import {
   copyFileSync as copyFileSync5,
   existsSync as existsSync19,
   mkdirSync as mkdirSync14,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync18,
   readdirSync as readdirSync9,
   renameSync as renameSync6,
   rmSync as rmSync4,
@@ -24206,7 +24323,7 @@ function readActiveSlot(agentDir) {
   if (!existsSync19(p))
     return null;
   try {
-    const val = readFileSync17(p, "utf-8").trim();
+    const val = readFileSync18(p, "utf-8").trim();
     return val.length > 0 ? val : null;
   } catch {
     return null;
@@ -24242,7 +24359,7 @@ function readSlotMeta(agentDir, slot) {
   if (!existsSync19(p))
     return null;
   try {
-    return JSON.parse(readFileSync17(p, "utf-8"));
+    return JSON.parse(readFileSync18(p, "utf-8"));
   } catch {
     return null;
   }
@@ -24291,7 +24408,7 @@ function syncLegacyFromActive(agentDir) {
   }
 }
 function atomicCopy(src, dest, mode) {
-  const contents = readFileSync17(src);
+  const contents = readFileSync18(src);
   const tmp = `${dest}.tmp-${process.pid}-${randomBytes2(4).toString("hex")}`;
   try {
     writeFileSync9(tmp, contents, { mode });
@@ -24320,7 +24437,7 @@ function migrateLegacyIfNeeded(agentDir) {
   }
   let token;
   try {
-    token = readFileSync17(legacyToken, "utf-8").trim();
+    token = readFileSync18(legacyToken, "utf-8").trim();
   } catch {
     return { migrated: false };
   }
@@ -24392,9 +24509,9 @@ var init_accounts = __esm(() => {
 });
 
 // src/auth/manager.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync11 } from "node:child_process";
 import {
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   readdirSync as readdirSync10,
   existsSync as existsSync20,
   writeFileSync as writeFileSync10,
@@ -24443,14 +24560,14 @@ function authSessionName(name, slot) {
   return `${base}-${slot.replace(/[^a-zA-Z0-9_.-]/g, "-")}`;
 }
 function tmux(args) {
-  return execFileSync10("tmux", args, {
+  return execFileSync11("tmux", args, {
     encoding: "utf-8",
     stdio: ["pipe", "pipe", "pipe"]
   }).trim();
 }
 function tmuxSessionExists(sessionName) {
   try {
-    execFileSync10("tmux", ["has-session", "-t", sessionName], {
+    execFileSync11("tmux", ["has-session", "-t", sessionName], {
       stdio: ["pipe", "pipe", "pipe"]
     });
     return true;
@@ -24465,7 +24582,7 @@ function readJsonFile(path) {
   if (!existsSync20(path))
     return null;
   try {
-    return JSON.parse(readFileSync18(path, "utf-8"));
+    return JSON.parse(readFileSync19(path, "utf-8"));
   } catch {
     return null;
   }
@@ -24475,7 +24592,7 @@ function readOAuthToken(agentDir) {
   if (!existsSync20(path))
     return null;
   try {
-    const token = readFileSync18(path, "utf-8").trim();
+    const token = readFileSync19(path, "utf-8").trim();
     return token.length > 0 ? token : null;
   } catch {
     return null;
@@ -24487,7 +24604,7 @@ function authFilesAreInaccessible(agentDir) {
     if (!existsSync20(p))
       continue;
     try {
-      readFileSync18(p, "utf-8");
+      readFileSync19(p, "utf-8");
     } catch (err) {
       const code = err?.code;
       if (code === "EACCES" || code === "EPERM")
@@ -24586,7 +24703,7 @@ function readTokenFromCredentialsFile(credentialsFilePath) {
   try {
     if (!existsSync20(credentialsFilePath))
       return null;
-    const raw = readFileSync18(credentialsFilePath, "utf-8");
+    const raw = readFileSync19(credentialsFilePath, "utf-8");
     const parsed = JSON.parse(raw);
     const token = parsed?.claudeAiOauth?.accessToken;
     if (typeof token !== "string")
@@ -24610,7 +24727,7 @@ function readCredentials(agentDir) {
   if (!existsSync20(credPath))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync18(credPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync19(credPath, "utf-8"));
     return parsed.claudeAiOauth ?? null;
   } catch {
     return null;
@@ -24766,7 +24883,7 @@ function readTokenFromLogFile(logPath) {
   if (!existsSync20(logPath))
     return null;
   try {
-    const content = readFileSync18(logPath, "utf-8");
+    const content = readFileSync19(logPath, "utf-8");
     return parseSetupTokenValue(content);
   } catch {
     return null;
@@ -24912,7 +25029,7 @@ var init_manager = __esm(() => {
 import {
   existsSync as existsSync25,
   mkdirSync as mkdirSync16,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync12
 } from "node:fs";
@@ -24925,7 +25042,7 @@ function readQuarantineMarker(telegramStateDir) {
   if (!existsSync25(path))
     return null;
   try {
-    const raw = readFileSync20(path, "utf-8");
+    const raw = readFileSync21(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object")
       return null;
@@ -24981,7 +25098,7 @@ __export(exports_inject, {
   INJECT_BLOCKED: () => INJECT_BLOCKED,
   INJECT_ALLOWLIST: () => INJECT_ALLOWLIST
 });
-import { execFile, execFileSync as execFileSync12 } from "node:child_process";
+import { execFile, execFileSync as execFileSync13 } from "node:child_process";
 import { promisify } from "node:util";
 function validateInjectCommand(command) {
   if (typeof command !== "string" || command.trim().length === 0) {
@@ -25009,7 +25126,7 @@ function makeTmuxRunner(tmuxBin) {
   return {
     capture(socket, session) {
       try {
-        return execFileSync12(tmuxBin, ["-L", socket, "capture-pane", "-p", "-t", session, "-S", "-200"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+        return execFileSync13(tmuxBin, ["-L", socket, "capture-pane", "-p", "-t", session, "-S", "-200"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
       } catch {
         return null;
       }
@@ -25019,11 +25136,11 @@ function makeTmuxRunner(tmuxBin) {
       const flagEnd = rest.findIndex((a) => !a.startsWith("-"));
       const flagsBeforeKeys = flagEnd === -1 ? rest : rest.slice(0, flagEnd);
       const keys = flagEnd === -1 ? [] : rest.slice(flagEnd);
-      execFileSync12(tmuxBin, ["-L", socket, subcmd, ...flagsBeforeKeys, "-t", session, ...keys], { stdio: ["pipe", "pipe", "pipe"] });
+      execFileSync13(tmuxBin, ["-L", socket, subcmd, ...flagsBeforeKeys, "-t", session, ...keys], { stdio: ["pipe", "pipe", "pipe"] });
     },
     hasSession(socket, session) {
       try {
-        execFileSync12(tmuxBin, ["-L", socket, "has-session", "-t", session], {
+        execFileSync13(tmuxBin, ["-L", socket, "has-session", "-t", session], {
           stdio: ["pipe", "pipe", "pipe"]
         });
         return true;
@@ -25856,7 +25973,7 @@ import {
   chownSync,
   existsSync as existsSync28,
   mkdirSync as mkdirSync17,
-  readFileSync as readFileSync22,
+  readFileSync as readFileSync23,
   readdirSync as readdirSync14,
   renameSync as renameSync7,
   rmSync as rmSync10,
@@ -25904,7 +26021,7 @@ function readAccountCredentials(label, home2 = homedir9()) {
   if (!existsSync28(p))
     return null;
   try {
-    return JSON.parse(readFileSync22(p, "utf-8"));
+    return JSON.parse(readFileSync23(p, "utf-8"));
   } catch {
     return null;
   }
@@ -25914,7 +26031,7 @@ function readAccountMeta(label, home2 = homedir9()) {
   if (!existsSync28(p))
     return null;
   try {
-    return JSON.parse(readFileSync22(p, "utf-8"));
+    return JSON.parse(readFileSync23(p, "utf-8"));
   } catch {
     return null;
   }
@@ -25964,9 +26081,9 @@ function setGoogleWorkspaceBlock(yamlText, block) {
   if (!Array.isArray(block.approvers) || block.approvers.length === 0) {
     throw new Error("setGoogleWorkspaceBlock: at least one approver id is required");
   }
-  const doc = import_yaml6.parseDocument(yamlText);
+  const doc = import_yaml7.parseDocument(yamlText);
   const root = doc.contents;
-  if (!import_yaml6.isMap(root)) {
+  if (!import_yaml7.isMap(root)) {
     throw new Error("setGoogleWorkspaceBlock: YAML root is not a map");
   }
   if (root.has("google_workspace") || root.has("drive")) {
@@ -25983,9 +26100,9 @@ function setGoogleWorkspaceBlock(yamlText, block) {
 `) ? out : out + `
 `;
 }
-var import_yaml6;
+var import_yaml7;
 var init_google_workspace_yaml = __esm(() => {
-  import_yaml6 = __toESM(require_dist(), 1);
+  import_yaml7 = __toESM(require_dist(), 1);
 });
 
 // src/util/atomic.ts
@@ -27655,13 +27772,13 @@ function setAuthActive(yamlText, label) {
   if (typeof label !== "string" || label.length === 0) {
     throw new Error("setAuthActive: label must be a non-empty string");
   }
-  const doc = import_yaml8.parseDocument(yamlText);
+  const doc = import_yaml9.parseDocument(yamlText);
   const root = doc.contents;
-  if (!import_yaml8.isMap(root)) {
+  if (!import_yaml9.isMap(root)) {
     throw new Error("setAuthActive: YAML root is not a map");
   }
   const existing = root.get("auth", true);
-  if (import_yaml8.isMap(existing)) {
+  if (import_yaml9.isMap(existing)) {
     if (existing.get("active") === label) {
       return yamlText;
     }
@@ -27674,9 +27791,9 @@ function setAuthActive(yamlText, label) {
 `) ? out : out + `
 `;
 }
-var import_yaml8;
+var import_yaml9;
 var init_auth_active_yaml = __esm(() => {
-  import_yaml8 = __toESM(require_dist(), 1);
+  import_yaml9 = __toESM(require_dist(), 1);
 });
 
 // src/auth/via-claude.ts
@@ -27690,8 +27807,8 @@ __export(exports_via_claude, {
   PRE_PASTE_RULES: () => PRE_PASTE_RULES,
   POST_PASTE_RULES: () => POST_PASTE_RULES
 });
-import { execFileSync as execFileSync13, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync30, mkdirSync as mkdirSync18, readFileSync as readFileSync25 } from "node:fs";
+import { execFileSync as execFileSync14, spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync30, mkdirSync as mkdirSync18, readFileSync as readFileSync26 } from "node:fs";
 import { join as join22, resolve as resolve23 } from "node:path";
 function tmuxHasSession(session) {
   const r = spawnSync2("tmux", ["has-session", "-t", session], {
@@ -27701,7 +27818,7 @@ function tmuxHasSession(session) {
 }
 function tmuxKillSession(session) {
   try {
-    execFileSync13("tmux", ["kill-session", "-t", session], {
+    execFileSync14("tmux", ["kill-session", "-t", session], {
       stdio: "ignore",
       timeout: 3000
     });
@@ -27709,7 +27826,7 @@ function tmuxKillSession(session) {
 }
 function tmuxCapturePane(session) {
   try {
-    const out = execFileSync13("tmux", ["capture-pane", "-p", "-t", session, "-S", "-200"], { timeout: 3000, stdio: ["ignore", "pipe", "pipe"], maxBuffer: 4 * 1024 * 1024 });
+    const out = execFileSync14("tmux", ["capture-pane", "-p", "-t", session, "-S", "-200"], { timeout: 3000, stdio: ["ignore", "pipe", "pipe"], maxBuffer: 4 * 1024 * 1024 });
     return out.toString("utf8");
   } catch {
     return "";
@@ -27717,7 +27834,7 @@ function tmuxCapturePane(session) {
 }
 function tmuxSendKeys(session, keys, literal = false) {
   try {
-    execFileSync13("tmux", ["send-keys", "-t", session, ...literal ? ["-l"] : [], ...keys], { timeout: 3000, stdio: ["ignore", "pipe", "pipe"] });
+    execFileSync14("tmux", ["send-keys", "-t", session, ...literal ? ["-l"] : [], ...keys], { timeout: 3000, stdio: ["ignore", "pipe", "pipe"] });
   } catch {}
 }
 function extractAuthorizeUrl(pane) {
@@ -27746,7 +27863,7 @@ async function runViaClaude(opts) {
       tmuxKillSession(SESSION);
   }
   const spawn4 = opts.spawnClaude ?? (() => {
-    execFileSync13("tmux", [
+    execFileSync14("tmux", [
       "new-session",
       "-d",
       "-s",
@@ -27801,7 +27918,7 @@ async function runViaClaude(opts) {
       await sleep3(poll);
       if (existsSync30(credentialsPath2)) {
         await sleep3(200);
-        const raw = readFileSync25(credentialsPath2, "utf-8");
+        const raw = readFileSync26(credentialsPath2, "utf-8");
         let parsed;
         try {
           parsed = JSON.parse(raw);
@@ -28563,7 +28680,7 @@ var init_thinking_effort_risk = __esm(() => {
 // src/manifest.ts
 import {
   existsSync as existsSync49,
-  readFileSync as readFileSync44,
+  readFileSync as readFileSync45,
   readdirSync as readdirSync18
 } from "node:fs";
 import { dirname as dirname11, join as join42 } from "node:path";
@@ -28585,7 +28702,7 @@ function loadManifest(manifestPath) {
   }
   let raw;
   try {
-    raw = readFileSync44(path4, "utf-8");
+    raw = readFileSync45(path4, "utf-8");
   } catch (err) {
     throw new Error(`Failed to read manifest at ${path4}: ${err.message}`);
   }
@@ -28650,7 +28767,7 @@ function probePlaywrightMcpVersion() {
       const pkgPath = join42(npxCache, entry, "node_modules/@playwright/mcp/package.json");
       if (existsSync49(pkgPath)) {
         try {
-          const pkg = JSON.parse(readFileSync44(pkgPath, "utf-8"));
+          const pkg = JSON.parse(readFileSync45(pkgPath, "utf-8"));
           if (pkg.version)
             return pkg.version;
         } catch {}
@@ -28742,13 +28859,22 @@ var init_manifest = __esm(() => {
 });
 
 // src/cli/doctor-docker.ts
-import { readFileSync as readFileSync45 } from "node:fs";
+import { readFileSync as readFileSync46 } from "node:fs";
+function imageTagOf(ref) {
+  if (!ref)
+    return "<absent>";
+  const at = ref.lastIndexOf("@");
+  const base = at >= 0 ? ref.slice(0, at) : ref;
+  const colon = base.lastIndexOf(":");
+  const slash = base.lastIndexOf("/");
+  return colon > slash ? base.slice(colon + 1) : ref;
+}
 function isDockerMode(opts) {
   if (process.env.SWITCHROOM_RUNTIME === "docker")
     return true;
   if (opts?.composePath) {
     try {
-      readFileSync45(opts.composePath, "utf8");
+      readFileSync46(opts.composePath, "utf8");
       return true;
     } catch {}
   }
@@ -28883,6 +29009,27 @@ function checkDockerfileUserAlignment(composeYaml, dockerfileAgent) {
     fix: "Drop the USER directive from Dockerfile.agent (preferred \u2014 the image is identity-neutral) or align per-agent UIDs by renaming."
   };
 }
+function checkSingletonImageDrift(composeYaml, deps) {
+  const drift = detectSingletonDrift({
+    composeFile: "(in-memory)",
+    readCompose: () => composeYaml,
+    inspectImage: deps?.inspectImage
+  });
+  const stale = drift.filter((d) => d.needsRecreate && d.running !== null);
+  if (stale.length === 0) {
+    return {
+      name: "singleton image drift",
+      status: "ok",
+      detail: "vault-broker / approval-kernel / auth-broker match the pinned image"
+    };
+  }
+  return {
+    name: "singleton image drift",
+    status: "warn",
+    detail: "singleton(s) running an image older than the pin: " + stale.map((d) => `${d.service} ${imageTagOf(d.running)}\u2260${imageTagOf(d.pinned)}`).join(", "),
+    fix: "Recreate them \u2014 `switchroom agent restart <any-agent>` now self-heals stale singletons, or `switchroom update` (whole-project recreate)."
+  };
+}
 function runDockerChecks(args) {
   if (!args.active) {
     return [{
@@ -28896,6 +29043,7 @@ function runDockerChecks(args) {
   out.push(checkAgentCaps(args.config));
   if (args.composeYaml) {
     out.push(checkAgentSocketMounts(args.composeYaml));
+    out.push(checkSingletonImageDrift(args.composeYaml));
     if (args.dockerfileAgent) {
       out.push(checkDockerfileUserAlignment(args.composeYaml, args.dockerfileAgent));
     }
@@ -28911,10 +29059,11 @@ function runDockerChecks(args) {
 }
 var init_doctor_docker = __esm(() => {
   init_compose();
+  init_singleton_reconcile();
 });
 
 // src/cli/doctor-auth-broker.ts
-import { existsSync as existsSync50, readFileSync as readFileSync46 } from "node:fs";
+import { existsSync as existsSync50, readFileSync as readFileSync47 } from "node:fs";
 import { createHash as createHash10 } from "node:crypto";
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { homedir as homedir23 } from "node:os";
@@ -29028,7 +29177,7 @@ function checkAuthBrokerDrift(deps = {}) {
   }
   let index;
   try {
-    index = JSON.parse(readFileSync46(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync47(indexPath, "utf-8"));
   } catch (err) {
     return {
       name: "auth-broker: drift",
@@ -29048,7 +29197,7 @@ function checkAuthBrokerDrift(deps = {}) {
     }
     let got;
     try {
-      got = sha256Hex(readFileSync46(credsPath, "utf-8"));
+      got = sha256Hex(readFileSync47(credsPath, "utf-8"));
     } catch (err) {
       divergent.push(`${label} (read failed: ${err.message})`);
       continue;
@@ -29089,7 +29238,7 @@ function checkAuthBrokerThresholdViolations(deps = {}) {
   }
   let violations;
   try {
-    violations = JSON.parse(readFileSync46(path4, "utf-8"));
+    violations = JSON.parse(readFileSync47(path4, "utf-8"));
   } catch (err) {
     return {
       name: "auth-broker: threshold violations",
@@ -30586,7 +30735,7 @@ function runInlinedSecretChecks(_config, deps = {}) {
   }
   let parsed;
   try {
-    parsed = import_yaml14.parse(raw);
+    parsed = import_yaml15.parse(raw);
   } catch {
     return [
       {
@@ -30614,9 +30763,9 @@ function runInlinedSecretChecks(_config, deps = {}) {
     fix: `Move it to the per-agent-ACL'd vault: \`switchroom vault set <name>\` ` + `then replace the literal with \`vault:<name>\`. Rotate the exposed ` + `value if any agent may already have read it.`
   }));
 }
-var import_yaml14, SECRET_KEY_EXACT;
+var import_yaml15, SECRET_KEY_EXACT;
 var init_doctor_inlined_secrets = __esm(() => {
-  import_yaml14 = __toESM(require_dist(), 1);
+  import_yaml15 = __toESM(require_dist(), 1);
   SECRET_KEY_EXACT = new Set([
     "bot_token",
     "client_secret",
@@ -30868,7 +31017,7 @@ var init_doctor_agent_smoke = __esm(() => {
 });
 
 // src/cli/doctor-vault-broker-durability.ts
-import { execFileSync as execFileSync16 } from "node:child_process";
+import { execFileSync as execFileSync17 } from "node:child_process";
 import { existsSync as existsSync53, statSync as statSync22 } from "node:fs";
 import { homedir as homedir32 } from "node:os";
 import { join as join53 } from "node:path";
@@ -30930,7 +31079,7 @@ function spawnDockerStat(p) {
 }
 function spawnDockerStatForContainer(containerName2, p) {
   try {
-    const stdout = execFileSync16("docker", ["exec", containerName2, "stat", "-c", "%i %s", p], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
+    const stdout = execFileSync17("docker", ["exec", containerName2, "stat", "-c", "%i %s", p], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
     return { status: 0, stdout, stderr: "", error: null };
   } catch (err) {
     const e = err;
@@ -31004,7 +31153,7 @@ function probeBrokerUnlocked(opts) {
 }
 function defaultBrokerStatusProbe() {
   try {
-    const out = execFileSync16("switchroom", ["vault", "broker", "status"], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
+    const out = execFileSync17("switchroom", ["vault", "broker", "status"], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
     const parsed = JSON.parse(out.trim());
     if (!parsed.running)
       return null;
@@ -31204,7 +31353,7 @@ import {
   existsSync as existsSync54,
   lstatSync as lstatSync5,
   mkdirSync as mkdirSync29,
-  readFileSync as readFileSync47,
+  readFileSync as readFileSync48,
   readdirSync as readdirSync20,
   statSync as statSync23
 } from "node:fs";
@@ -31882,7 +32031,7 @@ function classifyReadError(err) {
 }
 function tryReadHostFile(path4) {
   try {
-    return { kind: "ok", content: readFileSync47(path4, "utf-8") };
+    return { kind: "ok", content: readFileSync48(path4, "utf-8") };
   } catch (err) {
     const kind = classifyReadError(err);
     const error = err?.message ?? String(err);
@@ -31898,7 +32047,7 @@ function parseEnvFile(path4) {
     return {};
   let content;
   try {
-    content = readFileSync47(path4, "utf-8");
+    content = readFileSync48(path4, "utf-8");
   } catch {
     return {};
   }
@@ -32015,7 +32164,7 @@ function checkStartShStale(agentName, startShPath) {
   }
   let content;
   try {
-    content = readFileSync47(startShPath, "utf-8");
+    content = readFileSync48(startShPath, "utf-8");
   } catch (err) {
     return {
       name: label,
@@ -32128,7 +32277,7 @@ function isSwitchroomCheckout(dir) {
     const pkgPath = join54(dir, "package.json");
     if (!existsSync54(pkgPath))
       return false;
-    const pkg = JSON.parse(readFileSync47(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync48(pkgPath, "utf-8"));
     return pkg.name === "switchroom";
   } catch {
     return false;
@@ -32249,7 +32398,7 @@ function checkAgents(config, configPath) {
         });
       } else {
         try {
-          const mcp = JSON.parse(readFileSync47(mcpJsonPath, "utf-8"));
+          const mcp = JSON.parse(readFileSync48(mcpJsonPath, "utf-8"));
           const hasSwitchroomTelegram = !!mcp.mcpServers?.["switchroom-telegram"];
           const memoryEnabled = isHindsightEnabled(config);
           const hasHindsight = !!mcp.mcpServers?.hindsight;
@@ -32744,11 +32893,11 @@ function runDockerSection(config) {
   let composeYaml;
   let dockerfileAgent;
   try {
-    composeYaml = readFileSync47(composePath, "utf8");
+    composeYaml = readFileSync48(composePath, "utf8");
   } catch {}
   const dockerfilePath = resolve32(process.env.HOME ?? "", ".switchroom", "docker", "Dockerfile.agent");
   try {
-    dockerfileAgent = readFileSync47(dockerfilePath, "utf8");
+    dockerfileAgent = readFileSync48(dockerfilePath, "utf8");
   } catch {}
   return runDockerChecks({
     config,
@@ -49041,7 +49190,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes15 } from "node:crypto";
-import { existsSync as existsSync82, readFileSync as readFileSync66 } from "node:fs";
+import { existsSync as existsSync82, readFileSync as readFileSync67 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -49219,7 +49368,7 @@ function getLastUpdateApplyStatus() {
   }
   let raw;
   try {
-    raw = readFileSync66(path8, "utf-8");
+    raw = readFileSync67(path8, "utf-8");
   } catch (err2) {
     return errorText2(`get_status: failed to read audit log at ${path8}: ${err2.message}`);
   }
@@ -49452,13 +49601,13 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.66";
-var COMMIT_SHA = "0f4f029d";
+var VERSION = "0.14.68";
+var COMMIT_SHA = "4f371b79";
 
 // src/cli/agent.ts
 init_source();
 import { join as join17, resolve as resolve21 } from "node:path";
-import { rmSync as rmSync9, existsSync as existsSync26, readFileSync as readFileSync21, writeFileSync as writeFileSync13 } from "node:fs";
+import { rmSync as rmSync9, existsSync as existsSync26, readFileSync as readFileSync22, writeFileSync as writeFileSync13 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 
 // src/agents/scheduler-state.ts
@@ -49524,7 +49673,7 @@ function formatSchedulerState(state) {
 init_loader();
 init_hindsight();
 init_helpers();
-var import_yaml4 = __toESM(require_dist(), 1);
+var import_yaml5 = __toESM(require_dist(), 1);
 
 // src/agents/scaffold.ts
 init_source();
@@ -53079,12 +53228,12 @@ function spinner(message) {
 }
 
 // src/agents/status.ts
-import { existsSync as existsSync18, readFileSync as readFileSync16, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync17, statSync as statSync10 } from "node:fs";
 import { join as join12 } from "node:path";
-import { execFileSync as execFileSync8 } from "node:child_process";
+import { execFileSync as execFileSync9 } from "node:child_process";
 
 // src/agents/handoff-summarizer.ts
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync8, renameSync as renameSync5, mkdirSync as mkdirSync13, existsSync as existsSync16, statSync as statSync9, readdirSync as readdirSync8 } from "node:fs";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync8, renameSync as renameSync5, mkdirSync as mkdirSync13, existsSync as existsSync16, statSync as statSync9, readdirSync as readdirSync8 } from "node:fs";
 import { join as join11 } from "node:path";
 var DEFAULT_MAX_TURNS = 50;
 var TOPIC_MAX_CHARS = 117;
@@ -53092,7 +53241,7 @@ var TURN_TEXT_MAX_CHARS = 1200;
 function extractTurnsFromJsonl(path, maxTurns) {
   let raw;
   try {
-    raw = readFileSync14(path, "utf-8");
+    raw = readFileSync15(path, "utf-8");
   } catch {
     return [];
   }
@@ -53317,7 +53466,7 @@ function findLatestSessionJsonl(claudeConfigDir) {
 }
 
 // src/agents/perf.ts
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync16 } from "node:fs";
 function readTurnUsages(jsonlPath, lastN) {
   if (!existsSync17(jsonlPath))
     return [];
@@ -53325,7 +53474,7 @@ function readTurnUsages(jsonlPath, lastN) {
     return [];
   let raw;
   try {
-    raw = readFileSync15(jsonlPath, "utf-8");
+    raw = readFileSync16(jsonlPath, "utf-8");
   } catch {
     return [];
   }
@@ -53734,7 +53883,7 @@ function readLogFile(logPath) {
     const stat = statSync10(logPath);
     const cap = 256 * 1024;
     if (stat.size <= cap) {
-      return readFileSync16(logPath, "utf-8");
+      return readFileSync17(logPath, "utf-8");
     }
     const fs2 = __require("node:fs");
     const fd = fs2.openSync(logPath, "r");
@@ -53758,14 +53907,14 @@ function readLastMessages(historyDbPath) {
     };
   }
   try {
-    const out = execFileSync8("bun", [
+    const out = execFileSync9("bun", [
       "-e",
       `const { Database } = require("bun:sqlite"); ` + `const db = new Database(${JSON.stringify(historyDbPath)}, { readonly: true }); ` + `const rows = db.prepare("SELECT role, MAX(ts) as ts FROM messages GROUP BY role").all(); ` + `for (const r of rows) console.log(r.role + "|" + r.ts); ` + `db.close();`
     ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
     return parseSqliteRoleTsOutput(out);
   } catch {}
   try {
-    const out = execFileSync8("sqlite3", [
+    const out = execFileSync9("sqlite3", [
       historyDbPath,
       "SELECT role, MAX(ts) FROM messages GROUP BY role;"
     ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
@@ -53877,7 +54026,7 @@ function escapeRegex(s) {
 }
 function readDockerContainer(containerName2) {
   try {
-    const out = execFileSync8("docker", ["inspect", "--format", "{{json .State}}", containerName2], { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
+    const out = execFileSync9("docker", ["inspect", "--format", "{{json .State}}", containerName2], { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
     const state = JSON.parse(out.trim());
     const active = state.Status === "running" ? "active" : state.Status === "restarting" ? "restarting" : "inactive";
     const pid = typeof state.Pid === "number" && state.Pid > 0 ? state.Pid : null;
@@ -54153,7 +54302,7 @@ async function completeCreation(name, code, opts = {}) {
 // src/agents/add-orchestrator.ts
 import { resolve as resolve18, join as join15 } from "node:path";
 import { existsSync as existsSync23, rmSync as rmSync7, statSync as statSync14 } from "node:fs";
-import { execFileSync as execFileSync11 } from "node:child_process";
+import { execFileSync as execFileSync12 } from "node:child_process";
 
 // src/setup/botfather-walkthrough.ts
 var DEFAULT_MAX_ATTEMPTS = 3;
@@ -54725,7 +54874,7 @@ function pruneBundledSkills(agentDir, keep, scope) {
 }
 function defaultIsUnitActive(unitName) {
   try {
-    const out = execFileSync11("systemctl", ["--user", "is-active", unitName], {
+    const out = execFileSync12("systemctl", ["--user", "is-active", unitName], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -54754,8 +54903,8 @@ import { tmpdir as tmpdir2 } from "node:os";
 init_merge();
 init_timezone();
 init_resolver();
-var import_yaml3 = __toESM(require_dist(), 1);
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync11 } from "node:fs";
+var import_yaml4 = __toESM(require_dist(), 1);
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync11 } from "node:fs";
 var AGENT_NAME_RE2 = /^[a-z0-9][a-z0-9_-]{0,50}$/;
 function defaultDeps() {
   return {
@@ -54778,12 +54927,12 @@ function defaultDeps() {
     copyDir: (src, dst) => cpSync(src, dst, { recursive: true }),
     removeDir: (p) => rmSync8(p, { recursive: true, force: true }),
     existsSync: existsSync24,
-    readFileSync: (p, enc) => readFileSync19(p, enc)
+    readFileSync: (p, enc) => readFileSync20(p, enc)
   };
 }
 function renameAgentInConfig(configPath, oldName, newName) {
-  const raw = readFileSync19(configPath, "utf-8");
-  const doc = import_yaml3.default.parseDocument(raw);
+  const raw = readFileSync20(configPath, "utf-8");
+  const doc = import_yaml4.default.parseDocument(raw);
   const agents = doc.get("agents");
   if (!agents || !agents.has(oldName)) {
     throw new Error(`Agent "${oldName}" not found in ${configPath}`);
@@ -54825,7 +54974,7 @@ async function renameAgent(opts, injectedDeps) {
   const deps = { ...defaultDeps(), ...injectedDeps };
   const { oldName, newName, configPath, hindsightMode = "preserve" } = opts;
   const _existsSync = deps.existsSync;
-  const _readFileSync = deps.readFileSync ?? ((p, enc) => readFileSync19(p, enc));
+  const _readFileSync = deps.readFileSync ?? ((p, enc) => readFileSync20(p, enc));
   if (!AGENT_NAME_RE2.test(oldName)) {
     throw new Error(`Invalid old agent name: "${oldName}". ` + `Names must match ^[a-z0-9][a-z0-9_-]{0,50}$`);
   }
@@ -55145,16 +55294,16 @@ function parsePorcelainDirty(porcelain) {
 }
 function checkSwitchroomBranch() {
   try {
-    const { execFileSync: execFileSync13 } = __require("node:child_process");
+    const { execFileSync: execFileSync14 } = __require("node:child_process");
     const cwd = process.cwd();
-    const branch = execFileSync13("git", ["-C", cwd, "rev-parse", "--abbrev-ref", "HEAD"], {
+    const branch = execFileSync14("git", ["-C", cwd, "rev-parse", "--abbrev-ref", "HEAD"], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
     if (branch === "" || branch === "HEAD")
       return null;
     if (branch === "main" || branch === "master") {
-      const porcelain = execFileSync13("git", ["-C", cwd, "status", "--porcelain"], {
+      const porcelain = execFileSync14("git", ["-C", cwd, "status", "--porcelain"], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "ignore"]
       });
@@ -55199,7 +55348,7 @@ function preflightCheck(name, agentDir, _usesDevChannels) {
   }
   const envPath = resolve21(agentDir, "telegram", ".env");
   if (existsSync26(envPath)) {
-    const envContent = readFileSync21(envPath, "utf-8");
+    const envContent = readFileSync22(envPath, "utf-8");
     if (!envContent.includes("TELEGRAM_BOT_TOKEN=") || envContent.includes("# Set your bot token")) {
       errors2.push(`telegram/.env is missing TELEGRAM_BOT_TOKEN. ` + `Set it or run: switchroom setup`);
     }
@@ -55286,25 +55435,25 @@ function writeAgentEntryToConfig(configPath, name, profile) {
   if (!existsSync26(configPath)) {
     throw new Error(`switchroom.yaml not found at ${configPath}`);
   }
-  const raw = readFileSync21(configPath, "utf-8");
-  const doc = import_yaml4.default.parseDocument(raw);
+  const raw = readFileSync22(configPath, "utf-8");
+  const doc = import_yaml5.default.parseDocument(raw);
   let agents = doc.get("agents");
   if (!agents) {
-    agents = new import_yaml4.default.YAMLMap;
+    agents = new import_yaml5.default.YAMLMap;
     doc.set("agents", agents);
   }
   if (agents.has(name)) {
     throw new Error(`Agent "${name}" already exists in ${configPath}. Use updateAgentExtendsInConfig to change its profile.`);
   }
-  const entry = new import_yaml4.default.YAMLMap;
+  const entry = new import_yaml5.default.YAMLMap;
   entry.set("extends", profile);
   entry.set("topic_name", synthesizeTopicName2(name));
   agents.set(name, entry);
   writeFileSync13(configPath, doc.toString(), "utf-8");
 }
 function updateAgentExtendsInConfig(configPath, name, profile) {
-  const raw = readFileSync21(configPath, "utf-8");
-  const doc = import_yaml4.default.parseDocument(raw);
+  const raw = readFileSync22(configPath, "utf-8");
+  const doc = import_yaml5.default.parseDocument(raw);
   const agents = doc.get("agents");
   if (!agents || !agents.has(name)) {
     throw new Error(`Agent "${name}" not found in ${configPath}; cannot update extends.`);
@@ -55316,8 +55465,8 @@ function updateAgentExtendsInConfig(configPath, name, profile) {
 function removeAgentFromConfig(configPath, name) {
   if (!existsSync26(configPath))
     return;
-  const raw = readFileSync21(configPath, "utf-8");
-  const doc = import_yaml4.default.parseDocument(raw);
+  const raw = readFileSync22(configPath, "utf-8");
+  const doc = import_yaml5.default.parseDocument(raw);
   const agents = doc.get("agents");
   if (!agents || !agents.has(name))
     return;
@@ -55362,7 +55511,7 @@ async function reconcileAndRestartAgent(name, config, agentsDir, configPath, opt
   if (!opts.force) {
     const envPath = resolve21(agentsDir, name, "telegram", ".env");
     if (existsSync26(envPath)) {
-      const envContent = readFileSync21(envPath, "utf-8");
+      const envContent = readFileSync22(envPath, "utf-8");
       const match = envContent.match(/^TELEGRAM_BOT_TOKEN=(.+)$/m);
       if (match) {
         const token = match[1].trim();
@@ -55637,6 +55786,14 @@ Scaffolding agent: ${name}
       }
     }
     let sawAbort = false;
+    try {
+      const recon = reconcileSingletonImages((m) => console.error(source_default.gray(`  ${m}`)));
+      if (recon.recreated.length > 0) {
+        console.error(source_default.cyan(`  \u21bb Recreated stale singleton(s) to the pinned image: ${recon.recreated.join(", ")}`));
+      }
+    } catch (err) {
+      console.error(source_default.yellow(`  \u26a0 singleton reconcile skipped: ${err instanceof Error ? err.message : String(err)}`));
+    }
     for (const n of names) {
       if (!config.agents[n]) {
         console.error(source_default.red(`Agent "${n}" is not defined in switchroom.yaml`));
@@ -55836,7 +55993,7 @@ Scaffolding agent: ${name}
         let actual = {};
         if (existsSync26(settingsPath)) {
           try {
-            const raw = JSON.parse(readFileSync21(settingsPath, "utf-8"));
+            const raw = JSON.parse(readFileSync22(settingsPath, "utf-8"));
             actual = raw.hooks ?? {};
           } catch {
             console.error(source_default.red(`  ${n}: could not parse settings.json`));
@@ -55978,8 +56135,8 @@ Reconciled ${agentsTouched} agent(s), ${totalChanges} file(s) changed.`));
       console.error(source_default.red(`switchroom.yaml not found at ${configPath}`));
       process.exit(1);
     }
-    const raw = readFileSync21(configPath, "utf-8");
-    const doc = import_yaml4.default.parseDocument(raw);
+    const raw = readFileSync22(configPath, "utf-8");
+    const doc = import_yaml5.default.parseDocument(raw);
     const agents = doc.get("agents");
     if (!agents || !agents.has(name)) {
       console.error(source_default.red(`Agent "${name}" is not defined in switchroom.yaml`));
@@ -55988,12 +56145,12 @@ Reconciled ${agentsTouched} agent(s), ${totalChanges} file(s) changed.`));
     const agentNode = agents.get(name);
     let tools = agentNode.get("tools");
     if (!tools) {
-      tools = new import_yaml4.default.YAMLMap;
+      tools = new import_yaml5.default.YAMLMap;
       agentNode.set("tools", tools);
     }
     let allow = tools.get("allow");
     if (!allow) {
-      allow = new import_yaml4.default.YAMLSeq;
+      allow = new import_yaml5.default.YAMLSeq;
       tools.set("allow", allow);
     }
     const existingAllow = allow.toJSON() ?? [];
@@ -56027,8 +56184,8 @@ Reconciled ${agentsTouched} agent(s), ${totalChanges} file(s) changed.`));
       console.error(source_default.red(`switchroom.yaml not found at ${configPath}`));
       process.exit(1);
     }
-    const raw = readFileSync21(configPath, "utf-8");
-    const doc = import_yaml4.default.parseDocument(raw);
+    const raw = readFileSync22(configPath, "utf-8");
+    const doc = import_yaml5.default.parseDocument(raw);
     const agents = doc.get("agents");
     if (!agents || !agents.has(name)) {
       console.error(source_default.red(`Agent "${name}" is not defined in switchroom.yaml`));
@@ -56038,7 +56195,7 @@ Reconciled ${agentsTouched} agent(s), ${totalChanges} file(s) changed.`));
     if (opts.off) {
       const tools = agentNode.get("tools");
       if (tools && tools.has("allow")) {
-        tools.set("allow", new import_yaml4.default.YAMLSeq);
+        tools.set("allow", new import_yaml5.default.YAMLSeq);
         writeFileSync13(configPath, doc.toString(), "utf-8");
         console.log(source_default.yellow(`  ${name}: dangerous mode OFF (tools.allow cleared)`));
       } else {
@@ -56047,10 +56204,10 @@ Reconciled ${agentsTouched} agent(s), ${totalChanges} file(s) changed.`));
     } else {
       let tools = agentNode.get("tools");
       if (!tools) {
-        tools = new import_yaml4.default.YAMLMap;
+        tools = new import_yaml5.default.YAMLMap;
         agentNode.set("tools", tools);
       }
-      const allowSeq = new import_yaml4.default.YAMLSeq;
+      const allowSeq = new import_yaml5.default.YAMLSeq;
       allowSeq.add("all");
       tools.set("allow", allowSeq);
       writeFileSync13(configPath, doc.toString(), "utf-8");
@@ -56082,7 +56239,7 @@ Reconciled ${agentsTouched} agent(s), ${totalChanges} file(s) changed.`));
       console.error(source_default.red(`Agent "${name}" not found at ${settingsPath}`));
       process.exit(1);
     }
-    const settings = JSON.parse(readFileSync21(settingsPath, "utf-8"));
+    const settings = JSON.parse(readFileSync22(settingsPath, "utf-8"));
     const allow = settings.permissions?.allow ?? [];
     const deny = settings.permissions?.deny ?? [];
     const defaultMode = settings.permissions?.defaultMode;
@@ -56922,24 +57079,24 @@ init_account_store();
 init_loader();
 init_manager();
 init_helpers();
-import { existsSync as existsSync31, readFileSync as readFileSync26 } from "node:fs";
+import { existsSync as existsSync31, readFileSync as readFileSync27 } from "node:fs";
 import { join as join23, resolve as resolve24 } from "node:path";
 
 // src/cli/auth-google.ts
 init_source();
-import { readFileSync as readFileSync23, writeFileSync as writeFileSync15 } from "node:fs";
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync15 } from "node:fs";
 
 // src/cli/google-accounts-yaml.ts
-var import_yaml5 = __toESM(require_dist(), 1);
+var import_yaml6 = __toESM(require_dist(), 1);
 function enableAgentsOnGoogleAccount(yamlText, account, agentsToEnable) {
-  const doc = import_yaml5.parseDocument(yamlText);
+  const doc = import_yaml6.parseDocument(yamlText);
   ensureGoogleAccountEntry(doc, account);
   const existing = doc.getIn(["google_accounts", account, "enabled_for"]);
   const currentAgents = readEnabledFor(existing);
   const additions = agentsToEnable.filter((a) => !currentAgents.includes(a));
   if (additions.length === 0)
     return yamlText;
-  if (import_yaml5.isSeq(existing)) {
+  if (import_yaml6.isSeq(existing)) {
     const seq = existing;
     for (const a of additions)
       seq.add(a);
@@ -56949,11 +57106,11 @@ function enableAgentsOnGoogleAccount(yamlText, account, agentsToEnable) {
   return String(doc);
 }
 function disableAgentsOnGoogleAccount(yamlText, account, agentsToDisable) {
-  const doc = import_yaml5.parseDocument(yamlText);
+  const doc = import_yaml6.parseDocument(yamlText);
   if (!hasGoogleAccountEntry(doc, account))
     return yamlText;
   const existing = doc.getIn(["google_accounts", account, "enabled_for"]);
-  if (!import_yaml5.isSeq(existing))
+  if (!import_yaml6.isSeq(existing))
     return yamlText;
   const seq = existing;
   const beforeLen = seq.items.length;
@@ -56969,16 +57126,16 @@ function disableAgentsOnGoogleAccount(yamlText, account, agentsToDisable) {
   return String(doc);
 }
 function getEnabledAgentsForGoogleAccount(yamlText, account) {
-  const doc = import_yaml5.parseDocument(yamlText);
+  const doc = import_yaml6.parseDocument(yamlText);
   if (!hasGoogleAccountEntry(doc, account))
     return null;
   const existing = doc.getIn(["google_accounts", account, "enabled_for"]);
   return readEnabledFor(existing);
 }
 function listGoogleAccounts(yamlText) {
-  const doc = import_yaml5.parseDocument(yamlText);
+  const doc = import_yaml6.parseDocument(yamlText);
   const accounts = doc.get("google_accounts");
-  if (!import_yaml5.isMap(accounts))
+  if (!import_yaml6.isMap(accounts))
     return [];
   const out = [];
   for (const item of accounts.items) {
@@ -56993,7 +57150,7 @@ function listGoogleAccounts(yamlText) {
   return out;
 }
 function readEnabledFor(node) {
-  if (!import_yaml5.isSeq(node))
+  if (!import_yaml6.isSeq(node))
     return [];
   const seq = node;
   return seq.items.map((item) => item.value ?? item).filter((v) => typeof v === "string");
@@ -57005,7 +57162,7 @@ function ensureGoogleAccountEntry(doc, account) {
 }
 function hasGoogleAccountEntry(doc, account) {
   const accounts = doc.get("google_accounts");
-  if (!import_yaml5.isMap(accounts))
+  if (!import_yaml6.isMap(accounts))
     return false;
   return accounts.has(account);
 }
@@ -57122,7 +57279,7 @@ function registerConnect(googleParent, program3) {
       `  tier: ${tier}`
     ].join(`
 `);
-    const raw = readFileSync23(configPath, "utf-8");
+    const raw = readFileSync24(configPath, "utf-8");
     const patched = setGoogleWorkspaceBlock2(raw, {
       clientIdRef: "vault:google-oauth-client-id",
       clientSecretRef: "vault:google-oauth-client-secret",
@@ -57168,7 +57325,7 @@ function registerEnable(googleParent, program3) {
       }
     }
     const yamlPath = getConfigPath(program3);
-    const before = readFileSync23(yamlPath, "utf-8");
+    const before = readFileSync24(yamlPath, "utf-8");
     const after = enableAgentsOnGoogleAccount(before, normalizedAccount, agents);
     const noop = after === before;
     if (!noop) {
@@ -57196,7 +57353,7 @@ function registerDisable(googleParent, program3) {
     const config = getConfig(program3);
     agents = expandAllAgents(agents, config);
     const yamlPath = getConfigPath(program3);
-    const before = readFileSync23(yamlPath, "utf-8");
+    const before = readFileSync24(yamlPath, "utf-8");
     const enabledBefore = getEnabledAgentsBefore(before, normalizedAccount);
     if (enabledBefore.length === 0) {
       console.log();
@@ -57233,7 +57390,7 @@ function registerDisable(googleParent, program3) {
 function registerList(googleParent, program3) {
   googleParent.command("list").description("List every Google account configured in switchroom.yaml with its enabled_for[] agents. Matrix view of accounts \u00d7 agents.").option("--json", "Emit raw JSON instead of a table").action(withConfigError(async (opts) => {
     const yamlPath = getConfigPath(program3);
-    const yaml = readFileSync23(yamlPath, "utf-8");
+    const yaml = readFileSync24(yamlPath, "utf-8");
     const accounts = listGoogleAccounts(yaml);
     if (opts.json) {
       console.log(JSON.stringify(accounts, null, 2));
@@ -57619,19 +57776,19 @@ function buildGoogleCredentials(args) {
 
 // src/cli/auth-microsoft.ts
 init_source();
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "node:fs";
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync16 } from "node:fs";
 
 // src/cli/microsoft-accounts-yaml.ts
-var import_yaml7 = __toESM(require_dist(), 1);
+var import_yaml8 = __toESM(require_dist(), 1);
 function enableAgentsOnMicrosoftAccount(yamlText, account, agentsToEnable) {
-  const doc = import_yaml7.parseDocument(yamlText);
+  const doc = import_yaml8.parseDocument(yamlText);
   ensureMicrosoftAccountEntry(doc, account);
   const existing = doc.getIn(["microsoft_accounts", account, "enabled_for"]);
   const currentAgents = readEnabledFor2(existing);
   const additions = agentsToEnable.filter((a) => !currentAgents.includes(a));
   if (additions.length === 0)
     return yamlText;
-  if (import_yaml7.isSeq(existing)) {
+  if (import_yaml8.isSeq(existing)) {
     const seq = existing;
     for (const a of additions)
       seq.add(a);
@@ -57641,11 +57798,11 @@ function enableAgentsOnMicrosoftAccount(yamlText, account, agentsToEnable) {
   return String(doc);
 }
 function disableAgentsOnMicrosoftAccount(yamlText, account, agentsToDisable) {
-  const doc = import_yaml7.parseDocument(yamlText);
+  const doc = import_yaml8.parseDocument(yamlText);
   if (!hasMicrosoftAccountEntry(doc, account))
     return yamlText;
   const existing = doc.getIn(["microsoft_accounts", account, "enabled_for"]);
-  if (!import_yaml7.isSeq(existing))
+  if (!import_yaml8.isSeq(existing))
     return yamlText;
   const seq = existing;
   const beforeLen = seq.items.length;
@@ -57661,16 +57818,16 @@ function disableAgentsOnMicrosoftAccount(yamlText, account, agentsToDisable) {
   return String(doc);
 }
 function getEnabledAgentsForMicrosoftAccount(yamlText, account) {
-  const doc = import_yaml7.parseDocument(yamlText);
+  const doc = import_yaml8.parseDocument(yamlText);
   if (!hasMicrosoftAccountEntry(doc, account))
     return null;
   const existing = doc.getIn(["microsoft_accounts", account, "enabled_for"]);
   return readEnabledFor2(existing);
 }
 function listMicrosoftAccounts(yamlText) {
-  const doc = import_yaml7.parseDocument(yamlText);
+  const doc = import_yaml8.parseDocument(yamlText);
   const accounts = doc.get("microsoft_accounts");
-  if (!import_yaml7.isMap(accounts))
+  if (!import_yaml8.isMap(accounts))
     return [];
   const out = [];
   for (const item of accounts.items) {
@@ -57685,7 +57842,7 @@ function listMicrosoftAccounts(yamlText) {
   return out;
 }
 function removeMicrosoftAccountEntry(yamlText, account) {
-  const doc = import_yaml7.parseDocument(yamlText);
+  const doc = import_yaml8.parseDocument(yamlText);
   if (!hasMicrosoftAccountEntry(doc, account))
     return yamlText;
   doc.deleteIn(["microsoft_accounts", account]);
@@ -57693,7 +57850,7 @@ function removeMicrosoftAccountEntry(yamlText, account) {
   return String(doc);
 }
 function readEnabledFor2(node) {
-  if (!import_yaml7.isSeq(node))
+  if (!import_yaml8.isSeq(node))
     return [];
   const seq = node;
   return seq.items.map((item) => item.value ?? item).filter((v) => typeof v === "string");
@@ -57705,13 +57862,13 @@ function ensureMicrosoftAccountEntry(doc, account) {
 }
 function hasMicrosoftAccountEntry(doc, account) {
   const accounts = doc.get("microsoft_accounts");
-  if (!import_yaml7.isMap(accounts))
+  if (!import_yaml8.isMap(accounts))
     return false;
   return accounts.has(account);
 }
 function pruneEmptyMap(doc, path) {
   const node = doc.getIn(path);
-  if (import_yaml7.isMap(node) && node.items.length === 0) {
+  if (import_yaml8.isMap(node) && node.items.length === 0) {
     doc.deleteIn(path);
   }
 }
@@ -57813,7 +57970,7 @@ function registerEnable2(microsoftParent, program3) {
     agents = expandAllAgents2(agents, config);
     validateAgentSlugs(agents, config);
     const yamlPath = getConfigPath(program3);
-    const before = readFileSync24(yamlPath, "utf-8");
+    const before = readFileSync25(yamlPath, "utf-8");
     const enabledBefore = getEnabledAgentsBefore2(before, normalizedAccount);
     const after = enableAgentsOnMicrosoftAccount(before, normalizedAccount, agents);
     if (after !== before)
@@ -57843,7 +58000,7 @@ function registerDisable2(microsoftParent, program3) {
     const config = getConfig(program3);
     agents = expandAllAgents2(agents, config);
     const yamlPath = getConfigPath(program3);
-    const before = readFileSync24(yamlPath, "utf-8");
+    const before = readFileSync25(yamlPath, "utf-8");
     const enabledBefore = getEnabledAgentsBefore2(before, normalizedAccount);
     if (enabledBefore.length === 0) {
       console.log();
@@ -57877,7 +58034,7 @@ function registerDisable2(microsoftParent, program3) {
 function registerList2(microsoftParent, program3) {
   microsoftParent.command("list").description("List every Microsoft account configured in switchroom.yaml with its enabled_for[] agents.").option("--json", "Emit raw JSON instead of a table").action(withConfigError(async (opts) => {
     const yamlPath = getConfigPath(program3);
-    const yaml = readFileSync24(yamlPath, "utf-8");
+    const yaml = readFileSync25(yamlPath, "utf-8");
     const accounts = listMicrosoftAccounts(yaml);
     if (opts.json) {
       console.log(JSON.stringify(accounts, null, 2));
@@ -58052,7 +58209,7 @@ function registerAccountRemove2(accountParent) {
     const { brokerCall: brokerCall2 } = await Promise.resolve().then(() => (init_broker_call(), exports_broker_call));
     const program3 = command.parent?.parent?.parent ?? command;
     const yamlPath = getConfigPath(program3);
-    const before = readFileSync24(yamlPath, "utf-8");
+    const before = readFileSync25(yamlPath, "utf-8");
     const enabled = getEnabledAgentsForMicrosoftAccount(before, normalizedAccount);
     if (enabled && enabled.length > 0) {
       throw new Error(`Account ${normalizedAccount} is still enabled on agents: ${enabled.join(", ")}. Run 'switchroom auth microsoft disable ${normalizedAccount} all' first.`);
@@ -58236,7 +58393,7 @@ function diagnoseAuthState(claudeConfigDir) {
   } else if (hasCreds) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync26(credsPath, "utf-8"));
+      parsed = JSON.parse(readFileSync27(credsPath, "utf-8"));
     } catch (err) {
       const code = err?.code;
       if (code === "EACCES" || code === "EPERM") {
@@ -58404,7 +58561,7 @@ function loadCredentialsFromAgent(agentName) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync26(credsPath, "utf-8"));
+    parsed = JSON.parse(readFileSync27(credsPath, "utf-8"));
   } catch (err) {
     console.error(source_default.red(`  Failed to parse credentials.json: ${err.message}`));
     process.exit(1);
@@ -58422,7 +58579,7 @@ function loadCredentialsFromFile(path) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync26(path, "utf-8"));
+    parsed = JSON.parse(readFileSync27(path, "utf-8"));
   } catch (err) {
     console.error(source_default.red(`  Failed to parse ${path}: ${err.message}`));
     process.exit(1);
@@ -58555,7 +58712,7 @@ function registerAuthCommand(program3) {
   function pinAuthActiveInYaml(label, quiet = false) {
     try {
       const yamlPath = getConfigPath(program3);
-      const before = readFileSync26(yamlPath, "utf-8");
+      const before = readFileSync27(yamlPath, "utf-8");
       const after = setAuthActive(before, label);
       if (after !== before) {
         let mode = 420;
@@ -58703,15 +58860,15 @@ init_loader();
 init_loader();
 init_vault();
 import { createInterface as createInterface3 } from "node:readline";
-import { readFileSync as readFileSync35 } from "node:fs";
+import { readFileSync as readFileSync36 } from "node:fs";
 
 // src/cli/vault-sweep.ts
 init_source();
 init_loader();
 init_vault();
 init_hindsight();
-import { readFileSync as readFileSync27, writeFileSync as writeFileSync17, copyFileSync as copyFileSync6, existsSync as existsSync32, readdirSync as readdirSync15, statSync as statSync17 } from "node:fs";
-import { execFileSync as execFileSync14 } from "node:child_process";
+import { readFileSync as readFileSync28, writeFileSync as writeFileSync17, copyFileSync as copyFileSync6, existsSync as existsSync32, readdirSync as readdirSync15, statSync as statSync17 } from "node:fs";
+import { execFileSync as execFileSync15 } from "node:child_process";
 import { join as join24 } from "node:path";
 import { homedir as homedir11 } from "node:os";
 function getVaultPath2(configPath) {
@@ -58771,7 +58928,7 @@ function findTelegramHistoryDb() {
 function scrubJsonl(path, values, dryRun) {
   let content;
   try {
-    content = readFileSync27(path, "utf8");
+    content = readFileSync28(path, "utf8");
   } catch {
     return { target: path, matches: 0, modified: false };
   }
@@ -59049,7 +59206,7 @@ function registerVaultSweep(vault, program3) {
 function scrubSqlite(path, values, dryRun) {
   let hasSqlite = true;
   try {
-    execFileSync14("sqlite3", ["-version"], { timeout: 2000, stdio: "ignore" });
+    execFileSync15("sqlite3", ["-version"], { timeout: 2000, stdio: "ignore" });
   } catch {
     hasSqlite = false;
   }
@@ -59061,7 +59218,7 @@ function scrubSqlite(path, values, dryRun) {
   for (const { value } of values) {
     const esc = value.replace(/'/g, "''");
     try {
-      const out = execFileSync14("sqlite3", [path, `SELECT COUNT(*) FROM messages WHERE text LIKE '%${esc}%'`], { encoding: "utf8", timeout: 1e4 });
+      const out = execFileSync15("sqlite3", [path, `SELECT COUNT(*) FROM messages WHERE text LIKE '%${esc}%'`], { encoding: "utf8", timeout: 1e4 });
       const n = parseInt(out.trim(), 10);
       if (!Number.isNaN(n))
         matches += n;
@@ -59075,7 +59232,7 @@ function scrubSqlite(path, values, dryRun) {
       for (const { key, value } of values) {
         const esc = value.replace(/'/g, "''");
         const replacement = `vault:${key}`.replace(/'/g, "''");
-        execFileSync14("sqlite3", [path, `UPDATE messages SET text = replace(text, '${esc}', '${replacement}')`], { timeout: 15000 });
+        execFileSync15("sqlite3", [path, `UPDATE messages SET text = replace(text, '${esc}', '${replacement}')`], { timeout: 15000 });
       }
       return { target: path, matches, modified: true };
     } catch (err) {
@@ -59113,14 +59270,14 @@ function suggestVaultKeys(requested, available, max = 3) {
 init_loader();
 init_loader();
 init_client();
-import { readFileSync as readFileSync32, existsSync as existsSync36, unlinkSync as unlinkSync9 } from "node:fs";
+import { readFileSync as readFileSync33, existsSync as existsSync36, unlinkSync as unlinkSync9 } from "node:fs";
 import { spawn as spawn4 } from "node:child_process";
 
 // src/vault/broker/server.ts
 init_compose();
 init_vault();
 import * as net3 from "node:net";
-import { mkdirSync as mkdirSync22, chmodSync as chmodSync7, chownSync as chownSync2, existsSync as existsSync35, readFileSync as readFileSync30, readdirSync as readdirSync16, statSync as statSync19, unlinkSync as unlinkSync8, writeFileSync as writeFileSync19, renameSync as renameSync10 } from "node:fs";
+import { mkdirSync as mkdirSync22, chmodSync as chmodSync7, chownSync as chownSync2, existsSync as existsSync35, readFileSync as readFileSync31, readdirSync as readdirSync16, statSync as statSync19, unlinkSync as unlinkSync8, writeFileSync as writeFileSync19, renameSync as renameSync10 } from "node:fs";
 import { dirname as dirname6, resolve as resolve26, basename as basename4 } from "node:path";
 import * as os4 from "node:os";
 import * as path3 from "node:path";
@@ -59136,7 +59293,7 @@ import {
   mkdirSync as mkdirSync19,
   openSync as openSync6,
   closeSync as closeSync6,
-  readFileSync as readFileSync28,
+  readFileSync as readFileSync29,
   renameSync as renameSync9,
   statSync as statSync18,
   symlinkSync as symlinkSync3,
@@ -59292,7 +59449,7 @@ function lstatSyncOrNull(path) {
   }
 }
 function sha256File(path) {
-  const data = readFileSync28(path);
+  const data = readFileSync29(path);
   return createHash5("sha256").update(data).digest("hex");
 }
 function atomicReplaceWithSymlink(target, linkTarget) {
@@ -59327,7 +59484,7 @@ init_loader();
 
 // src/vault/auto-unlock.ts
 import { createHmac, randomBytes as randomBytes6, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "node:crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync34, mkdirSync as mkdirSync20, readFileSync as readFileSync29, writeFileSync as writeFileSync18 } from "node:fs";
+import { chmodSync as chmodSync5, existsSync as existsSync34, mkdirSync as mkdirSync20, readFileSync as readFileSync30, writeFileSync as writeFileSync18 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 var FORMAT_VERSION = 1;
 var SALT_LEN = 16;
@@ -59363,7 +59520,7 @@ function readMachineId() {
   }
   for (const path of [MACHINE_ID_PRIMARY, MACHINE_ID_FALLBACK]) {
     try {
-      const id = readFileSync29(path, "utf8").trim();
+      const id = readFileSync30(path, "utf8").trim();
       if (id.length > 0)
         return id;
     } catch {}
@@ -59427,7 +59584,7 @@ function readAutoUnlockFile(filePath) {
   }
   let blob;
   try {
-    blob = readFileSync29(filePath);
+    blob = readFileSync30(filePath);
   } catch {
     throw new AutoUnlockDecryptError("io");
   }
@@ -63284,7 +63441,7 @@ class VaultBroker {
     const credPath = `${dir}/vault-passphrase`;
     let passphrase;
     try {
-      passphrase = readFileSync30(credPath, "utf8").replace(/\n+$/, "");
+      passphrase = readFileSync31(credPath, "utf8").replace(/\n+$/, "");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -63435,9 +63592,9 @@ init_vault();
 // src/cli/vault-auto-unlock.ts
 init_loader();
 init_client();
-var import_yaml9 = __toESM(require_dist(), 1);
+var import_yaml10 = __toESM(require_dist(), 1);
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { readFileSync as readFileSync31, writeFileSync as writeFileSync20 } from "node:fs";
+import { readFileSync as readFileSync32, writeFileSync as writeFileSync20 } from "node:fs";
 import { homedir as homedir16 } from "node:os";
 import { join as join31 } from "node:path";
 class EncryptFailedError extends Error {
@@ -63467,8 +63624,8 @@ function encryptCredential(passphrase, credPath) {
   }
 }
 function setVaultBrokerAutoUnlock(configPath, value) {
-  const raw = readFileSync31(configPath, "utf-8");
-  const doc = import_yaml9.default.parseDocument(raw);
+  const raw = readFileSync32(configPath, "utf-8");
+  const doc = import_yaml10.default.parseDocument(raw);
   doc.setIn(["vault", "broker", "autoUnlock"], value);
   writeFileSync20(configPath, doc.toString(), "utf-8");
 }
@@ -63662,7 +63819,7 @@ function registerVaultBrokerCommand(vaultCmd, program3) {
       console.error("vault-broker PID file not found \u2014 is the daemon running?");
       process.exit(1);
     }
-    const pid = parseInt(readFileSync32(pidPath, "utf8").trim(), 10);
+    const pid = parseInt(readFileSync33(pidPath, "utf8").trim(), 10);
     if (isNaN(pid) || pid <= 0) {
       console.error("Invalid PID file contents");
       process.exit(1);
@@ -64035,7 +64192,7 @@ Vault Doctor`));
 
 // src/cli/vault-audit.ts
 init_source();
-import { existsSync as existsSync38, readFileSync as readFileSync33 } from "node:fs";
+import { existsSync as existsSync38, readFileSync as readFileSync34 } from "node:fs";
 
 // src/vault/audit-reader.ts
 function parseAuditLine(line) {
@@ -64114,7 +64271,7 @@ function registerVaultAuditCommand(vault, _program) {
 The log is created when the vault broker handles its first request.`));
       process.exit(0);
     }
-    const raw = readFileSync33(logPath, "utf-8");
+    const raw = readFileSync34(logPath, "utf-8");
     const rawLines = raw.split(`
 `);
     const limit = Math.max(1, parseInt(opts.tail ?? "50", 10) || 50);
@@ -64324,7 +64481,7 @@ import {
   mkdirSync as mkdirSync23,
   openSync as openSync9,
   readdirSync as readdirSync17,
-  readFileSync as readFileSync34,
+  readFileSync as readFileSync35,
   renameSync as renameSync11,
   statSync as statSync20,
   symlinkSync as symlinkSync4,
@@ -64371,7 +64528,7 @@ function parseBackupFilename(name) {
 function validateVaultEnvelopeFile(path4) {
   let buf;
   try {
-    buf = readFileSync34(path4);
+    buf = readFileSync35(path4);
   } catch (err) {
     return `cannot read ${path4}: ${err.message}`;
   }
@@ -64443,7 +64600,7 @@ function listBackupFiles(dir) {
 }
 function sha256OfFile(path4) {
   const h = createHash8("sha256");
-  h.update(readFileSync34(path4));
+  h.update(readFileSync35(path4));
   return h.digest("hex");
 }
 function backupVault(opts) {
@@ -64463,7 +64620,7 @@ function backupVault(opts) {
   const fullPath = join33(opts.destDir, filename);
   const tmpName = `.tmp.${process.pid}.${randomBytes10(4).toString("hex")}`;
   const tmpPath = join33(opts.destDir, tmpName);
-  const src = readFileSync34(opts.vaultPath);
+  const src = readFileSync35(opts.vaultPath);
   const fd = openSync9(tmpPath, "wx", 384);
   try {
     writeSync5(fd, src);
@@ -64838,7 +64995,7 @@ function registerVaultCommand(program3) {
       let isBinaryFile = false;
       if (opts.file) {
         try {
-          const buf = readFileSync35(resolvePath(opts.file));
+          const buf = readFileSync36(resolvePath(opts.file));
           const asUtf8 = buf.toString("utf8");
           if (Buffer.compare(buf, Buffer.from(asUtf8, "utf8")) === 0) {
             value = asUtf8;
@@ -65182,7 +65339,7 @@ Push passphrase to broker for future requests? [Y/n]: `);
 
 // src/cli/telegram.ts
 init_source();
-import { existsSync as existsSync41, readFileSync as readFileSync36, writeFileSync as writeFileSync21 } from "node:fs";
+import { existsSync as existsSync41, readFileSync as readFileSync37, writeFileSync as writeFileSync21 } from "node:fs";
 import { join as join35 } from "node:path";
 
 // src/web/webhook-dispatch.ts
@@ -65286,15 +65443,15 @@ init_paths();
 import { createInterface as createInterface4 } from "node:readline";
 
 // src/cli/telegram-yaml.ts
-var import_yaml10 = __toESM(require_dist(), 1);
+var import_yaml11 = __toESM(require_dist(), 1);
 function setTelegramFeature(yamlText, agentName, feature, value) {
-  const doc = import_yaml10.parseDocument(yamlText);
+  const doc = import_yaml11.parseDocument(yamlText);
   ensureAgent(doc, agentName);
   doc.setIn(["agents", agentName, "channels", "telegram", feature], value);
   return String(doc);
 }
 function removeTelegramFeature(yamlText, agentName, feature) {
-  const doc = import_yaml10.parseDocument(yamlText);
+  const doc = import_yaml11.parseDocument(yamlText);
   if (!hasAgent(doc, agentName))
     return yamlText;
   if (!doc.hasIn(["agents", agentName, "channels", "telegram", feature])) {
@@ -65312,21 +65469,21 @@ function ensureAgent(doc, agentName) {
 }
 function hasAgent(doc, agentName) {
   const agents = doc.get("agents");
-  if (!import_yaml10.isMap(agents))
+  if (!import_yaml11.isMap(agents))
     return false;
   return agents.has(agentName);
 }
 function pruneEmptyMap2(doc, path4) {
   const node = doc.getIn(path4);
-  if (import_yaml10.isMap(node) && node.items.length === 0) {
+  if (import_yaml11.isMap(node) && node.items.length === 0) {
     doc.deleteIn(path4);
   }
 }
 function addWebhookSource(yamlText, agentName, source) {
-  const doc = import_yaml10.parseDocument(yamlText);
+  const doc = import_yaml11.parseDocument(yamlText);
   ensureAgent(doc, agentName);
   const existing = doc.getIn(["agents", agentName, "channels", "telegram", "webhook_sources"]);
-  if (import_yaml10.isSeq(existing)) {
+  if (import_yaml11.isSeq(existing)) {
     const seq = existing;
     for (const item of seq.items) {
       const v = item.value ?? item;
@@ -65340,11 +65497,11 @@ function addWebhookSource(yamlText, agentName, source) {
   return String(doc);
 }
 function removeWebhookSource(yamlText, agentName, source) {
-  const doc = import_yaml10.parseDocument(yamlText);
+  const doc = import_yaml11.parseDocument(yamlText);
   if (!hasAgent(doc, agentName))
     return yamlText;
   const existing = doc.getIn(["agents", agentName, "channels", "telegram", "webhook_sources"]);
-  if (!import_yaml10.isSeq(existing))
+  if (!import_yaml11.isSeq(existing))
     return yamlText;
   const seq = existing;
   const beforeLen = seq.items.length;
@@ -65613,7 +65770,7 @@ function registerDisableVerb(tg, program3) {
 }
 async function applyYamlEdit(program3, agent, feature, value, dryRun) {
   const path4 = getConfigPath(program3);
-  const before = readFileSync36(path4, "utf-8");
+  const before = readFileSync37(path4, "utf-8");
   let after;
   try {
     after = setTelegramFeature(before, agent, feature, value);
@@ -65628,7 +65785,7 @@ async function applyYamlEdit(program3, agent, feature, value, dryRun) {
 }
 async function applyYamlRemove(program3, agent, feature, dryRun) {
   const path4 = getConfigPath(program3);
-  const before = readFileSync36(path4, "utf-8");
+  const before = readFileSync37(path4, "utf-8");
   const after = removeTelegramFeature(before, agent, feature);
   if (before === after) {
     console.log(source_default.yellow(`No change \u2014 ${feature.replace("_", "-")} is not set for agent '${agent}'.`));
@@ -65677,7 +65834,7 @@ function fail(msg) {
 }
 async function applyYamlAddWebhook(program3, agent, source, dryRun) {
   const path4 = getConfigPath(program3);
-  const before = readFileSync36(path4, "utf-8");
+  const before = readFileSync37(path4, "utf-8");
   let after;
   try {
     after = addWebhookSource(before, agent, source);
@@ -65697,7 +65854,7 @@ async function applyYamlAddWebhook(program3, agent, source, dryRun) {
 }
 async function applyYamlRemoveWebhook(program3, agent, source, dryRun) {
   const path4 = getConfigPath(program3);
-  const before = readFileSync36(path4, "utf-8");
+  const before = readFileSync37(path4, "utf-8");
   const after = removeWebhookSource(before, agent, source);
   if (before === after) {
     console.log(source_default.yellow(`No change \u2014 webhook source '${source}' is not currently enabled for agent '${agent}'.`));
@@ -65754,7 +65911,7 @@ function registerDispatchVerb(tg, _program) {
     }
     let payload;
     try {
-      payload = JSON.parse(readFileSync36(opts.payload, "utf-8"));
+      payload = JSON.parse(readFileSync37(opts.payload, "utf-8"));
     } catch (err) {
       fail(`Could not read payload file '${opts.payload}': ${err.message}`);
     }
@@ -65875,7 +66032,7 @@ function reflectAcrossAgents(config) {
 init_helpers();
 
 // src/setup/hindsight.ts
-import { execFileSync as execFileSync15 } from "node:child_process";
+import { execFileSync as execFileSync16 } from "node:child_process";
 import { createServer as createServer4 } from "node:net";
 var HINDSIGHT_DEFAULT_API_PORT = 8888;
 var HINDSIGHT_DEFAULT_UI_PORT = 9999;
@@ -65930,7 +66087,7 @@ async function pickHindsightPorts() {
 }
 function isDockerAvailable() {
   try {
-    execFileSync15("docker", ["--version"], { stdio: "pipe" });
+    execFileSync16("docker", ["--version"], { stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -65938,7 +66095,7 @@ function isDockerAvailable() {
 }
 function isHindsightRunning() {
   try {
-    const output = execFileSync15("docker", ["ps", "--filter", "name=switchroom-hindsight", "--format", "{{.Status}}"], { stdio: "pipe", encoding: "utf-8" });
+    const output = execFileSync16("docker", ["ps", "--filter", "name=switchroom-hindsight", "--format", "{{.Status}}"], { stdio: "pipe", encoding: "utf-8" });
     return output.trim().length > 0;
   } catch {
     return false;
@@ -65946,7 +66103,7 @@ function isHindsightRunning() {
 }
 function isHindsightContainerExists() {
   try {
-    const output = execFileSync15("docker", ["ps", "-a", "--filter", "name=switchroom-hindsight", "--format", "{{.Names}}"], { stdio: "pipe", encoding: "utf-8" });
+    const output = execFileSync16("docker", ["ps", "-a", "--filter", "name=switchroom-hindsight", "--format", "{{.Names}}"], { stdio: "pipe", encoding: "utf-8" });
     return output.trim().length > 0;
   } catch {
     return false;
@@ -65996,19 +66153,19 @@ function startHindsight(ports) {
     ...envArgs,
     HINDSIGHT_IMAGE
   ];
-  execFileSync15("docker", args, { stdio: "pipe" });
+  execFileSync16("docker", args, { stdio: "pipe" });
 }
 function stopHindsight() {
   try {
-    execFileSync15("docker", ["stop", "switchroom-hindsight"], { stdio: "pipe" });
+    execFileSync16("docker", ["stop", "switchroom-hindsight"], { stdio: "pipe" });
   } catch {}
   try {
-    execFileSync15("docker", ["rm", "switchroom-hindsight"], { stdio: "pipe" });
+    execFileSync16("docker", ["rm", "switchroom-hindsight"], { stdio: "pipe" });
   } catch {}
 }
 function getHindsightStatus() {
   try {
-    const output = execFileSync15("docker", ["ps", "-a", "--filter", "name=switchroom-hindsight", "--format", "{{.Status}}"], { stdio: "pipe", encoding: "utf-8" });
+    const output = execFileSync16("docker", ["ps", "-a", "--filter", "name=switchroom-hindsight", "--format", "{{.Status}}"], { stdio: "pipe", encoding: "utf-8" });
     const status = output.trim();
     return status.length > 0 ? status : null;
   } catch {
@@ -66106,8 +66263,8 @@ async function ensureHindsightConsumer(configPath, account, uid = HINDSIGHT_DEFA
 
 // src/cli/memory.ts
 init_loader();
-var import_yaml11 = __toESM(require_dist(), 1);
-import { existsSync as existsSync42, readFileSync as readFileSync37, writeFileSync as writeFileSync22 } from "node:fs";
+var import_yaml12 = __toESM(require_dist(), 1);
+import { existsSync as existsSync42, readFileSync as readFileSync38, writeFileSync as writeFileSync22 } from "node:fs";
 import { join as join36 } from "node:path";
 function readRecallLog(agentDir, limit) {
   const path4 = join36(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
@@ -66115,7 +66272,7 @@ function readRecallLog(agentDir, limit) {
     return [];
   let raw;
   try {
-    raw = readFileSync37(path4, "utf-8");
+    raw = readFileSync38(path4, "utf-8");
   } catch {
     return [];
   }
@@ -66310,8 +66467,8 @@ Cross-agent reflection plan
     const configPath = getConfigPath(program3);
     try {
       if (existsSync42(configPath)) {
-        const raw = readFileSync37(configPath, "utf-8");
-        const doc = import_yaml11.default.parseDocument(raw);
+        const raw = readFileSync38(configPath, "utf-8");
+        const doc = import_yaml12.default.parseDocument(raw);
         if (!doc.has("memory")) {
           doc.set("memory", { backend: "hindsight", shared_collection: "shared", config: { provider, url } });
         } else {
@@ -66417,7 +66574,7 @@ init_source();
 init_merge();
 init_lifecycle();
 import {
-  readFileSync as readFileSync42,
+  readFileSync as readFileSync43,
   existsSync as existsSync47,
   realpathSync as realpathSync3,
   mkdirSync as mkdirSync27,
@@ -66436,7 +66593,7 @@ init_lifecycle();
 init_manager();
 init_hindsight();
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync44, readFileSync as readFileSync39 } from "node:fs";
+import { existsSync as existsSync44, readFileSync as readFileSync40 } from "node:fs";
 import { resolve as resolve27 } from "node:path";
 init_audit_reader();
 
@@ -70940,7 +71097,7 @@ init_paths();
 import {
   existsSync as existsSync43,
   mkdirSync as mkdirSync24,
-  readFileSync as readFileSync38,
+  readFileSync as readFileSync39,
   writeFileSync as writeFileSync23
 } from "node:fs";
 import { dirname as dirname8 } from "node:path";
@@ -70961,7 +71118,7 @@ function getDistinctId() {
   const path4 = resolveStatePath("analytics-id");
   try {
     if (existsSync43(path4)) {
-      const existing = readFileSync38(path4, "utf-8").trim();
+      const existing = readFileSync39(path4, "utf-8").trim();
       if (existing) {
         cachedDistinctId = existing;
         return existing;
@@ -71537,7 +71694,7 @@ async function handleGetSystemHealth(home2) {
     const logPath = defaultAuditLogPath2(home2);
     if (existsSync44(logPath)) {
       hostd.auditLogPresent = true;
-      const raw = readFileSync39(logPath, "utf-8");
+      const raw = readFileSync40(logPath, "utf-8");
       hostd.recent = readAndFilter(raw, {}, 10);
     }
   } catch (err) {
@@ -71582,6 +71739,70 @@ async function handleGetGoogleAccounts(config) {
   }
   return out;
 }
+async function handleGetMicrosoftAccounts(config) {
+  const live = new Map;
+  try {
+    await withAuthBrokerClient(async (client2) => {
+      const data = await client2.listMicrosoftAccounts();
+      for (const a of data.accounts) {
+        live.set(a.account.toLowerCase(), {
+          expiresAt: a.expiresAt,
+          scope: a.scope,
+          clientId: a.clientId,
+          accountType: a.accountType
+        });
+      }
+    });
+  } catch (err) {
+    if (!(err instanceof AuthBrokerUnreachableError))
+      throw err;
+  }
+  const cfgAccounts = config.microsoft_accounts ?? {};
+  const keys = new Set([
+    ...Object.keys(cfgAccounts).map((k) => k.toLowerCase()),
+    ...live.keys()
+  ]);
+  const out = [];
+  for (const key of [...keys].sort()) {
+    const cfg = cfgAccounts[key];
+    const l = live.get(key);
+    out.push({
+      account: key,
+      expiresAt: l?.expiresAt ?? null,
+      scope: l?.scope ?? null,
+      clientId: l?.clientId ?? null,
+      accountType: l?.accountType ?? null,
+      enabledFor: cfg?.enabled_for ? [...cfg.enabled_for].sort() : [],
+      brokerKnown: l != null
+    });
+  }
+  return out;
+}
+function handleGetNotionWorkspace(config) {
+  const nw = config.notion_workspace;
+  if (!nw) {
+    return { configured: false, vaultKey: null, databases: [], fullAccessAgents: [] };
+  }
+  const declared = nw.databases ?? {};
+  const agentNames = Object.keys(config.agents ?? {});
+  const databases = Object.entries(declared).map(([name, id]) => {
+    const enabledFor = agentNames.filter((n) => agentCanAccessNotionDB(config, n, id)).sort();
+    return { name, id, enabledFor };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+  const agentsRaw = config.agents ?? {};
+  const fullAccessAgents = agentNames.filter((n) => {
+    if (!shouldEmitNotionMcp(n, config))
+      return false;
+    const dbs = agentsRaw[n]?.notion_workspace?.databases;
+    return dbs === undefined || dbs.length === 0;
+  }).sort();
+  return {
+    configured: true,
+    vaultKey: nw.vault_key ?? null,
+    databases,
+    fullAccessAgents
+  };
+}
 function handleGetSchedule(config) {
   const entries = collectScheduleEntries(config);
   const agentsDir = resolveAgentsDir(config);
@@ -71616,7 +71837,7 @@ async function handleGetApprovals() {
 }
 
 // src/web/webhook-handler.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync46, mkdirSync as mkdirSync26, readFileSync as readFileSync41, writeFileSync as writeFileSync24 } from "fs";
+import { appendFileSync as appendFileSync3, existsSync as existsSync46, mkdirSync as mkdirSync26, readFileSync as readFileSync42, writeFileSync as writeFileSync24 } from "fs";
 import { join as join40 } from "path";
 import { homedir as homedir21 } from "os";
 
@@ -71768,7 +71989,7 @@ function forwardToGateway(socketPath, req, opts = {}) {
 }
 
 // src/web/webhook-edge.ts
-import { existsSync as existsSync45, readFileSync as readFileSync40 } from "fs";
+import { existsSync as existsSync45, readFileSync as readFileSync41 } from "fs";
 import { join as join39 } from "path";
 import { homedir as homedir20 } from "os";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -71781,7 +72002,7 @@ function loadEdgeSecret(path4) {
   try {
     if (!existsSync45(p))
       return null;
-    const raw = readFileSync40(p, "utf-8").trim();
+    const raw = readFileSync41(p, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -71815,7 +72036,7 @@ function loadDedupFile(path4) {
   try {
     if (!existsSync46(path4))
       return {};
-    const raw = JSON.parse(readFileSync41(path4, "utf-8"));
+    const raw = JSON.parse(readFileSync42(path4, "utf-8"));
     return typeof raw.deliveries === "object" && raw.deliveries !== null ? raw.deliveries : {};
   } catch {
     return {};
@@ -72095,7 +72316,7 @@ function resolveWebToken() {
   const home2 = process.env.HOME ?? homedir22();
   const tokenPath = join41(home2, ".switchroom", "web-token");
   if (existsSync47(tokenPath)) {
-    const existing = readFileSync42(tokenPath, "utf8").trim();
+    const existing = readFileSync43(tokenPath, "utf8").trim();
     if (existing.length > 0)
       return existing;
   }
@@ -72112,7 +72333,7 @@ function resolveWebToken() {
     return token;
   } catch (err) {
     if (err.code === "EEXIST") {
-      const existing = readFileSync42(tokenPath, "utf8").trim();
+      const existing = readFileSync43(tokenPath, "utf8").trim();
       if (existing.length > 0)
         return existing;
     }
@@ -72182,7 +72403,7 @@ function loadWebhookSecrets() {
   if (!existsSync47(path4))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync42(path4, "utf-8"));
+    const parsed = JSON.parse(readFileSync43(path4, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (err) {
     process.stderr.write(`webhook-ingest: failed to parse ${path4}: ${err.message} \u2014 webhooks will return 401 until fixed
@@ -72259,6 +72480,12 @@ function parseRoute(pathname, method) {
   if (method === "GET" && pathname === "/api/google-accounts") {
     return { handler: "getGoogleAccounts", params: {} };
   }
+  if (method === "GET" && pathname === "/api/microsoft-accounts") {
+    return { handler: "getMicrosoftAccounts", params: {} };
+  }
+  if (method === "GET" && pathname === "/api/notion-workspace") {
+    return { handler: "getNotionWorkspace", params: {} };
+  }
   if (method === "GET" && pathname === "/api/schedule") {
     return { handler: "getSchedule", params: {} };
   }
@@ -72384,6 +72611,10 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
             return (async () => jsonResponse(await handleGetSystemHealth()))();
           case "getGoogleAccounts":
             return (async () => jsonResponse(await handleGetGoogleAccounts(config)))();
+          case "getMicrosoftAccounts":
+            return (async () => jsonResponse(await handleGetMicrosoftAccounts(config)))();
+          case "getNotionWorkspace":
+            return jsonResponse(handleGetNotionWorkspace(config));
           case "getSchedule":
             return jsonResponse(handleGetSchedule(config));
           case "getApprovals":
@@ -72457,7 +72688,7 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
       }
       const ext = extname(realFullPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
-      const content = readFileSync42(realFullPath);
+      const content = readFileSync43(realFullPath);
       return new Response(content, {
         headers: { "Content-Type": contentType }
       });
@@ -72591,26 +72822,26 @@ Starting Switchroom dashboard...
 // src/cli/setup.ts
 init_source();
 init_loader();
-import { existsSync as existsSync48, copyFileSync as copyFileSync8, readFileSync as readFileSync43, writeFileSync as writeFileSync25, mkdirSync as mkdirSync28 } from "node:fs";
+import { existsSync as existsSync48, copyFileSync as copyFileSync8, readFileSync as readFileSync44, writeFileSync as writeFileSync25, mkdirSync as mkdirSync28 } from "node:fs";
 import { resolve as resolve29, dirname as dirname10 } from "node:path";
 init_vault();
 init_manager();
 
 // src/cli/setup-posture-rewrite.ts
-var import_yaml12 = __toESM(require_dist(), 1);
+var import_yaml13 = __toESM(require_dist(), 1);
 function insertVaultBrokerApprovalAuth(source, value = "telegram-id") {
   let doc;
   try {
-    doc = import_yaml12.default.parseDocument(source);
+    doc = import_yaml13.default.parseDocument(source);
   } catch {
     return { kind: "not-found" };
   }
   const vault = doc.get("vault");
-  if (!vault || !import_yaml12.default.isMap(vault)) {
+  if (!vault || !import_yaml13.default.isMap(vault)) {
     return { kind: "not-found" };
   }
   const broker = vault.get("broker");
-  if (!broker || !import_yaml12.default.isMap(broker)) {
+  if (!broker || !import_yaml13.default.isMap(broker)) {
     return { kind: "not-found" };
   }
   if (broker.has("approvalAuth")) {
@@ -72661,7 +72892,7 @@ ${childIndent}approvalAuth: ${value}`;
 }
 
 // src/cli/supergroup-setup-yaml.ts
-var import_yaml13 = __toESM(require_dist(), 1);
+var import_yaml14 = __toESM(require_dist(), 1);
 function isValidSupergroupChatId(value) {
   return /^-\d+$/.test(value);
 }
@@ -72669,23 +72900,23 @@ function setAgentSupergroupChatId(yamlText, agentName, chatId) {
   if (!isValidSupergroupChatId(chatId)) {
     throw new Error(`setAgentSupergroupChatId: chat_id must be a negative integer string (got "${chatId}")`);
   }
-  const doc = import_yaml13.parseDocument(yamlText);
+  const doc = import_yaml14.parseDocument(yamlText);
   const root = doc.contents;
-  if (!import_yaml13.isMap(root)) {
+  if (!import_yaml14.isMap(root)) {
     throw new Error("setAgentSupergroupChatId: YAML root is not a map");
   }
   const agents = root.get("agents", true);
-  if (!import_yaml13.isMap(agents)) {
+  if (!import_yaml14.isMap(agents)) {
     throw new Error("setAgentSupergroupChatId: config has no `agents:` map");
   }
   const agent = agents.get(agentName, true);
-  if (!import_yaml13.isMap(agent)) {
+  if (!import_yaml14.isMap(agent)) {
     throw new Error(`setAgentSupergroupChatId: agent "${agentName}" not found in config`);
   }
   const channels = agent.get("channels", true);
-  if (import_yaml13.isMap(channels)) {
+  if (import_yaml14.isMap(channels)) {
     const telegram = channels.get("telegram", true);
-    if (import_yaml13.isMap(telegram)) {
+    if (import_yaml14.isMap(telegram)) {
       if (telegram.get("chat_id") === chatId)
         return yamlText;
       telegram.set("chat_id", chatId);
@@ -73320,7 +73551,7 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
     try {
       const yamlPath = existsSync48(resolve29(process.cwd(), "switchroom.yaml")) ? resolve29(process.cwd(), "switchroom.yaml") : resolve29(process.cwd(), "switchroom.yml");
       if (existsSync48(yamlPath)) {
-        const content = readFileSync43(yamlPath, "utf-8");
+        const content = readFileSync44(yamlPath, "utf-8");
         const result = insertVaultBrokerApprovalAuth(content, "telegram-id");
         if (result.kind === "rewritten") {
           writeFileSync25(yamlPath, result.content, "utf-8");
@@ -73355,7 +73586,7 @@ async function stepDangerousMode(config, nonInteractive) {
     ];
     for (const configPath of configPaths) {
       if (existsSync48(configPath)) {
-        let content = readFileSync43(configPath, "utf-8");
+        let content = readFileSync44(configPath, "utf-8");
         const agentNames = Object.keys(config.agents);
         for (const name of agentNames) {
           const agentPattern = new RegExp(`(^  ${name}:\\s*\\n)`, "m");
@@ -73465,9 +73696,9 @@ async function stepVerification(config, nonInteractive) {
   Start ${source_default.cyan(firstName)} now?`, false);
     if (startNow) {
       try {
-        const { execFileSync: execFileSync16 } = await import("node:child_process");
+        const { execFileSync: execFileSync17 } = await import("node:child_process");
         console.log(source_default.gray(`  Starting ${firstName}...`));
-        execFileSync16("switchroom", ["agent", "start", firstName], { stdio: "inherit" });
+        execFileSync17("switchroom", ["agent", "start", firstName], { stdio: "inherit" });
         console.log(source_default.green(`  ${STEP_DONE} Agent started`));
       } catch {
         console.log(source_default.yellow(`  Could not start automatically. Run: switchroom agent start ${firstName}`));
@@ -73484,7 +73715,7 @@ init_doctor();
 init_source();
 init_loader();
 init_lifecycle();
-import { cpSync as cpSync2, existsSync as existsSync55, mkdirSync as mkdirSync30, readFileSync as readFileSync48, realpathSync as realpathSync5, rmSync as rmSync12, statSync as statSync24 } from "node:fs";
+import { cpSync as cpSync2, existsSync as existsSync55, mkdirSync as mkdirSync30, readFileSync as readFileSync49, realpathSync as realpathSync5, rmSync as rmSync12, statSync as statSync24 } from "node:fs";
 import { spawnSync as spawnSync8 } from "node:child_process";
 import { join as join55, dirname as dirname13, resolve as resolve33 } from "node:path";
 import { homedir as homedir33 } from "node:os";
@@ -73494,7 +73725,7 @@ function runningFromSwitchroomCheckout(scriptPath) {
   for (let i = 0;i < 12; i++) {
     if (existsSync55(join55(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync48(join55(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync49(join55(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -73762,7 +73993,7 @@ function defaultStatusProbe(composePath) {
         const pkgPath = join55(dir, "package.json");
         if (existsSync55(pkgPath)) {
           try {
-            const pkg = JSON.parse(readFileSync48(pkgPath, "utf-8"));
+            const pkg = JSON.parse(readFileSync49(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
               cliVersion = pkg.version;
           } catch (err) {
@@ -73978,7 +74209,7 @@ init_source();
 init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
-import { existsSync as existsSync56, readFileSync as readFileSync49 } from "node:fs";
+import { existsSync as existsSync56, readFileSync as readFileSync50 } from "node:fs";
 import { dirname as dirname14, join as join56 } from "node:path";
 function getClaudeCodeVersion() {
   try {
@@ -74032,7 +74263,7 @@ function locateSwitchroomInstallDir() {
     const pkgPath = join56(dir, "package.json");
     if (existsSync56(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync49(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync50(pkgPath, "utf-8"));
         if (pkg.name === "switchroom" && existsSync56(join56(dir, ".git"))) {
           return dir;
         }
@@ -74263,7 +74494,7 @@ import {
   mkdirSync as mkdirSync31,
   openSync as openSync11,
   readdirSync as readdirSync21,
-  readFileSync as readFileSync50,
+  readFileSync as readFileSync51,
   renameSync as renameSync12,
   statSync as statSync25,
   unlinkSync as unlinkSync11,
@@ -74673,7 +74904,7 @@ function readAll(stateDir) {
     return [];
   let raw;
   try {
-    raw = readFileSync50(path4, "utf-8");
+    raw = readFileSync51(path4, "utf-8");
   } catch {
     return [];
   }
@@ -74884,7 +75115,7 @@ function withLock(stateDir, fn) {
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync50(lockPath, "utf-8").trim();
+    pidStr = readFileSync51(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
@@ -75141,13 +75372,13 @@ import { createHash as createHash11 } from "node:crypto";
 import {
   existsSync as existsSync58,
   mkdirSync as mkdirSync32,
-  readFileSync as readFileSync51,
+  readFileSync as readFileSync52,
   rmSync as rmSync13,
   writeFileSync as writeFileSync27
 } from "node:fs";
 import { dirname as dirname15, join as join58 } from "node:path";
 import { homedir as homedir34 } from "node:os";
-import { execFileSync as execFileSync17 } from "node:child_process";
+import { execFileSync as execFileSync18 } from "node:child_process";
 
 class PythonEnvError extends Error {
   stderr;
@@ -75161,7 +75392,7 @@ function defaultPythonCacheRoot() {
   return join58(homedir34(), ".switchroom", "deps", "python");
 }
 function hashFile(path4) {
-  return createHash11("sha256").update(readFileSync51(path4)).digest("hex");
+  return createHash11("sha256").update(readFileSync52(path4)).digest("hex");
 }
 function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
@@ -75177,7 +75408,7 @@ function ensurePythonEnv(opts) {
   const pipBin = join58(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
   if (!force && existsSync58(stampPath) && existsSync58(pythonBin)) {
-    const existingHash = readFileSync51(stampPath, "utf8").trim();
+    const existingHash = readFileSync52(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -75194,7 +75425,7 @@ function ensurePythonEnv(opts) {
   }
   mkdirSync32(dirname15(venvDir), { recursive: true });
   try {
-    execFileSync17(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
+    execFileSync18(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
   } catch (err) {
     const e = err;
     throw new PythonEnvError(`Failed to create venv for skill "${skillName}" with ${hostPython}: ${e.message}`, e.stderr?.toString());
@@ -75206,7 +75437,7 @@ function ensurePythonEnv(opts) {
     delete childEnv.PIP_TARGET;
     delete childEnv.PIP_PREFIX;
     delete childEnv.PYTHONUSERBASE;
-    execFileSync17(pipBin, ["install", "--disable-pip-version-check", "-r", requirementsPath], { stdio: "pipe", env: childEnv });
+    execFileSync18(pipBin, ["install", "--disable-pip-version-check", "-r", requirementsPath], { stdio: "pipe", env: childEnv });
   } catch (err) {
     const e = err;
     throw new PythonEnvError(`Failed to install requirements for skill "${skillName}": ${e.message}`, e.stderr?.toString());
@@ -75229,13 +75460,13 @@ import {
   copyFileSync as copyFileSync9,
   existsSync as existsSync59,
   mkdirSync as mkdirSync33,
-  readFileSync as readFileSync52,
+  readFileSync as readFileSync53,
   rmSync as rmSync14,
   writeFileSync as writeFileSync28
 } from "node:fs";
 import { dirname as dirname16, join as join59 } from "node:path";
 import { homedir as homedir35 } from "node:os";
-import { execFileSync as execFileSync18 } from "node:child_process";
+import { execFileSync as execFileSync19 } from "node:child_process";
 
 class NodeEnvError extends Error {
   stderr;
@@ -75264,7 +75495,7 @@ function hashDepInputs(packageJsonPath) {
   const hasher = createHash12("sha256");
   hasher.update(`package.json
 `);
-  hasher.update(readFileSync52(packageJsonPath));
+  hasher.update(readFileSync53(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
     const lockPath = join59(sourceDir, lockName);
     if (existsSync59(lockPath)) {
@@ -75273,7 +75504,7 @@ function hashDepInputs(packageJsonPath) {
       hasher.update(lockName);
       hasher.update(`
 `);
-      hasher.update(readFileSync52(lockPath));
+      hasher.update(readFileSync53(lockPath));
     }
   }
   return hasher.digest("hex");
@@ -75292,7 +75523,7 @@ function ensureNodeEnv(opts) {
   const binDir = join59(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
   if (!force && existsSync59(stampPath) && existsSync59(nodeModulesDir)) {
-    const existingHash = readFileSync52(stampPath, "utf8").trim();
+    const existingHash = readFileSync53(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -75319,10 +75550,10 @@ function ensureNodeEnv(opts) {
   try {
     if (installer === "bun") {
       const args = copiedLockfile ? ["install", "--frozen-lockfile"] : ["install"];
-      execFileSync18("bun", args, { cwd: envDir, stdio: "pipe" });
+      execFileSync19("bun", args, { cwd: envDir, stdio: "pipe" });
     } else {
       const args = copiedLockfile ? ["ci"] : ["install"];
-      execFileSync18("npm", args, { cwd: envDir, stdio: "pipe" });
+      execFileSync19("npm", args, { cwd: envDir, stdio: "pipe" });
     }
   } catch (err) {
     const e = err;
@@ -76311,7 +76542,7 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync10, existsSync as existsSync62, readFileSync as readFileSync53, writeFileSync as writeFileSync29 } from "node:fs";
+import { copyFileSync as copyFileSync10, existsSync as existsSync62, readFileSync as readFileSync54, writeFileSync as writeFileSync29 } from "node:fs";
 import { join as join61, resolve as resolve39 } from "node:path";
 init_schema();
 function resolveSoulTargetOrExit(program3, agentName) {
@@ -76357,7 +76588,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
-    process.stdout.write(readFileSync53(t.soulPath, "utf-8"));
+    process.stdout.write(readFileSync54(t.soulPath, "utf-8"));
   }));
   cmd.command("reset <agent>").description("Re-seed SOUL.md from the agent's current profile " + "(backs the existing file up to SOUL.md.bak first)").option("-y, --yes", "Skip the confirmation prompt").action(withConfigError(async (agentName, opts) => {
     const t = resolveSoulTargetOrExit(program3, agentName);
@@ -76402,7 +76633,7 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync63, readFileSync as readFileSync54, readdirSync as readdirSync22, statSync as statSync26 } from "node:fs";
+import { existsSync as existsSync63, readFileSync as readFileSync55, readdirSync as readdirSync22, statSync as statSync26 } from "node:fs";
 import { resolve as resolve40, join as join62 } from "node:path";
 import { createHash as createHash13 } from "node:crypto";
 init_merge();
@@ -76442,7 +76673,7 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
 }
 function extractLatestUserMessage(transcriptPath) {
   try {
-    const content = readFileSync54(transcriptPath, "utf-8");
+    const content = readFileSync55(transcriptPath, "utf-8");
     const lines = content.trim().split(`
 `).filter(Boolean);
     for (let i = lines.length - 1;i >= 0; i--) {
@@ -76546,7 +76777,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Append System Prompt (per-session) ===
 `);
-    const handoffContent = existsSync63(handoffPath) ? readFileSync54(handoffPath, "utf-8") : "";
+    const handoffContent = existsSync63(handoffPath) ? readFileSync55(handoffPath, "utf-8") : "";
     if (handoffContent.trim().length > 0) {
       console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
       console.log(handoffContent);
@@ -76557,7 +76788,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
 `);
-    const claudeMdContent = existsSync63(claudeMdPath) ? readFileSync54(claudeMdPath, "utf-8") : "";
+    const claudeMdContent = existsSync63(claudeMdPath) ? readFileSync55(claudeMdPath, "utf-8") : "";
     if (claudeMdContent.trim().length > 0) {
       console.log(`(${formatBytes(claudeMdContent.length)})`);
       console.log(claudeMdContent);
@@ -76568,7 +76799,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Persona (SOUL.md) ===
 `);
-    const soulMdContent = existsSync63(soulMdPath) ? readFileSync54(soulMdPath, "utf-8") : existsSync63(workspaceSoulMdPath) ? readFileSync54(workspaceSoulMdPath, "utf-8") : "";
+    const soulMdContent = existsSync63(soulMdPath) ? readFileSync55(soulMdPath, "utf-8") : existsSync63(workspaceSoulMdPath) ? readFileSync55(workspaceSoulMdPath, "utf-8") : "";
     if (soulMdContent.trim().length > 0) {
       console.log(`(${formatBytes(soulMdContent.length)})`);
       console.log(soulMdContent);
@@ -76648,7 +76879,7 @@ function registerDebugCommand(program3) {
 init_source();
 
 // src/worktree/claim.ts
-import { execFileSync as execFileSync19 } from "node:child_process";
+import { execFileSync as execFileSync20 } from "node:child_process";
 import { closeSync as closeSync12, mkdirSync as mkdirSync35, openSync as openSync12, existsSync as existsSync65, unlinkSync as unlinkSync13 } from "node:fs";
 import { join as join64, resolve as resolve42 } from "node:path";
 import { homedir as homedir38 } from "node:os";
@@ -76658,7 +76889,7 @@ import { randomBytes as randomBytes13 } from "node:crypto";
 import {
   mkdirSync as mkdirSync34,
   writeFileSync as writeFileSync30,
-  readFileSync as readFileSync55,
+  readFileSync as readFileSync56,
   readdirSync as readdirSync23,
   unlinkSync as unlinkSync12,
   existsSync as existsSync64,
@@ -76686,7 +76917,7 @@ function writeRecord(record2) {
 function readRecord(id) {
   const path7 = recordPath(id);
   try {
-    const raw = readFileSync55(path7, "utf8");
+    const raw = readFileSync56(path7, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -76815,7 +77046,7 @@ async function claimWorktree(input, codeRepos) {
     releaseLock();
   }
   try {
-    execFileSync19("git", ["worktree", "add", "-b", branch, worktreePath], {
+    execFileSync20("git", ["worktree", "add", "-b", branch, worktreePath], {
       cwd: repoPath,
       stdio: "pipe"
     });
@@ -76828,7 +77059,7 @@ async function claimWorktree(input, codeRepos) {
 }
 
 // src/worktree/release.ts
-import { execFileSync as execFileSync20 } from "node:child_process";
+import { execFileSync as execFileSync21 } from "node:child_process";
 import { existsSync as existsSync66 } from "node:fs";
 function releaseWorktree(input) {
   const { id } = input;
@@ -76839,7 +77070,7 @@ function releaseWorktree(input) {
   let gitSuccess = true;
   if (existsSync66(record2.path)) {
     try {
-      execFileSync20("git", ["worktree", "remove", "--force", record2.path], {
+      execFileSync21("git", ["worktree", "remove", "--force", record2.path], {
         cwd: record2.repo,
         stdio: "pipe"
       });
@@ -76875,16 +77106,16 @@ function listWorktrees() {
 }
 
 // src/worktree/reaper.ts
-import { execFileSync as execFileSync21 } from "node:child_process";
+import { execFileSync as execFileSync22 } from "node:child_process";
 import { existsSync as existsSync67 } from "node:fs";
 var STALE_THRESHOLD_MS = 10 * 60 * 1000;
 function isPathInUse(path7) {
   try {
-    execFileSync21("fuser", [path7], { stdio: "pipe" });
+    execFileSync22("fuser", [path7], { stdio: "pipe" });
     return true;
   } catch {}
   try {
-    const out = execFileSync21("lsof", ["-t", path7], {
+    const out = execFileSync22("lsof", ["-t", path7], {
       stdio: ["ignore", "pipe", "ignore"]
     }).toString().trim();
     if (out.length > 0)
@@ -76894,7 +77125,7 @@ function isPathInUse(path7) {
 }
 function hasUncommittedChanges(repoPath, worktreePath) {
   try {
-    const out = execFileSync21("git", ["-C", worktreePath, "status", "--porcelain"], { stdio: "pipe" }).toString();
+    const out = execFileSync22("git", ["-C", worktreePath, "status", "--porcelain"], { stdio: "pipe" }).toString();
     return out.trim().length > 0;
   } catch {
     return false;
@@ -76908,7 +77139,7 @@ function reapRecord(record2) {
       warning = `[worktree-reaper] Reaped worktree with uncommitted changes: ` + `id=${id} branch=${branch} agent=${ownerAgent ?? "unknown"} path=${path7}`;
     }
     try {
-      execFileSync21("git", ["worktree", "remove", "--force", path7], {
+      execFileSync22("git", ["worktree", "remove", "--force", path7], {
         cwd: repo,
         stdio: "pipe"
       });
@@ -78000,7 +78231,7 @@ async function fetchToken(vaultKey) {
 
 // src/cli/apply.ts
 init_source();
-import { accessSync as accessSync3, chownSync as chownSync4, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync72, mkdirSync as mkdirSync40, readFileSync as readFileSync57, readdirSync as readdirSync26, renameSync as renameSync14, writeFileSync as writeFileSync35 } from "node:fs";
+import { accessSync as accessSync3, chownSync as chownSync4, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync72, mkdirSync as mkdirSync40, readFileSync as readFileSync58, readdirSync as readdirSync26, renameSync as renameSync14, writeFileSync as writeFileSync35 } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
@@ -78391,13 +78622,13 @@ agents:
 init_resolver();
 import { dirname as dirname21, join as join70, resolve as resolve44 } from "node:path";
 import { homedir as homedir40 } from "node:os";
-import { execFileSync as execFileSync22 } from "node:child_process";
+import { execFileSync as execFileSync23 } from "node:child_process";
 init_vault();
 init_loader();
 init_loader();
 
 // src/cli/update-prompt-hook.ts
-import { existsSync as existsSync69, readFileSync as readFileSync56, writeFileSync as writeFileSync34, chmodSync as chmodSync10, mkdirSync as mkdirSync39 } from "node:fs";
+import { existsSync as existsSync69, readFileSync as readFileSync57, writeFileSync as writeFileSync34, chmodSync as chmodSync10, mkdirSync as mkdirSync39 } from "node:fs";
 import { join as join67 } from "node:path";
 var HOOK_FILENAME = "update-card-on-prompt.sh";
 function updatePromptHookScript() {
@@ -78469,7 +78700,7 @@ function installUpdatePromptHook(agentDir) {
   const scriptPath = join67(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
-  const existing = existsSync69(scriptPath) ? readFileSync56(scriptPath, "utf-8") : "";
+  const existing = existsSync69(scriptPath) ? readFileSync57(scriptPath, "utf-8") : "";
   if (existing !== desired) {
     writeFileSync34(scriptPath, desired, { mode: 493 });
     chmodSync10(scriptPath, 493);
@@ -78483,7 +78714,7 @@ function installUpdatePromptHook(agentDir) {
   if (!existsSync69(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
-  const raw = readFileSync56(settingsPath, "utf-8");
+  const raw = readFileSync57(settingsPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -78777,7 +79008,7 @@ async function ensureHostMountSources(config) {
   await mkdir(fleetDir, { recursive: true });
   const invariantsPath = join70(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
-  const invariantsCurrent = existsSync72(invariantsPath) ? readFileSync57(invariantsPath, "utf-8") : null;
+  const invariantsCurrent = existsSync72(invariantsPath) ? readFileSync58(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
     writeFileSync35(invariantsPath, invariantsCanonical, { mode: 420 });
   }
@@ -78799,7 +79030,7 @@ async function ensureHostMountSources(config) {
 }
 function detectComposeV2() {
   try {
-    const out = execFileSync22("docker", ["compose", "version"], {
+    const out = execFileSync23("docker", ["compose", "version"], {
       stdio: ["ignore", "pipe", "pipe"],
       encoding: "utf8"
     });
@@ -79314,7 +79545,7 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync58, existsSync as existsSync73, readdirSync as readdirSync27 } from "node:fs";
+import { readFileSync as readFileSync59, existsSync as existsSync73, readdirSync as readdirSync27 } from "node:fs";
 import { join as join71 } from "node:path";
 import { homedir as homedir41 } from "node:os";
 
@@ -79590,7 +79821,7 @@ function runReport(opts) {
   for (const src of sources) {
     let content;
     try {
-      content = readFileSync58(src.path, "utf-8");
+      content = readFileSync59(src.path, "utf-8");
     } catch (err) {
       process.stderr.write(`status-ask report: cannot read ${src.path}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -79691,7 +79922,7 @@ import {
   existsSync as existsSync74,
   mkdirSync as mkdirSync41,
   appendFileSync as appendFileSync4,
-  readFileSync as readFileSync59
+  readFileSync as readFileSync60
 } from "node:fs";
 var AUDIT_ROOT = join72(homedir42(), ".switchroom", "audit");
 function auditPathFor(agent) {
@@ -79786,7 +80017,7 @@ function readAuditTail(agent, limit, opts = {}) {
     return [];
   let raw;
   try {
-    raw = readFileSync59(path8, "utf-8");
+    raw = readFileSync60(path8, "utf-8");
   } catch {
     return [];
   }
@@ -79936,7 +80167,7 @@ function registerAgentConfigCommands(program3) {
 }
 
 // src/cli/agent-config-write.ts
-var import_yaml16 = __toESM(require_dist(), 1);
+var import_yaml17 = __toESM(require_dist(), 1);
 
 // src/config/overlay-writer.ts
 init_paths();
@@ -79947,7 +80178,7 @@ import {
   mkdirSync as mkdirSync42,
   openSync as openSync13,
   readdirSync as readdirSync28,
-  readFileSync as readFileSync60,
+  readFileSync as readFileSync61,
   renameSync as renameSync15,
   statSync as statSync28,
   unlinkSync as unlinkSync14,
@@ -80071,7 +80302,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
       continue;
     const full = join73(paths.skillsDir, name);
     try {
-      const raw = readFileSync60(full, "utf-8");
+      const raw = readFileSync61(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -80098,7 +80329,7 @@ function listOverlayEntries(agent, opts = {}) {
       continue;
     const full = join73(paths.scheduleDir, name);
     try {
-      const raw = readFileSync60(full, "utf-8");
+      const raw = readFileSync61(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -80129,7 +80360,7 @@ function filterOverlaySecrets(doc, source) {
 // src/agents/reconcile-dry-run.ts
 init_overlay_schema();
 init_schema();
-var import_yaml15 = __toESM(require_dist(), 1);
+var import_yaml16 = __toESM(require_dist(), 1);
 init_lifecycle();
 var MIN_CRON_INTERVAL_SECS = 5 * 60;
 function violatesMinInterval(cron) {
@@ -80151,7 +80382,7 @@ function violatesMinInterval(cron) {
 function dryRunReconcile(input) {
   let parsed;
   try {
-    parsed = import_yaml15.parse(input.yamlText);
+    parsed = import_yaml16.parse(input.yamlText);
   } catch (err) {
     return {
       ok: false,
@@ -80246,7 +80477,7 @@ import {
   mkdirSync as mkdirSync43,
   openSync as openSync14,
   readdirSync as readdirSync29,
-  readFileSync as readFileSync61,
+  readFileSync as readFileSync62,
   renameSync as renameSync16,
   unlinkSync as unlinkSync15,
   writeFileSync as writeFileSync36,
@@ -80310,7 +80541,7 @@ function listPendingScheduleEntries(agent, opts = {}) {
     if (!existsSync76(yamlPath))
       continue;
     try {
-      const meta = JSON.parse(readFileSync61(metaPath, "utf-8"));
+      const meta = JSON.parse(readFileSync62(metaPath, "utf-8"));
       if (meta?.v !== 1 || typeof meta.stage_id !== "string")
         continue;
       out.push({ stageId: meta.stage_id, agent: meta.agent, yamlPath, metaPath, meta });
@@ -80349,7 +80580,7 @@ function denyPendingScheduleEntry(opts) {
 
 // src/cli/agent-config-write.ts
 init_protocol3();
-import { existsSync as existsSync77, readFileSync as readFileSync62 } from "node:fs";
+import { existsSync as existsSync77, readFileSync as readFileSync63 } from "node:fs";
 var MAX_ENTRIES_PER_AGENT = 20;
 var MIN_CRON_INTERVAL_MIN = 5;
 function extractCronSmallestGapMin(expr) {
@@ -80457,7 +80688,7 @@ function scheduleAdd(opts) {
     ]
   };
   const yamlText = (() => {
-    const body = import_yaml16.stringify(doc);
+    const body = import_yaml17.stringify(doc);
     const header = opts.name ? `# name: ${opts.name}
 ` : "";
     return header + body;
@@ -80567,7 +80798,7 @@ function scheduleAddOrStage(opts) {
     ]
   };
   const yamlText = (opts.name ? `# name: ${opts.name}
-` : "") + import_yaml16.stringify(doc);
+` : "") + import_yaml17.stringify(doc);
   const summary = (() => {
     const parts = [`cron=${opts.cronExpr}`];
     if (opts.secrets?.length)
@@ -80617,7 +80848,7 @@ function scheduleRemove(opts) {
         break;
       }
       try {
-        const parsed = import_yaml16.parse(e.raw);
+        const parsed = import_yaml17.parse(e.raw);
         if (parsed && parsed.name === opts.name) {
           match = e;
           break;
@@ -80636,7 +80867,7 @@ function scheduleRemove(opts) {
   let priorContent = null;
   try {
     if (existsSync77(match.path))
-      priorContent = readFileSync62(match.path, "utf-8");
+      priorContent = readFileSync63(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
   const reconcileFn = opts.reconcile === undefined ? opts.root ? null : reconcileAgentCronOnly : opts.reconcile;
@@ -80827,10 +81058,10 @@ function registerAgentConfigWriteCommands(program3) {
 }
 
 // src/cli/agent-config-skill-write.ts
-var import_yaml17 = __toESM(require_dist(), 1);
+var import_yaml18 = __toESM(require_dist(), 1);
 import { existsSync as existsSync78 } from "node:fs";
 init_reconcile_default_skills();
-var import_yaml18 = __toESM(require_dist(), 1);
+var import_yaml19 = __toESM(require_dist(), 1);
 import { join as join75 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
@@ -80880,7 +81111,7 @@ function countCurrentSkills(agent, opts) {
   let total = 0;
   for (const e of entries) {
     try {
-      const doc = import_yaml18.parse(e.raw);
+      const doc = import_yaml19.parse(e.raw);
       total += (doc?.skills ?? []).length;
     } catch {}
   }
@@ -80910,7 +81141,7 @@ function skillInstall(opts) {
   if (!existsSync78(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
-  const yamlText = import_yaml17.stringify({ skills: [skillName] });
+  const yamlText = import_yaml18.stringify({ skills: [skillName] });
   let path8;
   try {
     path8 = writeSkillsOverlayEntry(agent, slug, yamlText, { root: opts.root });
@@ -81076,7 +81307,7 @@ import {
   mkdirSync as mkdirSync44,
   mkdtempSync as mkdtempSync5,
   openSync as openSync15,
-  readFileSync as readFileSync63,
+  readFileSync as readFileSync64,
   readdirSync as readdirSync30,
   realpathSync as realpathSync7,
   renameSync as renameSync17,
@@ -81089,7 +81320,7 @@ import { dirname as dirname22, join as join76, relative as relative2, resolve as
 import { spawnSync as spawnSync10 } from "node:child_process";
 
 // src/cli/skill-common.ts
-var import_yaml19 = __toESM(require_dist(), 1);
+var import_yaml20 = __toESM(require_dist(), 1);
 var MAX_FILE_BYTES = 256 * 1024;
 var MAX_SKILL_BYTES = 2 * 1024 * 1024;
 var MAX_FILES_PER_SKILL = 50;
@@ -81193,7 +81424,7 @@ function validateSkillMd(content, expectedName) {
   }
   let parsed;
   try {
-    parsed = import_yaml19.parse(fmText);
+    parsed = import_yaml20.parse(fmText);
   } catch (e) {
     return authorErr("E_SKILL_INVALID_FRONTMATTER", `frontmatter is not valid YAML: ${e.message}`);
   }
@@ -81328,7 +81559,7 @@ function loadFromDir(dir) {
         continue;
       }
       if (ent.isFile()) {
-        const buf = readFileSync63(full);
+        const buf = readFileSync64(full);
         files[rel.replace(/\\/g, "/")] = buf.toString("utf-8");
       }
     }
@@ -81377,7 +81608,7 @@ function loadFromTarball(tarPath) {
   }
 }
 function loadSingleFile(filePath) {
-  const content = readFileSync63(filePath, "utf-8");
+  const content = readFileSync64(filePath, "utf-8");
   return { "SKILL.md": content };
 }
 function loadFromStdin() {
@@ -81468,7 +81699,7 @@ function diffSummary(currentDir, files) {
         if (ent.isDirectory()) {
           walk2(full);
         } else if (ent.isFile()) {
-          currentFiles[rel.replace(/\\/g, "/")] = readFileSync63(full, "utf-8");
+          currentFiles[rel.replace(/\\/g, "/")] = readFileSync64(full, "utf-8");
         }
       }
     };
@@ -81628,7 +81859,7 @@ import {
   mkdirSync as mkdirSync45,
   mkdtempSync as mkdtempSync6,
   openSync as openSync16,
-  readFileSync as readFileSync64,
+  readFileSync as readFileSync65,
   readdirSync as readdirSync31,
   renameSync as renameSync18,
   rmSync as rmSync17,
@@ -81710,7 +81941,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
         if (ent.isDirectory())
           walk2(s, d);
         else if (ent.isFile()) {
-          writeFileSync38(d, readFileSync64(s));
+          writeFileSync38(d, readFileSync65(s));
         }
       }
     };
@@ -81789,7 +82020,7 @@ function loadFromDir2(dir) {
       }
       if (ent.isFile()) {
         const rel = relative3(abs, full).replace(/\\/g, "/");
-        files[rel] = readFileSync64(full, "utf-8");
+        files[rel] = readFileSync65(full, "utf-8");
       }
     }
   };
@@ -81975,7 +82206,7 @@ function loadFiles(opts) {
     return loadFromDir2(p);
   }
   if (p.endsWith(".md")) {
-    return { "SKILL.md": readFileSync64(p, "utf-8") };
+    return { "SKILL.md": readFileSync65(p, "utf-8") };
   }
   fail3(`--from must be a directory or a .md file. Got: ${opts.from}`);
 }
@@ -82064,7 +82295,7 @@ function readSourceFiles(dir) {
             fail3(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
           }
         } catch {}
-        files[rel] = readFileSync64(full, "utf-8");
+        files[rel] = readFileSync65(full, "utf-8");
       }
     }
   };
@@ -82232,8 +82463,8 @@ function registerSkillPersonalCommands(program3) {
 
 // src/cli/skill-search.ts
 init_helpers();
-var import_yaml20 = __toESM(require_dist(), 1);
-import { existsSync as existsSync81, readdirSync as readdirSync32, readFileSync as readFileSync65, statSync as statSync31 } from "node:fs";
+var import_yaml21 = __toESM(require_dist(), 1);
+import { existsSync as existsSync81, readdirSync as readdirSync32, readFileSync as readFileSync66, statSync as statSync31 } from "node:fs";
 import { homedir as homedir45 } from "node:os";
 import { join as join78, resolve as resolve48 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
@@ -82254,7 +82485,7 @@ function readSkillFrontmatter(skillDir) {
     return null;
   let content;
   try {
-    content = readFileSync65(mdPath, "utf-8");
+    content = readFileSync66(mdPath, "utf-8");
   } catch {
     return null;
   }
@@ -82272,7 +82503,7 @@ function readSkillFrontmatter(skillDir) {
   const fmText = rest.slice(0, endIdx);
   let parsed;
   try {
-    parsed = import_yaml20.parse(fmText);
+    parsed = import_yaml21.parse(fmText);
   } catch (e) {
     return { error: `yaml parse: ${e.message}` };
   }
@@ -82526,7 +82757,7 @@ function registerHostdMcpCommand(program3) {
 // src/cli/hostd.ts
 init_source();
 init_helpers();
-import { existsSync as existsSync83, mkdirSync as mkdirSync46, readdirSync as readdirSync33, readFileSync as readFileSync67, writeFileSync as writeFileSync39, statSync as statSync32, copyFileSync as copyFileSync12 } from "node:fs";
+import { existsSync as existsSync83, mkdirSync as mkdirSync46, readdirSync as readdirSync33, readFileSync as readFileSync68, writeFileSync as writeFileSync39, statSync as statSync32, copyFileSync as copyFileSync12 } from "node:fs";
 import { homedir as homedir46 } from "node:os";
 import { join as join79 } from "node:path";
 import { spawnSync as spawnSync13 } from "node:child_process";
@@ -82781,7 +83012,7 @@ function registerHostdCommand(program3) {
 The log is created when hostd handles its first privileged-verb request.`));
       return;
     }
-    const raw = readFileSync67(logPath, "utf-8");
+    const raw = readFileSync68(logPath, "utf-8");
     const limit = Math.max(1, parseInt(opts.tail ?? "50", 10) || 50);
     const filters = {
       agent: opts.agent,