switchroom 0.14.73 → 0.14.74

package/dist/cli/switchroom.js

@@ -28636,6 +28636,86 @@ function formatForCli(entries, opts = {}) {
 }
 var init_audit_reader = () => {};
 
+// src/host-control/client.ts
+import { connect as connect2 } from "node:net";
+async function hostdRequest(opts, req) {
+  const timeoutMs = opts.timeoutMs ?? 5000;
+  return new Promise((resolve27, reject) => {
+    const socket = connect2(opts.socketPath);
+    let buf = "";
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled)
+        return;
+      settled = true;
+      socket.destroy();
+      reject(new Error(`hostd: request timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    socket.on("connect", () => {
+      try {
+        socket.write(encodeRequest3(req));
+      } catch (err) {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        socket.destroy();
+        reject(err);
+      }
+    });
+    socket.on("data", (chunk) => {
+      buf += chunk.toString("utf8");
+      if (Buffer.byteLength(buf, "utf8") > MAX_FRAME_BYTES3 * 2) {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        socket.destroy();
+        reject(new Error("hostd: response exceeded frame budget"));
+        return;
+      }
+      const nl = buf.indexOf(`
+`);
+      if (nl === -1)
+        return;
+      const line = buf.slice(0, nl);
+      try {
+        const resp = decodeResponse3(line);
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        socket.end();
+        resolve27(resp);
+      } catch (err) {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        socket.destroy();
+        reject(new Error(`hostd: bad response frame: ${err.message}`, { cause: err }));
+      }
+    });
+    socket.on("error", (err) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      reject(err);
+    });
+    socket.on("close", () => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      reject(new Error("hostd: connection closed before response"));
+    });
+  });
+}
+var init_client4 = __esm(() => {
+  init_protocol3();
+});
+
 // src/cli/doctor-status.ts
 function statusGlyph(status) {
   switch (status) {
@@ -28679,17 +28759,17 @@ var init_thinking_effort_risk = __esm(() => {
 
 // src/manifest.ts
 import {
-  existsSync as existsSync49,
-  readFileSync as readFileSync45,
+  existsSync as existsSync50,
+  readFileSync as readFileSync46,
   readdirSync as readdirSync18
 } from "node:fs";
-import { dirname as dirname11, join as join42 } from "node:path";
+import { dirname as dirname11, join as join44 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
 function locateManifestPath() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const candidate = join42(dir, "dependencies.json");
-    if (existsSync49(candidate))
+    const candidate = join44(dir, "dependencies.json");
+    if (existsSync50(candidate))
       return candidate;
     dir = dirname11(dir);
   }
@@ -28702,7 +28782,7 @@ function loadManifest(manifestPath) {
   }
   let raw;
   try {
-    raw = readFileSync45(path4, "utf-8");
+    raw = readFileSync46(path4, "utf-8");
   } catch (err) {
     throw new Error(`Failed to read manifest at ${path4}: ${err.message}`);
   }
@@ -28758,16 +28838,16 @@ function probeClaudeVersion() {
 }
 function probePlaywrightMcpVersion() {
   const home2 = process.env.HOME ?? "";
-  const npxCache = join42(home2, ".npm/_npx");
-  if (!existsSync49(npxCache))
+  const npxCache = join44(home2, ".npm/_npx");
+  if (!existsSync50(npxCache))
     return null;
   try {
     const entries = readdirSync18(npxCache);
     for (const entry of entries) {
-      const pkgPath = join42(npxCache, entry, "node_modules/@playwright/mcp/package.json");
-      if (existsSync49(pkgPath)) {
+      const pkgPath = join44(npxCache, entry, "node_modules/@playwright/mcp/package.json");
+      if (existsSync50(pkgPath)) {
         try {
-          const pkg = JSON.parse(readFileSync45(pkgPath, "utf-8"));
+          const pkg = JSON.parse(readFileSync46(pkgPath, "utf-8"));
           if (pkg.version)
             return pkg.version;
         } catch {}
@@ -28859,7 +28939,7 @@ var init_manifest = __esm(() => {
 });
 
 // src/cli/doctor-docker.ts
-import { readFileSync as readFileSync46 } from "node:fs";
+import { readFileSync as readFileSync47 } from "node:fs";
 function imageTagOf(ref) {
   if (!ref)
     return "<absent>";
@@ -28874,7 +28954,7 @@ function isDockerMode(opts) {
     return true;
   if (opts?.composePath) {
     try {
-      readFileSync46(opts.composePath, "utf8");
+      readFileSync47(opts.composePath, "utf8");
       return true;
     } catch {}
   }
@@ -29063,14 +29143,14 @@ var init_doctor_docker = __esm(() => {
 });
 
 // src/cli/doctor-auth-broker.ts
-import { existsSync as existsSync50, readFileSync as readFileSync47 } from "node:fs";
+import { existsSync as existsSync51, readFileSync as readFileSync48 } from "node:fs";
 import { createHash as createHash10 } from "node:crypto";
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { homedir as homedir23 } from "node:os";
-import { join as join43 } from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { homedir as homedir24 } from "node:os";
+import { join as join45 } from "node:path";
 function defaultDockerInspect(container, format) {
   try {
-    const r = spawnSync5("docker", ["inspect", "-f", format, container], { encoding: "utf-8", timeout: 5000 });
+    const r = spawnSync6("docker", ["inspect", "-f", format, container], { encoding: "utf-8", timeout: 5000 });
     if (r.status !== 0)
       return null;
     return r.stdout.trim();
@@ -29080,7 +29160,7 @@ function defaultDockerInspect(container, format) {
 }
 function defaultDockerExecExists(container, path4) {
   try {
-    const r = spawnSync5("docker", ["exec", container, "test", "-S", path4], { encoding: "utf-8", timeout: 5000 });
+    const r = spawnSync6("docker", ["exec", container, "test", "-S", path4], { encoding: "utf-8", timeout: 5000 });
     return r.status === 0;
   } catch {
     return false;
@@ -29167,8 +29247,8 @@ function checkAuthBrokerPerAgentSockets(config, deps = {}) {
 }
 function checkAuthBrokerDrift(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const indexPath = join43(stateDir, "sha-index.json");
-  if (!existsSync50(indexPath)) {
+  const indexPath = join45(stateDir, "sha-index.json");
+  if (!existsSync51(indexPath)) {
     return {
       name: "auth-broker: drift",
       status: "ok",
@@ -29177,7 +29257,7 @@ function checkAuthBrokerDrift(deps = {}) {
   }
   let index;
   try {
-    index = JSON.parse(readFileSync47(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync48(indexPath, "utf-8"));
   } catch (err) {
     return {
       name: "auth-broker: drift",
@@ -29186,18 +29266,18 @@ function checkAuthBrokerDrift(deps = {}) {
       fix: "Inspect `~/.switchroom/state/auth-broker/sha-index.json` for corruption."
     };
   }
-  const home2 = deps.home ?? homedir23();
+  const home2 = deps.home ?? homedir24();
   const divergent = [];
   const missingOnDisk = [];
   for (const [label, expected] of Object.entries(index)) {
     const credsPath = accountCredentialsPath(label, home2);
-    if (!existsSync50(credsPath)) {
+    if (!existsSync51(credsPath)) {
       missingOnDisk.push(label);
       continue;
     }
     let got;
     try {
-      got = sha256Hex(readFileSync47(credsPath, "utf-8"));
+      got = sha256Hex(readFileSync48(credsPath, "utf-8"));
     } catch (err) {
       divergent.push(`${label} (read failed: ${err.message})`);
       continue;
@@ -29228,8 +29308,8 @@ function checkAuthBrokerDrift(deps = {}) {
 }
 function checkAuthBrokerThresholdViolations(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const path4 = join43(stateDir, "threshold-violations.json");
-  if (!existsSync50(path4)) {
+  const path4 = join45(stateDir, "threshold-violations.json");
+  if (!existsSync51(path4)) {
     return {
       name: "auth-broker: threshold violations",
       status: "ok",
@@ -29238,7 +29318,7 @@ function checkAuthBrokerThresholdViolations(deps = {}) {
   }
   let violations;
   try {
-    violations = JSON.parse(readFileSync47(path4, "utf-8"));
+    violations = JSON.parse(readFileSync48(path4, "utf-8"));
   } catch (err) {
     return {
       name: "auth-broker: threshold violations",
@@ -29272,9 +29352,9 @@ function checkAuthBrokerActiveAccount(config, deps = {}) {
       fix: "Run `switchroom auth use <label>` to pin a fleet-wide account, then `switchroom apply`. Without an active account every agent boot fails."
     };
   }
-  const home2 = deps.home ?? homedir23();
+  const home2 = deps.home ?? homedir24();
   const dir = accountDir(active, home2);
-  if (!existsSync50(dir)) {
+  if (!existsSync51(dir)) {
     return {
       name: "auth-broker: fleet active account",
       status: "fail",
@@ -29283,7 +29363,7 @@ function checkAuthBrokerActiveAccount(config, deps = {}) {
     };
   }
   const creds = accountCredentialsPath(active, home2);
-  if (!existsSync50(creds)) {
+  if (!existsSync51(creds)) {
     return {
       name: "auth-broker: fleet active account",
       status: "fail",
@@ -29315,10 +29395,10 @@ var init_doctor_auth_broker = __esm(() => {
 });
 
 // src/cli/doctor-hostd.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { spawnSync as spawnSync7 } from "node:child_process";
 function realDockerInspect(ref, format) {
   try {
-    const r = spawnSync6("docker", ["inspect", ref, "--format", format], {
+    const r = spawnSync7("docker", ["inspect", ref, "--format", format], {
       encoding: "utf-8",
       timeout: 5000
     });
@@ -29420,17 +29500,17 @@ var init_doctor_hostd = () => {};
 import {
   accessSync,
   constants as fsConstants4,
-  existsSync as existsSync51,
+  existsSync as existsSync52,
   realpathSync as realpathSync4,
   statSync as statSync21
 } from "node:fs";
-import { userInfo, homedir as homedir24 } from "node:os";
-import { join as join44 } from "node:path";
+import { userInfo, homedir as homedir25 } from "node:os";
+import { join as join46 } from "node:path";
 function resolveVaultPath2(config) {
   return config.vault?.path ? config.vault.path.replace(/^~/, process.env.HOME ?? "") : resolveStatePath("vault.enc");
 }
 function defaultStatVault(path4) {
-  if (!existsSync51(path4)) {
+  if (!existsSync52(path4)) {
     return { exists: false, readable: false, uid: -1, mode: 0, realPath: path4 };
   }
   let real = path4;
@@ -29563,7 +29643,7 @@ async function runSecretAccessChecks(config, deps = {}) {
   };
   const passphrase = deps.passphrase ?? process.env.SWITCHROOM_VAULT_PASSPHRASE;
   if (!passphrase) {
-    const sock = deps.brokerOperatorSocket ?? join44(homedir24(), ".switchroom", "broker-operator", "sock");
+    const sock = deps.brokerOperatorSocket ?? join46(homedir25(), ".switchroom", "broker-operator", "sock");
     const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
     for (const name of Object.keys(config.agents ?? {})) {
       const resolved = resolveAgentConfig(config.defaults, config.profiles, config.agents[name]);
@@ -29648,8 +29728,8 @@ import {
   existsSync as realExistsSync,
   readFileSync as realReadFileSync
 } from "node:fs";
-import { join as join45, resolve as resolve30 } from "node:path";
-import { homedir as homedir25 } from "node:os";
+import { join as join47, resolve as resolve30 } from "node:path";
+import { homedir as homedir26 } from "node:os";
 function resolveDeps(config, deps) {
   let agentsDir = deps.agentsDir;
   if (agentsDir === undefined) {
@@ -29772,8 +29852,8 @@ function checkScaffoldWiring(config, driveAgents, d) {
       });
       continue;
     }
-    const mcpPath = join45(agentDir, ".mcp.json");
-    const claudeJsonPath = join45(agentDir, ".claude", ".claude.json");
+    const mcpPath = join47(agentDir, ".mcp.json");
+    const claudeJsonPath = join47(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson(d, mcpPath);
     const trustRead = readJson(d, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -29886,7 +29966,7 @@ async function runDriveBrokerReachabilityChecks(config, deps = {}) {
       }
     ];
   }
-  const sock = deps.brokerOperatorSocket ?? join45(homedir25(), ".switchroom", "broker-operator", "sock");
+  const sock = deps.brokerOperatorSocket ?? join47(homedir26(), ".switchroom", "broker-operator", "sock");
   const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
   const results = [];
   for (const agent of driveAgents) {
@@ -29940,8 +30020,8 @@ import {
   readSync as realReadSync,
   closeSync as realCloseSync
 } from "node:fs";
-import { join as join46 } from "node:path";
-import { homedir as homedir26 } from "node:os";
+import { join as join48 } from "node:path";
+import { homedir as homedir27 } from "node:os";
 function defaultReadHead(p, n) {
   let fd;
   try {
@@ -29969,7 +30049,7 @@ function resolveDeps2(config, deps) {
     }
   }
   return {
-    homeDir: deps.homeDir ?? homedir26(),
+    homeDir: deps.homeDir ?? homedir27(),
     agentsDir,
     existsSync: deps.existsSync ?? ((p) => realExistsSync2(p)),
     readFileSync: deps.readFileSync ?? ((p) => realReadFileSync2(p, "utf-8")),
@@ -29998,7 +30078,7 @@ function runWebkiteChecks(config, deps = {}) {
     return [];
   const d = resolveDeps2(config, deps);
   const results = [];
-  const binPath = join46(d.homeDir, ".switchroom", "bin", "webkite");
+  const binPath = join48(d.homeDir, ".switchroom", "bin", "webkite");
   if (!d.existsSync(binPath)) {
     results.push({
       name: "webkite: binary",
@@ -30028,12 +30108,12 @@ function runWebkiteChecks(config, deps = {}) {
       });
     }
   }
-  const cloakDir = join46(d.homeDir, ".cloakbrowser");
+  const cloakDir = join48(d.homeDir, ".cloakbrowser");
   let chromeFound = false;
   if (d.existsSync(cloakDir)) {
     try {
       for (const entry of d.readdirSync(cloakDir)) {
-        if (entry.startsWith("chromium-") && d.existsSync(join46(cloakDir, entry, "chrome"))) {
+        if (entry.startsWith("chromium-") && d.existsSync(join48(cloakDir, entry, "chrome"))) {
           chromeFound = true;
           break;
         }
@@ -30059,9 +30139,9 @@ function runWebkiteChecks(config, deps = {}) {
     return results;
   }
   for (const agent of enabledAgents) {
-    const agentDir = join46(d.agentsDir, agent);
-    const settingsPath = join46(agentDir, ".claude", "settings.json");
-    const mcpPath = join46(agentDir, ".mcp.json");
+    const agentDir = join48(d.agentsDir, agent);
+    const settingsPath = join48(agentDir, ".claude", "settings.json");
+    const mcpPath = join48(agentDir, ".mcp.json");
     if (!d.existsSync(settingsPath) && !d.existsSync(mcpPath)) {
       continue;
     }
@@ -30125,7 +30205,7 @@ var init_doctor_webkite = __esm(() => {
 });
 
 // src/cli/doctor-scaffold-wiring.ts
-import { join as join47, resolve as resolve31 } from "node:path";
+import { join as join49, resolve as resolve31 } from "node:path";
 function readJson2(d, path4) {
   if (!d.existsSync(path4))
     return { kind: "absent" };
@@ -30168,8 +30248,8 @@ function checkIntegrationScaffoldWiring(args) {
       });
       continue;
     }
-    const mcpPath = join47(agentDir, ".mcp.json");
-    const claudeJsonPath = join47(agentDir, ".claude", ".claude.json");
+    const mcpPath = join49(agentDir, ".mcp.json");
+    const claudeJsonPath = join49(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson2(deps, mcpPath);
     const trustRead = readJson2(deps, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -30233,14 +30313,14 @@ import {
   existsSync as realExistsSync3,
   readFileSync as realReadFileSync3
 } from "node:fs";
-import { join as join48 } from "node:path";
-import { homedir as homedir27 } from "node:os";
+import { join as join50 } from "node:path";
+import { homedir as homedir28 } from "node:os";
 function resolveDeps3(deps) {
-  const home2 = deps.homeDir?.() ?? homedir27();
+  const home2 = deps.homeDir?.() ?? homedir28();
   return {
     existsSync: deps.existsSync ?? realExistsSync3,
     readFileSync: deps.readFileSync ?? realReadFileSync3,
-    agentsDir: join48(home2, ".switchroom", "agents"),
+    agentsDir: join50(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now
   };
 }
@@ -30323,7 +30403,7 @@ function checkOAuthClient2(config, anyAgentEnabled) {
   ];
 }
 function readHeartbeat(d, agentName) {
-  const path4 = join48(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
+  const path4 = join50(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
   if (!d.existsSync(path4)) {
     return { error: "heartbeat file missing \u2014 launcher has not yet started" };
   }
@@ -30420,15 +30500,15 @@ import {
   readFileSync as realReadFileSync4,
   statSync as realStatSync
 } from "node:fs";
-import { join as join49 } from "node:path";
-import { homedir as homedir28 } from "node:os";
+import { join as join51 } from "node:path";
+import { homedir as homedir29 } from "node:os";
 function resolveDeps4(deps) {
-  const home2 = deps.homeDir?.() ?? homedir28();
+  const home2 = deps.homeDir?.() ?? homedir29();
   return {
     existsSync: deps.existsSync ?? realExistsSync4,
     readFileSync: deps.readFileSync ?? realReadFileSync4,
     statSync: deps.statSync ?? realStatSync,
-    agentsDir: join49(home2, ".switchroom", "agents"),
+    agentsDir: join51(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now,
     vaultAclReader: deps.vaultAclReader ?? (async () => ({ kind: "unreachable", msg: "no default reader wired" }))
   };
@@ -30553,7 +30633,7 @@ function checkLauncherHeartbeat2(notionAgents, d) {
     return [];
   const results = [];
   for (const name of notionAgents) {
-    const heartbeatPath = join49(d.agentsDir, name, "notion-launcher.heartbeat.json");
+    const heartbeatPath = join51(d.agentsDir, name, "notion-launcher.heartbeat.json");
     if (!d.existsSync(heartbeatPath)) {
       results.push({
         name: `notion:launcher-heartbeat:${name}`,
@@ -30628,11 +30708,11 @@ import {
   readdirSync as realReaddirSync2,
   statSync as realStatSync2
 } from "node:fs";
-import { homedir as homedir29 } from "node:os";
-import { join as join50 } from "node:path";
+import { homedir as homedir30 } from "node:os";
+import { join as join52 } from "node:path";
 function runCredentialsMigrationChecks(config, deps = {}) {
-  const credDir = deps.credentialsDir ?? join50(homedir29(), ".switchroom", "credentials");
-  const existsSync52 = deps.existsSync ?? ((p) => realExistsSync5(p));
+  const credDir = deps.credentialsDir ?? join52(homedir30(), ".switchroom", "credentials");
+  const existsSync53 = deps.existsSync ?? ((p) => realExistsSync5(p));
   const readdirSync20 = deps.readdirSync ?? ((p) => realReaddirSync2(p));
   const isDirectory = deps.isDirectory ?? ((p) => {
     try {
@@ -30641,7 +30721,7 @@ function runCredentialsMigrationChecks(config, deps = {}) {
       return false;
     }
   });
-  if (!existsSync52(credDir))
+  if (!existsSync53(credDir))
     return [];
   const agentNames = new Set(Object.keys(config.agents ?? {}));
   let entries;
@@ -30659,7 +30739,7 @@ function runCredentialsMigrationChecks(config, deps = {}) {
   const flat = [];
   const perAgentDirs = [];
   for (const e of entries) {
-    const full = join50(credDir, e);
+    const full = join52(credDir, e);
     if (isDirectory(full) && agentNames.has(e)) {
       perAgentDirs.push(e);
     } else {
@@ -30735,7 +30815,7 @@ function runInlinedSecretChecks(_config, deps = {}) {
   }
   let parsed;
   try {
-    parsed = import_yaml15.parse(raw);
+    parsed = import_yaml17.parse(raw);
   } catch {
     return [
       {
@@ -30763,9 +30843,9 @@ function runInlinedSecretChecks(_config, deps = {}) {
     fix: `Move it to the per-agent-ACL'd vault: \`switchroom vault set <name>\` ` + `then replace the literal with \`vault:<name>\`. Rotate the exposed ` + `value if any agent may already have read it.`
   }));
 }
-var import_yaml15, SECRET_KEY_EXACT;
+var import_yaml17, SECRET_KEY_EXACT;
 var init_doctor_inlined_secrets = __esm(() => {
-  import_yaml15 = __toESM(require_dist(), 1);
+  import_yaml17 = __toESM(require_dist(), 1);
   SECRET_KEY_EXACT = new Set([
     "bot_token",
     "client_secret",
@@ -30782,19 +30862,19 @@ var init_doctor_inlined_secrets = __esm(() => {
 
 // src/cli/doctor-audit-integrity.ts
 import { readFileSync as fsReadFileSync2 } from "node:fs";
-import { homedir as homedir30 } from "node:os";
-import { join as join51 } from "node:path";
+import { homedir as homedir31 } from "node:os";
+import { join as join53 } from "node:path";
 function rootWrittenLogs(home2) {
   return [
-    { label: "vault-broker", path: join51(home2, ".switchroom", "vault-audit.log") },
+    { label: "vault-broker", path: join53(home2, ".switchroom", "vault-audit.log") },
     {
       label: "hostd",
-      path: join51(home2, ".switchroom", "host-control-audit.log")
+      path: join53(home2, ".switchroom", "host-control-audit.log")
     }
   ];
 }
 function runAuditIntegrityChecks(deps = {}) {
-  const home2 = deps.homeDir ?? homedir30();
+  const home2 = deps.homeDir ?? homedir31();
   const read = deps.readFileSync ?? ((p) => fsReadFileSync2(p, "utf8"));
   const results = [];
   for (const { label, path: path4 } of rootWrittenLogs(home2)) {
@@ -30850,97 +30930,17 @@ var init_doctor_audit_integrity = __esm(() => {
   init_audit_hashchain();
 });
 
-// src/host-control/client.ts
-import { connect as connect2 } from "node:net";
-async function hostdRequest(opts, req) {
-  const timeoutMs = opts.timeoutMs ?? 5000;
-  return new Promise((resolve32, reject) => {
-    const socket = connect2(opts.socketPath);
-    let buf = "";
-    let settled = false;
-    const timer = setTimeout(() => {
-      if (settled)
-        return;
-      settled = true;
-      socket.destroy();
-      reject(new Error(`hostd: request timed out after ${timeoutMs}ms`));
-    }, timeoutMs);
-    socket.on("connect", () => {
-      try {
-        socket.write(encodeRequest3(req));
-      } catch (err) {
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timer);
-        socket.destroy();
-        reject(err);
-      }
-    });
-    socket.on("data", (chunk) => {
-      buf += chunk.toString("utf8");
-      if (Buffer.byteLength(buf, "utf8") > MAX_FRAME_BYTES3 * 2) {
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timer);
-        socket.destroy();
-        reject(new Error("hostd: response exceeded frame budget"));
-        return;
-      }
-      const nl = buf.indexOf(`
-`);
-      if (nl === -1)
-        return;
-      const line = buf.slice(0, nl);
-      try {
-        const resp = decodeResponse3(line);
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timer);
-        socket.end();
-        resolve32(resp);
-      } catch (err) {
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timer);
-        socket.destroy();
-        reject(new Error(`hostd: bad response frame: ${err.message}`, { cause: err }));
-      }
-    });
-    socket.on("error", (err) => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timer);
-      reject(err);
-    });
-    socket.on("close", () => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timer);
-      reject(new Error("hostd: connection closed before response"));
-    });
-  });
-}
-var init_client4 = __esm(() => {
-  init_protocol3();
-});
-
 // src/cli/doctor-agent-smoke.ts
-import { existsSync as existsSync52 } from "node:fs";
-import { homedir as homedir31 } from "node:os";
-import { join as join52 } from "node:path";
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { existsSync as existsSync53 } from "node:fs";
+import { homedir as homedir32 } from "node:os";
+import { join as join54 } from "node:path";
+import { randomUUID as randomUUID5 } from "node:crypto";
 async function runAgentSmokeChecks(config, deps = {}) {
   if (deps.fast)
     return [];
-  const home2 = deps.homeDir ?? homedir31();
-  const sock = deps.operatorSockPath ?? join52(home2, ".switchroom", "hostd", "operator", "sock");
-  if (!deps.hostdRequestImpl && !existsSync52(sock)) {
+  const home2 = deps.homeDir ?? homedir32();
+  const sock = deps.operatorSockPath ?? join54(home2, ".switchroom", "hostd", "operator", "sock");
+  if (!deps.hostdRequestImpl && !existsSync53(sock)) {
     return [
       {
         name: "agent liveness",
@@ -30952,7 +30952,7 @@ async function runAgentSmokeChecks(config, deps = {}) {
   }
   const call = deps.hostdRequestImpl ?? ((s, name) => hostdRequest({ socketPath: s, timeoutMs: 8000 }, {
     v: 1,
-    request_id: `doctor-smoke-${randomUUID4()}`,
+    request_id: `doctor-smoke-${randomUUID5()}`,
     op: "agent_smoke",
     args: { name }
   }));
@@ -31018,9 +31018,9 @@ var init_doctor_agent_smoke = __esm(() => {
 
 // src/cli/doctor-vault-broker-durability.ts
 import { execFileSync as execFileSync17 } from "node:child_process";
-import { existsSync as existsSync53, statSync as statSync22 } from "node:fs";
-import { homedir as homedir32 } from "node:os";
-import { join as join53 } from "node:path";
+import { existsSync as existsSync54, statSync as statSync22 } from "node:fs";
+import { homedir as homedir33 } from "node:os";
+import { join as join55 } from "node:path";
 function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   const statHost = opts?.statHost ?? defaultStatHost;
   const statBroker = opts?.statBroker ?? defaultStatBroker;
@@ -31042,7 +31042,7 @@ function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   };
 }
 function defaultStatHost(p) {
-  if (!existsSync53(p))
+  if (!existsSync54(p))
     return null;
   try {
     const s = statSync22(p, { bigint: true });
@@ -31163,22 +31163,22 @@ function defaultBrokerStatusProbe() {
   }
 }
 function runVaultBrokerDurabilityChecks(_config, opts) {
-  const home2 = homedir32();
+  const home2 = homedir33();
   const probe2 = opts?.inodeProbe ?? probeBindMountInode;
   return [
     probeBrokerUnlocked(opts?.statusProbe),
     probeAutoUnlockBlob(home2),
     probeMachineIdMount(),
-    formatBindMountResult("vault-broker: vault.enc bind mount", join53(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join53(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
-    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join53(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join53(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
-    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join53(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join53(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
+    formatBindMountResult("vault-broker: vault.enc bind mount", join55(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join55(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
+    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join55(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join55(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
+    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join55(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join55(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
     probeKernelDbDurability(home2, {
       statBroker: opts?.kernelStatBroker
     })
   ];
 }
 function probeKernelDbDurability(home2, opts) {
-  const hostDir = join53(home2, ".switchroom", "approvals");
+  const hostDir = join55(home2, ".switchroom", "approvals");
   const containerDir = "/state/approvals";
   const name = "approval-kernel: approvals bind mount (allow_always durability)";
   const kernelStat = opts?.statBroker ?? defaultKernelStatBroker;
@@ -31246,8 +31246,8 @@ function defaultKernelStatBroker(p) {
   return { kind: "ok-with-stat", ino: inoStr, size };
 }
 function probeAutoUnlockBlob(home2) {
-  const blobPath = join53(home2, ".switchroom", "vault-auto-unlock");
-  if (!existsSync53(blobPath)) {
+  const blobPath = join55(home2, ".switchroom", "vault-auto-unlock");
+  if (!existsSync54(blobPath)) {
     return {
       name: "vault-broker: auto-unlock blob",
       status: "warn",
@@ -31271,7 +31271,7 @@ function probeAutoUnlockBlob(home2) {
   };
 }
 function probeMachineIdMount() {
-  const hostExists = existsSync53("/etc/machine-id");
+  const hostExists = existsSync54("/etc/machine-id");
   if (!hostExists) {
     return {
       name: "vault-broker: machine-id passthrough",
@@ -31346,27 +31346,27 @@ __export(exports_doctor, {
   checkAgents: () => checkAgents,
   MFF_VAULT_KEY: () => MFF_VAULT_KEY
 });
-import { execSync as execSync3, spawnSync as spawnSync7 } from "node:child_process";
+import { execSync as execSync3, spawnSync as spawnSync8 } from "node:child_process";
 import {
   accessSync as accessSync2,
   constants as fsConstants5,
-  existsSync as existsSync54,
+  existsSync as existsSync55,
   lstatSync as lstatSync5,
-  mkdirSync as mkdirSync29,
-  readFileSync as readFileSync48,
+  mkdirSync as mkdirSync30,
+  readFileSync as readFileSync49,
   readdirSync as readdirSync20,
   statSync as statSync23
 } from "node:fs";
-import { dirname as dirname12, join as join54, resolve as resolve32 } from "node:path";
+import { dirname as dirname12, join as join56, resolve as resolve32 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
-  const nvmRoot = join54(process.env.HOME ?? "", ".nvm", "versions", "node");
-  if (!existsSync54(nvmRoot))
+  const nvmRoot = join56(process.env.HOME ?? "", ".nvm", "versions", "node");
+  if (!existsSync55(nvmRoot))
     return null;
   try {
     const versions = readdirSync20(nvmRoot).sort().reverse();
     for (const v of versions) {
-      const candidate = join54(nvmRoot, v, "bin", bin);
+      const candidate = join56(nvmRoot, v, "bin", bin);
       try {
         const s = statSync23(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
@@ -31531,21 +31531,21 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
   if (envBrowsersPath && envBrowsersPath.length > 0) {
     cacheLocations.push(envBrowsersPath);
   }
-  cacheLocations.push(join54(homeDir, ".cache", "ms-playwright"));
+  cacheLocations.push(join56(homeDir, ".cache", "ms-playwright"));
   for (const cacheDir of cacheLocations) {
-    if (!existsSync54(cacheDir))
+    if (!existsSync55(cacheDir))
       continue;
     try {
       const entries = readdirSync20(cacheDir).filter((e) => e.startsWith("chromium"));
       for (const entry of entries) {
         const candidates2 = [
-          join54(cacheDir, entry, "chrome-linux64", "chrome"),
-          join54(cacheDir, entry, "chrome-linux", "chrome"),
-          join54(cacheDir, entry, "chrome-linux64", "headless_shell"),
-          join54(cacheDir, entry, "chrome-linux", "headless_shell")
+          join56(cacheDir, entry, "chrome-linux64", "chrome"),
+          join56(cacheDir, entry, "chrome-linux", "chrome"),
+          join56(cacheDir, entry, "chrome-linux64", "headless_shell"),
+          join56(cacheDir, entry, "chrome-linux", "headless_shell")
         ];
         for (const path4 of candidates2) {
-          if (existsSync54(path4))
+          if (existsSync55(path4))
             return path4;
         }
       }
@@ -31567,7 +31567,7 @@ function checkChromium() {
 }
 function checkDepsCacheWritable(depsRoot = resolvePath("~/.switchroom/deps")) {
   try {
-    mkdirSync29(depsRoot, { recursive: true });
+    mkdirSync30(depsRoot, { recursive: true });
     accessSync2(depsRoot, fsConstants5.W_OK);
     return {
       name: "~/.switchroom/deps writable",
@@ -31665,8 +31665,8 @@ function checkUserDeclaredMcps(name, agentConfig, config, renderedMcpServers) {
 function checkLegacyState() {
   const results = [];
   const h = process.env.HOME ?? "/root";
-  const clerkDir = join54(h, LEGACY_STATE_DIR);
-  const clerkPresent = existsSync54(clerkDir);
+  const clerkDir = join56(h, LEGACY_STATE_DIR);
+  const clerkPresent = existsSync55(clerkDir);
   results.push({
     name: "legacy ~/.clerk state",
     status: clerkPresent ? "warn" : "ok",
@@ -31675,7 +31675,7 @@ function checkLegacyState() {
       fix: "Legacy state detected. Run `mv ~/.clerk ~/.switchroom` and rename " + "any top-level `clerk:` key in switchroom.yaml to `switchroom:`. " + "This back-compat shim is REMOVED in v0.13.0 \u2014 no automatic " + "migration exists."
     } : {}
   });
-  const legacySock = join54(h, ".switchroom", "vault-broker.sock");
+  const legacySock = join56(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
     sockStat = lstatSync5(legacySock);
@@ -31694,7 +31694,7 @@ function probeVaultBrokerSocketPair(agentName) {
   const dataPath = `/run/switchroom/broker/${agentName}/sock`;
   const unlockPath = `/run/switchroom/broker/${agentName}/unlock`;
   const script = `D=0; U=0; ` + `test -S '${dataPath}' && D=1; ` + `test -S '${unlockPath}' && U=1; ` + `echo "D=$D U=$U"`;
-  const r = spawnSync7("docker", ["exec", "switchroom-vault-broker", "sh", "-c", script], { stdio: "pipe", timeout: 3000 });
+  const r = spawnSync8("docker", ["exec", "switchroom-vault-broker", "sh", "-c", script], { stdio: "pipe", timeout: 3000 });
   if (r.error || r.status === null)
     return "unreachable";
   if (r.status !== 0) {
@@ -31796,7 +31796,7 @@ function checkVault(config) {
     detail: "Approval auth: passphrase (two-factor)"
   };
   const pairsResult = checkVaultBrokerSocketPairs(config);
-  if (!existsSync54(vaultPath)) {
+  if (!existsSync55(vaultPath)) {
     return [
       postureResult,
       {
@@ -31893,7 +31893,7 @@ function checkHindsightConsumer(config, opts) {
 }
 function probeAuthBrokerSocket(consumerName) {
   const containerPath = `/run/switchroom/auth-broker/${consumerName}/sock`;
-  const r = spawnSync7("docker", ["exec", "switchroom-auth-broker", "test", "-S", containerPath], { stdio: "pipe", timeout: 3000 });
+  const r = spawnSync8("docker", ["exec", "switchroom-auth-broker", "test", "-S", containerPath], { stdio: "pipe", timeout: 3000 });
   if (r.error || r.status === null)
     return "unreachable";
   if (r.status === 0)
@@ -31971,8 +31971,8 @@ async function checkHindsight(config) {
 }
 function checkPendingRetainsQueue(dir) {
   const home2 = process.env.HOME ?? "";
-  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join54(home2, ".hindsight", "pending-retains");
-  if (!existsSync54(pendingDir)) {
+  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join56(home2, ".hindsight", "pending-retains");
+  if (!existsSync55(pendingDir)) {
     return {
       name: "pending-retains queue",
       status: "ok",
@@ -32031,7 +32031,7 @@ function classifyReadError(err) {
 }
 function tryReadHostFile(path4) {
   try {
-    return { kind: "ok", content: readFileSync48(path4, "utf-8") };
+    return { kind: "ok", content: readFileSync49(path4, "utf-8") };
   } catch (err) {
     const kind = classifyReadError(err);
     const error = err?.message ?? String(err);
@@ -32043,11 +32043,11 @@ function tryReadHostFile(path4) {
   }
 }
 function parseEnvFile(path4) {
-  if (!existsSync54(path4))
+  if (!existsSync55(path4))
     return {};
   let content;
   try {
-    content = readFileSync48(path4, "utf-8");
+    content = readFileSync49(path4, "utf-8");
   } catch {
     return {};
   }
@@ -32102,7 +32102,7 @@ async function checkTelegram(config) {
     const plugin = agentConfig.channels?.telegram?.plugin ?? "switchroom";
     if (plugin !== "switchroom")
       continue;
-    const envPath = join54(agentsDir, name, "telegram", ".env");
+    const envPath = join56(agentsDir, name, "telegram", ".env");
     const read = tryReadHostFile(envPath);
     if (read.kind === "eacces") {
       results.push({
@@ -32154,7 +32154,7 @@ async function checkTelegram(config) {
 }
 function checkStartShStale(agentName, startShPath) {
   const label = `${agentName}: start.sh scheduler block`;
-  if (!existsSync54(startShPath)) {
+  if (!existsSync55(startShPath)) {
     return {
       name: label,
       status: "warn",
@@ -32164,7 +32164,7 @@ function checkStartShStale(agentName, startShPath) {
   }
   let content;
   try {
-    content = readFileSync48(startShPath, "utf-8");
+    content = readFileSync49(startShPath, "utf-8");
   } catch (err) {
     return {
       name: label,
@@ -32185,7 +32185,7 @@ function checkStartShStale(agentName, startShPath) {
 }
 function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const label = `${agentName}: $HOME/.switchroom symlink (#910)`;
-  const path4 = join54(agentDir, "home", ".switchroom");
+  const path4 = join56(agentDir, "home", ".switchroom");
   let stats;
   try {
     stats = lstatSync5(path4);
@@ -32222,8 +32222,8 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
 }
 function checkRepoHygiene(repoRoot) {
   const results = [];
-  const exportDir = join54(repoRoot, "clerk-export");
-  if (existsSync54(exportDir)) {
+  const exportDir = join56(repoRoot, "clerk-export");
+  if (existsSync55(exportDir)) {
     results.push({
       name: "repo hygiene: clerk-export/ on disk (#1072)",
       status: "warn",
@@ -32231,8 +32231,8 @@ function checkRepoHygiene(repoRoot) {
       fix: `Run scripts/migrate-clerk-export-to-vault.sh to move the bundle ` + `into the vault, then delete the on-disk copy.`
     });
   }
-  const knownTarball = join54(repoRoot, "clerk-export-with-secrets.tar.gz");
-  if (existsSync54(knownTarball)) {
+  const knownTarball = join56(repoRoot, "clerk-export-with-secrets.tar.gz");
+  if (existsSync55(knownTarball)) {
     results.push({
       name: "repo hygiene: clerk-export-with-secrets.tar.gz on disk (#1072)",
       status: "warn",
@@ -32249,7 +32249,7 @@ function checkRepoHygiene(repoRoot) {
         results.push({
           name: `repo hygiene: ${name} on disk (#1072)`,
           status: "warn",
-          detail: `${join54(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
+          detail: `${join56(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
           fix: `Inspect, migrate any secrets into the vault, then delete the ` + `archive.`
         });
       }
@@ -32272,12 +32272,12 @@ function checkRepoHygiene(repoRoot) {
 }
 function isSwitchroomCheckout(dir) {
   try {
-    if (!existsSync54(join54(dir, ".git")))
+    if (!existsSync55(join56(dir, ".git")))
       return false;
-    const pkgPath = join54(dir, "package.json");
-    if (!existsSync54(pkgPath))
+    const pkgPath = join56(dir, "package.json");
+    if (!existsSync55(pkgPath))
       return false;
-    const pkg = JSON.parse(readFileSync48(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync49(pkgPath, "utf-8"));
     return pkg.name === "switchroom";
   } catch {
     return false;
@@ -32290,7 +32290,7 @@ function checkAgents(config, configPath) {
   const authStatuses = getAllAuthStatuses(config);
   for (const [name, agentConfig] of Object.entries(config.agents)) {
     const agentDir = resolve32(agentsDir, name);
-    if (!existsSync54(agentDir)) {
+    if (!existsSync55(agentDir)) {
       results.push({
         name: `${name}: scaffold`,
         status: "fail",
@@ -32311,7 +32311,7 @@ function checkAgents(config, configPath) {
         fix: `Rotate the bot token (e.g. via \`switchroom vault\`), then run ` + `\`switchroom agent unquarantine ${name}\` and \`switchroom agent restart ${name}\``
       });
     }
-    results.push(checkStartShStale(name, join54(agentDir, "start.sh")));
+    results.push(checkStartShStale(name, join56(agentDir, "start.sh")));
     results.push(checkLeakedHomeSwitchroom(name, agentDir));
     const status = statuses[name];
     const active = status?.active ?? "unknown";
@@ -32388,8 +32388,8 @@ function checkAgents(config, configPath) {
       }
     }
     if (agentConfig.channels?.telegram?.plugin === "switchroom") {
-      const mcpJsonPath = join54(agentDir, ".mcp.json");
-      if (!existsSync54(mcpJsonPath)) {
+      const mcpJsonPath = join56(agentDir, ".mcp.json");
+      if (!existsSync55(mcpJsonPath)) {
         results.push({
           name: `${name}: .mcp.json`,
           status: "fail",
@@ -32398,7 +32398,7 @@ function checkAgents(config, configPath) {
         });
       } else {
         try {
-          const mcp = JSON.parse(readFileSync48(mcpJsonPath, "utf-8"));
+          const mcp = JSON.parse(readFileSync49(mcpJsonPath, "utf-8"));
           const hasSwitchroomTelegram = !!mcp.mcpServers?.["switchroom-telegram"];
           const memoryEnabled = isHindsightEnabled(config);
           const hasHindsight = !!mcp.mcpServers?.hindsight;
@@ -32475,7 +32475,7 @@ function mffEnvPath(config) {
   return agent ? resolve32(home2, ".switchroom/credentials", agent, "my-family-finance/.env") : resolve32(home2, ".switchroom/credentials/my-family-finance/.env");
 }
 function mffEnvState(envPath) {
-  if (!existsSync54(envPath))
+  if (!existsSync55(envPath))
     return "absent";
   try {
     accessSync2(envPath, fsConstants5.R_OK);
@@ -32493,7 +32493,7 @@ function checkMffVaultKeyPresent(passphrase, vaultPath) {
       fix: "Export SWITCHROOM_VAULT_PASSPHRASE to enable MFF vault probes"
     };
   }
-  if (!existsSync54(vaultPath)) {
+  if (!existsSync55(vaultPath)) {
     return {
       name: "mff: vault key present",
       status: "fail",
@@ -32546,7 +32546,7 @@ function deriveEd25519PublicKeyBytes(keyMaterial) {
   }
 }
 function checkMffVaultKeyFormat(passphrase, vaultPath) {
-  if (!passphrase || !existsSync54(vaultPath)) {
+  if (!passphrase || !existsSync55(vaultPath)) {
     return {
       name: "mff: vault key format",
       status: "warn",
@@ -32690,8 +32690,8 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
     };
   }
   const credDir = dirname12(envPath);
-  const authScript = join54(credDir, "claude-auth.py");
-  if (!existsSync54(authScript)) {
+  const authScript = join56(credDir, "claude-auth.py");
+  if (!existsSync55(authScript)) {
     return {
       name: "mff: auth flow",
       status: "warn",
@@ -32702,7 +32702,7 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
   const python3 = which("python3") ?? "python3";
   let token;
   try {
-    const result = spawnSync7(python3, [authScript, "--quiet"], {
+    const result = spawnSync8(python3, [authScript, "--quiet"], {
       timeout: timeoutMs,
       encoding: "utf-8",
       env: { ...process.env, ...env2 }
@@ -32893,11 +32893,11 @@ function runDockerSection(config) {
   let composeYaml;
   let dockerfileAgent;
   try {
-    composeYaml = readFileSync48(composePath, "utf8");
+    composeYaml = readFileSync49(composePath, "utf8");
   } catch {}
   const dockerfilePath = resolve32(process.env.HOME ?? "", ".switchroom", "docker", "Dockerfile.agent");
   try {
-    dockerfileAgent = readFileSync48(dockerfilePath, "utf8");
+    dockerfileAgent = readFileSync49(dockerfilePath, "utf8");
   } catch {}
   return runDockerChecks({
     config,
@@ -48726,9 +48726,9 @@ __export(exports_server, {
   dispatchTool: () => dispatchTool,
   TOOLS: () => TOOLS
 });
-import { spawnSync as spawnSync12 } from "node:child_process";
+import { spawnSync as spawnSync13 } from "node:child_process";
 function execCli(args, stdin) {
-  const r = spawnSync12(CLI_BIN, args, {
+  const r = spawnSync13(CLI_BIN, args, {
     encoding: "utf-8",
     env: process.env,
     timeout: 15000,
@@ -49190,7 +49190,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes15 } from "node:crypto";
-import { existsSync as existsSync82, readFileSync as readFileSync67 } from "node:fs";
+import { existsSync as existsSync83, readFileSync as readFileSync68 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -49205,7 +49205,7 @@ async function dispatchTool2(name, args) {
     return errorText2("hostd MCP: SWITCHROOM_AGENT_NAME env var is not set \u2014 cannot " + "determine which per-agent socket to talk to.");
   }
   const sockPath = selfSocketPath();
-  if (!existsSync82(sockPath)) {
+  if (!existsSync83(sockPath)) {
     return errorText2(`hostd MCP: socket not bound at ${sockPath}. The host-control ` + `daemon is either not installed (run \`switchroom hostd install\`) ` + `or this agent isn't admin-flagged in switchroom.yaml. RFC C ` + `bind-mounts the per-agent socket only when host_control.enabled ` + `is true AND the agent has admin: true.`);
   }
   let req;
@@ -49357,18 +49357,18 @@ function resolveAuditLogPath() {
   if (process.env.HOSTD_AUDIT_LOG_PATH)
     return process.env.HOSTD_AUDIT_LOG_PATH;
   const bindMounted = "/host-home/.switchroom/host-control-audit.log";
-  if (existsSync82(bindMounted))
+  if (existsSync83(bindMounted))
     return bindMounted;
   return defaultAuditLogPath2();
 }
 function getLastUpdateApplyStatus() {
   const path8 = resolveAuditLogPath();
-  if (!existsSync82(path8)) {
+  if (!existsSync83(path8)) {
     return errorText2(`get_status: audit log not found at ${path8}. No update_apply has run yet?`);
   }
   let raw;
   try {
-    raw = readFileSync67(path8, "utf-8");
+    raw = readFileSync68(path8, "utf-8");
   } catch (err2) {
     return errorText2(`get_status: failed to read audit log at ${path8}: ${err2.message}`);
   }
@@ -49601,8 +49601,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.73";
-var COMMIT_SHA = "bf5d1f94";
+var VERSION = "0.14.74";
+var COMMIT_SHA = "7e9ebb67";
 
 // src/cli/agent.ts
 init_source();
@@ -49802,7 +49802,7 @@ import_handlebars.default.registerHelper("isNumber", (value) => {
   return typeof value === "number" && Number.isFinite(value);
 });
 var SHARED_FRAGMENTS_DIR = resolve4(PROFILES_ROOT, "_shared");
-var SHARED_FRAGMENTS = ["telegram-style", "vault-protocol", "agent-self-service"];
+var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service"];
 for (const name of SHARED_FRAGMENTS) {
   const fragPath = join2(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
   if (existsSync4(fragPath)) {
@@ -51115,6 +51115,18 @@ function seedWorkspaceBootstrapFiles(params) {
       if (entry.endsWith(".hbs")) {
         const destRel = relPath.replace(/\.hbs$/, "");
         const destPath = join8(agentWorkspaceDir, destRel);
+        if (destRel === "SOUL.default.md") {
+          const rendered = renderTemplate(srcPath, params.context);
+          const existed = existsSync13(destPath);
+          const current = existed ? readFileSync11(destPath, "utf8") : null;
+          if (current !== rendered) {
+            writeFileSync5(destPath, rendered);
+            params.created.push(destPath);
+          } else {
+            params.skipped.push(destPath);
+          }
+          continue;
+        }
         const renderFn = () => {
           if (destRel === "SOUL.md") {
             return renderSoulMd(params.profilePath, agentWorkspaceDir, params.context.soul) ?? renderTemplate(srcPath, params.context);
@@ -66576,19 +66588,20 @@ init_source();
 
 // src/web/server.ts
 init_merge();
+init_loader();
 init_lifecycle();
 import {
-  readFileSync as readFileSync43,
-  existsSync as existsSync47,
+  readFileSync as readFileSync44,
+  existsSync as existsSync48,
   realpathSync as realpathSync3,
-  mkdirSync as mkdirSync27,
+  mkdirSync as mkdirSync28,
   openSync as openSync10,
   closeSync as closeSync10,
   writeSync as writeSync6,
   constants as fsConstants3
 } from "node:fs";
-import { resolve as resolve28, extname, join as join41, relative, dirname as dirname9 } from "node:path";
-import { homedir as homedir22 } from "node:os";
+import { resolve as resolve28, extname, join as join43, relative, dirname as dirname9 } from "node:path";
+import { homedir as homedir23 } from "node:os";
 import { spawn as spawn5 } from "node:child_process";
 import { timingSafeEqual as timingSafeEqual3, randomBytes as randomBytes11 } from "node:crypto";
 
@@ -66596,8 +66609,8 @@ import { timingSafeEqual as timingSafeEqual3, randomBytes as randomBytes11 } fro
 init_lifecycle();
 init_manager();
 init_hindsight();
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync44, readFileSync as readFileSync40 } from "node:fs";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync45, readFileSync as readFileSync41 } from "node:fs";
 import { resolve as resolve27 } from "node:path";
 init_audit_reader();
 
@@ -71206,12 +71219,198 @@ function installGlobalErrorHandlers() {
 // src/web/api.ts
 init_loader();
 init_merge();
+
+// src/config/agent-workspace-account.ts
+var import_yaml13 = __toESM(require_dist(), 1);
+function blockKey(provider) {
+  return `${provider}_workspace`;
+}
+function setAgentWorkspaceAccount(yamlText, provider, agent, account) {
+  const doc = import_yaml13.parseDocument(yamlText);
+  const agentsNode = doc.get("agents");
+  if (!import_yaml13.isMap(agentsNode)) {
+    throw new Error("switchroom.yaml has no `agents:` map");
+  }
+  if (!agentsNode.has(agent)) {
+    throw new Error(`agent '${agent}' is not declared in switchroom.yaml`);
+  }
+  const path4 = ["agents", agent, blockKey(provider), "account"];
+  const current = doc.getIn(path4);
+  if (current === account)
+    return yamlText;
+  doc.setIn(path4, account);
+  return String(doc);
+}
+function clearAgentWorkspaceAccount(yamlText, provider, agent) {
+  const doc = import_yaml13.parseDocument(yamlText);
+  const agentsNode = doc.get("agents");
+  if (!import_yaml13.isMap(agentsNode))
+    return yamlText;
+  if (!agentsNode.has(agent))
+    return yamlText;
+  const blockPath = ["agents", agent, blockKey(provider)];
+  const block = doc.getIn(blockPath);
+  if (!import_yaml13.isMap(block))
+    return yamlText;
+  const accountPath = [...blockPath, "account"];
+  if (doc.getIn(accountPath) === undefined)
+    return yamlText;
+  doc.deleteIn(accountPath);
+  const after = doc.getIn(blockPath);
+  if (import_yaml13.isMap(after) && after.items.length === 0) {
+    doc.deleteIn(blockPath);
+  }
+  return String(doc);
+}
+function getAgentWorkspaceAccount(yamlText, provider, agent) {
+  const doc = import_yaml13.parseDocument(yamlText);
+  const v = doc.getIn(["agents", agent, blockKey(provider), "account"]);
+  return typeof v === "string" ? v : null;
+}
+
+// src/web/config-edit-plan.ts
+init_schema();
+var import_yaml14 = __toESM(require_dist(), 1);
+import { readFileSync as readFileSync40 } from "node:fs";
+
+class ConfigPlanError extends Error {
+}
+function composeTransforms(...transforms) {
+  return (text) => transforms.reduce((acc, t) => t(acc), text);
+}
+function planConfigEdit(configPath, transform) {
+  let before;
+  try {
+    before = readFileSync40(configPath, "utf-8");
+  } catch (err) {
+    throw new ConfigPlanError(`could not read config: ${err.message}`);
+  }
+  let after;
+  try {
+    after = transform(before);
+  } catch (err) {
+    throw new ConfigPlanError(`config edit failed: ${err.message}`);
+  }
+  if (after === before) {
+    return { before, after, changed: false };
+  }
+  let parsed;
+  try {
+    parsed = import_yaml14.parse(after);
+  } catch (err) {
+    throw new ConfigPlanError(`edit produced unparseable YAML: ${err.message}`);
+  }
+  const check = SwitchroomConfigSchema.safeParse(parsed);
+  if (!check.success) {
+    throw new ConfigPlanError(`edit produced an invalid config: ${check.error.issues.slice(0, 3).map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`);
+  }
+  return { before, after, changed: true };
+}
+
+// src/web/config-diff.ts
+import {
+  mkdirSync as mkdirSync25,
+  mkdtempSync as mkdtemp,
+  rmSync as rmrf,
+  writeFileSync as writeFileSync24
+} from "node:fs";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { tmpdir as tmpdir4 } from "node:os";
+import { join as join38 } from "node:path";
+
+class ConfigDiffError extends Error {
+}
+function generateUnifiedDiff(before, after, name = "switchroom.yaml", gitBin = "git") {
+  if (before === after)
+    return "";
+  const dir = mkdtemp(join38(tmpdir4(), "switchroom-config-diff-"));
+  try {
+    mkdirSync25(join38(dir, "cur"), { recursive: true });
+    mkdirSync25(join38(dir, "new"), { recursive: true });
+    writeFileSync24(join38(dir, "cur", name), before);
+    writeFileSync24(join38(dir, "new", name), after);
+    const r = spawnSync4(gitBin, ["diff", "--no-index", "--no-color", "--", `cur/${name}`, `new/${name}`], { cwd: dir, encoding: "utf-8", timeout: 1e4 });
+    if (r.status === 0)
+      return "";
+    if (r.status !== 1) {
+      throw new ConfigDiffError(`git diff failed (status=${r.status}): ${(r.stderr || r.error?.message || "").toString().trim()}`);
+    }
+    const raw = r.stdout ?? "";
+    if (!raw.includes("@@")) {
+      throw new ConfigDiffError("git diff produced no hunks");
+    }
+    const diff = raw.split(`
+`).map((line) => {
+      if (line.startsWith("diff --git "))
+        return `diff --git a/${name} b/${name}`;
+      if (line.startsWith("--- "))
+        return `--- a/${name}`;
+      if (line.startsWith("+++ "))
+        return `+++ b/${name}`;
+      return line;
+    }).join(`
+`);
+    return diff;
+  } finally {
+    try {
+      rmrf(dir, { recursive: true, force: true });
+    } catch {}
+  }
+}
+
+// src/web/hostd-config-propose.ts
+init_client4();
+import { existsSync as existsSync44 } from "node:fs";
+import { homedir as homedir20 } from "node:os";
+import { join as join39 } from "node:path";
+var PROPOSE_TIMEOUT_MS = 11 * 60 * 1000;
+function resolveHostdOperatorSocket(env2 = process.env) {
+  const override = env2.SWITCHROOM_HOSTD_OPERATOR_SOCKET;
+  if (override && override.length > 0)
+    return override;
+  const candidates = [
+    "/host-home/.switchroom/hostd/operator/sock",
+    join39(homedir20(), ".switchroom", "hostd", "operator", "sock")
+  ];
+  for (const c of candidates) {
+    if (existsSync44(c))
+      return c;
+  }
+  return null;
+}
+async function proposeConfigEditViaHostd(args) {
+  const req = {
+    v: 1,
+    op: "config_propose_edit",
+    request_id: args.requestId,
+    args: {
+      unified_diff: args.unifiedDiff,
+      reason: args.reason,
+      target_path: "/state/config/switchroom.yaml"
+    }
+  };
+  const send = args.send ?? hostdRequest;
+  try {
+    const resp = await send({ socketPath: args.socketPath, timeoutMs: args.timeoutMs ?? PROPOSE_TIMEOUT_MS }, req);
+    if (resp.result === "completed")
+      return { state: "applied" };
+    if (resp.result === "denied") {
+      return { state: "denied", reason: resp.error ?? "operator denied the change" };
+    }
+    return { state: "error", reason: resp.error ?? `hostd returned '${resp.result}'` };
+  } catch (err) {
+    return { state: "error", reason: err.message };
+  }
+}
+
+// src/web/api.ts
 init_account_store();
 init_client2();
+import { randomUUID as randomUUID4 } from "node:crypto";
 
 // telegram-plugin/registry/turns-schema.ts
-import { chmodSync as chmodSync8, mkdirSync as mkdirSync25 } from "fs";
-import { join as join38 } from "path";
+import { chmodSync as chmodSync8, mkdirSync as mkdirSync26 } from "fs";
+import { join as join40 } from "path";
 var DatabaseClass = null;
 function loadDatabaseClass() {
   if (DatabaseClass != null)
@@ -71274,9 +71473,9 @@ function applySchema(db) {
 }
 function openTurnsDb(agentDir) {
   const Database2 = loadDatabaseClass();
-  const dir = join38(agentDir, "telegram");
-  mkdirSync25(dir, { recursive: true, mode: 448 });
-  const path4 = join38(dir, "registry.db");
+  const dir = join40(agentDir, "telegram");
+  mkdirSync26(dir, { recursive: true, mode: 448 });
+  const path4 = join40(dir, "registry.db");
   const db = new Database2(path4, { create: true });
   applySchema(db);
   try {
@@ -71441,7 +71640,7 @@ function handleRestartAgent(name) {
   }
 }
 function handleGetLogs(name, lines = 50) {
-  const res = spawnSync4("docker", ["logs", "--tail", String(lines), containerName(name)], { encoding: "utf-8", timeout: 5000 });
+  const res = spawnSync5("docker", ["logs", "--tail", String(lines), containerName(name)], { encoding: "utf-8", timeout: 5000 });
   if (res.error) {
     return { ok: false, error: res.error.message };
   }
@@ -71634,7 +71833,7 @@ function inspectEnv(container, keys) {
   const out = {};
   for (const k of keys)
     out[k] = null;
-  const res = spawnSync4("docker", ["inspect", "--format", "{{json .Config.Env}}", container], { encoding: "utf-8", timeout: 4000 });
+  const res = spawnSync5("docker", ["inspect", "--format", "{{json .Config.Env}}", container], { encoding: "utf-8", timeout: 4000 });
   if (res.error || res.status !== 0 || !res.stdout)
     return out;
   try {
@@ -71696,9 +71895,9 @@ async function handleGetSystemHealth(home2) {
   };
   try {
     const logPath = defaultAuditLogPath2(home2);
-    if (existsSync44(logPath)) {
+    if (existsSync45(logPath)) {
       hostd.auditLogPresent = true;
-      const raw = readFileSync40(logPath, "utf-8");
+      const raw = readFileSync41(logPath, "utf-8");
       hostd.recent = readAndFilter(raw, {}, 10);
     }
   } catch (err) {
@@ -71807,6 +72006,98 @@ function handleGetNotionWorkspace(config) {
     fullAccessAgents
   };
 }
+var connectionAccessStatuses = new Map;
+function reapConnectionAccessStatuses(now = Date.now()) {
+  for (const [id, s] of connectionAccessStatuses) {
+    if (s.state !== "pending" && now - s.startedAt > 30 * 60000) {
+      connectionAccessStatuses.delete(id);
+    }
+  }
+}
+function handleGetConnectionAccessStatus(requestId) {
+  return connectionAccessStatuses.get(requestId) ?? { state: "unknown" };
+}
+function handleSetConnectionAccess(configPath, config, args, deps = {}) {
+  const provider = args.provider;
+  if (provider !== "google" && provider !== "microsoft") {
+    return { ok: false, error: `unsupported provider '${args.provider}' (google|microsoft)` };
+  }
+  if (args.action !== "enable" && args.action !== "disable") {
+    return { ok: false, error: `action must be 'enable' or 'disable'` };
+  }
+  const agent = args.agent;
+  if (!agent || !config.agents?.[agent]) {
+    return { ok: false, error: `unknown agent '${agent}'` };
+  }
+  const account = String(args.account ?? "").trim().toLowerCase();
+  if (!/^[^@\s:]+@[^@\s:]+\.[^@\s:]+$/.test(account)) {
+    return { ok: false, error: `invalid account email '${args.account}'` };
+  }
+  const enableAcl = provider === "google" ? enableAgentsOnGoogleAccount : enableAgentsOnMicrosoftAccount;
+  const disableAcl = provider === "google" ? disableAgentsOnGoogleAccount : disableAgentsOnMicrosoftAccount;
+  let transform;
+  if (args.action === "enable") {
+    transform = composeTransforms((y) => enableAcl(y, account, [agent]), (y) => setAgentWorkspaceAccount(y, provider, agent, account));
+  } else {
+    transform = composeTransforms((y) => disableAcl(y, account, [agent]), (y) => getAgentWorkspaceAccount(y, provider, agent) === account ? clearAgentWorkspaceAccount(y, provider, agent) : y);
+  }
+  let plan;
+  try {
+    plan = planConfigEdit(configPath, transform);
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof ConfigPlanError ? err.message : err.message
+    };
+  }
+  if (!plan.changed) {
+    return { ok: true, changed: false };
+  }
+  const socketPath = deps.socketPath !== undefined ? deps.socketPath : resolveHostdOperatorSocket();
+  if (!socketPath) {
+    return {
+      ok: false,
+      error: "hostd operator socket not found \u2014 credential grants require hostd (the Telegram approval path). " + "Ensure host_control is enabled and the switchroom-web container mounts ~/.switchroom."
+    };
+  }
+  let diff;
+  try {
+    diff = (deps.generateDiff ?? generateUnifiedDiff)(plan.before, plan.after);
+  } catch (err) {
+    return { ok: false, error: `could not build config diff: ${err.message}` };
+  }
+  const now = deps.now ?? Date.now;
+  const requestId = randomUUID4();
+  const reason = `dashboard: ${args.action} ${agent} on ${account} (${provider})`;
+  connectionAccessStatuses.set(requestId, { state: "pending", startedAt: now() });
+  reapConnectionAccessStatuses(now());
+  const propose = deps.propose ?? ((reqId, d, r) => proposeConfigEditViaHostd({ requestId: reqId, unifiedDiff: d, reason: r, socketPath }));
+  propose(requestId, diff, reason).then((outcome) => {
+    const startedAt = connectionAccessStatuses.get(requestId)?.startedAt ?? now();
+    if (outcome.state === "applied") {
+      connectionAccessStatuses.set(requestId, { state: "applied", startedAt, restartAgent: agent });
+    } else if (outcome.state === "denied") {
+      connectionAccessStatuses.set(requestId, { state: "denied", startedAt, reason: outcome.reason });
+    } else {
+      connectionAccessStatuses.set(requestId, { state: "error", startedAt, reason: outcome.reason });
+    }
+    captureEvent("connection_access", {
+      provider,
+      action: args.action,
+      outcome: outcome.state,
+      source: "web_api"
+    });
+  }).catch((err) => {
+    const startedAt = connectionAccessStatuses.get(requestId)?.startedAt ?? now();
+    connectionAccessStatuses.set(requestId, {
+      state: "error",
+      startedAt,
+      reason: err instanceof Error ? err.message : String(err)
+    });
+    captureException(err, { action: "connection_access", provider });
+  });
+  return { ok: true, changed: true, requestId, pendingApproval: true };
+}
 function handleGetSchedule(config) {
   const entries = collectScheduleEntries(config);
   const agentsDir = resolveAgentsDir(config);
@@ -71841,9 +72132,9 @@ async function handleGetApprovals() {
 }
 
 // src/web/webhook-handler.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync46, mkdirSync as mkdirSync26, readFileSync as readFileSync42, writeFileSync as writeFileSync24 } from "fs";
-import { join as join40 } from "path";
-import { homedir as homedir21 } from "os";
+import { appendFileSync as appendFileSync3, existsSync as existsSync47, mkdirSync as mkdirSync27, readFileSync as readFileSync43, writeFileSync as writeFileSync25 } from "fs";
+import { join as join42 } from "path";
+import { homedir as homedir22 } from "os";
 
 // src/web/webhook-verify.ts
 import { createHmac as createHmac2, timingSafeEqual } from "crypto";
@@ -71993,20 +72284,20 @@ function forwardToGateway(socketPath, req, opts = {}) {
 }
 
 // src/web/webhook-edge.ts
-import { existsSync as existsSync45, readFileSync as readFileSync41 } from "fs";
-import { join as join39 } from "path";
-import { homedir as homedir20 } from "os";
+import { existsSync as existsSync46, readFileSync as readFileSync42 } from "fs";
+import { join as join41 } from "path";
+import { homedir as homedir21 } from "os";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var EDGE_HEADER = "x-switchroom-edge";
 function edgeSecretPath() {
-  return join39(homedir20(), ".switchroom", "webhook-edge-secret");
+  return join41(homedir21(), ".switchroom", "webhook-edge-secret");
 }
 function loadEdgeSecret(path4) {
   const p = path4 ?? edgeSecretPath();
   try {
-    if (!existsSync45(p))
+    if (!existsSync46(p))
       return null;
-    const raw = readFileSync41(p, "utf-8").trim();
+    const raw = readFileSync42(p, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -72038,9 +72329,9 @@ var DEDUP_MAX = 1000;
 var DEDUP_TTL_MS = 24 * 60 * 60 * 1000;
 function loadDedupFile(path4) {
   try {
-    if (!existsSync46(path4))
+    if (!existsSync47(path4))
       return {};
-    const raw = JSON.parse(readFileSync42(path4, "utf-8"));
+    const raw = JSON.parse(readFileSync43(path4, "utf-8"));
     return typeof raw.deliveries === "object" && raw.deliveries !== null ? raw.deliveries : {};
   } catch {
     return {};
@@ -72054,7 +72345,7 @@ function saveDedupFile(path4, deliveries, now) {
   }
   const sorted = Object.entries(pruned).sort((a, b) => b[1] - a[1]).slice(0, DEDUP_MAX);
   const final = Object.fromEntries(sorted);
-  writeFileSync24(path4, JSON.stringify({ deliveries: final }), {
+  writeFileSync25(path4, JSON.stringify({ deliveries: final }), {
     mode: 384
   });
 }
@@ -72062,8 +72353,8 @@ var agentDedupCache = new Map;
 function createFileDedupStore(resolveAgentDir) {
   return {
     check(agent, deliveryId, now) {
-      const telegramDir = join40(resolveAgentDir(agent), "telegram");
-      const filePath = join40(telegramDir, "webhook-dedup.json");
+      const telegramDir = join42(resolveAgentDir(agent), "telegram");
+      const filePath = join42(telegramDir, "webhook-dedup.json");
       if (!agentDedupCache.has(agent)) {
         agentDedupCache.set(agent, loadDedupFile(filePath));
       }
@@ -72073,7 +72364,7 @@ function createFileDedupStore(resolveAgentDir) {
       }
       deliveries[deliveryId] = now;
       try {
-        mkdirSync26(telegramDir, { recursive: true });
+        mkdirSync27(telegramDir, { recursive: true });
         saveDedupFile(filePath, deliveries, now);
       } catch {}
       return;
@@ -72115,9 +72406,9 @@ function shouldWriteThrottleIssue(agent, source, now, windowMap) {
   return true;
 }
 function writeThrottleIssue(agent, source, now, telegramDir, log) {
-  const issuesPath = join40(telegramDir, "issues.jsonl");
+  const issuesPath = join42(telegramDir, "issues.jsonl");
   try {
-    mkdirSync26(telegramDir, { recursive: true });
+    mkdirSync27(telegramDir, { recursive: true });
     const record = {
       ts: now,
       agent,
@@ -72140,7 +72431,7 @@ function writeThrottleIssue(agent, source, now, telegramDir, log) {
 async function handleWebhookIngest(args, deps = {}) {
   const log = deps.log ?? ((s) => process.stderr.write(s));
   const now = (deps.now ?? Date.now)();
-  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join40(homedir21(), ".switchroom", "agents", a));
+  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join42(homedir22(), ".switchroom", "agents", a));
   const rateLimiter = deps.rateLimiter ?? defaultRateLimiter;
   const dedupStore = deps.dedupStore ?? createFileDedupStore(resolveAgentDir);
   if (!args.agentExists) {
@@ -72204,7 +72495,7 @@ async function handleWebhookIngest(args, deps = {}) {
   if (retryAfter !== null) {
     if (!args.viaGateway) {
       const agentDir2 = resolveAgentDir(args.agent);
-      const telegramDir2 = join40(agentDir2, "telegram");
+      const telegramDir2 = join42(agentDir2, "telegram");
       if (shouldWriteThrottleIssue(args.agent, source, now)) {
         writeThrottleIssue(args.agent, source, now, telegramDir2, log);
       }
@@ -72224,7 +72515,7 @@ async function handleWebhookIngest(args, deps = {}) {
   const eventType = source === "github" ? args.headers.get("x-github-event") ?? "unknown" : args.source;
   const rendered = source === "github" ? renderGithubEvent(eventType, payload) : renderGenericEvent(args.source, payload);
   if (args.viaGateway) {
-    const socketPath = join40(resolveAgentDir(args.agent), "telegram", "webhook.sock");
+    const socketPath = join42(resolveAgentDir(args.agent), "telegram", "webhook.sock");
     const forward = deps.forwardFn ?? forwardToGateway;
     const deliveryId = source === "github" ? args.headers.get("x-github-delivery") ?? undefined : undefined;
     let resp;
@@ -72263,10 +72554,10 @@ async function handleWebhookIngest(args, deps = {}) {
     return jsonReply(202, { ok: true, recorded: true, ts: resp.ts });
   }
   const agentDir = resolveAgentDir(args.agent);
-  const telegramDir = join40(agentDir, "telegram");
-  const logPath = join40(telegramDir, "webhook-events.jsonl");
+  const telegramDir = join42(agentDir, "telegram");
+  const logPath = join42(telegramDir, "webhook-events.jsonl");
   try {
-    mkdirSync26(telegramDir, { recursive: true });
+    mkdirSync27(telegramDir, { recursive: true });
     const record = {
       ts: now,
       source,
@@ -72317,15 +72608,15 @@ function resolveWebToken() {
   const fromEnv = process.env.SWITCHROOM_WEB_TOKEN;
   if (fromEnv && fromEnv.length > 0)
     return fromEnv;
-  const home2 = process.env.HOME ?? homedir22();
-  const tokenPath = join41(home2, ".switchroom", "web-token");
-  if (existsSync47(tokenPath)) {
-    const existing = readFileSync43(tokenPath, "utf8").trim();
+  const home2 = process.env.HOME ?? homedir23();
+  const tokenPath = join43(home2, ".switchroom", "web-token");
+  if (existsSync48(tokenPath)) {
+    const existing = readFileSync44(tokenPath, "utf8").trim();
     if (existing.length > 0)
       return existing;
   }
   const token = randomBytes11(32).toString("hex");
-  mkdirSync27(dirname9(tokenPath), { recursive: true, mode: 448 });
+  mkdirSync28(dirname9(tokenPath), { recursive: true, mode: 448 });
   try {
     const fd = openSync10(tokenPath, fsConstants3.O_WRONLY | fsConstants3.O_CREAT | fsConstants3.O_EXCL, 384);
     try {
@@ -72337,7 +72628,7 @@ function resolveWebToken() {
     return token;
   } catch (err) {
     if (err.code === "EEXIST") {
-      const existing = readFileSync43(tokenPath, "utf8").trim();
+      const existing = readFileSync44(tokenPath, "utf8").trim();
       if (existing.length > 0)
         return existing;
     }
@@ -72403,11 +72694,11 @@ function checkWsAuth(req, token, server) {
   return presented !== null && constantTimeEqual(presented, token);
 }
 function loadWebhookSecrets() {
-  const path4 = join41(homedir22(), ".switchroom", "webhook-secrets.json");
-  if (!existsSync47(path4))
+  const path4 = join43(homedir23(), ".switchroom", "webhook-secrets.json");
+  if (!existsSync48(path4))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync43(path4, "utf-8"));
+    const parsed = JSON.parse(readFileSync44(path4, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (err) {
     process.stderr.write(`webhook-ingest: failed to parse ${path4}: ${err.message} \u2014 webhooks will return 401 until fixed
@@ -72499,6 +72790,16 @@ function parseRoute(pathname, method) {
   if (method === "GET" && pathname === "/api/accounts") {
     return { handler: "getAccounts", params: {} };
   }
+  if (method === "POST" && pathname === "/api/connections/access") {
+    return { handler: "setConnectionAccess", params: {} };
+  }
+  const accessStatusMatch = pathname.match(/^\/api\/connections\/access\/([^/]+)$/);
+  if (method === "GET" && accessStatusMatch) {
+    return {
+      handler: "getConnectionAccessStatus",
+      params: { requestId: decodeURIComponent(accessStatusMatch[1]) }
+    };
+  }
   if (method === "POST" && pathname === "/api/auth/use") {
     return { handler: "useAccount", params: {} };
   }
@@ -72517,8 +72818,17 @@ function parseRoute(pathname, method) {
 }
 function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
   const uiDirRaw = resolve28(import.meta.dirname, "ui");
-  const uiDir = existsSync47(uiDirRaw) ? realpathSync3(uiDirRaw) : uiDirRaw;
+  const uiDir = existsSync48(uiDirRaw) ? realpathSync3(uiDirRaw) : uiDirRaw;
   const token = resolveWebToken();
+  const freshConfig = () => {
+    if (!configPath)
+      return config;
+    try {
+      return loadConfig(configPath);
+    } catch {
+      return config;
+    }
+  };
   const localhostOnly = hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1";
   const server = Bun.serve({
     port,
@@ -72614,11 +72924,11 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
           case "getSystemHealth":
             return (async () => jsonResponse(await handleGetSystemHealth()))();
           case "getGoogleAccounts":
-            return (async () => jsonResponse(await handleGetGoogleAccounts(config)))();
+            return (async () => jsonResponse(await handleGetGoogleAccounts(freshConfig())))();
           case "getMicrosoftAccounts":
-            return (async () => jsonResponse(await handleGetMicrosoftAccounts(config)))();
+            return (async () => jsonResponse(await handleGetMicrosoftAccounts(freshConfig())))();
           case "getNotionWorkspace":
-            return jsonResponse(handleGetNotionWorkspace(config));
+            return jsonResponse(handleGetNotionWorkspace(freshConfig()));
           case "getSchedule":
             return jsonResponse(handleGetSchedule(config));
           case "getApprovals":
@@ -72644,6 +72954,28 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
               return jsonResponse(result);
             })();
           }
+          case "setConnectionAccess": {
+            return (async () => {
+              if (!configPath) {
+                return jsonResponse({ ok: false, error: "config path not available to the web server" }, 500);
+              }
+              let body;
+              try {
+                body = await req.json();
+              } catch {
+                return jsonResponse({ ok: false, error: "Invalid JSON body" }, 400);
+              }
+              const result = handleSetConnectionAccess(configPath, freshConfig(), {
+                provider: String(body.provider ?? ""),
+                account: String(body.account ?? ""),
+                agent: String(body.agent ?? ""),
+                action: String(body.action ?? "")
+              });
+              return jsonResponse(result, result.ok ? 200 : 400);
+            })();
+          }
+          case "getConnectionAccessStatus":
+            return jsonResponse(handleGetConnectionAccessStatus(route.params.requestId));
           case "refreshQuota": {
             return (async () => {
               let body = {};
@@ -72676,8 +73008,8 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         }
       }
       let filePath = pathname === "/" ? "/index.html" : pathname;
-      const fullPath = join41(uiDir, filePath);
-      if (!existsSync47(fullPath)) {
+      const fullPath = join43(uiDir, filePath);
+      if (!existsSync48(fullPath)) {
         return new Response("Not Found", { status: 404 });
       }
       let realFullPath;
@@ -72692,7 +73024,7 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
       }
       const ext = extname(realFullPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
-      const content = readFileSync43(realFullPath);
+      const content = readFileSync44(realFullPath);
       return new Response(content, {
         headers: { "Content-Type": contentType }
       });
@@ -72826,26 +73158,26 @@ Starting Switchroom dashboard...
 // src/cli/setup.ts
 init_source();
 init_loader();
-import { existsSync as existsSync48, copyFileSync as copyFileSync8, readFileSync as readFileSync44, writeFileSync as writeFileSync25, mkdirSync as mkdirSync28 } from "node:fs";
+import { existsSync as existsSync49, copyFileSync as copyFileSync8, readFileSync as readFileSync45, writeFileSync as writeFileSync26, mkdirSync as mkdirSync29 } from "node:fs";
 import { resolve as resolve29, dirname as dirname10 } from "node:path";
 init_vault();
 init_manager();
 
 // src/cli/setup-posture-rewrite.ts
-var import_yaml13 = __toESM(require_dist(), 1);
+var import_yaml15 = __toESM(require_dist(), 1);
 function insertVaultBrokerApprovalAuth(source, value = "telegram-id") {
   let doc;
   try {
-    doc = import_yaml13.default.parseDocument(source);
+    doc = import_yaml15.default.parseDocument(source);
   } catch {
     return { kind: "not-found" };
   }
   const vault = doc.get("vault");
-  if (!vault || !import_yaml13.default.isMap(vault)) {
+  if (!vault || !import_yaml15.default.isMap(vault)) {
     return { kind: "not-found" };
   }
   const broker = vault.get("broker");
-  if (!broker || !import_yaml13.default.isMap(broker)) {
+  if (!broker || !import_yaml15.default.isMap(broker)) {
     return { kind: "not-found" };
   }
   if (broker.has("approvalAuth")) {
@@ -72896,7 +73228,7 @@ ${childIndent}approvalAuth: ${value}`;
 }
 
 // src/cli/supergroup-setup-yaml.ts
-var import_yaml14 = __toESM(require_dist(), 1);
+var import_yaml16 = __toESM(require_dist(), 1);
 function isValidSupergroupChatId(value) {
   return /^-\d+$/.test(value);
 }
@@ -72904,23 +73236,23 @@ function setAgentSupergroupChatId(yamlText, agentName, chatId) {
   if (!isValidSupergroupChatId(chatId)) {
     throw new Error(`setAgentSupergroupChatId: chat_id must be a negative integer string (got "${chatId}")`);
   }
-  const doc = import_yaml14.parseDocument(yamlText);
+  const doc = import_yaml16.parseDocument(yamlText);
   const root = doc.contents;
-  if (!import_yaml14.isMap(root)) {
+  if (!import_yaml16.isMap(root)) {
     throw new Error("setAgentSupergroupChatId: YAML root is not a map");
   }
   const agents = root.get("agents", true);
-  if (!import_yaml14.isMap(agents)) {
+  if (!import_yaml16.isMap(agents)) {
     throw new Error("setAgentSupergroupChatId: config has no `agents:` map");
   }
   const agent = agents.get(agentName, true);
-  if (!import_yaml14.isMap(agent)) {
+  if (!import_yaml16.isMap(agent)) {
     throw new Error(`setAgentSupergroupChatId: agent "${agentName}" not found in config`);
   }
   const channels = agent.get("channels", true);
-  if (import_yaml14.isMap(channels)) {
+  if (import_yaml16.isMap(channels)) {
     const telegram = channels.get("telegram", true);
-    if (import_yaml14.isMap(telegram)) {
+    if (import_yaml16.isMap(telegram)) {
       if (telegram.get("chat_id") === chatId)
         return yamlText;
       telegram.set("chat_id", chatId);
@@ -73008,7 +73340,7 @@ async function stepConfigFile(configPath, nonInteractive) {
       existingConfig = null;
     }
   }
-  if (existingConfig && existsSync48(existingConfig)) {
+  if (existingConfig && existsSync49(existingConfig)) {
     if (!nonInteractive) {
       const useExisting = await askYesNo(`  Found ${source_default.cyan(existingConfig)}. Use it?`, true);
       if (!useExisting) {
@@ -73036,10 +73368,10 @@ async function copyExampleConfig(nonInteractive) {
   }
   const srcFile = resolve29(examplesDir, `${choice}.yaml`);
   const destFile = resolvePath("~/.switchroom/switchroom.yaml");
-  if (!existsSync48(srcFile)) {
+  if (!existsSync49(srcFile)) {
     throw new ConfigError(`Example config not found: ${choice}.yaml`);
   }
-  mkdirSync28(dirname10(destFile), { recursive: true });
+  mkdirSync29(dirname10(destFile), { recursive: true });
   copyFileSync8(srcFile, destFile);
   console.log(source_default.green(`  Copied ${choice}.yaml -> ${destFile}`));
   console.log(source_default.yellow(`  Edit ${destFile} to customize, then re-run switchroom setup.`));
@@ -73120,7 +73452,7 @@ async function resolveOrPromptToken(rawToken, label, config, nonInteractive) {
       try {
         const { openVault: openVault2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
         const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-        if (existsSync48(vaultPath)) {
+        if (existsSync49(vaultPath)) {
           const secrets = openVault2(passphrase, vaultPath);
           const key = rawToken.replace("vault:", "");
           const entry = secrets[key];
@@ -73148,7 +73480,7 @@ async function resolveOrPromptToken(rawToken, label, config, nonInteractive) {
 async function storeTokenInVault(config, vaultRef, token) {
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
   const key = vaultRef.replace("vault:", "");
-  if (!existsSync48(vaultPath)) {
+  if (!existsSync49(vaultPath)) {
     console.log(source_default.gray("  Creating encrypted vault..."));
     let passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
     if (!passphrase) {
@@ -73321,7 +73653,7 @@ async function stepMemoryBackend(config, nonInteractive, switchroomConfigPath) {
   try {
     const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
     const passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
-    if (passphrase && existsSync48(vaultPath)) {
+    if (passphrase && existsSync49(vaultPath)) {
       const existing = getStringSecret(passphrase, vaultPath, "hindsight-api-key");
       if (existing) {
         console.log(source_default.gray("  Note: legacy 'hindsight-api-key' is in your vault but is no longer used. You can remove it with `switchroom vault rm hindsight-api-key`."));
@@ -73449,16 +73781,16 @@ async function stepScaffoldAgents(config, agentBots, userId, nonInteractive, swi
 }
 async function ensureAuthActiveDefault(configPath) {
   const fs4 = await import("node:fs");
-  const { parseDocument: parseDocument7, isMap: isMap7 } = await Promise.resolve().then(() => __toESM(require_dist(), 1));
+  const { parseDocument: parseDocument8, isMap: isMap8 } = await Promise.resolve().then(() => __toESM(require_dist(), 1));
   const { atomicWriteFileSync: atomicWriteFileSync3 } = await Promise.resolve().then(() => (init_atomic(), exports_atomic));
   const { setAuthActive: setAuthActive2 } = await Promise.resolve().then(() => (init_auth_active_yaml(), exports_auth_active_yaml));
   const raw = fs4.readFileSync(configPath, "utf-8");
-  const doc = parseDocument7(raw);
+  const doc = parseDocument8(raw);
   const root = doc.contents;
-  if (!isMap7(root))
+  if (!isMap8(root))
     return;
   const existing = root.get("auth", true);
-  if (isMap7(existing) && existing.has("active"))
+  if (isMap8(existing) && existing.has("active"))
     return;
   const after = setAuthActive2(raw, "default");
   if (after === raw)
@@ -73481,13 +73813,13 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
     return;
   }
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (!existsSync48(vaultPath)) {
+  if (!existsSync49(vaultPath)) {
     console.log(source_default.gray("  Skipping (vault not created yet)."));
     return;
   }
   const credPathRaw = config.vault?.broker?.autoUnlockCredentialPath ?? "~/.switchroom/vault-auto-unlock";
   const credPath = resolvePath(credPathRaw);
-  if (config.vault?.broker?.autoUnlock === true && existsSync48(credPath)) {
+  if (config.vault?.broker?.autoUnlock === true && existsSync49(credPath)) {
     console.log(source_default.green(`  ${STEP_DONE} Already configured (${credPath})`));
     return;
   }
@@ -73553,12 +73885,12 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
   const choice = await askChoice("  Approval posture", [PASSPHRASE_CHOICE, TELEGRAM_ID_CHOICE]);
   if (choice === TELEGRAM_ID_CHOICE) {
     try {
-      const yamlPath = existsSync48(resolve29(process.cwd(), "switchroom.yaml")) ? resolve29(process.cwd(), "switchroom.yaml") : resolve29(process.cwd(), "switchroom.yml");
-      if (existsSync48(yamlPath)) {
-        const content = readFileSync44(yamlPath, "utf-8");
+      const yamlPath = existsSync49(resolve29(process.cwd(), "switchroom.yaml")) ? resolve29(process.cwd(), "switchroom.yaml") : resolve29(process.cwd(), "switchroom.yml");
+      if (existsSync49(yamlPath)) {
+        const content = readFileSync45(yamlPath, "utf-8");
         const result = insertVaultBrokerApprovalAuth(content, "telegram-id");
         if (result.kind === "rewritten") {
-          writeFileSync25(yamlPath, result.content, "utf-8");
+          writeFileSync26(yamlPath, result.content, "utf-8");
           console.log(source_default.green(`  ${STEP_DONE} Set vault.broker.approvalAuth: telegram-id in ${yamlPath}`));
         } else if (result.kind === "already-set") {
           console.log(source_default.gray("  approvalAuth already set \u2014 leaving it alone."));
@@ -73589,8 +73921,8 @@ async function stepDangerousMode(config, nonInteractive) {
       resolve29(process.cwd(), "switchroom.yml")
     ];
     for (const configPath of configPaths) {
-      if (existsSync48(configPath)) {
-        let content = readFileSync44(configPath, "utf-8");
+      if (existsSync49(configPath)) {
+        let content = readFileSync45(configPath, "utf-8");
         const agentNames = Object.keys(config.agents);
         for (const name of agentNames) {
           const agentPattern = new RegExp(`(^  ${name}:\\s*\\n)`, "m");
@@ -73604,7 +73936,7 @@ async function stepDangerousMode(config, nonInteractive) {
           }
           config.agents[name].dangerous_mode = true;
         }
-        writeFileSync25(configPath, content, "utf-8");
+        writeFileSync26(configPath, content, "utf-8");
         console.log(source_default.green(`  ${STEP_DONE} Enabled dangerous_mode for all agents in ${configPath}`));
         break;
       }
@@ -73719,17 +74051,17 @@ init_doctor();
 init_source();
 init_loader();
 init_lifecycle();
-import { cpSync as cpSync2, existsSync as existsSync55, mkdirSync as mkdirSync30, readFileSync as readFileSync49, realpathSync as realpathSync5, rmSync as rmSync12, statSync as statSync24 } from "node:fs";
-import { spawnSync as spawnSync8 } from "node:child_process";
-import { join as join55, dirname as dirname13, resolve as resolve33 } from "node:path";
-import { homedir as homedir33 } from "node:os";
-var DEFAULT_COMPOSE_PATH = join55(homedir33(), ".switchroom", "compose", "docker-compose.yml");
+import { cpSync as cpSync2, existsSync as existsSync56, mkdirSync as mkdirSync31, readFileSync as readFileSync50, realpathSync as realpathSync5, rmSync as rmSync12, statSync as statSync24 } from "node:fs";
+import { spawnSync as spawnSync9 } from "node:child_process";
+import { join as join57, dirname as dirname13, resolve as resolve33 } from "node:path";
+import { homedir as homedir34 } from "node:os";
+var DEFAULT_COMPOSE_PATH = join57(homedir34(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname13(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync55(join55(dir, ".git"))) {
+    if (existsSync56(join57(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync49(join55(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync50(join57(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -73781,7 +74113,7 @@ function planUpdate(opts) {
   steps.push({
     name: "pull-images",
     description: "Pull broker / kernel / agent images from GHCR",
-    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync55(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
+    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync56(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
     run: () => {
       const r = runner("docker", [
         "compose",
@@ -73880,17 +74212,17 @@ function planUpdate(opts) {
         return;
       }
       const source = resolve33(import.meta.dirname, "../../skills");
-      const dest = join55(homedir33(), ".switchroom", "skills", "_bundled");
-      if (!existsSync55(source)) {
+      const dest = join57(homedir34(), ".switchroom", "skills", "_bundled");
+      if (!existsSync56(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
         return;
       }
       try {
-        if (existsSync55(dest)) {
+        if (existsSync56(dest)) {
           rmSync12(dest, { recursive: true, force: true });
         }
-        mkdirSync30(dirname13(dest), { recursive: true });
+        mkdirSync31(dirname13(dest), { recursive: true });
         cpSync2(source, dest, { recursive: true, dereference: false });
       } catch (err) {
         throw new Error(`sync-bundled-skills failed: ${err.message}`);
@@ -73949,7 +74281,7 @@ function planUpdate(opts) {
   return steps;
 }
 function defaultRunner(cmd, args) {
-  const r = spawnSync8(cmd, args, { stdio: "inherit" });
+  const r = spawnSync9(cmd, args, { stdio: "inherit" });
   return { status: r.status ?? 1 };
 }
 function writeMarkerInPreferredLocation(agent, reason, runner) {
@@ -73994,10 +74326,10 @@ function defaultStatusProbe(composePath) {
       } catch {}
       let dir = dirname13(scriptPath);
       for (let i = 0;i < 8; i++) {
-        const pkgPath = join55(dir, "package.json");
-        if (existsSync55(pkgPath)) {
+        const pkgPath = join57(dir, "package.json");
+        if (existsSync56(pkgPath)) {
           try {
-            const pkg = JSON.parse(readFileSync49(pkgPath, "utf-8"));
+            const pkg = JSON.parse(readFileSync50(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
               cliVersion = pkg.version;
           } catch (err) {
@@ -74018,13 +74350,13 @@ function defaultStatusProbe(composePath) {
     warnings.push("could not resolve CLI version (no package.json found above the resolved script path)");
   }
   const services = [];
-  if (!existsSync55(composePath)) {
+  if (!existsSync56(composePath)) {
     warnings.push(`compose file not found at ${composePath}; service status unknown`);
     return { cliVersion, cliBuiltAt, services, warnings };
   }
   let serviceList = [];
   try {
-    const r = spawnSync8("docker", ["compose", "-p", "switchroom", "-f", composePath, "config", "--services"], { encoding: "utf-8", timeout: 1e4 });
+    const r = spawnSync9("docker", ["compose", "-p", "switchroom", "-f", composePath, "config", "--services"], { encoding: "utf-8", timeout: 1e4 });
     if (r.status !== 0) {
       warnings.push(`docker compose config --services failed: ${r.stderr?.trim() ?? r.error?.message ?? "unknown"}`);
       return { cliVersion, cliBuiltAt, services, warnings };
@@ -74041,7 +74373,7 @@ function defaultStatusProbe(composePath) {
     let containerCreatedAt = null;
     let status = "<unknown>";
     try {
-      const r = spawnSync8("docker", ["inspect", "-f", "{{.Config.Image}}|{{.Created}}|{{.State.Status}}", containerName2], { encoding: "utf-8", timeout: 5000 });
+      const r = spawnSync9("docker", ["inspect", "-f", "{{.Config.Image}}|{{.Created}}|{{.State.Status}}", containerName2], { encoding: "utf-8", timeout: 5000 });
       if (r.status === 0) {
         const [img, created, st] = r.stdout.trim().split("|");
         image = img ?? null;
@@ -74057,7 +74389,7 @@ function defaultStatusProbe(composePath) {
     let imagePulledAt = null;
     if (image) {
       try {
-        const r = spawnSync8("docker", ["image", "inspect", "-f", "{{.Id}}|{{.Created}}|{{.Metadata.LastTagTime}}", image], { encoding: "utf-8", timeout: 5000 });
+        const r = spawnSync9("docker", ["image", "inspect", "-f", "{{.Id}}|{{.Created}}|{{.Metadata.LastTagTime}}", image], { encoding: "utf-8", timeout: 5000 });
         if (r.status === 0) {
           const [id, created, lastTag] = r.stdout.trim().split("|");
           imageDigestShort = id?.replace(/^sha256:/, "").slice(0, 12) ?? null;
@@ -74213,8 +74545,8 @@ init_source();
 init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
-import { existsSync as existsSync56, readFileSync as readFileSync50 } from "node:fs";
-import { dirname as dirname14, join as join56 } from "node:path";
+import { existsSync as existsSync57, readFileSync as readFileSync51 } from "node:fs";
+import { dirname as dirname14, join as join58 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync4("claude --version 2>/dev/null", {
@@ -74264,11 +74596,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const pkgPath = join56(dir, "package.json");
-    if (existsSync56(pkgPath)) {
+    const pkgPath = join58(dir, "package.json");
+    if (existsSync57(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync50(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync56(join56(dir, ".git"))) {
+        const pkg = JSON.parse(readFileSync51(pkgPath, "utf-8"));
+        if (pkg.name === "switchroom" && existsSync57(join58(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -74494,18 +74826,18 @@ function registerHandoffCommand(program3) {
 // src/issues/store.ts
 import {
   closeSync as closeSync11,
-  existsSync as existsSync57,
-  mkdirSync as mkdirSync31,
+  existsSync as existsSync58,
+  mkdirSync as mkdirSync32,
   openSync as openSync11,
   readdirSync as readdirSync21,
-  readFileSync as readFileSync51,
+  readFileSync as readFileSync52,
   renameSync as renameSync12,
   statSync as statSync25,
   unlinkSync as unlinkSync11,
-  writeFileSync as writeFileSync26,
+  writeFileSync as writeFileSync27,
   writeSync as writeSync7
 } from "node:fs";
-import { join as join57 } from "node:path";
+import { join as join59 } from "node:path";
 import { randomBytes as randomBytes12 } from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
 
@@ -74903,12 +75235,12 @@ function redactedMarker(ruleId) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path4 = join57(stateDir, ISSUES_FILE);
-  if (!existsSync57(path4))
+  const path4 = join59(stateDir, ISSUES_FILE);
+  if (!existsSync58(path4))
     return [];
   let raw;
   try {
-    raw = readFileSync51(path4, "utf-8");
+    raw = readFileSync52(path4, "utf-8");
   } catch {
     return [];
   }
@@ -74981,7 +75313,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve36(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync57(join57(stateDir, ISSUES_FILE)))
+  if (!existsSync58(join59(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -74999,7 +75331,7 @@ function resolve36(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync57(join57(stateDir, ISSUES_FILE)))
+  if (!existsSync58(join59(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -75017,7 +75349,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync57(join57(stateDir, ISSUES_FILE)))
+  if (!existsSync58(join59(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -75047,16 +75379,16 @@ function prune(stateDir, opts = {}) {
   });
 }
 function ensureDir(stateDir) {
-  mkdirSync31(stateDir, { recursive: true });
+  mkdirSync32(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path4 = join57(stateDir, ISSUES_FILE);
+  const path4 = join59(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path4}.tmp-${process.pid}-${randomBytes12(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
 `) + `
 `;
-  writeFileSync26(tmp, body, "utf-8");
+  writeFileSync27(tmp, body, "utf-8");
   renameSync12(tmp, path4);
 }
 var ORPHAN_TMP_TTL_MS = 60000;
@@ -75072,7 +75404,7 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join57(stateDir, entry);
+    const tmpPath = join59(stateDir, entry);
     try {
       const stat = statSync25(tmpPath);
       if (stat.mtimeMs < cutoff) {
@@ -75084,7 +75416,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join57(stateDir, ISSUES_LOCK);
+  const lockPath = join59(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -75119,7 +75451,7 @@ function withLock(stateDir, fn) {
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync51(lockPath, "utf-8").trim();
+    pidStr = readFileSync52(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
@@ -75367,21 +75699,21 @@ function relTime(deltaMs) {
 
 // src/cli/deps.ts
 init_source();
-import { existsSync as existsSync60 } from "node:fs";
-import { homedir as homedir36 } from "node:os";
-import { join as join60, resolve as resolve37 } from "node:path";
+import { existsSync as existsSync61 } from "node:fs";
+import { homedir as homedir37 } from "node:os";
+import { join as join62, resolve as resolve37 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash11 } from "node:crypto";
 import {
-  existsSync as existsSync58,
-  mkdirSync as mkdirSync32,
-  readFileSync as readFileSync52,
+  existsSync as existsSync59,
+  mkdirSync as mkdirSync33,
+  readFileSync as readFileSync53,
   rmSync as rmSync13,
-  writeFileSync as writeFileSync27
+  writeFileSync as writeFileSync28
 } from "node:fs";
-import { dirname as dirname15, join as join58 } from "node:path";
-import { homedir as homedir34 } from "node:os";
+import { dirname as dirname15, join as join60 } from "node:path";
+import { homedir as homedir35 } from "node:os";
 import { execFileSync as execFileSync18 } from "node:child_process";
 
 class PythonEnvError extends Error {
@@ -75393,26 +75725,26 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join58(homedir34(), ".switchroom", "deps", "python");
+  return join60(homedir35(), ".switchroom", "deps", "python");
 }
 function hashFile(path4) {
-  return createHash11("sha256").update(readFileSync52(path4)).digest("hex");
+  return createHash11("sha256").update(readFileSync53(path4)).digest("hex");
 }
 function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultPythonCacheRoot();
   const hostPython = opts.pythonBin ?? "python3";
-  if (!existsSync58(requirementsPath)) {
+  if (!existsSync59(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join58(cacheRoot, skillName);
-  const stampPath = join58(venvDir, ".requirements.sha256");
-  const binDir = join58(venvDir, "bin");
-  const pythonBin = join58(binDir, "python");
-  const pipBin = join58(binDir, "pip");
+  const venvDir = join60(cacheRoot, skillName);
+  const stampPath = join60(venvDir, ".requirements.sha256");
+  const binDir = join60(venvDir, "bin");
+  const pythonBin = join60(binDir, "python");
+  const pipBin = join60(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
-  if (!force && existsSync58(stampPath) && existsSync58(pythonBin)) {
-    const existingHash = readFileSync52(stampPath, "utf8").trim();
+  if (!force && existsSync59(stampPath) && existsSync59(pythonBin)) {
+    const existingHash = readFileSync53(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -75424,10 +75756,10 @@ function ensurePythonEnv(opts) {
       };
     }
   }
-  if (existsSync58(venvDir)) {
+  if (existsSync59(venvDir)) {
     rmSync13(venvDir, { recursive: true, force: true });
   }
-  mkdirSync32(dirname15(venvDir), { recursive: true });
+  mkdirSync33(dirname15(venvDir), { recursive: true });
   try {
     execFileSync18(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
   } catch (err) {
@@ -75446,7 +75778,7 @@ function ensurePythonEnv(opts) {
     const e = err;
     throw new PythonEnvError(`Failed to install requirements for skill "${skillName}": ${e.message}`, e.stderr?.toString());
   }
-  writeFileSync27(stampPath, targetHash + `
+  writeFileSync28(stampPath, targetHash + `
 `);
   return {
     skillName,
@@ -75462,14 +75794,14 @@ function ensurePythonEnv(opts) {
 import { createHash as createHash12 } from "node:crypto";
 import {
   copyFileSync as copyFileSync9,
-  existsSync as existsSync59,
-  mkdirSync as mkdirSync33,
-  readFileSync as readFileSync53,
+  existsSync as existsSync60,
+  mkdirSync as mkdirSync34,
+  readFileSync as readFileSync54,
   rmSync as rmSync14,
-  writeFileSync as writeFileSync28
+  writeFileSync as writeFileSync29
 } from "node:fs";
-import { dirname as dirname16, join as join59 } from "node:path";
-import { homedir as homedir35 } from "node:os";
+import { dirname as dirname16, join as join61 } from "node:path";
+import { homedir as homedir36 } from "node:os";
 import { execFileSync as execFileSync19 } from "node:child_process";
 
 class NodeEnvError extends Error {
@@ -75492,23 +75824,23 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join59(homedir35(), ".switchroom", "deps", "node");
+  return join61(homedir36(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
   const sourceDir = dirname16(packageJsonPath);
   const hasher = createHash12("sha256");
   hasher.update(`package.json
 `);
-  hasher.update(readFileSync53(packageJsonPath));
+  hasher.update(readFileSync54(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join59(sourceDir, lockName);
-    if (existsSync59(lockPath)) {
+    const lockPath = join61(sourceDir, lockName);
+    if (existsSync60(lockPath)) {
       hasher.update(`
 `);
       hasher.update(lockName);
       hasher.update(`
 `);
-      hasher.update(readFileSync53(lockPath));
+      hasher.update(readFileSync54(lockPath));
     }
   }
   return hasher.digest("hex");
@@ -75517,17 +75849,17 @@ function ensureNodeEnv(opts) {
   const { skillName, packageJsonPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultNodeCacheRoot();
   const installer = opts.installer ?? "bun";
-  if (!existsSync59(packageJsonPath)) {
+  if (!existsSync60(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
   const sourceDir = dirname16(packageJsonPath);
-  const envDir = join59(cacheRoot, skillName);
-  const stampPath = join59(envDir, ".package.sha256");
-  const nodeModulesDir = join59(envDir, "node_modules");
-  const binDir = join59(nodeModulesDir, ".bin");
+  const envDir = join61(cacheRoot, skillName);
+  const stampPath = join61(envDir, ".package.sha256");
+  const nodeModulesDir = join61(envDir, "node_modules");
+  const binDir = join61(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
-  if (!force && existsSync59(stampPath) && existsSync59(nodeModulesDir)) {
-    const existingHash = readFileSync53(stampPath, "utf8").trim();
+  if (!force && existsSync60(stampPath) && existsSync60(nodeModulesDir)) {
+    const existingHash = readFileSync54(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -75538,16 +75870,16 @@ function ensureNodeEnv(opts) {
       };
     }
   }
-  if (existsSync59(envDir)) {
+  if (existsSync60(envDir)) {
     rmSync14(envDir, { recursive: true, force: true });
   }
-  mkdirSync33(envDir, { recursive: true });
-  copyFileSync9(packageJsonPath, join59(envDir, "package.json"));
+  mkdirSync34(envDir, { recursive: true });
+  copyFileSync9(packageJsonPath, join61(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join59(sourceDir, lockName);
-    if (existsSync59(lockPath)) {
-      copyFileSync9(lockPath, join59(envDir, lockName));
+    const lockPath = join61(sourceDir, lockName);
+    if (existsSync60(lockPath)) {
+      copyFileSync9(lockPath, join61(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -75563,7 +75895,7 @@ function ensureNodeEnv(opts) {
     const e = err;
     throw new NodeEnvError(`Failed to install node deps for skill "${skillName}" with ${installer}: ${e.message}`, e.stderr?.toString());
   }
-  writeFileSync28(stampPath, targetHash + `
+  writeFileSync29(stampPath, targetHash + `
 `);
   return {
     skillName,
@@ -75576,28 +75908,28 @@ function ensureNodeEnv(opts) {
 
 // src/cli/deps.ts
 function builtinSkillsRoot() {
-  return resolve37(homedir36(), ".switchroom/skills/_bundled");
+  return resolve37(homedir37(), ".switchroom/skills/_bundled");
 }
 function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
   deps.command("rebuild <skill>").description("Rebuild the Python venv and/or Node node_modules cache for a skill").option("-p, --python", "Rebuild only the Python env").option("-n, --node", "Rebuild only the Node env").action(async (skill, opts) => {
     const skillsRoot = builtinSkillsRoot();
-    if (!existsSync60(skillsRoot)) {
+    if (!existsSync61(skillsRoot)) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join60(skillsRoot, skill);
-    if (!existsSync60(skillDir)) {
+    const skillDir = join62(skillsRoot, skill);
+    if (!existsSync61(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join60(skillDir, "requirements.txt");
-    const packageJsonPath = join60(skillDir, "package.json");
-    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync60(requirementsPath));
-    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync60(packageJsonPath));
+    const requirementsPath = join62(skillDir, "requirements.txt");
+    const packageJsonPath = join62(skillDir, "package.json");
+    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync61(requirementsPath));
+    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync61(packageJsonPath));
     let did = 0;
     if (wantPython) {
-      if (!existsSync60(requirementsPath)) {
+      if (!existsSync61(requirementsPath)) {
         console.error(source_default.red(`Skill "${skill}" has no requirements.txt at ${requirementsPath}`));
         process.exit(1);
       }
@@ -75621,7 +75953,7 @@ function registerDepsCommand(program3) {
       }
     }
     if (wantNode) {
-      if (!existsSync60(packageJsonPath)) {
+      if (!existsSync61(packageJsonPath)) {
         console.error(source_default.red(`Skill "${skill}" has no package.json at ${packageJsonPath}`));
         process.exit(1);
       }
@@ -75654,9 +75986,9 @@ function registerDepsCommand(program3) {
 // src/cli/workspace.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync61 } from "node:fs";
+import { existsSync as existsSync62 } from "node:fs";
 import { resolve as resolve38, sep as sep3 } from "node:path";
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 
 // src/agents/workspace.ts
 import { readFile, stat } from "node:fs/promises";
@@ -75864,6 +76196,7 @@ function buildBootstrapPromptWarning(params) {
 
 // src/agents/bootstrap-types.ts
 var DEFAULT_AGENTS_FILENAME = "AGENTS.md";
+var DEFAULT_SOUL_DEFAULT_FILENAME = "SOUL.default.md";
 var DEFAULT_SOUL_FILENAME = "SOUL.md";
 var DEFAULT_TOOLS_FILENAME = "TOOLS.md";
 var DEFAULT_IDENTITY_FILENAME = "IDENTITY.md";
@@ -75877,6 +76210,7 @@ var DEFAULT_WORKSPACE_DIR_NAME = "workspace";
 var DEFAULT_MEMORY_SUBDIR = "memory";
 var STABLE_BOOTSTRAP_FILENAMES = [
   DEFAULT_AGENTS_FILENAME,
+  DEFAULT_SOUL_DEFAULT_FILENAME,
   DEFAULT_SOUL_FILENAME,
   DEFAULT_IDENTITY_FILENAME,
   DEFAULT_USER_FILENAME,
@@ -76369,7 +76703,7 @@ function registerWorkspaceCommand(program3) {
       process.exit(1);
     }
     const editor = process.env["EDITOR"] ?? process.env["VISUAL"] ?? "vi";
-    const child = spawnSync9(editor, [target], { stdio: "inherit" });
+    const child = spawnSync10(editor, [target], { stdio: "inherit" });
     if (child.status !== 0 && child.status !== null) {
       process.exit(child.status);
     }
@@ -76431,12 +76765,12 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve38(dir, ".git");
-    if (!existsSync61(gitDir)) {
+    if (!existsSync62(gitDir)) {
       process.stdout.write(`Workspace is not a git repository. Re-run \`switchroom agent create ${agentName}\` ` + `or manually \`git init\` in ${dir} to enable versioning.
 `);
       return;
     }
-    const statusResult = spawnSync9("git", ["status", "--short"], {
+    const statusResult = spawnSync10("git", ["status", "--short"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -76451,7 +76785,7 @@ function registerWorkspaceCommand(program3) {
       return;
     }
     const message = opts.message || `checkpoint: ${new Date().toISOString()}`;
-    const addResult = spawnSync9("git", ["add", "-A"], {
+    const addResult = spawnSync10("git", ["add", "-A"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -76460,7 +76794,7 @@ function registerWorkspaceCommand(program3) {
 `);
       process.exit(1);
     }
-    const commitResult = spawnSync9("git", ["commit", "-m", message], {
+    const commitResult = spawnSync10("git", ["commit", "-m", message], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -76469,7 +76803,7 @@ function registerWorkspaceCommand(program3) {
 `);
       process.exit(1);
     }
-    const shaResult = spawnSync9("git", ["rev-parse", "--short", "HEAD"], {
+    const shaResult = spawnSync10("git", ["rev-parse", "--short", "HEAD"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -76485,12 +76819,12 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve38(dir, ".git");
-    if (!existsSync61(gitDir)) {
+    if (!existsSync62(gitDir)) {
       process.stdout.write(`Workspace is not a git repository.
 `);
       return;
     }
-    const child = spawnSync9("git", ["status", "--short"], {
+    const child = spawnSync10("git", ["status", "--short"], {
       cwd: dir,
       stdio: "inherit"
     });
@@ -76510,7 +76844,7 @@ function resolveAgentWorkspaceDirOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve38(agentsDir, agentName);
   const dir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync61(dir)) {
+  if (!existsSync62(dir)) {
     process.stderr.write(`workspace: ${dir} does not exist yet. Run \`switchroom setup\` or \`switchroom agent scaffold ${agentName}\` to seed it.
 `);
     return;
@@ -76546,8 +76880,8 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync10, existsSync as existsSync62, readFileSync as readFileSync54, writeFileSync as writeFileSync29 } from "node:fs";
-import { join as join61, resolve as resolve39 } from "node:path";
+import { copyFileSync as copyFileSync10, existsSync as existsSync63, readFileSync as readFileSync55, writeFileSync as writeFileSync30 } from "node:fs";
+import { join as join63, resolve as resolve39 } from "node:path";
 init_schema();
 function resolveSoulTargetOrExit(program3, agentName) {
   const config = getConfig(program3);
@@ -76562,7 +76896,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve39(agentsDir, agentName);
   const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync62(workspaceDir)) {
+  if (!existsSync63(workspaceDir)) {
     console.error(`soul: ${workspaceDir} does not exist yet. Run \`switchroom setup\` ` + `or \`switchroom agent scaffold ${agentName}\` to seed it.`);
     process.exit(1);
   }
@@ -76571,7 +76905,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join61(workspaceDir, "SOUL.md"),
+    soulPath: join63(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -76588,11 +76922,11 @@ function registerSoulCommand(program3) {
     const t = resolveSoulTargetOrExit(program3, agentName);
     if (!t)
       return;
-    if (!existsSync62(t.soulPath)) {
+    if (!existsSync63(t.soulPath)) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
-    process.stdout.write(readFileSync54(t.soulPath, "utf-8"));
+    process.stdout.write(readFileSync55(t.soulPath, "utf-8"));
   }));
   cmd.command("reset <agent>").description("Re-seed SOUL.md from the agent's current profile " + "(backs the existing file up to SOUL.md.bak first)").option("-y, --yes", "Skip the confirmation prompt").action(withConfigError(async (agentName, opts) => {
     const t = resolveSoulTargetOrExit(program3, agentName);
@@ -76603,7 +76937,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: profile "${t.profileName}" ships no SOUL.md.hbs \u2014 ` + `nothing to re-seed from.`);
       process.exit(1);
     }
-    const exists = existsSync62(t.soulPath);
+    const exists = existsSync63(t.soulPath);
     if (exists && !opts.yes) {
       if (!isInteractive()) {
         console.error(`soul: ${t.soulPath} already exists. Re-run with --yes to ` + `replace it (the current file is backed up to SOUL.md.bak).`);
@@ -76618,12 +76952,12 @@ function registerSoulCommand(program3) {
     let backupPath;
     if (exists) {
       backupPath = `${t.soulPath}.bak`;
-      if (existsSync62(backupPath)) {
+      if (existsSync63(backupPath)) {
         backupPath = `${t.soulPath}.bak.${Date.now()}`;
       }
       copyFileSync10(t.soulPath, backupPath);
     }
-    writeFileSync29(t.soulPath, content, "utf-8");
+    writeFileSync30(t.soulPath, content, "utf-8");
     if (backupPath) {
       console.log(`soul: re-seeded ${agentName}'s SOUL.md from profile ` + `"${t.profileName}".
 ` + `      Previous version saved to ${backupPath}`);
@@ -76637,8 +76971,8 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync63, readFileSync as readFileSync55, readdirSync as readdirSync22, statSync as statSync26 } from "node:fs";
-import { resolve as resolve40, join as join62 } from "node:path";
+import { existsSync as existsSync64, readFileSync as readFileSync56, readdirSync as readdirSync22, statSync as statSync26 } from "node:fs";
+import { resolve as resolve40, join as join64 } from "node:path";
 import { createHash as createHash13 } from "node:crypto";
 init_merge();
 init_hindsight();
@@ -76652,8 +76986,8 @@ function sha256(content) {
   return createHash13("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join62(claudeConfigDir, "projects");
-  if (!existsSync63(projectsDir))
+  const projectsDir = join64(claudeConfigDir, "projects");
+  if (!existsSync64(projectsDir))
     return;
   try {
     const entries = readdirSync22(projectsDir, { withFileTypes: true });
@@ -76661,9 +76995,9 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join62(projectsDir, entry.name);
-      const transcriptPath = join62(projectPath, "transcript.jsonl");
-      if (!existsSync63(transcriptPath))
+      const projectPath = join64(projectsDir, entry.name);
+      const transcriptPath = join64(projectPath, "transcript.jsonl");
+      if (!existsSync64(transcriptPath))
         continue;
       const stat3 = statSync26(transcriptPath);
       if (!latest || stat3.mtimeMs > latest.mtime) {
@@ -76677,7 +77011,7 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
 }
 function extractLatestUserMessage(transcriptPath) {
   try {
-    const content = readFileSync55(transcriptPath, "utf-8");
+    const content = readFileSync56(transcriptPath, "utf-8");
     const lines = content.trim().split(`
 `).filter(Boolean);
     for (let i = lines.length - 1;i >= 0; i--) {
@@ -76726,16 +77060,16 @@ function registerDebugCommand(program3) {
     }
     const agentsDir = resolveAgentsDir(config);
     const agentDir = resolve40(agentsDir, agentName);
-    if (!existsSync63(agentDir)) {
+    if (!existsSync64(agentDir)) {
       console.error(`Agent directory not found: ${agentDir}`);
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join62(agentDir, ".claude");
-    const claudeMdPath = join62(agentDir, "CLAUDE.md");
-    const soulMdPath = join62(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join62(workspaceDir, "SOUL.md");
-    const handoffPath = join62(agentDir, ".handoff.md");
+    const claudeConfigDir = join64(agentDir, ".claude");
+    const claudeMdPath = join64(agentDir, "CLAUDE.md");
+    const soulMdPath = join64(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join64(workspaceDir, "SOUL.md");
+    const handoffPath = join64(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -76781,7 +77115,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Append System Prompt (per-session) ===
 `);
-    const handoffContent = existsSync63(handoffPath) ? readFileSync55(handoffPath, "utf-8") : "";
+    const handoffContent = existsSync64(handoffPath) ? readFileSync56(handoffPath, "utf-8") : "";
     if (handoffContent.trim().length > 0) {
       console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
       console.log(handoffContent);
@@ -76792,7 +77126,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
 `);
-    const claudeMdContent = existsSync63(claudeMdPath) ? readFileSync55(claudeMdPath, "utf-8") : "";
+    const claudeMdContent = existsSync64(claudeMdPath) ? readFileSync56(claudeMdPath, "utf-8") : "";
     if (claudeMdContent.trim().length > 0) {
       console.log(`(${formatBytes(claudeMdContent.length)})`);
       console.log(claudeMdContent);
@@ -76803,7 +77137,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Persona (SOUL.md) ===
 `);
-    const soulMdContent = existsSync63(soulMdPath) ? readFileSync55(soulMdPath, "utf-8") : existsSync63(workspaceSoulMdPath) ? readFileSync55(workspaceSoulMdPath, "utf-8") : "";
+    const soulMdContent = existsSync64(soulMdPath) ? readFileSync56(soulMdPath, "utf-8") : existsSync64(workspaceSoulMdPath) ? readFileSync56(workspaceSoulMdPath, "utf-8") : "";
     if (soulMdContent.trim().length > 0) {
       console.log(`(${formatBytes(soulMdContent.length)})`);
       console.log(soulMdContent);
@@ -76884,44 +77218,44 @@ init_source();
 
 // src/worktree/claim.ts
 import { execFileSync as execFileSync20 } from "node:child_process";
-import { closeSync as closeSync12, mkdirSync as mkdirSync35, openSync as openSync12, existsSync as existsSync65, unlinkSync as unlinkSync13 } from "node:fs";
-import { join as join64, resolve as resolve42 } from "node:path";
-import { homedir as homedir38 } from "node:os";
+import { closeSync as closeSync12, mkdirSync as mkdirSync36, openSync as openSync12, existsSync as existsSync66, unlinkSync as unlinkSync13 } from "node:fs";
+import { join as join66, resolve as resolve42 } from "node:path";
+import { homedir as homedir39 } from "node:os";
 import { randomBytes as randomBytes13 } from "node:crypto";
 
 // src/worktree/registry.ts
 import {
-  mkdirSync as mkdirSync34,
-  writeFileSync as writeFileSync30,
-  readFileSync as readFileSync56,
+  mkdirSync as mkdirSync35,
+  writeFileSync as writeFileSync31,
+  readFileSync as readFileSync57,
   readdirSync as readdirSync23,
   unlinkSync as unlinkSync12,
-  existsSync as existsSync64,
+  existsSync as existsSync65,
   renameSync as renameSync13
 } from "node:fs";
-import { join as join63, resolve as resolve41 } from "node:path";
-import { homedir as homedir37 } from "node:os";
+import { join as join65, resolve as resolve41 } from "node:path";
+import { homedir as homedir38 } from "node:os";
 function registryDir() {
-  return resolve41(process.env.SWITCHROOM_WORKTREE_DIR ?? join63(homedir37(), ".switchroom", "worktrees"));
+  return resolve41(process.env.SWITCHROOM_WORKTREE_DIR ?? join65(homedir38(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join63(registryDir(), `${id}.json`);
+  return join65(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
-  mkdirSync34(registryDir(), { recursive: true });
+  mkdirSync35(registryDir(), { recursive: true });
 }
 function writeRecord(record2) {
   ensureDir2();
   const target = recordPath(record2.id);
   const tmp = `${target}.tmp${process.pid}`;
-  writeFileSync30(tmp, JSON.stringify(record2, null, 2) + `
+  writeFileSync31(tmp, JSON.stringify(record2, null, 2) + `
 `, { mode: 384 });
   renameSync13(tmp, target);
 }
 function readRecord(id) {
   const path7 = recordPath(id);
   try {
-    const raw = readFileSync56(path7, "utf8");
+    const raw = readFileSync57(path7, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -76954,9 +77288,9 @@ function countByRepo(repoPath) {
 // src/worktree/claim.ts
 function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
-  mkdirSync35(lockDir, { recursive: true });
+  mkdirSync36(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join64(lockDir, `.lock-${lockName}`);
+  const lockPath = join66(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -76983,7 +77317,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve42(process.env.SWITCHROOM_WORKTREE_BASE ?? join64(homedir38(), ".switchroom", "worktree-checkouts"));
+  return resolve42(process.env.SWITCHROOM_WORKTREE_BASE ?? join66(homedir39(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes13(4).toString("hex");
@@ -77005,12 +77339,12 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join64(homedir38(), p.slice(2));
+    return join66(homedir39(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
   const repoPath = resolveRepoPath(input.repo, codeRepos);
-  if (!existsSync65(repoPath)) {
+  if (!existsSync66(repoPath)) {
     throw new Error(`Repository path does not exist: ${repoPath}`);
   }
   let concurrencyCap = DEFAULT_CONCURRENCY;
@@ -77032,8 +77366,8 @@ async function claimWorktree(input, codeRepos) {
     const taskSuffix = input.taskName ? sanitizeTaskName(input.taskName) : "task";
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
-    mkdirSync35(baseDir, { recursive: true });
-    worktreePath = join64(baseDir, `${id}-${taskSuffix}`);
+    mkdirSync36(baseDir, { recursive: true });
+    worktreePath = join66(baseDir, `${id}-${taskSuffix}`);
     const now = new Date().toISOString();
     const record2 = {
       id,
@@ -77064,7 +77398,7 @@ async function claimWorktree(input, codeRepos) {
 
 // src/worktree/release.ts
 import { execFileSync as execFileSync21 } from "node:child_process";
-import { existsSync as existsSync66 } from "node:fs";
+import { existsSync as existsSync67 } from "node:fs";
 function releaseWorktree(input) {
   const { id } = input;
   const record2 = readRecord(id);
@@ -77072,7 +77406,7 @@ function releaseWorktree(input) {
     return { released: true };
   }
   let gitSuccess = true;
-  if (existsSync66(record2.path)) {
+  if (existsSync67(record2.path)) {
     try {
       execFileSync21("git", ["worktree", "remove", "--force", record2.path], {
         cwd: record2.repo,
@@ -77111,7 +77445,7 @@ function listWorktrees() {
 
 // src/worktree/reaper.ts
 import { execFileSync as execFileSync22 } from "node:child_process";
-import { existsSync as existsSync67 } from "node:fs";
+import { existsSync as existsSync68 } from "node:fs";
 var STALE_THRESHOLD_MS = 10 * 60 * 1000;
 function isPathInUse(path7) {
   try {
@@ -77138,7 +77472,7 @@ function hasUncommittedChanges(repoPath, worktreePath) {
 function reapRecord(record2) {
   const { id, path: path7, repo, branch, ownerAgent } = record2;
   let warning = null;
-  if (existsSync67(path7)) {
+  if (existsSync68(path7)) {
     if (hasUncommittedChanges(repo, path7)) {
       warning = `[worktree-reaper] Reaped worktree with uncommitted changes: ` + `id=${id} branch=${branch} agent=${ownerAgent ?? "unknown"} path=${path7}`;
     }
@@ -77159,7 +77493,7 @@ function runReaper(nowMs) {
   const warnings = [];
   for (const record2 of records) {
     const heartbeatAge = now - new Date(record2.heartbeatAt).getTime();
-    const worktreeExists = existsSync67(record2.path);
+    const worktreeExists = existsSync68(record2.path);
     if (!worktreeExists) {
       deleteRecord(record2.id);
       reaped.push(record2.id);
@@ -77283,12 +77617,12 @@ init_drive();
 init_scaffold_integration();
 import {
   chmodSync as chmodSync9,
-  mkdirSync as mkdirSync36,
+  mkdirSync as mkdirSync37,
   readdirSync as readdirSync24,
   rmSync as rmSync15,
-  writeFileSync as writeFileSync31
+  writeFileSync as writeFileSync32
 } from "node:fs";
-import { join as join65 } from "node:path";
+import { join as join67 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -77478,17 +77812,17 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join65(stateBase, "google-workspace-mcp", "credentials");
+  return join67(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
-  mkdirSync36(dir, { recursive: true, mode: 448 });
+  mkdirSync37(dir, { recursive: true, mode: 448 });
   chmodSync9(dir, 448);
   for (const name of readdirSync24(dir)) {
-    rmSync15(join65(dir, name), { force: true, recursive: true });
+    rmSync15(join67(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join65(dir, filename);
-  writeFileSync31(filePath, JSON.stringify(seed), { mode: 384 });
+  const filePath = join67(dir, filename);
+  writeFileSync32(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync9(filePath, 384);
   return filePath;
 }
@@ -77646,8 +77980,8 @@ function registerDriveMcpLauncherCommand(program3) {
 // src/cli/m365-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
-import { writeFileSync as writeFileSync32, mkdirSync as mkdirSync37 } from "node:fs";
-import { dirname as dirname17, join as join66 } from "node:path";
+import { writeFileSync as writeFileSync33, mkdirSync as mkdirSync38 } from "node:fs";
+import { dirname as dirname17, join as join68 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -77672,14 +78006,14 @@ function computeRefreshDelayMs(expiresAt, now, leadMs = DEFAULT_REFRESH_LEAD_MS)
 function writeRefreshHeartbeat(agentName, data) {
   const path7 = heartbeatPath(agentName);
   try {
-    mkdirSync37(dirname17(path7), { recursive: true });
-    writeFileSync32(path7, JSON.stringify(data, null, 2), { mode: 420 });
+    mkdirSync38(dirname17(path7), { recursive: true });
+    writeFileSync33(path7, JSON.stringify(data, null, 2), { mode: 420 });
   } catch {}
 }
 function heartbeatPath(agentName) {
   const override = process.env.SWITCHROOM_M365_HEARTBEAT_DIR;
   if (override) {
-    return join66(override, `m365-launcher-${agentName}.heartbeat.json`);
+    return join68(override, `m365-launcher-${agentName}.heartbeat.json`);
   }
   return "/state/agent/m365-launcher.heartbeat.json";
 }
@@ -77864,7 +78198,7 @@ function registerM365McpLauncherCommand(program3) {
 // src/cli/notion-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn7 } from "node:child_process";
-import { existsSync as existsSync68, mkdirSync as mkdirSync38, writeFileSync as writeFileSync33 } from "node:fs";
+import { existsSync as existsSync69, mkdirSync as mkdirSync39, writeFileSync as writeFileSync34 } from "node:fs";
 import { dirname as dirname18 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
 var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
@@ -77876,9 +78210,9 @@ function buildNotionMcpArgs(opts) {
 function defaultWriteHeartbeat(path7, contents) {
   try {
     const dir = dirname18(path7);
-    if (!existsSync68(dir))
-      mkdirSync38(dir, { recursive: true });
-    writeFileSync33(path7, contents);
+    if (!existsSync69(dir))
+      mkdirSync39(dir, { recursive: true });
+    writeFileSync34(path7, contents);
   } catch {}
 }
 async function runNotionMcpLauncher(opts, runtime) {
@@ -78235,7 +78569,7 @@ async function fetchToken(vaultKey) {
 
 // src/cli/apply.ts
 init_source();
-import { accessSync as accessSync3, chownSync as chownSync4, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync72, mkdirSync as mkdirSync40, readFileSync as readFileSync58, readdirSync as readdirSync26, renameSync as renameSync14, writeFileSync as writeFileSync35 } from "node:fs";
+import { accessSync as accessSync3, chownSync as chownSync4, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync73, mkdirSync as mkdirSync41, readFileSync as readFileSync59, readdirSync as readdirSync26, renameSync as renameSync14, writeFileSync as writeFileSync36 } from "node:fs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
@@ -78624,16 +78958,16 @@ agents:
 
 // src/cli/apply.ts
 init_resolver();
-import { dirname as dirname21, join as join70, resolve as resolve44 } from "node:path";
-import { homedir as homedir40 } from "node:os";
+import { dirname as dirname21, join as join72, resolve as resolve44 } from "node:path";
+import { homedir as homedir41 } from "node:os";
 import { execFileSync as execFileSync23 } from "node:child_process";
 init_vault();
 init_loader();
 init_loader();
 
 // src/cli/update-prompt-hook.ts
-import { existsSync as existsSync69, readFileSync as readFileSync57, writeFileSync as writeFileSync34, chmodSync as chmodSync10, mkdirSync as mkdirSync39 } from "node:fs";
-import { join as join67 } from "node:path";
+import { existsSync as existsSync70, readFileSync as readFileSync58, writeFileSync as writeFileSync35, chmodSync as chmodSync10, mkdirSync as mkdirSync40 } from "node:fs";
+import { join as join69 } from "node:path";
 var HOOK_FILENAME = "update-card-on-prompt.sh";
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -78699,14 +79033,14 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join67(agentDir, ".claude", "hooks");
-  mkdirSync39(hooksDir, { recursive: true });
-  const scriptPath = join67(hooksDir, HOOK_FILENAME);
+  const hooksDir = join69(agentDir, ".claude", "hooks");
+  mkdirSync40(hooksDir, { recursive: true });
+  const scriptPath = join69(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
-  const existing = existsSync69(scriptPath) ? readFileSync57(scriptPath, "utf-8") : "";
+  const existing = existsSync70(scriptPath) ? readFileSync58(scriptPath, "utf-8") : "";
   if (existing !== desired) {
-    writeFileSync34(scriptPath, desired, { mode: 493 });
+    writeFileSync35(scriptPath, desired, { mode: 493 });
     chmodSync10(scriptPath, 493);
     installed = true;
   } else {
@@ -78714,11 +79048,11 @@ function installUpdatePromptHook(agentDir) {
       chmodSync10(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join67(agentDir, ".claude", "settings.json");
-  if (!existsSync69(settingsPath)) {
+  const settingsPath = join69(agentDir, ".claude", "settings.json");
+  if (!existsSync70(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
-  const raw = readFileSync57(settingsPath, "utf-8");
+  const raw = readFileSync58(settingsPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -78751,7 +79085,7 @@ function installUpdatePromptHook(agentDir) {
     });
     hooks.UserPromptSubmit = list2;
     parsed.hooks = hooks;
-    writeFileSync34(settingsPath, JSON.stringify(parsed, null, 2) + `
+    writeFileSync35(settingsPath, JSON.stringify(parsed, null, 2) + `
 `, { mode: 384 });
     installed = true;
   }
@@ -78834,13 +79168,13 @@ function detectInstallType() {
 // src/cli/operator-uid.ts
 import {
   chownSync as chownSync3,
-  existsSync as existsSync71,
+  existsSync as existsSync72,
   lstatSync as lstatSync7,
   readdirSync as readdirSync25,
   realpathSync as realpathSync6,
   statSync as statSync27
 } from "node:fs";
-import { join as join69 } from "node:path";
+import { join as join71 } from "node:path";
 function resolveOperatorUid() {
   const sudoUid = process.env.SUDO_UID;
   if (sudoUid !== undefined) {
@@ -78856,19 +79190,19 @@ function resolveOperatorUid() {
   return;
 }
 function operatorOwnedPaths(home2) {
-  const root = join69(home2, ".switchroom");
+  const root = join71(home2, ".switchroom");
   return [
-    join69(root, "vault"),
-    join69(root, "vault-auto-unlock"),
-    join69(root, "vault-audit.log"),
-    join69(root, "host-control-audit.log"),
-    join69(root, "accounts"),
-    join69(root, "compose")
+    join71(root, "vault"),
+    join71(root, "vault-auto-unlock"),
+    join71(root, "vault-audit.log"),
+    join71(root, "host-control-audit.log"),
+    join71(root, "accounts"),
+    join71(root, "compose")
   ];
 }
 function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
   const chown = deps.chown ?? ((p, u, g) => chownSync3(p, u, g));
-  const exists = deps.exists ?? ((p) => existsSync71(p));
+  const exists = deps.exists ?? ((p) => existsSync72(p));
   const isSymlink = deps.isSymlink ?? ((p) => {
     try {
       return lstatSync7(p).isSymbolicLink();
@@ -78912,7 +79246,7 @@ function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
     } catch {}
     if (isDir(target)) {
       for (const entry of readdir2(target)) {
-        visit(join69(target, entry));
+        visit(join71(target, entry));
       }
     }
   };
@@ -78926,17 +79260,17 @@ var EMBEDDED_EXAMPLES = {
   switchroom: switchroom_default,
   minimal: minimal_default
 };
-var DEFAULT_COMPOSE_PATH2 = join70(homedir40(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH2 = join72(homedir41(), ".switchroom", "compose", "docker-compose.yml");
 var COMPOSE_PROJECT2 = "switchroom";
 function resolveVaultBindMountDir(homeDir, ctx) {
   const isCustomPath = ctx.migrationKind === "custom-path-skipped";
   if (isCustomPath && ctx.customVaultPath) {
     return dirname21(ctx.customVaultPath);
   }
-  return join70(homeDir, ".switchroom", "vault");
+  return join72(homeDir, ".switchroom", "vault");
 }
 function inspectVaultBindMountDir(vaultDir) {
-  if (!existsSync72(vaultDir))
+  if (!existsSync73(vaultDir))
     return { kind: "missing" };
   const entries = readdirSync26(vaultDir);
   const unknown = [];
@@ -78962,63 +79296,63 @@ function hasVaultRefs(value) {
   return false;
 }
 async function ensureHostMountSources(config) {
-  const home2 = homedir40();
+  const home2 = homedir41();
   const dirs = [
-    join70(home2, ".switchroom", "approvals"),
-    join70(home2, ".switchroom", "scheduler"),
-    join70(home2, ".switchroom", "logs"),
-    join70(home2, ".switchroom", "compose"),
-    join70(home2, ".switchroom", "broker-operator")
+    join72(home2, ".switchroom", "approvals"),
+    join72(home2, ".switchroom", "scheduler"),
+    join72(home2, ".switchroom", "logs"),
+    join72(home2, ".switchroom", "compose"),
+    join72(home2, ".switchroom", "broker-operator")
   ];
   for (const name of Object.keys(config.agents)) {
-    dirs.push(join70(home2, ".switchroom", "agents", name));
-    dirs.push(join70(home2, ".switchroom", "logs", name));
-    dirs.push(join70(home2, ".claude", "projects", name));
-    dirs.push(join70(home2, ".switchroom", "audit", name));
-    if (existsSync72(join70(home2, ".switchroom-config"))) {
-      dirs.push(join70(home2, ".switchroom-config", "agents", name, "personal-skills"));
+    dirs.push(join72(home2, ".switchroom", "agents", name));
+    dirs.push(join72(home2, ".switchroom", "logs", name));
+    dirs.push(join72(home2, ".claude", "projects", name));
+    dirs.push(join72(home2, ".switchroom", "audit", name));
+    if (existsSync73(join72(home2, ".switchroom-config"))) {
+      dirs.push(join72(home2, ".switchroom-config", "agents", name, "personal-skills"));
     }
   }
   for (const dir of dirs) {
     await mkdir(dir, { recursive: true });
   }
-  const autoUnlockPath = join70(home2, ".switchroom", "vault-auto-unlock");
-  if (!existsSync72(autoUnlockPath)) {
-    writeFileSync35(autoUnlockPath, "", { mode: 384 });
+  const autoUnlockPath = join72(home2, ".switchroom", "vault-auto-unlock");
+  if (!existsSync73(autoUnlockPath)) {
+    writeFileSync36(autoUnlockPath, "", { mode: 384 });
   }
-  const auditLogPath = join70(home2, ".switchroom", "vault-audit.log");
-  if (!existsSync72(auditLogPath)) {
-    writeFileSync35(auditLogPath, "", { mode: 420 });
+  const auditLogPath = join72(home2, ".switchroom", "vault-audit.log");
+  if (!existsSync73(auditLogPath)) {
+    writeFileSync36(auditLogPath, "", { mode: 420 });
   }
-  const grantsDbPath = join70(home2, ".switchroom", "vault-grants.db");
-  if (!existsSync72(grantsDbPath)) {
-    writeFileSync35(grantsDbPath, "", { mode: 384 });
+  const grantsDbPath = join72(home2, ".switchroom", "vault-grants.db");
+  if (!existsSync73(grantsDbPath)) {
+    writeFileSync36(grantsDbPath, "", { mode: 384 });
   }
-  const hostdAuditLogPath = join70(home2, ".switchroom", "host-control-audit.log");
-  if (!existsSync72(hostdAuditLogPath)) {
-    writeFileSync35(hostdAuditLogPath, "", { mode: 420 });
+  const hostdAuditLogPath = join72(home2, ".switchroom", "host-control-audit.log");
+  if (!existsSync73(hostdAuditLogPath)) {
+    writeFileSync36(hostdAuditLogPath, "", { mode: 420 });
   }
   for (const name of Object.keys(config.agents)) {
-    const tokenPath = join70(home2, ".switchroom", "agents", name, ".vault-token");
-    if (!existsSync72(tokenPath)) {
-      writeFileSync35(tokenPath, "", { mode: 384 });
+    const tokenPath = join72(home2, ".switchroom", "agents", name, ".vault-token");
+    if (!existsSync73(tokenPath)) {
+      writeFileSync36(tokenPath, "", { mode: 384 });
     }
     try {
       const uid = allocateAgentUid(name);
       chownSync4(tokenPath, uid, uid);
     } catch {}
   }
-  const fleetDir = join70(home2, ".switchroom", "fleet");
+  const fleetDir = join72(home2, ".switchroom", "fleet");
   await mkdir(fleetDir, { recursive: true });
-  const invariantsPath = join70(fleetDir, "switchroom-invariants.md");
+  const invariantsPath = join72(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
-  const invariantsCurrent = existsSync72(invariantsPath) ? readFileSync58(invariantsPath, "utf-8") : null;
+  const invariantsCurrent = existsSync73(invariantsPath) ? readFileSync59(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
-    writeFileSync35(invariantsPath, invariantsCanonical, { mode: 420 });
+    writeFileSync36(invariantsPath, invariantsCanonical, { mode: 420 });
   }
-  const fleetClaudePath = join70(fleetDir, "CLAUDE.md");
-  if (!existsSync72(fleetClaudePath)) {
-    writeFileSync35(fleetClaudePath, [
+  const fleetClaudePath = join72(fleetDir, "CLAUDE.md");
+  if (!existsSync73(fleetClaudePath)) {
+    writeFileSync36(fleetClaudePath, [
       "# Switchroom fleet defaults",
       "",
       "Operator-owned fleet brain. Every agent reads this via",
@@ -79049,7 +79383,7 @@ ${out.trim()}`;
 }
 function runApplyPreflight(config, opts = {}) {
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (hasVaultRefs(config) && !existsSync72(vaultPath)) {
+  if (hasVaultRefs(config) && !existsSync73(vaultPath)) {
     throw new Error(`Config references vault keys (vault:<name>) but ${vaultPath} is missing. ` + `Run \`switchroom setup\` first to initialise the vault.`);
   }
   const detect = opts.detectComposeV2 ?? detectComposeV2;
@@ -79060,7 +79394,7 @@ function runApplyPreflight(config, opts = {}) {
   detectAndReportLegacyGdriveSlots(vaultPath);
 }
 function detectAndReportLegacyGdriveSlots(vaultPath) {
-  if (!existsSync72(vaultPath))
+  if (!existsSync73(vaultPath))
     return;
   const passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
   if (!passphrase)
@@ -79099,18 +79433,18 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 `));
   }
 }
-function writeInstallTypeCache(homeDir = homedir40()) {
+function writeInstallTypeCache(homeDir = homedir41()) {
   const ctx = detectInstallType();
-  const dir = join70(homeDir, ".switchroom");
-  const out = join70(dir, "install-type.json");
+  const dir = join72(homeDir, ".switchroom");
+  const out = join72(dir, "install-type.json");
   const tmp = `${out}.tmp`;
-  mkdirSync40(dir, { recursive: true });
+  mkdirSync41(dir, { recursive: true });
   const payload = {
     install_type: ctx.install_type,
     detected_at: new Date().toISOString(),
     source_paths: ctx.source_paths
   };
-  writeFileSync35(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
+  writeFileSync36(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
   renameSync14(tmp, out);
   return out;
 }
@@ -79151,14 +79485,14 @@ Applying switchroom config...
       writeOut(source_default.green(`  + ${name}`) + source_default.gray(` (${agentConfig.extends ?? "default"}) \u2014 ${detail}
 `));
       try {
-        installUpdatePromptHook(join70(agentsDir, name));
+        installUpdatePromptHook(join72(agentsDir, name));
       } catch (hookErr) {
         writeOut(source_default.gray(`    (update-prompt hook install failed for ${name}: ${hookErr.message})
 `));
       }
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join70(agentsDir, name), uid, {
+        alignAgentUid(name, join72(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -79195,7 +79529,7 @@ Applying switchroom config...
     for (const name of agentNames) {
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join70(agentsDir, name), uid, {
+        alignAgentUid(name, join72(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -79209,7 +79543,7 @@ Applying switchroom config...
   }
   const vaultPathConfigured = config.vault?.path;
   const customVaultPath = vaultPathConfigured ? resolvePath(vaultPathConfigured) : undefined;
-  const migrationResult = migrateVaultLayout(homedir40(), {
+  const migrationResult = migrateVaultLayout(homedir41(), {
     customVaultPath
   });
   switch (migrationResult.kind) {
@@ -79235,7 +79569,7 @@ Applying switchroom config...
       writeErr(formatDivergentRecoveryMessage(migrationResult.details));
       process.exit(4);
   }
-  const postMigrationInspect = inspectVaultLayout(homedir40());
+  const postMigrationInspect = inspectVaultLayout(homedir41());
   const acceptable = [
     "no-vault",
     "already-migrated",
@@ -79250,7 +79584,7 @@ Applying switchroom config...
 `));
     process.exit(5);
   }
-  const vaultDir = resolveVaultBindMountDir(homedir40(), {
+  const vaultDir = resolveVaultBindMountDir(homedir41(), {
     migrationKind: migrationResult.kind,
     customVaultPath
   });
@@ -79280,7 +79614,7 @@ Applying switchroom config...
     imageTag: composeImageTag,
     buildMode: options.buildLocal ? "local" : "pull",
     buildContext: options.buildContext,
-    homeDir: homedir40(),
+    homeDir: homedir41(),
     switchroomConfigPath,
     operatorUid
   });
@@ -79300,7 +79634,7 @@ Wrote `) + composePath + source_default.gray(` (${composeBytes} bytes)
   writeOut(source_default.gray(`  (If pull returns 401, login to ghcr.io first: see docs/operators/install.md#ghcr-auth)
 `));
   if (process.geteuid?.() === 0 && operatorUid !== undefined) {
-    const restored = restoreOperatorOwnership(homedir40(), operatorUid);
+    const restored = restoreOperatorOwnership(homedir41(), operatorUid);
     if (restored.length > 0) {
       writeOut(source_default.gray(`  Restored operator ownership of ${restored.length} ~/.switchroom path(s)
 `));
@@ -79348,18 +79682,18 @@ function copyExampleConfig2(name) {
     throw new Error(`Invalid example name: ${name} (must match /^[a-z0-9_-]+$/)`);
   }
   const dest = resolve44(process.cwd(), "switchroom.yaml");
-  if (existsSync72(dest)) {
+  if (existsSync73(dest)) {
     console.error(source_default.yellow("switchroom.yaml already exists \u2014 skipping example copy"));
     return;
   }
   const embedded = EMBEDDED_EXAMPLES[name];
   if (embedded !== undefined) {
-    writeFileSync35(dest, embedded, { encoding: "utf8" });
+    writeFileSync36(dest, embedded, { encoding: "utf8" });
     console.log(source_default.green(`Copied ${name}.yaml -> switchroom.yaml`));
     return;
   }
   const exampleFile = resolve44(import.meta.dirname, `../../examples/${name}.yaml`);
-  if (!existsSync72(exampleFile)) {
+  if (!existsSync73(exampleFile)) {
     throw new Error(`Example config not found: ${name}.yaml (available: ${Object.keys(EMBEDDED_EXAMPLES).join(", ")})`);
   }
   copyFileSync11(exampleFile, dest);
@@ -79370,8 +79704,8 @@ function findUnwritableAgentDirs(config, opts) {
   const targets = opts.only ? [opts.only] : Object.keys(config.agents ?? {});
   const unwritable = [];
   for (const name of targets) {
-    const startSh = join70(agentsDir, name, "start.sh");
-    if (!existsSync72(startSh))
+    const startSh = join72(agentsDir, name, "start.sh");
+    if (!existsSync73(startSh))
       continue;
     try {
       accessSync3(startSh, fsConstants6.W_OK);
@@ -79549,9 +79883,9 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync59, existsSync as existsSync73, readdirSync as readdirSync27 } from "node:fs";
-import { join as join71 } from "node:path";
-import { homedir as homedir41 } from "node:os";
+import { readFileSync as readFileSync60, existsSync as existsSync74, readdirSync as readdirSync27 } from "node:fs";
+import { join as join73 } from "node:path";
+import { homedir as homedir42 } from "node:os";
 
 // src/status-ask/report.ts
 function parseJsonl(content) {
@@ -79825,7 +80159,7 @@ function runReport(opts) {
   for (const src of sources) {
     let content;
     try {
-      content = readFileSync59(src.path, "utf-8");
+      content = readFileSync60(src.path, "utf-8");
     } catch (err) {
       process.stderr.write(`status-ask report: cannot read ${src.path}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -79872,7 +80206,7 @@ function runReport(opts) {
 function resolveSources(explicitPath) {
   if (explicitPath != null && explicitPath.trim() !== "") {
     const trimmed = explicitPath.trim();
-    if (!existsSync73(trimmed)) {
+    if (!existsSync74(trimmed)) {
       process.stderr.write(`status-ask report: ${trimmed}: file not found
 `);
       process.exit(1);
@@ -79886,9 +80220,9 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join71(homedir41(), ".switchroom", "agents");
+    agentsDir = join73(homedir42(), ".switchroom", "agents");
   }
-  if (!existsSync73(agentsDir))
+  if (!existsSync74(agentsDir))
     return [];
   const sources = [];
   let entries;
@@ -79898,8 +80232,8 @@ function resolveSources(explicitPath) {
     return [];
   }
   for (const name of entries) {
-    const path8 = join71(agentsDir, name, "runtime-metrics.jsonl");
-    if (existsSync73(path8)) {
+    const path8 = join73(agentsDir, name, "runtime-metrics.jsonl");
+    if (existsSync74(path8)) {
       sources.push({ path: path8, agent: name });
     }
   }
@@ -79920,17 +80254,17 @@ function inferAgentFromPath(p) {
 
 // src/cli/agent-config.ts
 init_helpers();
-import { join as join72 } from "node:path";
-import { homedir as homedir42 } from "node:os";
+import { join as join74 } from "node:path";
+import { homedir as homedir43 } from "node:os";
 import {
-  existsSync as existsSync74,
-  mkdirSync as mkdirSync41,
+  existsSync as existsSync75,
+  mkdirSync as mkdirSync42,
   appendFileSync as appendFileSync4,
-  readFileSync as readFileSync60
+  readFileSync as readFileSync61
 } from "node:fs";
-var AUDIT_ROOT = join72(homedir42(), ".switchroom", "audit");
+var AUDIT_ROOT = join74(homedir43(), ".switchroom", "audit");
 function auditPathFor(agent) {
-  return join72(AUDIT_ROOT, agent, "agent-config.jsonl");
+  return join74(AUDIT_ROOT, agent, "agent-config.jsonl");
 }
 function appendAudit(agent, cmd, args, exit, opts = {}) {
   const row = {
@@ -79944,8 +80278,8 @@ function appendAudit(agent, cmd, args, exit, opts = {}) {
   const path8 = opts.auditPath ?? auditPathFor(agent);
   const dir = path8.slice(0, path8.lastIndexOf("/"));
   try {
-    if (!existsSync74(dir)) {
-      mkdirSync41(dir, { recursive: true });
+    if (!existsSync75(dir)) {
+      mkdirSync42(dir, { recursive: true });
     }
     appendFileSync4(path8, JSON.stringify(row) + `
 `, { flag: "a" });
@@ -79956,7 +80290,7 @@ function isContainerContext(env2 = process.env, opts = {}) {
     return true;
   const probe2 = opts.dockerEnvPath ?? "/.dockerenv";
   try {
-    if (existsSync74(probe2))
+    if (existsSync75(probe2))
       return true;
   } catch {}
   return false;
@@ -80017,11 +80351,11 @@ function getAgentSlice(config, agent) {
 }
 function readAuditTail(agent, limit, opts = {}) {
   const path8 = opts.auditPath ?? auditPathFor(agent);
-  if (!existsSync74(path8))
+  if (!existsSync75(path8))
     return [];
   let raw;
   try {
-    raw = readFileSync60(path8, "utf-8");
+    raw = readFileSync61(path8, "utf-8");
   } catch {
     return [];
   }
@@ -80171,51 +80505,51 @@ function registerAgentConfigCommands(program3) {
 }
 
 // src/cli/agent-config-write.ts
-var import_yaml17 = __toESM(require_dist(), 1);
+var import_yaml19 = __toESM(require_dist(), 1);
 
 // src/config/overlay-writer.ts
 init_paths();
 import {
   closeSync as closeSync13,
-  existsSync as existsSync75,
+  existsSync as existsSync76,
   fsyncSync as fsyncSync6,
-  mkdirSync as mkdirSync42,
+  mkdirSync as mkdirSync43,
   openSync as openSync13,
   readdirSync as readdirSync28,
-  readFileSync as readFileSync61,
+  readFileSync as readFileSync62,
   renameSync as renameSync15,
   statSync as statSync28,
   unlinkSync as unlinkSync14,
   writeSync as writeSync8
 } from "node:fs";
-import { join as join73, resolve as resolve45 } from "node:path";
+import { join as join75, resolve as resolve45 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
   const base = opts.root ? resolve45(opts.root, agent) : resolve45(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join73(base, "schedule.d");
-  const scheduleStagingDir = join73(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join73(base, "skills.d");
-  const skillsStagingDir = join73(skillsDir, STAGING_SUBDIR);
+  const scheduleDir = join75(base, "schedule.d");
+  const scheduleStagingDir = join75(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join75(base, "skills.d");
+  const skillsStagingDir = join75(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join73(base, ".lock"),
+    lockPath: join75(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
 function ensureDirs(paths) {
-  mkdirSync42(paths.scheduleDir, { recursive: true });
-  mkdirSync42(paths.scheduleStagingDir, { recursive: true });
+  mkdirSync43(paths.scheduleDir, { recursive: true });
+  mkdirSync43(paths.scheduleStagingDir, { recursive: true });
 }
 function ensureSkillsDirs(paths) {
-  mkdirSync42(paths.skillsDir, { recursive: true });
-  mkdirSync42(paths.skillsStagingDir, { recursive: true });
+  mkdirSync43(paths.skillsDir, { recursive: true });
+  mkdirSync43(paths.skillsStagingDir, { recursive: true });
 }
 function withAgentLock(paths, fn) {
-  mkdirSync42(paths.agentRoot, { recursive: true });
+  mkdirSync43(paths.agentRoot, { recursive: true });
   const start = Date.now();
   const TIMEOUT_MS = 5000;
   let fd = null;
@@ -80256,8 +80590,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join73(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join73(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join75(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join75(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -80273,8 +80607,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join73(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join73(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join75(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join75(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -80289,8 +80623,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join73(paths.skillsDir, `${slug}.yaml`);
-    if (!existsSync75(finalPath))
+    const finalPath = join75(paths.skillsDir, `${slug}.yaml`);
+    if (!existsSync76(finalPath))
       return false;
     unlinkSync14(finalPath);
     return true;
@@ -80298,15 +80632,15 @@ function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
 }
 function listSkillsOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync75(paths.skillsDir))
+  if (!existsSync76(paths.skillsDir))
     return [];
   const out = [];
   for (const name of readdirSync28(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join73(paths.skillsDir, name);
+    const full = join75(paths.skillsDir, name);
     try {
-      const raw = readFileSync61(full, "utf-8");
+      const raw = readFileSync62(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -80316,8 +80650,8 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join73(paths.scheduleDir, `${slug}.yaml`);
-    if (!existsSync75(finalPath))
+    const finalPath = join75(paths.scheduleDir, `${slug}.yaml`);
+    if (!existsSync76(finalPath))
       return false;
     unlinkSync14(finalPath);
     return true;
@@ -80325,15 +80659,15 @@ function deleteOverlayEntry(agent, slug, opts = {}) {
 }
 function listOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync75(paths.scheduleDir))
+  if (!existsSync76(paths.scheduleDir))
     return [];
   const out = [];
   for (const name of readdirSync28(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join73(paths.scheduleDir, name);
+    const full = join75(paths.scheduleDir, name);
     try {
-      const raw = readFileSync61(full, "utf-8");
+      const raw = readFileSync62(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -80364,7 +80698,7 @@ function filterOverlaySecrets(doc, source) {
 // src/agents/reconcile-dry-run.ts
 init_overlay_schema();
 init_schema();
-var import_yaml16 = __toESM(require_dist(), 1);
+var import_yaml18 = __toESM(require_dist(), 1);
 init_lifecycle();
 var MIN_CRON_INTERVAL_SECS = 5 * 60;
 function violatesMinInterval(cron) {
@@ -80386,7 +80720,7 @@ function violatesMinInterval(cron) {
 function dryRunReconcile(input) {
   let parsed;
   try {
-    parsed = import_yaml16.parse(input.yamlText);
+    parsed = import_yaml18.parse(input.yamlText);
   } catch (err) {
     return {
       ok: false,
@@ -80476,27 +80810,27 @@ function reconcileAgentCronOnly(agent) {
 // src/cli/agent-config-pending.ts
 import {
   closeSync as closeSync14,
-  existsSync as existsSync76,
+  existsSync as existsSync77,
   fsyncSync as fsyncSync7,
-  mkdirSync as mkdirSync43,
+  mkdirSync as mkdirSync44,
   openSync as openSync14,
   readdirSync as readdirSync29,
-  readFileSync as readFileSync62,
+  readFileSync as readFileSync63,
   renameSync as renameSync16,
   unlinkSync as unlinkSync15,
-  writeFileSync as writeFileSync36,
+  writeFileSync as writeFileSync37,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join74 } from "node:path";
+import { join as join76 } from "node:path";
 import { randomBytes as randomBytes14 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join74(paths.scheduleDir, ".pending");
+  return join76(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  mkdirSync43(dir, { recursive: true });
+  mkdirSync44(dir, { recursive: true });
   return dir;
 }
 function newStageId() {
@@ -80505,8 +80839,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join74(dir, `${stageId}.yaml`);
-  const metaPath = join74(dir, `${stageId}.meta.json`);
+  const yamlPath = join76(dir, `${stageId}.yaml`);
+  const metaPath = join76(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -80527,25 +80861,25 @@ function stagePendingScheduleEntry(opts) {
     }
     renameSync16(yamlTmp, yamlPath);
   }
-  writeFileSync36(metaPath, JSON.stringify(meta, null, 2) + `
+  writeFileSync37(metaPath, JSON.stringify(meta, null, 2) + `
 `, { mode: 384 });
   return { stageId, yamlPath, metaPath };
 }
 function listPendingScheduleEntries(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  if (!existsSync76(dir))
+  if (!existsSync77(dir))
     return [];
   const out = [];
   for (const name of readdirSync29(dir).sort()) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join74(dir, name);
-    const yamlPath = join74(dir, `${stageId}.yaml`);
-    if (!existsSync76(yamlPath))
+    const metaPath = join76(dir, name);
+    const yamlPath = join76(dir, `${stageId}.yaml`);
+    if (!existsSync77(yamlPath))
       continue;
     try {
-      const meta = JSON.parse(readFileSync62(metaPath, "utf-8"));
+      const meta = JSON.parse(readFileSync63(metaPath, "utf-8"));
       if (meta?.v !== 1 || typeof meta.stage_id !== "string")
         continue;
       out.push({ stageId: meta.stage_id, agent: meta.agent, yamlPath, metaPath, meta });
@@ -80560,8 +80894,8 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join74(paths.scheduleDir, `${slug}.yaml`);
-  if (existsSync76(finalPath)) {
+  const finalPath = join76(paths.scheduleDir, `${slug}.yaml`);
+  if (existsSync77(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
   renameSync16(match.yamlPath, finalPath);
@@ -80584,7 +80918,7 @@ function denyPendingScheduleEntry(opts) {
 
 // src/cli/agent-config-write.ts
 init_protocol3();
-import { existsSync as existsSync77, readFileSync as readFileSync63 } from "node:fs";
+import { existsSync as existsSync78, readFileSync as readFileSync64 } from "node:fs";
 var MAX_ENTRIES_PER_AGENT = 20;
 var MIN_CRON_INTERVAL_MIN = 5;
 function extractCronSmallestGapMin(expr) {
@@ -80692,7 +81026,7 @@ function scheduleAdd(opts) {
     ]
   };
   const yamlText = (() => {
-    const body = import_yaml17.stringify(doc);
+    const body = import_yaml19.stringify(doc);
     const header = opts.name ? `# name: ${opts.name}
 ` : "";
     return header + body;
@@ -80802,7 +81136,7 @@ function scheduleAddOrStage(opts) {
     ]
   };
   const yamlText = (opts.name ? `# name: ${opts.name}
-` : "") + import_yaml17.stringify(doc);
+` : "") + import_yaml19.stringify(doc);
   const summary = (() => {
     const parts = [`cron=${opts.cronExpr}`];
     if (opts.secrets?.length)
@@ -80852,7 +81186,7 @@ function scheduleRemove(opts) {
         break;
       }
       try {
-        const parsed = import_yaml17.parse(e.raw);
+        const parsed = import_yaml19.parse(e.raw);
         if (parsed && parsed.name === opts.name) {
           match = e;
           break;
@@ -80870,8 +81204,8 @@ function scheduleRemove(opts) {
   }
   let priorContent = null;
   try {
-    if (existsSync77(match.path))
-      priorContent = readFileSync63(match.path, "utf-8");
+    if (existsSync78(match.path))
+      priorContent = readFileSync64(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
   const reconcileFn = opts.reconcile === undefined ? opts.root ? null : reconcileAgentCronOnly : opts.reconcile;
@@ -81062,11 +81396,11 @@ function registerAgentConfigWriteCommands(program3) {
 }
 
 // src/cli/agent-config-skill-write.ts
-var import_yaml18 = __toESM(require_dist(), 1);
-import { existsSync as existsSync78 } from "node:fs";
+var import_yaml20 = __toESM(require_dist(), 1);
+import { existsSync as existsSync79 } from "node:fs";
 init_reconcile_default_skills();
-var import_yaml19 = __toESM(require_dist(), 1);
-import { join as join75 } from "node:path";
+var import_yaml21 = __toESM(require_dist(), 1);
+import { join as join77 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -81115,7 +81449,7 @@ function countCurrentSkills(agent, opts) {
   let total = 0;
   for (const e of entries) {
     try {
-      const doc = import_yaml19.parse(e.raw);
+      const doc = import_yaml21.parse(e.raw);
       total += (doc?.skills ?? []).length;
     } catch {}
   }
@@ -81141,11 +81475,11 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join75(poolDir, skillName);
-  if (!existsSync78(skillPath)) {
+  const skillPath = join77(poolDir, skillName);
+  if (!existsSync79(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
-  const yamlText = import_yaml18.stringify({ skills: [skillName] });
+  const yamlText = import_yaml20.stringify({ skills: [skillName] });
   let path8;
   try {
     path8 = writeSkillsOverlayEntry(agent, slug, yamlText, { root: opts.root });
@@ -81306,25 +81640,25 @@ function registerAgentConfigSkillWriteCommands(program3) {
 // src/cli/skill.ts
 import {
   closeSync as closeSync15,
-  existsSync as existsSync79,
+  existsSync as existsSync80,
   lstatSync as lstatSync8,
-  mkdirSync as mkdirSync44,
+  mkdirSync as mkdirSync45,
   mkdtempSync as mkdtempSync5,
   openSync as openSync15,
-  readFileSync as readFileSync64,
+  readFileSync as readFileSync65,
   readdirSync as readdirSync30,
   realpathSync as realpathSync7,
   renameSync as renameSync17,
   rmSync as rmSync16,
   statSync as statSync29,
-  writeFileSync as writeFileSync37
+  writeFileSync as writeFileSync38
 } from "node:fs";
-import { tmpdir as tmpdir4, homedir as homedir43 } from "node:os";
-import { dirname as dirname22, join as join76, relative as relative2, resolve as resolve46 } from "node:path";
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { tmpdir as tmpdir5, homedir as homedir44 } from "node:os";
+import { dirname as dirname22, join as join78, relative as relative2, resolve as resolve46 } from "node:path";
+import { spawnSync as spawnSync11 } from "node:child_process";
 
 // src/cli/skill-common.ts
-var import_yaml20 = __toESM(require_dist(), 1);
+var import_yaml22 = __toESM(require_dist(), 1);
 var MAX_FILE_BYTES = 256 * 1024;
 var MAX_SKILL_BYTES = 2 * 1024 * 1024;
 var MAX_FILES_PER_SKILL = 50;
@@ -81428,7 +81762,7 @@ function validateSkillMd(content, expectedName) {
   }
   let parsed;
   try {
-    parsed = import_yaml20.parse(fmText);
+    parsed = import_yaml22.parse(fmText);
   } catch (e) {
     return authorErr("E_SKILL_INVALID_FRONTMATTER", `frontmatter is not valid YAML: ${e.message}`);
   }
@@ -81514,10 +81848,10 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join76(homedir43(), raw.slice(2));
+    return join78(homedir44(), raw.slice(2));
   }
   if (raw === "~")
-    return homedir43();
+    return homedir44();
   return resolve46(raw);
 }
 function readStdinSync() {
@@ -81553,7 +81887,7 @@ function loadFromDir(dir) {
   const walk2 = (sub) => {
     const entries = readdirSync30(sub, { withFileTypes: true });
     for (const ent of entries) {
-      const full = join76(sub, ent.name);
+      const full = join78(sub, ent.name);
       const rel = relative2(abs, full);
       if (ent.isSymbolicLink()) {
         fail2(`refusing to read symlink inside --from dir: ${rel}`);
@@ -81563,7 +81897,7 @@ function loadFromDir(dir) {
         continue;
       }
       if (ent.isFile()) {
-        const buf = readFileSync64(full);
+        const buf = readFileSync65(full);
         files[rel.replace(/\\/g, "/")] = buf.toString("utf-8");
       }
     }
@@ -81574,7 +81908,7 @@ function loadFromDir(dir) {
 function loadFromTarball(tarPath) {
   const isGz = tarPath.endsWith(".gz") || tarPath.endsWith(".tgz");
   const listFlags = isGz ? ["-tzf"] : ["-tf"];
-  const list2 = spawnSync10("tar", [...listFlags, tarPath], {
+  const list2 = spawnSync11("tar", [...listFlags, tarPath], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -81588,10 +81922,10 @@ function loadFromTarball(tarPath) {
       fail2(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
-  const staging = mkdtempSync5(join76(tmpdir4(), "skill-apply-extract-"));
+  const staging = mkdtempSync5(join78(tmpdir5(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
-    const r = spawnSync10("tar", [
+    const r = spawnSync11("tar", [
       ...flags,
       tarPath,
       "-C",
@@ -81612,7 +81946,7 @@ function loadFromTarball(tarPath) {
   }
 }
 function loadSingleFile(filePath) {
-  const content = readFileSync64(filePath, "utf-8");
+  const content = readFileSync65(filePath, "utf-8");
   return { "SKILL.md": content };
 }
 function loadFromStdin() {
@@ -81666,7 +82000,7 @@ function validatePayload(name, files) {
   if (errors2.length === 0) {
     for (const [path8, content] of Object.entries(files)) {
       if (SH_SCRIPT_RE2.test(path8)) {
-        const r = spawnSync10("bash", ["-n"], {
+        const r = spawnSync11("bash", ["-n"], {
           input: content,
           encoding: "utf-8"
         });
@@ -81674,11 +82008,11 @@ function validatePayload(name, files) {
           errors2.push(`${path8} fails \`bash -n\` syntax check: ${(r.stderr ?? "").trim()}`);
         }
       } else if (PY_SCRIPT_RE2.test(path8)) {
-        const tmp = mkdtempSync5(join76(tmpdir4(), "skill-apply-py-"));
-        const tmpPy = join76(tmp, "check.py");
+        const tmp = mkdtempSync5(join78(tmpdir5(), "skill-apply-py-"));
+        const tmpPy = join78(tmp, "check.py");
         try {
-          writeFileSync37(tmpPy, content);
-          const r = spawnSync10("python3", ["-m", "py_compile", tmpPy], {
+          writeFileSync38(tmpPy, content);
+          const r = spawnSync11("python3", ["-m", "py_compile", tmpPy], {
             encoding: "utf-8"
           });
           if (r.status !== 0) {
@@ -81695,15 +82029,15 @@ function validatePayload(name, files) {
 function diffSummary(currentDir, files) {
   const lines = [];
   const currentFiles = {};
-  if (existsSync79(currentDir)) {
+  if (existsSync80(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync30(sub, { withFileTypes: true })) {
-        const full = join76(sub, ent.name);
+        const full = join78(sub, ent.name);
         const rel = relative2(currentDir, full);
         if (ent.isDirectory()) {
           walk2(full);
         } else if (ent.isFile()) {
-          currentFiles[rel.replace(/\\/g, "/")] = readFileSync64(full, "utf-8");
+          currentFiles[rel.replace(/\\/g, "/")] = readFileSync65(full, "utf-8");
         }
       }
     };
@@ -81731,10 +82065,10 @@ function diffSummary(currentDir, files) {
 `);
 }
 function writePayload(poolDir, name, files) {
-  if (!existsSync79(poolDir)) {
-    mkdirSync44(poolDir, { recursive: true, mode: 493 });
+  if (!existsSync80(poolDir)) {
+    mkdirSync45(poolDir, { recursive: true, mode: 493 });
   }
-  const target = join76(poolDir, name);
+  const target = join78(poolDir, name);
   let targetIsSymlink = false;
   try {
     const st = lstatSync8(target);
@@ -81745,15 +82079,15 @@ function writePayload(poolDir, name, files) {
   if (targetIsSymlink) {
     fail2(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
-  const staging = mkdtempSync5(join76(poolDir, `.skill-apply-stage-${name}-`));
+  const staging = mkdtempSync5(join78(poolDir, `.skill-apply-stage-${name}-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join76(staging, path8);
-      mkdirSync44(dirname22(full), { recursive: true, mode: 493 });
+      const full = join78(staging, path8);
+      mkdirSync45(dirname22(full), { recursive: true, mode: 493 });
       const fd = openSync15(full, "wx");
       try {
-        writeFileSync37(fd, content);
+        writeFileSync38(fd, content);
       } finally {
         closeSync15(fd);
       }
@@ -81780,9 +82114,9 @@ function writePayload(poolDir, name, files) {
     try {
       rmSync16(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync79(oldRename)) {
+    if (oldRename && existsSync80(oldRename)) {
       try {
-        if (existsSync79(target)) {
+        if (existsSync80(target)) {
           rmSync16(target, { recursive: true, force: true });
         }
         renameSync17(oldRename, target);
@@ -81803,7 +82137,7 @@ function registerSkillCommand(program3) {
       files = loadFromStdin();
     } else {
       const fromPath = resolve46(opts.from);
-      if (!existsSync79(fromPath)) {
+      if (!existsSync80(fromPath)) {
         fail2(`--from path does not exist: ${opts.from}`);
       }
       const st = statSync29(fromPath);
@@ -81827,7 +82161,7 @@ function registerSkillCommand(program3) {
     }
     const config = loadConfig();
     const poolDir = resolveSkillsPoolDir2(config.switchroom?.skills_dir);
-    const currentDir = join76(poolDir, name);
+    const currentDir = join78(poolDir, name);
     console.log(source_default.bold(`Skill: ${name}`) + source_default.gray(` (${Object.keys(files).length} files, ${sumBytes(files)} bytes)`));
     console.log(source_default.bold("Diff vs current pool content:"));
     console.log(diffSummary(currentDir, files));
@@ -81841,7 +82175,7 @@ function registerSkillCommand(program3) {
 \u2713 Wrote ${name} to ${currentDir}`));
     const applyBin = process.argv[1] ?? "switchroom";
     console.log(source_default.gray(`Running \`switchroom apply --non-interactive\`...`));
-    const r = spawnSync10(process.argv0, [applyBin, "apply", "--non-interactive"], { stdio: "inherit" });
+    const r = spawnSync11(process.argv0, [applyBin, "apply", "--non-interactive"], { stdio: "inherit" });
     if (r.status !== 0) {
       console.error(source_default.yellow(`(warning: \`switchroom apply\` exited ${r.status} \u2014 skill is ` + `in the pool but symlinks may not be refreshed. Re-run manually.)`));
     }
@@ -81858,22 +82192,22 @@ function sumBytes(files) {
 // src/cli/skill-personal.ts
 import {
   closeSync as closeSync16,
-  existsSync as existsSync80,
+  existsSync as existsSync81,
   lstatSync as lstatSync9,
-  mkdirSync as mkdirSync45,
+  mkdirSync as mkdirSync46,
   mkdtempSync as mkdtempSync6,
   openSync as openSync16,
-  readFileSync as readFileSync65,
+  readFileSync as readFileSync66,
   readdirSync as readdirSync31,
   renameSync as renameSync18,
   rmSync as rmSync17,
   statSync as statSync30,
   utimesSync,
-  writeFileSync as writeFileSync38
+  writeFileSync as writeFileSync39
 } from "node:fs";
-import { dirname as dirname23, join as join77, relative as relative3, resolve as resolve47 } from "node:path";
-import { homedir as homedir44, tmpdir as tmpdir5 } from "node:os";
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { dirname as dirname23, join as join79, relative as relative3, resolve as resolve47 } from "node:path";
+import { homedir as homedir45, tmpdir as tmpdir6 } from "node:os";
+import { spawnSync as spawnSync12 } from "node:child_process";
 init_helpers();
 init_source();
 var PERSONAL_PREFIX = "personal-";
@@ -81882,15 +82216,15 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve47(override) : join77(homedir44(), ".switchroom-config");
-  if (!existsSync80(candidate))
+  const candidate = override ? resolve47(override) : join79(homedir45(), ".switchroom-config");
+  if (!existsSync81(candidate))
     return null;
-  return join77(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
+  return join79(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
   try {
-    if (!existsSync80(configSkillsRoot))
+    if (!existsSync81(configSkillsRoot))
       return;
     const now = Date.now();
     for (const ent of readdirSync31(configSkillsRoot)) {
@@ -81903,7 +82237,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync17(join77(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync17(join79(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -81912,7 +82246,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   const configSkillsRoot = resolveConfigSkillsDir(agent);
   if (!configSkillsRoot)
     return;
-  const dest = join77(configSkillsRoot, name);
+  const dest = join79(configSkillsRoot, name);
   try {
     if (liveSkillDir !== null) {
       try {
@@ -81926,32 +82260,32 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     }
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
-      if (existsSync80(dest)) {
-        const trash = join77(configSkillsRoot, `.${name}-trash-${Date.now()}`);
+      if (existsSync81(dest)) {
+        const trash = join79(configSkillsRoot, `.${name}-trash-${Date.now()}`);
         renameSync18(dest, trash);
       }
       return;
     }
-    mkdirSync45(configSkillsRoot, { recursive: true, mode: 493 });
+    mkdirSync46(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
-    const staging = mkdtempSync6(join77(configSkillsRoot, `.${name}-staging-`));
+    const staging = mkdtempSync6(join79(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
-      mkdirSync45(dst, { recursive: true, mode: 493 });
+      mkdirSync46(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync31(src, { withFileTypes: true })) {
-        const s = join77(src, ent.name);
-        const d = join77(dst, ent.name);
+        const s = join79(src, ent.name);
+        const d = join79(dst, ent.name);
         if (ent.isSymbolicLink())
           continue;
         if (ent.isDirectory())
           walk2(s, d);
         else if (ent.isFile()) {
-          writeFileSync38(d, readFileSync65(s));
+          writeFileSync39(d, readFileSync66(s));
         }
       }
     };
     walk2(liveSkillDir, staging);
-    if (existsSync80(dest)) {
-      const prior = join77(configSkillsRoot, `.${name}-prior-${Date.now()}`);
+    if (existsSync81(dest)) {
+      const prior = join79(configSkillsRoot, `.${name}-prior-${Date.now()}`);
       renameSync18(dest, prior);
     }
     renameSync18(staging, dest);
@@ -81978,13 +82312,13 @@ function resolveAgent(opts) {
 function resolveAgentsRoot(opts) {
   if (opts.root)
     return resolve47(opts.root);
-  return join77(homedir44(), ".switchroom", "agents");
+  return join79(homedir45(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
-  return join77(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
+  return join79(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
 }
 function trashDir(agentsRoot, agent) {
-  return join77(agentsRoot, agent, ".claude", TRASH_DIRNAME);
+  return join79(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
 function readStdinSync2() {
   const chunks = [];
@@ -82014,7 +82348,7 @@ function loadFromDir2(dir) {
   const files = {};
   const walk2 = (sub) => {
     for (const ent of readdirSync31(sub, { withFileTypes: true })) {
-      const full = join77(sub, ent.name);
+      const full = join79(sub, ent.name);
       if (ent.isSymbolicLink()) {
         fail3(`refusing to read symlink in --from dir: ${relative3(abs, full)}`);
       }
@@ -82024,7 +82358,7 @@ function loadFromDir2(dir) {
       }
       if (ent.isFile()) {
         const rel = relative3(abs, full).replace(/\\/g, "/");
-        files[rel] = readFileSync65(full, "utf-8");
+        files[rel] = readFileSync66(full, "utf-8");
       }
     }
   };
@@ -82062,16 +82396,16 @@ function behavioralValidate(files) {
   const errors2 = [];
   for (const [path8, content] of Object.entries(files)) {
     if (SH_SCRIPT_RE.test(path8)) {
-      const r = spawnSync11("bash", ["-n"], { input: content, encoding: "utf-8" });
+      const r = spawnSync12("bash", ["-n"], { input: content, encoding: "utf-8" });
       if (r.status !== 0) {
         errors2.push(`${path8} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
     } else if (PY_SCRIPT_RE.test(path8)) {
-      const tmp = mkdtempSync6(join77(tmpdir5(), "skill-personal-py-"));
-      const tmpPy = join77(tmp, "check.py");
+      const tmp = mkdtempSync6(join79(tmpdir6(), "skill-personal-py-"));
+      const tmpPy = join79(tmp, "check.py");
       try {
-        writeFileSync38(tmpPy, content);
-        const r = spawnSync11("python3", ["-m", "py_compile", tmpPy], {
+        writeFileSync39(tmpPy, content);
+        const r = spawnSync12("python3", ["-m", "py_compile", tmpPy], {
           encoding: "utf-8"
         });
         if (r.status !== 0) {
@@ -82086,13 +82420,13 @@ function behavioralValidate(files) {
 }
 function sweepTrash(agentsRoot, agent) {
   const trash = trashDir(agentsRoot, agent);
-  if (!existsSync80(trash))
+  if (!existsSync81(trash))
     return;
   const now = Date.now();
   for (const ent of readdirSync31(trash, { withFileTypes: true })) {
     if (!ent.isDirectory())
       continue;
-    const entPath = join77(trash, ent.name);
+    const entPath = join79(trash, ent.name);
     try {
       const st = statSync30(entPath);
       if (now - st.mtimeMs > TRASH_TTL_MS) {
@@ -82112,16 +82446,16 @@ function writePersonalSkill(targetDir, files) {
   if (targetIsSymlink) {
     fail3(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
-  mkdirSync45(dirname23(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join77(dirname23(targetDir), `.skill-personal-stage-`));
+  mkdirSync46(dirname23(targetDir), { recursive: true, mode: 493 });
+  const staging = mkdtempSync6(join79(dirname23(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join77(staging, path8);
-      mkdirSync45(dirname23(full), { recursive: true, mode: 493 });
+      const full = join79(staging, path8);
+      mkdirSync46(dirname23(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
-        writeFileSync38(fd, content);
+        writeFileSync39(fd, content);
       } finally {
         closeSync16(fd);
       }
@@ -82148,9 +82482,9 @@ function writePersonalSkill(targetDir, files) {
     try {
       rmSync17(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync80(oldRename)) {
+    if (oldRename && existsSync81(oldRename)) {
       try {
-        if (existsSync80(targetDir)) {
+        if (existsSync81(targetDir)) {
           rmSync17(targetDir, { recursive: true, force: true });
         }
         renameSync18(oldRename, targetDir);
@@ -82202,7 +82536,7 @@ function loadFiles(opts) {
     return loadFromStdin2();
   }
   const p = resolve47(opts.from);
-  if (!existsSync80(p)) {
+  if (!existsSync81(p)) {
     fail3(`--from path does not exist: ${opts.from}`);
   }
   const st = statSync30(p);
@@ -82210,7 +82544,7 @@ function loadFiles(opts) {
     return loadFromDir2(p);
   }
   if (p.endsWith(".md")) {
-    return { "SKILL.md": readFileSync65(p, "utf-8") };
+    return { "SKILL.md": readFileSync66(p, "utf-8") };
   }
   fail3(`--from must be a directory or a .md file. Got: ${opts.from}`);
 }
@@ -82250,10 +82584,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join77(homedir44(), ".switchroom", "skills");
+  return join79(homedir45(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join77(homedir44(), ".switchroom", "skills", "_bundled");
+  return join79(homedir45(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -82263,8 +82597,8 @@ function resolveCloneSource(source, opts) {
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
-  const dir = join77(root, slug);
-  if (!existsSync80(dir)) {
+  const dir = join79(root, slug);
+  if (!existsSync81(dir)) {
     fail3(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
   const st = lstatSync9(dir);
@@ -82279,7 +82613,7 @@ function readSourceFiles(dir) {
   const skipped = [];
   const walk2 = (sub) => {
     for (const ent of readdirSync31(sub, { withFileTypes: true })) {
-      const full = join77(sub, ent.name);
+      const full = join79(sub, ent.name);
       if (ent.isSymbolicLink()) {
         continue;
       }
@@ -82299,7 +82633,7 @@ function readSourceFiles(dir) {
             fail3(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
           }
         } catch {}
-        files[rel] = readFileSync65(full, "utf-8");
+        files[rel] = readFileSync66(full, "utf-8");
       }
     }
   };
@@ -82388,9 +82722,9 @@ function removePersonalAction(name, opts) {
     throw err2;
   }
   const trashRoot = trashDir(agentsRoot, agent);
-  mkdirSync45(trashRoot, { recursive: true, mode: 493 });
+  mkdirSync46(trashRoot, { recursive: true, mode: 493 });
   const ts = Date.now();
-  const trashTarget = join77(trashRoot, `${name}-${ts}`);
+  const trashTarget = join79(trashRoot, `${name}-${ts}`);
   renameSync18(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
@@ -82409,16 +82743,16 @@ function listPersonalAction(opts) {
   const agent = resolveAgent(opts);
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
-  const skillsDir = join77(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join79(agentsRoot, agent, ".claude", "skills");
   const personal = [];
-  if (existsSync80(skillsDir)) {
+  if (existsSync81(skillsDir)) {
     for (const ent of readdirSync31(skillsDir, { withFileTypes: true })) {
       if (!ent.isDirectory())
         continue;
       if (!ent.name.startsWith(PERSONAL_PREFIX))
         continue;
       const skillName = ent.name.slice(PERSONAL_PREFIX.length);
-      const skillPath = join77(skillsDir, ent.name);
+      const skillPath = join79(skillsDir, ent.name);
       let fileCount = 0;
       let totalBytes = 0;
       const walk2 = (sub) => {
@@ -82426,10 +82760,10 @@ function listPersonalAction(opts) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync30(join77(sub, e.name)).size;
+              totalBytes += statSync30(join79(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
-            walk2(join77(sub, e.name));
+            walk2(join79(sub, e.name));
           }
         }
       };
@@ -82467,29 +82801,29 @@ function registerSkillPersonalCommands(program3) {
 
 // src/cli/skill-search.ts
 init_helpers();
-var import_yaml21 = __toESM(require_dist(), 1);
-import { existsSync as existsSync81, readdirSync as readdirSync32, readFileSync as readFileSync66, statSync as statSync31 } from "node:fs";
-import { homedir as homedir45 } from "node:os";
-import { join as join78, resolve as resolve48 } from "node:path";
+var import_yaml23 = __toESM(require_dist(), 1);
+import { existsSync as existsSync82, readdirSync as readdirSync32, readFileSync as readFileSync67, statSync as statSync31 } from "node:fs";
+import { homedir as homedir46 } from "node:os";
+import { join as join80, resolve as resolve48 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
 function defaultAgentsRoot() {
-  return resolve48(homedir45(), ".switchroom/agents");
+  return resolve48(homedir46(), ".switchroom/agents");
 }
 function defaultSharedRoot2() {
-  return resolve48(homedir45(), ".switchroom/skills");
+  return resolve48(homedir46(), ".switchroom/skills");
 }
 function defaultBundledRoot2() {
-  return resolve48(homedir45(), ".switchroom/skills/_bundled");
+  return resolve48(homedir46(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join78(skillDir, "SKILL.md");
-  if (!existsSync81(mdPath))
+  const mdPath = join80(skillDir, "SKILL.md");
+  if (!existsSync82(mdPath))
     return null;
   let content;
   try {
-    content = readFileSync66(mdPath, "utf-8");
+    content = readFileSync67(mdPath, "utf-8");
   } catch {
     return null;
   }
@@ -82507,7 +82841,7 @@ function readSkillFrontmatter(skillDir) {
   const fmText = rest.slice(0, endIdx);
   let parsed;
   try {
-    parsed = import_yaml21.parse(fmText);
+    parsed = import_yaml23.parse(fmText);
   } catch (e) {
     return { error: `yaml parse: ${e.message}` };
   }
@@ -82517,7 +82851,7 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join78(skillDir, "SKILL.md");
+  const mdPath = join80(skillDir, "SKILL.md");
   try {
     const st = statSync31(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
@@ -82528,8 +82862,8 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join78(agentsRoot, agent, ".claude/skills");
-  if (!existsSync81(skillsDir))
+  const skillsDir = join80(agentsRoot, agent, ".claude/skills");
+  if (!existsSync82(skillsDir))
     return [];
   const out = [];
   let entries;
@@ -82541,7 +82875,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join78(skillsDir, ent);
+    const dirPath = join80(skillsDir, ent);
     try {
       if (!statSync31(dirPath).isDirectory())
         continue;
@@ -82567,7 +82901,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   return out;
 }
 function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
-  if (!existsSync81(sharedRoot))
+  if (!existsSync82(sharedRoot))
     return [];
   const out = [];
   let entries;
@@ -82581,7 +82915,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join78(sharedRoot, ent);
+    const dirPath = join80(sharedRoot, ent);
     try {
       if (!statSync31(dirPath).isDirectory())
         continue;
@@ -82605,7 +82939,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
   return out;
 }
 function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
-  if (!existsSync81(bundledRoot))
+  if (!existsSync82(bundledRoot))
     return [];
   const out = [];
   let entries;
@@ -82617,7 +82951,7 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join78(bundledRoot, ent);
+    const dirPath = join80(bundledRoot, ent);
     try {
       if (!statSync31(dirPath).isDirectory())
         continue;
@@ -82761,10 +83095,10 @@ function registerHostdMcpCommand(program3) {
 // src/cli/hostd.ts
 init_source();
 init_helpers();
-import { existsSync as existsSync83, mkdirSync as mkdirSync46, readdirSync as readdirSync33, readFileSync as readFileSync68, writeFileSync as writeFileSync39, statSync as statSync32, copyFileSync as copyFileSync12 } from "node:fs";
-import { homedir as homedir46 } from "node:os";
-import { join as join79 } from "node:path";
-import { spawnSync as spawnSync13 } from "node:child_process";
+import { existsSync as existsSync84, mkdirSync as mkdirSync47, readdirSync as readdirSync33, readFileSync as readFileSync69, writeFileSync as writeFileSync40, statSync as statSync32, copyFileSync as copyFileSync12 } from "node:fs";
+import { homedir as homedir47 } from "node:os";
+import { join as join81 } from "node:path";
+import { spawnSync as spawnSync14 } from "node:child_process";
 init_audit_reader();
 var DEFAULT_IMAGE_TAG = "latest";
 var HOSTD_COMPOSE_PROJECT = "switchroom-hostd";
@@ -82854,14 +83188,14 @@ networks:
 `;
 }
 function hostdDir() {
-  return join79(homedir46(), ".switchroom", "hostd");
+  return join81(homedir47(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join79(hostdDir(), "docker-compose.yml");
+  return join81(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
-  if (!existsSync83(p))
+  if (!existsSync84(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -82869,7 +83203,7 @@ function backupExistingCompose() {
   return bak;
 }
 function runDocker(args) {
-  const r = spawnSync13("docker", args, { encoding: "utf8" });
+  const r = spawnSync14("docker", args, { encoding: "utf8" });
   return {
     ok: r.status === 0,
     stdout: r.stdout ?? "",
@@ -82894,9 +83228,9 @@ async function doInstall(opts, program3) {
   }
   const dir = hostdDir();
   const composePath = hostdComposePath();
-  mkdirSync46(dir, { recursive: true });
+  mkdirSync47(dir, { recursive: true });
   const yaml = renderHostdComposeFile({
-    hostHome: homedir46(),
+    hostHome: homedir47(),
     imageTag: opts.tag ?? DEFAULT_IMAGE_TAG,
     operatorUid: resolveOperatorUid()
   });
@@ -82909,7 +83243,7 @@ async function doInstall(opts, program3) {
   const bak = backupExistingCompose();
   if (bak)
     console.log(source_default.dim(`  Backed up existing compose to ${bak}`));
-  writeFileSync39(composePath, yaml, "utf8");
+  writeFileSync40(composePath, yaml, "utf8");
   console.log(source_default.green(`  \u2713 Wrote ${composePath}`));
   const adminAgents = Object.entries(cfg.agents ?? {}).filter(([, a]) => a?.admin === true).map(([name]) => name);
   console.log(source_default.dim(`    agents served (one socket each): ${allAgents.length === 0 ? "(none)" : allAgents.join(", ")}`));
@@ -82940,7 +83274,7 @@ function doStatus() {
   const composeYml = hostdComposePath();
   console.log(source_default.bold("switchroom-hostd"));
   console.log("");
-  if (!existsSync83(composeYml)) {
+  if (!existsSync84(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom hostd install` to set up."));
     return;
@@ -82961,14 +83295,14 @@ function doStatus() {
   } else {
     console.log(source_default.green(`  container:  ${ps.stdout.trim()}`));
   }
-  if (existsSync83(dir)) {
+  if (existsSync84(dir)) {
     const entries = [];
     try {
       for (const name of readdirSync33(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join79(dir, name, "sock");
-        if (existsSync83(sockPath)) {
+        const sockPath = join81(dir, name, "sock");
+        if (existsSync84(sockPath)) {
           const st = statSync32(sockPath);
           if ((st.mode & 61440) === 49152) {
             entries.push(`${name} \u2192 ${sockPath}`);
@@ -82987,7 +83321,7 @@ function doStatus() {
 }
 function doUninstall() {
   const composeYml = hostdComposePath();
-  if (!existsSync83(composeYml)) {
+  if (!existsSync84(composeYml)) {
     console.log(source_default.yellow("  No hostd install detected (no compose file at this path)."));
     return;
   }
@@ -83011,12 +83345,12 @@ function registerHostdCommand(program3) {
   hostd.command("uninstall").description("Stop the hostd container. Leaves the compose file in place for re-install.").action(() => doUninstall());
   hostd.command("audit").description("Tail and filter the hostd audit log (privileged-verb call history)").option("--tail <n>", "Number of matching entries to show (default: 50)", "50").option("--agent <name>", "Filter to a specific caller agent").option("--op <verb>", "Filter to a specific hostd verb (e.g. update_apply, agent_restart)").option("--error", "Show only failed (error/denied) entries").option("--verbose", "Show the captured stderr / error tail under each failed row").option("--path <file>", "Override audit log path (for debugging)").action((opts) => {
     const logPath = opts.path ?? defaultAuditLogPath2();
-    if (!existsSync83(logPath)) {
+    if (!existsSync84(logPath)) {
       console.error(source_default.yellow(`Audit log not found at ${logPath}.`) + source_default.gray(`
 The log is created when hostd handles its first privileged-verb request.`));
       return;
     }
-    const raw = readFileSync68(logPath, "utf-8");
+    const raw = readFileSync69(logPath, "utf-8");
     const limit = Math.max(1, parseInt(opts.tail ?? "50", 10) || 50);
     const filters = {
       agent: opts.agent,
@@ -83058,10 +83392,10 @@ The log is created when hostd handles its first privileged-verb request.`));
 // src/cli/webd.ts
 init_source();
 init_helpers();
-import { existsSync as existsSync84, mkdirSync as mkdirSync47, writeFileSync as writeFileSync40, copyFileSync as copyFileSync13 } from "node:fs";
-import { homedir as homedir47 } from "node:os";
-import { join as join80 } from "node:path";
-import { spawnSync as spawnSync14 } from "node:child_process";
+import { existsSync as existsSync85, mkdirSync as mkdirSync48, writeFileSync as writeFileSync41, copyFileSync as copyFileSync13 } from "node:fs";
+import { homedir as homedir48 } from "node:os";
+import { join as join82 } from "node:path";
+import { spawnSync as spawnSync15 } from "node:child_process";
 var DEFAULT_IMAGE_TAG2 = "latest";
 var WEB_COMPOSE_PROJECT = "switchroom-web";
 function renderWebComposeFile(opts) {
@@ -83141,14 +83475,14 @@ services:
 `;
 }
 function webdDir() {
-  return join80(homedir47(), ".switchroom", "web");
+  return join82(homedir48(), ".switchroom", "web");
 }
 function webdComposePath() {
-  return join80(webdDir(), "docker-compose.yml");
+  return join82(webdDir(), "docker-compose.yml");
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
-  if (!existsSync84(p))
+  if (!existsSync85(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -83156,7 +83490,7 @@ function backupExistingCompose2() {
   return bak;
 }
 function runDocker2(args) {
-  const r = spawnSync14("docker", args, { encoding: "utf8" });
+  const r = spawnSync15("docker", args, { encoding: "utf8" });
   return {
     ok: r.status === 0,
     stdout: r.stdout ?? "",
@@ -83173,9 +83507,9 @@ async function doInstall2(opts) {
   }
   const dir = webdDir();
   const composePath = webdComposePath();
-  mkdirSync47(dir, { recursive: true });
+  mkdirSync48(dir, { recursive: true });
   const yaml = renderWebComposeFile({
-    hostHome: homedir47(),
+    hostHome: homedir48(),
     imageTag: opts.tag ?? DEFAULT_IMAGE_TAG2,
     operatorUid
   });
@@ -83188,7 +83522,7 @@ async function doInstall2(opts) {
   const bak = backupExistingCompose2();
   if (bak)
     console.log(source_default.dim(`  Backed up existing compose to ${bak}`));
-  writeFileSync40(composePath, yaml, "utf8");
+  writeFileSync41(composePath, yaml, "utf8");
   console.log(source_default.green(`  \u2713 Wrote ${composePath}`));
   console.log(source_default.dim(`    running as uid ${operatorUid} (operator), network_mode: host`));
   console.log(source_default.dim(`    Pulling ghcr.io/switchroom/switchroom-web:${opts.tag ?? DEFAULT_IMAGE_TAG2}\u2026`));
@@ -83220,7 +83554,7 @@ function doStatus2() {
   const composeYml = webdComposePath();
   console.log(source_default.bold("switchroom-web"));
   console.log("");
-  if (!existsSync84(composeYml)) {
+  if (!existsSync85(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom webd install` to set up."));
     return;
@@ -83244,7 +83578,7 @@ function doStatus2() {
 }
 function doUninstall2() {
   const composeYml = webdComposePath();
-  if (!existsSync84(composeYml)) {
+  if (!existsSync85(composeYml)) {
     console.log(source_default.yellow("  No web-service install detected (no compose file at this path)."));
     return;
   }