switchroom 0.15.11 → 0.15.13

package/dist/cli/switchroom.js

@@ -13711,6 +13711,12 @@ var init_schema = __esm(() => {
     }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default \u2014 when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit."),
     webhook_via_gateway: exports_external.boolean().optional().describe("Route verified webhook events to the agent's in-container gateway " + "over a peercred-gated UDS (<agent>/telegram/webhook.sock) instead " + "of having the host-side web receiver write the agent dir directly. " + "Required under the Docker runtime: the receiver runs as the host " + "operator UID and cannot write the per-agent-UID-owned agent dir " + "(EACCES 500) nor connect the gateway socket. When true the gateway " + "(running as the agent UID) becomes the sole writer of " + "webhook-events.jsonl + dedup/cooldown state and also fires " + "webhook_dispatch. Off by default for back-compat with host-runtime " + "installs. See docs/rfcs/webhook-via-gateway-socket.md."),
     webhook_require_edge: exports_external.boolean().optional().describe("Cloudflare-only edge lock: require the X-Switchroom-Edge header " + "(injected by a Cloudflare Transform Rule on hooks.switchroom.ai) to " + "match the operator's edge secret at ~/.switchroom/webhook-edge-secret " + "before any HMAC verification; reject 403 otherwise. Proves the " + "request entered through our Cloudflare edge \u2014 the per-agent HMAC " + "alone can't (it proves body provenance, not network path). Stacks " + "on the GitHub-IP WAF + per-agent HMAC. Fail-closed: when required " + "but the secret file is missing/empty every request is rejected. Off " + "by default. See docs/rfcs/webhook-cloudflare-edge-lock.md."),
+    linear_agent: exports_external.object({
+      enabled: exports_external.boolean(),
+      token: exports_external.string().describe("vault:<key> reference to the Linear OAuth app token (actor=app). " + "Resolved at runtime via the vault broker (canonically " + "vault:linear/<agent>/token). Never an inline literal."),
+      workspace_id: exports_external.string().optional().describe("Optional Linear workspace (organization) id this agent is " + "installed into. Informational \u2014 used for setup hints and " + "multi-workspace disambiguation; the token already scopes the " + "app to its workspace."),
+      default_team_id: exports_external.string().optional().describe("Optional Linear team id new captured issues file into when the " + "agent doesn't pass an explicit team_id. Unnecessary for a " + "single-team workspace (auto-resolved); set it only when the " + "workspace has multiple teams. Manage via " + "`switchroom linear-agent set-team <agent> <team>`.")
+    }).optional().describe("Linear first-class agent integration (#2298). When enabled, the " + "agent appears in a Linear workspace as an app actor (own name/" + "avatar, @-mentionable, delegate-assignable). Linear AgentSessionEvent " + "webhooks (mention / delegation) wake the agent instantly via the " + "same gateway inject path as webhook_dispatch, tagged " + 'meta.source="linear" with the agent_session_id, and the agent ' + "responds with structured AgentActivity (thought/message/complete/" + "error) via the linear_agent_activity MCP tool. Builds the " + "session-lifecycle layer on top of the plain webhook_sources:[linear] " + "+ webhook_dispatch support (#2272). The OAuth app token is stored in " + "the vault and referenced here as vault:linear/<agent>/token; run " + "`switchroom linear-agent setup <agent>` to provision it. Off by " + "default \u2014 opt in per agent. Cascades from " + "defaults.channels.telegram.linear_agent."),
     chat_id: exports_external.string().regex(/^-\d+$/, 'supergroup chat_id must be a negative integer as a string (e.g. "-1001234567890")').optional().describe("Per-agent supergroup ID \u2014 overrides fleet `telegram.forum_chat_id`. " + "When set, requires `default_topic_id`. Negative integer as string. " + "Forbidden when `dm_only: true`. See docs/rfcs/supergroup-mode.md."),
     default_topic_id: exports_external.number().int().positive().optional().describe("Forum topic ID this agent's automated outbounds default to when " + "no more-specific alias resolves. Defaults to General (topic 1) when " + "`chat_id` is set and this is omitted \u2014 set it only to pin a different " + "fallback topic. " + "Telegram's General topic is `id=1` at MTProto but sends omit the " + "field \u2014 the outbound wrapper strips `message_thread_id === 1` " + "on send. Forbidden when `dm_only: true`."),
     topic_aliases: exports_external.record(exports_external.string(), exports_external.number().int().positive()).optional().describe("Operator-friendly names for forum topic IDs (e.g. " + "`{ general: 1, planning: 17, cron: 23, admin: 31, alerts: 41 }`). " + "Referenced from per-cron `topic:` fields and the outbound router " + "for autonomous events (boot \u2192 alerts, hostd \u2192 admin, etc.). " + "Cascades per-key through defaults \u2192 profile \u2192 agent.")
@@ -14635,6 +14641,16 @@ function mergeAgentConfig(defaultsIn, agentIn) {
     }
     merged.reaction_dispatch = combined;
   }
+  const linearEnabled = merged.channels?.telegram?.linear_agent?.enabled === true;
+  if (linearEnabled) {
+    const rd = merged.reaction_dispatch;
+    if (!rd || rd.emojis === undefined) {
+      merged.reaction_dispatch = {
+        enabled: rd?.enabled ?? true,
+        emojis: ["\uD83D\uDC68\u200d\uD83D\uDCBB", "\uD83D\uDCCC"]
+      };
+    }
+  }
   if (defaults.resources || merged.resources) {
     const d = defaults.resources ?? {};
     const a = merged.resources ?? {};
@@ -29166,7 +29182,7 @@ var init_thinking_effort_risk = __esm(() => {
 // src/manifest.ts
 import {
   existsSync as existsSync52,
-  readFileSync as readFileSync47,
+  readFileSync as readFileSync48,
   readdirSync as readdirSync19
 } from "node:fs";
 import { dirname as dirname12, join as join47 } from "node:path";
@@ -29188,7 +29204,7 @@ function loadManifest(manifestPath) {
   }
   let raw;
   try {
-    raw = readFileSync47(path4, "utf-8");
+    raw = readFileSync48(path4, "utf-8");
   } catch (err) {
     throw new Error(`Failed to read manifest at ${path4}: ${err.message}`);
   }
@@ -29253,7 +29269,7 @@ function probePlaywrightMcpVersion() {
       const pkgPath = join47(npxCache, entry, "node_modules/@playwright/mcp/package.json");
       if (existsSync52(pkgPath)) {
         try {
-          const pkg = JSON.parse(readFileSync47(pkgPath, "utf-8"));
+          const pkg = JSON.parse(readFileSync48(pkgPath, "utf-8"));
           if (pkg.version)
             return pkg.version;
         } catch {}
@@ -29488,7 +29504,7 @@ var init_doctor_memory = __esm(() => {
 });
 
 // src/cli/doctor-docker.ts
-import { readFileSync as readFileSync48 } from "node:fs";
+import { readFileSync as readFileSync49 } from "node:fs";
 function imageTagOf(ref) {
   if (!ref)
     return "<absent>";
@@ -29503,7 +29519,7 @@ function isDockerMode(opts) {
     return true;
   if (opts?.composePath) {
     try {
-      readFileSync48(opts.composePath, "utf8");
+      readFileSync49(opts.composePath, "utf8");
       return true;
     } catch {}
   }
@@ -29692,7 +29708,7 @@ var init_doctor_docker = __esm(() => {
 });
 
 // src/cli/doctor-auth-broker.ts
-import { existsSync as existsSync53, readFileSync as readFileSync49 } from "node:fs";
+import { existsSync as existsSync53, readFileSync as readFileSync50 } from "node:fs";
 import { createHash as createHash10 } from "node:crypto";
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { homedir as homedir26 } from "node:os";
@@ -29806,7 +29822,7 @@ function checkAuthBrokerDrift(deps = {}) {
   }
   let index;
   try {
-    index = JSON.parse(readFileSync49(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync50(indexPath, "utf-8"));
   } catch (err) {
     return {
       name: "auth-broker: drift",
@@ -29826,7 +29842,7 @@ function checkAuthBrokerDrift(deps = {}) {
     }
     let got;
     try {
-      got = sha256Hex(readFileSync49(credsPath, "utf-8"));
+      got = sha256Hex(readFileSync50(credsPath, "utf-8"));
     } catch (err) {
       divergent.push(`${label} (read failed: ${err.message})`);
       continue;
@@ -29867,7 +29883,7 @@ function checkAuthBrokerThresholdViolations(deps = {}) {
   }
   let violations;
   try {
-    violations = JSON.parse(readFileSync49(path4, "utf-8"));
+    violations = JSON.parse(readFileSync50(path4, "utf-8"));
   } catch (err) {
     return {
       name: "auth-broker: threshold violations",
@@ -31903,7 +31919,7 @@ import {
   existsSync as existsSync57,
   lstatSync as lstatSync6,
   mkdirSync as mkdirSync31,
-  readFileSync as readFileSync50,
+  readFileSync as readFileSync51,
   readdirSync as readdirSync21,
   statSync as statSync25
 } from "node:fs";
@@ -32663,7 +32679,7 @@ function classifyReadError(err) {
 }
 function tryReadHostFile(path4) {
   try {
-    return { kind: "ok", content: readFileSync50(path4, "utf-8") };
+    return { kind: "ok", content: readFileSync51(path4, "utf-8") };
   } catch (err) {
     const kind = classifyReadError(err);
     const error = err?.message ?? String(err);
@@ -32679,7 +32695,7 @@ function parseEnvFile(path4) {
     return {};
   let content;
   try {
-    content = readFileSync50(path4, "utf-8");
+    content = readFileSync51(path4, "utf-8");
   } catch {
     return {};
   }
@@ -32796,7 +32812,7 @@ function checkStartShStale(agentName, startShPath) {
   }
   let content;
   try {
-    content = readFileSync50(startShPath, "utf-8");
+    content = readFileSync51(startShPath, "utf-8");
   } catch (err) {
     return {
       name: label,
@@ -32909,7 +32925,7 @@ function isSwitchroomCheckout(dir) {
     const pkgPath = join59(dir, "package.json");
     if (!existsSync57(pkgPath))
       return false;
-    const pkg = JSON.parse(readFileSync50(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync51(pkgPath, "utf-8"));
     return pkg.name === "switchroom";
   } catch {
     return false;
@@ -33030,7 +33046,7 @@ function checkAgents(config, configPath) {
         });
       } else {
         try {
-          const mcp = JSON.parse(readFileSync50(mcpJsonPath, "utf-8"));
+          const mcp = JSON.parse(readFileSync51(mcpJsonPath, "utf-8"));
           const hasSwitchroomTelegram = !!mcp.mcpServers?.["switchroom-telegram"];
           const memoryEnabled = isHindsightEnabled(config);
           const hasHindsight = !!mcp.mcpServers?.hindsight;
@@ -33525,11 +33541,11 @@ function runDockerSection(config) {
   let composeYaml;
   let dockerfileAgent;
   try {
-    composeYaml = readFileSync50(composePath, "utf8");
+    composeYaml = readFileSync51(composePath, "utf8");
   } catch {}
   const dockerfilePath = resolve32(process.env.HOME ?? "", ".switchroom", "docker", "Dockerfile.agent");
   try {
-    dockerfileAgent = readFileSync50(dockerfilePath, "utf8");
+    dockerfileAgent = readFileSync51(dockerfilePath, "utf8");
   } catch {}
   return runDockerChecks({
     config,
@@ -49836,7 +49852,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes15 } from "node:crypto";
-import { existsSync as existsSync83, readFileSync as readFileSync69 } from "node:fs";
+import { existsSync as existsSync83, readFileSync as readFileSync70 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -50014,7 +50030,7 @@ function getLastUpdateApplyStatus() {
   }
   let raw;
   try {
-    raw = readFileSync69(path8, "utf-8");
+    raw = readFileSync70(path8, "utf-8");
   } catch (err2) {
     return errorText2(`get_status: failed to read audit log at ${path8}: ${err2.message}`);
   }
@@ -50247,8 +50263,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.15.11";
-var COMMIT_SHA = "43331954";
+var VERSION = "0.15.13";
+var COMMIT_SHA = "36ba2682";
 
 // src/cli/agent.ts
 init_source();
@@ -51714,6 +51730,11 @@ function webkiteDenyForAgent(agentConfig) {
 }
 var SWITCHROOM_DEFAULT_MAIN_MODEL = "claude-sonnet-4-6";
 var SWITCHROOM_DEFAULT_THINKING_EFFORT = "low";
+function resolveMainModel(model) {
+  if (model === undefined || model === "default")
+    return SWITCHROOM_DEFAULT_MAIN_MODEL;
+  return model;
+}
 function dedupe2(items) {
   const seen = new Set;
   const out = [];
@@ -51983,6 +52004,10 @@ function channelsToEnv(agent) {
   if (tg.clear_status_on_completion !== undefined) {
     out.SWITCHROOM_TG_CLEAR_STATUS_ON_COMPLETION = tg.clear_status_on_completion ? "1" : "0";
   }
+  const linearDefaultTeam = tg?.linear_agent?.default_team_id;
+  if (linearDefaultTeam) {
+    out.SWITCHROOM_LINEAR_DEFAULT_TEAM_ID = linearDefaultTeam;
+  }
   return out;
 }
 function buildRepoEnvVars(_agentName, agentDir, agent) {
@@ -52322,6 +52347,7 @@ function buildWorkspaceContext(args) {
     useSwitchroomPlugin: usesSwitchroomTelegramPlugin(agentConfig),
     useHotReloadStable: agentConfig.channels?.telegram?.hotReloadStable === true,
     telegramEnabledFlag: agentConfig.channels?.telegram?.enabled === false ? "false" : "true",
+    linearAgentEnabled: agentConfig.channels?.telegram?.linear_agent?.enabled === true,
     securityPluginDir: DOCKER_SECURITY_PLUGIN_PATH,
     hindsightEnabled: hindsightAutoRecallEnabled,
     hindsightBankIdQ: shellSingleQuote(hindsightBankId),
@@ -52333,7 +52359,7 @@ function buildWorkspaceContext(args) {
     hindsightTopicFilterMode,
     switchroomConfigPathQ: switchroomConfigPath ? shellSingleQuote(resolve11(switchroomConfigPath)) : undefined,
     hostHomeQ: process.env.HOME ? shellSingleQuote(process.env.HOME) : undefined,
-    modelQ: shellSingleQuote(agentConfig.model ?? SWITCHROOM_DEFAULT_MAIN_MODEL),
+    modelQ: shellSingleQuote(resolveMainModel(agentConfig.model)),
     ...buildCronSessionContext(agentConfig),
     thinkingEffort: agentConfig.thinking_effort ?? SWITCHROOM_DEFAULT_THINKING_EFFORT,
     permissionMode: agentConfig.permission_mode,
@@ -52633,7 +52659,7 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
         useSwitchroomPlugin: usesSwitchroomTelegramPlugin(agentConfig),
         configPath: switchroomConfigPath
       });
-      settings.model = agentConfig.model ?? SWITCHROOM_DEFAULT_MAIN_MODEL;
+      settings.model = resolveMainModel(agentConfig.model);
       const mergedSettings = agentConfig.settings_raw ? deepMergeJson(settings, agentConfig.settings_raw) : settings;
       if (agentConfig.settings_raw && Object.keys(agentConfig.settings_raw).length > 0) {
         mergedSettings._switchroomManagedRawKeys = Object.keys(agentConfig.settings_raw);
@@ -53424,7 +53450,7 @@ function reconcileAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchr
       hindsightTopicAliasesJsonQ: hindsightTopicAliasesJson ? shellSingleQuote(hindsightTopicAliasesJson) : undefined,
       hindsightTopicFilterMode,
       hostHomeQ: process.env.HOME ? shellSingleQuote(process.env.HOME) : undefined,
-      modelQ: shellSingleQuote(agentConfig.model ?? SWITCHROOM_DEFAULT_MAIN_MODEL),
+      modelQ: shellSingleQuote(resolveMainModel(agentConfig.model)),
       ...buildCronSessionContext(agentConfig),
       thinkingEffort: agentConfig.thinking_effort ?? SWITCHROOM_DEFAULT_THINKING_EFFORT,
       permissionMode: agentConfig.permission_mode,
@@ -53509,7 +53535,8 @@ function reconcileAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchr
         schedule: agentConfig.schedule,
         useSwitchroomPlugin: usesSwitchroomTelegramPlugin(agentConfig),
         admin: agentConfig.admin === true || agentConfig.root === true,
-        root: agentConfig.root === true
+        root: agentConfig.root === true,
+        linearAgentEnabled: agentConfig.channels?.telegram?.linear_agent?.enabled === true
       };
       let rendered = renderTemplate(claudeMdSrc, claudeContext);
       const vaultProtocol = renderVaultProtocolFragment(claudeContext);
@@ -53675,7 +53702,7 @@ ${body}
         }
       }
     }
-    settings.model = agentConfig.model ?? SWITCHROOM_DEFAULT_MAIN_MODEL;
+    settings.model = resolveMainModel(agentConfig.model);
     const mergedSettings = agentConfig.settings_raw ? deepMergeJson(settings, agentConfig.settings_raw) : settings;
     if (agentConfig.settings_raw && Object.keys(agentConfig.settings_raw).length > 0) {
       mergedSettings[META_KEY] = Object.keys(agentConfig.settings_raw);
@@ -67029,6 +67056,31 @@ import { createInterface as createInterface4 } from "node:readline";
 
 // src/cli/telegram-yaml.ts
 var import_yaml11 = __toESM(require_dist(), 1);
+function setLinearAgent(yamlText, agentName, opts) {
+  const doc = import_yaml11.parseDocument(yamlText);
+  ensureAgent(doc, agentName);
+  const block = { enabled: true, token: opts.token };
+  if (opts.workspaceId)
+    block.workspace_id = opts.workspaceId;
+  doc.setIn(["agents", agentName, "channels", "telegram", "linear_agent"], block);
+  doc.setIn(["agents", agentName, "channels", "telegram", "webhook_via_gateway"], true);
+  return String(doc);
+}
+function setLinearDefaultTeam(yamlText, agentName, teamId) {
+  const doc = import_yaml11.parseDocument(yamlText);
+  ensureAgent(doc, agentName);
+  if (!doc.hasIn(["agents", agentName, "channels", "telegram", "linear_agent"])) {
+    throw new Error(`agent '${agentName}' has no linear_agent block. Run 'switchroom linear-agent setup --agent ${agentName} --token <token>' first.`);
+  }
+  const path4 = ["agents", agentName, "channels", "telegram", "linear_agent", "default_team_id"];
+  if (teamId === null) {
+    if (doc.hasIn(path4))
+      doc.deleteIn(path4);
+  } else {
+    doc.setIn(path4, teamId);
+  }
+  return String(doc);
+}
 function setTelegramFeature(yamlText, agentName, feature, value) {
   const doc = import_yaml11.parseDocument(yamlText);
   ensureAgent(doc, agentName);
@@ -67587,6 +67639,123 @@ function promptHidden2(prompt) {
   });
 }
 
+// src/cli/linear-agent.ts
+init_source();
+init_helpers();
+import { readFileSync as readFileSync39, writeFileSync as writeFileSync22 } from "node:fs";
+function registerLinearAgentCommand(program3) {
+  const linear = program3.command("linear-agent").description("Install an agent into a Linear workspace as a first-class app actor (#2298) \u2014 @-mentionable, delegate-assignable, agent sessions wake it instantly.");
+  linear.command("setup").description("Provision <agent> as a Linear agent. Vault-stores the Linear OAuth app token (actor=app) under 'linear/<agent>/token' and enables the linear_agent block in switchroom.yaml. The OAuth browser authorize step is printed as instructions (it can't run headless); pass the already-obtained --token.").requiredOption("--agent <name>", "Agent name (must exist in switchroom.yaml)").requiredOption("--token <token>", "The Linear OAuth app token (actor=app), obtained out-of-band via the browser authorize step. Stored in the vault, never in switchroom.yaml.").option("--client-id <id>", "Linear OAuth app client id (for the printed authorize-URL hint).").option("--client-secret <secret>", "Linear OAuth app client secret (informational \u2014 not stored by this verb).").option("--redirect-uri <uri>", "OAuth redirect URI registered on the Linear app (for the authorize-URL hint).").option("--workspace-id <id>", "Optional Linear workspace (organization) id to record in config.").option("--webhook-base <url>", "Base URL of the switchroom web server (e.g. https://hooks.switchroom.ai). Used to print the webhook URL to register in Linear. Defaults to a placeholder.").option("--dry-run", "Print the YAML diff + instructions without writing or vaulting anything").action(withConfigError(async (opts) => {
+    if (!/^[a-z][a-z0-9_-]{0,63}$/.test(opts.agent)) {
+      fail2(`--agent must be a lowercase agent slug (got '${opts.agent}').`);
+    }
+    if (!opts.token || opts.token.trim().length === 0) {
+      fail2("--token must be a non-empty Linear app token.");
+    }
+    const vaultKey = `linear/${opts.agent}/token`;
+    if (!opts.dryRun) {
+      await vaultPut(program3, vaultKey, opts.token);
+    } else {
+      console.log(source_default.gray(`[dry-run] would store the Linear token in the vault as '${vaultKey}'`));
+    }
+    const path4 = getConfigPath(program3);
+    const before = readFileSync39(path4, "utf-8");
+    let after;
+    try {
+      after = setLinearAgent(before, opts.agent, {
+        token: `vault:${vaultKey}`,
+        ...opts.workspaceId ? { workspaceId: opts.workspaceId } : {}
+      });
+    } catch (err) {
+      fail2(err.message);
+    }
+    if (opts.dryRun) {
+      console.log(source_default.bold(`[dry-run] would edit ${path4}`));
+      console.log(makeUnifiedDiff2(before, after));
+    } else {
+      writeFileSync22(path4, after, "utf-8");
+      console.log(source_default.green(`\u2713 Enabled linear-agent for agent '${opts.agent}'`));
+      console.log(source_default.gray(`  Vault key: ${vaultKey}`));
+      console.log(source_default.gray(`  Run 'switchroom agent restart ${opts.agent}' to pick up the change.`));
+    }
+    printLinearInstructions(opts, vaultKey);
+  }));
+  linear.command("set-team").description("Set (or clear) the default Linear team captured issues file into for <agent>. Only needed when the workspace has multiple teams \u2014 a single-team workspace auto-resolves. Pass --clear to remove the default.").requiredOption("--agent <name>", "Agent name (must have a linear_agent block)").option("--team <id>", "Linear team id new captured issues default to.").option("--clear", "Remove the configured default team (revert to auto-resolve).").action(withConfigError(async (opts) => {
+    if (!/^[a-z][a-z0-9_-]{0,63}$/.test(opts.agent)) {
+      fail2(`--agent must be a lowercase agent slug (got '${opts.agent}').`);
+    }
+    if (!opts.clear && (!opts.team || opts.team.trim().length === 0)) {
+      fail2("pass either --team <id> or --clear.");
+    }
+    const path4 = getConfigPath(program3);
+    const before = readFileSync39(path4, "utf-8");
+    let after;
+    try {
+      after = setLinearDefaultTeam(before, opts.agent, opts.clear ? null : opts.team.trim());
+    } catch (err) {
+      fail2(err.message);
+    }
+    writeFileSync22(path4, after, "utf-8");
+    if (opts.clear) {
+      console.log(source_default.green(`\u2713 Cleared default Linear team for '${opts.agent}' (auto-resolve).`));
+    } else {
+      console.log(source_default.green(`\u2713 Default Linear team for '${opts.agent}' set to ${opts.team.trim()}.`));
+    }
+    console.log(source_default.gray(`  Run 'switchroom agent restart ${opts.agent}' to pick up the change.`));
+  }));
+}
+function printLinearInstructions(opts, vaultKey) {
+  const base = opts.webhookBase ?? "https://<your-switchroom-web-host>";
+  const webhookUrl = `${base.replace(/\/$/, "")}/webhook/${opts.agent}/linear`;
+  console.log("");
+  console.log(source_default.bold("Next steps in Linear (browser, one-time per agent):"));
+  console.log(source_default.gray("  1. Create / open your Linear OAuth app with actor=app and scopes"));
+  console.log(source_default.gray("     app:mentionable + app:assignable (https://linear.app/developers/agents)."));
+  if (opts.clientId) {
+    const redirect = opts.redirectUri ?? `${base.replace(/\/$/, "")}/oauth/callback`;
+    const authorizeUrl = `https://linear.app/oauth/authorize?` + `client_id=${encodeURIComponent(opts.clientId)}` + `&redirect_uri=${encodeURIComponent(redirect)}` + `&response_type=code` + `&scope=${encodeURIComponent("read,write,app:assignable,app:mentionable")}` + `&actor=app`;
+    console.log(source_default.gray("  2. Authorize the app as an actor (open in a browser):"));
+    console.log(source_default.cyan(`     ${authorizeUrl}`));
+    console.log(source_default.gray("     The redirect delivers the app token you pass to this verb via --token."));
+  } else {
+    console.log(source_default.gray("  2. Authorize the app (actor=app) in a browser; capture the app token and"));
+    console.log(source_default.gray("     re-run this verb with --token (and optionally --client-id to print the"));
+    console.log(source_default.gray("     authorize URL)."));
+  }
+  console.log(source_default.gray("  3. Register this webhook URL on the app (AgentSessionEvent + Issue/Comment):"));
+  console.log(source_default.cyan(`     ${webhookUrl}`));
+  console.log(source_default.gray("     Use Linear's signing secret as the webhook secret \u2014 store it in the vault " + `under webhook/${opts.agent}/linear (e.g. 'switchroom telegram enable webhook ` + `--agent ${opts.agent} --source linear --secret <signing-secret>').`));
+  console.log("");
+  console.log(source_default.gray(`  Token is read at runtime from vault:${vaultKey} (actor=app).`));
+}
+function makeUnifiedDiff2(before, after) {
+  const a = before.split(`
+`);
+  const b = after.split(`
+`);
+  const out = [];
+  let i = 0, j = 0;
+  while (i < a.length || j < b.length) {
+    if (i < a.length && j < b.length && a[i] === b[j]) {
+      out.push(`  ${a[i]}`);
+      i++;
+      j++;
+    } else if (j < b.length && (i >= a.length || a[i] !== b[j])) {
+      out.push(source_default.green(`+ ${b[j]}`));
+      j++;
+    } else {
+      out.push(source_default.red(`- ${a[i]}`));
+      i++;
+    }
+  }
+  return out.join(`
+`);
+}
+function fail2(msg) {
+  console.error(source_default.red(`Error: ${msg}`));
+  process.exit(1);
+}
+
 // src/cli/memory.ts
 init_source();
 init_hindsight();
@@ -67856,7 +68025,7 @@ async function ensureHindsightConsumer(configPath, account, uid = HINDSIGHT_DEFA
 // src/cli/memory.ts
 init_loader();
 var import_yaml12 = __toESM(require_dist(), 1);
-import { existsSync as existsSync44, readFileSync as readFileSync39, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync44, readFileSync as readFileSync40, writeFileSync as writeFileSync23 } from "node:fs";
 import { join as join39 } from "node:path";
 function readRecallLog(agentDir, limit) {
   const path4 = join39(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
@@ -67864,7 +68033,7 @@ function readRecallLog(agentDir, limit) {
     return [];
   let raw;
   try {
-    raw = readFileSync39(path4, "utf-8");
+    raw = readFileSync40(path4, "utf-8");
   } catch {
     return [];
   }
@@ -68059,7 +68228,7 @@ Cross-agent reflection plan
     const configPath = getConfigPath(program3);
     try {
       if (existsSync44(configPath)) {
-        const raw = readFileSync39(configPath, "utf-8");
+        const raw = readFileSync40(configPath, "utf-8");
         const doc = import_yaml12.default.parseDocument(raw);
         if (!doc.has("memory")) {
           doc.set("memory", { backend: "hindsight", shared_collection: "shared", config: { provider, url } });
@@ -68075,7 +68244,7 @@ Cross-agent reflection plan
             }
           }
         }
-        writeFileSync22(configPath, doc.toString(), "utf-8");
+        writeFileSync23(configPath, doc.toString(), "utf-8");
         console.log(source_default.gray(`  Updated ${configPath} with memory.config.url = ${url}`));
         console.log(source_default.gray("  Run `switchroom agent reconcile all --restart` to apply this to existing agents."));
       }
@@ -68168,7 +68337,7 @@ init_loader();
 init_client();
 init_lifecycle();
 import {
-  readFileSync as readFileSync45,
+  readFileSync as readFileSync46,
   existsSync as existsSync50,
   realpathSync as realpathSync4,
   mkdirSync as mkdirSync29,
@@ -68187,7 +68356,7 @@ init_lifecycle();
 init_manager();
 init_hindsight();
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync47, readFileSync as readFileSync42, statSync as statSync22 } from "node:fs";
+import { existsSync as existsSync47, readFileSync as readFileSync43, statSync as statSync22 } from "node:fs";
 import { resolve as resolve27 } from "node:path";
 init_audit_reader();
 
@@ -72695,8 +72864,8 @@ init_paths();
 import {
   existsSync as existsSync45,
   mkdirSync as mkdirSync25,
-  readFileSync as readFileSync40,
-  writeFileSync as writeFileSync23
+  readFileSync as readFileSync41,
+  writeFileSync as writeFileSync24
 } from "node:fs";
 import { dirname as dirname9 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
@@ -72716,7 +72885,7 @@ function getDistinctId() {
   const path4 = resolveStatePath("analytics-id");
   try {
     if (existsSync45(path4)) {
-      const existing = readFileSync40(path4, "utf-8").trim();
+      const existing = readFileSync41(path4, "utf-8").trim();
       if (existing) {
         cachedDistinctId = existing;
         return existing;
@@ -72727,7 +72896,7 @@ function getDistinctId() {
   cachedDistinctId = id;
   try {
     mkdirSync25(dirname9(path4), { recursive: true });
-    writeFileSync23(path4, id, "utf-8");
+    writeFileSync24(path4, id, "utf-8");
   } catch {}
   return id;
 }
@@ -72852,7 +73021,7 @@ function getAgentWorkspaceAccount(yamlText, provider, agent) {
 // src/web/config-edit-plan.ts
 init_schema();
 var import_yaml14 = __toESM(require_dist(), 1);
-import { readFileSync as readFileSync41 } from "node:fs";
+import { readFileSync as readFileSync42 } from "node:fs";
 
 class ConfigPlanError extends Error {
 }
@@ -72862,7 +73031,7 @@ function composeTransforms(...transforms) {
 function planConfigEdit(configPath, transform) {
   let before;
   try {
-    before = readFileSync41(configPath, "utf-8");
+    before = readFileSync42(configPath, "utf-8");
   } catch (err) {
     throw new ConfigPlanError(`could not read config: ${err.message}`);
   }
@@ -72893,7 +73062,7 @@ import {
   mkdirSync as mkdirSync26,
   mkdtempSync as mkdtemp,
   rmSync as rmrf,
-  writeFileSync as writeFileSync24
+  writeFileSync as writeFileSync25
 } from "node:fs";
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { tmpdir as tmpdir4 } from "node:os";
@@ -72908,8 +73077,8 @@ function generateUnifiedDiff(before, after, name = "switchroom.yaml", gitBin = "
   try {
     mkdirSync26(join41(dir, "cur"), { recursive: true });
     mkdirSync26(join41(dir, "new"), { recursive: true });
-    writeFileSync24(join41(dir, "cur", name), before);
-    writeFileSync24(join41(dir, "new", name), after);
+    writeFileSync25(join41(dir, "cur", name), before);
+    writeFileSync25(join41(dir, "new", name), after);
     const r = spawnSync4(gitBin, ["diff", "--no-index", "--no-color", "--", `cur/${name}`, `new/${name}`], { cwd: dir, encoding: "utf-8", timeout: 1e4 });
     if (r.status === 0)
       return "";
@@ -73546,7 +73715,7 @@ async function handleGetSystemHealth(config, home2) {
     const logPath = defaultAuditLogPath2(home2);
     if (existsSync47(logPath)) {
       hostd.auditLogPresent = true;
-      const raw = readFileSync42(logPath, "utf-8");
+      const raw = readFileSync43(logPath, "utf-8");
       hostd.recent = readAndFilter(raw, {}, 10);
     }
   } catch (err) {
@@ -73906,7 +74075,7 @@ async function handleGetMemoryHealth(config, opts) {
 }
 
 // src/web/webhook-handler.ts
-import { appendFileSync as appendFileSync4, existsSync as existsSync49, mkdirSync as mkdirSync28, readFileSync as readFileSync44, writeFileSync as writeFileSync25 } from "fs";
+import { appendFileSync as appendFileSync4, existsSync as existsSync49, mkdirSync as mkdirSync28, readFileSync as readFileSync45, writeFileSync as writeFileSync26 } from "fs";
 import { join as join45 } from "path";
 import { homedir as homedir24 } from "os";
 
@@ -74113,7 +74282,7 @@ function forwardToGateway(socketPath, req, opts = {}) {
 }
 
 // src/web/webhook-edge.ts
-import { existsSync as existsSync48, readFileSync as readFileSync43 } from "fs";
+import { existsSync as existsSync48, readFileSync as readFileSync44 } from "fs";
 import { join as join44 } from "path";
 import { homedir as homedir23 } from "os";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -74126,7 +74295,7 @@ function loadEdgeSecret(path4) {
   try {
     if (!existsSync48(p))
       return null;
-    const raw = readFileSync43(p, "utf-8").trim();
+    const raw = readFileSync44(p, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -74160,7 +74329,7 @@ function loadDedupFile(path4) {
   try {
     if (!existsSync49(path4))
       return {};
-    const raw = JSON.parse(readFileSync44(path4, "utf-8"));
+    const raw = JSON.parse(readFileSync45(path4, "utf-8"));
     return typeof raw.deliveries === "object" && raw.deliveries !== null ? raw.deliveries : {};
   } catch {
     return {};
@@ -74174,7 +74343,7 @@ function saveDedupFile(path4, deliveries, now) {
   }
   const sorted = Object.entries(pruned).sort((a, b) => b[1] - a[1]).slice(0, DEDUP_MAX);
   const final = Object.fromEntries(sorted);
-  writeFileSync25(path4, JSON.stringify({ deliveries: final }), {
+  writeFileSync26(path4, JSON.stringify({ deliveries: final }), {
     mode: 384
   });
 }
@@ -74443,7 +74612,7 @@ function resolveWebToken() {
   const home2 = process.env.HOME ?? homedir25();
   const tokenPath = join46(home2, ".switchroom", "web-token");
   if (existsSync50(tokenPath)) {
-    const existing = readFileSync45(tokenPath, "utf8").trim();
+    const existing = readFileSync46(tokenPath, "utf8").trim();
     if (existing.length > 0)
       return existing;
   }
@@ -74460,7 +74629,7 @@ function resolveWebToken() {
     return token;
   } catch (err) {
     if (err.code === "EEXIST") {
-      const existing = readFileSync45(tokenPath, "utf8").trim();
+      const existing = readFileSync46(tokenPath, "utf8").trim();
       if (existing.length > 0)
         return existing;
     }
@@ -74530,7 +74699,7 @@ function loadWebhookSecrets() {
   if (!existsSync50(path4))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync45(path4, "utf-8"));
+    const parsed = JSON.parse(readFileSync46(path4, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (err) {
     process.stderr.write(`webhook-ingest: failed to parse ${path4}: ${err.message} \u2014 webhooks will return 401 until fixed
@@ -74903,7 +75072,7 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
       }
       const ext = extname(realFullPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
-      const content = readFileSync45(realFullPath);
+      const content = readFileSync46(realFullPath);
       return new Response(content, {
         headers: { "Content-Type": contentType }
       });
@@ -75037,7 +75206,7 @@ Starting Switchroom dashboard...
 // src/cli/setup.ts
 init_source();
 init_loader();
-import { existsSync as existsSync51, copyFileSync as copyFileSync8, readFileSync as readFileSync46, writeFileSync as writeFileSync26, mkdirSync as mkdirSync30 } from "node:fs";
+import { existsSync as existsSync51, copyFileSync as copyFileSync8, readFileSync as readFileSync47, writeFileSync as writeFileSync27, mkdirSync as mkdirSync30 } from "node:fs";
 import { resolve as resolve29, dirname as dirname11 } from "node:path";
 init_vault();
 init_manager();
@@ -75766,10 +75935,10 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
     try {
       const yamlPath = existsSync51(resolve29(process.cwd(), "switchroom.yaml")) ? resolve29(process.cwd(), "switchroom.yaml") : resolve29(process.cwd(), "switchroom.yml");
       if (existsSync51(yamlPath)) {
-        const content = readFileSync46(yamlPath, "utf-8");
+        const content = readFileSync47(yamlPath, "utf-8");
         const result = insertVaultBrokerApprovalAuth(content, "telegram-id");
         if (result.kind === "rewritten") {
-          writeFileSync26(yamlPath, result.content, "utf-8");
+          writeFileSync27(yamlPath, result.content, "utf-8");
           console.log(source_default.green(`  ${STEP_DONE} Set vault.broker.approvalAuth: telegram-id in ${yamlPath}`));
         } else if (result.kind === "already-set") {
           console.log(source_default.gray("  approvalAuth already set \u2014 leaving it alone."));
@@ -75801,7 +75970,7 @@ async function stepDangerousMode(config, nonInteractive) {
     ];
     for (const configPath of configPaths) {
       if (existsSync51(configPath)) {
-        let content = readFileSync46(configPath, "utf-8");
+        let content = readFileSync47(configPath, "utf-8");
         const agentNames = Object.keys(config.agents);
         for (const name of agentNames) {
           const agentPattern = new RegExp(`(^  ${name}:\\s*\\n)`, "m");
@@ -75815,7 +75984,7 @@ async function stepDangerousMode(config, nonInteractive) {
           }
           config.agents[name].dangerous_mode = true;
         }
-        writeFileSync26(configPath, content, "utf-8");
+        writeFileSync27(configPath, content, "utf-8");
         console.log(source_default.green(`  ${STEP_DONE} Enabled dangerous_mode for all agents in ${configPath}`));
         break;
       }
@@ -75930,7 +76099,7 @@ init_doctor();
 init_source();
 init_loader();
 init_lifecycle();
-import { cpSync as cpSync2, existsSync as existsSync58, mkdirSync as mkdirSync32, readFileSync as readFileSync51, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync26 } from "node:fs";
+import { cpSync as cpSync2, existsSync as existsSync58, mkdirSync as mkdirSync32, readFileSync as readFileSync52, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync26 } from "node:fs";
 import { spawnSync as spawnSync9 } from "node:child_process";
 import { join as join60, dirname as dirname14, resolve as resolve33 } from "node:path";
 import { homedir as homedir36 } from "node:os";
@@ -75940,7 +76109,7 @@ function runningFromSwitchroomCheckout(scriptPath) {
   for (let i = 0;i < 12; i++) {
     if (existsSync58(join60(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync51(join60(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync52(join60(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -76208,7 +76377,7 @@ function defaultStatusProbe(composePath) {
         const pkgPath = join60(dir, "package.json");
         if (existsSync58(pkgPath)) {
           try {
-            const pkg = JSON.parse(readFileSync51(pkgPath, "utf-8"));
+            const pkg = JSON.parse(readFileSync52(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
               cliVersion = pkg.version;
           } catch (err) {
@@ -76424,7 +76593,7 @@ init_source();
 init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
-import { existsSync as existsSync59, readFileSync as readFileSync52 } from "node:fs";
+import { existsSync as existsSync59, readFileSync as readFileSync53 } from "node:fs";
 import { dirname as dirname15, join as join61 } from "node:path";
 function getClaudeCodeVersion() {
   try {
@@ -76478,7 +76647,7 @@ function locateSwitchroomInstallDir() {
     const pkgPath = join61(dir, "package.json");
     if (existsSync59(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync52(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync53(pkgPath, "utf-8"));
         if (pkg.name === "switchroom" && existsSync59(join61(dir, ".git"))) {
           return dir;
         }
@@ -76709,11 +76878,11 @@ import {
   mkdirSync as mkdirSync33,
   openSync as openSync11,
   readdirSync as readdirSync22,
-  readFileSync as readFileSync53,
+  readFileSync as readFileSync54,
   renameSync as renameSync12,
   statSync as statSync27,
   unlinkSync as unlinkSync11,
-  writeFileSync as writeFileSync27,
+  writeFileSync as writeFileSync28,
   writeSync as writeSync7
 } from "node:fs";
 import { join as join62 } from "node:path";
@@ -77119,7 +77288,7 @@ function readAll(stateDir) {
     return [];
   let raw;
   try {
-    raw = readFileSync53(path4, "utf-8");
+    raw = readFileSync54(path4, "utf-8");
   } catch {
     return [];
   }
@@ -77267,7 +77436,7 @@ function writeAll(stateDir, events) {
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
 `) + `
 `;
-  writeFileSync27(tmp, body, "utf-8");
+  writeFileSync28(tmp, body, "utf-8");
   renameSync12(tmp, path4);
 }
 var ORPHAN_TMP_TTL_MS = 60000;
@@ -77330,7 +77499,7 @@ function withLock(stateDir, fn) {
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync53(lockPath, "utf-8").trim();
+    pidStr = readFileSync54(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
@@ -77587,9 +77756,9 @@ import { createHash as createHash11 } from "node:crypto";
 import {
   existsSync as existsSync61,
   mkdirSync as mkdirSync34,
-  readFileSync as readFileSync54,
+  readFileSync as readFileSync55,
   rmSync as rmSync13,
-  writeFileSync as writeFileSync28
+  writeFileSync as writeFileSync29
 } from "node:fs";
 import { dirname as dirname16, join as join63 } from "node:path";
 import { homedir as homedir37 } from "node:os";
@@ -77607,7 +77776,7 @@ function defaultPythonCacheRoot() {
   return join63(homedir37(), ".switchroom", "deps", "python");
 }
 function hashFile(path4) {
-  return createHash11("sha256").update(readFileSync54(path4)).digest("hex");
+  return createHash11("sha256").update(readFileSync55(path4)).digest("hex");
 }
 function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
@@ -77623,7 +77792,7 @@ function ensurePythonEnv(opts) {
   const pipBin = join63(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
   if (!force && existsSync61(stampPath) && existsSync61(pythonBin)) {
-    const existingHash = readFileSync54(stampPath, "utf8").trim();
+    const existingHash = readFileSync55(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -77657,7 +77826,7 @@ function ensurePythonEnv(opts) {
     const e = err;
     throw new PythonEnvError(`Failed to install requirements for skill "${skillName}": ${e.message}`, e.stderr?.toString());
   }
-  writeFileSync28(stampPath, targetHash + `
+  writeFileSync29(stampPath, targetHash + `
 `);
   return {
     skillName,
@@ -77675,9 +77844,9 @@ import {
   copyFileSync as copyFileSync9,
   existsSync as existsSync62,
   mkdirSync as mkdirSync35,
-  readFileSync as readFileSync55,
+  readFileSync as readFileSync56,
   rmSync as rmSync14,
-  writeFileSync as writeFileSync29
+  writeFileSync as writeFileSync30
 } from "node:fs";
 import { dirname as dirname17, join as join64 } from "node:path";
 import { homedir as homedir38 } from "node:os";
@@ -77710,7 +77879,7 @@ function hashDepInputs(packageJsonPath) {
   const hasher = createHash12("sha256");
   hasher.update(`package.json
 `);
-  hasher.update(readFileSync55(packageJsonPath));
+  hasher.update(readFileSync56(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
     const lockPath = join64(sourceDir, lockName);
     if (existsSync62(lockPath)) {
@@ -77719,7 +77888,7 @@ function hashDepInputs(packageJsonPath) {
       hasher.update(lockName);
       hasher.update(`
 `);
-      hasher.update(readFileSync55(lockPath));
+      hasher.update(readFileSync56(lockPath));
     }
   }
   return hasher.digest("hex");
@@ -77738,7 +77907,7 @@ function ensureNodeEnv(opts) {
   const binDir = join64(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
   if (!force && existsSync62(stampPath) && existsSync62(nodeModulesDir)) {
-    const existingHash = readFileSync55(stampPath, "utf8").trim();
+    const existingHash = readFileSync56(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -77774,7 +77943,7 @@ function ensureNodeEnv(opts) {
     const e = err;
     throw new NodeEnvError(`Failed to install node deps for skill "${skillName}" with ${installer}: ${e.message}`, e.stderr?.toString());
   }
-  writeFileSync29(stampPath, targetHash + `
+  writeFileSync30(stampPath, targetHash + `
 `);
   return {
     skillName,
@@ -78757,7 +78926,7 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync10, existsSync as existsSync65, readFileSync as readFileSync56, writeFileSync as writeFileSync30 } from "node:fs";
+import { copyFileSync as copyFileSync10, existsSync as existsSync65, readFileSync as readFileSync57, writeFileSync as writeFileSync31 } from "node:fs";
 import { join as join66, resolve as resolve39 } from "node:path";
 init_schema();
 function resolveSoulTargetOrExit(program3, agentName) {
@@ -78803,7 +78972,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
-    process.stdout.write(readFileSync56(t.soulPath, "utf-8"));
+    process.stdout.write(readFileSync57(t.soulPath, "utf-8"));
   }));
   cmd.command("reset <agent>").description("Re-seed SOUL.md from the agent's current profile " + "(backs the existing file up to SOUL.md.bak first)").option("-y, --yes", "Skip the confirmation prompt").action(withConfigError(async (agentName, opts) => {
     const t = resolveSoulTargetOrExit(program3, agentName);
@@ -78834,7 +79003,7 @@ function registerSoulCommand(program3) {
       }
       copyFileSync10(t.soulPath, backupPath);
     }
-    writeFileSync30(t.soulPath, content, "utf-8");
+    writeFileSync31(t.soulPath, content, "utf-8");
     if (backupPath) {
       console.log(`soul: re-seeded ${agentName}'s SOUL.md from profile ` + `"${t.profileName}".
 ` + `      Previous version saved to ${backupPath}`);
@@ -78848,7 +79017,7 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync66, readFileSync as readFileSync57, readdirSync as readdirSync23, statSync as statSync28 } from "node:fs";
+import { existsSync as existsSync66, readFileSync as readFileSync58, readdirSync as readdirSync23, statSync as statSync28 } from "node:fs";
 import { resolve as resolve40, join as join67 } from "node:path";
 import { createHash as createHash13 } from "node:crypto";
 init_merge();
@@ -78864,7 +79033,7 @@ function readMcpServerNames(agentDir) {
   if (!existsSync66(mcpPath))
     return [];
   try {
-    const parsed = JSON.parse(readFileSync57(mcpPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync58(mcpPath, "utf-8"));
     return Object.keys(parsed.mcpServers ?? {});
   } catch {
     return null;
@@ -78899,7 +79068,7 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
 }
 function extractLatestUserMessage(transcriptPath) {
   try {
-    const content = readFileSync57(transcriptPath, "utf-8");
+    const content = readFileSync58(transcriptPath, "utf-8");
     const lines = content.trim().split(`
 `).filter(Boolean);
     for (let i = lines.length - 1;i >= 0; i--) {
@@ -79003,7 +79172,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Append System Prompt (per-session) ===
 `);
-    const handoffContent = existsSync66(handoffPath) ? readFileSync57(handoffPath, "utf-8") : "";
+    const handoffContent = existsSync66(handoffPath) ? readFileSync58(handoffPath, "utf-8") : "";
     if (handoffContent.trim().length > 0) {
       console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
       console.log(handoffContent);
@@ -79014,7 +79183,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
 `);
-    const claudeMdContent = existsSync66(claudeMdPath) ? readFileSync57(claudeMdPath, "utf-8") : "";
+    const claudeMdContent = existsSync66(claudeMdPath) ? readFileSync58(claudeMdPath, "utf-8") : "";
     if (claudeMdContent.trim().length > 0) {
       console.log(`(${formatBytes(claudeMdContent.length)})`);
       console.log(claudeMdContent);
@@ -79025,7 +79194,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Persona (SOUL.md) ===
 `);
-    const soulMdContent = existsSync66(soulMdPath) ? readFileSync57(soulMdPath, "utf-8") : existsSync66(workspaceSoulMdPath) ? readFileSync57(workspaceSoulMdPath, "utf-8") : "";
+    const soulMdContent = existsSync66(soulMdPath) ? readFileSync58(soulMdPath, "utf-8") : existsSync66(workspaceSoulMdPath) ? readFileSync58(workspaceSoulMdPath, "utf-8") : "";
     if (soulMdContent.trim().length > 0) {
       console.log(`(${formatBytes(soulMdContent.length)})`);
       console.log(soulMdContent);
@@ -79089,8 +79258,8 @@ function registerDebugCommand(program3) {
     const fleetDir = join67(agentsDir, "..", "fleet");
     const fleetInvPath = join67(fleetDir, "switchroom-invariants.md");
     const fleetClaudePath = join67(fleetDir, "CLAUDE.md");
-    const fleetInvBytes = existsSync66(fleetInvPath) ? readFileSync57(fleetInvPath, "utf-8").length : 0;
-    const fleetClaudeBytes = existsSync66(fleetClaudePath) ? readFileSync57(fleetClaudePath, "utf-8").length : 0;
+    const fleetInvBytes = existsSync66(fleetInvPath) ? readFileSync58(fleetInvPath, "utf-8").length : 0;
+    const fleetClaudeBytes = existsSync66(fleetClaudePath) ? readFileSync58(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
     const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
     console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
@@ -79131,8 +79300,8 @@ import { randomBytes as randomBytes13 } from "node:crypto";
 // src/worktree/registry.ts
 import {
   mkdirSync as mkdirSync36,
-  writeFileSync as writeFileSync31,
-  readFileSync as readFileSync58,
+  writeFileSync as writeFileSync32,
+  readFileSync as readFileSync59,
   readdirSync as readdirSync24,
   unlinkSync as unlinkSync12,
   existsSync as existsSync67,
@@ -79153,14 +79322,14 @@ function writeRecord(record2) {
   ensureDir2();
   const target = recordPath(record2.id);
   const tmp = `${target}.tmp${process.pid}`;
-  writeFileSync31(tmp, JSON.stringify(record2, null, 2) + `
+  writeFileSync32(tmp, JSON.stringify(record2, null, 2) + `
 `, { mode: 384 });
   renameSync13(tmp, target);
 }
 function readRecord(id) {
   const path7 = recordPath(id);
   try {
-    const raw = readFileSync58(path7, "utf8");
+    const raw = readFileSync59(path7, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -79525,7 +79694,7 @@ import {
   mkdirSync as mkdirSync38,
   readdirSync as readdirSync25,
   rmSync as rmSync15,
-  writeFileSync as writeFileSync32
+  writeFileSync as writeFileSync33
 } from "node:fs";
 import { join as join70 } from "node:path";
 function encodeCredentialsFilename(email) {
@@ -79727,7 +79896,7 @@ function writeSeedFile(dir, email, seed) {
   }
   const filename = encodeCredentialsFilename(email);
   const filePath = join70(dir, filename);
-  writeFileSync32(filePath, JSON.stringify(seed), { mode: 384 });
+  writeFileSync33(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync9(filePath, 384);
   return filePath;
 }
@@ -79885,7 +80054,7 @@ function registerDriveMcpLauncherCommand(program3) {
 // src/cli/m365-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
-import { writeFileSync as writeFileSync33, mkdirSync as mkdirSync39 } from "node:fs";
+import { writeFileSync as writeFileSync34, mkdirSync as mkdirSync39 } from "node:fs";
 import { dirname as dirname18, join as join71 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
@@ -79912,7 +80081,7 @@ function writeRefreshHeartbeat(agentName, data) {
   const path7 = heartbeatPath(agentName);
   try {
     mkdirSync39(dirname18(path7), { recursive: true });
-    writeFileSync33(path7, JSON.stringify(data, null, 2), { mode: 420 });
+    writeFileSync34(path7, JSON.stringify(data, null, 2), { mode: 420 });
   } catch {}
 }
 function heartbeatPath(agentName) {
@@ -80103,7 +80272,7 @@ function registerM365McpLauncherCommand(program3) {
 // src/cli/notion-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn7 } from "node:child_process";
-import { existsSync as existsSync71, mkdirSync as mkdirSync40, writeFileSync as writeFileSync34 } from "node:fs";
+import { existsSync as existsSync71, mkdirSync as mkdirSync40, writeFileSync as writeFileSync35 } from "node:fs";
 import { dirname as dirname19 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
 var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
@@ -80117,7 +80286,7 @@ function defaultWriteHeartbeat(path7, contents) {
     const dir = dirname19(path7);
     if (!existsSync71(dir))
       mkdirSync40(dir, { recursive: true });
-    writeFileSync34(path7, contents);
+    writeFileSync35(path7, contents);
   } catch {}
 }
 async function runNotionMcpLauncher(opts, runtime) {
@@ -80227,7 +80396,7 @@ function registerNotionMcpLauncherCommand(program3) {
 
 // src/cli/deliver-file.ts
 init_client2();
-import { readFileSync as readFileSync59, statSync as statSync29 } from "node:fs";
+import { readFileSync as readFileSync60, statSync as statSync29 } from "node:fs";
 import { basename as basename8 } from "node:path";
 
 // src/delivery/onedrive.ts
@@ -80567,7 +80736,7 @@ async function defaultResolveProvider() {
 async function runDeliverFile(localPath, deps = {}) {
   const agentName = safeAgentName(deps.agentName ?? process.env.SWITCHROOM_AGENT_NAME);
   const sizeOf = deps.fileSize ?? ((p) => statSync29(p).size);
-  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync59(p)));
+  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync60(p)));
   const resolveProvider = deps.resolveProvider ?? defaultResolveProvider;
   let size;
   try {
@@ -80857,7 +81026,7 @@ async function fetchToken(vaultKey) {
 
 // src/cli/apply.ts
 init_source();
-import { accessSync as accessSync3, chownSync as chownSync5, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync74, mkdirSync as mkdirSync42, readFileSync as readFileSync61, readdirSync as readdirSync26, renameSync as renameSync14, writeFileSync as writeFileSync36 } from "node:fs";
+import { accessSync as accessSync3, chownSync as chownSync5, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync74, mkdirSync as mkdirSync42, readFileSync as readFileSync62, readdirSync as readdirSync26, renameSync as renameSync14, writeFileSync as writeFileSync37 } from "node:fs";
 import { mkdir as mkdir2 } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
@@ -81254,7 +81423,7 @@ init_loader();
 init_loader();
 
 // src/cli/update-prompt-hook.ts
-import { existsSync as existsSync72, readFileSync as readFileSync60, writeFileSync as writeFileSync35, chmodSync as chmodSync10, mkdirSync as mkdirSync41 } from "node:fs";
+import { existsSync as existsSync72, readFileSync as readFileSync61, writeFileSync as writeFileSync36, chmodSync as chmodSync10, mkdirSync as mkdirSync41 } from "node:fs";
 import { join as join72 } from "node:path";
 var HOOK_FILENAME = "update-card-on-prompt.sh";
 function updatePromptHookScript() {
@@ -81326,9 +81495,9 @@ function installUpdatePromptHook(agentDir) {
   const scriptPath = join72(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
-  const existing = existsSync72(scriptPath) ? readFileSync60(scriptPath, "utf-8") : "";
+  const existing = existsSync72(scriptPath) ? readFileSync61(scriptPath, "utf-8") : "";
   if (existing !== desired) {
-    writeFileSync35(scriptPath, desired, { mode: 493 });
+    writeFileSync36(scriptPath, desired, { mode: 493 });
     chmodSync10(scriptPath, 493);
     installed = true;
   } else {
@@ -81340,7 +81509,7 @@ function installUpdatePromptHook(agentDir) {
   if (!existsSync72(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
-  const raw = readFileSync60(settingsPath, "utf-8");
+  const raw = readFileSync61(settingsPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -81373,7 +81542,7 @@ function installUpdatePromptHook(agentDir) {
     });
     hooks.UserPromptSubmit = list2;
     parsed.hooks = hooks;
-    writeFileSync35(settingsPath, JSON.stringify(parsed, null, 2) + `
+    writeFileSync36(settingsPath, JSON.stringify(parsed, null, 2) + `
 `, { mode: 384 });
     installed = true;
   }
@@ -81496,24 +81665,24 @@ async function ensureHostMountSources(config) {
   }
   const autoUnlockPath = join74(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync74(autoUnlockPath)) {
-    writeFileSync36(autoUnlockPath, "", { mode: 384 });
+    writeFileSync37(autoUnlockPath, "", { mode: 384 });
   }
   const auditLogPath = join74(home2, ".switchroom", "vault-audit.log");
   if (!existsSync74(auditLogPath)) {
-    writeFileSync36(auditLogPath, "", { mode: 420 });
+    writeFileSync37(auditLogPath, "", { mode: 420 });
   }
   const grantsDbPath = join74(home2, ".switchroom", "vault-grants.db");
   if (!existsSync74(grantsDbPath)) {
-    writeFileSync36(grantsDbPath, "", { mode: 384 });
+    writeFileSync37(grantsDbPath, "", { mode: 384 });
   }
   const hostdAuditLogPath = join74(home2, ".switchroom", "host-control-audit.log");
   if (!existsSync74(hostdAuditLogPath)) {
-    writeFileSync36(hostdAuditLogPath, "", { mode: 420 });
+    writeFileSync37(hostdAuditLogPath, "", { mode: 420 });
   }
   for (const name of Object.keys(config.agents)) {
     const tokenPath = join74(home2, ".switchroom", "agents", name, ".vault-token");
     if (!existsSync74(tokenPath)) {
-      writeFileSync36(tokenPath, "", { mode: 384 });
+      writeFileSync37(tokenPath, "", { mode: 384 });
     }
     try {
       const uid = allocateAgentUid(name);
@@ -81524,13 +81693,13 @@ async function ensureHostMountSources(config) {
   await mkdir2(fleetDir, { recursive: true });
   const invariantsPath = join74(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
-  const invariantsCurrent = existsSync74(invariantsPath) ? readFileSync61(invariantsPath, "utf-8") : null;
+  const invariantsCurrent = existsSync74(invariantsPath) ? readFileSync62(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
-    writeFileSync36(invariantsPath, invariantsCanonical, { mode: 420 });
+    writeFileSync37(invariantsPath, invariantsCanonical, { mode: 420 });
   }
   const fleetClaudePath = join74(fleetDir, "CLAUDE.md");
   if (!existsSync74(fleetClaudePath)) {
-    writeFileSync36(fleetClaudePath, [
+    writeFileSync37(fleetClaudePath, [
       "# Switchroom fleet defaults",
       "",
       "Operator-owned fleet brain. Every agent reads this via",
@@ -81622,7 +81791,7 @@ function writeInstallTypeCache(homeDir = homedir43()) {
     detected_at: new Date().toISOString(),
     source_paths: ctx.source_paths
   };
-  writeFileSync36(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
+  writeFileSync37(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
   renameSync14(tmp, out);
   return out;
 }
@@ -81818,10 +81987,10 @@ Done. Scaffolded ${scaffolded}/${allAgentNames.length} agents.
   };
 }
 function formatScaffoldFailureResolution(failures, scaffolded, agentsTotal) {
-  const fail2 = failures.length;
+  const fail3 = failures.length;
   const lines = [];
   lines.push("");
-  lines.push(`ERROR: Scaffolded ${scaffolded}/${agentsTotal} agents. ${fail2} failed.`);
+  lines.push(`ERROR: Scaffolded ${scaffolded}/${agentsTotal} agents. ${fail3} failed.`);
   lines.push("");
   lines.push("Per-agent state dirs are mode 0700 owned by per-agent UIDs (the v0.7+");
   lines.push("docker model). The operator cannot write into them without privilege");
@@ -81854,7 +82023,7 @@ function copyExampleConfig2(name) {
   }
   const embedded = EMBEDDED_EXAMPLES[name];
   if (embedded !== undefined) {
-    writeFileSync36(dest, embedded, { encoding: "utf8" });
+    writeFileSync37(dest, embedded, { encoding: "utf8" });
     console.log(source_default.green(`Copied ${name}.yaml -> switchroom.yaml`));
     return;
   }
@@ -82049,7 +82218,7 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync62, existsSync as existsSync75, readdirSync as readdirSync27 } from "node:fs";
+import { readFileSync as readFileSync63, existsSync as existsSync75, readdirSync as readdirSync27 } from "node:fs";
 import { join as join75 } from "node:path";
 import { homedir as homedir44 } from "node:os";
 
@@ -82325,7 +82494,7 @@ function runReport(opts) {
   for (const src of sources) {
     let content;
     try {
-      content = readFileSync62(src.path, "utf-8");
+      content = readFileSync63(src.path, "utf-8");
     } catch (err) {
       process.stderr.write(`status-ask report: cannot read ${src.path}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -82430,7 +82599,7 @@ import {
   mkdirSync as mkdirSync43,
   openSync as openSync13,
   readdirSync as readdirSync28,
-  readFileSync as readFileSync63,
+  readFileSync as readFileSync64,
   renameSync as renameSync15,
   statSync as statSync30,
   unlinkSync as unlinkSync14,
@@ -82554,7 +82723,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
       continue;
     const full = join76(paths.skillsDir, name);
     try {
-      const raw = readFileSync63(full, "utf-8");
+      const raw = readFileSync64(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -82581,7 +82750,7 @@ function listOverlayEntries(agent, opts = {}) {
       continue;
     const full = join76(paths.scheduleDir, name);
     try {
-      const raw = readFileSync63(full, "utf-8");
+      const raw = readFileSync64(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -82729,10 +82898,10 @@ import {
   mkdirSync as mkdirSync44,
   openSync as openSync14,
   readdirSync as readdirSync29,
-  readFileSync as readFileSync64,
+  readFileSync as readFileSync65,
   renameSync as renameSync16,
   unlinkSync as unlinkSync15,
-  writeFileSync as writeFileSync37,
+  writeFileSync as writeFileSync38,
   writeSync as writeSync9
 } from "node:fs";
 import { join as join77 } from "node:path";
@@ -82775,7 +82944,7 @@ function stagePendingScheduleEntry(opts) {
     }
     renameSync16(yamlTmp, yamlPath);
   }
-  writeFileSync37(metaPath, JSON.stringify(meta, null, 2) + `
+  writeFileSync38(metaPath, JSON.stringify(meta, null, 2) + `
 `, { mode: 384 });
   return { stageId, yamlPath, metaPath };
 }
@@ -82793,7 +82962,7 @@ function listPendingScheduleEntries(agent, opts = {}) {
     if (!existsSync77(yamlPath))
       continue;
     try {
-      const meta = JSON.parse(readFileSync64(metaPath, "utf-8"));
+      const meta = JSON.parse(readFileSync65(metaPath, "utf-8"));
       if (meta?.v !== 1 || typeof meta.stage_id !== "string")
         continue;
       out.push({ stageId: meta.stage_id, agent: meta.agent, yamlPath, metaPath, meta });
@@ -82831,7 +83000,7 @@ function denyPendingScheduleEntry(opts) {
 }
 
 // src/cli/agent-config-write.ts
-import { existsSync as existsSync78, readFileSync as readFileSync65 } from "node:fs";
+import { existsSync as existsSync78, readFileSync as readFileSync66 } from "node:fs";
 import { execFileSync as execFileSync25 } from "node:child_process";
 
 // src/scheduler/schedule-report.ts
@@ -83199,7 +83368,7 @@ function scheduleRemove(opts) {
   let priorContent = null;
   try {
     if (existsSync78(match.path))
-      priorContent = readFileSync65(match.path, "utf-8");
+      priorContent = readFileSync66(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
   const reconcileFn = opts.reconcile === undefined ? opts.root ? null : reconcileAgentCronOnly : opts.reconcile;
@@ -83402,7 +83571,7 @@ function registerAgentConfigWriteCommands(program3) {
     }
     let blob;
     if (opts.jsonl) {
-      blob = existsSync78(opts.jsonl) ? readFileSync65(opts.jsonl, "utf-8") : "";
+      blob = existsSync78(opts.jsonl) ? readFileSync66(opts.jsonl, "utf-8") : "";
     } else {
       try {
         blob = execFileSync25("docker", ["exec", `switchroom-${agent}`, "cat", "/state/agent/scheduler.jsonl"], {
@@ -83682,13 +83851,13 @@ import {
   mkdirSync as mkdirSync45,
   mkdtempSync as mkdtempSync5,
   openSync as openSync15,
-  readFileSync as readFileSync66,
+  readFileSync as readFileSync67,
   readdirSync as readdirSync30,
   realpathSync as realpathSync7,
   renameSync as renameSync17,
   rmSync as rmSync16,
   statSync as statSync31,
-  writeFileSync as writeFileSync38
+  writeFileSync as writeFileSync39
 } from "node:fs";
 import { tmpdir as tmpdir5, homedir as homedir45 } from "node:os";
 import { dirname as dirname23, join as join79, relative as relative2, resolve as resolve46 } from "node:path";
@@ -83918,7 +84087,7 @@ function isTarballPath(p) {
 function loadFromDir(dir) {
   const abs = realpathSync7(dir);
   if (!statSync31(abs).isDirectory()) {
-    fail2(`--from path is not a directory: ${dir}`);
+    fail3(`--from path is not a directory: ${dir}`);
   }
   const files = {};
   const walk2 = (sub) => {
@@ -83927,14 +84096,14 @@ function loadFromDir(dir) {
       const full = join79(sub, ent.name);
       const rel = relative2(abs, full);
       if (ent.isSymbolicLink()) {
-        fail2(`refusing to read symlink inside --from dir: ${rel}`);
+        fail3(`refusing to read symlink inside --from dir: ${rel}`);
       }
       if (ent.isDirectory()) {
         walk2(full);
         continue;
       }
       if (ent.isFile()) {
-        const buf = readFileSync66(full);
+        const buf = readFileSync67(full);
         files[rel.replace(/\\/g, "/")] = buf.toString("utf-8");
       }
     }
@@ -83950,13 +84119,13 @@ function loadFromTarball(tarPath) {
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (list2.status !== 0) {
-    fail2(`tar list failed (exit ${list2.status}): ${(list2.stderr ?? "").trim()}`);
+    fail3(`tar list failed (exit ${list2.status}): ${(list2.stderr ?? "").trim()}`);
   }
   const entries = (list2.stdout ?? "").split(`
 `).map((s) => s.trim()).filter((s) => s.length > 0 && !s.endsWith("/"));
   for (const entry of entries) {
     if (!validateRelPath(entry)) {
-      fail2(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
+      fail3(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
   const staging = mkdtempSync5(join79(tmpdir5(), "skill-apply-extract-"));
@@ -83973,7 +84142,7 @@ function loadFromTarball(tarPath) {
     ], { stdio: "pipe" });
     if (r.status !== 0) {
       const stderr = r.stderr?.toString("utf-8") ?? "(no stderr)";
-      fail2(`tar extraction failed (exit ${r.status}): ${stderr.trim()}`);
+      fail3(`tar extraction failed (exit ${r.status}): ${stderr.trim()}`);
     }
     return loadFromDir(staging);
   } finally {
@@ -83983,13 +84152,13 @@ function loadFromTarball(tarPath) {
   }
 }
 function loadSingleFile(filePath) {
-  const content = readFileSync66(filePath, "utf-8");
+  const content = readFileSync67(filePath, "utf-8");
   return { "SKILL.md": content };
 }
 function loadFromStdin() {
   const content = readStdinSync();
   if (content.length === 0) {
-    fail2("no content on stdin; either pipe SKILL.md content in or pass --from");
+    fail3("no content on stdin; either pipe SKILL.md content in or pass --from");
   }
   return { "SKILL.md": content };
 }
@@ -84048,7 +84217,7 @@ function validatePayload(name, files) {
         const tmp = mkdtempSync5(join79(tmpdir5(), "skill-apply-py-"));
         const tmpPy = join79(tmp, "check.py");
         try {
-          writeFileSync38(tmpPy, content);
+          writeFileSync39(tmpPy, content);
           const r = spawnSync11("python3", ["-m", "py_compile", tmpPy], {
             encoding: "utf-8"
           });
@@ -84074,7 +84243,7 @@ function diffSummary(currentDir, files) {
         if (ent.isDirectory()) {
           walk2(full);
         } else if (ent.isFile()) {
-          currentFiles[rel.replace(/\\/g, "/")] = readFileSync66(full, "utf-8");
+          currentFiles[rel.replace(/\\/g, "/")] = readFileSync67(full, "utf-8");
         }
       }
     };
@@ -84114,7 +84283,7 @@ function writePayload(poolDir, name, files) {
     }
   } catch {}
   if (targetIsSymlink) {
-    fail2(`refusing to overwrite symlink at ${target}; investigate manually`);
+    fail3(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
   const staging = mkdtempSync5(join79(poolDir, `.skill-apply-stage-${name}-`));
   let oldRename = null;
@@ -84124,7 +84293,7 @@ function writePayload(poolDir, name, files) {
       mkdirSync45(dirname23(full), { recursive: true, mode: 493 });
       const fd = openSync15(full, "wx");
       try {
-        writeFileSync38(fd, content);
+        writeFileSync39(fd, content);
       } finally {
         closeSync15(fd);
       }
@@ -84162,7 +84331,7 @@ function writePayload(poolDir, name, files) {
     throw err2;
   }
 }
-function fail2(msg) {
+function fail3(msg) {
   console.error(source_default.red(`error: ${msg}`));
   process.exit(2);
 }
@@ -84175,7 +84344,7 @@ function registerSkillCommand(program3) {
     } else {
       const fromPath = resolve46(opts.from);
       if (!existsSync80(fromPath)) {
-        fail2(`--from path does not exist: ${opts.from}`);
+        fail3(`--from path does not exist: ${opts.from}`);
       }
       const st = statSync31(fromPath);
       if (st.isDirectory()) {
@@ -84185,7 +84354,7 @@ function registerSkillCommand(program3) {
       } else if (fromPath.endsWith(".md")) {
         files = loadSingleFile(fromPath);
       } else {
-        fail2(`--from must be a directory, a .tar/.tar.gz/.tgz tarball, or a ` + `.md file. Got: ${opts.from}`);
+        fail3(`--from must be a directory, a .tar/.tar.gz/.tgz tarball, or a ` + `.md file. Got: ${opts.from}`);
       }
     }
     const v = validatePayload(name, files);
@@ -84234,13 +84403,13 @@ import {
   mkdirSync as mkdirSync46,
   mkdtempSync as mkdtempSync6,
   openSync as openSync16,
-  readFileSync as readFileSync67,
+  readFileSync as readFileSync68,
   readdirSync as readdirSync31,
   renameSync as renameSync18,
   rmSync as rmSync17,
   statSync as statSync32,
   utimesSync,
-  writeFileSync as writeFileSync39
+  writeFileSync as writeFileSync40
 } from "node:fs";
 import { dirname as dirname24, join as join80, relative as relative3, resolve as resolve47 } from "node:path";
 import { homedir as homedir46, tmpdir as tmpdir6 } from "node:os";
@@ -84316,7 +84485,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
         if (ent.isDirectory())
           walk2(s, d);
         else if (ent.isFile()) {
-          writeFileSync39(d, readFileSync67(s));
+          writeFileSync40(d, readFileSync68(s));
         }
       }
     };
@@ -84331,7 +84500,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
 `));
   }
 }
-function fail3(msg, exit = 2) {
+function fail4(msg, exit = 2) {
   console.error(source_default.red(`error: ${msg}`));
   process.exit(exit);
 }
@@ -84339,10 +84508,10 @@ function resolveAgent(opts) {
   const fromEnv = process.env.SWITCHROOM_AGENT_NAME;
   const agent = opts.agent ?? fromEnv;
   if (!agent) {
-    fail3("agent name required: pass --agent <name>, or set SWITCHROOM_AGENT_NAME " + "in the calling environment (set by switchroom for in-container agents).");
+    fail4("agent name required: pass --agent <name>, or set SWITCHROOM_AGENT_NAME " + "in the calling environment (set by switchroom for in-container agents).");
   }
   if (!SKILL_SLUG_RE.test(agent)) {
-    fail3(`agent name has invalid shape: ${JSON.stringify(agent)}`);
+    fail4(`agent name has invalid shape: ${JSON.stringify(agent)}`);
   }
   return agent;
 }
@@ -84380,14 +84549,14 @@ function readStdinSync2() {
 function loadFromDir2(dir) {
   const abs = resolve47(dir);
   if (!statSync32(abs).isDirectory()) {
-    fail3(`--from path is not a directory: ${dir}`);
+    fail4(`--from path is not a directory: ${dir}`);
   }
   const files = {};
   const walk2 = (sub) => {
     for (const ent of readdirSync31(sub, { withFileTypes: true })) {
       const full = join80(sub, ent.name);
       if (ent.isSymbolicLink()) {
-        fail3(`refusing to read symlink in --from dir: ${relative3(abs, full)}`);
+        fail4(`refusing to read symlink in --from dir: ${relative3(abs, full)}`);
       }
       if (ent.isDirectory()) {
         walk2(full);
@@ -84395,7 +84564,7 @@ function loadFromDir2(dir) {
       }
       if (ent.isFile()) {
         const rel = relative3(abs, full).replace(/\\/g, "/");
-        files[rel] = readFileSync67(full, "utf-8");
+        files[rel] = readFileSync68(full, "utf-8");
       }
     }
   };
@@ -84405,7 +84574,7 @@ function loadFromDir2(dir) {
 function loadFromStdin2() {
   const raw = readStdinSync2();
   if (raw.length === 0) {
-    fail3("no content on stdin; pipe a SKILL.md or JSON file-map");
+    fail4("no content on stdin; pipe a SKILL.md or JSON file-map");
   }
   const trimmed = raw.trimStart();
   if (trimmed.startsWith("{")) {
@@ -84413,15 +84582,15 @@ function loadFromStdin2() {
     try {
       parsed = JSON.parse(raw);
     } catch (err2) {
-      fail3(`stdin starts with '{' but is not valid JSON: ${err2.message}`);
+      fail4(`stdin starts with '{' but is not valid JSON: ${err2.message}`);
     }
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-      fail3("stdin JSON must be an object of {path: content, ...}");
+      fail4("stdin JSON must be an object of {path: content, ...}");
     }
     const files = {};
     for (const [k, v] of Object.entries(parsed)) {
       if (typeof v !== "string") {
-        fail3(`stdin JSON: value for ${JSON.stringify(k)} must be a string`);
+        fail4(`stdin JSON: value for ${JSON.stringify(k)} must be a string`);
       }
       files[k] = v;
     }
@@ -84441,7 +84610,7 @@ function behavioralValidate(files) {
       const tmp = mkdtempSync6(join80(tmpdir6(), "skill-personal-py-"));
       const tmpPy = join80(tmp, "check.py");
       try {
-        writeFileSync39(tmpPy, content);
+        writeFileSync40(tmpPy, content);
         const r = spawnSync12("python3", ["-m", "py_compile", tmpPy], {
           encoding: "utf-8"
         });
@@ -84481,7 +84650,7 @@ function writePersonalSkill(targetDir, files) {
     }
   } catch {}
   if (targetIsSymlink) {
-    fail3(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
+    fail4(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
   mkdirSync46(dirname24(targetDir), { recursive: true, mode: 493 });
   const staging = mkdtempSync6(join80(dirname24(targetDir), `.skill-personal-stage-`));
@@ -84492,7 +84661,7 @@ function writePersonalSkill(targetDir, files) {
       mkdirSync46(dirname24(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
-        writeFileSync39(fd, content);
+        writeFileSync40(fd, content);
       } finally {
         closeSync16(fd);
       }
@@ -84533,7 +84702,7 @@ function writePersonalSkill(targetDir, files) {
 function loadValidateWrite(agentsRoot, agent, name, files, ensureNew) {
   sweepTrash(agentsRoot, agent);
   if (!SKILL_SLUG_RE.test(name)) {
-    fail3(`skill name must match ${SKILL_SLUG_RE.source}: got ${JSON.stringify(name)}`);
+    fail4(`skill name must match ${SKILL_SLUG_RE.source}: got ${JSON.stringify(name)}`);
   }
   const target = personalSkillDir(agentsRoot, agent, name);
   const exists = (() => {
@@ -84545,10 +84714,10 @@ function loadValidateWrite(agentsRoot, agent, name, files, ensureNew) {
     }
   })();
   if (ensureNew && exists) {
-    fail3(`personal skill ${JSON.stringify(name)} already exists for agent ${JSON.stringify(agent)}. ` + `Use \`skill edit-personal\` to overwrite, or \`skill remove-personal\` first.`, 9);
+    fail4(`personal skill ${JSON.stringify(name)} already exists for agent ${JSON.stringify(agent)}. ` + `Use \`skill edit-personal\` to overwrite, or \`skill remove-personal\` first.`, 9);
   }
   if (!ensureNew && !exists) {
-    fail3(`personal skill ${JSON.stringify(name)} does not exist for agent ${JSON.stringify(agent)}. ` + `Use \`skill init-personal\` to create it.`, 9);
+    fail4(`personal skill ${JSON.stringify(name)} does not exist for agent ${JSON.stringify(agent)}. ` + `Use \`skill init-personal\` to create it.`, 9);
   }
   const v = validateSkillBundle(name, files);
   if (!v.ok) {
@@ -84574,16 +84743,16 @@ function loadFiles(opts) {
   }
   const p = resolve47(opts.from);
   if (!existsSync81(p)) {
-    fail3(`--from path does not exist: ${opts.from}`);
+    fail4(`--from path does not exist: ${opts.from}`);
   }
   const st = statSync32(p);
   if (st.isDirectory()) {
     return loadFromDir2(p);
   }
   if (p.endsWith(".md")) {
-    return { "SKILL.md": readFileSync67(p, "utf-8") };
+    return { "SKILL.md": readFileSync68(p, "utf-8") };
   }
-  fail3(`--from must be a directory or a .md file. Got: ${opts.from}`);
+  fail4(`--from must be a directory or a .md file. Got: ${opts.from}`);
 }
 function initPersonalAction(name, opts) {
   const agent = resolveAgent(opts);
@@ -84629,18 +84798,18 @@ function defaultBundledRoot() {
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
   if (!m) {
-    fail3(`source must be \`shared:<name>\` or \`bundled:<name>\` (got ${JSON.stringify(source)})`);
+    fail4(`source must be \`shared:<name>\` or \`bundled:<name>\` (got ${JSON.stringify(source)})`);
   }
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
   const dir = join80(root, slug);
   if (!existsSync81(dir)) {
-    fail3(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
+    fail4(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
   const st = lstatSync9(dir);
   if (st.isSymbolicLink()) {
-    fail3(`clone source ${JSON.stringify(source)} is a symlink at ${dir}; ` + `point clone at the canonical pool path instead`);
+    fail4(`clone source ${JSON.stringify(source)} is a symlink at ${dir}; ` + `point clone at the canonical pool path instead`);
   }
   return { tier, slug, dir };
 }
@@ -84667,10 +84836,10 @@ function readSourceFiles(dir) {
         try {
           const st = lstatSync9(full);
           if (st.size > CLONE_MAX_FILE_BYTES) {
-            fail3(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
+            fail4(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
           }
         } catch {}
-        files[rel] = readFileSync67(full, "utf-8");
+        files[rel] = readFileSync68(full, "utf-8");
       }
     }
   };
@@ -84701,11 +84870,11 @@ function clonePersonalAction(source, opts) {
   const src = resolveCloneSource(source, opts);
   const newName = opts.name ?? src.slug;
   if (!SKILL_SLUG_RE.test(newName)) {
-    fail3(`destination name must match ${SKILL_SLUG_RE.source}: got ${JSON.stringify(newName)}`);
+    fail4(`destination name must match ${SKILL_SLUG_RE.source}: got ${JSON.stringify(newName)}`);
   }
   const { files, skipped } = readSourceFiles(src.dir);
   if (!files["SKILL.md"]) {
-    fail3(`source ${JSON.stringify(source)} has no SKILL.md at ${src.dir}`);
+    fail4(`source ${JSON.stringify(source)} has no SKILL.md at ${src.dir}`);
   }
   if (newName !== src.slug) {
     files["SKILL.md"] = rewriteSkillMdName(files["SKILL.md"], newName);
@@ -84743,18 +84912,18 @@ function removePersonalAction(name, opts) {
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
   if (!SKILL_SLUG_RE.test(name)) {
-    fail3(`skill name must match ${SKILL_SLUG_RE.source}: got ${JSON.stringify(name)}`);
+    fail4(`skill name must match ${SKILL_SLUG_RE.source}: got ${JSON.stringify(name)}`);
   }
   const target = personalSkillDir(agentsRoot, agent, name);
   try {
     const st = lstatSync9(target);
     if (st.isSymbolicLink()) {
-      fail3(`refusing to remove symlink at ${target}; investigate manually`);
+      fail4(`refusing to remove symlink at ${target}; investigate manually`);
     }
   } catch (err2) {
     const e = err2;
     if (e.code === "ENOENT") {
-      fail3(`personal skill ${JSON.stringify(name)} does not exist for agent ${JSON.stringify(agent)}`, 1);
+      fail4(`personal skill ${JSON.stringify(name)} does not exist for agent ${JSON.stringify(agent)}`, 1);
     }
     throw err2;
   }
@@ -84839,7 +85008,7 @@ function registerSkillPersonalCommands(program3) {
 // src/cli/skill-search.ts
 init_helpers();
 var import_yaml23 = __toESM(require_dist(), 1);
-import { existsSync as existsSync82, readdirSync as readdirSync32, readFileSync as readFileSync68, statSync as statSync33 } from "node:fs";
+import { existsSync as existsSync82, readdirSync as readdirSync32, readFileSync as readFileSync69, statSync as statSync33 } from "node:fs";
 import { homedir as homedir47 } from "node:os";
 import { join as join81, resolve as resolve48 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
@@ -84860,7 +85029,7 @@ function readSkillFrontmatter(skillDir) {
     return null;
   let content;
   try {
-    content = readFileSync68(mdPath, "utf-8");
+    content = readFileSync69(mdPath, "utf-8");
   } catch {
     return null;
   }
@@ -85132,7 +85301,7 @@ function registerHostdMcpCommand(program3) {
 // src/cli/hostd.ts
 init_source();
 init_helpers();
-import { existsSync as existsSync84, mkdirSync as mkdirSync47, readdirSync as readdirSync33, readFileSync as readFileSync70, writeFileSync as writeFileSync40, statSync as statSync34, copyFileSync as copyFileSync12 } from "node:fs";
+import { existsSync as existsSync84, mkdirSync as mkdirSync47, readdirSync as readdirSync33, readFileSync as readFileSync71, writeFileSync as writeFileSync41, statSync as statSync34, copyFileSync as copyFileSync12 } from "node:fs";
 import { homedir as homedir48 } from "node:os";
 import { join as join82 } from "node:path";
 import { spawnSync as spawnSync14 } from "node:child_process";
@@ -85308,7 +85477,7 @@ async function doInstall(opts, program3) {
   const bak = backupExistingCompose();
   if (bak)
     console.log(source_default.dim(`  Backed up existing compose to ${bak}`));
-  writeFileSync40(composePath, yaml, "utf8");
+  writeFileSync41(composePath, yaml, "utf8");
   console.log(source_default.green(`  \u2713 Wrote ${composePath}`));
   const adminAgents = Object.entries(cfg.agents ?? {}).filter(([, a]) => a?.admin === true).map(([name]) => name);
   console.log(source_default.dim(`    agents served (one socket each): ${allAgents.length === 0 ? "(none)" : allAgents.join(", ")}`));
@@ -85415,7 +85584,7 @@ function registerHostdCommand(program3) {
 The log is created when hostd handles its first privileged-verb request.`));
       return;
     }
-    const raw = readFileSync70(logPath, "utf-8");
+    const raw = readFileSync71(logPath, "utf-8");
     const limit = Math.max(1, parseInt(opts.tail ?? "50", 10) || 50);
     const filters = {
       agent: opts.agent,
@@ -85457,7 +85626,7 @@ The log is created when hostd handles its first privileged-verb request.`));
 // src/cli/webd.ts
 init_source();
 init_helpers();
-import { existsSync as existsSync85, mkdirSync as mkdirSync48, writeFileSync as writeFileSync41, copyFileSync as copyFileSync13 } from "node:fs";
+import { existsSync as existsSync85, mkdirSync as mkdirSync48, writeFileSync as writeFileSync42, copyFileSync as copyFileSync13 } from "node:fs";
 import { homedir as homedir49 } from "node:os";
 import { join as join83 } from "node:path";
 import { spawnSync as spawnSync15 } from "node:child_process";
@@ -85593,7 +85762,7 @@ async function doInstall2(opts, program3) {
   const bak = backupExistingCompose2();
   if (bak)
     console.log(source_default.dim(`  Backed up existing compose to ${bak}`));
-  writeFileSync41(composePath, yaml, "utf8");
+  writeFileSync42(composePath, yaml, "utf8");
   console.log(source_default.green(`  \u2713 Wrote ${composePath}`));
   console.log(source_default.dim(`    running as uid ${operatorUid} (operator), network_mode: host`));
   console.log(source_default.dim(`    Pulling ghcr.io/switchroom/switchroom-web:${imageTag}\u2026`));
@@ -85698,6 +85867,7 @@ registerTopicsCommand(program3);
 registerAuthCommand(program3);
 registerVaultCommand(program3);
 registerTelegramCommand(program3);
+registerLinearAgentCommand(program3);
 registerMemoryCommand(program3);
 registerWebCommand(program3);
 registerHandoffCommand(program3);