switchroom 0.14.92 → 0.15.0

package/dist/cli/switchroom.js

@@ -23137,42 +23137,6 @@ var init_resolver = __esm(() => {
   materializedDirs = new Set;
 });
 
-// src/agents/tmux.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
-function sendAgentInterrupt(opts) {
-  const { agentName } = opts;
-  const attempts = typeof opts.attempts === "number" && opts.attempts > 0 ? opts.attempts : 1;
-  const retryDelayMs = typeof opts.retryDelayMs === "number" && opts.retryDelayMs >= 0 ? opts.retryDelayMs : 100;
-  const socket = `switchroom-${agentName}`;
-  const args = ["-L", socket, "send-keys", "-t", agentName, "C-c"];
-  let lastError = null;
-  for (let i = 0;i < attempts; i++) {
-    try {
-      execFileSync5("tmux", args, {
-        timeout: 3000,
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      return { ok: true };
-    } catch (err) {
-      lastError = `tmux send-keys C-c failed: ${err.message}`;
-      console.error(`[tmux-interrupt] ${agentName}: ${lastError}`);
-    }
-    if (i < attempts - 1 && retryDelayMs > 0) {
-      sleepSync(retryDelayMs);
-    }
-  }
-  return { error: lastError ?? "tmux send-keys C-c failed" };
-}
-function sleepSync(ms) {
-  const sab = new SharedArrayBuffer(4);
-  const view = new Int32Array(sab);
-  Atomics.wait(view, 0, 0, ms);
-}
-var MAX_BYTES;
-var init_tmux = __esm(() => {
-  MAX_BYTES = 10 * 1024 * 1024;
-});
-
 // src/agents/compose.ts
 import { createHash as createHash3 } from "node:crypto";
 import { existsSync as existsSync14, mkdirSync as mkdirSync10, readFileSync as readFileSync12 } from "node:fs";
@@ -23804,10 +23768,46 @@ var init_compose = __esm(() => {
   BIND_MOUNT_EXACT_SOURCE_DENY = new Set(["/var/run/docker.sock"]);
 });
 
+// src/agents/tmux.ts
+import { execFileSync as execFileSync5 } from "node:child_process";
+function sendAgentInterrupt(opts) {
+  const { agentName } = opts;
+  const attempts = typeof opts.attempts === "number" && opts.attempts > 0 ? opts.attempts : 1;
+  const retryDelayMs = typeof opts.retryDelayMs === "number" && opts.retryDelayMs >= 0 ? opts.retryDelayMs : 100;
+  const socket = `switchroom-${agentName}`;
+  const args = ["-L", socket, "send-keys", "-t", agentName, "C-c"];
+  let lastError = null;
+  for (let i = 0;i < attempts; i++) {
+    try {
+      execFileSync5("tmux", args, {
+        timeout: 3000,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      return { ok: true };
+    } catch (err) {
+      lastError = `tmux send-keys C-c failed: ${err.message}`;
+      console.error(`[tmux-interrupt] ${agentName}: ${lastError}`);
+    }
+    if (i < attempts - 1 && retryDelayMs > 0) {
+      sleepSync(retryDelayMs);
+    }
+  }
+  return { error: lastError ?? "tmux send-keys C-c failed" };
+}
+function sleepSync(ms) {
+  const sab = new SharedArrayBuffer(4);
+  const view = new Int32Array(sab);
+  Atomics.wait(view, 0, 0, ms);
+}
+var MAX_BYTES;
+var init_tmux = __esm(() => {
+  MAX_BYTES = 10 * 1024 * 1024;
+});
+
 // src/agents/docker-fleet.ts
 import { resolve as resolve12 } from "node:path";
 import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 import { execFileSync as execFileSync6 } from "node:child_process";
 function resolveSwitchroomHome(explicit) {
   if (explicit && explicit.length > 0)
@@ -23831,7 +23831,7 @@ function bringUpAgentService(opts) {
   }
   const compose = opts.generateComposeContent?.() ?? generateCompose({
     config: opts.config,
-    homeDir: homedir5(),
+    homeDir: homedir6(),
     switchroomConfigPath
   });
   const composePath = resolve12(composeDir, "docker-compose.yml");
@@ -23952,18 +23952,18 @@ var init_singleton_reconcile = __esm(() => {
 
 // src/agents/lifecycle.ts
 import { execFileSync as execFileSync8, spawn, spawnSync } from "node:child_process";
-import { existsSync as existsSync15, mkdirSync as mkdirSync12, writeFileSync as writeFileSync7, renameSync as renameSync4, readFileSync as readFileSync14 } from "node:fs";
-import { resolve as resolve13, join as join10 } from "node:path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync12, writeFileSync as writeFileSync7, renameSync as renameSync4, readFileSync as readFileSync14 } from "node:fs";
+import { resolve as resolve13, join as join11 } from "node:path";
 import { connect } from "node:net";
 function cleanShutdownMarkerPathForAgent(name) {
   const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? resolveStatePath("agents");
-  return join10(agentsDir, name, "telegram", "clean-shutdown.json");
+  return join11(agentsDir, name, "telegram", "clean-shutdown.json");
 }
 function writeRestartReasonMarker(name, reason, opts = {}) {
   const path = cleanShutdownMarkerPathForAgent(name);
   try {
-    mkdirSync12(join10(path, ".."), { recursive: true });
-    if (opts.preserveExisting && existsSync15(path)) {
+    mkdirSync12(join11(path, ".."), { recursive: true });
+    if (opts.preserveExisting && existsSync16(path)) {
       try {
         const prev = JSON.parse(readFileSync14(path, "utf-8"));
         if (prev && typeof prev.ts === "number" && Date.now() - prev.ts < 30000 && prev.reason) {
@@ -24066,8 +24066,8 @@ function gracefulRestartAgent(name) {
   return new Promise((resolvePromise, reject) => {
     const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? resolveStatePath("agents");
     const agentDir = resolve13(agentsDir, name);
-    const socketPath = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join10(agentDir, "telegram", "gateway.sock");
-    if (!existsSync15(socketPath)) {
+    const socketPath = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join11(agentDir, "telegram", "gateway.sock");
+    if (!existsSync16(socketPath)) {
       reject(new Error("Gateway socket not found. Is the gateway running?"));
       return;
     }
@@ -24452,40 +24452,40 @@ var init_pane_ready_probe = () => {};
 // src/auth/accounts.ts
 import {
   copyFileSync as copyFileSync5,
-  existsSync as existsSync19,
+  existsSync as existsSync20,
   mkdirSync as mkdirSync14,
   readFileSync as readFileSync18,
-  readdirSync as readdirSync9,
+  readdirSync as readdirSync10,
   renameSync as renameSync6,
   rmSync as rmSync4,
-  statSync as statSync11,
+  statSync as statSync12,
   writeFileSync as writeFileSync9
 } from "node:fs";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 function claudeDir(agentDir) {
-  return join13(agentDir, ".claude");
+  return join14(agentDir, ".claude");
 }
 function accountsDir(agentDir) {
-  return join13(claudeDir(agentDir), "accounts");
+  return join14(claudeDir(agentDir), "accounts");
 }
 function slotDir(agentDir, slot) {
-  return join13(accountsDir(agentDir), slot);
+  return join14(accountsDir(agentDir), slot);
 }
 function slotTokenPath(agentDir, slot) {
-  return join13(slotDir(agentDir, slot), ".oauth-token");
+  return join14(slotDir(agentDir, slot), ".oauth-token");
 }
 function slotMetaPath(agentDir, slot) {
-  return join13(slotDir(agentDir, slot), ".oauth-token.meta.json");
+  return join14(slotDir(agentDir, slot), ".oauth-token.meta.json");
 }
 function activeMarkerPath(agentDir) {
-  return join13(claudeDir(agentDir), "active");
+  return join14(claudeDir(agentDir), "active");
 }
 function legacyTokenPath(agentDir) {
-  return join13(claudeDir(agentDir), ".oauth-token");
+  return join14(claudeDir(agentDir), ".oauth-token");
 }
 function legacyMetaPath(agentDir) {
-  return join13(claudeDir(agentDir), ".oauth-token.meta.json");
+  return join14(claudeDir(agentDir), ".oauth-token.meta.json");
 }
 function validateSlotName(slot) {
   if (typeof slot !== "string" || slot.length === 0) {
@@ -24506,7 +24506,7 @@ function validateSlotName(slot) {
 }
 function readActiveSlot(agentDir) {
   const p = activeMarkerPath(agentDir);
-  if (!existsSync19(p))
+  if (!existsSync20(p))
     return null;
   try {
     const val = readFileSync18(p, "utf-8").trim();
@@ -24523,12 +24523,12 @@ function writeActiveSlot(agentDir, slot) {
 }
 function listSlots(agentDir) {
   const dir = accountsDir(agentDir);
-  if (!existsSync19(dir))
+  if (!existsSync20(dir))
     return [];
   try {
-    return readdirSync9(dir).filter((name) => {
+    return readdirSync10(dir).filter((name) => {
       try {
-        return statSync11(join13(dir, name)).isDirectory();
+        return statSync12(join14(dir, name)).isDirectory();
       } catch {
         return false;
       }
@@ -24538,11 +24538,11 @@ function listSlots(agentDir) {
   }
 }
 function slotExists(agentDir, slot) {
-  return existsSync19(slotTokenPath(agentDir, slot));
+  return existsSync20(slotTokenPath(agentDir, slot));
 }
 function readSlotMeta(agentDir, slot) {
   const p = slotMetaPath(agentDir, slot);
-  if (!existsSync19(p))
+  if (!existsSync20(p))
     return null;
   try {
     return JSON.parse(readFileSync18(p, "utf-8"));
@@ -24585,11 +24585,11 @@ function syncLegacyFromActive(agentDir) {
     return;
   const srcToken = slotTokenPath(agentDir, active);
   const srcMeta = slotMetaPath(agentDir, active);
-  if (!existsSync19(srcToken))
+  if (!existsSync20(srcToken))
     return;
   mkdirSync14(claudeDir(agentDir), { recursive: true });
   atomicCopy(srcToken, legacyTokenPath(agentDir), 384);
-  if (existsSync19(srcMeta)) {
+  if (existsSync20(srcMeta)) {
     atomicCopy(srcMeta, legacyMetaPath(agentDir), 384);
   }
 }
@@ -24613,7 +24613,7 @@ function migrateLegacyIfNeeded(agentDir) {
     return { migrated: false };
   }
   const legacyToken = legacyTokenPath(agentDir);
-  if (!existsSync19(legacyToken)) {
+  if (!existsSync20(legacyToken)) {
     if (slots.length === 1 && slotExists(agentDir, slots[0])) {
       writeActiveSlot(agentDir, slots[0]);
       syncLegacyFromActive(agentDir);
@@ -24635,7 +24635,7 @@ function migrateLegacyIfNeeded(agentDir) {
   writeFileSync9(slotTokenPath(agentDir, slot), token + `
 `, { mode: 384 });
   const legacyMeta = legacyMetaPath(agentDir);
-  if (existsSync19(legacyMeta)) {
+  if (existsSync20(legacyMeta)) {
     try {
       copyFileSync5(legacyMeta, slotMetaPath(agentDir, slot));
     } catch {
@@ -24698,16 +24698,16 @@ var init_accounts = __esm(() => {
 import { execFileSync as execFileSync11 } from "node:child_process";
 import {
   readFileSync as readFileSync19,
-  readdirSync as readdirSync10,
-  existsSync as existsSync20,
+  readdirSync as readdirSync11,
+  existsSync as existsSync21,
   writeFileSync as writeFileSync10,
   mkdirSync as mkdirSync15,
   mkdtempSync as mkdtempSync2,
   rmSync as rmSync5,
   chmodSync as chmodSync3,
-  statSync as statSync12
+  statSync as statSync13
 } from "node:fs";
-import { join as join14, resolve as resolve15 } from "node:path";
+import { join as join15, resolve as resolve15 } from "node:path";
 function extractCodeChallenge(url) {
   const match = url.match(/[?&]code_challenge=([A-Za-z0-9_-]+)/);
   return match ? match[1] : null;
@@ -24722,22 +24722,22 @@ function stripAnsi(text) {
   return text.replace(/\x1B\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\x1B[@-_]/g, "").replace(/\r/g, "");
 }
 function claudeDir2(agentDir) {
-  return join14(agentDir, ".claude");
+  return join15(agentDir, ".claude");
 }
 function credentialsPath(agentDir) {
-  return join14(claudeDir2(agentDir), ".credentials.json");
+  return join15(claudeDir2(agentDir), ".credentials.json");
 }
 function oauthTokenPath(agentDir) {
-  return join14(claudeDir2(agentDir), ".oauth-token");
+  return join15(claudeDir2(agentDir), ".oauth-token");
 }
 function oauthTokenMetaPath(agentDir) {
-  return join14(claudeDir2(agentDir), ".oauth-token.meta.json");
+  return join15(claudeDir2(agentDir), ".oauth-token.meta.json");
 }
 function authLogPath(agentDir) {
-  return join14(claudeDir2(agentDir), ".setup-token.log");
+  return join15(claudeDir2(agentDir), ".setup-token.log");
 }
 function authSessionMetaPath(agentDir) {
-  return join14(claudeDir2(agentDir), ".setup-token.session.json");
+  return join15(claudeDir2(agentDir), ".setup-token.session.json");
 }
 function authSessionName(name, slot) {
   const base = `switchroom-auth-${name.replace(/[^a-zA-Z0-9_.-]/g, "-")}`;
@@ -24765,7 +24765,7 @@ function captureTmuxPane(sessionName) {
   return tmux(["capture-pane", "-p", "-t", sessionName, "-S", "-200"]);
 }
 function readJsonFile(path) {
-  if (!existsSync20(path))
+  if (!existsSync21(path))
     return null;
   try {
     return JSON.parse(readFileSync19(path, "utf-8"));
@@ -24775,7 +24775,7 @@ function readJsonFile(path) {
 }
 function readOAuthToken(agentDir) {
   const path = oauthTokenPath(agentDir);
-  if (!existsSync20(path))
+  if (!existsSync21(path))
     return null;
   try {
     const token = readFileSync19(path, "utf-8").trim();
@@ -24787,7 +24787,7 @@ function readOAuthToken(agentDir) {
 function authFilesAreInaccessible(agentDir) {
   const probes = [credentialsPath(agentDir), oauthTokenPath(agentDir)];
   for (const p of probes) {
-    if (!existsSync20(p))
+    if (!existsSync21(p))
       continue;
     try {
       readFileSync19(p, "utf-8");
@@ -24818,7 +24818,7 @@ function writeOAuthToken(agentDir, token, slot) {
 }
 function fileMtimeMs(filePath) {
   try {
-    return statSync12(filePath).mtimeMs;
+    return statSync13(filePath).mtimeMs;
   } catch {
     return 0;
   }
@@ -24852,12 +24852,12 @@ function isSessionStale(agentDir, sessionName) {
 }
 function cleanupAuthTempDirs(agentDir) {
   const dir = claudeDir2(agentDir);
-  if (!existsSync20(dir))
+  if (!existsSync21(dir))
     return;
   try {
-    for (const entry of readdirSync10(dir)) {
+    for (const entry of readdirSync11(dir)) {
       if (entry.startsWith(".setup-token-tmp-")) {
-        rmSync5(join14(dir, entry), { recursive: true, force: true });
+        rmSync5(join15(dir, entry), { recursive: true, force: true });
       }
     }
   } catch {}
@@ -24887,7 +24887,7 @@ function parseSetupTokenValue(output) {
 }
 function readTokenFromCredentialsFile(credentialsFilePath) {
   try {
-    if (!existsSync20(credentialsFilePath))
+    if (!existsSync21(credentialsFilePath))
       return null;
     const raw = readFileSync19(credentialsFilePath, "utf-8");
     const parsed = JSON.parse(raw);
@@ -24910,7 +24910,7 @@ function hasPendingAuthSession(name, agentDir) {
 }
 function readCredentials(agentDir) {
   const credPath = credentialsPath(agentDir);
-  if (!existsSync20(credPath))
+  if (!existsSync21(credPath))
     return null;
   try {
     const parsed = JSON.parse(readFileSync19(credPath, "utf-8"));
@@ -24922,9 +24922,9 @@ function readCredentials(agentDir) {
 function getAuthStatus(name, agentDir) {
   const pendingAuth = hasPendingAuthSession(name, agentDir);
   const creds = readCredentials(agentDir);
-  if (!existsSync20(oauthTokenPath(agentDir))) {
+  if (!existsSync21(oauthTokenPath(agentDir))) {
     const activeSlot = readActiveSlot(agentDir);
-    if (activeSlot && existsSync20(slotTokenPath(agentDir, activeSlot))) {
+    if (activeSlot && existsSync21(slotTokenPath(agentDir, activeSlot))) {
       try {
         syncLegacyFromActive(agentDir);
       } catch {}
@@ -25018,14 +25018,14 @@ function startAuthSession(name, agentDir, opts = {}) {
   rmSync5(logPath, { force: true });
   let configDir;
   if (opts.force) {
-    configDir = mkdtempSync2(join14(claudeDir2(agentDir), ".setup-token-tmp-"));
+    configDir = mkdtempSync2(join15(claudeDir2(agentDir), ".setup-token-tmp-"));
     try {
       chmodSync3(configDir, 448);
     } catch {}
   } else {
     configDir = claudeDir2(agentDir);
   }
-  const credentialsMtimeAtStart = fileMtimeMs(join14(configDir, ".credentials.json"));
+  const credentialsMtimeAtStart = fileMtimeMs(join15(configDir, ".credentials.json"));
   const commandParts = [];
   commandParts.push(`CLAUDE_CONFIG_DIR=${shellQuote(configDir)}`);
   commandParts.push(`LOG_PATH=${shellQuote(logPath)}`);
@@ -25066,7 +25066,7 @@ function startAuthSession(name, agentDir, opts = {}) {
   };
 }
 function readTokenFromLogFile(logPath) {
-  if (!existsSync20(logPath))
+  if (!existsSync21(logPath))
     return null;
   try {
     const content = readFileSync19(logPath, "utf-8");
@@ -25113,7 +25113,7 @@ function submitAuthCode(name, agentDir, code, slot, _opts = {}) {
   tmux(["send-keys", "-l", "-t", sessionName, code.trim()]);
   tmux(["send-keys", "-t", sessionName, "Enter"]);
   const meta = readJsonFile(authSessionMetaPath(agentDir));
-  const credFileToWatch = meta?.configDir ? join14(meta.configDir, ".credentials.json") : credentialsPath(agentDir);
+  const credFileToWatch = meta?.configDir ? join15(meta.configDir, ".credentials.json") : credentialsPath(agentDir);
   const credsMtimeSnapshot = meta?.credentialsMtimeAtStart ?? 0;
   const logPath = authLogPath(agentDir);
   let token = null;
@@ -25213,19 +25213,19 @@ var init_manager = __esm(() => {
 
 // src/agents/quarantine.ts
 import {
-  existsSync as existsSync25,
+  existsSync as existsSync26,
   mkdirSync as mkdirSync16,
   readFileSync as readFileSync21,
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync12
 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function quarantineMarkerPath(telegramStateDir) {
-  return join16(telegramStateDir, QUARANTINE_FILENAME);
+  return join17(telegramStateDir, QUARANTINE_FILENAME);
 }
 function readQuarantineMarker(telegramStateDir) {
   const path = quarantineMarkerPath(telegramStateDir);
-  if (!existsSync25(path))
+  if (!existsSync26(path))
     return null;
   try {
     const raw = readFileSync21(path, "utf-8");
@@ -25251,7 +25251,7 @@ function readQuarantineMarker(telegramStateDir) {
 }
 function clearQuarantineMarker(telegramStateDir) {
   const path = quarantineMarkerPath(telegramStateDir);
-  if (!existsSync25(path))
+  if (!existsSync26(path))
     return false;
   try {
     unlinkSync6(path);
@@ -25261,7 +25261,7 @@ function clearQuarantineMarker(telegramStateDir) {
   }
 }
 function hostTelegramStateDir(agentsDir, name) {
-  return join16(agentsDir, name, "telegram");
+  return join17(agentsDir, name, "telegram");
 }
 function readQuarantineMarkerForAgent(agentsDir, name) {
   return readQuarantineMarker(hostTelegramStateDir(agentsDir, name));
@@ -25807,10 +25807,10 @@ __export(exports_client2, {
   AuthBrokerClient: () => AuthBrokerClient
 });
 import * as net2 from "node:net";
-import { existsSync as existsSync27 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
+import { existsSync as existsSync28 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
 import { randomUUID } from "node:crypto";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 function reviveDate(v) {
   if (v == null)
     return null;
@@ -25819,8 +25819,8 @@ function reviveDate(v) {
   const d = new Date(v);
   return Number.isNaN(d.getTime()) ? null : d;
 }
-function operatorSocketPath(home2 = homedir7()) {
-  return join18(home2, ".switchroom", "state", "auth-broker-operator", "sock");
+function operatorSocketPath(home2 = homedir8()) {
+  return join19(home2, ".switchroom", "state", "auth-broker-operator", "sock");
 }
 function resolveAuthBrokerSocketPath(opts) {
   if (opts?.socket)
@@ -26098,7 +26098,7 @@ async function withAuthBrokerClient(fn, opts) {
   }
 }
 function authBrokerSocketExists(opts) {
-  return existsSync27(resolveAuthBrokerSocketPath(opts));
+  return existsSync28(resolveAuthBrokerSocketPath(opts));
 }
 var DEFAULT_TIMEOUT_MS2 = 5000, AuthBrokerError, AuthBrokerUnreachableError;
 var init_client2 = __esm(() => {
@@ -26157,44 +26157,44 @@ var init_broker_call = __esm(() => {
 
 // src/auth/account-store.ts
 import {
-  chownSync,
-  existsSync as existsSync28,
+  chownSync as chownSync3,
+  existsSync as existsSync29,
   mkdirSync as mkdirSync17,
   readFileSync as readFileSync23,
-  readdirSync as readdirSync14,
+  readdirSync as readdirSync15,
   renameSync as renameSync7,
   rmSync as rmSync10,
-  statSync as statSync15,
+  statSync as statSync16,
   writeFileSync as writeFileSync14
 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { join as join20, resolve as resolve22 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { join as join21, resolve as resolve22 } from "node:path";
 function accountsRootOverride() {
   const v = process.env.SWITCHROOM_ACCOUNTS_DIR;
   if (v && v.length > 0 && v.startsWith("/"))
     return v;
   return;
 }
-function accountsRoot(home2 = homedir9()) {
+function accountsRoot(home2 = homedir10()) {
   return accountsRootOverride() ?? resolve22(home2, ".switchroom", "accounts");
 }
-function accountDir(label, home2 = homedir9()) {
-  return join20(accountsRoot(home2), label);
+function accountDir(label, home2 = homedir10()) {
+  return join21(accountsRoot(home2), label);
 }
-function accountCredentialsPath(label, home2 = homedir9()) {
-  return join20(accountDir(label, home2), "credentials.json");
+function accountCredentialsPath(label, home2 = homedir10()) {
+  return join21(accountDir(label, home2), "credentials.json");
 }
-function accountMetaPath(label, home2 = homedir9()) {
-  return join20(accountDir(label, home2), "meta.json");
+function accountMetaPath(label, home2 = homedir10()) {
+  return join21(accountDir(label, home2), "meta.json");
 }
-function listAccounts(home2 = homedir9()) {
+function listAccounts(home2 = homedir10()) {
   const root = accountsRoot(home2);
-  if (!existsSync28(root))
+  if (!existsSync29(root))
     return [];
   try {
-    return readdirSync14(root).filter((name) => {
+    return readdirSync15(root).filter((name) => {
       try {
-        return statSync15(join20(root, name)).isDirectory();
+        return statSync16(join21(root, name)).isDirectory();
       } catch {
         return false;
       }
@@ -26203,9 +26203,9 @@ function listAccounts(home2 = homedir9()) {
     return [];
   }
 }
-function readAccountCredentials(label, home2 = homedir9()) {
+function readAccountCredentials(label, home2 = homedir10()) {
   const p = accountCredentialsPath(label, home2);
-  if (!existsSync28(p))
+  if (!existsSync29(p))
     return null;
   try {
     return JSON.parse(readFileSync23(p, "utf-8"));
@@ -26213,9 +26213,9 @@ function readAccountCredentials(label, home2 = homedir9()) {
     return null;
   }
 }
-function readAccountMeta(label, home2 = homedir9()) {
+function readAccountMeta(label, home2 = homedir10()) {
   const p = accountMetaPath(label, home2);
-  if (!existsSync28(p))
+  if (!existsSync29(p))
     return null;
   try {
     return JSON.parse(readFileSync23(p, "utf-8"));
@@ -26223,7 +26223,7 @@ function readAccountMeta(label, home2 = homedir9()) {
     return null;
   }
 }
-function accountHealth(label, now = Date.now(), home2 = homedir9()) {
+function accountHealth(label, now = Date.now(), home2 = homedir10()) {
   const creds = readAccountCredentials(label, home2);
   if (!creds?.claudeAiOauth?.accessToken)
     return "missing-credentials";
@@ -26239,7 +26239,7 @@ function accountHealth(label, now = Date.now(), home2 = homedir9()) {
   }
   return "healthy";
 }
-function getAccountInfos(now = Date.now(), home2 = homedir9()) {
+function getAccountInfos(now = Date.now(), home2 = homedir10()) {
   return listAccounts(home2).map((label) => {
     const creds = readAccountCredentials(label, home2);
     const meta = readAccountMeta(label, home2);
@@ -26908,15 +26908,15 @@ var init_disconnect = __esm(() => {
 });
 
 // src/vault/approvals/client.ts
-import { existsSync as existsSync29 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import { join as join21 } from "node:path";
-function kernelOperatorSocketPath(home2 = homedir10()) {
-  return join21(home2, ".switchroom", "state", "kernel-operator", "sock");
+import { existsSync as existsSync30 } from "node:fs";
+import { homedir as homedir11 } from "node:os";
+import { join as join22 } from "node:path";
+function kernelOperatorSocketPath(home2 = homedir11()) {
+  return join22(home2, ".switchroom", "state", "kernel-operator", "sock");
 }
-function resolveKernelOperatorSocket(home2 = homedir10()) {
+function resolveKernelOperatorSocket(home2 = homedir11()) {
   const p = kernelOperatorSocketPath(home2);
-  return existsSync29(p) ? p : null;
+  return existsSync30(p) ? p : null;
 }
 function resolveKernelSocketPath(opts) {
   if (opts?.socket)
@@ -27995,8 +27995,8 @@ __export(exports_via_claude, {
   POST_PASTE_RULES: () => POST_PASTE_RULES
 });
 import { execFileSync as execFileSync14, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync30, mkdirSync as mkdirSync18, readFileSync as readFileSync26 } from "node:fs";
-import { join as join22, resolve as resolve23 } from "node:path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync18, readFileSync as readFileSync26 } from "node:fs";
+import { join as join23, resolve as resolve23 } from "node:path";
 function tmuxHasSession(session) {
   const r = spawnSync2("tmux", ["has-session", "-t", session], {
     stdio: ["ignore", "ignore", "ignore"]
@@ -28042,7 +28042,7 @@ async function runViaClaude(opts) {
   const poll = opts.pollMs ?? VIA_CLAUDE_DEFAULTS.pollMs;
   const configDir = resolve23(opts.configDir);
   mkdirSync18(configDir, { recursive: true });
-  const credentialsPath2 = join22(configDir, ".credentials.json");
+  const credentialsPath2 = join23(configDir, ".credentials.json");
   const capture = opts.capturePane ?? (() => tmuxCapturePane(SESSION));
   const send = opts.sendKeys ?? ((keys, literal) => tmuxSendKeys(SESSION, keys, literal === true));
   if (!opts.spawnClaude) {
@@ -28103,7 +28103,7 @@ async function runViaClaude(opts) {
     log("  Waiting for credentials to land\u2026");
     while (Date.now() < phase2Deadline) {
       await sleep3(poll);
-      if (existsSync30(credentialsPath2)) {
+      if (existsSync31(credentialsPath2)) {
         await sleep3(200);
         const raw = readFileSync26(credentialsPath2, "utf-8");
         let parsed;
@@ -28684,10 +28684,10 @@ var init_protocol3 = __esm(() => {
 });
 
 // src/host-control/audit-reader.ts
-import { homedir as homedir19 } from "node:os";
-import { join as join37 } from "node:path";
-function defaultAuditLogPath2(home2 = homedir19()) {
-  return join37(home2, ".switchroom", "host-control-audit.log");
+import { homedir as homedir20 } from "node:os";
+import { join as join38 } from "node:path";
+function defaultAuditLogPath2(home2 = homedir20()) {
+  return join38(home2, ".switchroom", "host-control-audit.log");
 }
 function parseAuditLine2(line) {
   const trimmed = line.trim();
@@ -28946,19 +28946,19 @@ var init_thinking_effort_risk = __esm(() => {
 
 // src/manifest.ts
 import {
-  existsSync as existsSync50,
+  existsSync as existsSync51,
   readFileSync as readFileSync46,
-  readdirSync as readdirSync18
+  readdirSync as readdirSync19
 } from "node:fs";
-import { dirname as dirname11, join as join44 } from "node:path";
+import { dirname as dirname12, join as join45 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
 function locateManifestPath() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const candidate = join44(dir, "dependencies.json");
-    if (existsSync50(candidate))
+    const candidate = join45(dir, "dependencies.json");
+    if (existsSync51(candidate))
       return candidate;
-    dir = dirname11(dir);
+    dir = dirname12(dir);
   }
   return null;
 }
@@ -29025,14 +29025,14 @@ function probeClaudeVersion() {
 }
 function probePlaywrightMcpVersion() {
   const home2 = process.env.HOME ?? "";
-  const npxCache = join44(home2, ".npm/_npx");
-  if (!existsSync50(npxCache))
+  const npxCache = join45(home2, ".npm/_npx");
+  if (!existsSync51(npxCache))
     return null;
   try {
-    const entries = readdirSync18(npxCache);
+    const entries = readdirSync19(npxCache);
     for (const entry of entries) {
-      const pkgPath = join44(npxCache, entry, "node_modules/@playwright/mcp/package.json");
-      if (existsSync50(pkgPath)) {
+      const pkgPath = join45(npxCache, entry, "node_modules/@playwright/mcp/package.json");
+      if (existsSync51(pkgPath)) {
         try {
           const pkg = JSON.parse(readFileSync46(pkgPath, "utf-8"));
           if (pkg.version)
@@ -29473,11 +29473,11 @@ var init_doctor_docker = __esm(() => {
 });
 
 // src/cli/doctor-auth-broker.ts
-import { existsSync as existsSync51, readFileSync as readFileSync48 } from "node:fs";
+import { existsSync as existsSync52, readFileSync as readFileSync48 } from "node:fs";
 import { createHash as createHash10 } from "node:crypto";
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { homedir as homedir24 } from "node:os";
-import { join as join45 } from "node:path";
+import { homedir as homedir25 } from "node:os";
+import { join as join46 } from "node:path";
 function defaultDockerInspect(container, format) {
   try {
     const r = spawnSync6("docker", ["inspect", "-f", format, container], { encoding: "utf-8", timeout: 5000 });
@@ -29577,8 +29577,8 @@ function checkAuthBrokerPerAgentSockets(config, deps = {}) {
 }
 function checkAuthBrokerDrift(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const indexPath = join45(stateDir, "sha-index.json");
-  if (!existsSync51(indexPath)) {
+  const indexPath = join46(stateDir, "sha-index.json");
+  if (!existsSync52(indexPath)) {
     return {
       name: "auth-broker: drift",
       status: "ok",
@@ -29596,12 +29596,12 @@ function checkAuthBrokerDrift(deps = {}) {
       fix: "Inspect `~/.switchroom/state/auth-broker/sha-index.json` for corruption."
     };
   }
-  const home2 = deps.home ?? homedir24();
+  const home2 = deps.home ?? homedir25();
   const divergent = [];
   const missingOnDisk = [];
   for (const [label, expected] of Object.entries(index)) {
     const credsPath = accountCredentialsPath(label, home2);
-    if (!existsSync51(credsPath)) {
+    if (!existsSync52(credsPath)) {
       missingOnDisk.push(label);
       continue;
     }
@@ -29638,8 +29638,8 @@ function checkAuthBrokerDrift(deps = {}) {
 }
 function checkAuthBrokerThresholdViolations(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const path4 = join45(stateDir, "threshold-violations.json");
-  if (!existsSync51(path4)) {
+  const path4 = join46(stateDir, "threshold-violations.json");
+  if (!existsSync52(path4)) {
     return {
       name: "auth-broker: threshold violations",
       status: "ok",
@@ -29682,9 +29682,9 @@ function checkAuthBrokerActiveAccount(config, deps = {}) {
       fix: "Run `switchroom auth use <label>` to pin a fleet-wide account, then `switchroom apply`. Without an active account every agent boot fails."
     };
   }
-  const home2 = deps.home ?? homedir24();
+  const home2 = deps.home ?? homedir25();
   const dir = accountDir(active, home2);
-  if (!existsSync51(dir)) {
+  if (!existsSync52(dir)) {
     return {
       name: "auth-broker: fleet active account",
       status: "fail",
@@ -29693,7 +29693,7 @@ function checkAuthBrokerActiveAccount(config, deps = {}) {
     };
   }
   const creds = accountCredentialsPath(active, home2);
-  if (!existsSync51(creds)) {
+  if (!existsSync52(creds)) {
     return {
       name: "auth-broker: fleet active account",
       status: "fail",
@@ -29830,27 +29830,27 @@ var init_doctor_hostd = () => {};
 import {
   accessSync,
   constants as fsConstants4,
-  existsSync as existsSync52,
-  realpathSync as realpathSync4,
-  statSync as statSync22
+  existsSync as existsSync53,
+  realpathSync as realpathSync5,
+  statSync as statSync23
 } from "node:fs";
-import { userInfo, homedir as homedir25 } from "node:os";
-import { join as join46 } from "node:path";
+import { userInfo, homedir as homedir26 } from "node:os";
+import { join as join47 } from "node:path";
 function resolveVaultPath2(config) {
   return config.vault?.path ? config.vault.path.replace(/^~/, process.env.HOME ?? "") : resolveStatePath("vault.enc");
 }
 function defaultStatVault(path4) {
-  if (!existsSync52(path4)) {
+  if (!existsSync53(path4)) {
     return { exists: false, readable: false, uid: -1, mode: 0, realPath: path4 };
   }
   let real = path4;
   try {
-    real = realpathSync4(path4);
+    real = realpathSync5(path4);
   } catch {}
   let uid = -1;
   let mode = 0;
   try {
-    const s = statSync22(real);
+    const s = statSync23(real);
     uid = s.uid;
     mode = s.mode & 511;
   } catch {
@@ -29973,7 +29973,7 @@ async function runSecretAccessChecks(config, deps = {}) {
   };
   const passphrase = deps.passphrase ?? process.env.SWITCHROOM_VAULT_PASSPHRASE;
   if (!passphrase) {
-    const sock = deps.brokerOperatorSocket ?? join46(homedir25(), ".switchroom", "broker-operator", "sock");
+    const sock = deps.brokerOperatorSocket ?? join47(homedir26(), ".switchroom", "broker-operator", "sock");
     const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
     for (const name of Object.keys(config.agents ?? {})) {
       const resolved = resolveAgentConfig(config.defaults, config.profiles, config.agents[name]);
@@ -30058,8 +30058,8 @@ import {
   existsSync as realExistsSync,
   readFileSync as realReadFileSync
 } from "node:fs";
-import { join as join47, resolve as resolve30 } from "node:path";
-import { homedir as homedir26 } from "node:os";
+import { join as join48, resolve as resolve30 } from "node:path";
+import { homedir as homedir27 } from "node:os";
 function resolveDeps(config, deps) {
   let agentsDir = deps.agentsDir;
   if (agentsDir === undefined) {
@@ -30182,8 +30182,8 @@ function checkScaffoldWiring(config, driveAgents, d) {
       });
       continue;
     }
-    const mcpPath = join47(agentDir, ".mcp.json");
-    const claudeJsonPath = join47(agentDir, ".claude", ".claude.json");
+    const mcpPath = join48(agentDir, ".mcp.json");
+    const claudeJsonPath = join48(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson(d, mcpPath);
     const trustRead = readJson(d, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -30296,7 +30296,7 @@ async function runDriveBrokerReachabilityChecks(config, deps = {}) {
       }
     ];
   }
-  const sock = deps.brokerOperatorSocket ?? join47(homedir26(), ".switchroom", "broker-operator", "sock");
+  const sock = deps.brokerOperatorSocket ?? join48(homedir27(), ".switchroom", "broker-operator", "sock");
   const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
   const results = [];
   for (const agent of driveAgents) {
@@ -30350,8 +30350,8 @@ import {
   readSync as realReadSync,
   closeSync as realCloseSync
 } from "node:fs";
-import { join as join48 } from "node:path";
-import { homedir as homedir27 } from "node:os";
+import { join as join49 } from "node:path";
+import { homedir as homedir28 } from "node:os";
 function defaultReadHead(p, n) {
   let fd;
   try {
@@ -30379,7 +30379,7 @@ function resolveDeps2(config, deps) {
     }
   }
   return {
-    homeDir: deps.homeDir ?? homedir27(),
+    homeDir: deps.homeDir ?? homedir28(),
     agentsDir,
     existsSync: deps.existsSync ?? ((p) => realExistsSync2(p)),
     readFileSync: deps.readFileSync ?? ((p) => realReadFileSync2(p, "utf-8")),
@@ -30408,7 +30408,7 @@ function runWebkiteChecks(config, deps = {}) {
     return [];
   const d = resolveDeps2(config, deps);
   const results = [];
-  const binPath = join48(d.homeDir, ".switchroom", "bin", "webkite");
+  const binPath = join49(d.homeDir, ".switchroom", "bin", "webkite");
   if (!d.existsSync(binPath)) {
     results.push({
       name: "webkite: binary",
@@ -30438,12 +30438,12 @@ function runWebkiteChecks(config, deps = {}) {
       });
     }
   }
-  const cloakDir = join48(d.homeDir, ".cloakbrowser");
+  const cloakDir = join49(d.homeDir, ".cloakbrowser");
   let chromeFound = false;
   if (d.existsSync(cloakDir)) {
     try {
       for (const entry of d.readdirSync(cloakDir)) {
-        if (entry.startsWith("chromium-") && d.existsSync(join48(cloakDir, entry, "chrome"))) {
+        if (entry.startsWith("chromium-") && d.existsSync(join49(cloakDir, entry, "chrome"))) {
           chromeFound = true;
           break;
         }
@@ -30469,9 +30469,9 @@ function runWebkiteChecks(config, deps = {}) {
     return results;
   }
   for (const agent of enabledAgents) {
-    const agentDir = join48(d.agentsDir, agent);
-    const settingsPath = join48(agentDir, ".claude", "settings.json");
-    const mcpPath = join48(agentDir, ".mcp.json");
+    const agentDir = join49(d.agentsDir, agent);
+    const settingsPath = join49(agentDir, ".claude", "settings.json");
+    const mcpPath = join49(agentDir, ".mcp.json");
     if (!d.existsSync(settingsPath) && !d.existsSync(mcpPath)) {
       continue;
     }
@@ -30535,7 +30535,7 @@ var init_doctor_webkite = __esm(() => {
 });
 
 // src/cli/doctor-scaffold-wiring.ts
-import { join as join49, resolve as resolve31 } from "node:path";
+import { join as join50, resolve as resolve31 } from "node:path";
 function readJson2(d, path4) {
   if (!d.existsSync(path4))
     return { kind: "absent" };
@@ -30578,8 +30578,8 @@ function checkIntegrationScaffoldWiring(args) {
       });
       continue;
     }
-    const mcpPath = join49(agentDir, ".mcp.json");
-    const claudeJsonPath = join49(agentDir, ".claude", ".claude.json");
+    const mcpPath = join50(agentDir, ".mcp.json");
+    const claudeJsonPath = join50(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson2(deps, mcpPath);
     const trustRead = readJson2(deps, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -30643,14 +30643,14 @@ import {
   existsSync as realExistsSync3,
   readFileSync as realReadFileSync3
 } from "node:fs";
-import { join as join50 } from "node:path";
-import { homedir as homedir28 } from "node:os";
+import { join as join51 } from "node:path";
+import { homedir as homedir29 } from "node:os";
 function resolveDeps3(deps) {
-  const home2 = deps.homeDir?.() ?? homedir28();
+  const home2 = deps.homeDir?.() ?? homedir29();
   return {
     existsSync: deps.existsSync ?? realExistsSync3,
     readFileSync: deps.readFileSync ?? realReadFileSync3,
-    agentsDir: join50(home2, ".switchroom", "agents"),
+    agentsDir: join51(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now
   };
 }
@@ -30733,7 +30733,7 @@ function checkOAuthClient2(config, anyAgentEnabled) {
   ];
 }
 function readHeartbeat(d, agentName) {
-  const path4 = join50(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
+  const path4 = join51(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
   if (!d.existsSync(path4)) {
     return { error: "heartbeat file missing \u2014 launcher has not yet started" };
   }
@@ -30830,15 +30830,15 @@ import {
   readFileSync as realReadFileSync4,
   statSync as realStatSync
 } from "node:fs";
-import { join as join51 } from "node:path";
-import { homedir as homedir29 } from "node:os";
+import { join as join52 } from "node:path";
+import { homedir as homedir30 } from "node:os";
 function resolveDeps4(deps) {
-  const home2 = deps.homeDir?.() ?? homedir29();
+  const home2 = deps.homeDir?.() ?? homedir30();
   return {
     existsSync: deps.existsSync ?? realExistsSync4,
     readFileSync: deps.readFileSync ?? realReadFileSync4,
     statSync: deps.statSync ?? realStatSync,
-    agentsDir: join51(home2, ".switchroom", "agents"),
+    agentsDir: join52(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now,
     vaultAclReader: deps.vaultAclReader ?? (async () => ({ kind: "unreachable", msg: "no default reader wired" }))
   };
@@ -30963,7 +30963,7 @@ function checkLauncherHeartbeat2(notionAgents, d) {
     return [];
   const results = [];
   for (const name of notionAgents) {
-    const heartbeatPath = join51(d.agentsDir, name, "notion-launcher.heartbeat.json");
+    const heartbeatPath = join52(d.agentsDir, name, "notion-launcher.heartbeat.json");
     if (!d.existsSync(heartbeatPath)) {
       results.push({
         name: `notion:launcher-heartbeat:${name}`,
@@ -31038,12 +31038,12 @@ import {
   readdirSync as realReaddirSync2,
   statSync as realStatSync2
 } from "node:fs";
-import { homedir as homedir30 } from "node:os";
-import { join as join52 } from "node:path";
+import { homedir as homedir31 } from "node:os";
+import { join as join53 } from "node:path";
 function runCredentialsMigrationChecks(config, deps = {}) {
-  const credDir = deps.credentialsDir ?? join52(homedir30(), ".switchroom", "credentials");
-  const existsSync53 = deps.existsSync ?? ((p) => realExistsSync5(p));
-  const readdirSync20 = deps.readdirSync ?? ((p) => realReaddirSync2(p));
+  const credDir = deps.credentialsDir ?? join53(homedir31(), ".switchroom", "credentials");
+  const existsSync54 = deps.existsSync ?? ((p) => realExistsSync5(p));
+  const readdirSync21 = deps.readdirSync ?? ((p) => realReaddirSync2(p));
   const isDirectory = deps.isDirectory ?? ((p) => {
     try {
       return realStatSync2(p).isDirectory();
@@ -31051,12 +31051,12 @@ function runCredentialsMigrationChecks(config, deps = {}) {
       return false;
     }
   });
-  if (!existsSync53(credDir))
+  if (!existsSync54(credDir))
     return [];
   const agentNames = new Set(Object.keys(config.agents ?? {}));
   let entries;
   try {
-    entries = readdirSync20(credDir);
+    entries = readdirSync21(credDir);
   } catch {
     return [
       {
@@ -31069,7 +31069,7 @@ function runCredentialsMigrationChecks(config, deps = {}) {
   const flat = [];
   const perAgentDirs = [];
   for (const e of entries) {
-    const full = join52(credDir, e);
+    const full = join53(credDir, e);
     if (isDirectory(full) && agentNames.has(e)) {
       perAgentDirs.push(e);
     } else {
@@ -31192,19 +31192,19 @@ var init_doctor_inlined_secrets = __esm(() => {
 
 // src/cli/doctor-audit-integrity.ts
 import { readFileSync as fsReadFileSync2 } from "node:fs";
-import { homedir as homedir31 } from "node:os";
-import { join as join53 } from "node:path";
+import { homedir as homedir32 } from "node:os";
+import { join as join54 } from "node:path";
 function rootWrittenLogs(home2) {
   return [
-    { label: "vault-broker", path: join53(home2, ".switchroom", "vault-audit.log") },
+    { label: "vault-broker", path: join54(home2, ".switchroom", "vault-audit.log") },
     {
       label: "hostd",
-      path: join53(home2, ".switchroom", "host-control-audit.log")
+      path: join54(home2, ".switchroom", "host-control-audit.log")
     }
   ];
 }
 function runAuditIntegrityChecks(deps = {}) {
-  const home2 = deps.homeDir ?? homedir31();
+  const home2 = deps.homeDir ?? homedir32();
   const read = deps.readFileSync ?? ((p) => fsReadFileSync2(p, "utf8"));
   const results = [];
   for (const { label, path: path4 } of rootWrittenLogs(home2)) {
@@ -31261,16 +31261,16 @@ var init_doctor_audit_integrity = __esm(() => {
 });
 
 // src/cli/doctor-agent-smoke.ts
-import { existsSync as existsSync53 } from "node:fs";
-import { homedir as homedir32 } from "node:os";
-import { join as join54 } from "node:path";
+import { existsSync as existsSync54 } from "node:fs";
+import { homedir as homedir33 } from "node:os";
+import { join as join55 } from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 async function runAgentSmokeChecks(config, deps = {}) {
   if (deps.fast)
     return [];
-  const home2 = deps.homeDir ?? homedir32();
-  const sock = deps.operatorSockPath ?? join54(home2, ".switchroom", "hostd", "operator", "sock");
-  if (!deps.hostdRequestImpl && !existsSync53(sock)) {
+  const home2 = deps.homeDir ?? homedir33();
+  const sock = deps.operatorSockPath ?? join55(home2, ".switchroom", "hostd", "operator", "sock");
+  if (!deps.hostdRequestImpl && !existsSync54(sock)) {
     return [
       {
         name: "agent liveness",
@@ -31348,9 +31348,9 @@ var init_doctor_agent_smoke = __esm(() => {
 
 // src/cli/doctor-vault-broker-durability.ts
 import { execFileSync as execFileSync18 } from "node:child_process";
-import { existsSync as existsSync54, statSync as statSync23 } from "node:fs";
-import { homedir as homedir33 } from "node:os";
-import { join as join55 } from "node:path";
+import { existsSync as existsSync55, statSync as statSync24 } from "node:fs";
+import { homedir as homedir34 } from "node:os";
+import { join as join56 } from "node:path";
 function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   const statHost = opts?.statHost ?? defaultStatHost;
   const statBroker = opts?.statBroker ?? defaultStatBroker;
@@ -31372,10 +31372,10 @@ function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   };
 }
 function defaultStatHost(p) {
-  if (!existsSync54(p))
+  if (!existsSync55(p))
     return null;
   try {
-    const s = statSync23(p, { bigint: true });
+    const s = statSync24(p, { bigint: true });
     return { ino: s.ino, size: Number(s.size) };
   } catch {
     return null;
@@ -31493,22 +31493,22 @@ function defaultBrokerStatusProbe() {
   }
 }
 function runVaultBrokerDurabilityChecks(_config, opts) {
-  const home2 = homedir33();
+  const home2 = homedir34();
   const probe2 = opts?.inodeProbe ?? probeBindMountInode;
   return [
     probeBrokerUnlocked(opts?.statusProbe),
     probeAutoUnlockBlob(home2),
     probeMachineIdMount(),
-    formatBindMountResult("vault-broker: vault.enc bind mount", join55(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join55(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
-    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join55(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join55(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
-    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join55(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join55(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
+    formatBindMountResult("vault-broker: vault.enc bind mount", join56(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join56(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
+    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join56(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join56(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
+    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join56(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join56(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
     probeKernelDbDurability(home2, {
       statBroker: opts?.kernelStatBroker
     })
   ];
 }
 function probeKernelDbDurability(home2, opts) {
-  const hostDir = join55(home2, ".switchroom", "approvals");
+  const hostDir = join56(home2, ".switchroom", "approvals");
   const containerDir = "/state/approvals";
   const name = "approval-kernel: approvals bind mount (allow_always durability)";
   const kernelStat = opts?.statBroker ?? defaultKernelStatBroker;
@@ -31576,8 +31576,8 @@ function defaultKernelStatBroker(p) {
   return { kind: "ok-with-stat", ino: inoStr, size };
 }
 function probeAutoUnlockBlob(home2) {
-  const blobPath = join55(home2, ".switchroom", "vault-auto-unlock");
-  if (!existsSync54(blobPath)) {
+  const blobPath = join56(home2, ".switchroom", "vault-auto-unlock");
+  if (!existsSync55(blobPath)) {
     return {
       name: "vault-broker: auto-unlock blob",
       status: "warn",
@@ -31585,7 +31585,7 @@ function probeAutoUnlockBlob(home2) {
       fix: "Run `switchroom vault broker enable-auto-unlock` to seal the blob with the current passphrase + machine-id"
     };
   }
-  const sz = statSync23(blobPath).size;
+  const sz = statSync24(blobPath).size;
   if (sz === 0) {
     return {
       name: "vault-broker: auto-unlock blob",
@@ -31601,7 +31601,7 @@ function probeAutoUnlockBlob(home2) {
   };
 }
 function probeMachineIdMount() {
-  const hostExists = existsSync54("/etc/machine-id");
+  const hostExists = existsSync55("/etc/machine-id");
   if (!hostExists) {
     return {
       name: "vault-broker: machine-id passthrough",
@@ -31680,25 +31680,25 @@ import { execSync as execSync3, spawnSync as spawnSync8 } from "node:child_proce
 import {
   accessSync as accessSync2,
   constants as fsConstants5,
-  existsSync as existsSync55,
-  lstatSync as lstatSync5,
+  existsSync as existsSync56,
+  lstatSync as lstatSync6,
   mkdirSync as mkdirSync30,
   readFileSync as readFileSync49,
-  readdirSync as readdirSync20,
-  statSync as statSync24
+  readdirSync as readdirSync21,
+  statSync as statSync25
 } from "node:fs";
-import { dirname as dirname12, join as join56, resolve as resolve32 } from "node:path";
+import { dirname as dirname13, join as join57, resolve as resolve32 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
-  const nvmRoot = join56(process.env.HOME ?? "", ".nvm", "versions", "node");
-  if (!existsSync55(nvmRoot))
+  const nvmRoot = join57(process.env.HOME ?? "", ".nvm", "versions", "node");
+  if (!existsSync56(nvmRoot))
     return null;
   try {
-    const versions = readdirSync20(nvmRoot).sort().reverse();
+    const versions = readdirSync21(nvmRoot).sort().reverse();
     for (const v of versions) {
-      const candidate = join56(nvmRoot, v, "bin", bin);
+      const candidate = join57(nvmRoot, v, "bin", bin);
       try {
-        const s = statSync24(candidate);
+        const s = statSync25(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
           return candidate;
         }
@@ -31861,21 +31861,21 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
   if (envBrowsersPath && envBrowsersPath.length > 0) {
     cacheLocations.push(envBrowsersPath);
   }
-  cacheLocations.push(join56(homeDir, ".cache", "ms-playwright"));
+  cacheLocations.push(join57(homeDir, ".cache", "ms-playwright"));
   for (const cacheDir of cacheLocations) {
-    if (!existsSync55(cacheDir))
+    if (!existsSync56(cacheDir))
       continue;
     try {
-      const entries = readdirSync20(cacheDir).filter((e) => e.startsWith("chromium"));
+      const entries = readdirSync21(cacheDir).filter((e) => e.startsWith("chromium"));
       for (const entry of entries) {
         const candidates2 = [
-          join56(cacheDir, entry, "chrome-linux64", "chrome"),
-          join56(cacheDir, entry, "chrome-linux", "chrome"),
-          join56(cacheDir, entry, "chrome-linux64", "headless_shell"),
-          join56(cacheDir, entry, "chrome-linux", "headless_shell")
+          join57(cacheDir, entry, "chrome-linux64", "chrome"),
+          join57(cacheDir, entry, "chrome-linux", "chrome"),
+          join57(cacheDir, entry, "chrome-linux64", "headless_shell"),
+          join57(cacheDir, entry, "chrome-linux", "headless_shell")
         ];
         for (const path4 of candidates2) {
-          if (existsSync55(path4))
+          if (existsSync56(path4))
             return path4;
         }
       }
@@ -31995,8 +31995,8 @@ function checkUserDeclaredMcps(name, agentConfig, config, renderedMcpServers) {
 function checkLegacyState() {
   const results = [];
   const h = process.env.HOME ?? "/root";
-  const clerkDir = join56(h, LEGACY_STATE_DIR);
-  const clerkPresent = existsSync55(clerkDir);
+  const clerkDir = join57(h, LEGACY_STATE_DIR);
+  const clerkPresent = existsSync56(clerkDir);
   results.push({
     name: "legacy ~/.clerk state",
     status: clerkPresent ? "warn" : "ok",
@@ -32005,10 +32005,10 @@ function checkLegacyState() {
       fix: "Legacy state detected. Run `mv ~/.clerk ~/.switchroom` and rename " + "any top-level `clerk:` key in switchroom.yaml to `switchroom:`. " + "This back-compat shim is REMOVED in v0.13.0 \u2014 no automatic " + "migration exists."
     } : {}
   });
-  const legacySock = join56(h, ".switchroom", "vault-broker.sock");
+  const legacySock = join57(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
-    sockStat = lstatSync5(legacySock);
+    sockStat = lstatSync6(legacySock);
   } catch {}
   if (sockStat) {
     results.push({
@@ -32126,7 +32126,7 @@ function checkVault(config) {
     detail: "Approval auth: passphrase (two-factor)"
   };
   const pairsResult = checkVaultBrokerSocketPairs(config);
-  if (!existsSync55(vaultPath)) {
+  if (!existsSync56(vaultPath)) {
     return [
       postureResult,
       {
@@ -32306,8 +32306,8 @@ async function checkHindsight(config) {
 }
 function checkPendingRetainsQueue(dir) {
   const home2 = process.env.HOME ?? "";
-  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join56(home2, ".hindsight", "pending-retains");
-  if (!existsSync55(pendingDir)) {
+  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join57(home2, ".hindsight", "pending-retains");
+  if (!existsSync56(pendingDir)) {
     return {
       name: "pending-retains queue",
       status: "ok",
@@ -32316,7 +32316,7 @@ function checkPendingRetainsQueue(dir) {
   }
   let names;
   try {
-    names = readdirSync20(pendingDir);
+    names = readdirSync21(pendingDir);
   } catch (err) {
     return {
       name: "pending-retains queue",
@@ -32378,7 +32378,7 @@ function tryReadHostFile(path4) {
   }
 }
 function parseEnvFile(path4) {
-  if (!existsSync55(path4))
+  if (!existsSync56(path4))
     return {};
   let content;
   try {
@@ -32437,7 +32437,7 @@ async function checkTelegram(config) {
     const plugin = agentConfig.channels?.telegram?.plugin ?? "switchroom";
     if (plugin !== "switchroom")
       continue;
-    const envPath = join56(agentsDir, name, "telegram", ".env");
+    const envPath = join57(agentsDir, name, "telegram", ".env");
     const read = tryReadHostFile(envPath);
     if (read.kind === "eacces") {
       results.push({
@@ -32489,7 +32489,7 @@ async function checkTelegram(config) {
 }
 function checkStartShStale(agentName, startShPath) {
   const label = `${agentName}: start.sh scheduler block`;
-  if (!existsSync55(startShPath)) {
+  if (!existsSync56(startShPath)) {
     return {
       name: label,
       status: "warn",
@@ -32520,10 +32520,10 @@ function checkStartShStale(agentName, startShPath) {
 }
 function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const label = `${agentName}: $HOME/.switchroom symlink (#910)`;
-  const path4 = join56(agentDir, "home", ".switchroom");
+  const path4 = join57(agentDir, "home", ".switchroom");
   let stats;
   try {
-    stats = lstatSync5(path4);
+    stats = lstatSync6(path4);
   } catch (err) {
     if (err.code === "ENOENT") {
       return {
@@ -32557,8 +32557,8 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
 }
 function checkRepoHygiene(repoRoot) {
   const results = [];
-  const exportDir = join56(repoRoot, "clerk-export");
-  if (existsSync55(exportDir)) {
+  const exportDir = join57(repoRoot, "clerk-export");
+  if (existsSync56(exportDir)) {
     results.push({
       name: "repo hygiene: clerk-export/ on disk (#1072)",
       status: "warn",
@@ -32566,8 +32566,8 @@ function checkRepoHygiene(repoRoot) {
       fix: `Run scripts/migrate-clerk-export-to-vault.sh to move the bundle ` + `into the vault, then delete the on-disk copy.`
     });
   }
-  const knownTarball = join56(repoRoot, "clerk-export-with-secrets.tar.gz");
-  if (existsSync55(knownTarball)) {
+  const knownTarball = join57(repoRoot, "clerk-export-with-secrets.tar.gz");
+  if (existsSync56(knownTarball)) {
     results.push({
       name: "repo hygiene: clerk-export-with-secrets.tar.gz on disk (#1072)",
       status: "warn",
@@ -32576,7 +32576,7 @@ function checkRepoHygiene(repoRoot) {
     });
   }
   try {
-    const entries = readdirSync20(repoRoot);
+    const entries = readdirSync21(repoRoot);
     for (const name of entries) {
       if (name === "clerk-export-with-secrets.tar.gz")
         continue;
@@ -32584,7 +32584,7 @@ function checkRepoHygiene(repoRoot) {
         results.push({
           name: `repo hygiene: ${name} on disk (#1072)`,
           status: "warn",
-          detail: `${join56(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
+          detail: `${join57(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
           fix: `Inspect, migrate any secrets into the vault, then delete the ` + `archive.`
         });
       }
@@ -32607,10 +32607,10 @@ function checkRepoHygiene(repoRoot) {
 }
 function isSwitchroomCheckout(dir) {
   try {
-    if (!existsSync55(join56(dir, ".git")))
+    if (!existsSync56(join57(dir, ".git")))
       return false;
-    const pkgPath = join56(dir, "package.json");
-    if (!existsSync55(pkgPath))
+    const pkgPath = join57(dir, "package.json");
+    if (!existsSync56(pkgPath))
       return false;
     const pkg = JSON.parse(readFileSync49(pkgPath, "utf-8"));
     return pkg.name === "switchroom";
@@ -32625,7 +32625,7 @@ function checkAgents(config, configPath) {
   const authStatuses = getAllAuthStatuses(config);
   for (const [name, agentConfig] of Object.entries(config.agents)) {
     const agentDir = resolve32(agentsDir, name);
-    if (!existsSync55(agentDir)) {
+    if (!existsSync56(agentDir)) {
       results.push({
         name: `${name}: scaffold`,
         status: "fail",
@@ -32646,7 +32646,7 @@ function checkAgents(config, configPath) {
         fix: `Rotate the bot token (e.g. via \`switchroom vault\`), then run ` + `\`switchroom agent unquarantine ${name}\` and \`switchroom agent restart ${name}\``
       });
     }
-    results.push(checkStartShStale(name, join56(agentDir, "start.sh")));
+    results.push(checkStartShStale(name, join57(agentDir, "start.sh")));
     results.push(checkLeakedHomeSwitchroom(name, agentDir));
     const status = statuses[name];
     const active = status?.active ?? "unknown";
@@ -32723,8 +32723,8 @@ function checkAgents(config, configPath) {
       }
     }
     if (agentConfig.channels?.telegram?.plugin === "switchroom") {
-      const mcpJsonPath = join56(agentDir, ".mcp.json");
-      if (!existsSync55(mcpJsonPath)) {
+      const mcpJsonPath = join57(agentDir, ".mcp.json");
+      if (!existsSync56(mcpJsonPath)) {
         results.push({
           name: `${name}: .mcp.json`,
           status: "fail",
@@ -32810,7 +32810,7 @@ function mffEnvPath(config) {
   return agent ? resolve32(home2, ".switchroom/credentials", agent, "my-family-finance/.env") : resolve32(home2, ".switchroom/credentials/my-family-finance/.env");
 }
 function mffEnvState(envPath) {
-  if (!existsSync55(envPath))
+  if (!existsSync56(envPath))
     return "absent";
   try {
     accessSync2(envPath, fsConstants5.R_OK);
@@ -32828,7 +32828,7 @@ function checkMffVaultKeyPresent(passphrase, vaultPath) {
       fix: "Export SWITCHROOM_VAULT_PASSPHRASE to enable MFF vault probes"
     };
   }
-  if (!existsSync55(vaultPath)) {
+  if (!existsSync56(vaultPath)) {
     return {
       name: "mff: vault key present",
       status: "fail",
@@ -32881,7 +32881,7 @@ function deriveEd25519PublicKeyBytes(keyMaterial) {
   }
 }
 function checkMffVaultKeyFormat(passphrase, vaultPath) {
-  if (!passphrase || !existsSync55(vaultPath)) {
+  if (!passphrase || !existsSync56(vaultPath)) {
     return {
       name: "mff: vault key format",
       status: "warn",
@@ -33024,9 +33024,9 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
       detail: "skipped (MFF_API_URL not set)"
     };
   }
-  const credDir = dirname12(envPath);
-  const authScript = join56(credDir, "claude-auth.py");
-  if (!existsSync55(authScript)) {
+  const credDir = dirname13(envPath);
+  const authScript = join57(credDir, "claude-auth.py");
+  if (!existsSync56(authScript)) {
     return {
       name: "mff: auth flow",
       status: "warn",
@@ -49937,14 +49937,14 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.92";
-var COMMIT_SHA = "cd0b9973";
+var VERSION = "0.15.0";
+var COMMIT_SHA = "5841c1d5";
 
 // src/cli/agent.ts
 init_source();
-import { join as join17, resolve as resolve21 } from "node:path";
-import { rmSync as rmSync9, existsSync as existsSync26, readFileSync as readFileSync22, writeFileSync as writeFileSync13 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
+import { join as join18, resolve as resolve21 } from "node:path";
+import { rmSync as rmSync9, existsSync as existsSync27, readFileSync as readFileSync22, writeFileSync as writeFileSync13 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
 
 // src/agents/scheduler-state.ts
 import { closeSync, openSync, readSync, statSync } from "node:fs";
@@ -53465,24 +53465,179 @@ function buildAccessJson2(agentConfig, telegramConfig, resolvedTopicId, userId)
 `;
 }
 
+// src/cli/write-compose.ts
+init_compose();
+import { chownSync as chownSync2 } from "node:fs";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname3 } from "node:path";
+
+// src/config/release-resolve.ts
+function resolveImageTag(release) {
+  if (!release)
+    return "latest";
+  if (release.pin)
+    return release.pin;
+  if (release.channel)
+    return release.channel;
+  return "latest";
+}
+function resolveRelease(opts) {
+  if (opts.override)
+    return opts.override;
+  if (opts.perAgent)
+    return opts.perAgent;
+  if (opts.root)
+    return opts.root;
+  return;
+}
+
+// src/cli/operator-uid.ts
+import {
+  chownSync,
+  existsSync as existsSync15,
+  lstatSync as lstatSync4,
+  readdirSync as readdirSync7,
+  realpathSync as realpathSync3,
+  statSync as statSync8
+} from "node:fs";
+import { join as join10 } from "node:path";
+function resolveOperatorUid() {
+  const sudoUid = process.env.SUDO_UID;
+  if (sudoUid !== undefined) {
+    const parsed = parseInt(sudoUid, 10);
+    if (Number.isFinite(parsed) && parsed > 0)
+      return parsed;
+  }
+  if (typeof process.getuid === "function") {
+    const uid = process.getuid();
+    if (uid > 0)
+      return uid;
+  }
+  return;
+}
+function operatorOwnedPaths(home2) {
+  const root = join10(home2, ".switchroom");
+  return [
+    join10(root, "vault"),
+    join10(root, "vault-auto-unlock"),
+    join10(root, "vault-audit.log"),
+    join10(root, "host-control-audit.log"),
+    join10(root, "accounts"),
+    join10(root, "compose")
+  ];
+}
+function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
+  const chown = deps.chown ?? ((p, u, g) => chownSync(p, u, g));
+  const exists = deps.exists ?? ((p) => existsSync15(p));
+  const isSymlink = deps.isSymlink ?? ((p) => {
+    try {
+      return lstatSync4(p).isSymbolicLink();
+    } catch {
+      return false;
+    }
+  });
+  const isDir = deps.isDir ?? ((p) => {
+    try {
+      return statSync8(p).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+  const realpath = deps.realpath ?? ((p) => {
+    try {
+      return realpathSync3(p);
+    } catch {
+      return p;
+    }
+  });
+  const readdir = deps.readdir ?? ((p) => {
+    try {
+      return readdirSync7(p);
+    } catch {
+      return [];
+    }
+  });
+  const chowned = [];
+  const seen = new Set;
+  const visit = (path) => {
+    if (!exists(path))
+      return;
+    const target = isSymlink(path) ? realpath(path) : path;
+    if (seen.has(target))
+      return;
+    seen.add(target);
+    try {
+      chown(target, operatorUid, operatorUid);
+      chowned.push(target);
+    } catch {}
+    if (isDir(target)) {
+      for (const entry of readdir(target)) {
+        visit(join10(target, entry));
+      }
+    }
+  };
+  for (const p of operatorOwnedPaths(home2))
+    visit(p);
+  return chowned;
+}
+
+// src/cli/write-compose.ts
+var AGENT_IMAGE_TAG_RE = /image:\s*\S*switchroom-agent:(\S+)/;
+async function writeComposeFile(opts) {
+  const release = resolveRelease({ override: opts.releaseOverride, root: opts.config.release });
+  const imageTag = resolveImageTag(release);
+  const operatorUid = resolveOperatorUid();
+  const content = generateCompose({
+    config: opts.config,
+    imageTag,
+    buildMode: opts.buildMode ?? "pull",
+    buildContext: opts.buildContext,
+    homeDir: homedir5(),
+    switchroomConfigPath: opts.switchroomConfigPath,
+    operatorUid
+  });
+  let previous = null;
+  try {
+    previous = await readFile(opts.composePath, "utf8");
+  } catch {
+    previous = null;
+  }
+  const previousImageTag = previous ? AGENT_IMAGE_TAG_RE.exec(previous)?.[1] ?? null : null;
+  await mkdir(dirname3(opts.composePath), { recursive: true });
+  await writeFile(opts.composePath, content, { encoding: "utf8", mode: 384 });
+  if (operatorUid !== undefined && process.geteuid?.() === 0) {
+    try {
+      chownSync2(opts.composePath, operatorUid, operatorUid);
+    } catch {}
+  }
+  return {
+    composePath: opts.composePath,
+    imageTag,
+    bytes: Buffer.byteLength(content, "utf8"),
+    changed: previous !== content,
+    previousImageTag
+  };
+}
+
 // src/cli/agent.ts
 init_lifecycle();
 init_merge();
 
 // src/agents/in-flight.ts
-import { readdirSync as readdirSync7, statSync as statSync8 } from "node:fs";
+import { readdirSync as readdirSync8, statSync as statSync9 } from "node:fs";
 import { resolve as resolve14 } from "node:path";
 var DEFAULT_RECENCY_MS = 30000;
 function safeReaddir(path) {
   try {
-    return readdirSync7(path);
+    return readdirSync8(path);
   } catch {
     return [];
   }
 }
 function safeMtimeMs(path) {
   try {
-    return statSync8(path).mtimeMs;
+    return statSync9(path).mtimeMs;
   } catch {
     return 0;
   }
@@ -53501,7 +53656,7 @@ function collectJsonl(root, maxDepth = 4) {
       const full = resolve14(dir, entry);
       let isDir = false;
       try {
-        isDir = statSync8(full).isDirectory();
+        isDir = statSync9(full).isDirectory();
       } catch {
         continue;
       }
@@ -53690,13 +53845,13 @@ function spinner(message) {
 }
 
 // src/agents/status.ts
-import { existsSync as existsSync18, readFileSync as readFileSync17, statSync as statSync10 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync17, statSync as statSync11 } from "node:fs";
+import { join as join13 } from "node:path";
 import { execFileSync as execFileSync9 } from "node:child_process";
 
 // src/agents/handoff-summarizer.ts
-import { readFileSync as readFileSync15, writeFileSync as writeFileSync8, renameSync as renameSync5, mkdirSync as mkdirSync13, existsSync as existsSync16, statSync as statSync9, readdirSync as readdirSync8 } from "node:fs";
-import { join as join11 } from "node:path";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync8, renameSync as renameSync5, mkdirSync as mkdirSync13, existsSync as existsSync17, statSync as statSync10, readdirSync as readdirSync9 } from "node:fs";
+import { join as join12 } from "node:path";
 var DEFAULT_MAX_TURNS = 50;
 var TOPIC_MAX_CHARS = 117;
 var TURN_TEXT_MAX_CHARS = 1200;
@@ -53831,8 +53986,8 @@ function clampTopic(s) {
 }
 function writeSidecarsAtomic(agentDir, briefing, topic) {
   mkdirSync13(agentDir, { recursive: true });
-  const handoffPath = join11(agentDir, ".handoff.md");
-  const topicPath = join11(agentDir, ".handoff-topic");
+  const handoffPath = join12(agentDir, ".handoff.md");
+  const topicPath = join12(agentDir, ".handoff-topic");
   const handoffTmp = handoffPath + ".tmp";
   const topicTmp = topicPath + ".tmp";
   writeFileSync8(handoffTmp, briefing, "utf-8");
@@ -53893,22 +54048,22 @@ async function mirrorToHindsight(briefing, opts) {
   }
 }
 function findLatestSessionJsonl(claudeConfigDir) {
-  const projects = join11(claudeConfigDir, "projects");
-  if (!existsSync16(projects))
+  const projects = join12(claudeConfigDir, "projects");
+  if (!existsSync17(projects))
     return null;
   let latest = null;
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync8(dir);
+      entries = readdirSync9(dir);
     } catch {
       return;
     }
     for (const name of entries) {
-      const full = join11(dir, name);
+      const full = join12(dir, name);
       let st;
       try {
-        st = statSync9(full);
+        st = statSync10(full);
       } catch {
         continue;
       }
@@ -53928,9 +54083,9 @@ function findLatestSessionJsonl(claudeConfigDir) {
 }
 
 // src/agents/perf.ts
-import { existsSync as existsSync17, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "node:fs";
 function readTurnUsages(jsonlPath, lastN) {
-  if (!existsSync17(jsonlPath))
+  if (!existsSync18(jsonlPath))
     return [];
   if (lastN <= 0)
     return [];
@@ -54241,10 +54396,10 @@ async function buildAgentStatusReport(inputs) {
       };
     }
   }
-  const logPath = join12(inputs.agentDir, "telegram", "gateway.log");
+  const logPath = join13(inputs.agentDir, "telegram", "gateway.log");
   const logContent = inputs.readGatewayLog(logPath);
   const polling = buildPollingStatus(logContent);
-  const historyDbPath = join12(inputs.agentDir, "telegram", "history.db");
+  const historyDbPath = join13(inputs.agentDir, "telegram", "history.db");
   const messagesResult = inputs.getLastMessages(historyDbPath);
   const messages = buildMessageStatus(messagesResult);
   const checks = [
@@ -54339,10 +54494,10 @@ function formatWindowFromIso(first, last) {
   return `${f} .. ${l}`;
 }
 function readLogFile(logPath) {
-  if (!existsSync18(logPath))
+  if (!existsSync19(logPath))
     return null;
   try {
-    const stat = statSync10(logPath);
+    const stat = statSync11(logPath);
     const cap = 256 * 1024;
     if (stat.size <= cap) {
       return readFileSync17(logPath, "utf-8");
@@ -54361,7 +54516,7 @@ function readLogFile(logPath) {
   }
 }
 function readLastMessages(historyDbPath) {
-  if (!existsSync18(historyDbPath)) {
+  if (!existsSync19(historyDbPath)) {
     return {
       lastInboundTs: null,
       lastOutboundTs: null,
@@ -54522,7 +54677,7 @@ function defaultStatusInputs(params) {
 }
 function readCacheTelemetry(agentDir) {
   try {
-    const claudeConfigDir = join12(agentDir, ".claude");
+    const claudeConfigDir = join13(agentDir, ".claude");
     const jsonl = findLatestSessionJsonl(claudeConfigDir);
     if (!jsonl)
       return null;
@@ -54546,7 +54701,7 @@ function readCacheTelemetry(agentDir) {
 // src/agents/create-orchestrator.ts
 init_loader();
 import { resolve as resolve16 } from "node:path";
-import { existsSync as existsSync21, rmSync as rmSync6 } from "node:fs";
+import { existsSync as existsSync22, rmSync as rmSync6 } from "node:fs";
 init_lifecycle();
 init_manager();
 
@@ -54653,7 +54808,7 @@ async function createAgent(opts) {
       resolve16(cwd, "switchroom.yml")
     ];
     for (const c of candidates) {
-      if (existsSync21(c))
+      if (existsSync22(c))
         return c;
     }
     throw new Error("switchroom.yaml not found. Pass configPath or run from the project root.");
@@ -54716,14 +54871,14 @@ async function completeCreation(name, code, opts = {}) {
     const cwd = process.cwd();
     const candidates = [resolve16(cwd, "switchroom.yaml"), resolve16(cwd, "switchroom.yml")];
     for (const c of candidates)
-      if (existsSync21(c))
+      if (existsSync22(c))
         return c;
     throw new Error("switchroom.yaml not found. Pass configPath option.");
   })();
   const config = loadConfig(configPath);
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve16(agentsDir, name);
-  if (!existsSync21(agentDir)) {
+  if (!existsSync22(agentDir)) {
     throw new Error(`Agent dir not found: ${agentDir}. Run createAgent first.`);
   }
   const authCodeResult = submitAuthCode(name, agentDir, code, undefined, opts.pollTimeoutMs ? { pollTimeoutMs: opts.pollTimeoutMs } : {});
@@ -54762,8 +54917,8 @@ async function completeCreation(name, code, opts = {}) {
 }
 
 // src/agents/add-orchestrator.ts
-import { resolve as resolve18, join as join15 } from "node:path";
-import { existsSync as existsSync23, rmSync as rmSync7, statSync as statSync14 } from "node:fs";
+import { resolve as resolve18, join as join16 } from "node:path";
+import { existsSync as existsSync24, rmSync as rmSync7, statSync as statSync15 } from "node:fs";
 import { execFileSync as execFileSync12 } from "node:child_process";
 
 // src/setup/botfather-walkthrough.ts
@@ -54854,7 +55009,7 @@ function enforceUsername(username, agentSlug, expectedUsername, loose, warn) {
 }
 
 // src/setup/profile-picker.ts
-import { existsSync as existsSync22, readdirSync as readdirSync11, statSync as statSync13 } from "node:fs";
+import { existsSync as existsSync23, readdirSync as readdirSync12, statSync as statSync14 } from "node:fs";
 import { resolve as resolve17 } from "node:path";
 var PROFILE_GLOSSES = {
   default: "minimal baseline \u2014 generic chat helper, no opinion.",
@@ -54866,13 +55021,13 @@ var DEFAULT_MAX_ATTEMPTS2 = 3;
 var PROFILES_ROOT2 = resolve17(import.meta.dirname, "../../profiles");
 function defaultListProfileSkills(profileName) {
   const skillsDir = resolve17(PROFILES_ROOT2, profileName, "skills");
-  if (!existsSync22(skillsDir)) {
+  if (!existsSync23(skillsDir)) {
     return [];
   }
   try {
-    return readdirSync11(skillsDir).filter((entry) => {
+    return readdirSync12(skillsDir).filter((entry) => {
       try {
-        return statSync13(resolve17(skillsDir, entry)).isDirectory();
+        return statSync14(resolve17(skillsDir, entry)).isDirectory();
       } catch {
         return false;
       }
@@ -55153,7 +55308,7 @@ function runFinalPreflight(inputs) {
   const { name, agentDir, expectedUserId, isUnitActive, configPath } = inputs;
   const unitPath = resolve18(process.env.HOME ?? "/root", ".config/systemd/user", `switchroom-${name}.service`);
   let autoaccept = { ok: false, detail: `unit not found at ${unitPath}` };
-  if (existsSync23(unitPath)) {
+  if (existsSync24(unitPath)) {
     const fs2 = __require("node:fs");
     const content = fs2.readFileSync(unitPath, "utf-8");
     if (content.includes("expect") || content.includes("autoaccept")) {
@@ -55172,7 +55327,7 @@ function runFinalPreflight(inputs) {
   }
   const envPath = resolve18(agentDir, "telegram", ".env");
   let token = { ok: false, detail: `telegram/.env missing at ${envPath}` };
-  if (existsSync23(envPath)) {
+  if (existsSync24(envPath)) {
     const fs2 = __require("node:fs");
     const content = fs2.readFileSync(envPath, "utf-8");
     if (/TELEGRAM_BOT_TOKEN=\S+/.test(content)) {
@@ -55200,7 +55355,7 @@ function runFinalPreflight(inputs) {
   }
   const accessPath = resolve18(agentDir, "telegram", "access.json");
   let access;
-  if (!existsSync23(accessPath)) {
+  if (!existsSync24(accessPath)) {
     access = {
       ok: false,
       detail: `access.json missing at ${accessPath}`
@@ -55227,7 +55382,7 @@ function runFinalPreflight(inputs) {
   }
   const settingsPath = resolve18(agentDir, ".claude", "settings.json");
   let mcp;
-  if (!existsSync23(settingsPath)) {
+  if (!existsSync24(settingsPath)) {
     mcp = {
       ok: false,
       detail: `.claude/settings.json missing at ${settingsPath}. ` + `Fix: switchroom agent reconcile ${name}`
@@ -55261,7 +55416,7 @@ function runFinalPreflight(inputs) {
       ok: true,
       detail: "skipped (no switchroom.yaml path supplied)"
     };
-  } else if (!existsSync23(configPath)) {
+  } else if (!existsSync24(configPath)) {
     vaultMgd = {
       ok: false,
       detail: `switchroom.yaml not found at ${configPath}`
@@ -55307,7 +55462,7 @@ function runFinalPreflight(inputs) {
 }
 function pruneBundledSkills(agentDir, keep, scope) {
   const skillsDir = resolve18(agentDir, ".claude", "skills");
-  if (!existsSync23(skillsDir)) {
+  if (!existsSync24(skillsDir)) {
     return [];
   }
   const keepSet = new Set(keep);
@@ -55316,12 +55471,12 @@ function pruneBundledSkills(agentDir, keep, scope) {
   for (const entry of scopeSet) {
     if (keepSet.has(entry))
       continue;
-    const entryPath = join15(skillsDir, entry);
-    if (!existsSync23(entryPath))
+    const entryPath = join16(skillsDir, entry);
+    if (!existsSync24(entryPath))
       continue;
     let isDir = false;
     try {
-      isDir = statSync14(entryPath).isDirectory();
+      isDir = statSync15(entryPath).isDirectory();
     } catch {
       continue;
     }
@@ -55356,7 +55511,7 @@ init_vault();
 init_lifecycle();
 import { resolve as resolve19 } from "node:path";
 import {
-  existsSync as existsSync24,
+  existsSync as existsSync25,
   mkdtempSync as mkdtempSync3,
   rmSync as rmSync8,
   cpSync
@@ -55388,7 +55543,7 @@ function defaultDeps() {
     },
     copyDir: (src, dst) => cpSync(src, dst, { recursive: true }),
     removeDir: (p) => rmSync8(p, { recursive: true, force: true }),
-    existsSync: existsSync24,
+    existsSync: existsSync25,
     readFileSync: (p, enc) => readFileSync20(p, enc)
   };
 }
@@ -55805,11 +55960,11 @@ function checkQuarantineRefusal(agentsDir, name) {
 function preflightCheck(name, agentDir, _usesDevChannels) {
   const errors2 = [];
   const startSh = resolve21(agentDir, "start.sh");
-  if (!existsSync26(startSh)) {
+  if (!existsSync27(startSh)) {
     errors2.push(`start.sh not found at ${startSh}`);
   }
   const envPath = resolve21(agentDir, "telegram", ".env");
-  if (existsSync26(envPath)) {
+  if (existsSync27(envPath)) {
     const envContent = readFileSync22(envPath, "utf-8");
     if (!envContent.includes("TELEGRAM_BOT_TOKEN=") || envContent.includes("# Set your bot token")) {
       errors2.push(`telegram/.env is missing TELEGRAM_BOT_TOKEN. ` + `Set it or run: switchroom setup`);
@@ -55817,7 +55972,7 @@ function preflightCheck(name, agentDir, _usesDevChannels) {
   } else {
     errors2.push(`telegram/.env not found at ${envPath}`);
   }
-  if (!existsSync26(resolve21(agentDir, ".claude", "settings.json"))) {
+  if (!existsSync27(resolve21(agentDir, ".claude", "settings.json"))) {
     errors2.push(`.claude/settings.json not found. Run: switchroom agent reconcile ${name}`);
   }
   return errors2;
@@ -55894,7 +56049,7 @@ function synthesizeTopicName2(name) {
   return name.split(/[-_]+/).filter((s) => s.length > 0).map((s) => s.charAt(0).toUpperCase() + s.slice(1)).join(" ");
 }
 function writeAgentEntryToConfig(configPath, name, profile) {
-  if (!existsSync26(configPath)) {
+  if (!existsSync27(configPath)) {
     throw new Error(`switchroom.yaml not found at ${configPath}`);
   }
   const raw = readFileSync22(configPath, "utf-8");
@@ -55925,7 +56080,7 @@ function updateAgentExtendsInConfig(configPath, name, profile) {
   writeFileSync13(configPath, doc.toString(), "utf-8");
 }
 function removeAgentFromConfig(configPath, name) {
-  if (!existsSync26(configPath))
+  if (!existsSync27(configPath))
     return;
   const raw = readFileSync22(configPath, "utf-8");
   const doc = import_yaml5.default.parseDocument(raw);
@@ -55939,7 +56094,8 @@ async function reconcileAndRestartAgent(name, config, agentsDir, configPath, opt
   reconcileAgent,
   restartAgent,
   gracefulRestartAgent,
-  applyCronChangesHot
+  applyCronChangesHot,
+  writeComposeFile
 }) {
   const log = opts.silent ? () => {} : (msg) => console.log(msg);
   const agentConfig = config.agents[name];
@@ -55972,7 +56128,7 @@ async function reconcileAndRestartAgent(name, config, agentsDir, configPath, opt
   }
   if (!opts.force) {
     const envPath = resolve21(agentsDir, name, "telegram", ".env");
-    if (existsSync26(envPath)) {
+    if (existsSync27(envPath)) {
       const envContent = readFileSync22(envPath, "utf-8");
       const match = envContent.match(/^TELEGRAM_BOT_TOKEN=(.+)$/m);
       if (match) {
@@ -55988,6 +56144,20 @@ async function reconcileAndRestartAgent(name, config, agentsDir, configPath, opt
       }
     }
   }
+  try {
+    const r = await deps.writeComposeFile({
+      config,
+      composePath: opts.composePath ?? composeFilePath(),
+      switchroomConfigPath: configPath
+    });
+    if (r.changed) {
+      const tagNote = r.previousImageTag && r.previousImageTag !== r.imageTag ? ` (image ${r.previousImageTag} \u2192 ${r.imageTag})` : ` (image ${r.imageTag})`;
+      log(source_default.green(`  ${name}: compose regenerated${tagNote}`));
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log(source_default.yellow(`  ${name}: could not regenerate compose (${msg}) \u2014 image/pin changes may not apply; run \`switchroom apply\``));
+  }
   if (opts.graceful) {
     try {
       const r = await deps.gracefulRestartAgent(name);
@@ -56022,7 +56192,7 @@ function registerAgentCommand(program3) {
       }
       return;
     }
-    const logsDir = join17(homedir6(), ".switchroom", "logs");
+    const logsDir = join18(homedir7(), ".switchroom", "logs");
     const schedulerStates = Object.fromEntries(agentNames.map((n) => [n, getSchedulerState(n, logsDir)]));
     if (opts.json) {
       const data = agentNames.map((name) => {
@@ -56453,7 +56623,7 @@ Scaffolding agent: ${name}
         });
         const settingsPath = resolve21(agentsDir, n, ".claude", "settings.json");
         let actual = {};
-        if (existsSync26(settingsPath)) {
+        if (existsSync27(settingsPath)) {
           try {
             const raw = JSON.parse(readFileSync22(settingsPath, "utf-8"));
             actual = raw.hooks ?? {};
@@ -56593,7 +56763,7 @@ Reconciled ${agentsTouched} agent(s), ${totalChanges} file(s) changed.`));
   }));
   agent.command("grant <name> <tool>").description("Add a tool name (or 'all') to an agent's tools.allow in switchroom.yaml, then reconcile").option("--no-restart", "Skip restarting the agent after granting").action(withConfigError(async (name, tool, opts) => {
     const configPath = getConfigPath(program3);
-    if (!existsSync26(configPath)) {
+    if (!existsSync27(configPath)) {
       console.error(source_default.red(`switchroom.yaml not found at ${configPath}`));
       process.exit(1);
     }
@@ -56642,7 +56812,7 @@ Reconciled ${agentsTouched} agent(s), ${totalChanges} file(s) changed.`));
   }));
   agent.command("dangerous <name>").description("Enable full tool access for an agent (sets tools.allow: [all] in switchroom.yaml). Reconciles + restarts.").option("--off", "Disable: clear tools.allow").option("--no-restart", "Skip restarting the agent").action(withConfigError(async (name, opts) => {
     const configPath = getConfigPath(program3);
-    if (!existsSync26(configPath)) {
+    if (!existsSync27(configPath)) {
       console.error(source_default.red(`switchroom.yaml not found at ${configPath}`));
       process.exit(1);
     }
@@ -56697,7 +56867,7 @@ Reconciled ${agentsTouched} agent(s), ${totalChanges} file(s) changed.`));
     const config = getConfig(program3);
     const agentsDir = resolveAgentsDir(config);
     const settingsPath = resolve21(agentsDir, name, ".claude", "settings.json");
-    if (!existsSync26(settingsPath)) {
+    if (!existsSync27(settingsPath)) {
       console.error(source_default.red(`Agent "${name}" not found at ${settingsPath}`));
       process.exit(1);
     }
@@ -56756,7 +56926,7 @@ Permissions for ${name}
         }
       }
     }
-    if (existsSync26(agentDir)) {
+    if (existsSync27(agentDir)) {
       rmSync9(agentDir, { recursive: true, force: true });
       console.log(source_default.green(`  Removed directory: ${agentDir}`));
     } else {
@@ -56960,7 +57130,7 @@ switchroom agent add: ${name}
           } catch {}
           const agentsDirRollback = resolveAgentsDir(cfg);
           const agentDirRollback = resolve21(agentsDirRollback, name);
-          if (existsSync26(agentDirRollback)) {
+          if (existsSync27(agentDirRollback)) {
             rmSync9(agentDirRollback, { recursive: true, force: true });
             console.log(source_default.gray(`  Rolled back: removed ${agentDirRollback}`));
           }
@@ -57059,8 +57229,8 @@ init_source();
 init_lifecycle();
 import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
-import { homedir as homedir8 } from "node:os";
-import { join as join19 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { join as join20 } from "node:path";
 init_helpers();
 init_broker_call();
 var execFileP = promisify2(execFile2);
@@ -57132,7 +57302,7 @@ function registerStatusCommand(program3) {
     const config = getConfig(program3);
     const agentNames = Object.keys(config.agents ?? {}).sort();
     const statuses = getAllAgentStatuses(config);
-    const logsDir = join19(homedir8(), ".switchroom", "logs");
+    const logsDir = join20(homedir9(), ".switchroom", "logs");
     const schedulerStates = Object.fromEntries(agentNames.map((n) => [n, getSchedulerState(n, logsDir)]));
     const accountsP = fetchAccounts();
     const mcpEnabled = opts.mcp !== false;
@@ -57541,8 +57711,8 @@ init_account_store();
 init_loader();
 init_manager();
 init_helpers();
-import { existsSync as existsSync31, readFileSync as readFileSync27 } from "node:fs";
-import { join as join23, resolve as resolve24 } from "node:path";
+import { existsSync as existsSync32, readFileSync as readFileSync27 } from "node:fs";
+import { join as join24, resolve as resolve24 } from "node:path";
 
 // src/cli/auth-google.ts
 init_source();
@@ -57759,8 +57929,8 @@ function registerConnect(googleParent, program3) {
     }
     let mode = 420;
     try {
-      const { statSync: statSync16 } = await import("node:fs");
-      mode = statSync16(configPath).mode & 511;
+      const { statSync: statSync17 } = await import("node:fs");
+      mode = statSync17(configPath).mode & 511;
     } catch {}
     atomicWriteFileSync3(configPath, patched, mode);
     try {
@@ -59058,7 +59228,7 @@ function registerAuthScheduleSubcommands(_program, authParent) {
 // src/cli/auth.ts
 init_auth_active_yaml();
 init_atomic();
-import { statSync as statSync16 } from "node:fs";
+import { statSync as statSync17 } from "node:fs";
 var SEVERITY_RANK = {
   ok: 0,
   warn: 1,
@@ -59067,10 +59237,10 @@ var SEVERITY_RANK = {
 };
 function diagnoseAuthState(claudeConfigDir) {
   const findings = [];
-  const credsPath = join23(claudeConfigDir, ".credentials.json");
-  const oauthTokenPath2 = join23(claudeConfigDir, ".oauth-token");
-  const hasCreds = existsSync31(credsPath);
-  const hasOauthToken = existsSync31(oauthTokenPath2);
+  const credsPath = join24(claudeConfigDir, ".credentials.json");
+  const oauthTokenPath2 = join24(claudeConfigDir, ".oauth-token");
+  const hasCreds = existsSync32(credsPath);
+  const hasOauthToken = existsSync32(oauthTokenPath2);
   if (!hasCreds && !hasOauthToken) {
     findings.push({
       code: "credentials_missing",
@@ -59241,8 +59411,8 @@ function loadCredentialsFromAgent(agentName) {
   const config = getConfigSafe();
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve24(agentsDir, agentName);
-  const credsPath = join23(agentDir, ".claude", ".credentials.json");
-  if (!existsSync31(credsPath)) {
+  const credsPath = join24(agentDir, ".claude", ".credentials.json");
+  if (!existsSync32(credsPath)) {
     console.error(source_default.red(`  Agent "${agentName}" has no .claude/.credentials.json \u2014 log it in first.`));
     process.exit(1);
   }
@@ -59260,7 +59430,7 @@ function loadCredentialsFromAgent(agentName) {
   return parsed;
 }
 function loadCredentialsFromFile(path) {
-  if (!existsSync31(path)) {
+  if (!existsSync32(path)) {
     console.error(source_default.red(`  No file at ${path}`));
     process.exit(1);
   }
@@ -59299,12 +59469,12 @@ function loadCredentialsFromGlobalAccount(label) {
   };
 }
 async function loadCredentialsViaClaude(label) {
-  const [{ runViaClaude: runViaClaude2 }, { homedir: homedir11 }, { default: readline }] = await Promise.all([
+  const [{ runViaClaude: runViaClaude2 }, { homedir: homedir12 }, { default: readline }] = await Promise.all([
     Promise.resolve().then(() => (init_via_claude(), exports_via_claude)),
     import("node:os"),
     import("node:readline")
   ]);
-  const configDir = join23(homedir11(), ".switchroom", "accounts", label);
+  const configDir = join24(homedir12(), ".switchroom", "accounts", label);
   const result = await runViaClaude2({
     configDir,
     promptForCode: async (_url) => {
@@ -59346,7 +59516,7 @@ function registerAuthCommand(program3) {
       await withConfigError(async () => {
         const config = getConfig(program3);
         const agentsDir = resolveAgentsDir(config);
-        configDir = join23(agentsDir, agent, ".claude");
+        configDir = join24(agentsDir, agent, ".claude");
       })();
     }
     const diag = diagnoseAuthState(configDir);
@@ -59405,7 +59575,7 @@ function registerAuthCommand(program3) {
       if (after !== before) {
         let mode = 420;
         try {
-          mode = statSync16(yamlPath).mode & 511;
+          mode = statSync17(yamlPath).mode & 511;
         } catch {}
         atomicWriteFileSync2(yamlPath, after, mode);
         if (!quiet) {
@@ -59505,7 +59675,7 @@ function registerAuthCommand(program3) {
   }));
   auth.command("reauth <agent>").description("Start/resume an OAuth re-auth session for an agent; prints the login URL").option("--slot <label>", "Target a specific account slot/label instead of the agent's active one").option("--force", "Kill any existing session and force a fresh login (use to switch accounts)").action(withConfigError(async (agent, opts) => {
     const config = getConfig(program3);
-    const agentDir = join23(resolveAgentsDir(config), agent);
+    const agentDir = join24(resolveAgentsDir(config), agent);
     const r = startAuthSession(agent, agentDir, {
       force: opts.force,
       slot: opts.slot
@@ -59518,7 +59688,7 @@ function registerAuthCommand(program3) {
   }));
   auth.command("code <agent> <code>").description("Submit the browser OAuth code to complete a pending `auth reauth`").option("--slot <label>", "Target a specific account slot/label").option("--json", "Emit the structured AuthCodeResult as JSON (consumed by the Telegram gateway)").action(withConfigError(async (agent, code, opts) => {
     const config = getConfig(program3);
-    const agentDir = join23(resolveAgentsDir(config), agent);
+    const agentDir = join24(resolveAgentsDir(config), agent);
     const r = submitAuthCode(agent, agentDir, code, opts.slot);
     if (opts.json) {
       console.log(JSON.stringify({
@@ -59535,7 +59705,7 @@ function registerAuthCommand(program3) {
   }));
   auth.command("cancel <agent>").description("Cancel a pending `auth reauth` session for an agent").option("--slot <label>", "Target a specific account slot/label").action(withConfigError(async (agent, opts) => {
     const config = getConfig(program3);
-    const agentDir = join23(resolveAgentsDir(config), agent);
+    const agentDir = join24(resolveAgentsDir(config), agent);
     const r = cancelAuthSession(agent, agentDir, opts.slot);
     for (const line of r.instructions)
       console.log(line);
@@ -59555,10 +59725,10 @@ init_source();
 init_loader();
 init_vault();
 init_hindsight();
-import { readFileSync as readFileSync28, writeFileSync as writeFileSync17, copyFileSync as copyFileSync6, existsSync as existsSync32, readdirSync as readdirSync15, statSync as statSync17 } from "node:fs";
+import { readFileSync as readFileSync28, writeFileSync as writeFileSync17, copyFileSync as copyFileSync6, existsSync as existsSync33, readdirSync as readdirSync16, statSync as statSync18 } from "node:fs";
 import { execFileSync as execFileSync15 } from "node:child_process";
-import { join as join24 } from "node:path";
-import { homedir as homedir11 } from "node:os";
+import { join as join25 } from "node:path";
+import { homedir as homedir12 } from "node:os";
 function getVaultPath2(configPath) {
   try {
     const config = loadConfig(configPath);
@@ -59573,22 +59743,22 @@ function maskToken(s) {
   return "***";
 }
 function findClaudeTranscripts() {
-  const root = join24(homedir11(), ".claude", "projects");
-  if (!existsSync32(root))
+  const root = join25(homedir12(), ".claude", "projects");
+  if (!existsSync33(root))
     return [];
   const out = [];
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync15(dir);
+      entries = readdirSync16(dir);
     } catch {
       return;
     }
     for (const e of entries) {
-      const p = join24(dir, e);
+      const p = join25(dir, e);
       let st;
       try {
-        st = statSync17(p);
+        st = statSync18(p);
       } catch {
         continue;
       }
@@ -59604,11 +59774,11 @@ function findClaudeTranscripts() {
 }
 function findTelegramHistoryDb() {
   const candidates = [
-    process.env.TELEGRAM_STATE_DIR ? join24(process.env.TELEGRAM_STATE_DIR, "history.db") : null,
-    join24(homedir11(), ".claude", "channels", "telegram", "history.db")
+    process.env.TELEGRAM_STATE_DIR ? join25(process.env.TELEGRAM_STATE_DIR, "history.db") : null,
+    join25(homedir12(), ".claude", "channels", "telegram", "history.db")
   ].filter(Boolean);
   for (const c of candidates) {
-    if (existsSync32(c))
+    if (existsSync33(c))
       return c;
   }
   return null;
@@ -59964,15 +60134,15 @@ function suggestVaultKeys(requested, available, max = 3) {
 init_loader();
 init_loader();
 init_client();
-import { readFileSync as readFileSync33, existsSync as existsSync36, unlinkSync as unlinkSync9 } from "node:fs";
+import { readFileSync as readFileSync33, existsSync as existsSync37, unlinkSync as unlinkSync9 } from "node:fs";
 import { spawn as spawn4 } from "node:child_process";
 
 // src/vault/broker/server.ts
 init_compose();
 init_vault();
 import * as net3 from "node:net";
-import { mkdirSync as mkdirSync22, chmodSync as chmodSync7, chownSync as chownSync2, existsSync as existsSync35, readFileSync as readFileSync31, readdirSync as readdirSync16, statSync as statSync19, unlinkSync as unlinkSync8, writeFileSync as writeFileSync19, renameSync as renameSync10 } from "node:fs";
-import { dirname as dirname6, resolve as resolve26, basename as basename4 } from "node:path";
+import { mkdirSync as mkdirSync22, chmodSync as chmodSync7, chownSync as chownSync4, existsSync as existsSync36, readFileSync as readFileSync31, readdirSync as readdirSync17, statSync as statSync20, unlinkSync as unlinkSync8, writeFileSync as writeFileSync19, renameSync as renameSync10 } from "node:fs";
+import { dirname as dirname7, resolve as resolve26, basename as basename4 } from "node:path";
 import * as os4 from "node:os";
 import * as path3 from "node:path";
 
@@ -59981,26 +60151,26 @@ init_vault();
 import {
   copyFileSync as copyFileSync7,
   chmodSync as chmodSync4,
-  existsSync as existsSync33,
+  existsSync as existsSync34,
   fsyncSync as fsyncSync4,
-  lstatSync as lstatSync4,
+  lstatSync as lstatSync5,
   mkdirSync as mkdirSync19,
   openSync as openSync6,
   closeSync as closeSync6,
   readFileSync as readFileSync29,
   renameSync as renameSync9,
-  statSync as statSync18,
+  statSync as statSync19,
   symlinkSync as symlinkSync3,
   unlinkSync as unlinkSync7
 } from "node:fs";
 import { createHash as createHash5 } from "node:crypto";
-import { basename as basename3, dirname as dirname3, join as join25 } from "node:path";
+import { basename as basename3, dirname as dirname4, join as join26 } from "node:path";
 function vaultLayoutPaths(home2) {
-  const switchroomRoot = join25(home2, ".switchroom");
+  const switchroomRoot = join26(home2, ".switchroom");
   return {
-    oldPath: join25(switchroomRoot, "vault.enc"),
-    newPath: join25(switchroomRoot, "vault", "vault.enc"),
-    parent: join25(switchroomRoot, "vault"),
+    oldPath: join26(switchroomRoot, "vault.enc"),
+    newPath: join26(switchroomRoot, "vault", "vault.enc"),
+    parent: join26(switchroomRoot, "vault"),
     switchroomRoot
   };
 }
@@ -60020,11 +60190,11 @@ function migrateVaultLayout(home2, opts = {}) {
 }
 function runMigration(home2, opts) {
   const { oldPath, newPath, parent, switchroomRoot } = vaultLayoutPaths(home2);
-  const lockTarget = existsSync33(newPath) ? newPath : existsSync33(oldPath) ? oldPath : null;
+  const lockTarget = existsSync34(newPath) ? newPath : existsSync34(oldPath) ? oldPath : null;
   const release = !opts.dryRun && lockTarget !== null ? acquireVaultLock(lockTarget) : null;
   try {
     const oldStat = lstatSyncOrNull(oldPath);
-    const newExists = existsSync33(newPath);
+    const newExists = existsSync34(newPath);
     if (oldStat === null && !newExists) {
       return { kind: "no-vault" };
     }
@@ -60041,8 +60211,8 @@ function runMigration(home2, opts) {
         fsyncDir(switchroomRoot);
         return { kind: "completed-partial" };
       }
-      const oldRealStat = statSync18(oldPath);
-      const newRealStat = statSync18(newPath);
+      const oldRealStat = statSync19(oldPath);
+      const newRealStat = statSync19(newPath);
       return {
         kind: "divergent",
         details: {
@@ -60137,7 +60307,7 @@ your fleet works after \`switchroom apply\`, then delete it.
 }
 function lstatSyncOrNull(path) {
   try {
-    return lstatSync4(path);
+    return lstatSync5(path);
   } catch {
     return null;
   }
@@ -60147,8 +60317,8 @@ function sha256File(path) {
   return createHash5("sha256").update(data).digest("hex");
 }
 function atomicReplaceWithSymlink(target, linkTarget) {
-  const tmp = join25(dirname3(target), `.${basename3(target)}.symlink-tmp`);
-  if (existsSync33(tmp)) {
+  const tmp = join26(dirname4(target), `.${basename3(target)}.symlink-tmp`);
+  if (existsSync34(tmp)) {
     try {
       unlinkSync7(tmp);
     } catch {}
@@ -60178,8 +60348,8 @@ init_loader();
 
 // src/vault/auto-unlock.ts
 import { createHmac, randomBytes as randomBytes6, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "node:crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync34, mkdirSync as mkdirSync20, readFileSync as readFileSync30, writeFileSync as writeFileSync18 } from "node:fs";
-import { dirname as dirname4 } from "node:path";
+import { chmodSync as chmodSync5, existsSync as existsSync35, mkdirSync as mkdirSync20, readFileSync as readFileSync30, writeFileSync as writeFileSync18 } from "node:fs";
+import { dirname as dirname5 } from "node:path";
 var FORMAT_VERSION = 1;
 var SALT_LEN = 16;
 var NONCE_LEN = 12;
@@ -60268,12 +60438,12 @@ function decryptAutoUnlock(blob, machineId) {
 }
 function writeAutoUnlockFile(passphrase, filePath) {
   const blob = encryptAutoUnlock(passphrase);
-  mkdirSync20(dirname4(filePath), { recursive: true, mode: 448 });
+  mkdirSync20(dirname5(filePath), { recursive: true, mode: 448 });
   writeFileSync18(filePath, blob, { mode: 384 });
   chmodSync5(filePath, 384);
 }
 function readAutoUnlockFile(filePath) {
-  if (!existsSync34(filePath)) {
+  if (!existsSync35(filePath)) {
     throw new AutoUnlockDecryptError("io");
   }
   let blob;
@@ -60299,8 +60469,8 @@ import * as path from "node:path";
 
 // src/vault/broker/test-isolation-guard.ts
 import { mkdtempSync as mkdtempSync4 } from "node:fs";
-import { homedir as homedir12, tmpdir as tmpdir3 } from "node:os";
-import { join as join26, resolve as resolve25, sep } from "node:path";
+import { homedir as homedir13, tmpdir as tmpdir3 } from "node:os";
+import { join as join27, resolve as resolve25, sep } from "node:path";
 function isTestRuntime() {
   return process.env.VITEST !== undefined;
 }
@@ -60308,7 +60478,7 @@ function escapeHatchSet() {
   return process.env.SWITCHROOM_ALLOW_PROD_VAULT_IN_TEST === "1";
 }
 function realSwitchroomHome() {
-  return resolve25(homedir12(), ".switchroom");
+  return resolve25(homedir13(), ".switchroom");
 }
 function isUnderRealSwitchroomHome(p) {
   const home2 = realSwitchroomHome();
@@ -60321,7 +60491,7 @@ function safeVaultPath(requestedPath) {
     return requestedPath;
   if (!isUnderRealSwitchroomHome(requestedPath))
     return requestedPath;
-  const redirected = join26(mkdtempSync4(join26(tmpdir3(), "sw-test-vault-")), "vault.enc");
+  const redirected = join27(mkdtempSync4(join27(tmpdir3(), "sw-test-vault-")), "vault.enc");
   if (!warnedVault) {
     warnedVault = true;
     process.stderr.write(`[test-isolation guard] vault path redirected away from the ` + `production tree to an isolated tmpdir \u2014 a vault/broker test ` + `resolved its vault path inside ~/.switchroom. See CLAUDE.md ` + `"Vault & shared-state test discipline".
@@ -60337,7 +60507,7 @@ function safeAuditLogPath(requestedPath) {
   if (!isUnderRealSwitchroomHome(requestedPath))
     return requestedPath;
   if (!cachedTmpAuditLog) {
-    cachedTmpAuditLog = join26(mkdtempSync4(join26(tmpdir3(), "sw-test-audit-")), "vault-audit.log");
+    cachedTmpAuditLog = join27(mkdtempSync4(join27(tmpdir3(), "sw-test-audit-")), "vault-audit.log");
   }
   if (!warnedAudit) {
     warnedAudit = true;
@@ -62700,13 +62870,13 @@ class VaultBroker {
       this.passphrase = this.testOpts._testPassphrase;
     }
     process.umask(63);
-    const parentDir = dirname6(this.socketPath);
+    const parentDir = dirname7(this.socketPath);
     mkdirSync22(parentDir, { recursive: true, mode: 448 });
     try {
       chmodSync7(parentDir, 448);
     } catch {}
     for (const p of [this.socketPath, this.unlockSocketPath]) {
-      if (existsSync35(p)) {
+      if (existsSync36(p)) {
         try {
           unlinkSync8(p);
         } catch {}
@@ -62739,7 +62909,7 @@ class VaultBroker {
     try {
       if (ready) {
         writeFileSync19(p, "", { mode: 384 });
-      } else if (existsSync35(p)) {
+      } else if (existsSync36(p)) {
         unlinkSync8(p);
       }
     } catch {}
@@ -62772,7 +62942,7 @@ class VaultBroker {
       try {
         entry.server.close();
       } catch {}
-      if (existsSync35(sockPath)) {
+      if (existsSync36(sockPath)) {
         try {
           unlinkSync8(sockPath);
         } catch {}
@@ -62780,7 +62950,7 @@ class VaultBroker {
     }
     this.agentServers.clear();
     for (const p of [this.socketPath, this.unlockSocketPath]) {
-      if (p && existsSync35(p)) {
+      if (p && existsSync36(p)) {
         try {
           unlinkSync8(p);
         } catch {}
@@ -62788,7 +62958,7 @@ class VaultBroker {
     }
     try {
       const pidPath = resolvePath(PID_FILE_DEFAULT);
-      if (existsSync35(pidPath))
+      if (existsSync36(pidPath))
         unlinkSync8(pidPath);
     } catch {}
   }
@@ -62811,16 +62981,16 @@ class VaultBroker {
     return new Promise((resolveP, rejectP) => {
       if (abs.endsWith("/sock")) {
         const dir = abs.slice(0, -"/sock".length);
-        if (existsSync35(dir)) {
+        if (existsSync36(dir)) {
           try {
-            chownSync2(dir, 0, 0);
+            chownSync4(dir, 0, 0);
           } catch {}
           try {
             chmodSync7(dir, 448);
           } catch {}
         }
       }
-      if (existsSync35(abs)) {
+      if (existsSync36(abs)) {
         try {
           unlinkSync8(abs);
         } catch (err) {
@@ -62841,18 +63011,18 @@ class VaultBroker {
         try {
           agentUid = allocateAgentUid(agentName);
           try {
-            chownSync2(abs, agentUid, agentUid);
+            chownSync4(abs, agentUid, agentUid);
           } catch {}
           if (abs.endsWith("/sock")) {
             const dir = abs.slice(0, -"/sock".length);
             try {
-              chownSync2(dir, agentUid, agentUid);
+              chownSync4(dir, agentUid, agentUid);
             } catch {}
           }
         } catch {}
         this.agentServers.set(abs, { server, agentName });
         const unlockAbs = unlockSocketFor(abs);
-        if (existsSync35(unlockAbs)) {
+        if (existsSync36(unlockAbs)) {
           try {
             unlinkSync8(unlockAbs);
           } catch {}
@@ -62873,7 +63043,7 @@ class VaultBroker {
           } catch {}
           if (agentUid !== null) {
             try {
-              chownSync2(unlockAbs, agentUid, agentUid);
+              chownSync4(unlockAbs, agentUid, agentUid);
             } catch {}
           }
           this.agentServers.set(unlockAbs, { server: unlockServer, agentName });
@@ -62907,8 +63077,8 @@ class VaultBroker {
     if (!Number.isFinite(uid) || uid <= 0)
       return;
     try {
-      if (existsSync35(this.vaultPath))
-        chownSync2(this.vaultPath, uid, uid);
+      if (existsSync36(this.vaultPath))
+        chownSync4(this.vaultPath, uid, uid);
     } catch {}
   }
   bindOperatorListener(socketPath, operatorUid) {
@@ -62920,9 +63090,9 @@ class VaultBroker {
     const unlockAbs = unlockSocketFor(abs);
     if (abs.endsWith("/sock")) {
       const dir = abs.slice(0, -"/sock".length);
-      if (existsSync35(dir)) {
+      if (existsSync36(dir)) {
         try {
-          chownSync2(dir, 0, 0);
+          chownSync4(dir, 0, 0);
         } catch {}
         try {
           chmodSync7(dir, 448);
@@ -62930,7 +63100,7 @@ class VaultBroker {
       }
     }
     for (const p of [abs, unlockAbs]) {
-      if (existsSync35(p)) {
+      if (existsSync36(p)) {
         try {
           unlinkSync8(p);
         } catch {}
@@ -62946,7 +63116,7 @@ class VaultBroker {
           chmodSync7(abs, 384);
         } catch {}
         try {
-          chownSync2(abs, operatorUid, operatorUid);
+          chownSync4(abs, operatorUid, operatorUid);
         } catch {}
         const unlockServer = net3.createServer((sock) => {
           this._handleUnlockConnection(sock, true);
@@ -62957,12 +63127,12 @@ class VaultBroker {
             chmodSync7(unlockAbs, 384);
           } catch {}
           try {
-            chownSync2(unlockAbs, operatorUid, operatorUid);
+            chownSync4(unlockAbs, operatorUid, operatorUid);
           } catch {}
           if (abs.endsWith("/sock")) {
             const dir = abs.slice(0, -"/sock".length);
             try {
-              chownSync2(dir, operatorUid, operatorUid);
+              chownSync4(dir, operatorUid, operatorUid);
             } catch {}
             try {
               chmodSync7(dir, 448);
@@ -63797,7 +63967,7 @@ class VaultBroker {
         renameSync10(tmpPath, tokenPath);
         try {
           const uid = allocateAgentUid(agent);
-          chownSync2(tokenPath, uid, uid);
+          chownSync4(tokenPath, uid, uid);
         } catch (chownErr) {
           process.stderr.write(`[vault-broker] mint_grant: token written but chown failed for agent ${agent}: ${chownErr.message} (CAP_CHOWN missing?)
 `);
@@ -63854,7 +64024,7 @@ class VaultBroker {
         const row = this.grantsDb.query("SELECT agent_slug FROM vault_grants WHERE id = ?").get(id);
         if (row && AgentNameSchema.safeParse(row.agent_slug).success) {
           const tokenPath = path3.join(os4.homedir(), ".switchroom", "agents", row.agent_slug, ".vault-token");
-          if (existsSync35(tokenPath)) {
+          if (existsSync36(tokenPath)) {
             try {
               unlinkSync8(tokenPath);
             } catch {}
@@ -64092,10 +64262,10 @@ class VaultBroker {
     const envPath = process.env.SWITCHROOM_VAULT_BROKER_AUTO_UNLOCK_PATH;
     const configuredPath = (envPath && envPath.length > 0 ? envPath : undefined) ?? this.config?.vault?.broker?.autoUnlockCredentialPath ?? DEFAULT_AUTO_UNLOCK_PATH;
     const filePath = resolvePath(configuredPath);
-    if (!existsSync35(filePath))
+    if (!existsSync36(filePath))
       return false;
     try {
-      if (statSync19(filePath).size === 0)
+      if (statSync20(filePath).size === 0)
         return false;
     } catch {
       return false;
@@ -64173,15 +64343,15 @@ class VaultBroker {
   }
 }
 function detectVaultLayoutDrift(vaultPath) {
-  const dir = dirname6(vaultPath);
+  const dir = dirname7(vaultPath);
   if (basename4(dir) !== "vault")
     return;
   if (basename4(vaultPath) !== "vault.enc")
     return;
-  const switchroomDir = dirname6(dir);
+  const switchroomDir = dirname7(dir);
   if (basename4(switchroomDir) !== ".switchroom")
     return;
-  const home2 = dirname6(switchroomDir);
+  const home2 = dirname7(switchroomDir);
   const result = inspectVaultLayout(home2);
   if (result.kind === "divergent") {
     throw new VaultError(`Vault layout divergence detected at boot: ${result.details.oldPath} and ${result.details.newPath} are both regular files with different content. An older switchroom CLI may have written to the legacy path after migration ran. Run \`switchroom apply\` from the host to surface the recovery recipe (state E refusal with literal \`mv\` commands). See docs/operators/state-e-recovery.md.`);
@@ -64207,8 +64377,8 @@ async function main() {
   const vaultPath = process.env.SWITCHROOM_VAULT_PATH;
   let perAgentTargets = [];
   try {
-    if (existsSync35(perAgentDir)) {
-      const entries = readdirSync16(perAgentDir, { withFileTypes: true });
+    if (existsSync36(perAgentDir)) {
+      const entries = readdirSync17(perAgentDir, { withFileTypes: true });
       const flat = [];
       const subdirs = [];
       for (const e of entries) {
@@ -64249,7 +64419,7 @@ async function main() {
     }
     const operatorUidStr = process.env.SWITCHROOM_BROKER_OPERATOR_UID;
     const operatorDir = "/run/switchroom/broker/operator";
-    if (operatorUidStr !== undefined && existsSync35(operatorDir)) {
+    if (operatorUidStr !== undefined && existsSync36(operatorDir)) {
       const operatorUid = parseInt(operatorUidStr, 10);
       if (!Number.isFinite(operatorUid) || operatorUid <= 0) {
         process.stderr.write(`[vault-broker] SWITCHROOM_BROKER_OPERATOR_UID='${operatorUidStr}' is not a positive integer; skipping operator listener
@@ -64289,8 +64459,8 @@ init_client();
 var import_yaml10 = __toESM(require_dist(), 1);
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { readFileSync as readFileSync32, writeFileSync as writeFileSync20 } from "node:fs";
-import { homedir as homedir16 } from "node:os";
-import { join as join31 } from "node:path";
+import { homedir as homedir17 } from "node:os";
+import { join as join32 } from "node:path";
 class EncryptFailedError extends Error {
   detail;
   constructor(detail) {
@@ -64323,7 +64493,7 @@ function setVaultBrokerAutoUnlock(configPath, value) {
   doc.setIn(["vault", "broker", "autoUnlock"], value);
   writeFileSync20(configPath, doc.toString(), "utf-8");
 }
-var DEFAULT_COMPOSE_FILE = join31(homedir16(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_FILE = join32(homedir17(), ".switchroom", "compose", "docker-compose.yml");
 async function applyAutoUnlock(opts = {}) {
   const log = opts.log ?? ((s) => console.log(s));
   const err = opts.err ?? ((s) => console.error(s));
@@ -64509,7 +64679,7 @@ function registerVaultBrokerCommand(vaultCmd, program3) {
       process.exit(0);
     }
     const pidPath = resolvePath(DEFAULT_PID_FILE);
-    if (!existsSync36(pidPath)) {
+    if (!existsSync37(pidPath)) {
       console.error("vault-broker PID file not found \u2014 is the daemon running?");
       process.exit(1);
     }
@@ -64636,7 +64806,7 @@ function registerVaultBrokerCommand(vaultCmd, program3) {
   broker.command("disable-auto-unlock").description("Remove the auto-unlock credential file. Reconcile + restart broker after.").action(() => {
     const parentOpts = program3.opts();
     const credPath = getAutoUnlockCredPath(parentOpts.config);
-    if (!existsSync36(credPath)) {
+    if (!existsSync37(credPath)) {
       console.log(`No credential file at ${credPath} \u2014 nothing to do.`);
       return;
     }
@@ -64657,7 +64827,7 @@ function registerVaultBrokerCommand(vaultCmd, program3) {
 
 // src/cli/vault-doctor.ts
 init_source();
-import { existsSync as existsSync37 } from "node:fs";
+import { existsSync as existsSync38 } from "node:fs";
 
 // src/vault/doctor.ts
 var SENSITIVE_KEY_RE = /oauth(?![a-zA-Z])|token(?![a-zA-Z])|secret(?![a-zA-Z])|api[-_]?key(?![a-zA-Z])|password(?![a-zA-Z])/i;
@@ -64827,7 +64997,7 @@ function registerVaultDoctorCommand(vault, program3) {
     const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
     const passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
     let vaultKeys = undefined;
-    if (passphrase && existsSync37(vaultPath)) {
+    if (passphrase && existsSync38(vaultPath)) {
       try {
         const entries = openVault(passphrase, vaultPath);
         vaultKeys = {};
@@ -64913,7 +65083,7 @@ Vault Doctor`));
 
 // src/cli/vault-audit.ts
 init_source();
-import { existsSync as existsSync38, readFileSync as readFileSync34 } from "node:fs";
+import { existsSync as existsSync39, readFileSync as readFileSync34 } from "node:fs";
 
 // src/vault/audit-reader.ts
 function parseAuditLine(line) {
@@ -64987,7 +65157,7 @@ function formatAuditLines(rawLines, filters, limit = 50) {
 function registerVaultAuditCommand(vault, _program) {
   vault.command("audit").description("Tail and filter the vault audit log (~/.switchroom/vault-audit.log)").option("--who <caller>", "Filter by caller substring (unit name or pid)").option("--key <pattern>", "Filter by key name (regex or substring)").option("--denied", "Show only denied access attempts").option("--tail <n>", "Number of matching entries to show (default: 50)", "50").option("--path <file>", "Override audit log path (for debugging)").action((opts) => {
     const logPath = opts.path ?? defaultAuditLogPath();
-    if (!existsSync38(logPath)) {
+    if (!existsSync39(logPath)) {
       console.error(source_default.yellow(`Audit log not found at ${logPath}.`) + source_default.gray(`
 The log is created when the vault broker handles its first request.`));
       process.exit(0);
@@ -65042,8 +65212,8 @@ init_source();
 init_loader();
 init_loader();
 init_client();
-import { join as join32 } from "node:path";
-import { homedir as homedir17 } from "node:os";
+import { join as join33 } from "node:path";
+import { homedir as homedir18 } from "node:os";
 function parseDuration(raw) {
   const lower = raw.toLowerCase().trim();
   if (lower === "0" || lower === "never" || lower === "none")
@@ -65135,7 +65305,7 @@ function registerVaultGrantCommands(vault, program3) {
       console.error(source_default.red(`Failed to mint grant: ${result.msg}`));
       process.exit(1);
     }
-    const tokenPath = join32(homedir17(), ".switchroom", "agents", agent, ".vault-token");
+    const tokenPath = join33(homedir18(), ".switchroom", "agents", agent, ".vault-token");
     console.log(source_default.green(`\u2713 Grant minted`));
     if (process.stdout.isTTY) {
       console.log(source_default.bold("Token: ") + result.token);
@@ -65186,8 +65356,8 @@ The token file was written to the agent directory (mode 0600).`));
 // src/cli/vault-backup.ts
 init_source();
 init_loader();
-import { existsSync as existsSync40 } from "node:fs";
-import { join as join34 } from "node:path";
+import { existsSync as existsSync41 } from "node:fs";
+import { join as join35 } from "node:path";
 
 // src/vault/backup.ts
 import {
@@ -65197,20 +65367,20 @@ import {
 import {
   appendFileSync as appendFileSync2,
   closeSync as closeSync9,
-  existsSync as existsSync39,
+  existsSync as existsSync40,
   fsyncSync as fsyncSync5,
   mkdirSync as mkdirSync23,
   openSync as openSync9,
-  readdirSync as readdirSync17,
+  readdirSync as readdirSync18,
   readFileSync as readFileSync35,
   renameSync as renameSync11,
-  statSync as statSync20,
+  statSync as statSync21,
   symlinkSync as symlinkSync4,
   unlinkSync as unlinkSync10,
   writeSync as writeSync5
 } from "node:fs";
-import { homedir as homedir18 } from "node:os";
-import { join as join33, resolve as resolvePath2 } from "node:path";
+import { homedir as homedir19 } from "node:os";
+import { join as join34, resolve as resolvePath2 } from "node:path";
 var LATEST_SYMLINK = "vault.enc.latest.bak";
 var MANIFEST_FILE = "manifest.jsonl";
 var DEFAULT_RETAIN = 30;
@@ -65285,9 +65455,9 @@ function resolveBackupDestination(input) {
   if (input.configDestination)
     return resolvePath2(input.configDestination);
   if (input.hasSwitchroomConfigRepo) {
-    return join33(input.home, ".switchroom-config", "vault-backups");
+    return join34(input.home, ".switchroom-config", "vault-backups");
   }
-  return join33(input.home, ".switchroom", "vault-backups");
+  return join34(input.home, ".switchroom", "vault-backups");
 }
 function findAutoUnlockSibling(entries) {
   for (const name of entries) {
@@ -65305,11 +65475,11 @@ function selectBackupsToPrune(sortedNewestFirst, retain) {
   return sortedNewestFirst.slice(retain);
 }
 function listBackupFiles(dir) {
-  if (!existsSync39(dir))
+  if (!existsSync40(dir))
     return [];
   let entries;
   try {
-    entries = readdirSync17(dir);
+    entries = readdirSync18(dir);
   } catch {
     return [];
   }
@@ -65332,15 +65502,15 @@ function backupVault(opts) {
     throw new Error(`vault backup refused: source is not a valid vault envelope: ${validationError}`);
   }
   mkdirSync23(opts.destDir, { recursive: true, mode: 448 });
-  const dirEntries = readdirSync17(opts.destDir);
+  const dirEntries = readdirSync18(opts.destDir);
   const offender = findAutoUnlockSibling(dirEntries);
   if (offender) {
     throw new Error(`vault backup refused: destination '${opts.destDir}' contains a file ` + `that looks like an auto-unlock credential ('${offender}'). The ` + `machine-bound auto-unlock blob MUST NOT be co-located with the ` + `encrypted vault \u2014 if they're together in version control, the ` + `passphrase gate is bypassed. Move/remove that file and retry.`);
   }
   const filename = computeBackupFilename(now);
-  const fullPath = join33(opts.destDir, filename);
+  const fullPath = join34(opts.destDir, filename);
   const tmpName = `.tmp.${process.pid}.${randomBytes10(4).toString("hex")}`;
-  const tmpPath = join33(opts.destDir, tmpName);
+  const tmpPath = join34(opts.destDir, tmpName);
   const src = readFileSync35(opts.vaultPath);
   const fd = openSync9(tmpPath, "wx", 384);
   try {
@@ -65349,14 +65519,14 @@ function backupVault(opts) {
   } finally {
     closeSync9(fd);
   }
-  if (existsSync39(fullPath)) {
+  if (existsSync40(fullPath)) {
     try {
       unlinkSync10(tmpPath);
     } catch {}
     throw new Error(`vault backup refused: '${fullPath}' already exists ` + `(sub-second collision with another backup). Retry in 1 second, ` + `or check for a concurrent backup process.`);
   }
   renameSync11(tmpPath, fullPath);
-  const stat = statSync20(fullPath);
+  const stat = statSync21(fullPath);
   const sha256 = sha256OfFile(fullPath);
   const row = {
     ts: now.toISOString(),
@@ -65364,9 +65534,9 @@ function backupVault(opts) {
     size_bytes: stat.size,
     sha256
   };
-  appendFileSync2(join33(opts.destDir, MANIFEST_FILE), JSON.stringify(row) + `
+  appendFileSync2(join34(opts.destDir, MANIFEST_FILE), JSON.stringify(row) + `
 `, { mode: 384 });
-  const latestPath = join33(opts.destDir, LATEST_SYMLINK);
+  const latestPath = join34(opts.destDir, LATEST_SYMLINK);
   try {
     unlinkSync10(latestPath);
   } catch {}
@@ -65385,7 +65555,7 @@ function backupVault(opts) {
   const pruneNames = selectBackupsToPrune(sorted, retain);
   for (const old of pruneNames) {
     try {
-      unlinkSync10(join33(opts.destDir, old));
+      unlinkSync10(join34(opts.destDir, old));
     } catch {}
   }
   if (pruneNames.length > 0) {
@@ -65408,7 +65578,7 @@ function backupVault(opts) {
   };
 }
 function defaultHome() {
-  return process.env.HOME ?? homedir18();
+  return process.env.HOME ?? homedir19();
 }
 
 // src/cli/vault-backup.ts
@@ -65434,7 +65604,7 @@ function registerVaultBackupCommand(vault, program3) {
         }
       } catch {}
       const home2 = defaultHome();
-      const hasSwitchroomConfigRepo = existsSync40(join34(home2, ".switchroom-config"));
+      const hasSwitchroomConfigRepo = existsSync41(join35(home2, ".switchroom-config"));
       const destDir = resolveBackupDestination({
         cliToFlag: opts.to ? resolvePath(opts.to) : undefined,
         configDestination,
@@ -66060,8 +66230,8 @@ Push passphrase to broker for future requests? [Y/n]: `);
 
 // src/cli/telegram.ts
 init_source();
-import { existsSync as existsSync41, readFileSync as readFileSync37, writeFileSync as writeFileSync21 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync42, readFileSync as readFileSync37, writeFileSync as writeFileSync21 } from "node:fs";
+import { join as join36 } from "node:path";
 
 // src/web/webhook-dispatch.ts
 function renderTemplate2(template, ctx) {
@@ -66323,8 +66493,8 @@ async function runTopicsDiscover(program3, chatId, opts) {
     fail(`Unknown agent '${agentName}'. Check switchroom.yaml.`);
   }
   const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? resolveStatePath("agents");
-  const dbPath = join35(agentsDir, agentName, "telegram", "history.db");
-  if (!existsSync41(dbPath)) {
+  const dbPath = join36(agentsDir, agentName, "telegram", "history.db");
+  if (!existsSync42(dbPath)) {
     fail(`No history DB at ${dbPath}.
 ` + `  The agent may not have received any Telegram messages yet, or it may be offline.
 ` + `  Tip: send one message in each topic of the supergroup, then re-run this command.`);
@@ -66592,7 +66762,7 @@ async function vaultPut(program3, key, value) {
   const configPath = program3.optsWithGlobals().config ?? undefined;
   const vaultPath = resolveVaultPath(configPath);
   const passphrase = await getVaultPassphrase();
-  if (!existsSync41(vaultPath)) {
+  if (!existsSync42(vaultPath)) {
     createVault(passphrase, vaultPath);
     console.log(source_default.gray(`  Created new vault at ${vaultPath}`));
   }
@@ -66988,11 +67158,11 @@ async function ensureHindsightConsumer(configPath, account, uid = HINDSIGHT_DEFA
 // src/cli/memory.ts
 init_loader();
 var import_yaml12 = __toESM(require_dist(), 1);
-import { existsSync as existsSync42, readFileSync as readFileSync38, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join36 } from "node:path";
+import { existsSync as existsSync43, readFileSync as readFileSync38, writeFileSync as writeFileSync22 } from "node:fs";
+import { join as join37 } from "node:path";
 function readRecallLog(agentDir, limit) {
-  const path4 = join36(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
-  if (!existsSync42(path4))
+  const path4 = join37(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
+  if (!existsSync43(path4))
     return [];
   let raw;
   try {
@@ -67190,7 +67360,7 @@ Cross-agent reflection plan
     const url = `http://127.0.0.1:${ports.apiPort}/mcp/`;
     const configPath = getConfigPath(program3);
     try {
-      if (existsSync42(configPath)) {
+      if (existsSync43(configPath)) {
         const raw = readFileSync38(configPath, "utf-8");
         const doc = import_yaml12.default.parseDocument(raw);
         if (!doc.has("memory")) {
@@ -67232,7 +67402,7 @@ Cross-agent reflection plan
       process.exit(1);
     })() : Object.keys(config.agents);
     for (const name of targets) {
-      const agentDir = join36(agentsDir, name);
+      const agentDir = join37(agentsDir, name);
       const entries = readRecallLog(agentDir, limit);
       if (opts.json) {
         for (const e of entries) {
@@ -67300,16 +67470,16 @@ init_loader();
 init_lifecycle();
 import {
   readFileSync as readFileSync44,
-  existsSync as existsSync48,
-  realpathSync as realpathSync3,
+  existsSync as existsSync49,
+  realpathSync as realpathSync4,
   mkdirSync as mkdirSync28,
   openSync as openSync10,
   closeSync as closeSync10,
   writeSync as writeSync6,
   constants as fsConstants3
 } from "node:fs";
-import { resolve as resolve28, extname, join as join43, relative, dirname as dirname9 } from "node:path";
-import { homedir as homedir23 } from "node:os";
+import { resolve as resolve28, extname, join as join44, relative, dirname as dirname10 } from "node:path";
+import { homedir as homedir24 } from "node:os";
 import { spawn as spawn5 } from "node:child_process";
 import { timingSafeEqual as timingSafeEqual3, randomBytes as randomBytes11 } from "node:crypto";
 
@@ -67318,7 +67488,7 @@ init_lifecycle();
 init_manager();
 init_hindsight();
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync45, readFileSync as readFileSync41, statSync as statSync21 } from "node:fs";
+import { existsSync as existsSync46, readFileSync as readFileSync41, statSync as statSync22 } from "node:fs";
 import { resolve as resolve27 } from "node:path";
 init_audit_reader();
 
@@ -67382,7 +67552,7 @@ function readRecentFires(jsonlPath) {
 init_client3();
 
 // node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/modifiers/module.node.mjs
-import { dirname as dirname7, posix, sep as sep2 } from "path";
+import { dirname as dirname8, posix, sep as sep2 } from "path";
 function createModulerModifier() {
   const getModuleFromFileName = createGetModuleFromFilename();
   return async (frames) => {
@@ -67391,7 +67561,7 @@ function createModulerModifier() {
     return frames;
   };
 }
-function createGetModuleFromFilename(basePath = process.argv[1] ? dirname7(process.argv[1]) : process.cwd(), isWindows = sep2 === "\\") {
+function createGetModuleFromFilename(basePath = process.argv[1] ? dirname8(process.argv[1]) : process.cwd(), isWindows = sep2 === "\\") {
   const normalizedBase = isWindows ? normalizeWindowsPath(basePath) : basePath;
   return (filename) => {
     if (!filename)
@@ -71824,12 +71994,12 @@ class PostHog extends PostHogBackendClient {
 // src/analytics/posthog.ts
 init_paths();
 import {
-  existsSync as existsSync43,
+  existsSync as existsSync44,
   mkdirSync as mkdirSync24,
   readFileSync as readFileSync39,
   writeFileSync as writeFileSync23
 } from "node:fs";
-import { dirname as dirname8 } from "node:path";
+import { dirname as dirname9 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 var DEFAULT_KEY = "phc_qKY87cKWZm6ZyCtk7LcRd2cU8Sg42u7Ywhui5stYCegd";
 var DEFAULT_HOST = "https://us.i.posthog.com";
@@ -71846,7 +72016,7 @@ function getDistinctId() {
     return cachedDistinctId;
   const path4 = resolveStatePath("analytics-id");
   try {
-    if (existsSync43(path4)) {
+    if (existsSync44(path4)) {
       const existing = readFileSync39(path4, "utf-8").trim();
       if (existing) {
         cachedDistinctId = existing;
@@ -71857,7 +72027,7 @@ function getDistinctId() {
   const id = randomUUID3();
   cachedDistinctId = id;
   try {
-    mkdirSync24(dirname8(path4), { recursive: true });
+    mkdirSync24(dirname9(path4), { recursive: true });
     writeFileSync23(path4, id, "utf-8");
   } catch {}
   return id;
@@ -72028,19 +72198,19 @@ import {
 } from "node:fs";
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 
 class ConfigDiffError extends Error {
 }
 function generateUnifiedDiff(before, after, name = "switchroom.yaml", gitBin = "git") {
   if (before === after)
     return "";
-  const dir = mkdtemp(join38(tmpdir4(), "switchroom-config-diff-"));
+  const dir = mkdtemp(join39(tmpdir4(), "switchroom-config-diff-"));
   try {
-    mkdirSync25(join38(dir, "cur"), { recursive: true });
-    mkdirSync25(join38(dir, "new"), { recursive: true });
-    writeFileSync24(join38(dir, "cur", name), before);
-    writeFileSync24(join38(dir, "new", name), after);
+    mkdirSync25(join39(dir, "cur"), { recursive: true });
+    mkdirSync25(join39(dir, "new"), { recursive: true });
+    writeFileSync24(join39(dir, "cur", name), before);
+    writeFileSync24(join39(dir, "new", name), after);
     const r = spawnSync4(gitBin, ["diff", "--no-index", "--no-color", "--", `cur/${name}`, `new/${name}`], { cwd: dir, encoding: "utf-8", timeout: 1e4 });
     if (r.status === 0)
       return "";
@@ -72072,9 +72242,9 @@ function generateUnifiedDiff(before, after, name = "switchroom.yaml", gitBin = "
 
 // src/web/hostd-config-propose.ts
 init_client4();
-import { existsSync as existsSync44 } from "node:fs";
-import { homedir as homedir20 } from "node:os";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync45 } from "node:fs";
+import { homedir as homedir21 } from "node:os";
+import { join as join40 } from "node:path";
 var PROPOSE_TIMEOUT_MS = 11 * 60 * 1000;
 function resolveHostdOperatorSocket(env2 = process.env) {
   const override = env2.SWITCHROOM_HOSTD_OPERATOR_SOCKET;
@@ -72082,10 +72252,10 @@ function resolveHostdOperatorSocket(env2 = process.env) {
     return override;
   const candidates = [
     "/host-home/.switchroom/hostd/operator/sock",
-    join39(homedir20(), ".switchroom", "hostd", "operator", "sock")
+    join40(homedir21(), ".switchroom", "hostd", "operator", "sock")
   ];
   for (const c of candidates) {
-    if (existsSync44(c))
+    if (existsSync45(c))
       return c;
   }
   return null;
@@ -72178,7 +72348,7 @@ init_client2();
 
 // telegram-plugin/registry/turns-schema.ts
 import { chmodSync as chmodSync8, mkdirSync as mkdirSync26 } from "fs";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 var DatabaseClass = null;
 function loadDatabaseClass() {
   if (DatabaseClass != null)
@@ -72241,9 +72411,9 @@ function applySchema(db) {
 }
 function openTurnsDb(agentDir) {
   const Database2 = loadDatabaseClass();
-  const dir = join40(agentDir, "telegram");
+  const dir = join41(agentDir, "telegram");
   mkdirSync26(dir, { recursive: true, mode: 448 });
-  const path4 = join40(dir, "registry.db");
+  const path4 = join41(dir, "registry.db");
   const db = new Database2(path4, { create: true });
   applySchema(db);
   try {
@@ -72350,7 +72520,7 @@ function listSubagents(db, opts = {}) {
 function agentBridgeAlive(agentsDir, name, maxAgeMs = 30000, now = Date.now()) {
   try {
     const f = resolve27(agentsDir, name, "telegram", ".bridge-alive");
-    return now - statSync21(f).mtimeMs <= maxAgeMs;
+    return now - statSync22(f).mtimeMs <= maxAgeMs;
   } catch {
     return false;
   }
@@ -72675,7 +72845,7 @@ async function handleGetSystemHealth(config, home2) {
   };
   try {
     const logPath = defaultAuditLogPath2(home2);
-    if (existsSync45(logPath)) {
+    if (existsSync46(logPath)) {
       hostd.auditLogPresent = true;
       const raw = readFileSync41(logPath, "utf-8");
       hostd.recent = readAndFilter(raw, {}, 10);
@@ -72977,9 +73147,9 @@ async function handleGetApprovals() {
 }
 
 // src/web/webhook-handler.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync47, mkdirSync as mkdirSync27, readFileSync as readFileSync43, writeFileSync as writeFileSync25 } from "fs";
-import { join as join42 } from "path";
-import { homedir as homedir22 } from "os";
+import { appendFileSync as appendFileSync3, existsSync as existsSync48, mkdirSync as mkdirSync27, readFileSync as readFileSync43, writeFileSync as writeFileSync25 } from "fs";
+import { join as join43 } from "path";
+import { homedir as homedir23 } from "os";
 
 // src/web/webhook-verify.ts
 import { createHmac as createHmac2, timingSafeEqual } from "crypto";
@@ -73129,18 +73299,18 @@ function forwardToGateway(socketPath, req, opts = {}) {
 }
 
 // src/web/webhook-edge.ts
-import { existsSync as existsSync46, readFileSync as readFileSync42 } from "fs";
-import { join as join41 } from "path";
-import { homedir as homedir21 } from "os";
+import { existsSync as existsSync47, readFileSync as readFileSync42 } from "fs";
+import { join as join42 } from "path";
+import { homedir as homedir22 } from "os";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var EDGE_HEADER = "x-switchroom-edge";
 function edgeSecretPath() {
-  return join41(homedir21(), ".switchroom", "webhook-edge-secret");
+  return join42(homedir22(), ".switchroom", "webhook-edge-secret");
 }
 function loadEdgeSecret(path4) {
   const p = path4 ?? edgeSecretPath();
   try {
-    if (!existsSync46(p))
+    if (!existsSync47(p))
       return null;
     const raw = readFileSync42(p, "utf-8").trim();
     return raw.length > 0 ? raw : null;
@@ -73174,7 +73344,7 @@ var DEDUP_MAX = 1000;
 var DEDUP_TTL_MS = 24 * 60 * 60 * 1000;
 function loadDedupFile(path4) {
   try {
-    if (!existsSync47(path4))
+    if (!existsSync48(path4))
       return {};
     const raw = JSON.parse(readFileSync43(path4, "utf-8"));
     return typeof raw.deliveries === "object" && raw.deliveries !== null ? raw.deliveries : {};
@@ -73198,8 +73368,8 @@ var agentDedupCache = new Map;
 function createFileDedupStore(resolveAgentDir) {
   return {
     check(agent, deliveryId, now) {
-      const telegramDir = join42(resolveAgentDir(agent), "telegram");
-      const filePath = join42(telegramDir, "webhook-dedup.json");
+      const telegramDir = join43(resolveAgentDir(agent), "telegram");
+      const filePath = join43(telegramDir, "webhook-dedup.json");
       if (!agentDedupCache.has(agent)) {
         agentDedupCache.set(agent, loadDedupFile(filePath));
       }
@@ -73251,7 +73421,7 @@ function shouldWriteThrottleIssue(agent, source, now, windowMap) {
   return true;
 }
 function writeThrottleIssue(agent, source, now, telegramDir, log) {
-  const issuesPath = join42(telegramDir, "issues.jsonl");
+  const issuesPath = join43(telegramDir, "issues.jsonl");
   try {
     mkdirSync27(telegramDir, { recursive: true });
     const record = {
@@ -73276,7 +73446,7 @@ function writeThrottleIssue(agent, source, now, telegramDir, log) {
 async function handleWebhookIngest(args, deps = {}) {
   const log = deps.log ?? ((s) => process.stderr.write(s));
   const now = (deps.now ?? Date.now)();
-  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join42(homedir22(), ".switchroom", "agents", a));
+  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join43(homedir23(), ".switchroom", "agents", a));
   const rateLimiter = deps.rateLimiter ?? defaultRateLimiter;
   const dedupStore = deps.dedupStore ?? createFileDedupStore(resolveAgentDir);
   if (!args.agentExists) {
@@ -73340,7 +73510,7 @@ async function handleWebhookIngest(args, deps = {}) {
   if (retryAfter !== null) {
     if (!args.viaGateway) {
       const agentDir2 = resolveAgentDir(args.agent);
-      const telegramDir2 = join42(agentDir2, "telegram");
+      const telegramDir2 = join43(agentDir2, "telegram");
       if (shouldWriteThrottleIssue(args.agent, source, now)) {
         writeThrottleIssue(args.agent, source, now, telegramDir2, log);
       }
@@ -73360,7 +73530,7 @@ async function handleWebhookIngest(args, deps = {}) {
   const eventType = source === "github" ? args.headers.get("x-github-event") ?? "unknown" : args.source;
   const rendered = source === "github" ? renderGithubEvent(eventType, payload) : renderGenericEvent(args.source, payload);
   if (args.viaGateway) {
-    const socketPath = join42(resolveAgentDir(args.agent), "telegram", "webhook.sock");
+    const socketPath = join43(resolveAgentDir(args.agent), "telegram", "webhook.sock");
     const forward = deps.forwardFn ?? forwardToGateway;
     const deliveryId = source === "github" ? args.headers.get("x-github-delivery") ?? undefined : undefined;
     let resp;
@@ -73399,8 +73569,8 @@ async function handleWebhookIngest(args, deps = {}) {
     return jsonReply(202, { ok: true, recorded: true, ts: resp.ts });
   }
   const agentDir = resolveAgentDir(args.agent);
-  const telegramDir = join42(agentDir, "telegram");
-  const logPath = join42(telegramDir, "webhook-events.jsonl");
+  const telegramDir = join43(agentDir, "telegram");
+  const logPath = join43(telegramDir, "webhook-events.jsonl");
   try {
     mkdirSync27(telegramDir, { recursive: true });
     const record = {
@@ -73453,15 +73623,15 @@ function resolveWebToken() {
   const fromEnv = process.env.SWITCHROOM_WEB_TOKEN;
   if (fromEnv && fromEnv.length > 0)
     return fromEnv;
-  const home2 = process.env.HOME ?? homedir23();
-  const tokenPath = join43(home2, ".switchroom", "web-token");
-  if (existsSync48(tokenPath)) {
+  const home2 = process.env.HOME ?? homedir24();
+  const tokenPath = join44(home2, ".switchroom", "web-token");
+  if (existsSync49(tokenPath)) {
     const existing = readFileSync44(tokenPath, "utf8").trim();
     if (existing.length > 0)
       return existing;
   }
   const token = randomBytes11(32).toString("hex");
-  mkdirSync28(dirname9(tokenPath), { recursive: true, mode: 448 });
+  mkdirSync28(dirname10(tokenPath), { recursive: true, mode: 448 });
   try {
     const fd = openSync10(tokenPath, fsConstants3.O_WRONLY | fsConstants3.O_CREAT | fsConstants3.O_EXCL, 384);
     try {
@@ -73539,8 +73709,8 @@ function checkWsAuth(req, token, server) {
   return presented !== null && constantTimeEqual(presented, token);
 }
 function loadWebhookSecrets() {
-  const path4 = join43(homedir23(), ".switchroom", "webhook-secrets.json");
-  if (!existsSync48(path4))
+  const path4 = join44(homedir24(), ".switchroom", "webhook-secrets.json");
+  if (!existsSync49(path4))
     return {};
   try {
     const parsed = JSON.parse(readFileSync44(path4, "utf-8"));
@@ -73673,7 +73843,7 @@ function parseRoute(pathname, method) {
 }
 function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
   const uiDirRaw = resolve28(import.meta.dirname, "ui");
-  const uiDir = existsSync48(uiDirRaw) ? realpathSync3(uiDirRaw) : uiDirRaw;
+  const uiDir = existsSync49(uiDirRaw) ? realpathSync4(uiDirRaw) : uiDirRaw;
   const token = resolveWebToken();
   const freshConfig = () => {
     if (!configPath)
@@ -73870,13 +74040,13 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         }
       }
       let filePath = pathname === "/" ? "/index.html" : pathname;
-      const fullPath = join43(uiDir, filePath);
-      if (!existsSync48(fullPath)) {
+      const fullPath = join44(uiDir, filePath);
+      if (!existsSync49(fullPath)) {
         return new Response("Not Found", { status: 404 });
       }
       let realFullPath;
       try {
-        realFullPath = realpathSync3(fullPath);
+        realFullPath = realpathSync4(fullPath);
       } catch {
         return new Response("Not Found", { status: 404 });
       }
@@ -74020,8 +74190,8 @@ Starting Switchroom dashboard...
 // src/cli/setup.ts
 init_source();
 init_loader();
-import { existsSync as existsSync49, copyFileSync as copyFileSync8, readFileSync as readFileSync45, writeFileSync as writeFileSync26, mkdirSync as mkdirSync29 } from "node:fs";
-import { resolve as resolve29, dirname as dirname10 } from "node:path";
+import { existsSync as existsSync50, copyFileSync as copyFileSync8, readFileSync as readFileSync45, writeFileSync as writeFileSync26, mkdirSync as mkdirSync29 } from "node:fs";
+import { resolve as resolve29, dirname as dirname11 } from "node:path";
 init_vault();
 init_manager();
 
@@ -74202,7 +74372,7 @@ async function stepConfigFile(configPath, nonInteractive) {
       existingConfig = null;
     }
   }
-  if (existingConfig && existsSync49(existingConfig)) {
+  if (existingConfig && existsSync50(existingConfig)) {
     if (!nonInteractive) {
       const useExisting = await askYesNo(`  Found ${source_default.cyan(existingConfig)}. Use it?`, true);
       if (!useExisting) {
@@ -74230,10 +74400,10 @@ async function copyExampleConfig(nonInteractive) {
   }
   const srcFile = resolve29(examplesDir, `${choice}.yaml`);
   const destFile = resolvePath("~/.switchroom/switchroom.yaml");
-  if (!existsSync49(srcFile)) {
+  if (!existsSync50(srcFile)) {
     throw new ConfigError(`Example config not found: ${choice}.yaml`);
   }
-  mkdirSync29(dirname10(destFile), { recursive: true });
+  mkdirSync29(dirname11(destFile), { recursive: true });
   copyFileSync8(srcFile, destFile);
   console.log(source_default.green(`  Copied ${choice}.yaml -> ${destFile}`));
   console.log(source_default.yellow(`  Edit ${destFile} to customize, then re-run switchroom setup.`));
@@ -74314,7 +74484,7 @@ async function resolveOrPromptToken(rawToken, label, config, nonInteractive) {
       try {
         const { openVault: openVault2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
         const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-        if (existsSync49(vaultPath)) {
+        if (existsSync50(vaultPath)) {
           const secrets = openVault2(passphrase, vaultPath);
           const key = rawToken.replace("vault:", "");
           const entry = secrets[key];
@@ -74342,7 +74512,7 @@ async function resolveOrPromptToken(rawToken, label, config, nonInteractive) {
 async function storeTokenInVault(config, vaultRef, token) {
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
   const key = vaultRef.replace("vault:", "");
-  if (!existsSync49(vaultPath)) {
+  if (!existsSync50(vaultPath)) {
     console.log(source_default.gray("  Creating encrypted vault..."));
     let passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
     if (!passphrase) {
@@ -74515,7 +74685,7 @@ async function stepMemoryBackend(config, nonInteractive, switchroomConfigPath) {
   try {
     const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
     const passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
-    if (passphrase && existsSync49(vaultPath)) {
+    if (passphrase && existsSync50(vaultPath)) {
       const existing = getStringSecret(passphrase, vaultPath, "hindsight-api-key");
       if (existing) {
         console.log(source_default.gray("  Note: legacy 'hindsight-api-key' is in your vault but is no longer used. You can remove it with `switchroom vault rm hindsight-api-key`."));
@@ -74675,13 +74845,13 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
     return;
   }
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (!existsSync49(vaultPath)) {
+  if (!existsSync50(vaultPath)) {
     console.log(source_default.gray("  Skipping (vault not created yet)."));
     return;
   }
   const credPathRaw = config.vault?.broker?.autoUnlockCredentialPath ?? "~/.switchroom/vault-auto-unlock";
   const credPath = resolvePath(credPathRaw);
-  if (config.vault?.broker?.autoUnlock === true && existsSync49(credPath)) {
+  if (config.vault?.broker?.autoUnlock === true && existsSync50(credPath)) {
     console.log(source_default.green(`  ${STEP_DONE} Already configured (${credPath})`));
     return;
   }
@@ -74747,8 +74917,8 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
   const choice = await askChoice("  Approval posture", [PASSPHRASE_CHOICE, TELEGRAM_ID_CHOICE]);
   if (choice === TELEGRAM_ID_CHOICE) {
     try {
-      const yamlPath = existsSync49(resolve29(process.cwd(), "switchroom.yaml")) ? resolve29(process.cwd(), "switchroom.yaml") : resolve29(process.cwd(), "switchroom.yml");
-      if (existsSync49(yamlPath)) {
+      const yamlPath = existsSync50(resolve29(process.cwd(), "switchroom.yaml")) ? resolve29(process.cwd(), "switchroom.yaml") : resolve29(process.cwd(), "switchroom.yml");
+      if (existsSync50(yamlPath)) {
         const content = readFileSync45(yamlPath, "utf-8");
         const result = insertVaultBrokerApprovalAuth(content, "telegram-id");
         if (result.kind === "rewritten") {
@@ -74783,7 +74953,7 @@ async function stepDangerousMode(config, nonInteractive) {
       resolve29(process.cwd(), "switchroom.yml")
     ];
     for (const configPath of configPaths) {
-      if (existsSync49(configPath)) {
+      if (existsSync50(configPath)) {
         let content = readFileSync45(configPath, "utf-8");
         const agentNames = Object.keys(config.agents);
         for (const name of agentNames) {
@@ -74913,22 +75083,22 @@ init_doctor();
 init_source();
 init_loader();
 init_lifecycle();
-import { cpSync as cpSync2, existsSync as existsSync56, mkdirSync as mkdirSync31, readFileSync as readFileSync50, realpathSync as realpathSync5, rmSync as rmSync12, statSync as statSync25 } from "node:fs";
+import { cpSync as cpSync2, existsSync as existsSync57, mkdirSync as mkdirSync31, readFileSync as readFileSync50, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync26 } from "node:fs";
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { join as join57, dirname as dirname13, resolve as resolve33 } from "node:path";
-import { homedir as homedir34 } from "node:os";
-var DEFAULT_COMPOSE_PATH = join57(homedir34(), ".switchroom", "compose", "docker-compose.yml");
+import { join as join58, dirname as dirname14, resolve as resolve33 } from "node:path";
+import { homedir as homedir35 } from "node:os";
+var DEFAULT_COMPOSE_PATH = join58(homedir35(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
-  let dir = dirname13(scriptPath);
+  let dir = dirname14(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync56(join57(dir, ".git"))) {
+    if (existsSync57(join58(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync50(join57(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync50(join58(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
     }
-    const parent = dirname13(dir);
+    const parent = dirname14(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -74975,7 +75145,7 @@ function planUpdate(opts) {
   steps.push({
     name: "pull-images",
     description: "Pull broker / kernel / agent images from GHCR",
-    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync56(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
+    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync57(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
     run: () => {
       const r = runner("docker", [
         "compose",
@@ -75074,17 +75244,17 @@ function planUpdate(opts) {
         return;
       }
       const source = resolve33(import.meta.dirname, "../../skills");
-      const dest = join57(homedir34(), ".switchroom", "skills", "_bundled");
-      if (!existsSync56(source)) {
+      const dest = join58(homedir35(), ".switchroom", "skills", "_bundled");
+      if (!existsSync57(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
         return;
       }
       try {
-        if (existsSync56(dest)) {
+        if (existsSync57(dest)) {
           rmSync12(dest, { recursive: true, force: true });
         }
-        mkdirSync31(dirname13(dest), { recursive: true });
+        mkdirSync31(dirname14(dest), { recursive: true });
         cpSync2(source, dest, { recursive: true, dereference: false });
       } catch (err) {
         throw new Error(`sync-bundled-skills failed: ${err.message}`);
@@ -75180,16 +75350,16 @@ function defaultStatusProbe(composePath) {
     let scriptPath = rawScriptPath;
     try {
       if (rawScriptPath)
-        scriptPath = realpathSync5(rawScriptPath);
+        scriptPath = realpathSync6(rawScriptPath);
     } catch {}
     if (scriptPath) {
       try {
-        cliBuiltAt = new Date(statSync25(scriptPath).mtimeMs).toISOString();
+        cliBuiltAt = new Date(statSync26(scriptPath).mtimeMs).toISOString();
       } catch {}
-      let dir = dirname13(scriptPath);
+      let dir = dirname14(scriptPath);
       for (let i = 0;i < 8; i++) {
-        const pkgPath = join57(dir, "package.json");
-        if (existsSync56(pkgPath)) {
+        const pkgPath = join58(dir, "package.json");
+        if (existsSync57(pkgPath)) {
           try {
             const pkg = JSON.parse(readFileSync50(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
@@ -75199,7 +75369,7 @@ function defaultStatusProbe(composePath) {
           }
           break;
         }
-        const parent = dirname13(dir);
+        const parent = dirname14(dir);
         if (parent === dir)
           break;
         dir = parent;
@@ -75212,7 +75382,7 @@ function defaultStatusProbe(composePath) {
     warnings.push("could not resolve CLI version (no package.json found above the resolved script path)");
   }
   const services = [];
-  if (!existsSync56(composePath)) {
+  if (!existsSync57(composePath)) {
     warnings.push(`compose file not found at ${composePath}; service status unknown`);
     return { cliVersion, cliBuiltAt, services, warnings };
   }
@@ -75407,8 +75577,8 @@ init_source();
 init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
-import { existsSync as existsSync57, readFileSync as readFileSync51 } from "node:fs";
-import { dirname as dirname14, join as join58 } from "node:path";
+import { existsSync as existsSync58, readFileSync as readFileSync51 } from "node:fs";
+import { dirname as dirname15, join as join59 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync4("claude --version 2>/dev/null", {
@@ -75458,16 +75628,16 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const pkgPath = join58(dir, "package.json");
-    if (existsSync57(pkgPath)) {
+    const pkgPath = join59(dir, "package.json");
+    if (existsSync58(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync51(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync57(join58(dir, ".git"))) {
+        if (pkg.name === "switchroom" && existsSync58(join59(dir, ".git"))) {
           return dir;
         }
       } catch {}
     }
-    dir = dirname14(dir);
+    dir = dirname15(dir);
   }
   return null;
 }
@@ -75688,18 +75858,18 @@ function registerHandoffCommand(program3) {
 // src/issues/store.ts
 import {
   closeSync as closeSync11,
-  existsSync as existsSync58,
+  existsSync as existsSync59,
   mkdirSync as mkdirSync32,
   openSync as openSync11,
-  readdirSync as readdirSync21,
+  readdirSync as readdirSync22,
   readFileSync as readFileSync52,
   renameSync as renameSync12,
-  statSync as statSync26,
+  statSync as statSync27,
   unlinkSync as unlinkSync11,
   writeFileSync as writeFileSync27,
   writeSync as writeSync7
 } from "node:fs";
-import { join as join59 } from "node:path";
+import { join as join60 } from "node:path";
 import { randomBytes as randomBytes12 } from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
 
@@ -76097,8 +76267,8 @@ function redactedMarker(ruleId) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path4 = join59(stateDir, ISSUES_FILE);
-  if (!existsSync58(path4))
+  const path4 = join60(stateDir, ISSUES_FILE);
+  if (!existsSync59(path4))
     return [];
   let raw;
   try {
@@ -76175,7 +76345,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve36(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync58(join59(stateDir, ISSUES_FILE)))
+  if (!existsSync59(join60(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -76193,7 +76363,7 @@ function resolve36(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync58(join59(stateDir, ISSUES_FILE)))
+  if (!existsSync59(join60(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -76211,7 +76381,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync58(join59(stateDir, ISSUES_FILE)))
+  if (!existsSync59(join60(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -76244,7 +76414,7 @@ function ensureDir(stateDir) {
   mkdirSync32(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path4 = join59(stateDir, ISSUES_FILE);
+  const path4 = join60(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path4}.tmp-${process.pid}-${randomBytes12(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -76258,7 +76428,7 @@ var TMP_PREFIX = `${ISSUES_FILE}.tmp-`;
 function sweepOrphanTmpFiles(stateDir) {
   let entries;
   try {
-    entries = readdirSync21(stateDir);
+    entries = readdirSync22(stateDir);
   } catch {
     return;
   }
@@ -76266,9 +76436,9 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join59(stateDir, entry);
+    const tmpPath = join60(stateDir, entry);
     try {
-      const stat = statSync26(tmpPath);
+      const stat = statSync27(tmpPath);
       if (stat.mtimeMs < cutoff) {
         unlinkSync11(tmpPath);
       }
@@ -76278,7 +76448,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join59(stateDir, ISSUES_LOCK);
+  const lockPath = join60(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -76561,21 +76731,21 @@ function relTime(deltaMs) {
 
 // src/cli/deps.ts
 init_source();
-import { existsSync as existsSync61 } from "node:fs";
-import { homedir as homedir37 } from "node:os";
-import { join as join62, resolve as resolve37 } from "node:path";
+import { existsSync as existsSync62 } from "node:fs";
+import { homedir as homedir38 } from "node:os";
+import { join as join63, resolve as resolve37 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash11 } from "node:crypto";
 import {
-  existsSync as existsSync59,
+  existsSync as existsSync60,
   mkdirSync as mkdirSync33,
   readFileSync as readFileSync53,
   rmSync as rmSync13,
   writeFileSync as writeFileSync28
 } from "node:fs";
-import { dirname as dirname15, join as join60 } from "node:path";
-import { homedir as homedir35 } from "node:os";
+import { dirname as dirname16, join as join61 } from "node:path";
+import { homedir as homedir36 } from "node:os";
 import { execFileSync as execFileSync19 } from "node:child_process";
 
 class PythonEnvError extends Error {
@@ -76587,7 +76757,7 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join60(homedir35(), ".switchroom", "deps", "python");
+  return join61(homedir36(), ".switchroom", "deps", "python");
 }
 function hashFile(path4) {
   return createHash11("sha256").update(readFileSync53(path4)).digest("hex");
@@ -76596,16 +76766,16 @@ function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultPythonCacheRoot();
   const hostPython = opts.pythonBin ?? "python3";
-  if (!existsSync59(requirementsPath)) {
+  if (!existsSync60(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join60(cacheRoot, skillName);
-  const stampPath = join60(venvDir, ".requirements.sha256");
-  const binDir = join60(venvDir, "bin");
-  const pythonBin = join60(binDir, "python");
-  const pipBin = join60(binDir, "pip");
+  const venvDir = join61(cacheRoot, skillName);
+  const stampPath = join61(venvDir, ".requirements.sha256");
+  const binDir = join61(venvDir, "bin");
+  const pythonBin = join61(binDir, "python");
+  const pipBin = join61(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
-  if (!force && existsSync59(stampPath) && existsSync59(pythonBin)) {
+  if (!force && existsSync60(stampPath) && existsSync60(pythonBin)) {
     const existingHash = readFileSync53(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
@@ -76618,10 +76788,10 @@ function ensurePythonEnv(opts) {
       };
     }
   }
-  if (existsSync59(venvDir)) {
+  if (existsSync60(venvDir)) {
     rmSync13(venvDir, { recursive: true, force: true });
   }
-  mkdirSync33(dirname15(venvDir), { recursive: true });
+  mkdirSync33(dirname16(venvDir), { recursive: true });
   try {
     execFileSync19(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
   } catch (err) {
@@ -76656,14 +76826,14 @@ function ensurePythonEnv(opts) {
 import { createHash as createHash12 } from "node:crypto";
 import {
   copyFileSync as copyFileSync9,
-  existsSync as existsSync60,
+  existsSync as existsSync61,
   mkdirSync as mkdirSync34,
   readFileSync as readFileSync54,
   rmSync as rmSync14,
   writeFileSync as writeFileSync29
 } from "node:fs";
-import { dirname as dirname16, join as join61 } from "node:path";
-import { homedir as homedir36 } from "node:os";
+import { dirname as dirname17, join as join62 } from "node:path";
+import { homedir as homedir37 } from "node:os";
 import { execFileSync as execFileSync20 } from "node:child_process";
 
 class NodeEnvError extends Error {
@@ -76686,17 +76856,17 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join61(homedir36(), ".switchroom", "deps", "node");
+  return join62(homedir37(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
-  const sourceDir = dirname16(packageJsonPath);
+  const sourceDir = dirname17(packageJsonPath);
   const hasher = createHash12("sha256");
   hasher.update(`package.json
 `);
   hasher.update(readFileSync54(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join61(sourceDir, lockName);
-    if (existsSync60(lockPath)) {
+    const lockPath = join62(sourceDir, lockName);
+    if (existsSync61(lockPath)) {
       hasher.update(`
 `);
       hasher.update(lockName);
@@ -76711,16 +76881,16 @@ function ensureNodeEnv(opts) {
   const { skillName, packageJsonPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultNodeCacheRoot();
   const installer = opts.installer ?? "bun";
-  if (!existsSync60(packageJsonPath)) {
+  if (!existsSync61(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
-  const sourceDir = dirname16(packageJsonPath);
-  const envDir = join61(cacheRoot, skillName);
-  const stampPath = join61(envDir, ".package.sha256");
-  const nodeModulesDir = join61(envDir, "node_modules");
-  const binDir = join61(nodeModulesDir, ".bin");
+  const sourceDir = dirname17(packageJsonPath);
+  const envDir = join62(cacheRoot, skillName);
+  const stampPath = join62(envDir, ".package.sha256");
+  const nodeModulesDir = join62(envDir, "node_modules");
+  const binDir = join62(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
-  if (!force && existsSync60(stampPath) && existsSync60(nodeModulesDir)) {
+  if (!force && existsSync61(stampPath) && existsSync61(nodeModulesDir)) {
     const existingHash = readFileSync54(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
@@ -76732,16 +76902,16 @@ function ensureNodeEnv(opts) {
       };
     }
   }
-  if (existsSync60(envDir)) {
+  if (existsSync61(envDir)) {
     rmSync14(envDir, { recursive: true, force: true });
   }
   mkdirSync34(envDir, { recursive: true });
-  copyFileSync9(packageJsonPath, join61(envDir, "package.json"));
+  copyFileSync9(packageJsonPath, join62(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join61(sourceDir, lockName);
-    if (existsSync60(lockPath)) {
-      copyFileSync9(lockPath, join61(envDir, lockName));
+    const lockPath = join62(sourceDir, lockName);
+    if (existsSync61(lockPath)) {
+      copyFileSync9(lockPath, join62(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -76770,28 +76940,28 @@ function ensureNodeEnv(opts) {
 
 // src/cli/deps.ts
 function builtinSkillsRoot() {
-  return resolve37(homedir37(), ".switchroom/skills/_bundled");
+  return resolve37(homedir38(), ".switchroom/skills/_bundled");
 }
 function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
   deps.command("rebuild <skill>").description("Rebuild the Python venv and/or Node node_modules cache for a skill").option("-p, --python", "Rebuild only the Python env").option("-n, --node", "Rebuild only the Node env").action(async (skill, opts) => {
     const skillsRoot = builtinSkillsRoot();
-    if (!existsSync61(skillsRoot)) {
+    if (!existsSync62(skillsRoot)) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join62(skillsRoot, skill);
-    if (!existsSync61(skillDir)) {
+    const skillDir = join63(skillsRoot, skill);
+    if (!existsSync62(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join62(skillDir, "requirements.txt");
-    const packageJsonPath = join62(skillDir, "package.json");
-    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync61(requirementsPath));
-    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync61(packageJsonPath));
+    const requirementsPath = join63(skillDir, "requirements.txt");
+    const packageJsonPath = join63(skillDir, "package.json");
+    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync62(requirementsPath));
+    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync62(packageJsonPath));
     let did = 0;
     if (wantPython) {
-      if (!existsSync61(requirementsPath)) {
+      if (!existsSync62(requirementsPath)) {
         console.error(source_default.red(`Skill "${skill}" has no requirements.txt at ${requirementsPath}`));
         process.exit(1);
       }
@@ -76815,7 +76985,7 @@ function registerDepsCommand(program3) {
       }
     }
     if (wantNode) {
-      if (!existsSync61(packageJsonPath)) {
+      if (!existsSync62(packageJsonPath)) {
         console.error(source_default.red(`Skill "${skill}" has no package.json at ${packageJsonPath}`));
         process.exit(1);
       }
@@ -76848,12 +77018,12 @@ function registerDepsCommand(program3) {
 // src/cli/workspace.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync62 } from "node:fs";
+import { existsSync as existsSync63 } from "node:fs";
 import { resolve as resolve38, sep as sep3 } from "node:path";
 import { spawnSync as spawnSync10 } from "node:child_process";
 
 // src/agents/workspace.ts
-import { readFile, stat } from "node:fs/promises";
+import { readFile as readFile2, stat } from "node:fs/promises";
 import path5 from "node:path";
 
 // src/agents/bootstrap-budget.ts
@@ -77091,7 +77261,7 @@ function resolveAgentWorkspaceDir(agentDir) {
 }
 async function readOptionalFile(filePath) {
   try {
-    const content = await readFile(filePath, "utf8");
+    const content = await readFile2(filePath, "utf8");
     return content;
   } catch (err) {
     if (isErrnoException(err) && (err.code === "ENOENT" || err.code === "EISDIR")) {
@@ -77281,7 +77451,7 @@ async function buildDynamicBootstrapPrompt(params) {
 }
 
 // src/agents/memory-search.ts
-import { readFile as readFile2, readdir, realpath, stat as stat2 } from "node:fs/promises";
+import { readFile as readFile3, readdir, realpath, stat as stat2 } from "node:fs/promises";
 import path6 from "node:path";
 var DEFAULT_MEMORY_SEARCH_MAX_RESULTS = 6;
 var DEFAULT_MEMORY_SEARCH_SNIPPET_CHARS = 220;
@@ -77332,7 +77502,7 @@ async function loadIndex(workspaceDir) {
       break;
     let content;
     try {
-      content = await readFile2(full, "utf8");
+      content = await readFile3(full, "utf8");
     } catch {
       continue;
     }
@@ -77463,7 +77633,7 @@ async function getWorkspaceMemoryFile(params) {
   if (!info.isFile()) {
     throw new Error(`not a file: ${params.relativePath}`);
   }
-  const buf = await readFile2(resolvedTarget);
+  const buf = await readFile3(resolvedTarget);
   if (buf.length <= maxBytes) {
     return {
       path: params.relativePath,
@@ -77627,7 +77797,7 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve38(dir, ".git");
-    if (!existsSync62(gitDir)) {
+    if (!existsSync63(gitDir)) {
       process.stdout.write(`Workspace is not a git repository. Re-run \`switchroom agent create ${agentName}\` ` + `or manually \`git init\` in ${dir} to enable versioning.
 `);
       return;
@@ -77681,7 +77851,7 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve38(dir, ".git");
-    if (!existsSync62(gitDir)) {
+    if (!existsSync63(gitDir)) {
       process.stdout.write(`Workspace is not a git repository.
 `);
       return;
@@ -77706,7 +77876,7 @@ function resolveAgentWorkspaceDirOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve38(agentsDir, agentName);
   const dir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync62(dir)) {
+  if (!existsSync63(dir)) {
     process.stderr.write(`workspace: ${dir} does not exist yet. Run \`switchroom setup\` or \`switchroom agent scaffold ${agentName}\` to seed it.
 `);
     return;
@@ -77742,8 +77912,8 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync10, existsSync as existsSync63, readFileSync as readFileSync55, writeFileSync as writeFileSync30 } from "node:fs";
-import { join as join63, resolve as resolve39 } from "node:path";
+import { copyFileSync as copyFileSync10, existsSync as existsSync64, readFileSync as readFileSync55, writeFileSync as writeFileSync30 } from "node:fs";
+import { join as join64, resolve as resolve39 } from "node:path";
 init_schema();
 function resolveSoulTargetOrExit(program3, agentName) {
   const config = getConfig(program3);
@@ -77758,7 +77928,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve39(agentsDir, agentName);
   const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync63(workspaceDir)) {
+  if (!existsSync64(workspaceDir)) {
     console.error(`soul: ${workspaceDir} does not exist yet. Run \`switchroom setup\` ` + `or \`switchroom agent scaffold ${agentName}\` to seed it.`);
     process.exit(1);
   }
@@ -77767,7 +77937,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join63(workspaceDir, "SOUL.md"),
+    soulPath: join64(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -77784,7 +77954,7 @@ function registerSoulCommand(program3) {
     const t = resolveSoulTargetOrExit(program3, agentName);
     if (!t)
       return;
-    if (!existsSync63(t.soulPath)) {
+    if (!existsSync64(t.soulPath)) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
@@ -77799,7 +77969,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: profile "${t.profileName}" ships no SOUL.md.hbs \u2014 ` + `nothing to re-seed from.`);
       process.exit(1);
     }
-    const exists = existsSync63(t.soulPath);
+    const exists = existsSync64(t.soulPath);
     if (exists && !opts.yes) {
       if (!isInteractive()) {
         console.error(`soul: ${t.soulPath} already exists. Re-run with --yes to ` + `replace it (the current file is backed up to SOUL.md.bak).`);
@@ -77814,7 +77984,7 @@ function registerSoulCommand(program3) {
     let backupPath;
     if (exists) {
       backupPath = `${t.soulPath}.bak`;
-      if (existsSync63(backupPath)) {
+      if (existsSync64(backupPath)) {
         backupPath = `${t.soulPath}.bak.${Date.now()}`;
       }
       copyFileSync10(t.soulPath, backupPath);
@@ -77833,8 +78003,8 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync64, readFileSync as readFileSync56, readdirSync as readdirSync22, statSync as statSync27 } from "node:fs";
-import { resolve as resolve40, join as join64 } from "node:path";
+import { existsSync as existsSync65, readFileSync as readFileSync56, readdirSync as readdirSync23, statSync as statSync28 } from "node:fs";
+import { resolve as resolve40, join as join65 } from "node:path";
 import { createHash as createHash13 } from "node:crypto";
 init_merge();
 init_hindsight();
@@ -77845,8 +78015,8 @@ function estimateTokens(bytes) {
   return Math.round(bytes / 3.7);
 }
 function readMcpServerNames(agentDir) {
-  const mcpPath = join64(agentDir, ".mcp.json");
-  if (!existsSync64(mcpPath))
+  const mcpPath = join65(agentDir, ".mcp.json");
+  if (!existsSync65(mcpPath))
     return [];
   try {
     const parsed = JSON.parse(readFileSync56(mcpPath, "utf-8"));
@@ -77859,20 +78029,20 @@ function sha256(content) {
   return createHash13("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join64(claudeConfigDir, "projects");
-  if (!existsSync64(projectsDir))
+  const projectsDir = join65(claudeConfigDir, "projects");
+  if (!existsSync65(projectsDir))
     return;
   try {
-    const entries = readdirSync22(projectsDir, { withFileTypes: true });
+    const entries = readdirSync23(projectsDir, { withFileTypes: true });
     let latest;
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join64(projectsDir, entry.name);
-      const transcriptPath = join64(projectPath, "transcript.jsonl");
-      if (!existsSync64(transcriptPath))
+      const projectPath = join65(projectsDir, entry.name);
+      const transcriptPath = join65(projectPath, "transcript.jsonl");
+      if (!existsSync65(transcriptPath))
         continue;
-      const stat3 = statSync27(transcriptPath);
+      const stat3 = statSync28(transcriptPath);
       if (!latest || stat3.mtimeMs > latest.mtime) {
         latest = { path: transcriptPath, mtime: stat3.mtimeMs };
       }
@@ -77933,16 +78103,16 @@ function registerDebugCommand(program3) {
     }
     const agentsDir = resolveAgentsDir(config);
     const agentDir = resolve40(agentsDir, agentName);
-    if (!existsSync64(agentDir)) {
+    if (!existsSync65(agentDir)) {
       console.error(`Agent directory not found: ${agentDir}`);
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join64(agentDir, ".claude");
-    const claudeMdPath = join64(agentDir, "CLAUDE.md");
-    const soulMdPath = join64(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join64(workspaceDir, "SOUL.md");
-    const handoffPath = join64(agentDir, ".handoff.md");
+    const claudeConfigDir = join65(agentDir, ".claude");
+    const claudeMdPath = join65(agentDir, "CLAUDE.md");
+    const soulMdPath = join65(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join65(workspaceDir, "SOUL.md");
+    const handoffPath = join65(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -77988,7 +78158,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Append System Prompt (per-session) ===
 `);
-    const handoffContent = existsSync64(handoffPath) ? readFileSync56(handoffPath, "utf-8") : "";
+    const handoffContent = existsSync65(handoffPath) ? readFileSync56(handoffPath, "utf-8") : "";
     if (handoffContent.trim().length > 0) {
       console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
       console.log(handoffContent);
@@ -77999,7 +78169,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
 `);
-    const claudeMdContent = existsSync64(claudeMdPath) ? readFileSync56(claudeMdPath, "utf-8") : "";
+    const claudeMdContent = existsSync65(claudeMdPath) ? readFileSync56(claudeMdPath, "utf-8") : "";
     if (claudeMdContent.trim().length > 0) {
       console.log(`(${formatBytes(claudeMdContent.length)})`);
       console.log(claudeMdContent);
@@ -78010,7 +78180,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Persona (SOUL.md) ===
 `);
-    const soulMdContent = existsSync64(soulMdPath) ? readFileSync56(soulMdPath, "utf-8") : existsSync64(workspaceSoulMdPath) ? readFileSync56(workspaceSoulMdPath, "utf-8") : "";
+    const soulMdContent = existsSync65(soulMdPath) ? readFileSync56(soulMdPath, "utf-8") : existsSync65(workspaceSoulMdPath) ? readFileSync56(workspaceSoulMdPath, "utf-8") : "";
     if (soulMdContent.trim().length > 0) {
       console.log(`(${formatBytes(soulMdContent.length)})`);
       console.log(soulMdContent);
@@ -78071,11 +78241,11 @@ function registerDebugCommand(program3) {
     const soulMdBytes = soulMdContent.length;
     const perTurnBytes = dynamicResult.concatenated.length;
     const userBytes = userMessage?.text.length ?? 0;
-    const fleetDir = join64(agentsDir, "..", "fleet");
-    const fleetInvPath = join64(fleetDir, "switchroom-invariants.md");
-    const fleetClaudePath = join64(fleetDir, "CLAUDE.md");
-    const fleetInvBytes = existsSync64(fleetInvPath) ? readFileSync56(fleetInvPath, "utf-8").length : 0;
-    const fleetClaudeBytes = existsSync64(fleetClaudePath) ? readFileSync56(fleetClaudePath, "utf-8").length : 0;
+    const fleetDir = join65(agentsDir, "..", "fleet");
+    const fleetInvPath = join65(fleetDir, "switchroom-invariants.md");
+    const fleetClaudePath = join65(fleetDir, "CLAUDE.md");
+    const fleetInvBytes = existsSync65(fleetInvPath) ? readFileSync56(fleetInvPath, "utf-8").length : 0;
+    const fleetClaudeBytes = existsSync65(fleetClaudePath) ? readFileSync56(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
     const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
     console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
@@ -78108,9 +78278,9 @@ init_source();
 
 // src/worktree/claim.ts
 import { execFileSync as execFileSync21 } from "node:child_process";
-import { closeSync as closeSync12, mkdirSync as mkdirSync36, openSync as openSync12, existsSync as existsSync66, unlinkSync as unlinkSync13 } from "node:fs";
-import { join as join66, resolve as resolve42 } from "node:path";
-import { homedir as homedir39 } from "node:os";
+import { closeSync as closeSync12, mkdirSync as mkdirSync36, openSync as openSync12, existsSync as existsSync67, unlinkSync as unlinkSync13 } from "node:fs";
+import { join as join67, resolve as resolve42 } from "node:path";
+import { homedir as homedir40 } from "node:os";
 import { randomBytes as randomBytes13 } from "node:crypto";
 
 // src/worktree/registry.ts
@@ -78118,18 +78288,18 @@ import {
   mkdirSync as mkdirSync35,
   writeFileSync as writeFileSync31,
   readFileSync as readFileSync57,
-  readdirSync as readdirSync23,
+  readdirSync as readdirSync24,
   unlinkSync as unlinkSync12,
-  existsSync as existsSync65,
+  existsSync as existsSync66,
   renameSync as renameSync13
 } from "node:fs";
-import { join as join65, resolve as resolve41 } from "node:path";
-import { homedir as homedir38 } from "node:os";
+import { join as join66, resolve as resolve41 } from "node:path";
+import { homedir as homedir39 } from "node:os";
 function registryDir() {
-  return resolve41(process.env.SWITCHROOM_WORKTREE_DIR ?? join65(homedir38(), ".switchroom", "worktrees"));
+  return resolve41(process.env.SWITCHROOM_WORKTREE_DIR ?? join66(homedir39(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join65(registryDir(), `${id}.json`);
+  return join66(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
   mkdirSync35(registryDir(), { recursive: true });
@@ -78161,7 +78331,7 @@ function listRecords() {
   ensureDir2();
   const dir = registryDir();
   const records = [];
-  for (const entry of readdirSync23(dir)) {
+  for (const entry of readdirSync24(dir)) {
     if (!entry.endsWith(".json"))
       continue;
     const id = entry.slice(0, -5);
@@ -78180,7 +78350,7 @@ function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
   mkdirSync36(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join66(lockDir, `.lock-${lockName}`);
+  const lockPath = join67(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -78207,7 +78377,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve42(process.env.SWITCHROOM_WORKTREE_BASE ?? join66(homedir39(), ".switchroom", "worktree-checkouts"));
+  return resolve42(process.env.SWITCHROOM_WORKTREE_BASE ?? join67(homedir40(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes13(4).toString("hex");
@@ -78229,12 +78399,12 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join66(homedir39(), p.slice(2));
+    return join67(homedir40(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
   const repoPath = resolveRepoPath(input.repo, codeRepos);
-  if (!existsSync66(repoPath)) {
+  if (!existsSync67(repoPath)) {
     throw new Error(`Repository path does not exist: ${repoPath}`);
   }
   let concurrencyCap = DEFAULT_CONCURRENCY;
@@ -78257,7 +78427,7 @@ async function claimWorktree(input, codeRepos) {
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
     mkdirSync36(baseDir, { recursive: true });
-    worktreePath = join66(baseDir, `${id}-${taskSuffix}`);
+    worktreePath = join67(baseDir, `${id}-${taskSuffix}`);
     const now = new Date().toISOString();
     const record2 = {
       id,
@@ -78288,7 +78458,7 @@ async function claimWorktree(input, codeRepos) {
 
 // src/worktree/release.ts
 import { execFileSync as execFileSync22 } from "node:child_process";
-import { existsSync as existsSync67 } from "node:fs";
+import { existsSync as existsSync68 } from "node:fs";
 function releaseWorktree(input) {
   const { id } = input;
   const record2 = readRecord(id);
@@ -78296,7 +78466,7 @@ function releaseWorktree(input) {
     return { released: true };
   }
   let gitSuccess = true;
-  if (existsSync67(record2.path)) {
+  if (existsSync68(record2.path)) {
     try {
       execFileSync22("git", ["worktree", "remove", "--force", record2.path], {
         cwd: record2.repo,
@@ -78335,7 +78505,7 @@ function listWorktrees() {
 
 // src/worktree/reaper.ts
 import { execFileSync as execFileSync23 } from "node:child_process";
-import { existsSync as existsSync68 } from "node:fs";
+import { existsSync as existsSync69 } from "node:fs";
 var STALE_THRESHOLD_MS = 10 * 60 * 1000;
 function isPathInUse(path7) {
   try {
@@ -78362,7 +78532,7 @@ function hasUncommittedChanges(repoPath, worktreePath) {
 function reapRecord(record2) {
   const { id, path: path7, repo, branch, ownerAgent } = record2;
   let warning = null;
-  if (existsSync68(path7)) {
+  if (existsSync69(path7)) {
     if (hasUncommittedChanges(repo, path7)) {
       warning = `[worktree-reaper] Reaped worktree with uncommitted changes: ` + `id=${id} branch=${branch} agent=${ownerAgent ?? "unknown"} path=${path7}`;
     }
@@ -78383,7 +78553,7 @@ function runReaper(nowMs) {
   const warnings = [];
   for (const record2 of records) {
     const heartbeatAge = now - new Date(record2.heartbeatAt).getTime();
-    const worktreeExists = existsSync68(record2.path);
+    const worktreeExists = existsSync69(record2.path);
     if (!worktreeExists) {
       deleteRecord(record2.id);
       reaped.push(record2.id);
@@ -78508,11 +78678,11 @@ init_scaffold_integration();
 import {
   chmodSync as chmodSync9,
   mkdirSync as mkdirSync37,
-  readdirSync as readdirSync24,
+  readdirSync as readdirSync25,
   rmSync as rmSync15,
   writeFileSync as writeFileSync32
 } from "node:fs";
-import { join as join67 } from "node:path";
+import { join as join68 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -78702,16 +78872,16 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join67(stateBase, "google-workspace-mcp", "credentials");
+  return join68(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
   mkdirSync37(dir, { recursive: true, mode: 448 });
   chmodSync9(dir, 448);
-  for (const name of readdirSync24(dir)) {
-    rmSync15(join67(dir, name), { force: true, recursive: true });
+  for (const name of readdirSync25(dir)) {
+    rmSync15(join68(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join67(dir, filename);
+  const filePath = join68(dir, filename);
   writeFileSync32(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync9(filePath, 384);
   return filePath;
@@ -78871,7 +79041,7 @@ function registerDriveMcpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
 import { writeFileSync as writeFileSync33, mkdirSync as mkdirSync38 } from "node:fs";
-import { dirname as dirname17, join as join68 } from "node:path";
+import { dirname as dirname18, join as join69 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -78896,14 +79066,14 @@ function computeRefreshDelayMs(expiresAt, now, leadMs = DEFAULT_REFRESH_LEAD_MS)
 function writeRefreshHeartbeat(agentName, data) {
   const path7 = heartbeatPath(agentName);
   try {
-    mkdirSync38(dirname17(path7), { recursive: true });
+    mkdirSync38(dirname18(path7), { recursive: true });
     writeFileSync33(path7, JSON.stringify(data, null, 2), { mode: 420 });
   } catch {}
 }
 function heartbeatPath(agentName) {
   const override = process.env.SWITCHROOM_M365_HEARTBEAT_DIR;
   if (override) {
-    return join68(override, `m365-launcher-${agentName}.heartbeat.json`);
+    return join69(override, `m365-launcher-${agentName}.heartbeat.json`);
   }
   return "/state/agent/m365-launcher.heartbeat.json";
 }
@@ -79088,8 +79258,8 @@ function registerM365McpLauncherCommand(program3) {
 // src/cli/notion-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn7 } from "node:child_process";
-import { existsSync as existsSync69, mkdirSync as mkdirSync39, writeFileSync as writeFileSync34 } from "node:fs";
-import { dirname as dirname18 } from "node:path";
+import { existsSync as existsSync70, mkdirSync as mkdirSync39, writeFileSync as writeFileSync34 } from "node:fs";
+import { dirname as dirname19 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
 var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
 var DEFAULT_VAULT_KEY = "notion/integration-token";
@@ -79099,8 +79269,8 @@ function buildNotionMcpArgs(opts) {
 }
 function defaultWriteHeartbeat(path7, contents) {
   try {
-    const dir = dirname18(path7);
-    if (!existsSync69(dir))
+    const dir = dirname19(path7);
+    if (!existsSync70(dir))
       mkdirSync39(dir, { recursive: true });
     writeFileSync34(path7, contents);
   } catch {}
@@ -79212,7 +79382,7 @@ function registerNotionMcpLauncherCommand(program3) {
 
 // src/cli/deliver-file.ts
 init_client2();
-import { readFileSync as readFileSync58, statSync as statSync28 } from "node:fs";
+import { readFileSync as readFileSync58, statSync as statSync29 } from "node:fs";
 import { basename as basename7 } from "node:path";
 
 // src/delivery/onedrive.ts
@@ -79502,7 +79672,7 @@ async function defaultResolveProvider() {
 }
 async function runDeliverFile(localPath, deps = {}) {
   const agentName = safeAgentName(deps.agentName ?? process.env.SWITCHROOM_AGENT_NAME);
-  const sizeOf = deps.fileSize ?? ((p) => statSync28(p).size);
+  const sizeOf = deps.fileSize ?? ((p) => statSync29(p).size);
   const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync58(p)));
   const resolveProvider = deps.resolveProvider ?? defaultResolveProvider;
   let size;
@@ -79793,8 +79963,8 @@ async function fetchToken(vaultKey) {
 
 // src/cli/apply.ts
 init_source();
-import { accessSync as accessSync3, chownSync as chownSync4, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync73, mkdirSync as mkdirSync41, readFileSync as readFileSync60, readdirSync as readdirSync26, renameSync as renameSync14, writeFileSync as writeFileSync36 } from "node:fs";
-import { mkdir, writeFile } from "node:fs/promises";
+import { accessSync as accessSync3, chownSync as chownSync5, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync73, mkdirSync as mkdirSync41, readFileSync as readFileSync60, readdirSync as readdirSync26, renameSync as renameSync14, writeFileSync as writeFileSync36 } from "node:fs";
+import { mkdir as mkdir2 } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
 
@@ -80182,16 +80352,16 @@ agents:
 
 // src/cli/apply.ts
 init_resolver();
-import { dirname as dirname21, join as join72, resolve as resolve44 } from "node:path";
-import { homedir as homedir41 } from "node:os";
+import { dirname as dirname22, join as join72, resolve as resolve44 } from "node:path";
+import { homedir as homedir42 } from "node:os";
 import { execFileSync as execFileSync24 } from "node:child_process";
 init_vault();
 init_loader();
 init_loader();
 
 // src/cli/update-prompt-hook.ts
-import { existsSync as existsSync70, readFileSync as readFileSync59, writeFileSync as writeFileSync35, chmodSync as chmodSync10, mkdirSync as mkdirSync40 } from "node:fs";
-import { join as join69 } from "node:path";
+import { existsSync as existsSync71, readFileSync as readFileSync59, writeFileSync as writeFileSync35, chmodSync as chmodSync10, mkdirSync as mkdirSync40 } from "node:fs";
+import { join as join70 } from "node:path";
 var HOOK_FILENAME = "update-card-on-prompt.sh";
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -80257,12 +80427,12 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join69(agentDir, ".claude", "hooks");
+  const hooksDir = join70(agentDir, ".claude", "hooks");
   mkdirSync40(hooksDir, { recursive: true });
-  const scriptPath = join69(hooksDir, HOOK_FILENAME);
+  const scriptPath = join70(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
-  const existing = existsSync70(scriptPath) ? readFileSync59(scriptPath, "utf-8") : "";
+  const existing = existsSync71(scriptPath) ? readFileSync59(scriptPath, "utf-8") : "";
   if (existing !== desired) {
     writeFileSync35(scriptPath, desired, { mode: 493 });
     chmodSync10(scriptPath, 493);
@@ -80272,8 +80442,8 @@ function installUpdatePromptHook(agentDir) {
       chmodSync10(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join69(agentDir, ".claude", "settings.json");
-  if (!existsSync70(settingsPath)) {
+  const settingsPath = join70(agentDir, ".claude", "settings.json");
+  if (!existsSync71(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
   const raw = readFileSync59(settingsPath, "utf-8");
@@ -80319,26 +80489,6 @@ function installUpdatePromptHook(agentDir) {
 // src/cli/apply.ts
 init_compose();
 
-// src/config/release-resolve.ts
-function resolveImageTag(release) {
-  if (!release)
-    return "latest";
-  if (release.pin)
-    return release.pin;
-  if (release.channel)
-    return release.channel;
-  return "latest";
-}
-function resolveRelease(opts) {
-  if (opts.override)
-    return opts.override;
-  if (opts.perAgent)
-    return opts.perAgent;
-  if (opts.root)
-    return opts.root;
-  return;
-}
-
 // src/cli/install-detect.ts
 import * as fs4 from "node:fs";
 import * as path7 from "node:path";
@@ -80389,107 +80539,17 @@ function detectInstallType() {
   }
 }
 
-// src/cli/operator-uid.ts
-import {
-  chownSync as chownSync3,
-  existsSync as existsSync72,
-  lstatSync as lstatSync7,
-  readdirSync as readdirSync25,
-  realpathSync as realpathSync6,
-  statSync as statSync29
-} from "node:fs";
-import { join as join71 } from "node:path";
-function resolveOperatorUid() {
-  const sudoUid = process.env.SUDO_UID;
-  if (sudoUid !== undefined) {
-    const parsed = parseInt(sudoUid, 10);
-    if (Number.isFinite(parsed) && parsed > 0)
-      return parsed;
-  }
-  if (typeof process.getuid === "function") {
-    const uid = process.getuid();
-    if (uid > 0)
-      return uid;
-  }
-  return;
-}
-function operatorOwnedPaths(home2) {
-  const root = join71(home2, ".switchroom");
-  return [
-    join71(root, "vault"),
-    join71(root, "vault-auto-unlock"),
-    join71(root, "vault-audit.log"),
-    join71(root, "host-control-audit.log"),
-    join71(root, "accounts"),
-    join71(root, "compose")
-  ];
-}
-function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
-  const chown = deps.chown ?? ((p, u, g) => chownSync3(p, u, g));
-  const exists = deps.exists ?? ((p) => existsSync72(p));
-  const isSymlink = deps.isSymlink ?? ((p) => {
-    try {
-      return lstatSync7(p).isSymbolicLink();
-    } catch {
-      return false;
-    }
-  });
-  const isDir = deps.isDir ?? ((p) => {
-    try {
-      return statSync29(p).isDirectory();
-    } catch {
-      return false;
-    }
-  });
-  const realpath2 = deps.realpath ?? ((p) => {
-    try {
-      return realpathSync6(p);
-    } catch {
-      return p;
-    }
-  });
-  const readdir2 = deps.readdir ?? ((p) => {
-    try {
-      return readdirSync25(p);
-    } catch {
-      return [];
-    }
-  });
-  const chowned = [];
-  const seen = new Set;
-  const visit = (path8) => {
-    if (!exists(path8))
-      return;
-    const target = isSymlink(path8) ? realpath2(path8) : path8;
-    if (seen.has(target))
-      return;
-    seen.add(target);
-    try {
-      chown(target, operatorUid, operatorUid);
-      chowned.push(target);
-    } catch {}
-    if (isDir(target)) {
-      for (const entry of readdir2(target)) {
-        visit(join71(target, entry));
-      }
-    }
-  };
-  for (const p of operatorOwnedPaths(home2))
-    visit(p);
-  return chowned;
-}
-
 // src/cli/apply.ts
 var EMBEDDED_EXAMPLES = {
   switchroom: switchroom_default,
   minimal: minimal_default
 };
-var DEFAULT_COMPOSE_PATH2 = join72(homedir41(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH2 = join72(homedir42(), ".switchroom", "compose", "docker-compose.yml");
 var COMPOSE_PROJECT2 = "switchroom";
 function resolveVaultBindMountDir(homeDir, ctx) {
   const isCustomPath = ctx.migrationKind === "custom-path-skipped";
   if (isCustomPath && ctx.customVaultPath) {
-    return dirname21(ctx.customVaultPath);
+    return dirname22(ctx.customVaultPath);
   }
   return join72(homeDir, ".switchroom", "vault");
 }
@@ -80520,7 +80580,7 @@ function hasVaultRefs(value) {
   return false;
 }
 async function ensureHostMountSources(config) {
-  const home2 = homedir41();
+  const home2 = homedir42();
   const dirs = [
     join72(home2, ".switchroom", "approvals"),
     join72(home2, ".switchroom", "scheduler"),
@@ -80538,7 +80598,7 @@ async function ensureHostMountSources(config) {
     }
   }
   for (const dir of dirs) {
-    await mkdir(dir, { recursive: true });
+    await mkdir2(dir, { recursive: true });
   }
   const autoUnlockPath = join72(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync73(autoUnlockPath)) {
@@ -80563,11 +80623,11 @@ async function ensureHostMountSources(config) {
     }
     try {
       const uid = allocateAgentUid(name);
-      chownSync4(tokenPath, uid, uid);
+      chownSync5(tokenPath, uid, uid);
     } catch {}
   }
   const fleetDir = join72(home2, ".switchroom", "fleet");
-  await mkdir(fleetDir, { recursive: true });
+  await mkdir2(fleetDir, { recursive: true });
   const invariantsPath = join72(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
   const invariantsCurrent = existsSync73(invariantsPath) ? readFileSync60(invariantsPath, "utf-8") : null;
@@ -80657,7 +80717,7 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 `));
   }
 }
-function writeInstallTypeCache(homeDir = homedir41()) {
+function writeInstallTypeCache(homeDir = homedir42()) {
   const ctx = detectInstallType();
   const dir = join72(homeDir, ".switchroom");
   const out = join72(dir, "install-type.json");
@@ -80767,7 +80827,7 @@ Applying switchroom config...
   }
   const vaultPathConfigured = config.vault?.path;
   const customVaultPath = vaultPathConfigured ? resolvePath(vaultPathConfigured) : undefined;
-  const migrationResult = migrateVaultLayout(homedir41(), {
+  const migrationResult = migrateVaultLayout(homedir42(), {
     customVaultPath
   });
   switch (migrationResult.kind) {
@@ -80793,7 +80853,7 @@ Applying switchroom config...
       writeErr(formatDivergentRecoveryMessage(migrationResult.details));
       process.exit(4);
   }
-  const postMigrationInspect = inspectVaultLayout(homedir41());
+  const postMigrationInspect = inspectVaultLayout(homedir42());
   const acceptable = [
     "no-vault",
     "already-migrated",
@@ -80808,7 +80868,7 @@ Applying switchroom config...
 `));
     process.exit(5);
   }
-  const vaultDir = resolveVaultBindMountDir(homedir41(), {
+  const vaultDir = resolveVaultBindMountDir(homedir42(), {
     migrationKind: migrationResult.kind,
     customVaultPath
   });
@@ -80828,26 +80888,14 @@ Applying switchroom config...
   }
   const composePath = options.outPath ?? DEFAULT_COMPOSE_PATH2;
   const operatorUid = resolveOperatorUid();
-  const composeRelease = resolveRelease({
-    override: options.releaseOverride,
-    root: config.release
-  });
-  const composeImageTag = resolveImageTag(composeRelease);
-  const composeContent = generateCompose({
+  const { bytes: composeBytes } = await writeComposeFile({
     config,
-    imageTag: composeImageTag,
-    buildMode: options.buildLocal ? "local" : "pull",
-    buildContext: options.buildContext,
-    homeDir: homedir41(),
+    composePath,
     switchroomConfigPath,
-    operatorUid
-  });
-  await mkdir(dirname21(composePath), { recursive: true });
-  await writeFile(composePath, composeContent, {
-    encoding: "utf8",
-    mode: 384
+    releaseOverride: options.releaseOverride,
+    buildMode: options.buildLocal ? "local" : "pull",
+    buildContext: options.buildContext
   });
-  const composeBytes = Buffer.byteLength(composeContent, "utf8");
   writeOut(source_default.bold(`
 Wrote `) + composePath + source_default.gray(` (${composeBytes} bytes)
 `));
@@ -80858,7 +80906,7 @@ Wrote `) + composePath + source_default.gray(` (${composeBytes} bytes)
   writeOut(source_default.gray(`  (If pull returns 401, login to ghcr.io first: see docs/operators/install.md#ghcr-auth)
 `));
   if (process.geteuid?.() === 0 && operatorUid !== undefined) {
-    const restored = restoreOperatorOwnership(homedir41(), operatorUid);
+    const restored = restoreOperatorOwnership(homedir42(), operatorUid);
     if (restored.length > 0) {
       writeOut(source_default.gray(`  Restored operator ownership of ${restored.length} ~/.switchroom path(s)
 `));
@@ -81109,7 +81157,7 @@ function runRedactStdin() {
 // src/cli/status-ask.ts
 import { readFileSync as readFileSync61, existsSync as existsSync74, readdirSync as readdirSync27 } from "node:fs";
 import { join as join73 } from "node:path";
-import { homedir as homedir42 } from "node:os";
+import { homedir as homedir43 } from "node:os";
 
 // src/status-ask/report.ts
 function parseJsonl(content) {
@@ -81444,7 +81492,7 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join73(homedir42(), ".switchroom", "agents");
+    agentsDir = join73(homedir43(), ".switchroom", "agents");
   }
   if (!existsSync74(agentsDir))
     return [];
@@ -81479,14 +81527,14 @@ function inferAgentFromPath(p) {
 // src/cli/agent-config.ts
 init_helpers();
 import { join as join74 } from "node:path";
-import { homedir as homedir43 } from "node:os";
+import { homedir as homedir44 } from "node:os";
 import {
   existsSync as existsSync75,
   mkdirSync as mkdirSync42,
   appendFileSync as appendFileSync4,
   readFileSync as readFileSync62
 } from "node:fs";
-var AUDIT_ROOT = join74(homedir43(), ".switchroom", "audit");
+var AUDIT_ROOT = join74(homedir44(), ".switchroom", "audit");
 function auditPathFor(agent) {
   return join74(AUDIT_ROOT, agent, "agent-config.jsonl");
 }
@@ -82986,8 +83034,8 @@ import {
   statSync as statSync31,
   writeFileSync as writeFileSync38
 } from "node:fs";
-import { tmpdir as tmpdir5, homedir as homedir44 } from "node:os";
-import { dirname as dirname22, join as join78, relative as relative2, resolve as resolve46 } from "node:path";
+import { tmpdir as tmpdir5, homedir as homedir45 } from "node:os";
+import { dirname as dirname23, join as join78, relative as relative2, resolve as resolve46 } from "node:path";
 import { spawnSync as spawnSync11 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -83181,10 +83229,10 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join78(homedir44(), raw.slice(2));
+    return join78(homedir45(), raw.slice(2));
   }
   if (raw === "~")
-    return homedir44();
+    return homedir45();
   return resolve46(raw);
 }
 function readStdinSync() {
@@ -83417,7 +83465,7 @@ function writePayload(poolDir, name, files) {
   try {
     for (const [path8, content] of Object.entries(files)) {
       const full = join78(staging, path8);
-      mkdirSync45(dirname22(full), { recursive: true, mode: 493 });
+      mkdirSync45(dirname23(full), { recursive: true, mode: 493 });
       const fd = openSync15(full, "wx");
       try {
         writeFileSync38(fd, content);
@@ -83538,8 +83586,8 @@ import {
   utimesSync,
   writeFileSync as writeFileSync39
 } from "node:fs";
-import { dirname as dirname23, join as join79, relative as relative3, resolve as resolve47 } from "node:path";
-import { homedir as homedir45, tmpdir as tmpdir6 } from "node:os";
+import { dirname as dirname24, join as join79, relative as relative3, resolve as resolve47 } from "node:path";
+import { homedir as homedir46, tmpdir as tmpdir6 } from "node:os";
 import { spawnSync as spawnSync12 } from "node:child_process";
 init_helpers();
 init_source();
@@ -83549,7 +83597,7 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve47(override) : join79(homedir45(), ".switchroom-config");
+  const candidate = override ? resolve47(override) : join79(homedir46(), ".switchroom-config");
   if (!existsSync81(candidate))
     return null;
   return join79(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
@@ -83645,7 +83693,7 @@ function resolveAgent(opts) {
 function resolveAgentsRoot(opts) {
   if (opts.root)
     return resolve47(opts.root);
-  return join79(homedir45(), ".switchroom", "agents");
+  return join79(homedir46(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
   return join79(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
@@ -83779,13 +83827,13 @@ function writePersonalSkill(targetDir, files) {
   if (targetIsSymlink) {
     fail3(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
-  mkdirSync46(dirname23(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join79(dirname23(targetDir), `.skill-personal-stage-`));
+  mkdirSync46(dirname24(targetDir), { recursive: true, mode: 493 });
+  const staging = mkdtempSync6(join79(dirname24(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
       const full = join79(staging, path8);
-      mkdirSync46(dirname23(full), { recursive: true, mode: 493 });
+      mkdirSync46(dirname24(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
         writeFileSync39(fd, content);
@@ -83917,10 +83965,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join79(homedir45(), ".switchroom", "skills");
+  return join79(homedir46(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join79(homedir45(), ".switchroom", "skills", "_bundled");
+  return join79(homedir46(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -84136,19 +84184,19 @@ function registerSkillPersonalCommands(program3) {
 init_helpers();
 var import_yaml23 = __toESM(require_dist(), 1);
 import { existsSync as existsSync82, readdirSync as readdirSync32, readFileSync as readFileSync68, statSync as statSync33 } from "node:fs";
-import { homedir as homedir46 } from "node:os";
+import { homedir as homedir47 } from "node:os";
 import { join as join80, resolve as resolve48 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
 function defaultAgentsRoot() {
-  return resolve48(homedir46(), ".switchroom/agents");
+  return resolve48(homedir47(), ".switchroom/agents");
 }
 function defaultSharedRoot2() {
-  return resolve48(homedir46(), ".switchroom/skills");
+  return resolve48(homedir47(), ".switchroom/skills");
 }
 function defaultBundledRoot2() {
-  return resolve48(homedir46(), ".switchroom/skills/_bundled");
+  return resolve48(homedir47(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
   const mdPath = join80(skillDir, "SKILL.md");
@@ -84429,7 +84477,7 @@ function registerHostdMcpCommand(program3) {
 init_source();
 init_helpers();
 import { existsSync as existsSync84, mkdirSync as mkdirSync47, readdirSync as readdirSync33, readFileSync as readFileSync70, writeFileSync as writeFileSync40, statSync as statSync34, copyFileSync as copyFileSync12 } from "node:fs";
-import { homedir as homedir47 } from "node:os";
+import { homedir as homedir48 } from "node:os";
 import { join as join81 } from "node:path";
 import { spawnSync as spawnSync14 } from "node:child_process";
 init_audit_reader();
@@ -84521,7 +84569,7 @@ networks:
 `;
 }
 function hostdDir() {
-  return join81(homedir47(), ".switchroom", "hostd");
+  return join81(homedir48(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
   return join81(hostdDir(), "docker-compose.yml");
@@ -84563,7 +84611,7 @@ async function doInstall(opts, program3) {
   const composePath = hostdComposePath();
   mkdirSync47(dir, { recursive: true });
   const yaml = renderHostdComposeFile({
-    hostHome: homedir47(),
+    hostHome: homedir48(),
     imageTag: opts.tag ?? DEFAULT_IMAGE_TAG,
     operatorUid: resolveOperatorUid()
   });
@@ -84726,7 +84774,7 @@ The log is created when hostd handles its first privileged-verb request.`));
 init_source();
 init_helpers();
 import { existsSync as existsSync85, mkdirSync as mkdirSync48, writeFileSync as writeFileSync41, copyFileSync as copyFileSync13 } from "node:fs";
-import { homedir as homedir48 } from "node:os";
+import { homedir as homedir49 } from "node:os";
 import { join as join82 } from "node:path";
 import { spawnSync as spawnSync15 } from "node:child_process";
 var DEFAULT_IMAGE_TAG2 = "latest";
@@ -84808,7 +84856,7 @@ services:
 `;
 }
 function webdDir() {
-  return join82(homedir48(), ".switchroom", "web");
+  return join82(homedir49(), ".switchroom", "web");
 }
 function webdComposePath() {
   return join82(webdDir(), "docker-compose.yml");
@@ -84842,7 +84890,7 @@ async function doInstall2(opts) {
   const composePath = webdComposePath();
   mkdirSync48(dir, { recursive: true });
   const yaml = renderWebComposeFile({
-    hostHome: homedir48(),
+    hostHome: homedir49(),
     imageTag: opts.tag ?? DEFAULT_IMAGE_TAG2,
     operatorUid
   });