switchroom 0.14.9 → 0.14.10

package/telegram-plugin/dist/gateway/gateway.js

@@ -23742,6 +23742,7 @@ var init_schema = __esm(() => {
     webhook_rate_limit: exports_external.object({
       rpm: exports_external.number().int().positive()
     }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default \u2014 when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit."),
+    webhook_via_gateway: exports_external.boolean().optional().describe("Route verified webhook events to the agent's in-container gateway " + "over a peercred-gated UDS (<agent>/telegram/webhook.sock) instead " + "of having the host-side web receiver write the agent dir directly. " + "Required under the Docker runtime: the receiver runs as the host " + "operator UID and cannot write the per-agent-UID-owned agent dir " + "(EACCES 500) nor connect the gateway socket. When true the gateway " + "(running as the agent UID) becomes the sole writer of " + "webhook-events.jsonl + dedup/cooldown state and also fires " + "webhook_dispatch. Off by default for back-compat with host-runtime " + "installs. See docs/rfcs/webhook-via-gateway-socket.md."),
     chat_id: exports_external.string().regex(/^-\d+$/, 'supergroup chat_id must be a negative integer as a string (e.g. "-1001234567890")').optional().describe("Per-agent supergroup ID \u2014 overrides fleet `telegram.forum_chat_id`. " + "When set, requires `default_topic_id`. Negative integer as string. " + "Forbidden when `dm_only: true`. See docs/rfcs/supergroup-mode.md."),
     default_topic_id: exports_external.number().int().positive().optional().describe("Forum topic ID this agent's automated outbounds default to when " + "no more-specific alias resolves. Required when `chat_id` is set. " + "Telegram's General topic is `id=1` at MTProto but sends omit the " + "field \u2014 the outbound wrapper strips `message_thread_id === 1` " + "on send. Forbidden when `dm_only: true`."),
     topic_aliases: exports_external.record(exports_external.string(), exports_external.number().int().positive()).optional().describe("Operator-friendly names for forum topic IDs (e.g. " + "`{ general: 1, planning: 17, cron: 23, admin: 31, alerts: 41 }`). " + "Referenced from per-cron `topic:` fields and the outbound router " + "for autonomous events (boot \u2192 alerts, hostd \u2192 admin, etc.). " + "Cascades per-key through defaults \u2192 profile \u2192 agent.")
@@ -25161,6 +25162,59 @@ function formatResetRelative(target, now = new Date) {
 }
 var OAUTH_BETA = "oauth-2025-04-20", DEFAULT_USER_AGENT = "claude-cli/1.0.0 (external, cli)", DEFAULT_PROBE_MODEL = "claude-haiku-4-5-20251001";
 var init_quota_check = () => {};
+
+// ../src/vault/broker/peercred-ffi.ts
+function getPeerCred(fd) {
+  if (process.platform !== "linux")
+    return null;
+  try {
+    const ffi = __require("bun:ffi");
+    const { dlopen, FFIType, ptr } = ffi;
+    const SOL_SOCKET = 1;
+    const SO_PEERCRED = 17;
+    const UCRED_SIZE = 12;
+    const cache = getPeerCred;
+    const lib = cache._lib ?? (() => {
+      const candidates = ["libc.so.6", "libc.so"];
+      const symbolSpec = {
+        getsockopt: {
+          args: [FFIType.i32, FFIType.i32, FFIType.i32, FFIType.ptr, FFIType.ptr],
+          returns: FFIType.i32
+        }
+      };
+      const errors3 = [];
+      for (const name of candidates) {
+        try {
+          const opened = dlopen(name, symbolSpec);
+          cache._lib = opened;
+          return opened;
+        } catch (e) {
+          errors3.push(`${name}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+      }
+      process.stderr.write(`[vault-broker] peercred-ffi: dlopen failed for all libc candidates ` + `(${errors3.join("; ")}); falling back to ss-parsing.
+`);
+      throw new Error("no libc candidate could be opened");
+    })();
+    const credBuf = new ArrayBuffer(UCRED_SIZE);
+    const lenBuf = new Uint32Array(1);
+    lenBuf[0] = UCRED_SIZE;
+    const rc = lib.symbols.getsockopt(fd, SOL_SOCKET, SO_PEERCRED, ptr(credBuf), ptr(lenBuf.buffer));
+    if (rc !== 0)
+      return null;
+    if (lenBuf[0] !== UCRED_SIZE)
+      return null;
+    const view = new DataView(credBuf);
+    return {
+      pid: view.getInt32(0, true),
+      uid: view.getInt32(4, true),
+      gid: view.getInt32(8, true)
+    };
+  } catch {
+    return null;
+  }
+}
+
 // ../src/vault/broker/peercred.ts
 function isReservedAgentName(name) {
   return RESERVED_AGENT_NAMES.has(name);
@@ -27869,19 +27923,19 @@ function renderAuthLine(state4, agentName3, now = Date.now()) {
 }
 
 // gateway/quota-cache.ts
-import { existsSync as existsSync23, readFileSync as readFileSync22, writeFileSync as writeFileSync13, mkdirSync as mkdirSync11 } from "fs";
-import { join as join20, dirname as dirname8 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync24, writeFileSync as writeFileSync15, mkdirSync as mkdirSync14 } from "fs";
+import { join as join23, dirname as dirname8 } from "path";
 function defaultCachePath() {
-  return process.env.SWITCHROOM_QUOTA_CACHE_PATH ?? join20(process.env.HOME ?? "/tmp", ".switchroom", "quota-cache.json");
+  return process.env.SWITCHROOM_QUOTA_CACHE_PATH ?? join23(process.env.HOME ?? "/tmp", ".switchroom", "quota-cache.json");
 }
 function readQuotaCache(opts = {}) {
   const path = opts.path ?? defaultCachePath();
   const now = opts.now ?? Date.now();
-  if (!existsSync23(path))
+  if (!existsSync26(path))
     return null;
   let entry;
   try {
-    entry = JSON.parse(readFileSync22(path, "utf8"));
+    entry = JSON.parse(readFileSync24(path, "utf8"));
   } catch {
     return null;
   }
@@ -27907,8 +27961,8 @@ function writeQuotaCache(result, opts = {}) {
     result
   };
   try {
-    mkdirSync11(dirname8(path), { recursive: true });
-    writeFileSync13(path, JSON.stringify(entry, null, 2), { mode: 384 });
+    mkdirSync14(dirname8(path), { recursive: true });
+    writeFileSync15(path, JSON.stringify(entry, null, 2), { mode: 384 });
   } catch {}
 }
 var DEFAULT_TTL_MS4, RATE_LIMIT_TTL_MS;
@@ -27918,8 +27972,8 @@ var init_quota_cache = __esm(() => {
 });
 
 // gateway/boot-probes.ts
-import { readFileSync as readFileSync23, readdirSync as readdirSync4, existsSync as existsSync24 } from "fs";
-import { join as join21 } from "path";
+import { readFileSync as readFileSync25, readdirSync as readdirSync4, existsSync as existsSync27 } from "fs";
+import { join as join24 } from "path";
 import { execFile as execFileCb } from "child_process";
 import { promisify as promisify3 } from "util";
 async function withTimeout(label, p, timeoutMs = PROBE_TIMEOUT_MS) {
@@ -27961,11 +28015,11 @@ function mapPlan(billingType, hasExtra) {
 }
 async function probeAccount(agentDir) {
   return withTimeout("Account", (async () => {
-    const claudeDir = join21(agentDir, ".claude");
-    const claudeJsonPath = join21(claudeDir, ".claude.json");
+    const claudeDir = join24(agentDir, ".claude");
+    const claudeJsonPath = join24(claudeDir, ".claude.json");
     let cfg = {};
     try {
-      const raw = readFileSync23(claudeJsonPath, "utf8");
+      const raw = readFileSync25(claudeJsonPath, "utf8");
       cfg = JSON.parse(raw);
     } catch {
       return { status: "fail", label: "Account", detail: "no .claude.json" };
@@ -27983,12 +28037,12 @@ async function probeAccount(agentDir) {
     let tokenStr = "";
     let status = "ok";
     for (const candidate of [
-      join21(claudeDir, ".oauth-token.meta.json"),
-      join21(claudeDir, "accounts", "default", ".oauth-token.meta.json")
+      join24(claudeDir, ".oauth-token.meta.json"),
+      join24(claudeDir, "accounts", "default", ".oauth-token.meta.json")
     ]) {
-      if (existsSync24(candidate)) {
+      if (existsSync27(candidate)) {
         try {
-          const meta = JSON.parse(readFileSync23(candidate, "utf8"));
+          const meta = JSON.parse(readFileSync25(candidate, "utf8"));
           if (meta.expiresAt) {
             tokenStr = " \u00b7 " + formatDaysFromNow(meta.expiresAt);
             const daysLeft = Math.round((meta.expiresAt - Date.now()) / 86400000);
@@ -28163,9 +28217,9 @@ async function resolveTmuxSupervisorPid(agentName3, execFileImpl) {
     if (!cgroup)
       return null;
     const procsPath = `/sys/fs/cgroup${cgroup}/cgroup.procs`;
-    if (!existsSync24(procsPath))
+    if (!existsSync27(procsPath))
       return null;
-    const pidsRaw = readFileSync23(procsPath, "utf-8");
+    const pidsRaw = readFileSync25(procsPath, "utf-8");
     const pids = pidsRaw.split(`
 `).map((s) => s.trim()).filter(Boolean);
     if (pids.length === 0)
@@ -28178,7 +28232,7 @@ async function resolveTmuxSupervisorPid(agentName3, execFileImpl) {
       let rss = 0;
       let comm = "";
       try {
-        const status = readFileSync23(`/proc/${pid}/status`, "utf-8");
+        const status = readFileSync25(`/proc/${pid}/status`, "utf-8");
         const rssLine = status.split(`
 `).find((l) => l.startsWith("VmRSS:"));
         if (rssLine) {
@@ -28190,7 +28244,7 @@ async function resolveTmuxSupervisorPid(agentName3, execFileImpl) {
         continue;
       }
       try {
-        comm = readFileSync23(`/proc/${pid}/comm`, "utf-8").trim();
+        comm = readFileSync25(`/proc/${pid}/comm`, "utf-8").trim();
       } catch {}
       candidates.push({ pid, rss, comm });
     }
@@ -28370,9 +28424,9 @@ async function probeQuota(claudeConfigDir, _agentDir, fetchImpl = fetch, opts =
       let claudeDirForProbe = null;
       for (const candidate of [
         claudeConfigDir,
-        join21(claudeConfigDir, "accounts", "default")
+        join24(claudeConfigDir, "accounts", "default")
       ]) {
-        if (existsSync24(join21(candidate, ".oauth-token"))) {
+        if (existsSync27(join24(candidate, ".oauth-token"))) {
           claudeDirForProbe = candidate;
           break;
         }
@@ -28437,7 +28491,7 @@ async function probeHindsight(bankName, fetchImpl = fetch) {
 }
 function readContainerBootTimeMsForProbe() {
   try {
-    const stat1 = readFileSync23("/proc/1/stat", "utf8");
+    const stat1 = readFileSync25("/proc/1/stat", "utf8");
     const lastParen = stat1.lastIndexOf(")");
     if (lastParen < 0)
       return null;
@@ -28445,7 +28499,7 @@ function readContainerBootTimeMsForProbe() {
     const starttimeTicks = Number(after[19]);
     if (!Number.isFinite(starttimeTicks))
       return null;
-    const procStat = readFileSync23("/proc/stat", "utf8");
+    const procStat = readFileSync25("/proc/stat", "utf8");
     const btimeLine = procStat.split(`
 `).find((l) => l.startsWith("btime "));
     if (!btimeLine)
@@ -28543,7 +28597,7 @@ async function probeUds(label, socketPath, opts = {}) {
   }
   return withTimeout(label, (async () => {
     if (!opts.connectImpl) {
-      if (!existsSync24(socketPath)) {
+      if (!existsSync27(socketPath)) {
         return {
           status: "fail",
           label,
@@ -28578,9 +28632,9 @@ function udsNextStep(label, kind) {
   return `${label} socket not reachable \u2014 bring up the daemon with \`docker compose up -d ${svc}\` (or check \`docker compose ps\`)`;
 }
 function defaultUdsConnect(socketPath) {
-  const net4 = __require("net");
+  const net5 = __require("net");
   return new Promise((resolve6, reject) => {
-    const sock = net4.createConnection({ path: socketPath });
+    const sock = net5.createConnection({ path: socketPath });
     const t = setTimeout(() => {
       sock.destroy();
       reject(new Error("connect timeout"));
@@ -28607,7 +28661,7 @@ async function probeSkills(agentDir, opts = {}) {
   return withTimeout("Skills", (async () => {
     const fs2 = opts.fs ?? realSkillsFs;
     const max = opts.maxNamesShown ?? 3;
-    const skillsDir = join21(agentDir, ".claude", "skills");
+    const skillsDir = join24(agentDir, ".claude", "skills");
     if (!fs2.exists(skillsDir)) {
       return { status: "ok", label: "Skills", detail: "no skills dir" };
     }
@@ -28622,17 +28676,17 @@ async function probeSkills(agentDir, opts = {}) {
     }
     const dangling = [];
     for (const name of entries) {
-      const skillPath = join21(skillsDir, name);
+      const skillPath = join24(skillsDir, name);
       if (!fs2.exists(skillPath)) {
         dangling.push(name);
         continue;
       }
-      const skillMd = join21(skillPath, "SKILL.md");
+      const skillMd = join24(skillPath, "SKILL.md");
       if (!fs2.exists(skillMd) && !fs2.exists(skillPath + ".md")) {
         continue;
       }
     }
-    const overlayDir = opts.overlaySkillsDir ?? join21(agentDir, "skills.d");
+    const overlayDir = opts.overlaySkillsDir ?? join24(agentDir, "skills.d");
     const overlaySlugs = new Set;
     if (fs2.exists(overlayDir)) {
       let overlayEntries = [];
@@ -28679,24 +28733,24 @@ var init_boot_probes = __esm(() => {
   execFile3 = promisify3(execFileCb);
   realProcFs = {
     readdir: (p) => readdirSync4(p),
-    readFile: (p) => readFileSync23(p, "utf-8")
+    readFile: (p) => readFileSync25(p, "utf-8")
   };
   realSchedulerFs = {
-    readFile: (p) => readFileSync23(p, "utf-8"),
+    readFile: (p) => readFileSync25(p, "utf-8"),
     mtimeMs: (p) => {
       const { statSync: statSync7 } = __require("fs");
       return statSync7(p).mtimeMs;
     },
-    exists: (p) => existsSync24(p)
+    exists: (p) => existsSync27(p)
   };
   realSkillsFs = {
     readdir: (p) => readdirSync4(p),
-    exists: (p) => existsSync24(p)
+    exists: (p) => existsSync27(p)
   };
 });
 
 // gateway/boot-issue-cache.ts
-import { existsSync as existsSync25, readFileSync as readFileSync24, writeFileSync as writeFileSync14, mkdirSync as mkdirSync12, renameSync as renameSync9 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync26, writeFileSync as writeFileSync16, mkdirSync as mkdirSync15, renameSync as renameSync9 } from "fs";
 import { dirname as dirname9 } from "path";
 function fingerprintProbe(key, r) {
   if (r.status === "ok")
@@ -28776,11 +28830,11 @@ function diffProbes(probes, cache, opts = {}) {
   return out;
 }
 function loadCache(path, now = Date.now) {
-  if (!existsSync25(path))
+  if (!existsSync28(path))
     return { ...EMPTY_CACHE, probes: {} };
   let raw;
   try {
-    raw = readFileSync24(path, "utf-8");
+    raw = readFileSync26(path, "utf-8");
   } catch {
     return { ...EMPTY_CACHE, probes: {} };
   }
@@ -28823,9 +28877,9 @@ function applyAndSave(path, cache, diff) {
     }
   }
   try {
-    mkdirSync12(dirname9(path), { recursive: true });
+    mkdirSync15(dirname9(path), { recursive: true });
     const tmp = `${path}.tmp`;
-    writeFileSync14(tmp, JSON.stringify(next), { mode: 384 });
+    writeFileSync16(tmp, JSON.stringify(next), { mode: 384 });
     renameSync9(tmp, path);
   } catch {}
   return next;
@@ -28839,7 +28893,7 @@ var init_boot_issue_cache = __esm(() => {
 
 // gateway/config-snapshot.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync26, readFileSync as readFileSync25, writeFileSync as writeFileSync15, mkdirSync as mkdirSync13, renameSync as renameSync10 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync27, writeFileSync as writeFileSync17, mkdirSync as mkdirSync16, renameSync as renameSync10 } from "fs";
 import { dirname as dirname10 } from "path";
 function hashStringArray(items) {
   if (!items || items.length === 0)
@@ -28904,11 +28958,11 @@ function renderConfigChangeDim(dim) {
   }
 }
 function loadSnapshot(path, now = Date.now) {
-  if (!existsSync26(path))
+  if (!existsSync29(path))
     return null;
   let raw;
   try {
-    raw = readFileSync25(path, "utf-8");
+    raw = readFileSync27(path, "utf-8");
   } catch {
     return null;
   }
@@ -28938,9 +28992,9 @@ function loadSnapshot(path, now = Date.now) {
 }
 function persistSnapshot(path, snapshot) {
   try {
-    mkdirSync13(dirname10(path), { recursive: true });
+    mkdirSync16(dirname10(path), { recursive: true });
     const tmp = `${path}.tmp`;
-    writeFileSync15(tmp, JSON.stringify(snapshot), { mode: 384 });
+    writeFileSync17(tmp, JSON.stringify(snapshot), { mode: 384 });
     renameSync10(tmp, path);
   } catch {}
 }
@@ -28956,7 +29010,7 @@ __export(exports_boot_card, {
   renderBootCard: () => renderBootCard,
   renderAccountRows: () => renderAuthLine
 });
-import { join as join22 } from "path";
+import { join as join25 } from "path";
 function resolvePersonaName(slug, loadConfig3) {
   try {
     const config = loadConfig3 ? loadConfig3() : loadConfig();
@@ -29046,7 +29100,7 @@ function renderBootCard(opts) {
 `);
 }
 async function runAllProbes(opts) {
-  const claudeDir = join22(opts.agentDir, ".claude");
+  const claudeDir = join25(opts.agentDir, ".claude");
   const probes = {};
   const slug = opts.agentSlug ?? opts.agentName;
   await Promise.allSettled([
@@ -29664,12 +29718,12 @@ var init_flock = () => {};
 // ../src/vault/vault.ts
 import { randomBytes as randomBytes5, scryptSync, createCipheriv, createDecipheriv } from "node:crypto";
 import {
-  readFileSync as readFileSync33,
-  writeFileSync as writeFileSync21,
-  existsSync as existsSync34,
+  readFileSync as readFileSync35,
+  writeFileSync as writeFileSync23,
+  existsSync as existsSync37,
   renameSync as renameSync12,
-  mkdirSync as mkdirSync20,
-  unlinkSync as unlinkSync12,
+  mkdirSync as mkdirSync23,
+  unlinkSync as unlinkSync13,
   lstatSync,
   realpathSync
 } from "node:fs";
@@ -29704,12 +29758,12 @@ function normalizeSecrets(raw) {
   return out;
 }
 function openVault(passphrase, vaultPath) {
-  if (!existsSync34(vaultPath)) {
+  if (!existsSync37(vaultPath)) {
     throw new VaultError(`Vault file not found: ${vaultPath}`);
   }
   let vaultFile;
   try {
-    vaultFile = JSON.parse(readFileSync33(vaultPath, "utf8"));
+    vaultFile = JSON.parse(readFileSync35(vaultPath, "utf8"));
   } catch {
     throw new VaultError(`Failed to read vault file: ${vaultPath}`);
   }
@@ -29754,16 +29808,16 @@ var init_vault = __esm(() => {
 
 // ../src/vault/resolver.ts
 import {
-  chmodSync as chmodSync4,
+  chmodSync as chmodSync5,
   closeSync as closeSync7,
-  mkdirSync as mkdirSync21,
+  mkdirSync as mkdirSync24,
   mkdtempSync as mkdtempSync2,
   openSync as openSync7,
   rmSync as rmSync3,
   statSync as statSync11,
   writeSync as writeSync2
 } from "node:fs";
-import { join as join32 } from "node:path";
+import { join as join35 } from "node:path";
 import { tmpdir } from "node:os";
 import { constants as fsConstants } from "node:fs";
 function isVaultReference(value) {
@@ -29815,13 +29869,13 @@ function materializationRoot() {
     return cachedRoot;
   const xdg = process.env.XDG_RUNTIME_DIR;
   if (xdg) {
-    const base = join32(xdg, "switchroom", "vault");
-    mkdirSync21(base, { recursive: true, mode: 448 });
-    cachedRoot = mkdtempSync2(join32(base, "run-"));
+    const base = join35(xdg, "switchroom", "vault");
+    mkdirSync24(base, { recursive: true, mode: 448 });
+    cachedRoot = mkdtempSync2(join35(base, "run-"));
   } else {
-    cachedRoot = mkdtempSync2(join32(tmpdir(), "switchroom-vault-"));
+    cachedRoot = mkdtempSync2(join35(tmpdir(), "switchroom-vault-"));
   }
-  chmodSync4(cachedRoot, 448);
+  chmodSync5(cachedRoot, 448);
   return cachedRoot;
 }
 function writeFileExclusive(filePath, content) {
@@ -29834,14 +29888,14 @@ function writeFileExclusive(filePath, content) {
   }
 }
 function materializeFilesEntry(key, files) {
-  const dir = join32(materializationRoot(), key);
+  const dir = join35(materializationRoot(), key);
   if (materializedDirs.has(dir)) {
     try {
       rmSync3(dir, { recursive: true, force: true });
     } catch {}
   }
-  mkdirSync21(dir, { recursive: true, mode: 448 });
-  chmodSync4(dir, 448);
+  mkdirSync24(dir, { recursive: true, mode: 448 });
+  chmodSync5(dir, 448);
   const st = statSync11(dir);
   if (typeof process.getuid === "function" && st.uid !== process.getuid()) {
     throw new Error(`Refusing to materialize vault entry: ${dir} not owned by caller`);
@@ -29850,7 +29904,7 @@ function materializeFilesEntry(key, files) {
     if (filename.includes("/") || filename.includes("\\") || filename === ".." || filename === "." || filename.includes("\x00")) {
       throw new Error(`Refusing to materialize vault file with unsafe name: ${filename}`);
     }
-    const filePath = join32(dir, filename);
+    const filePath = join35(dir, filename);
     const content = encoding === "base64" ? Buffer.from(value, "base64") : value;
     writeFileExclusive(filePath, content);
   }
@@ -29983,7 +30037,7 @@ __export(exports_materialize_bot_token, {
   materializeBotToken: () => materializeBotToken,
   BotTokenMaterializeError: () => BotTokenMaterializeError
 });
-import { existsSync as existsSync35 } from "node:fs";
+import { existsSync as existsSync38 } from "node:fs";
 function pickConfiguredToken(config, agentName3) {
   if (agentName3) {
     const agent = config.agents?.[agentName3];
@@ -29997,7 +30051,7 @@ function tryDirectVaultRead(ref, config, passphrase) {
   if (!passphrase)
     return null;
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (!existsSync35(vaultPath))
+  if (!existsSync38(vaultPath))
     return null;
   try {
     const secrets = openVault(passphrase, vaultPath);
@@ -30307,7 +30361,7 @@ __export(exports_tmux, {
   captureAgentPane: () => captureAgentPane
 });
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { mkdirSync as mkdirSync22, readdirSync as readdirSync6, statSync as statSync12, unlinkSync as unlinkSync13, writeFileSync as writeFileSync22 } from "node:fs";
+import { mkdirSync as mkdirSync25, readdirSync as readdirSync6, statSync as statSync12, unlinkSync as unlinkSync14, writeFileSync as writeFileSync24 } from "node:fs";
 import { resolve as resolve7 } from "node:path";
 function captureAgentPane(opts) {
   const { agentName: agentName3, agentDir, reason } = opts;
@@ -30319,7 +30373,7 @@ function captureAgentPane(opts) {
   const reasonSlug = sanitizeReason(reason);
   const outPath = resolve7(outDir, `${ts}-${reasonSlug}.txt`);
   try {
-    mkdirSync22(outDir, { recursive: true, mode: 493 });
+    mkdirSync25(outDir, { recursive: true, mode: 493 });
   } catch (err) {
     const msg = `mkdir crash-reports failed: ${err.message}`;
     console.error(`[tmux-capture] ${agentName3}: ${msg}`);
@@ -30353,7 +30407,7 @@ function captureAgentPane(opts) {
 ` + `
 `;
   try {
-    writeFileSync22(outPath, Buffer.concat([Buffer.from(header, "utf8"), body]), {
+    writeFileSync24(outPath, Buffer.concat([Buffer.from(header, "utf8"), body]), {
       mode: 420
     });
   } catch (err) {
@@ -30421,7 +30475,7 @@ function pruneOldReports(dir, retain) {
   }).sort((a, b) => b.mtimeMs - a.mtimeMs);
   for (const stale of files.slice(retain)) {
     try {
-      unlinkSync13(stale.full);
+      unlinkSync14(stale.full);
     } catch {}
   }
 }
@@ -30695,23 +30749,23 @@ var import_runner2 = __toESM(require_mod3(), 1);
 import { randomBytes as randomBytes6 } from "crypto";
 import { execFileSync as execFileSync5, execSync as execSync2, spawn as spawn2 } from "child_process";
 import {
-  readFileSync as readFileSync34,
-  writeFileSync as writeFileSync23,
-  mkdirSync as mkdirSync23,
+  readFileSync as readFileSync36,
+  writeFileSync as writeFileSync25,
+  mkdirSync as mkdirSync26,
   readdirSync as readdirSync7,
   rmSync as rmSync4,
   statSync as statSync13,
   renameSync as renameSync13,
   realpathSync as realpathSync2,
-  chmodSync as chmodSync5,
+  chmodSync as chmodSync6,
   openSync as openSync8,
   closeSync as closeSync8,
-  existsSync as existsSync36,
-  unlinkSync as unlinkSync14,
-  appendFileSync as appendFileSync3
+  existsSync as existsSync39,
+  unlinkSync as unlinkSync15,
+  appendFileSync as appendFileSync5
 } from "fs";
-import { homedir as homedir12 } from "os";
-import { join as join33, extname, sep as sep3, basename as basename7 } from "path";
+import { homedir as homedir14 } from "os";
+import { join as join36, extname, sep as sep3, basename as basename7 } from "path";
 
 // plugin-logger.ts
 import { appendFileSync, mkdirSync, renameSync, statSync, existsSync } from "fs";
@@ -44616,8 +44670,643 @@ function shouldSweepChatAtBoot(chatId) {
   return n < 0;
 }
 
+// gateway/webhook-ingest-server.ts
+import net4 from "node:net";
+import { chmodSync as chmodSync3, existsSync as existsSync21, unlinkSync as unlinkSync5 } from "node:fs";
+var MAX_REQUEST_BYTES = 1024 * 1024;
+function fdOf(conn) {
+  const handle = conn._handle;
+  if (!handle || typeof handle.fd !== "number" || handle.fd < 0)
+    return null;
+  return handle.fd;
+}
+function startWebhookIngestServer(opts) {
+  const log = opts.log ?? ((s) => process.stderr.write(s));
+  const allowed = new Set(opts.allowedUids);
+  try {
+    if (existsSync21(opts.socketPath))
+      unlinkSync5(opts.socketPath);
+  } catch (err) {
+    log(`webhook-ingest-server: could not unlink stale socket: ${err.message}
+`);
+  }
+  const server = net4.createServer((conn) => {
+    const fd = fdOf(conn);
+    const cred = fd !== null ? getPeerCred(fd) : null;
+    if (cred === null || !allowed.has(cred.uid)) {
+      log(`webhook-ingest-server: DENY connection uid=${cred?.uid ?? "unknown"} ` + `(allowed=${[...allowed].join(",")})
+`);
+      conn.destroy();
+      return;
+    }
+    let buf = "";
+    let handled = false;
+    conn.setEncoding("utf8");
+    const reply = (resp) => {
+      if (handled)
+        return;
+      handled = true;
+      try {
+        conn.write(JSON.stringify(resp) + `
+`);
+      } catch {}
+      conn.end();
+    };
+    conn.on("data", (chunk) => {
+      if (handled)
+        return;
+      buf += chunk;
+      if (buf.length > MAX_REQUEST_BYTES) {
+        reply({ status: "error", error: "request too large" });
+        return;
+      }
+      const nl = buf.indexOf(`
+`);
+      if (nl === -1)
+        return;
+      const line = buf.slice(0, nl);
+      let req;
+      try {
+        req = JSON.parse(line);
+      } catch {
+        reply({ status: "error", error: "malformed request" });
+        return;
+      }
+      if (!req || typeof req.agent !== "string" || typeof req.source !== "string" || typeof req.event_type !== "string" || typeof req.rendered_text !== "string" || typeof req.payload !== "object" || req.payload === null) {
+        reply({ status: "error", error: "invalid request shape" });
+        return;
+      }
+      Promise.resolve().then(() => opts.onRecord(req)).then((resp) => reply(resp)).catch((err) => {
+        log(`webhook-ingest-server: onRecord threw: ${String(err)}
+`);
+        reply({ status: "error", error: "internal error" });
+      });
+    });
+    conn.on("error", (err) => {
+      log(`webhook-ingest-server: conn error: ${err.message}
+`);
+    });
+    conn.setTimeout(1e4, () => {
+      if (!handled)
+        reply({ status: "error", error: "timeout" });
+      conn.destroy();
+    });
+  });
+  server.on("error", (err) => {
+    log(`webhook-ingest-server: server error: ${err.message}
+`);
+  });
+  try {
+    server.listen(opts.socketPath, () => {
+      try {
+        chmodSync3(opts.socketPath, 438);
+      } catch (err) {
+        log(`webhook-ingest-server: chmod failed: ${err.message}
+`);
+      }
+      log(`webhook-ingest-server: listening at ${opts.socketPath} ` + `(allowed uids: ${[...allowed].join(",")})
+`);
+    });
+  } catch (err) {
+    log(`webhook-ingest-server: listen failed: ${err.message}
+`);
+  }
+  return {
+    close: () => {
+      try {
+        server.close();
+      } catch {}
+      try {
+        if (existsSync21(opts.socketPath))
+          unlinkSync5(opts.socketPath);
+      } catch {}
+    }
+  };
+}
+
+// ../src/web/webhook-gateway-record.ts
+import { appendFileSync as appendFileSync4, mkdirSync as mkdirSync12 } from "fs";
+import { join as join20 } from "path";
+import { homedir as homedir10 } from "os";
+
+// ../src/web/webhook-handler.ts
+import { appendFileSync as appendFileSync3, existsSync as existsSync22, mkdirSync as mkdirSync10, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
+import { join as join18 } from "path";
+var DEDUP_MAX = 1000;
+var DEDUP_TTL_MS = 24 * 60 * 60 * 1000;
+function loadDedupFile(path) {
+  try {
+    if (!existsSync22(path))
+      return {};
+    const raw = JSON.parse(readFileSync16(path, "utf-8"));
+    return typeof raw.deliveries === "object" && raw.deliveries !== null ? raw.deliveries : {};
+  } catch {
+    return {};
+  }
+}
+function saveDedupFile(path, deliveries, now) {
+  const pruned = {};
+  for (const [id, ts] of Object.entries(deliveries)) {
+    if (now - ts < DEDUP_TTL_MS)
+      pruned[id] = ts;
+  }
+  const sorted = Object.entries(pruned).sort((a, b) => b[1] - a[1]).slice(0, DEDUP_MAX);
+  const final = Object.fromEntries(sorted);
+  writeFileSync9(path, JSON.stringify({ deliveries: final }), {
+    mode: 384
+  });
+}
+var agentDedupCache = new Map;
+function createFileDedupStore(resolveAgentDir) {
+  return {
+    check(agent, deliveryId, now) {
+      const telegramDir = join18(resolveAgentDir(agent), "telegram");
+      const filePath = join18(telegramDir, "webhook-dedup.json");
+      if (!agentDedupCache.has(agent)) {
+        agentDedupCache.set(agent, loadDedupFile(filePath));
+      }
+      const deliveries = agentDedupCache.get(agent);
+      if (deliveries[deliveryId] !== undefined) {
+        return deliveries[deliveryId];
+      }
+      deliveries[deliveryId] = now;
+      try {
+        mkdirSync10(telegramDir, { recursive: true });
+        saveDedupFile(filePath, deliveries, now);
+      } catch {}
+      return;
+    }
+  };
+}
+var tokenBuckets = new Map;
+var throttleIssueWindow = new Map;
+
+// ../src/web/webhook-dispatch.ts
+import { existsSync as existsSync23, mkdirSync as mkdirSync11, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "fs";
+import { join as join19 } from "path";
+import { homedir as homedir9 } from "os";
+
+// ../src/agent-scheduler/ipc-client.ts
+import { createConnection as createConnection2 } from "node:net";
+function createInjectIpcClient(options) {
+  const {
+    socketPath,
+    reconnectDelayMs = 1000,
+    maxReconnectDelayMs = 30000,
+    connectTimeoutMs = 5000,
+    log = () => {},
+    _connect = (path) => createConnection2(path)
+  } = options;
+  let socket = null;
+  let connected = false;
+  let closed = false;
+  let currentDelay = reconnectDelayMs;
+  let reconnectTimer = null;
+  let connectTimeoutTimer = null;
+  function clearConnectTimeout() {
+    if (connectTimeoutTimer !== null) {
+      clearTimeout(connectTimeoutTimer);
+      connectTimeoutTimer = null;
+    }
+  }
+  function clearReconnectTimer() {
+    if (reconnectTimer !== null) {
+      clearTimeout(reconnectTimer);
+      reconnectTimer = null;
+    }
+  }
+  function scheduleReconnect() {
+    if (closed)
+      return;
+    log(`scheduler ipc: reconnecting in ${currentDelay}ms`);
+    reconnectTimer = setTimeout(() => {
+      reconnectTimer = null;
+      if (!closed)
+        connect2();
+    }, currentDelay);
+    currentDelay = Math.min(currentDelay * 2, maxReconnectDelayMs);
+  }
+  function onClose() {
+    clearConnectTimeout();
+    connected = false;
+    socket = null;
+    if (!closed)
+      scheduleReconnect();
+  }
+  function connect2() {
+    if (closed)
+      return;
+    let s;
+    try {
+      s = _connect(socketPath);
+    } catch (err) {
+      log(`scheduler ipc: connect threw: ${err.message}`);
+      scheduleReconnect();
+      return;
+    }
+    socket = s;
+    connectTimeoutTimer = setTimeout(() => {
+      connectTimeoutTimer = null;
+      if (!connected) {
+        log(`scheduler ipc: connect timeout after ${connectTimeoutMs}ms`);
+        try {
+          s.destroy();
+        } catch {}
+      }
+    }, connectTimeoutMs);
+    s.on("connect", () => {
+      clearConnectTimeout();
+      connected = true;
+      currentDelay = reconnectDelayMs;
+      log(`scheduler ipc: connected to ${socketPath}`);
+    });
+    s.on("close", () => onClose());
+    s.on("error", (err) => {
+      log(`scheduler ipc: socket error: ${err.message}`);
+    });
+    s.on("data", () => {});
+  }
+  setImmediate(connect2);
+  return {
+    sendInjectInbound(msg) {
+      if (!socket || !connected)
+        return false;
+      try {
+        return socket.write(JSON.stringify(msg) + `
+`);
+      } catch (err) {
+        log(`scheduler ipc: write failed: ${err.message}`);
+        return false;
+      }
+    },
+    isConnected() {
+      return connected;
+    },
+    waitForConnect(timeoutMs) {
+      if (connected)
+        return Promise.resolve(true);
+      if (closed)
+        return Promise.resolve(false);
+      return new Promise((resolve6) => {
+        const start = Date.now();
+        const timer3 = setInterval(() => {
+          if (connected) {
+            clearInterval(timer3);
+            resolve6(true);
+            return;
+          }
+          if (closed || Date.now() - start >= timeoutMs) {
+            clearInterval(timer3);
+            resolve6(connected);
+          }
+        }, 50);
+        if (typeof timer3.unref === "function") {
+          timer3.unref();
+        }
+      });
+    },
+    close() {
+      closed = true;
+      clearReconnectTimer();
+      clearConnectTimeout();
+      if (socket) {
+        try {
+          socket.end();
+        } catch {}
+        socket = null;
+      }
+      connected = false;
+    }
+  };
+}
+
+// ../src/web/webhook-dispatch.ts
+function renderTemplate(template, ctx) {
+  return template.replace(/\{\{(\w+)\}\}/g, (_, key) => ctx[key] ?? "");
+}
+function buildGithubContext(eventType, payload) {
+  const repo = payload.repository?.full_name ?? "";
+  const pr = payload.pull_request;
+  const issue = payload.issue;
+  const obj = pr ?? issue;
+  const number = String(payload.number ?? obj?.number ?? "");
+  const firstCommit = payload.commits?.[0];
+  const title = String(obj?.title ?? firstCommit?.message ?? "");
+  const html_url = String(obj?.html_url ?? payload.html_url ?? "");
+  const author = String(obj?.user?.login ?? payload.sender?.login ?? "");
+  const rawLabels = obj?.labels ?? [];
+  const labels = rawLabels.map((l) => String(l.name ?? "")).join(", ");
+  const action = String(payload.action ?? "");
+  return { repo, number, title, html_url, author, labels, action, event: eventType };
+}
+function matchesRule(eventType, payload, matcher) {
+  if (matcher.event !== eventType)
+    return false;
+  const ctx = buildGithubContext(eventType, payload);
+  if (matcher.actions && matcher.actions.length > 0) {
+    if (!matcher.actions.includes(ctx.action))
+      return false;
+  }
+  if (matcher.exclude_authors && matcher.exclude_authors.length > 0) {
+    if (matcher.exclude_authors.includes(ctx.author))
+      return false;
+  }
+  if (matcher.labels_any && matcher.labels_any.length > 0) {
+    const pr = payload.pull_request;
+    const issue = payload.issue;
+    const rawLabels = (pr ?? issue)?.labels ?? [];
+    const labelNames = new Set(rawLabels.map((l) => String(l.name ?? "")));
+    const hasAny = matcher.labels_any.some((l) => labelNames.has(l));
+    if (!hasAny)
+      return false;
+  }
+  if (matcher.labels_all && matcher.labels_all.length > 0) {
+    const pr = payload.pull_request;
+    const issue = payload.issue;
+    const rawLabels = (pr ?? issue)?.labels ?? [];
+    const labelNames = new Set(rawLabels.map((l) => String(l.name ?? "")));
+    const hasAll = matcher.labels_all.every((l) => labelNames.has(l));
+    if (!hasAll)
+      return false;
+  }
+  return true;
+}
+function parseDurationMs(d) {
+  const m = d.trim().match(/^(\d+)(s|m|h|d)?$/);
+  if (!m)
+    return 0;
+  const n = parseInt(m[1], 10);
+  switch (m[2]) {
+    case "s":
+      return n * 1000;
+    case "m":
+      return n * 60000;
+    case "h":
+      return n * 3600000;
+    case "d":
+      return n * 86400000;
+    default:
+      return n;
+  }
+}
+function cooldownKey(eventType, repo, number, ruleIndex) {
+  return `${eventType}:${repo}:${number}:${ruleIndex}`;
+}
+function loadCooldownFile(path) {
+  try {
+    if (!existsSync23(path))
+      return {};
+    const raw = JSON.parse(readFileSync17(path, "utf-8"));
+    return typeof raw.dispatches === "object" && raw.dispatches !== null ? raw.dispatches : {};
+  } catch {
+    return {};
+  }
+}
+function saveCooldownFile(path, dispatches) {
+  try {
+    writeFileSync10(path, JSON.stringify({ dispatches }), {
+      mode: 384
+    });
+  } catch {}
+}
+function createFileCooldownStore(resolveAgentDir) {
+  const cache = new Map;
+  return {
+    isCoolingDown(agent, key, cooldownMs, now) {
+      if (cooldownMs <= 0)
+        return false;
+      const telegramDir = join19(resolveAgentDir(agent), "telegram");
+      const filePath = join19(telegramDir, "webhook-cooldown.json");
+      if (!cache.has(agent)) {
+        cache.set(agent, loadCooldownFile(filePath));
+      }
+      const dispatches = cache.get(agent);
+      const lastDispatch = dispatches[key];
+      if (lastDispatch !== undefined && now - lastDispatch < cooldownMs) {
+        return true;
+      }
+      dispatches[key] = now;
+      try {
+        mkdirSync11(telegramDir, { recursive: true });
+        saveCooldownFile(filePath, dispatches);
+      } catch {}
+      return false;
+    }
+  };
+}
+function isQuietHour(qh, now) {
+  const tz = qh.tz ?? "UTC";
+  let hour;
+  try {
+    const formatter = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      hour: "numeric",
+      hour12: false
+    });
+    const parts = formatter.formatToParts(now);
+    const hourPart = parts.find((p) => p.type === "hour");
+    hour = parseInt(hourPart?.value ?? "0", 10);
+  } catch {
+    hour = now.getUTCHours();
+  }
+  const { start, end } = qh;
+  if (start < end) {
+    return hour >= start && hour < end;
+  } else {
+    return hour >= start || hour < end;
+  }
+}
+async function defaultInject(socketPath, agentName3, inbound) {
+  const client3 = createInjectIpcClient({ socketPath });
+  try {
+    const connected = await client3.waitForConnect(5000);
+    if (!connected)
+      return false;
+    return client3.sendInjectInbound({
+      type: "inject_inbound",
+      agentName: agentName3,
+      inbound
+    });
+  } finally {
+    client3.close();
+  }
+}
+function injectWebhookInbound(agent, prompt, ctx, deps = {}) {
+  const log = deps.log ?? ((s) => process.stderr.write(s));
+  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join19(homedir9(), ".switchroom", "agents", a));
+  const now = (deps.now ?? Date.now)();
+  const socketPath = join19(resolveAgentDir(agent), "telegram", "gateway.sock");
+  const inbound = {
+    type: "inbound",
+    chatId: ctx.chatId,
+    ...ctx.threadId !== undefined ? { threadId: ctx.threadId } : {},
+    messageId: now,
+    user: "webhook",
+    userId: 0,
+    ts: now,
+    text: prompt,
+    meta: {
+      source: "webhook",
+      event: ctx.eventType,
+      rule_index: String(ctx.ruleIndex)
+    }
+  };
+  const injectFn = deps.injectFn ?? defaultInject;
+  injectFn(socketPath, agent, inbound).then((ok) => log(`webhook-dispatch: agent='${agent}' inject_inbound ` + `${ok ? "delivered to gateway" : "not delivered (gateway not connected)"}
+`)).catch((err) => log(`webhook-dispatch: agent='${agent}' inject failed: ${String(err)}
+`));
+}
+function evaluateDispatch(args, deps = {}) {
+  const log = deps.log ?? ((s) => process.stderr.write(s));
+  const now = (deps.now ?? Date.now)();
+  const nowDate = deps.nowDate ?? (() => new Date(now));
+  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join19(homedir9(), ".switchroom", "agents", a));
+  const cooldownStore = deps.cooldownStore ?? createFileCooldownStore(resolveAgentDir);
+  if (args.source !== "github")
+    return 0;
+  const rules = args.dispatchConfig.github;
+  if (!rules || rules.length === 0)
+    return 0;
+  const ctx = buildGithubContext(args.eventType, args.payload);
+  let fired = 0;
+  for (let i = 0;i < rules.length; i++) {
+    const rule = rules[i];
+    if (!matchesRule(args.eventType, args.payload, rule.match))
+      continue;
+    if (rule.quiet_hours && isQuietHour(rule.quiet_hours, nowDate())) {
+      log(`webhook-dispatch: agent='${args.agent}' rule=${i} skipped (quiet hours)
+`);
+      continue;
+    }
+    const cooldownMs = rule.cooldown ? parseDurationMs(rule.cooldown) : 0;
+    if (cooldownMs > 0) {
+      const ck = cooldownKey(args.eventType, ctx.repo, ctx.number, i);
+      if (cooldownStore.isCoolingDown(args.agent, ck, cooldownMs, now)) {
+        log(`webhook-dispatch: agent='${args.agent}' rule=${i} skipped (cooldown)
+`);
+        continue;
+      }
+    }
+    const prompt = renderTemplate(rule.prompt, ctx);
+    log(`webhook-dispatch: agent='${args.agent}' rule=${i} matched event='${args.eventType}' action='${ctx.action}' firing
+`);
+    injectWebhookInbound(args.agent, prompt, {
+      chatId: args.chatId,
+      ...args.threadId !== undefined ? { threadId: args.threadId } : {},
+      eventType: args.eventType,
+      ruleIndex: i
+    }, { ...deps, resolveAgentDir });
+    fired++;
+  }
+  return fired;
+}
+
+// ../src/web/webhook-gateway-record.ts
+init_loader();
+init_merge();
+
+// ../src/agent-scheduler/channel-target.ts
+init_merge();
+function resolveChannelTarget(config, agentName3) {
+  const agent = config.agents?.[agentName3];
+  const tgChannel = agent ? resolveAgentConfig(config.defaults, config.profiles, agent).channels?.telegram : undefined;
+  const supergroupChatId = tgChannel?.chat_id;
+  const supergroupDefaultTopic = tgChannel?.default_topic_id;
+  if (typeof supergroupChatId === "string" && supergroupChatId.length > 0) {
+    return {
+      chatId: supergroupChatId,
+      ...typeof supergroupDefaultTopic === "number" ? { threadId: supergroupDefaultTopic } : {},
+      routerConfig: {
+        ...typeof supergroupDefaultTopic === "number" ? { default_topic_id: supergroupDefaultTopic } : {},
+        ...tgChannel?.topic_aliases ? { topic_aliases: tgChannel.topic_aliases } : {}
+      }
+    };
+  }
+  const forumChatId = config.telegram?.forum_chat_id;
+  if (typeof forumChatId !== "string" || forumChatId.length === 0)
+    return null;
+  const threadId = agent?.topic_id;
+  return {
+    chatId: forumChatId,
+    ...typeof threadId === "number" ? { threadId } : {}
+  };
+}
+
+// ../src/web/webhook-gateway-record.ts
+function recordWebhookEvent(rec, deps = {}) {
+  const log = deps.log ?? ((s) => process.stderr.write(s));
+  const now = rec.ts || (deps.now ?? Date.now)();
+  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join20(homedir10(), ".switchroom", "agents", a));
+  const dedupStore = deps.dedupStore ?? createFileDedupStore(resolveAgentDir);
+  const agent = rec.agent;
+  const telegramDir = join20(resolveAgentDir(agent), "telegram");
+  if (rec.source === "github" && rec.delivery_id) {
+    const originalTs = dedupStore.check(agent, rec.delivery_id, now);
+    if (originalTs !== undefined) {
+      log(`webhook-gateway: agent='${agent}' source='${rec.source}' deduped delivery='${rec.delivery_id}'
+`);
+      return { status: "deduped", ts: originalTs };
+    }
+  }
+  const logPath = join20(telegramDir, "webhook-events.jsonl");
+  try {
+    mkdirSync12(telegramDir, { recursive: true });
+    const record = {
+      ts: now,
+      source: rec.source,
+      event_type: rec.event_type,
+      rendered_text: rec.rendered_text,
+      payload: rec.payload
+    };
+    appendFileSync4(logPath, JSON.stringify(record) + `
+`, { mode: 384 });
+  } catch (err) {
+    log(`webhook-gateway: agent='${agent}' source='${rec.source}' write failed: ${err.message}
+`);
+    return { status: "error", error: "write failed" };
+  }
+  log(`webhook-gateway: agent='${agent}' source='${rec.source}' event='${rec.event_type}' recorded ts=${now}
+`);
+  let dispatched = 0;
+  try {
+    const config = (deps.loadConfig ?? loadConfig)();
+    const rawAgent = config.agents?.[agent];
+    const dispatchConfig = rawAgent ? resolveAgentConfig(config.defaults, config.profiles, rawAgent).channels?.telegram?.webhook_dispatch : undefined;
+    if (dispatchConfig && rec.source === "github") {
+      const target = resolveChannelTarget(config, agent);
+      if (!target) {
+        log(`webhook-gateway: agent='${agent}' dispatch skipped \u2014 no chat target (forum_chat_id / chat_id unset)
+`);
+      } else {
+        const injectFn = deps.inject;
+        dispatched = evaluateDispatch({
+          agent,
+          source: rec.source,
+          eventType: rec.event_type,
+          payload: rec.payload,
+          dispatchConfig,
+          chatId: target.chatId,
+          ...target.threadId !== undefined ? { threadId: target.threadId } : {}
+        }, {
+          now: () => now,
+          resolveAgentDir,
+          log,
+          ...deps.cooldownStore ? { cooldownStore: deps.cooldownStore } : {},
+          ...injectFn ? {
+            injectFn: async (_socketPath, agentName3, inbound) => injectFn(agentName3, inbound)
+          } : {}
+        });
+      }
+    }
+  } catch (err) {
+    log(`webhook-gateway: agent='${agent}' dispatch error (event recorded): ${err.message}
+`);
+  }
+  return { status: "ok", ts: now, dispatched };
+}
+
 // gateway/ipc-server.ts
-import { renameSync as renameSync5, unlinkSync as unlinkSync5 } from "fs";
+import { renameSync as renameSync5, unlinkSync as unlinkSync6 } from "fs";
 var MAX_BUFFER_SIZE = 1024 * 1024;
 var VALID_OPERATOR_KINDS = new Set([
   "credentials-expired",
@@ -44735,7 +45424,7 @@ function createIpcServer(options) {
     renameSync5(socketPath, socketPath + ".bak");
   } catch {}
   try {
-    unlinkSync5(socketPath + ".bak");
+    unlinkSync6(socketPath + ".bak");
   } catch {}
   const clients = new Set;
   const agentIndex = new Map;
@@ -46805,15 +47494,15 @@ function escapeBody(s) {
 }
 
 // gateway/pid-file.ts
-import { writeFileSync as writeFileSync9, readFileSync as readFileSync16, unlinkSync as unlinkSync6, renameSync as renameSync6 } from "node:fs";
+import { writeFileSync as writeFileSync11, readFileSync as readFileSync18, unlinkSync as unlinkSync7, renameSync as renameSync6 } from "node:fs";
 function writePidFile(path, record) {
   const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync9(tmp, JSON.stringify(record), "utf-8");
+  writeFileSync11(tmp, JSON.stringify(record), "utf-8");
   renameSync6(tmp, path);
 }
 function clearPidFile(path) {
   try {
-    unlinkSync6(path);
+    unlinkSync7(path);
   } catch {}
 }
 
@@ -46824,10 +47513,10 @@ import {
   writeFile as writeFileAsync,
   readFile as readFileAsync
 } from "node:fs/promises";
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync19 } from "node:fs";
 function readCurrentBootId() {
   try {
-    const stat = readFileSync17("/proc/1/stat", "utf-8");
+    const stat = readFileSync19("/proc/1/stat", "utf-8");
     const lastParen = stat.lastIndexOf(")");
     if (lastParen < 0)
       return null;
@@ -47030,15 +47719,15 @@ function safeCount(fn) {
 }
 
 // gateway/session-marker.ts
-import { writeFileSync as writeFileSync10, readFileSync as readFileSync18, renameSync as renameSync7, unlinkSync as unlinkSync7 } from "node:fs";
+import { writeFileSync as writeFileSync12, readFileSync as readFileSync20, renameSync as renameSync7, unlinkSync as unlinkSync8 } from "node:fs";
 function writeSessionMarker(path, marker) {
   const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync10(tmp, JSON.stringify(marker), "utf-8");
+  writeFileSync12(tmp, JSON.stringify(marker), "utf-8");
   renameSync7(tmp, path);
 }
 function readSessionMarker(path) {
   try {
-    const raw = readFileSync18(path, "utf-8");
+    const raw = readFileSync20(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.pid === "number" && typeof parsed.startedAtMs === "number" && Number.isFinite(parsed.pid) && Number.isFinite(parsed.startedAtMs)) {
       return { pid: parsed.pid, startedAtMs: parsed.startedAtMs };
@@ -47060,16 +47749,16 @@ function shouldFireRestartBanner(input) {
 }
 
 // gateway/clean-shutdown-marker.ts
-import { writeFileSync as writeFileSync11, readFileSync as readFileSync19, renameSync as renameSync8, unlinkSync as unlinkSync8 } from "node:fs";
+import { writeFileSync as writeFileSync13, readFileSync as readFileSync21, renameSync as renameSync8, unlinkSync as unlinkSync9 } from "node:fs";
 var DEFAULT_MAX_AGE_MS = 60000;
 function writeCleanShutdownMarker(path, marker) {
   const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync11(tmp, JSON.stringify(marker), "utf-8");
+  writeFileSync13(tmp, JSON.stringify(marker), "utf-8");
   renameSync8(tmp, path);
 }
 function readCleanShutdownMarker(path) {
   try {
-    const raw = readFileSync19(path, "utf-8");
+    const raw = readFileSync21(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.ts === "number" && Number.isFinite(parsed.ts) && typeof parsed.signal === "string" && parsed.signal.length > 0) {
       const out = { ts: parsed.ts, signal: parsed.signal };
@@ -47084,7 +47773,7 @@ function readCleanShutdownMarker(path) {
 }
 function clearCleanShutdownMarker(path) {
   try {
-    unlinkSync8(path);
+    unlinkSync9(path);
   } catch {}
 }
 function shouldSuppressRecoveryBanner(marker, now, maxAgeMs = DEFAULT_MAX_AGE_MS) {
@@ -47864,16 +48553,16 @@ function classifyAdminGate(text, myAgentName) {
 
 // subagent-watcher.ts
 import {
-  existsSync as existsSync22,
+  existsSync as existsSync25,
   openSync as openSync2,
   readSync,
   statSync as statSync6,
   closeSync as closeSync2,
   watch,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync21
+  readFileSync as readFileSync23
 } from "fs";
-import { join as join19 } from "path";
+import { join as join22 } from "path";
 
 // operator-events.ts
 var DEFAULT_OPERATOR_EVENT_COOLDOWN_MS2 = 5 * 60000;
@@ -48116,20 +48805,20 @@ function bumpSubagentActivity(db2, args) {
 // gateway/turn-active-marker.ts
 import {
   closeSync,
-  existsSync as existsSync21,
-  mkdirSync as mkdirSync10,
+  existsSync as existsSync24,
+  mkdirSync as mkdirSync13,
   openSync,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync22,
   statSync as statSync5,
-  unlinkSync as unlinkSync9,
+  unlinkSync as unlinkSync10,
   utimesSync,
-  writeFileSync as writeFileSync12
+  writeFileSync as writeFileSync14
 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join21 } from "node:path";
 var TURN_ACTIVE_MARKER_FILE = "turn-active.json";
 function touchTurnActiveMarker(stateDir) {
-  const path = join18(stateDir, TURN_ACTIVE_MARKER_FILE);
-  if (!existsSync21(path))
+  const path = join21(stateDir, TURN_ACTIVE_MARKER_FILE);
+  if (!existsSync24(path))
     return;
   const now = new Date;
   try {
@@ -48164,7 +48853,7 @@ function backfillJsonlAgentId(db2, jsonlPath, agentId, log) {
   const metaPath = jsonlPath.replace(/\.jsonl$/, ".meta.json");
   let meta;
   try {
-    const raw = readFileSync21(metaPath, "utf8");
+    const raw = readFileSync23(metaPath, "utf8");
     meta = JSON.parse(raw);
   } catch {
     log?.(`subagent-watcher: backfill skip ${agentId} \u2014 meta.json not readable at ${metaPath}`);
@@ -48351,7 +49040,7 @@ function startSubagentWatcher(config) {
     clearTimeout(ref.ref);
   });
   const fs2 = config.fs ?? {
-    existsSync: existsSync22,
+    existsSync: existsSync25,
     readdirSync: readdirSync3,
     statSync: statSync6,
     openSync: openSync2,
@@ -48585,8 +49274,8 @@ function startSubagentWatcher(config) {
   function rescanSubagentDirs() {
     if (stopped)
       return;
-    const claudeHome = join19(agentDir, ".claude");
-    const projectsRoot = join19(claudeHome, "projects");
+    const claudeHome = join22(agentDir, ".claude");
+    const projectsRoot = join22(claudeHome, "projects");
     if (!fs2.existsSync(projectsRoot))
       return;
     let projectDirs;
@@ -48603,7 +49292,7 @@ function startSubagentWatcher(config) {
         }
         continue;
       }
-      const projectPath = join19(projectsRoot, pDir);
+      const projectPath = join22(projectsRoot, pDir);
       let sessionDirs;
       try {
         sessionDirs = fs2.readdirSync(projectPath);
@@ -48613,7 +49302,7 @@ function startSubagentWatcher(config) {
       for (const sDir of sessionDirs) {
         if (sDir.endsWith(".jsonl"))
           continue;
-        const subagentsPath = join19(projectPath, sDir, "subagents");
+        const subagentsPath = join22(projectPath, sDir, "subagents");
         if (!fs2.existsSync(subagentsPath))
           continue;
         if (!dirWatchers.has(subagentsPath)) {
@@ -48621,7 +49310,7 @@ function startSubagentWatcher(config) {
             const w = fs2.watch(subagentsPath, (_event, filename) => {
               if (!filename || !filename.toString().startsWith("agent-") || !filename.toString().endsWith(".jsonl"))
                 return;
-              const filePath = join19(subagentsPath, filename.toString());
+              const filePath = join22(subagentsPath, filename.toString());
               if (!knownFiles.has(filePath)) {
                 scanSubagentsDir(subagentsPath);
               }
@@ -48646,7 +49335,7 @@ function startSubagentWatcher(config) {
     for (const e of entries) {
       if (!e.startsWith("agent-") || !e.endsWith(".jsonl"))
         continue;
-      const filePath = join19(subagentsPath, e);
+      const filePath = join22(subagentsPath, e);
       if (knownFiles.has(filePath))
         continue;
       const agentId = e.slice("agent-".length, -".jsonl".length);
@@ -48763,15 +49452,15 @@ function determineRestartReason(opts) {
 init_boot_card();
 
 // gateway/update-announce.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync14, openSync as openSync3, closeSync as closeSync3, readFileSync as readFileSync26 } from "node:fs";
-import { join as join24 } from "node:path";
-import { homedir as homedir10 } from "node:os";
+import { existsSync as existsSync30, mkdirSync as mkdirSync17, openSync as openSync3, closeSync as closeSync3, readFileSync as readFileSync28 } from "node:fs";
+import { join as join27 } from "node:path";
+import { homedir as homedir12 } from "node:os";
 
 // ../src/host-control/audit-reader.ts
-import { homedir as homedir9 } from "node:os";
-import { join as join23 } from "node:path";
-function defaultAuditLogPath(home2 = homedir9()) {
-  return join23(home2, ".switchroom", "host-control-audit.log");
+import { homedir as homedir11 } from "node:os";
+import { join as join26 } from "node:path";
+function defaultAuditLogPath(home2 = homedir11()) {
+  return join26(home2, ".switchroom", "host-control-audit.log");
 }
 function parseAuditLine(line) {
   const trimmed = line.trim();
@@ -48877,8 +49566,8 @@ function readAndFilter(raw, filters, limit) {
 var DEFAULT_LOOKBACK_MS = 10 * 60 * 1000;
 function readLastTerminalUpdateAudit(opts = {}) {
   const path = opts.auditLogPath ?? defaultAuditLogPath();
-  const exists = opts.exists ?? existsSync27;
-  const readFile = opts.readFile ?? ((p) => readFileSync26(p, "utf-8"));
+  const exists = opts.exists ?? existsSync30;
+  const readFile = opts.readFile ?? ((p) => readFileSync28(p, "utf-8"));
   if (!exists(path))
     return null;
   let raw;
@@ -48939,15 +49628,15 @@ function renderUpdateOutcomeLine(entry) {
 `);
 }
 function claimUpdateAnnouncement(requestId, opts = {}) {
-  const stateDir = opts.stateDir ?? process.env.TELEGRAM_STATE_DIR ?? join24(homedir10(), ".switchroom");
-  const dir = join24(stateDir, "update-announced");
+  const stateDir = opts.stateDir ?? process.env.TELEGRAM_STATE_DIR ?? join27(homedir12(), ".switchroom");
+  const dir = join27(stateDir, "update-announced");
   try {
-    mkdirSync14(dir, { recursive: true });
+    mkdirSync17(dir, { recursive: true });
   } catch {
     return false;
   }
   const safeId = requestId.replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 200);
-  const path = join24(dir, safeId);
+  const path = join27(dir, safeId);
   try {
     const fd = openSync3(path, "wx");
     closeSync3(fd);
@@ -48966,7 +49655,7 @@ function maybeRenderUpdateAnnouncement(opts = {}) {
 }
 
 // issues-card.ts
-import { readFileSync as readFileSync27, writeFileSync as writeFileSync16 } from "node:fs";
+import { readFileSync as readFileSync29, writeFileSync as writeFileSync18 } from "node:fs";
 var SEVERITY_EMOJI = {
   info: "\u2139\ufe0f",
   warn: "\u26a0\ufe0f",
@@ -49058,7 +49747,7 @@ function extractRetryAfterSecs(err) {
 var COOLDOWN_JITTER_MS = 500;
 function readPersistedMessageId(path, log) {
   try {
-    const raw = readFileSync27(path, "utf8");
+    const raw = readFileSync29(path, "utf8");
     const parsed = JSON.parse(raw);
     const v = parsed.messageId;
     if (typeof v === "number" && Number.isInteger(v) && v > 0)
@@ -49074,7 +49763,7 @@ function readPersistedMessageId(path, log) {
 }
 function writePersistedMessageId(path, messageId, log) {
   try {
-    writeFileSync16(path, JSON.stringify({ messageId }) + `
+    writeFileSync18(path, JSON.stringify({ messageId }) + `
 `, { mode: 384 });
   } catch (err) {
     log(`issues-card: persist write failed (${err.message})`);
@@ -49167,24 +49856,24 @@ function createIssuesCardHandle(opts) {
 }
 
 // issues-watcher.ts
-import { existsSync as existsSync29, statSync as statSync8 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync32, statSync as statSync8 } from "node:fs";
+import { join as join29 } from "node:path";
 
 // ../src/issues/store.ts
 import {
   closeSync as closeSync4,
-  existsSync as existsSync28,
-  mkdirSync as mkdirSync15,
+  existsSync as existsSync31,
+  mkdirSync as mkdirSync18,
   openSync as openSync4,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync28,
+  readFileSync as readFileSync30,
   renameSync as renameSync11,
   statSync as statSync7,
-  unlinkSync as unlinkSync10,
-  writeFileSync as writeFileSync17,
+  unlinkSync as unlinkSync11,
+  writeFileSync as writeFileSync19,
   writeSync
 } from "node:fs";
-import { join as join25 } from "node:path";
+import { join as join28 } from "node:path";
 import { randomBytes as randomBytes4 } from "node:crypto";
 import { execSync } from "node:child_process";
 
@@ -49200,12 +49889,12 @@ var SEVERITY_RANK2 = {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path = join25(stateDir, ISSUES_FILE);
-  if (!existsSync28(path))
+  const path = join28(stateDir, ISSUES_FILE);
+  if (!existsSync31(path))
     return [];
   let raw;
   try {
-    raw = readFileSync28(path, "utf-8");
+    raw = readFileSync30(path, "utf-8");
   } catch {
     return [];
   }
@@ -49237,7 +49926,7 @@ function list(stateDir, opts = {}) {
   });
 }
 function resolve6(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync28(join25(stateDir, ISSUES_FILE)))
+  if (!existsSync31(join28(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -49255,13 +49944,13 @@ function resolve6(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function writeAll(stateDir, events) {
-  const path = join25(stateDir, ISSUES_FILE);
+  const path = join28(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path}.tmp-${process.pid}-${randomBytes4(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
 `) + `
 `;
-  writeFileSync17(tmp, body, "utf-8");
+  writeFileSync19(tmp, body, "utf-8");
   renameSync11(tmp, path);
 }
 var ORPHAN_TMP_TTL_MS = 60000;
@@ -49277,11 +49966,11 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath2 = join25(stateDir, entry);
+    const tmpPath2 = join28(stateDir, entry);
     try {
       const stat = statSync7(tmpPath2);
       if (stat.mtimeMs < cutoff) {
-        unlinkSync10(tmpPath2);
+        unlinkSync11(tmpPath2);
       }
     } catch {}
   }
@@ -49289,7 +49978,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join25(stateDir, ISSUES_LOCK);
+  const lockPath = join28(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -49317,27 +50006,27 @@ function withLock(stateDir, fn) {
       closeSync4(fd);
     } catch {}
     try {
-      unlinkSync10(lockPath);
+      unlinkSync11(lockPath);
     } catch {}
   }
 }
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync28(lockPath, "utf-8").trim();
+    pidStr = readFileSync30(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
   const pid = Number(pidStr);
   if (!Number.isFinite(pid) || pid <= 0) {
     try {
-      unlinkSync10(lockPath);
+      unlinkSync11(lockPath);
     } catch {}
     return true;
   }
   if (pid === process.pid) {
     try {
-      unlinkSync10(lockPath);
+      unlinkSync11(lockPath);
     } catch {}
     return true;
   }
@@ -49352,7 +50041,7 @@ function tryStealStaleLock(lockPath) {
       return false;
   }
   try {
-    unlinkSync10(lockPath);
+    unlinkSync11(lockPath);
   } catch {}
   return true;
 }
@@ -49374,7 +50063,7 @@ function isIssueEvent(v) {
 // issues-watcher.ts
 var DEFAULT_POLL_INTERVAL_MS2 = 2000;
 function startIssuesWatcher(opts) {
-  const path = join26(opts.stateDir, ISSUES_FILE);
+  const path = join29(opts.stateDir, ISSUES_FILE);
   const log = opts.log ?? (() => {});
   const intervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS2;
   const setIntervalFn = opts.setInterval ?? setInterval;
@@ -49422,7 +50111,7 @@ function startIssuesWatcher(opts) {
   };
 }
 function defaultSignatureProvider(path) {
-  if (!existsSync29(path))
+  if (!existsSync32(path))
     return null;
   try {
     const stat = statSync8(path);
@@ -49906,8 +50595,8 @@ function extractFlowItems(line) {
 }
 
 // credits-watch.ts
-import { readFileSync as readFileSync29, writeFileSync as writeFileSync18, existsSync as existsSync30, mkdirSync as mkdirSync16 } from "fs";
-import { join as join27 } from "path";
+import { readFileSync as readFileSync31, writeFileSync as writeFileSync20, existsSync as existsSync33, mkdirSync as mkdirSync19 } from "fs";
+import { join as join30 } from "path";
 var STATE_FILE = "credits-watch.json";
 var FATAL_REASONS = new Set([
   "out_of_credits",
@@ -49919,12 +50608,12 @@ function emptyCreditState() {
   return { lastNotifiedReason: null, lastNotifiedAt: 0 };
 }
 function readClaudeJsonOverage(claudeConfigDir) {
-  const path = join27(claudeConfigDir, ".claude.json");
-  if (!existsSync30(path))
+  const path = join30(claudeConfigDir, ".claude.json");
+  if (!existsSync33(path))
     return null;
   let raw;
   try {
-    raw = readFileSync29(path, "utf-8");
+    raw = readFileSync31(path, "utf-8");
   } catch {
     return null;
   }
@@ -50004,11 +50693,11 @@ function escapeHtml10(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function loadCreditState(stateDir) {
-  const path = join27(stateDir, STATE_FILE);
-  if (!existsSync30(path))
+  const path = join30(stateDir, STATE_FILE);
+  if (!existsSync33(path))
     return emptyCreditState();
   try {
-    const raw = readFileSync29(path, "utf-8");
+    const raw = readFileSync31(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object" && (parsed.lastNotifiedReason === null || typeof parsed.lastNotifiedReason === "string") && typeof parsed.lastNotifiedAt === "number" && Number.isFinite(parsed.lastNotifiedAt)) {
       return {
@@ -50020,15 +50709,15 @@ function loadCreditState(stateDir) {
   return emptyCreditState();
 }
 function saveCreditState(stateDir, state4) {
-  mkdirSync16(stateDir, { recursive: true });
-  const path = join27(stateDir, STATE_FILE);
-  writeFileSync18(path, JSON.stringify(state4, null, 2) + `
+  mkdirSync19(stateDir, { recursive: true });
+  const path = join30(stateDir, STATE_FILE);
+  writeFileSync20(path, JSON.stringify(state4, null, 2) + `
 `, { mode: 384 });
 }
 
 // quota-watch.ts
-import { readFileSync as readFileSync30, writeFileSync as writeFileSync19, existsSync as existsSync31, mkdirSync as mkdirSync17 } from "fs";
-import { join as join28 } from "path";
+import { readFileSync as readFileSync32, writeFileSync as writeFileSync21, existsSync as existsSync34, mkdirSync as mkdirSync20 } from "fs";
+import { join as join31 } from "path";
 var STATE_FILE2 = "quota-watch.json";
 function emptyQuotaWatchState() {
   return {};
@@ -50118,11 +50807,11 @@ function escapeHtml11(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function loadQuotaWatchState(stateDir) {
-  const path = join28(stateDir, STATE_FILE2);
-  if (!existsSync31(path))
+  const path = join31(stateDir, STATE_FILE2);
+  if (!existsSync34(path))
     return emptyQuotaWatchState();
   try {
-    const raw = readFileSync30(path, "utf-8");
+    const raw = readFileSync32(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return emptyQuotaWatchState();
@@ -50139,9 +50828,9 @@ function loadQuotaWatchState(stateDir) {
   }
 }
 function saveQuotaWatchState(stateDir, state4) {
-  mkdirSync17(stateDir, { recursive: true });
-  const path = join28(stateDir, STATE_FILE2);
-  writeFileSync19(path, JSON.stringify(state4, null, 2) + `
+  mkdirSync20(stateDir, { recursive: true });
+  const path = join31(stateDir, STATE_FILE2);
+  writeFileSync21(path, JSON.stringify(state4, null, 2) + `
 `, { mode: 384 });
 }
 function patchQuotaWatchState(current, accountLabel, accountState) {
@@ -50154,27 +50843,27 @@ init_auth_snapshot_format();
 // gateway/turn-active-marker.ts
 import {
   closeSync as closeSync5,
-  existsSync as existsSync32,
-  mkdirSync as mkdirSync18,
+  existsSync as existsSync35,
+  mkdirSync as mkdirSync21,
   openSync as openSync5,
-  readFileSync as readFileSync31,
+  readFileSync as readFileSync33,
   statSync as statSync9,
-  unlinkSync as unlinkSync11,
+  unlinkSync as unlinkSync12,
   utimesSync as utimesSync2,
-  writeFileSync as writeFileSync20
+  writeFileSync as writeFileSync22
 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join32 } from "node:path";
 var TURN_ACTIVE_MARKER_FILE2 = "turn-active.json";
 function writeTurnActiveMarker(stateDir, marker) {
   try {
-    mkdirSync18(stateDir, { recursive: true });
-    writeFileSync20(join29(stateDir, TURN_ACTIVE_MARKER_FILE2), JSON.stringify(marker, null, 2) + `
+    mkdirSync21(stateDir, { recursive: true });
+    writeFileSync22(join32(stateDir, TURN_ACTIVE_MARKER_FILE2), JSON.stringify(marker, null, 2) + `
 `, { mode: 384 });
   } catch {}
 }
 function touchTurnActiveMarker2(stateDir) {
-  const path = join29(stateDir, TURN_ACTIVE_MARKER_FILE2);
-  if (!existsSync32(path))
+  const path = join32(stateDir, TURN_ACTIVE_MARKER_FILE2);
+  if (!existsSync35(path))
     return;
   const now = new Date;
   try {
@@ -50188,12 +50877,12 @@ function touchTurnActiveMarker2(stateDir) {
 }
 function removeTurnActiveMarker(stateDir) {
   try {
-    unlinkSync11(join29(stateDir, TURN_ACTIVE_MARKER_FILE2));
+    unlinkSync12(join32(stateDir, TURN_ACTIVE_MARKER_FILE2));
   } catch {}
 }
 function sweepStaleTurnActiveMarker(stateDir, opts) {
-  const path = join29(stateDir, TURN_ACTIVE_MARKER_FILE2);
-  if (!existsSync32(path))
+  const path = join32(stateDir, TURN_ACTIVE_MARKER_FILE2);
+  if (!existsSync35(path))
     return false;
   const now = opts.now ?? Date.now();
   try {
@@ -50205,9 +50894,9 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
       return false;
     let payload = null;
     try {
-      payload = readFileSync31(path, "utf8");
+      payload = readFileSync33(path, "utf8");
     } catch {}
-    unlinkSync11(path);
+    unlinkSync12(path);
     if (opts.onRemove) {
       try {
         opts.onRemove({
@@ -50224,10 +50913,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.9";
-var COMMIT_SHA = "fd8ed8ed";
-var COMMIT_DATE = "2026-05-29T03:11:29Z";
-var LATEST_PR = 1985;
+var VERSION = "0.14.10";
+var COMMIT_SHA = "0cd391b5";
+var COMMIT_DATE = "2026-05-29T05:14:25Z";
+var LATEST_PR = 1987;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -50298,14 +50987,14 @@ function classifyRejection(err, opts = {}) {
 // ../src/vault/broker/client.ts
 init_protocol2();
 init_peercred();
-import * as net4 from "node:net";
+import * as net5 from "node:net";
 import * as fs2 from "node:fs";
-import { homedir as homedir11 } from "node:os";
-import { join as join30 } from "node:path";
+import { homedir as homedir13 } from "node:os";
+import { join as join33 } from "node:path";
 var DEFAULT_TIMEOUT_MS4 = 2000;
 var UNLOCK_TIMEOUT_MS = 30000;
-var LEGACY_SOCKET_PATH2 = join30(homedir11(), ".switchroom", "vault-broker.sock");
-var OPERATOR_SOCKET_PATH2 = join30(homedir11(), ".switchroom", "broker-operator", "sock");
+var LEGACY_SOCKET_PATH2 = join33(homedir13(), ".switchroom", "vault-broker.sock");
+var OPERATOR_SOCKET_PATH2 = join33(homedir13(), ".switchroom", "broker-operator", "sock");
 function defaultBrokerSocketPath2() {
   if (fs2.existsSync(OPERATOR_SOCKET_PATH2))
     return OPERATOR_SOCKET_PATH2;
@@ -50334,7 +51023,7 @@ async function rpc2(req, opts) {
       settled = true;
       resolve7(val);
     };
-    const client3 = new net4.Socket;
+    const client3 = new net5.Socket;
     const timer3 = setTimeout(() => {
       client3.destroy();
       settle({ kind: "unreachable", msg: `broker did not respond within ${timeoutMs}ms` });
@@ -50428,7 +51117,7 @@ async function unlockViaBroker(passphrase, opts) {
       client3.destroy();
       settle({ ok: false, msg: "Timeout waiting for broker" });
     }, timeoutMs);
-    const client3 = net4.createConnection({ path: unlockSocketPath });
+    const client3 = net5.createConnection({ path: unlockSocketPath });
     client3.on("error", (err) => {
       clearTimeout(timer3);
       settle({ ok: false, msg: `Broker unreachable: ${err.message}` });
@@ -50527,8 +51216,8 @@ function resolveVaultApprovalPosture(broker) {
 }
 
 // registry/turns-schema.ts
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync19 } from "fs";
-import { join as join31 } from "path";
+import { chmodSync as chmodSync4, mkdirSync as mkdirSync22 } from "fs";
+import { join as join34 } from "path";
 var DatabaseClass2 = null;
 function loadDatabaseClass2() {
   if (DatabaseClass2 != null)
@@ -50587,13 +51276,13 @@ function applySchema(db2) {
 }
 function openTurnsDb(agentDir) {
   const Database = loadDatabaseClass2();
-  const dir = join31(agentDir, "telegram");
-  mkdirSync19(dir, { recursive: true, mode: 448 });
-  const path = join31(dir, "registry.db");
+  const dir = join34(agentDir, "telegram");
+  mkdirSync22(dir, { recursive: true, mode: 448 });
+  const path = join34(dir, "registry.db");
   const db2 = new Database(path, { create: true });
   applySchema(db2);
   try {
-    chmodSync3(path, 384);
+    chmodSync4(path, 384);
   } catch {}
   return db2;
 }
@@ -50730,11 +51419,11 @@ installGlobalErrorHandlers();
 process.on("beforeExit", () => {
   shutdownAnalytics();
 });
-var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join33(homedir12(), ".claude", "channels", "telegram");
-var ACCESS_FILE = join33(STATE_DIR, "access.json");
-var APPROVED_DIR = join33(STATE_DIR, "approved");
-var ENV_FILE = join33(STATE_DIR, ".env");
-var INBOX_DIR = join33(STATE_DIR, "inbox");
+var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join36(homedir14(), ".claude", "channels", "telegram");
+var ACCESS_FILE = join36(STATE_DIR, "access.json");
+var APPROVED_DIR = join36(STATE_DIR, "approved");
+var ENV_FILE = join36(STATE_DIR, ".env");
+var INBOX_DIR = join36(STATE_DIR, "inbox");
 function triggerSelfRestart(targetAgent, reason, delayMs = 300) {
   const isDocker = process.env.SWITCHROOM_RUNTIME === "docker";
   const selfAgent = process.env.SWITCHROOM_AGENT_NAME;
@@ -50798,8 +51487,8 @@ function formatBootVersion() {
   });
 }
 try {
-  chmodSync5(ENV_FILE, 384);
-  for (const line of readFileSync34(ENV_FILE, "utf8").split(`
+  chmodSync6(ENV_FILE, 384);
+  for (const line of readFileSync36(ENV_FILE, "utf8").split(`
 `)) {
     const m = line.match(/^(\w+)=(.*)$/);
     if (m && process.env[m[1]] === undefined)
@@ -50852,7 +51541,7 @@ installTgPostLogger(bot);
 var _rawSendMessageDraft = bot.api.raw.sendMessageDraft;
 var GRAMMY_VERSION = (() => {
   try {
-    const raw = readFileSync34(new URL("../../node_modules/grammy/package.json", import.meta.url), "utf8");
+    const raw = readFileSync36(new URL("../../node_modules/grammy/package.json", import.meta.url), "utf8");
     return JSON.parse(raw).version ?? "unknown";
   } catch {
     return "unknown";
@@ -50925,7 +51614,7 @@ function assertSendable(f) {
   } catch {
     throw new Error(`refusing to send file \u2014 cannot resolve real path: ${f}`);
   }
-  const inbox = join33(stateReal, "inbox");
+  const inbox = join36(stateReal, "inbox");
   if (real.startsWith(stateReal + sep3) && !real.startsWith(inbox + sep3)) {
     throw new Error(`refusing to send channel state: ${f}`);
   }
@@ -50944,7 +51633,7 @@ function assertSendable(f) {
 }
 function readAccessFile() {
   try {
-    const raw = readFileSync34(ACCESS_FILE, "utf8");
+    const raw = readFileSync36(ACCESS_FILE, "utf8");
     const parsed = JSON.parse(raw);
     const allowFrom = validateStringArray("allowFrom", parsed.allowFrom ?? []);
     const groups = {};
@@ -51009,9 +51698,9 @@ function assertAllowedChat(chat_id) {
 function saveAccess(a) {
   if (STATIC)
     return;
-  mkdirSync23(STATE_DIR, { recursive: true, mode: 448 });
+  mkdirSync26(STATE_DIR, { recursive: true, mode: 448 });
   const tmp = ACCESS_FILE + ".tmp";
-  writeFileSync23(tmp, JSON.stringify(a, null, 2) + `
+  writeFileSync25(tmp, JSON.stringify(a, null, 2) + `
 `, { mode: 384 });
   renameSync13(tmp, ACCESS_FILE);
 }
@@ -51031,7 +51720,7 @@ var HISTORY_ENABLED = HISTORY_ACCESS.historyEnabled !== false;
 if (HISTORY_ENABLED) {
   try {
     initHistory(STATE_DIR, HISTORY_ACCESS.historyRetentionDays ?? 30);
-    process.stderr.write(`telegram gateway: history capture enabled at ${join33(STATE_DIR, "history.db")}
+    process.stderr.write(`telegram gateway: history capture enabled at ${join36(STATE_DIR, "history.db")}
 `);
   } catch (err) {
     process.stderr.write(`telegram gateway: history init failed (${err.message}) \u2014 capture disabled
@@ -51048,10 +51737,10 @@ try {
     process.stderr.write(`telegram gateway: turn-registry boot-reaper stamped ${reaped} orphaned turn(s) as ended_via='restart'
 `);
   } else {
-    process.stderr.write(`telegram gateway: turn-registry initialized at ${join33(agentDir, "telegram", "registry.db")}
+    process.stderr.write(`telegram gateway: turn-registry initialized at ${join36(agentDir, "telegram", "registry.db")}
 `);
   }
-  const pendingEnvPath = join33(agentDir, ".pending-turn.env");
+  const pendingEnvPath = join36(agentDir, ".pending-turn.env");
   try {
     const pending2 = findMostRecentInterruptedTurn(turnsDb);
     if (pending2 != null) {
@@ -51065,13 +51754,13 @@ try {
         `SWITCHROOM_PENDING_STARTED_AT=${pending2.started_at}`
       ];
       const pendingEnvTmp = `${pendingEnvPath}.tmp-${process.pid}`;
-      writeFileSync23(pendingEnvTmp, lines.join(`
+      writeFileSync25(pendingEnvTmp, lines.join(`
 `) + `
 `, { mode: 384 });
       renameSync13(pendingEnvTmp, pendingEnvPath);
       process.stderr.write(`telegram gateway: pending-turn env written to ${pendingEnvPath} turnKey=${pending2.turn_key} endedVia=${pending2.ended_via ?? "open"}
 `);
-    } else if (existsSync36(pendingEnvPath)) {
+    } else if (existsSync39(pendingEnvPath)) {
       rmSync4(pendingEnvPath, { force: true });
       process.stderr.write(`telegram gateway: pending-turn env cleared (clean previous shutdown)
 `);
@@ -51125,7 +51814,7 @@ function checkApprovals() {
     return;
   }
   for (const senderId of files) {
-    const file = join33(APPROVED_DIR, senderId);
+    const file = join36(APPROVED_DIR, senderId);
     bot.api.sendMessage(senderId, "Paired! Say hi to Claude.").then(() => rmSync4(file, { force: true }), (err) => {
       process.stderr.write(`telegram gateway: failed to send approval confirm: ${err}
 `);
@@ -52014,11 +52703,11 @@ var unpinProgressCardForChat = null;
 var getPinnedProgressCardMessageId = null;
 var completeProgressCardTurn = null;
 var subagentWatcher = null;
-var SOCKET_PATH = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join33(STATE_DIR, "gateway.sock");
-mkdirSync23(STATE_DIR, { recursive: true, mode: 448 });
-var GATEWAY_PID_PATH = process.env.SWITCHROOM_GATEWAY_PID_FILE ?? join33(STATE_DIR, "gateway.pid.json");
-var GATEWAY_SESSION_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_SESSION_MARKER ?? join33(STATE_DIR, "gateway-session.json");
-var GATEWAY_CLEAN_SHUTDOWN_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_CLEAN_SHUTDOWN_MARKER ?? join33(STATE_DIR, "clean-shutdown.json");
+var SOCKET_PATH = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join36(STATE_DIR, "gateway.sock");
+mkdirSync26(STATE_DIR, { recursive: true, mode: 448 });
+var GATEWAY_PID_PATH = process.env.SWITCHROOM_GATEWAY_PID_FILE ?? join36(STATE_DIR, "gateway.pid.json");
+var GATEWAY_SESSION_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_SESSION_MARKER ?? join36(STATE_DIR, "gateway-session.json");
+var GATEWAY_CLEAN_SHUTDOWN_MARKER_PATH = process.env.SWITCHROOM_GATEWAY_CLEAN_SHUTDOWN_MARKER ?? join36(STATE_DIR, "clean-shutdown.json");
 var GATEWAY_STARTED_AT_MS = Date.now();
 var BOOT_CARD_ENABLED = process.env.SWITCHROOM_BOOT_CARD !== "false";
 var activeBootCard = null;
@@ -52047,7 +52736,7 @@ function ensureIssuesCard(chatId, threadId) {
     bot: botApi,
     log: (msg) => process.stderr.write(`telegram gateway: ${msg}
 `),
-    persistPath: join33(stateDir, "issues-card.json")
+    persistPath: join36(stateDir, "issues-card.json")
   });
   activeIssuesWatcher = startIssuesWatcher({
     stateDir,
@@ -52221,13 +52910,13 @@ startTimer2({
   }
 });
 var inboundSpool = STATIC ? undefined : createInboundSpool({
-  path: join33(STATE_DIR, "inbound-spool.jsonl"),
+  path: join36(STATE_DIR, "inbound-spool.jsonl"),
   fs: {
-    appendFileSync: (p, d) => appendFileSync3(p, d),
-    readFileSync: (p) => readFileSync34(p, "utf8"),
-    writeFileSync: (p, d) => writeFileSync23(p, d),
+    appendFileSync: (p, d) => appendFileSync5(p, d),
+    readFileSync: (p) => readFileSync36(p, "utf8"),
+    writeFileSync: (p, d) => writeFileSync25(p, d),
     renameSync: (a, b) => renameSync13(a, b),
-    existsSync: (p) => existsSync36(p),
+    existsSync: (p) => existsSync39(p),
     statSizeSync: (p) => statSync13(p).size
   }
 });
@@ -52354,7 +53043,7 @@ var ipcServer = createIpcServer({
             probeQuotaViaBroker: (t) => probeQuotaForBootCard(agentSlug, t),
             tmuxSupervisor: process.env.SWITCHROOM_TMUX_SUPERVISOR === "1",
             dockerMode: process.env.SWITCHROOM_RUNTIME === "docker",
-            configSnapshotPath: join33(resolvedAgentDirForCard, ".config-snapshot.json"),
+            configSnapshotPath: join36(resolvedAgentDirForCard, ".config-snapshot.json"),
             ...updateOutcomeLine ? { updateOutcomeLine } : {}
           }, ackMsgId).then((handle) => {
             activeBootCard = handle;
@@ -52769,6 +53458,62 @@ ${reminder}
   log: (msg) => process.stderr.write(`telegram gateway: ipc \u2014 ${msg}
 `)
 });
+(() => {
+  try {
+    const selfAgent = process.env.SWITCHROOM_AGENT_NAME ?? "";
+    if (!selfAgent)
+      return;
+    let viaGateway = false;
+    try {
+      const cfg = loadConfig2();
+      const raw = cfg.agents?.[selfAgent];
+      viaGateway = raw ? resolveAgentConfig2(cfg.defaults, cfg.profiles, raw).channels?.telegram?.webhook_via_gateway === true : false;
+    } catch (err) {
+      process.stderr.write(`telegram gateway: webhook-ingest config probe failed: ${err.message}
+`);
+    }
+    if (!viaGateway)
+      return;
+    const allowedUids = [];
+    const ownUid = typeof process.getuid === "function" ? process.getuid() : null;
+    if (ownUid !== null)
+      allowedUids.push(ownUid);
+    const receiverUidRaw = process.env.SWITCHROOM_WEBHOOK_RECEIVER_UID;
+    const receiverUid = receiverUidRaw ? Number(receiverUidRaw) : NaN;
+    if (Number.isInteger(receiverUid))
+      allowedUids.push(receiverUid);
+    const socketPath = join36(STATE_DIR, "webhook.sock");
+    const webhookInject = (agentName3, inbound) => {
+      const msg = inbound;
+      const delivered = ipcServer.sendToAgent(agentName3, msg);
+      if (delivered)
+        markClaudeBusyForInbound(msg);
+      else
+        pendingInboundBuffer.push(agentName3, msg);
+      return delivered;
+    };
+    startWebhookIngestServer({
+      socketPath,
+      allowedUids,
+      log: (s) => process.stderr.write(`telegram gateway: ${s}`),
+      onRecord: (req) => recordWebhookEvent({
+        agent: selfAgent,
+        source: req.source,
+        event_type: req.event_type,
+        ts: req.ts,
+        rendered_text: req.rendered_text,
+        payload: req.payload,
+        ...req.delivery_id ? { delivery_id: req.delivery_id } : {}
+      }, {
+        inject: webhookInject,
+        log: (s) => process.stderr.write(`telegram gateway: ${s}`)
+      })
+    });
+  } catch (err) {
+    process.stderr.write(`telegram gateway: webhook-ingest server start failed (non-fatal): ${err.message}
+`);
+  }
+})();
 var IDLE_DRAIN_INTERVAL_MS = 5000;
 if (!STATIC) {
   setInterval(() => {
@@ -53734,11 +54479,11 @@ async function executeSendGif(rawArgs) {
   };
 }
 async function publishToTelegraph(text, shortName, authorName) {
-  const accountPath = join33(STATE_DIR, "telegraph-account.json");
+  const accountPath = join36(STATE_DIR, "telegraph-account.json");
   let account = null;
   try {
-    if (existsSync36(accountPath)) {
-      const raw = readFileSync34(accountPath, "utf-8");
+    if (existsSync39(accountPath)) {
+      const raw = readFileSync36(accountPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed.shortName && parsed.accessToken) {
         account = parsed;
@@ -53757,8 +54502,8 @@ async function publishToTelegraph(text, shortName, authorName) {
     }
     account = created.value;
     try {
-      mkdirSync23(STATE_DIR, { recursive: true, mode: 448 });
-      writeFileSync23(accountPath, JSON.stringify(account, null, 2), { mode: 384 });
+      mkdirSync26(STATE_DIR, { recursive: true, mode: 448 });
+      writeFileSync25(accountPath, JSON.stringify(account, null, 2), { mode: 384 });
     } catch (err) {
       process.stderr.write(`telegram gateway: telegraph cache write failed: ${err.message}
 `);
@@ -54000,9 +54745,9 @@ async function executeDownloadAttachment(args) {
     fileUniqueId: file.file_unique_id,
     now: Date.now()
   });
-  mkdirSync23(INBOX_DIR, { recursive: true, mode: 448 });
+  mkdirSync26(INBOX_DIR, { recursive: true, mode: 448 });
   assertInsideInbox(INBOX_DIR, dlPath);
-  writeFileSync23(dlPath, buf, { mode: 384 });
+  writeFileSync25(dlPath, buf, { mode: 384 });
   return { content: [{ type: "text", text: dlPath }] };
 }
 async function executeEditMessage(args) {
@@ -55777,14 +56522,14 @@ function restartMarkerPath() {
   const agentDir = resolveAgentDirFromEnv();
   if (!agentDir)
     return null;
-  return join33(agentDir, "restart-pending.json");
+  return join36(agentDir, "restart-pending.json");
 }
 function writeRestartMarker(marker) {
   const p = restartMarkerPath();
   if (!p)
     return;
   try {
-    writeFileSync23(p, JSON.stringify(marker));
+    writeFileSync25(p, JSON.stringify(marker));
     lastPlannedRestartAt = Date.now();
     process.stderr.write(`telegram gateway: restart-marker: write chat_id=${marker.chat_id} thread_id=${marker.thread_id ?? "-"} ack=${marker.ack_message_id ?? "-"} path=${p}
 `);
@@ -55803,7 +56548,7 @@ function readRestartMarker() {
   if (!p)
     return null;
   try {
-    return JSON.parse(readFileSync34(p, "utf8"));
+    return JSON.parse(readFileSync36(p, "utf8"));
   } catch {
     return null;
   }
@@ -55901,7 +56646,7 @@ var _dockerReachable;
 function isDockerReachable() {
   if (_dockerReachable !== undefined)
     return _dockerReachable;
-  if (!existsSync36("/var/run/docker.sock")) {
+  if (!existsSync39("/var/run/docker.sock")) {
     _dockerReachable = false;
     return _dockerReachable;
   }
@@ -55918,12 +56663,12 @@ function _resetDockerReachableCache() {
 }
 function spawnSwitchroomDetached(args, onFailure) {
   const fullArgs = SWITCHROOM_CONFIG ? ["--config", SWITCHROOM_CONFIG, ...args] : args;
-  const logPath = join33(STATE_DIR, "detached-spawn.log");
+  const logPath = join36(STATE_DIR, "detached-spawn.log");
   let outFd = null;
   try {
-    mkdirSync23(STATE_DIR, { recursive: true });
+    mkdirSync26(STATE_DIR, { recursive: true });
     outFd = openSync8(logPath, "a");
-    writeFileSync23(logPath, `
+    writeFileSync25(logPath, `
 [${new Date().toISOString()}] spawn ${SWITCHROOM_CLI} ${fullArgs.join(" ")}
 `, { flag: "a" });
   } catch {}
@@ -55949,7 +56694,7 @@ function spawnSwitchroomDetached(args, onFailure) {
         return;
       let tail = "";
       try {
-        const full = readFileSync34(logPath, "utf8");
+        const full = readFileSync36(logPath, "utf8");
         tail = full.split(`
 `).slice(-30).join(`
 `).trim();
@@ -56291,10 +57036,10 @@ bot.use(async (ctx, next) => {
 });
 function readRecentDenialsForAgent(agentName3, windowMs, limit) {
   try {
-    const auditPath = join33(homedir12(), ".switchroom", "vault-audit.log");
-    if (!existsSync36(auditPath))
+    const auditPath = join36(homedir14(), ".switchroom", "vault-audit.log");
+    if (!existsSync39(auditPath))
       return [];
-    const raw = readFileSync34(auditPath, "utf8");
+    const raw = readFileSync36(auditPath, "utf8");
     return recentDenialsFromAuditLog(raw, { agentName: agentName3, windowMs, limit });
   } catch {
     return [];
@@ -56345,7 +57090,7 @@ async function buildAgentMetadata(agentName3) {
   try {
     const agentDir = resolveAgentDirFromEnv();
     if (agentDir) {
-      const raw = readFileSync34(join33(agentDir, ".claude", ".claude.json"), "utf8");
+      const raw = readFileSync36(join36(agentDir, ".claude", ".claude.json"), "utf8");
       claudeJson = JSON.parse(raw);
     }
   } catch {}
@@ -56559,10 +57304,10 @@ bot.command("restart", async (ctx) => {
 function flushAgentHandoff(agentDir) {
   let removed = 0;
   for (const fname of [".handoff.md", ".handoff-topic"]) {
-    const p = join33(agentDir, fname);
+    const p = join36(agentDir, fname);
     try {
-      if (existsSync36(p)) {
-        unlinkSync14(p);
+      if (existsSync39(p)) {
+        unlinkSync15(p);
         removed++;
       }
     } catch (err) {
@@ -56617,7 +57362,7 @@ async function handleNewOrResetCommand(ctx, kind) {
   writeRestartMarker({ chat_id: chatId, thread_id: threadId ?? null, ack_message_id: ackId, ts: Date.now() });
   if (agentDir != null) {
     try {
-      writeFileSync23(join33(agentDir, ".force-fresh-session"), `${kind} at ${new Date().toISOString()}
+      writeFileSync25(join36(agentDir, ".force-fresh-session"), `${kind} at ${new Date().toISOString()}
 `, "utf8");
     } catch (err) {
       process.stderr.write(`telegram gateway: failed to write force-fresh marker: ${err}
@@ -56976,16 +57721,16 @@ bot.command("interrupt", async (ctx) => {
   await runSwitchroomCommand(ctx, ["agent", "interrupt", name], `interrupt ${name}`);
 });
 var lockoutOps = {
-  readFileSync: (p, enc) => readFileSync34(p, enc),
-  writeFileSync: (p, data, opts) => writeFileSync23(p, data, opts),
-  existsSync: (p) => existsSync36(p),
-  mkdirSync: (p, opts) => mkdirSync23(p, opts),
-  joinPath: (...parts) => join33(...parts)
+  readFileSync: (p, enc) => readFileSync36(p, enc),
+  writeFileSync: (p, data, opts) => writeFileSync25(p, data, opts),
+  existsSync: (p) => existsSync39(p),
+  mkdirSync: (p, opts) => mkdirSync26(p, opts),
+  joinPath: (...parts) => join36(...parts)
 };
 var FLEET_FALLBACK_DEDUP_MS = 30000;
 function isAuthBrokerSocketReachable() {
   try {
-    return existsSync36(resolveAuthBrokerSocketPath2());
+    return existsSync39(resolveAuthBrokerSocketPath2());
   } catch {
     return false;
   }
@@ -57046,7 +57791,7 @@ async function runCreditWatch() {
   if (!agentDir)
     return;
   const agentName3 = getMyAgentName();
-  const claudeConfigDir = join33(agentDir, ".claude");
+  const claudeConfigDir = join36(agentDir, ".claude");
   const stateDir = STATE_DIR;
   const reason = readClaudeJsonOverage(claudeConfigDir);
   const prev = loadCreditState(stateDir);
@@ -57349,10 +58094,10 @@ async function handleVaultRecentDenialCallback(ctx, data) {
     return;
   }
   const { token, id } = result;
-  const tokenPath = join33(homedir12(), ".switchroom", "agents", agentName3, ".vault-token");
+  const tokenPath = join36(homedir14(), ".switchroom", "agents", agentName3, ".vault-token");
   try {
-    mkdirSync23(join33(homedir12(), ".switchroom", "agents", agentName3), { recursive: true });
-    writeFileSync23(tokenPath, token, { mode: 384 });
+    mkdirSync26(join36(homedir14(), ".switchroom", "agents", agentName3), { recursive: true });
+    writeFileSync25(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created (${escapeHtmlForTg(id)}) but token write failed:</b> ${escapeHtmlForTg(String(err))}
 <i>Recover with: <code>switchroom vault grant ${escapeHtmlForTg(agentName3)} --keys ${escapeHtmlForTg(keyName)} --duration 30d</code> on the host.</i>`, { html: true });
@@ -57428,10 +58173,10 @@ async function performVaultAccessApproval(ctx, pending2, stageId, senderId, atte
     return;
   }
   const { token, id } = result;
-  const tokenPath = join33(homedir12(), ".switchroom", "agents", pending2.agent, ".vault-token");
+  const tokenPath = join36(homedir14(), ".switchroom", "agents", pending2.agent, ".vault-token");
   try {
-    mkdirSync23(join33(homedir12(), ".switchroom", "agents", pending2.agent), { recursive: true });
-    writeFileSync23(tokenPath, token, { mode: 384 });
+    mkdirSync26(join36(homedir14(), ".switchroom", "agents", pending2.agent), { recursive: true });
+    writeFileSync25(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created (${escapeHtmlForTg(id)}) but token write failed:</b> ${escapeHtmlForTg(String(err))}
 <i>Recover with: <code>switchroom vault grant ${escapeHtmlForTg(pending2.agent)} --keys ${escapeHtmlForTg(pending2.key)} --duration ${Math.round(pending2.ttl_seconds / 86400)}d</code> on the host.</i>`, { html: true });
@@ -57906,10 +58651,10 @@ async function executeGrantWizard(ctx, chatId, state4) {
     return;
   }
   const { token, id } = result;
-  const tokenPath = join33(homedir12(), ".switchroom", "agents", state4.agent, ".vault-token");
+  const tokenPath = join36(homedir14(), ".switchroom", "agents", state4.agent, ".vault-token");
   try {
-    mkdirSync23(join33(homedir12(), ".switchroom", "agents", state4.agent), { recursive: true });
-    writeFileSync23(tokenPath, token, { mode: 384 });
+    mkdirSync26(join36(homedir14(), ".switchroom", "agents", state4.agent), { recursive: true });
+    writeFileSync25(tokenPath, token, { mode: 384 });
   } catch (err) {
     await switchroomReply(ctx, `<b>Grant created but token write failed:</b> ${escapeHtmlForTg(String(err))}`, { html: true });
     return;
@@ -58757,7 +59502,7 @@ bot.command("usage", async (ctx) => {
     await switchroomReply(ctx, "<b>/usage:</b> cannot resolve agent dir.", { html: true });
     return;
   }
-  const result = await fetchQuota2({ claudeConfigDir: join33(agentDir, ".claude") });
+  const result = await fetchQuota2({ claudeConfigDir: join36(agentDir, ".claude") });
   if (!result.ok) {
     await switchroomReply(ctx, `<b>/usage:</b> ${escapeHtmlForTg(result.reason)}`, { html: true });
     return;
@@ -59198,7 +59943,7 @@ ${prettyInput}`;
     const unifiedDiff = (() => {
       try {
         const cfgPath = process.env.SWITCHROOM_CONFIG ?? SWITCHROOM_CONFIG ?? findConfigFile2();
-        const raw = readFileSync34(cfgPath, "utf8");
+        const raw = readFileSync36(cfgPath, "utf8");
         return synthesizeAllowRuleDiff({ agentName: agentName3, rule: rule.rule, configText: raw });
       } catch (err) {
         process.stderr.write(`telegram gateway: always-allow diff synth failed: ${err.message}
@@ -59335,9 +60080,9 @@ bot.on("message:photo", async (ctx) => {
         fileUniqueId: best.file_unique_id,
         now: Date.now()
       });
-      mkdirSync23(INBOX_DIR, { recursive: true, mode: 448 });
+      mkdirSync26(INBOX_DIR, { recursive: true, mode: 448 });
       assertInsideInbox(INBOX_DIR, dlPath);
-      writeFileSync23(dlPath, buf, { mode: 384 });
+      writeFileSync25(dlPath, buf, { mode: 384 });
       return dlPath;
     } catch (err) {
       const msg = err instanceof Error ? err.message : "unknown error";
@@ -59377,8 +60122,8 @@ async function maybeTranscribeVoice(fileId, mimeType, language) {
   let apiKey = null;
   try {
     const path = __require("path").join(__require("os").homedir(), ".switchroom", "openai-api-key");
-    if (existsSync36(path)) {
-      apiKey = readFileSync34(path, "utf-8").trim();
+    if (existsSync39(path)) {
+      apiKey = readFileSync36(path, "utf-8").trim();
     }
   } catch (err) {
     process.stderr.write(`telegram gateway: voice-in: failed to read api key: ${err.message}
@@ -60234,7 +60979,7 @@ var didOneTimeSetup = false;
                         return;
                       }
                     })();
-                    const resolvedAgentDirForBootCard = agentDir ?? join33(homedir12(), ".switchroom", "agents", agentSlug);
+                    const resolvedAgentDirForBootCard = agentDir ?? join36(homedir14(), ".switchroom", "agents", agentSlug);
                     const handle = await startBootCard(chatId, threadId, botApiForCard, {
                       agentName: agentDisplayName,
                       agentSlug,
@@ -60248,7 +60993,7 @@ var didOneTimeSetup = false;
                       probeQuotaViaBroker: (t) => probeQuotaForBootCard(agentSlug, t),
                       tmuxSupervisor: process.env.SWITCHROOM_TMUX_SUPERVISOR === "1",
                       dockerMode: process.env.SWITCHROOM_RUNTIME === "docker",
-                      configSnapshotPath: join33(resolvedAgentDirForBootCard, ".config-snapshot.json"),
+                      configSnapshotPath: join36(resolvedAgentDirForBootCard, ".config-snapshot.json"),
                       ...updateOutcomeLine ? { updateOutcomeLine } : {}
                     }, ackMsgId);
                     activeBootCard = handle;