switchroom 0.15.25 → 0.15.27

package/dist/cli/switchroom.js

@@ -28762,7 +28762,7 @@ function decodeResponse3(line) {
   const obj = JSON.parse(line);
   return ResponseSchema3.parse(obj);
 }
-var MAX_FRAME_BYTES3, RequestEnvelope, AgentRestartRequestSchema, UpgradeStatusRequestSchema, GetStatusRequestSchema, AgentNameSchema2, UpdateCheckRequestSchema, UpdateApplyRequestSchema, ApplyRequestSchema, AgentStartRequestSchema, AgentStopRequestSchema, AgentLogsRequestSchema, AgentExecRequestSchema, DoctorRequestSchema, AgentSmokeRequestSchema, ConfigProposeEditRequestSchema, RequestSchema3, ResultSchema, ErrorFixSchema, ErrorEnvelopeSchema, ResponseEnvelope, ResponseSchema3;
+var MAX_FRAME_BYTES3, RequestEnvelope, AgentRestartRequestSchema, UpgradeStatusRequestSchema, GetStatusRequestSchema, AgentNameSchema2, UpdateCheckRequestSchema, UpdateApplyRequestSchema, ApplyRequestSchema, AgentStartRequestSchema, AgentStopRequestSchema, AgentLogsRequestSchema, AgentExecRequestSchema, DoctorRequestSchema, AgentStatusRequestSchema, AgentScheduleRequestSchema, AgentSmokeRequestSchema, ConfigProposeEditRequestSchema, RequestSchema3, ResultSchema, ErrorFixSchema, ErrorEnvelopeSchema, ResponseEnvelope, ResponseSchema3;
 var init_protocol3 = __esm(() => {
   init_zod();
   MAX_FRAME_BYTES3 = 64 * 1024;
@@ -28848,6 +28848,20 @@ var init_protocol3 = __esm(() => {
     op: exports_external.literal("doctor"),
     args: exports_external.object({}).optional()
   });
+  AgentStatusRequestSchema = exports_external.object({
+    ...RequestEnvelope,
+    op: exports_external.literal("agent_status"),
+    args: exports_external.object({
+      name: AgentNameSchema2.optional()
+    })
+  });
+  AgentScheduleRequestSchema = exports_external.object({
+    ...RequestEnvelope,
+    op: exports_external.literal("agent_schedule"),
+    args: exports_external.object({
+      name: AgentNameSchema2.optional()
+    })
+  });
   AgentSmokeRequestSchema = exports_external.object({
     ...RequestEnvelope,
     op: exports_external.literal("agent_smoke"),
@@ -28878,6 +28892,8 @@ var init_protocol3 = __esm(() => {
     AgentExecRequestSchema,
     DoctorRequestSchema,
     AgentSmokeRequestSchema,
+    AgentStatusRequestSchema,
+    AgentScheduleRequestSchema,
     ConfigProposeEditRequestSchema
   ]);
   ResultSchema = exports_external.enum(["started", "completed", "denied", "error"]);
@@ -28929,6 +28945,7 @@ var init_protocol3 = __esm(() => {
     audit_id: exports_external.string().min(1).optional(),
     stdout_tail: exports_external.string().optional(),
     stderr_tail: exports_external.string().optional(),
+    payload: exports_external.string().optional(),
     error: exports_external.string().optional(),
     error_envelope: ErrorEnvelopeSchema.optional()
   };
@@ -29314,12 +29331,12 @@ import {
   readFileSync as readFileSync48,
   readdirSync as readdirSync19
 } from "node:fs";
-import { dirname as dirname12, join as join47 } from "node:path";
+import { dirname as dirname12, join as join48 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
 function locateManifestPath() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const candidate = join47(dir, "dependencies.json");
+    const candidate = join48(dir, "dependencies.json");
     if (existsSync52(candidate))
       return candidate;
     dir = dirname12(dir);
@@ -29389,13 +29406,13 @@ function probeClaudeVersion() {
 }
 function probePlaywrightMcpVersion() {
   const home2 = process.env.HOME ?? "";
-  const npxCache = join47(home2, ".npm/_npx");
+  const npxCache = join48(home2, ".npm/_npx");
   if (!existsSync52(npxCache))
     return null;
   try {
     const entries = readdirSync19(npxCache);
     for (const entry of entries) {
-      const pkgPath = join47(npxCache, entry, "node_modules/@playwright/mcp/package.json");
+      const pkgPath = join48(npxCache, entry, "node_modules/@playwright/mcp/package.json");
       if (existsSync52(pkgPath)) {
         try {
           const pkg = JSON.parse(readFileSync48(pkgPath, "utf-8"));
@@ -29840,8 +29857,8 @@ var init_doctor_docker = __esm(() => {
 import { existsSync as existsSync53, readFileSync as readFileSync50 } from "node:fs";
 import { createHash as createHash10 } from "node:crypto";
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { homedir as homedir26 } from "node:os";
-import { join as join48 } from "node:path";
+import { homedir as homedir27 } from "node:os";
+import { join as join49 } from "node:path";
 function defaultDockerInspect(container, format) {
   try {
     const r = spawnSync6("docker", ["inspect", "-f", format, container], { encoding: "utf-8", timeout: 5000 });
@@ -29941,7 +29958,7 @@ function checkAuthBrokerPerAgentSockets(config, deps = {}) {
 }
 function checkAuthBrokerDrift(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const indexPath = join48(stateDir, "sha-index.json");
+  const indexPath = join49(stateDir, "sha-index.json");
   if (!existsSync53(indexPath)) {
     return {
       name: "auth-broker: drift",
@@ -29960,7 +29977,7 @@ function checkAuthBrokerDrift(deps = {}) {
       fix: "Inspect `~/.switchroom/state/auth-broker/sha-index.json` for corruption."
     };
   }
-  const home2 = deps.home ?? homedir26();
+  const home2 = deps.home ?? homedir27();
   const divergent = [];
   const missingOnDisk = [];
   for (const [label, expected] of Object.entries(index)) {
@@ -30002,7 +30019,7 @@ function checkAuthBrokerDrift(deps = {}) {
 }
 function checkAuthBrokerThresholdViolations(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const path4 = join48(stateDir, "threshold-violations.json");
+  const path4 = join49(stateDir, "threshold-violations.json");
   if (!existsSync53(path4)) {
     return {
       name: "auth-broker: threshold violations",
@@ -30046,7 +30063,7 @@ function checkAuthBrokerActiveAccount(config, deps = {}) {
       fix: "Run `switchroom auth use <label>` to pin a fleet-wide account, then `switchroom apply`. Without an active account every agent boot fails."
     };
   }
-  const home2 = deps.home ?? homedir26();
+  const home2 = deps.home ?? homedir27();
   const dir = accountDir(active, home2);
   if (!existsSync53(dir)) {
     return {
@@ -30198,8 +30215,8 @@ import {
   realpathSync as realpathSync5,
   statSync as statSync23
 } from "node:fs";
-import { userInfo, homedir as homedir27 } from "node:os";
-import { join as join49 } from "node:path";
+import { userInfo, homedir as homedir28 } from "node:os";
+import { join as join50 } from "node:path";
 function resolveVaultPath2(config) {
   return config.vault?.path ? config.vault.path.replace(/^~/, process.env.HOME ?? "") : resolveStatePath("vault.enc");
 }
@@ -30337,7 +30354,7 @@ async function runSecretAccessChecks(config, deps = {}) {
   };
   const passphrase = deps.passphrase ?? process.env.SWITCHROOM_VAULT_PASSPHRASE;
   if (!passphrase) {
-    const sock = deps.brokerOperatorSocket ?? join49(homedir27(), ".switchroom", "broker-operator", "sock");
+    const sock = deps.brokerOperatorSocket ?? join50(homedir28(), ".switchroom", "broker-operator", "sock");
     const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
     for (const name of Object.keys(config.agents ?? {})) {
       const resolved = resolveAgentConfig(config.defaults, config.profiles, config.agents[name]);
@@ -30422,8 +30439,8 @@ import {
   existsSync as realExistsSync,
   readFileSync as realReadFileSync
 } from "node:fs";
-import { join as join50, resolve as resolve30 } from "node:path";
-import { homedir as homedir28 } from "node:os";
+import { join as join51, resolve as resolve30 } from "node:path";
+import { homedir as homedir29 } from "node:os";
 function resolveDeps(config, deps) {
   let agentsDir = deps.agentsDir;
   if (agentsDir === undefined) {
@@ -30546,8 +30563,8 @@ function checkScaffoldWiring(config, driveAgents, d) {
       });
       continue;
     }
-    const mcpPath = join50(agentDir, ".mcp.json");
-    const claudeJsonPath = join50(agentDir, ".claude", ".claude.json");
+    const mcpPath = join51(agentDir, ".mcp.json");
+    const claudeJsonPath = join51(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson(d, mcpPath);
     const trustRead = readJson(d, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -30660,7 +30677,7 @@ async function runDriveBrokerReachabilityChecks(config, deps = {}) {
       }
     ];
   }
-  const sock = deps.brokerOperatorSocket ?? join50(homedir28(), ".switchroom", "broker-operator", "sock");
+  const sock = deps.brokerOperatorSocket ?? join51(homedir29(), ".switchroom", "broker-operator", "sock");
   const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
   const results = [];
   for (const agent of driveAgents) {
@@ -30714,8 +30731,8 @@ import {
   readSync as realReadSync,
   closeSync as realCloseSync
 } from "node:fs";
-import { join as join51 } from "node:path";
-import { homedir as homedir29 } from "node:os";
+import { join as join52 } from "node:path";
+import { homedir as homedir30 } from "node:os";
 function defaultReadHead(p, n) {
   let fd;
   try {
@@ -30743,7 +30760,7 @@ function resolveDeps2(config, deps) {
     }
   }
   return {
-    homeDir: deps.homeDir ?? homedir29(),
+    homeDir: deps.homeDir ?? homedir30(),
     agentsDir,
     existsSync: deps.existsSync ?? ((p) => realExistsSync2(p)),
     readFileSync: deps.readFileSync ?? ((p) => realReadFileSync2(p, "utf-8")),
@@ -30772,7 +30789,7 @@ function runWebkiteChecks(config, deps = {}) {
     return [];
   const d = resolveDeps2(config, deps);
   const results = [];
-  const binPath = join51(d.homeDir, ".switchroom", "bin", "webkite");
+  const binPath = join52(d.homeDir, ".switchroom", "bin", "webkite");
   if (!d.existsSync(binPath)) {
     results.push({
       name: "webkite: binary",
@@ -30802,12 +30819,12 @@ function runWebkiteChecks(config, deps = {}) {
       });
     }
   }
-  const cloakDir = join51(d.homeDir, ".cloakbrowser");
+  const cloakDir = join52(d.homeDir, ".cloakbrowser");
   let chromeFound = false;
   if (d.existsSync(cloakDir)) {
     try {
       for (const entry of d.readdirSync(cloakDir)) {
-        if (entry.startsWith("chromium-") && d.existsSync(join51(cloakDir, entry, "chrome"))) {
+        if (entry.startsWith("chromium-") && d.existsSync(join52(cloakDir, entry, "chrome"))) {
           chromeFound = true;
           break;
         }
@@ -30833,9 +30850,9 @@ function runWebkiteChecks(config, deps = {}) {
     return results;
   }
   for (const agent of enabledAgents) {
-    const agentDir = join51(d.agentsDir, agent);
-    const settingsPath = join51(agentDir, ".claude", "settings.json");
-    const mcpPath = join51(agentDir, ".mcp.json");
+    const agentDir = join52(d.agentsDir, agent);
+    const settingsPath = join52(agentDir, ".claude", "settings.json");
+    const mcpPath = join52(agentDir, ".mcp.json");
     if (!d.existsSync(settingsPath) && !d.existsSync(mcpPath)) {
       continue;
     }
@@ -30965,7 +30982,7 @@ var init_doctor_cron_session = __esm(() => {
 });
 
 // src/cli/doctor-scaffold-wiring.ts
-import { join as join52, resolve as resolve32 } from "node:path";
+import { join as join53, resolve as resolve32 } from "node:path";
 function readJson2(d, path4) {
   if (!d.existsSync(path4))
     return { kind: "absent" };
@@ -31008,8 +31025,8 @@ function checkIntegrationScaffoldWiring(args) {
       });
       continue;
     }
-    const mcpPath = join52(agentDir, ".mcp.json");
-    const claudeJsonPath = join52(agentDir, ".claude", ".claude.json");
+    const mcpPath = join53(agentDir, ".mcp.json");
+    const claudeJsonPath = join53(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson2(deps, mcpPath);
     const trustRead = readJson2(deps, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -31073,14 +31090,14 @@ import {
   existsSync as realExistsSync3,
   readFileSync as realReadFileSync3
 } from "node:fs";
-import { join as join53 } from "node:path";
-import { homedir as homedir30 } from "node:os";
+import { join as join54 } from "node:path";
+import { homedir as homedir31 } from "node:os";
 function resolveDeps3(deps) {
-  const home2 = deps.homeDir?.() ?? homedir30();
+  const home2 = deps.homeDir?.() ?? homedir31();
   return {
     existsSync: deps.existsSync ?? realExistsSync3,
     readFileSync: deps.readFileSync ?? realReadFileSync3,
-    agentsDir: join53(home2, ".switchroom", "agents"),
+    agentsDir: join54(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now
   };
 }
@@ -31163,7 +31180,7 @@ function checkOAuthClient2(config, anyAgentEnabled) {
   ];
 }
 function readHeartbeat(d, agentName) {
-  const path4 = join53(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
+  const path4 = join54(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
   if (!d.existsSync(path4)) {
     return { error: "heartbeat file missing \u2014 launcher has not yet started" };
   }
@@ -31260,15 +31277,15 @@ import {
   readFileSync as realReadFileSync4,
   statSync as realStatSync2
 } from "node:fs";
-import { join as join54 } from "node:path";
-import { homedir as homedir31 } from "node:os";
+import { join as join55 } from "node:path";
+import { homedir as homedir32 } from "node:os";
 function resolveDeps4(deps) {
-  const home2 = deps.homeDir?.() ?? homedir31();
+  const home2 = deps.homeDir?.() ?? homedir32();
   return {
     existsSync: deps.existsSync ?? realExistsSync4,
     readFileSync: deps.readFileSync ?? realReadFileSync4,
     statSync: deps.statSync ?? realStatSync2,
-    agentsDir: join54(home2, ".switchroom", "agents"),
+    agentsDir: join55(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now,
     vaultAclReader: deps.vaultAclReader ?? (async () => ({ kind: "unreachable", msg: "no default reader wired" }))
   };
@@ -31393,7 +31410,7 @@ function checkLauncherHeartbeat2(notionAgents, d) {
     return [];
   const results = [];
   for (const name of notionAgents) {
-    const heartbeatPath = join54(d.agentsDir, name, "notion-launcher.heartbeat.json");
+    const heartbeatPath = join55(d.agentsDir, name, "notion-launcher.heartbeat.json");
     if (!d.existsSync(heartbeatPath)) {
       results.push({
         name: `notion:launcher-heartbeat:${name}`,
@@ -31468,10 +31485,10 @@ import {
   readdirSync as realReaddirSync2,
   statSync as realStatSync3
 } from "node:fs";
-import { homedir as homedir32 } from "node:os";
-import { join as join55 } from "node:path";
+import { homedir as homedir33 } from "node:os";
+import { join as join56 } from "node:path";
 function runCredentialsMigrationChecks(config, deps = {}) {
-  const credDir = deps.credentialsDir ?? join55(homedir32(), ".switchroom", "credentials");
+  const credDir = deps.credentialsDir ?? join56(homedir33(), ".switchroom", "credentials");
   const existsSync55 = deps.existsSync ?? ((p) => realExistsSync5(p));
   const readdirSync21 = deps.readdirSync ?? ((p) => realReaddirSync2(p));
   const isDirectory = deps.isDirectory ?? ((p) => {
@@ -31499,7 +31516,7 @@ function runCredentialsMigrationChecks(config, deps = {}) {
   const flat = [];
   const perAgentDirs = [];
   for (const e of entries) {
-    const full = join55(credDir, e);
+    const full = join56(credDir, e);
     if (isDirectory(full) && agentNames.has(e)) {
       perAgentDirs.push(e);
     } else {
@@ -31622,19 +31639,19 @@ var init_doctor_inlined_secrets = __esm(() => {
 
 // src/cli/doctor-audit-integrity.ts
 import { readFileSync as fsReadFileSync2 } from "node:fs";
-import { homedir as homedir33 } from "node:os";
-import { join as join56 } from "node:path";
+import { homedir as homedir34 } from "node:os";
+import { join as join57 } from "node:path";
 function rootWrittenLogs(home2) {
   return [
-    { label: "vault-broker", path: join56(home2, ".switchroom", "vault-audit.log") },
+    { label: "vault-broker", path: join57(home2, ".switchroom", "vault-audit.log") },
     {
       label: "hostd",
-      path: join56(home2, ".switchroom", "host-control-audit.log")
+      path: join57(home2, ".switchroom", "host-control-audit.log")
     }
   ];
 }
 function runAuditIntegrityChecks(deps = {}) {
-  const home2 = deps.homeDir ?? homedir33();
+  const home2 = deps.homeDir ?? homedir34();
   const read = deps.readFileSync ?? ((p) => fsReadFileSync2(p, "utf8"));
   const results = [];
   for (const { label, path: path4 } of rootWrittenLogs(home2)) {
@@ -31692,14 +31709,14 @@ var init_doctor_audit_integrity = __esm(() => {
 
 // src/cli/doctor-agent-smoke.ts
 import { existsSync as existsSync55 } from "node:fs";
-import { homedir as homedir34 } from "node:os";
-import { join as join57 } from "node:path";
+import { homedir as homedir35 } from "node:os";
+import { join as join58 } from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 async function runAgentSmokeChecks(config, deps = {}) {
   if (deps.fast)
     return [];
-  const home2 = deps.homeDir ?? homedir34();
-  const sock = deps.operatorSockPath ?? join57(home2, ".switchroom", "hostd", "operator", "sock");
+  const home2 = deps.homeDir ?? homedir35();
+  const sock = deps.operatorSockPath ?? join58(home2, ".switchroom", "hostd", "operator", "sock");
   if (!deps.hostdRequestImpl && !existsSync55(sock)) {
     return [
       {
@@ -31779,8 +31796,8 @@ var init_doctor_agent_smoke = __esm(() => {
 // src/cli/doctor-vault-broker-durability.ts
 import { execFileSync as execFileSync18 } from "node:child_process";
 import { existsSync as existsSync56, statSync as statSync24 } from "node:fs";
-import { homedir as homedir35 } from "node:os";
-import { join as join58 } from "node:path";
+import { homedir as homedir36 } from "node:os";
+import { join as join59 } from "node:path";
 function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   const statHost = opts?.statHost ?? defaultStatHost;
   const statBroker = opts?.statBroker ?? defaultStatBroker;
@@ -31923,22 +31940,22 @@ function defaultBrokerStatusProbe() {
   }
 }
 function runVaultBrokerDurabilityChecks(_config, opts) {
-  const home2 = homedir35();
+  const home2 = homedir36();
   const probe2 = opts?.inodeProbe ?? probeBindMountInode;
   return [
     probeBrokerUnlocked(opts?.statusProbe),
     probeAutoUnlockBlob(home2),
     probeMachineIdMount(),
-    formatBindMountResult("vault-broker: vault.enc bind mount", join58(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join58(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
-    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join58(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join58(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
-    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join58(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join58(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
+    formatBindMountResult("vault-broker: vault.enc bind mount", join59(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join59(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
+    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join59(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join59(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
+    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join59(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join59(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
     probeKernelDbDurability(home2, {
       statBroker: opts?.kernelStatBroker
     })
   ];
 }
 function probeKernelDbDurability(home2, opts) {
-  const hostDir = join58(home2, ".switchroom", "approvals");
+  const hostDir = join59(home2, ".switchroom", "approvals");
   const containerDir = "/state/approvals";
   const name = "approval-kernel: approvals bind mount (allow_always durability)";
   const kernelStat = opts?.statBroker ?? defaultKernelStatBroker;
@@ -32006,7 +32023,7 @@ function defaultKernelStatBroker(p) {
   return { kind: "ok-with-stat", ino: inoStr, size };
 }
 function probeAutoUnlockBlob(home2) {
-  const blobPath = join58(home2, ".switchroom", "vault-auto-unlock");
+  const blobPath = join59(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync56(blobPath)) {
     return {
       name: "vault-broker: auto-unlock blob",
@@ -32118,16 +32135,16 @@ import {
   readdirSync as readdirSync21,
   statSync as statSync25
 } from "node:fs";
-import { dirname as dirname13, join as join59, resolve as resolve33 } from "node:path";
+import { dirname as dirname13, join as join60, resolve as resolve33 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
-  const nvmRoot = join59(process.env.HOME ?? "", ".nvm", "versions", "node");
+  const nvmRoot = join60(process.env.HOME ?? "", ".nvm", "versions", "node");
   if (!existsSync57(nvmRoot))
     return null;
   try {
     const versions = readdirSync21(nvmRoot).sort().reverse();
     for (const v of versions) {
-      const candidate = join59(nvmRoot, v, "bin", bin);
+      const candidate = join60(nvmRoot, v, "bin", bin);
       try {
         const s = statSync25(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
@@ -32292,7 +32309,7 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
   if (envBrowsersPath && envBrowsersPath.length > 0) {
     cacheLocations.push(envBrowsersPath);
   }
-  cacheLocations.push(join59(homeDir, ".cache", "ms-playwright"));
+  cacheLocations.push(join60(homeDir, ".cache", "ms-playwright"));
   for (const cacheDir of cacheLocations) {
     if (!existsSync57(cacheDir))
       continue;
@@ -32300,10 +32317,10 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
       const entries = readdirSync21(cacheDir).filter((e) => e.startsWith("chromium"));
       for (const entry of entries) {
         const candidates2 = [
-          join59(cacheDir, entry, "chrome-linux64", "chrome"),
-          join59(cacheDir, entry, "chrome-linux", "chrome"),
-          join59(cacheDir, entry, "chrome-linux64", "headless_shell"),
-          join59(cacheDir, entry, "chrome-linux", "headless_shell")
+          join60(cacheDir, entry, "chrome-linux64", "chrome"),
+          join60(cacheDir, entry, "chrome-linux", "chrome"),
+          join60(cacheDir, entry, "chrome-linux64", "headless_shell"),
+          join60(cacheDir, entry, "chrome-linux", "headless_shell")
         ];
         for (const path4 of candidates2) {
           if (existsSync57(path4))
@@ -32426,7 +32443,7 @@ function checkUserDeclaredMcps(name, agentConfig, config, renderedMcpServers) {
 function checkLegacyState() {
   const results = [];
   const h = process.env.HOME ?? "/root";
-  const clerkDir = join59(h, LEGACY_STATE_DIR);
+  const clerkDir = join60(h, LEGACY_STATE_DIR);
   const clerkPresent = existsSync57(clerkDir);
   results.push({
     name: "legacy ~/.clerk state",
@@ -32436,7 +32453,7 @@ function checkLegacyState() {
       fix: "Legacy state detected. Run `mv ~/.clerk ~/.switchroom` and rename " + "any top-level `clerk:` key in switchroom.yaml to `switchroom:`. " + "This back-compat shim is REMOVED in v0.13.0 \u2014 no automatic " + "migration exists."
     } : {}
   });
-  const legacySock = join59(h, ".switchroom", "vault-broker.sock");
+  const legacySock = join60(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
     sockStat = lstatSync6(legacySock);
@@ -32814,7 +32831,7 @@ async function checkHindsight(config) {
 }
 function checkPendingRetainsQueue(dir) {
   const home2 = process.env.HOME ?? "";
-  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join59(home2, ".hindsight", "pending-retains");
+  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join60(home2, ".hindsight", "pending-retains");
   if (!existsSync57(pendingDir)) {
     return {
       name: "pending-retains queue",
@@ -32945,7 +32962,7 @@ async function checkTelegram(config) {
     const plugin = agentConfig.channels?.telegram?.plugin ?? "switchroom";
     if (plugin !== "switchroom")
       continue;
-    const envPath = join59(agentsDir, name, "telegram", ".env");
+    const envPath = join60(agentsDir, name, "telegram", ".env");
     const read = tryReadHostFile(envPath);
     if (read.kind === "eacces") {
       results.push({
@@ -33028,7 +33045,7 @@ function checkStartShStale(agentName, startShPath) {
 }
 function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const label = `${agentName}: $HOME/.switchroom symlink (#910)`;
-  const path4 = join59(agentDir, "home", ".switchroom");
+  const path4 = join60(agentDir, "home", ".switchroom");
   let stats;
   try {
     stats = lstatSync6(path4);
@@ -33065,7 +33082,7 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
 }
 function checkRepoHygiene(repoRoot) {
   const results = [];
-  const exportDir = join59(repoRoot, "clerk-export");
+  const exportDir = join60(repoRoot, "clerk-export");
   if (existsSync57(exportDir)) {
     results.push({
       name: "repo hygiene: clerk-export/ on disk (#1072)",
@@ -33074,7 +33091,7 @@ function checkRepoHygiene(repoRoot) {
       fix: `Run scripts/migrate-clerk-export-to-vault.sh to move the bundle ` + `into the vault, then delete the on-disk copy.`
     });
   }
-  const knownTarball = join59(repoRoot, "clerk-export-with-secrets.tar.gz");
+  const knownTarball = join60(repoRoot, "clerk-export-with-secrets.tar.gz");
   if (existsSync57(knownTarball)) {
     results.push({
       name: "repo hygiene: clerk-export-with-secrets.tar.gz on disk (#1072)",
@@ -33092,7 +33109,7 @@ function checkRepoHygiene(repoRoot) {
         results.push({
           name: `repo hygiene: ${name} on disk (#1072)`,
           status: "warn",
-          detail: `${join59(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
+          detail: `${join60(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
           fix: `Inspect, migrate any secrets into the vault, then delete the ` + `archive.`
         });
       }
@@ -33115,9 +33132,9 @@ function checkRepoHygiene(repoRoot) {
 }
 function isSwitchroomCheckout(dir) {
   try {
-    if (!existsSync57(join59(dir, ".git")))
+    if (!existsSync57(join60(dir, ".git")))
       return false;
-    const pkgPath = join59(dir, "package.json");
+    const pkgPath = join60(dir, "package.json");
     if (!existsSync57(pkgPath))
       return false;
     const pkg = JSON.parse(readFileSync51(pkgPath, "utf-8"));
@@ -33154,7 +33171,7 @@ function checkAgents(config, configPath) {
         fix: `Rotate the bot token (e.g. via \`switchroom vault\`), then run ` + `\`switchroom agent unquarantine ${name}\` and \`switchroom agent restart ${name}\``
       });
     }
-    results.push(checkStartShStale(name, join59(agentDir, "start.sh")));
+    results.push(checkStartShStale(name, join60(agentDir, "start.sh")));
     results.push(checkLeakedHomeSwitchroom(name, agentDir));
     const status = statuses[name];
     const active = status?.active ?? "unknown";
@@ -33231,7 +33248,7 @@ function checkAgents(config, configPath) {
       }
     }
     if (agentConfig.channels?.telegram?.plugin === "switchroom") {
-      const mcpJsonPath = join59(agentDir, ".mcp.json");
+      const mcpJsonPath = join60(agentDir, ".mcp.json");
       if (!existsSync57(mcpJsonPath)) {
         results.push({
           name: `${name}: .mcp.json`,
@@ -33533,7 +33550,7 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
     };
   }
   const credDir = dirname13(envPath);
-  const authScript = join59(credDir, "claude-auth.py");
+  const authScript = join60(credDir, "claude-auth.py");
   if (!existsSync57(authScript)) {
     return {
       name: "mff: auth flow",
@@ -50477,8 +50494,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.15.25";
-var COMMIT_SHA = "0d066743";
+var VERSION = "0.15.27";
+var COMMIT_SHA = "97160057";
 
 // src/cli/agent.ts
 init_source();
@@ -67478,6 +67495,23 @@ function addWebhookSource(yamlText, agentName, source) {
   }
   return String(doc);
 }
+function addAgentSecret(yamlText, agentName, key) {
+  const doc = import_yaml11.parseDocument(yamlText);
+  ensureAgent(doc, agentName);
+  const existing = doc.getIn(["agents", agentName, "secrets"]);
+  if (import_yaml11.isSeq(existing)) {
+    const seq = existing;
+    for (const item of seq.items) {
+      const v = item.value ?? item;
+      if (v === key)
+        return yamlText;
+    }
+    seq.add(key);
+  } else {
+    doc.setIn(["agents", agentName, "secrets"], [key]);
+  }
+  return String(doc);
+}
 function removeWebhookSource(yamlText, agentName, source) {
   const doc = import_yaml11.parseDocument(yamlText);
   if (!hasAgent(doc, agentName))
@@ -67860,6 +67894,22 @@ async function vaultPut(program3, key, value) {
   setStringSecret(passphrase, vaultPath, key, value);
   console.log(source_default.green(`\u2713 Stored secret in vault as '${key}'`));
 }
+async function vaultPutQuiet(program3, key, value) {
+  const configPath = program3.optsWithGlobals().config ?? undefined;
+  const vaultPath = resolveVaultPath(configPath);
+  const passphrase = await getVaultPassphrase();
+  if (!existsSync43(vaultPath))
+    createVault(passphrase, vaultPath);
+  setStringSecret(passphrase, vaultPath, key, value);
+}
+async function vaultGet(program3, key) {
+  const configPath = program3.optsWithGlobals().config ?? undefined;
+  const vaultPath = resolveVaultPath(configPath);
+  if (!existsSync43(vaultPath))
+    return null;
+  const passphrase = await getVaultPassphrase();
+  return getStringSecret(passphrase, vaultPath, key);
+}
 function resolveVaultPath(configPath) {
   try {
     const config = loadConfig(configPath);
@@ -67988,9 +68038,118 @@ function promptHidden2(prompt) {
 init_source();
 init_helpers();
 import { readFileSync as readFileSync39, writeFileSync as writeFileSync22 } from "node:fs";
+
+// src/linear/oauth-refresh.ts
+var LINEAR_TOKEN_ENDPOINT = "https://api.linear.app/oauth/token";
+var DEFAULT_REFRESH_SKEW_SEC = 2 * 3600;
+async function refreshLinearAppToken(bundle, opts = {}) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const nowSec = opts.nowSec ?? (() => Math.floor(Date.now() / 1000));
+  const form = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: bundle.refreshToken,
+    client_id: bundle.clientId,
+    client_secret: bundle.clientSecret
+  });
+  let resp;
+  try {
+    resp = await fetchImpl(LINEAR_TOKEN_ENDPOINT, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: form.toString()
+    });
+  } catch (err) {
+    return { ok: false, reason: "network", detail: err.message };
+  }
+  if (!resp.ok) {
+    const txt = await resp.text().catch(() => "");
+    const revoked = resp.status === 400 || /invalid_grant|invalid_token/i.test(txt);
+    return {
+      ok: false,
+      reason: revoked ? "revoked" : "http_error",
+      detail: `HTTP ${resp.status}${txt ? ` ${txt.slice(0, 200)}` : ""}`
+    };
+  }
+  let json;
+  try {
+    json = await resp.json();
+  } catch {
+    return { ok: false, reason: "bad_response", detail: "non-JSON token response" };
+  }
+  const accessToken = json.access_token;
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    return { ok: false, reason: "bad_response", detail: "no access_token in response" };
+  }
+  const expiresIn = typeof json.expires_in === "number" ? json.expires_in : 86400;
+  const rotated = typeof json.refresh_token === "string" && json.refresh_token.length > 0 ? json.refresh_token : bundle.refreshToken;
+  return {
+    ok: true,
+    accessToken,
+    refreshToken: rotated,
+    expiresAt: nowSec() + expiresIn,
+    ...typeof json.scope === "string" ? { scope: json.scope } : {}
+  };
+}
+function parseBundle(raw) {
+  if (raw == null || raw === "")
+    return null;
+  let o;
+  try {
+    o = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof o.client_id === "string" && typeof o.client_secret === "string" && typeof o.refresh_token === "string" && o.client_id.length > 0 && o.client_secret.length > 0 && o.refresh_token.length > 0) {
+    return {
+      clientId: o.client_id,
+      clientSecret: o.client_secret,
+      refreshToken: o.refresh_token,
+      ...typeof o.expires_at === "number" ? { expiresAt: o.expires_at } : {}
+    };
+  }
+  return null;
+}
+function serializeBundle(b) {
+  return JSON.stringify({
+    client_id: b.clientId,
+    client_secret: b.clientSecret,
+    refresh_token: b.refreshToken,
+    ...b.expiresAt != null ? { expires_at: b.expiresAt } : {}
+  });
+}
+async function performLinearRefresh(io) {
+  const raw = await io.readBundle();
+  const bundle = parseBundle(raw);
+  if (!bundle) {
+    return { ok: false, reason: "no_bundle", detail: "no/invalid refresh bundle" };
+  }
+  const res = await refreshLinearAppToken(bundle, {
+    ...io.fetchImpl ? { fetchImpl: io.fetchImpl } : {},
+    ...io.nowSec ? { nowSec: io.nowSec } : {}
+  });
+  if (!res.ok)
+    return { ok: false, reason: res.reason, detail: res.detail };
+  try {
+    await io.writeBundle(serializeBundle({
+      clientId: bundle.clientId,
+      clientSecret: bundle.clientSecret,
+      refreshToken: res.refreshToken,
+      expiresAt: res.expiresAt
+    }));
+    await io.writeToken(res.accessToken);
+  } catch (err) {
+    return { ok: false, reason: "persist_failed", detail: err.message };
+  }
+  return { ok: true, accessToken: res.accessToken, expiresAt: res.expiresAt };
+}
+
+// src/cli/linear-agent.ts
+function bundleKeyFor(agent) {
+  return `linear/${agent}/oauth`;
+}
 function registerLinearAgentCommand(program3) {
   const linear = program3.command("linear-agent").description("Install an agent into a Linear workspace as a first-class app actor (#2298) \u2014 @-mentionable, delegate-assignable, agent sessions wake it instantly.");
-  linear.command("setup").description("Provision <agent> as a Linear agent. Vault-stores the Linear OAuth app token (actor=app) under 'linear/<agent>/token' and enables the linear_agent block in switchroom.yaml. The OAuth browser authorize step is printed as instructions (it can't run headless); pass the already-obtained --token.").requiredOption("--agent <name>", "Agent name (must exist in switchroom.yaml)").requiredOption("--token <token>", "The Linear OAuth app token (actor=app), obtained out-of-band via the browser authorize step. Stored in the vault, never in switchroom.yaml.").option("--client-id <id>", "Linear OAuth app client id (for the printed authorize-URL hint).").option("--client-secret <secret>", "Linear OAuth app client secret (informational \u2014 not stored by this verb).").option("--redirect-uri <uri>", "OAuth redirect URI registered on the Linear app (for the authorize-URL hint).").option("--workspace-id <id>", "Optional Linear workspace (organization) id to record in config.").option("--webhook-base <url>", "Base URL of the switchroom web server (e.g. https://hooks.switchroom.ai). Used to print the webhook URL to register in Linear. Defaults to a placeholder.").option("--dry-run", "Print the YAML diff + instructions without writing or vaulting anything").action(withConfigError(async (opts) => {
+  linear.command("setup").description("Provision <agent> as a Linear agent. Vault-stores the Linear OAuth app token (actor=app) under 'linear/<agent>/token' and enables the linear_agent block in switchroom.yaml. The OAuth browser authorize step is printed as instructions (it can't run headless); pass the already-obtained --token.").requiredOption("--agent <name>", "Agent name (must exist in switchroom.yaml)").requiredOption("--token <token>", "The Linear OAuth app token (actor=app), obtained out-of-band via the browser authorize step. Stored in the vault, never in switchroom.yaml.").option("--client-id <id>", "Linear OAuth app client id. Stored (with --client-secret + --refresh-token) to enable unattended token refresh.").option("--client-secret <secret>", "Linear OAuth app client secret. Stored in the vault (with --client-id + --refresh-token) so the token can be refreshed without a browser re-auth.").option("--refresh-token <token>", "The refresh_token from the OAuth exchange. Stored so an expired access token self-heals (see 'linear-agent refresh').").option("--token-expires-in <seconds>", "expires_in from the OAuth token response (seconds). Records when the access token expires so refresh runs proactively. Defaults to 86400.").option("--redirect-uri <uri>", "OAuth redirect URI registered on the Linear app (for the authorize-URL hint).").option("--workspace-id <id>", "Optional Linear workspace (organization) id to record in config.").option("--webhook-base <url>", "Base URL of the switchroom web server (e.g. https://hooks.switchroom.ai). Used to print the webhook URL to register in Linear. Defaults to a placeholder.").option("--dry-run", "Print the YAML diff + instructions without writing or vaulting anything").action(withConfigError(async (opts) => {
     if (!/^[a-z][a-z0-9_-]{0,63}$/.test(opts.agent)) {
       fail2(`--agent must be a lowercase agent slug (got '${opts.agent}').`);
     }
@@ -67998,10 +68157,26 @@ function registerLinearAgentCommand(program3) {
       fail2("--token must be a non-empty Linear app token.");
     }
     const vaultKey = `linear/${opts.agent}/token`;
+    const bundleKey = bundleKeyFor(opts.agent);
+    const canRefresh = Boolean(opts.refreshToken && opts.clientId && opts.clientSecret);
     if (!opts.dryRun) {
       await vaultPut(program3, vaultKey, opts.token);
+      if (canRefresh) {
+        const expiresIn = Number.parseInt(opts.tokenExpiresIn ?? "", 10);
+        const ttl = Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : 86400;
+        const bundle = serializeBundle({
+          clientId: opts.clientId,
+          clientSecret: opts.clientSecret,
+          refreshToken: opts.refreshToken,
+          expiresAt: Math.floor(Date.now() / 1000) + ttl
+        });
+        await vaultPutQuiet(program3, bundleKey, bundle);
+      }
     } else {
       console.log(source_default.gray(`[dry-run] would store the Linear token in the vault as '${vaultKey}'`));
+      if (canRefresh) {
+        console.log(source_default.gray(`[dry-run] would store the refresh bundle as '${bundleKey}' (enables auto-refresh)`));
+      }
     }
     const path4 = getConfigPath(program3);
     const before = readFileSync39(path4, "utf-8");
@@ -68011,6 +68186,10 @@ function registerLinearAgentCommand(program3) {
         token: `vault:${vaultKey}`,
         ...opts.workspaceId ? { workspaceId: opts.workspaceId } : {}
       });
+      if (canRefresh) {
+        after = addAgentSecret(after, opts.agent, bundleKey);
+        after = addAgentSecret(after, opts.agent, vaultKey);
+      }
     } catch (err) {
       fail2(err.message);
     }
@@ -68021,10 +68200,42 @@ function registerLinearAgentCommand(program3) {
       writeFileSync22(path4, after, "utf-8");
       console.log(source_default.green(`\u2713 Enabled linear-agent for agent '${opts.agent}'`));
       console.log(source_default.gray(`  Vault key: ${vaultKey}`));
+      if (canRefresh) {
+        console.log(source_default.green(`\u2713 Auto-refresh enabled \u2014 refresh bundle stored at '${bundleKey}'`));
+        console.log(source_default.gray(`  Granted ACL: '${bundleKey}' + '${vaultKey}' added to agents.${opts.agent}.secrets[] (agent rotates them in-container on a 401).`));
+      } else {
+        console.log(source_default.yellow(`\u26a0 No refresh bundle stored \u2014 the access token will expire (~24h) and need a manual re-auth.`));
+        console.log(source_default.gray(`  To enable auto-refresh, re-run with --refresh-token <rt> --client-id <id> --client-secret <secret> --token-expires-in <sec>.`));
+      }
       console.log(source_default.gray(`  Run 'switchroom agent restart ${opts.agent}' to pick up the change.`));
     }
     printLinearInstructions(opts, vaultKey);
   }));
+  linear.command("refresh").description("Refresh <agent>'s Linear app token using the stored refresh bundle (linear/<agent>/oauth). Exchanges the refresh_token for a fresh access token, writes it to linear/<agent>/token, and rotates the stored refresh_token + expiry. Use to recover an expired token or seed automation. Host-side write \u2014 the running agent picks it up on its next broker re-mirror / restart.").requiredOption("--agent <name>", "Agent name (must have a linear_agent block)").action(withConfigError(async (opts) => {
+    if (!/^[a-z][a-z0-9_-]{0,63}$/.test(opts.agent)) {
+      fail2(`--agent must be a lowercase agent slug (got '${opts.agent}').`);
+    }
+    const bundleKey = bundleKeyFor(opts.agent);
+    const res = await performLinearRefresh({
+      readBundle: () => vaultGet(program3, bundleKey),
+      writeToken: (t) => vaultPutQuiet(program3, `linear/${opts.agent}/token`, t),
+      writeBundle: (json) => vaultPutQuiet(program3, bundleKey, json)
+    });
+    if (!res.ok) {
+      if (res.reason === "no_bundle") {
+        fail2(`No refresh bundle at '${bundleKey}'. Provision one via 'linear-agent setup --agent ${opts.agent} ` + `--token <t> --refresh-token <rt> --client-id <id> --client-secret <secret>'.`);
+      }
+      if (res.reason === "revoked") {
+        fail2(`Refresh token is dead (revoked/expired) \u2014 re-authorize in a browser (actor=app) and re-run setup with the new --refresh-token. (${res.detail})`);
+      }
+      fail2(`Refresh failed (${res.reason}): ${res.detail}`);
+    }
+    if (res.ok) {
+      const hours = Math.max(1, Math.round((res.expiresAt - Date.now() / 1000) / 3600));
+      console.log(source_default.green(`\u2713 Refreshed Linear token for '${opts.agent}' (expires in ~${hours}h).`));
+      console.log(source_default.gray(`  Written to vault:linear/${opts.agent}/token (+ rotated bundle). Restart the agent or wait for the broker to re-mirror.`));
+    }
+  }));
   linear.command("set-team").description("Set (or clear) the default Linear team captured issues file into for <agent>. Only needed when the workspace has multiple teams \u2014 a single-team workspace auto-resolves. Pass --clear to remove the default.").requiredOption("--agent <name>", "Agent name (must have a linear_agent block)").option("--team <id>", "Linear team id new captured issues default to.").option("--clear", "Remove the configured default team (revert to auto-resolve).").action(withConfigError(async (opts) => {
     if (!/^[a-z][a-z0-9_-]{0,63}$/.test(opts.agent)) {
       fail2(`--agent must be a lowercase agent slug (got '${opts.agent}').`);
@@ -68680,7 +68891,6 @@ init_source();
 init_merge();
 init_loader();
 init_client();
-init_lifecycle();
 import {
   readFileSync as readFileSync46,
   existsSync as existsSync50,
@@ -68691,9 +68901,8 @@ import {
   writeSync as writeSync6,
   constants as fsConstants3
 } from "node:fs";
-import { resolve as resolve28, extname, join as join46, relative, dirname as dirname10 } from "node:path";
-import { homedir as homedir25 } from "node:os";
-import { spawn as spawn5 } from "node:child_process";
+import { resolve as resolve28, extname, join as join47, relative, dirname as dirname10 } from "node:path";
+import { homedir as homedir26 } from "node:os";
 import { timingSafeEqual as timingSafeEqual3, randomBytes as randomBytes11 } from "node:crypto";
 
 // src/web/api.ts
@@ -68702,7 +68911,71 @@ init_manager();
 init_hindsight();
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { existsSync as existsSync47, readFileSync as readFileSync43, statSync as statSync22 } from "node:fs";
-import { resolve as resolve27 } from "node:path";
+import { resolve as resolve27, join as join44 } from "node:path";
+
+// src/web/memory-remediation.ts
+init_hindsight();
+function restBaseFromMcpUrl(mcpUrl) {
+  return hindsightRestBase(mcpUrl);
+}
+async function postTrigger(url, opts) {
+  const fetchImpl = opts?.fetchImpl ?? fetch;
+  const timeoutMs = opts?.timeoutMs ?? 5000;
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetchImpl(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      signal: controller.signal
+    });
+    clearTimeout(timeout);
+    if (!resp.ok)
+      return { ok: false, reason: `HTTP ${resp.status}` };
+    return { ok: true };
+  } catch (err) {
+    clearTimeout(timeout);
+    if (err.name === "AbortError")
+      return { ok: false, reason: "Timeout" };
+    return { ok: false, reason: String(err.message ?? err) };
+  }
+}
+async function reprocessDocuments(restBase, bank, docIds, opts) {
+  let triggered = 0;
+  let failed = 0;
+  let error;
+  const encodedBank = encodeURIComponent(bank);
+  for (const docId of docIds) {
+    const url = `${restBase}/v1/default/banks/${encodedBank}/documents/${encodeURIComponent(docId)}/reprocess`;
+    const r = await postTrigger(url, opts);
+    if (r.ok) {
+      triggered += 1;
+    } else {
+      failed += 1;
+      if (!error)
+        error = r.reason;
+    }
+  }
+  return error ? { triggered, failed, error } : { triggered, failed };
+}
+async function refreshMentalModel(restBase, bank, modelId, opts) {
+  const url = `${restBase}/v1/default/banks/${encodeURIComponent(bank)}/mental-models/${encodeURIComponent(modelId)}/refresh`;
+  const r = await postTrigger(url, opts);
+  return r.ok ? { ok: true } : { ok: false, error: r.reason };
+}
+async function buildUserProfile(mcpUrl, bank, opts) {
+  try {
+    const r = await ensureUserProfileMentalModel(mcpUrl, bank, {
+      fetchImpl: opts?.fetchImpl,
+      timeoutMs: opts?.timeoutMs
+    });
+    return r.ok ? { ok: true } : { ok: false, error: r.reason };
+  } catch (err) {
+    return { ok: false, error: String(err.message ?? err) };
+  }
+}
+
+// src/web/api.ts
 init_audit_reader();
 
 // src/scheduler/dispatch.ts
@@ -68765,6 +69038,8 @@ function readRecentFires(jsonlPath) {
 
 // src/web/api.ts
 init_client3();
+init_client();
+import { homedir as homedir23 } from "node:os";
 
 // node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/modifiers/module.node.mjs
 import { dirname as dirname8, posix, sep as sep2 } from "path";
@@ -73500,6 +73775,121 @@ async function proposeConfigEditViaHostd(args) {
   }
 }
 
+// src/web/hostd-read-client.ts
+init_client4();
+var READ_TIMEOUT_MS = 4000;
+function readRequestId(verb) {
+  return `web-${verb}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
+}
+async function fetchFleetStatusViaHostd(opts = {}) {
+  const socketPath = opts.socketPath !== undefined ? opts.socketPath : resolveHostdOperatorSocket();
+  if (!socketPath)
+    return null;
+  const send = opts.send ?? hostdRequest;
+  const req = {
+    v: 1,
+    op: "agent_status",
+    request_id: readRequestId("agent_status"),
+    args: {}
+  };
+  try {
+    const resp = await send({ socketPath, timeoutMs: opts.timeoutMs ?? READ_TIMEOUT_MS }, req);
+    if (resp.result !== "completed" || !resp.payload)
+      return null;
+    const parsed = JSON.parse(resp.payload);
+    if (!parsed || typeof parsed !== "object" || !parsed.statuses)
+      return null;
+    return parsed.statuses;
+  } catch {
+    return null;
+  }
+}
+async function fetchScheduleViaHostd(opts = {}) {
+  const socketPath = opts.socketPath !== undefined ? opts.socketPath : resolveHostdOperatorSocket();
+  if (!socketPath)
+    return null;
+  const send = opts.send ?? hostdRequest;
+  const req = {
+    v: 1,
+    op: "agent_schedule",
+    request_id: readRequestId("agent_schedule"),
+    args: {}
+  };
+  try {
+    const resp = await send({ socketPath, timeoutMs: opts.timeoutMs ?? READ_TIMEOUT_MS }, req);
+    if (resp.result !== "completed" || !resp.payload)
+      return null;
+    const parsed = JSON.parse(resp.payload);
+    if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.entries)) {
+      return null;
+    }
+    return {
+      entries: parsed.entries,
+      recentByAgent: parsed.recentByAgent ?? {},
+      ...parsed.truncated ? { truncated: true } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+async function fetchAgentLogsViaHostd(name, lines, opts = {}) {
+  const socketPath = opts.socketPath !== undefined ? opts.socketPath : resolveHostdOperatorSocket();
+  if (!socketPath) {
+    return { ok: false, error: HOSTD_UNREACHABLE_LOGS_MESSAGE };
+  }
+  const send = opts.send ?? hostdRequest;
+  const tail = Math.max(1, Math.min(lines, 2000));
+  const req = {
+    v: 1,
+    op: "agent_logs",
+    request_id: readRequestId("agent_logs"),
+    args: { name, tail }
+  };
+  try {
+    const resp = await send({ socketPath, timeoutMs: opts.timeoutMs ?? READ_TIMEOUT_MS }, req);
+    if (resp.result === "completed") {
+      return { ok: true, logs: resp.stdout_tail ?? "" };
+    }
+    return {
+      ok: false,
+      error: resp.error ?? (resp.stderr_tail && resp.stderr_tail.trim()) ?? `hostd agent_logs returned '${resp.result}'`
+    };
+  } catch {
+    return { ok: false, error: HOSTD_UNREACHABLE_LOGS_MESSAGE };
+  }
+}
+var HOSTD_UNREACHABLE_LOGS_MESSAGE = "Logs need hostd (the dashboard container has no docker access by design). " + "Ensure host_control is enabled, or run `switchroom agent logs <name>` on the host.";
+var HOSTD_UNREACHABLE_CONTROL_MESSAGE = "Agent control needs hostd (the dashboard container has no docker access by design). " + "Ensure host_control is enabled, or run `switchroom agent restart <name>` on the host.";
+async function restartAgentViaHostd(name, opts = {}) {
+  const socketPath = opts.socketPath !== undefined ? opts.socketPath : resolveHostdOperatorSocket();
+  if (!socketPath) {
+    return { ok: false, error: HOSTD_UNREACHABLE_CONTROL_MESSAGE };
+  }
+  const send = opts.send ?? hostdRequest;
+  const req = {
+    v: 1,
+    op: "agent_restart",
+    request_id: readRequestId("agent_restart"),
+    args: {
+      name,
+      reason: opts.reason ?? "restart requested from dashboard",
+      force: opts.force ?? true
+    }
+  };
+  try {
+    const resp = await send({ socketPath, timeoutMs: opts.timeoutMs ?? READ_TIMEOUT_MS }, req);
+    if (resp.result === "completed" || resp.result === "started") {
+      return { ok: true };
+    }
+    return {
+      ok: false,
+      error: resp.error ?? `hostd agent_restart returned '${resp.result}'`
+    };
+  } catch {
+    return { ok: false, error: HOSTD_UNREACHABLE_CONTROL_MESSAGE };
+  }
+}
+
 // src/web/api.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
 
@@ -73731,7 +74121,78 @@ function listSubagents(db, opts = {}) {
   return rows.map(mapSubagentRow);
 }
 
+// src/web/cache.ts
+class SwrCache {
+  now;
+  entries = new Map;
+  constructor(now = Date.now) {
+    this.now = now;
+  }
+  async get(key, ttlMs, producer) {
+    const existing = this.entries.get(key);
+    if (!existing) {
+      const value = await producer();
+      const fetchedAt = this.now();
+      this.entries.set(key, { value, fetchedAt, refreshing: false });
+      return { value, dataAsOf: fetchedAt, stale: false };
+    }
+    const age = this.now() - existing.fetchedAt;
+    if (age < ttlMs) {
+      return {
+        value: existing.value,
+        dataAsOf: existing.fetchedAt,
+        stale: false
+      };
+    }
+    if (!existing.refreshing) {
+      existing.refreshing = true;
+      producer().then((value) => {
+        this.entries.set(key, {
+          value,
+          fetchedAt: this.now(),
+          refreshing: false
+        });
+      }, () => {
+        const cur = this.entries.get(key);
+        if (cur)
+          cur.refreshing = false;
+      });
+    }
+    return {
+      value: existing.value,
+      dataAsOf: existing.fetchedAt,
+      stale: true
+    };
+  }
+  clear() {
+    this.entries.clear();
+  }
+}
+
 // src/web/api.ts
+var dashboardCache = new SwrCache;
+var DASHBOARD_CACHE_TTL = {
+  "system-health": 15000,
+  "memory-health": 60000,
+  schedule: 30000,
+  agents: 5000,
+  accounts: 1e4,
+  approvals: 15000,
+  grants: 15000
+};
+function readLastTurnAt(agentsDir, name) {
+  try {
+    const db = openTurnsDb(resolve27(agentsDir, name));
+    try {
+      const turns = listTurnsForAgent(db, { limit: 1 });
+      return turns.length > 0 ? turns[0].started_at : null;
+    } finally {
+      db.close();
+    }
+  } catch {
+    return null;
+  }
+}
 function agentBridgeAlive(agentsDir, name, maxAgeMs = 30000, now = Date.now()) {
   try {
     const f = resolve27(agentsDir, name, "telegram", ".bridge-alive");
@@ -73740,11 +74201,25 @@ function agentBridgeAlive(agentsDir, name, maxAgeMs = 30000, now = Date.now()) {
     return false;
   }
 }
-function handleGetAgents(config) {
+var AGENT_STATUS_CACHE_TTL_MS = 5000;
+var statusCache = new Map;
+async function cachedFleetStatus(now, fetchImpl = fetchFleetStatusViaHostd) {
+  const cached = statusCache.get("fleet");
+  if (cached && now - cached.fetchedAt < AGENT_STATUS_CACHE_TTL_MS) {
+    return cached.statuses;
+  }
+  const statuses = await fetchImpl();
+  statusCache.set("fleet", { statuses, fetchedAt: now });
+  return statuses;
+}
+async function handleGetAgents(config, deps = {}) {
+  const readLastTurn = deps.readLastTurn ?? readLastTurnAt;
   const statuses = getAllAgentStatuses(config);
   const authStatuses = getAllAuthStatuses(config);
   const agentsDir = resolveAgentsDir(config);
   const agents = [];
+  const needsBackfill = Object.values(statuses).some((s) => s && (s.uptime === null || s.memory === null));
+  const hostdStatuses = needsBackfill ? await cachedFleetStatus(deps.now ?? Date.now(), deps.fetchFleetStatus) : null;
   for (const [name, agentConfig] of Object.entries(config.agents)) {
     const status = statuses[name];
     const auth = authStatuses[name];
@@ -73752,11 +74227,14 @@ function handleGetAgents(config) {
     const resolved = resolveAgentConfig(config.defaults, config.profiles, agentConfig);
     const primaryAccount = resolved.auth?.override ?? config.auth?.active;
     const active = status?.active === "active" ? "active" : agentBridgeAlive(agentsDir, name) ? "active" : status?.active ?? "unknown";
+    const hostd = hostdStatuses?.[name];
+    const uptime = status?.uptime ?? hostd?.uptime ?? null;
+    const memory = status?.memory ?? hostd?.memory ?? null;
     agents.push({
       name,
       active,
-      uptime: status?.uptime ?? null,
-      memory: status?.memory ?? null,
+      uptime,
+      memory,
       extends: agentConfig.extends ?? "default",
       topic_name: agentConfig.topic_name,
       topic_emoji: agentConfig.topic_emoji,
@@ -73767,54 +74245,40 @@ function handleGetAgents(config) {
         timeUntilExpiry: auth?.timeUntilExpiry,
         expiresAt: auth?.expiresAt
       },
-      memoryCollection: collection
+      memoryCollection: collection,
+      lastTurnAt: readLastTurn(agentsDir, name)
     });
   }
   return agents;
 }
-function handleStartAgent(name) {
-  try {
-    startAgent(name);
-    captureEvent("agent_started", { agent: name, source: "web_api" });
-    return { ok: true };
-  } catch (err) {
-    captureException(err, { action: "start_agent", agent: name });
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
-  }
+function startStopNeedsOperatorMessage(verb) {
+  return `${verb === "start" ? "Start" : "Stop"} from the dashboard needs operator approval (a follow-up). ` + `For now run on the host: \`switchroom agent ${verb} ${"<name>"}\`.`;
 }
-function handleStopAgent(name) {
-  try {
-    stopAgent(name);
-    captureEvent("agent_stopped", { agent: name, source: "web_api" });
-    return { ok: true };
-  } catch (err) {
-    captureException(err, { action: "stop_agent", agent: name });
-    return { ok: false, error: err instanceof Error ? err.message : String(err) };
-  }
+var START_NEEDS_OPERATOR_MESSAGE = startStopNeedsOperatorMessage("start");
+var STOP_NEEDS_OPERATOR_MESSAGE = startStopNeedsOperatorMessage("stop");
+async function handleStartAgent(_name) {
+  return { ok: false, error: START_NEEDS_OPERATOR_MESSAGE };
+}
+async function handleStopAgent(_name) {
+  return { ok: false, error: STOP_NEEDS_OPERATOR_MESSAGE };
 }
-function handleRestartAgent(name) {
+async function handleRestartAgent(name, deps = {}) {
+  const restart = deps.restart ?? restartAgentViaHostd;
   try {
-    restartAgent(name);
-    captureEvent("agent_restarted", { agent: name, source: "web_api" });
-    return { ok: true };
+    const result = await restart(name);
+    if (result.ok) {
+      captureEvent("agent_restarted", { agent: name, source: "web_api" });
+      return { ok: true };
+    }
+    return { ok: false, error: result.error };
   } catch (err) {
     captureException(err, { action: "restart_agent", agent: name });
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
   }
 }
-function handleGetLogs(name, lines = 50) {
-  const res = spawnSync5("docker", ["logs", "--tail", String(lines), containerName(name)], { encoding: "utf-8", timeout: 5000 });
-  if (res.error) {
-    return { ok: false, error: res.error.message };
-  }
-  if (res.status !== 0) {
-    const stderr = (res.stderr ?? "").trim();
-    return {
-      ok: false,
-      error: stderr || `docker logs exited ${res.status ?? "non-zero"}`
-    };
-  }
-  return { ok: true, logs: `${res.stdout ?? ""}${res.stderr ?? ""}` };
+async function handleGetLogs(name, lines = 50, deps = {}) {
+  const fetchLogs = deps.fetchLogs ?? fetchAgentLogsViaHostd;
+  return await fetchLogs(name, lines);
 }
 function handleGetTurns(config, agentName, limit) {
   try {
@@ -73858,6 +74322,31 @@ var quotaCache = new Map;
 function quotaEntryFresh(e, now) {
   return !!e && now - e.fetchedAt < QUOTA_CACHE_TTL_MS;
 }
+function isoToMs(iso) {
+  if (!iso)
+    return null;
+  const ms = Date.parse(iso);
+  return Number.isNaN(ms) ? null : ms;
+}
+function deriveAccountQuotaView(brokerState, probe, now) {
+  const probeFresh = !!probe && now - probe.fetchedAt < QUOTA_CACHE_TTL_MS;
+  let quotaUsage = probeFresh ? probe.usage ?? null : null;
+  let quotaUsageSource = quotaUsage ? "probe" : null;
+  let quotaStale = !probeFresh;
+  if (!quotaUsage && brokerState?.last_quota) {
+    const lq = brokerState.last_quota;
+    quotaUsage = {
+      fiveHourPct: lq.fiveHourUtilizationPct,
+      sevenDayPct: lq.sevenDayUtilizationPct,
+      fiveHourResetAt: isoToMs(lq.fiveHourResetAt),
+      sevenDayResetAt: isoToMs(lq.sevenDayResetAt),
+      capturedAt: lq.capturedAt
+    };
+    quotaUsageSource = "broker-cache";
+    quotaStale = now - lq.capturedAt >= QUOTA_CACHE_TTL_MS;
+  }
+  return { quotaUsage, quotaUsageSource, quotaStale };
+}
 async function handleGetAccounts(config, home2) {
   const infos = getAccountInfos(Date.now(), home2);
   const brokerAccounts = new Map;
@@ -73884,12 +74373,15 @@ async function handleGetAccounts(config, home2) {
       usedBy.sort();
     }
     const now = Date.now();
-    const ce = quotaCache.get(info.label);
+    const brokerState = brokerAccounts.get(info.label) ?? null;
+    const view = deriveAccountQuotaView(brokerState, quotaCache.get(info.label), now);
     return {
       ...info,
-      quota: brokerAccounts.get(info.label) ?? null,
-      quotaUsage: quotaEntryFresh(ce, now) ? ce.usage ?? null : null,
-      quotaStale: !quotaEntryFresh(ce, now),
+      health: brokerState?.exhausted ? "quota-exhausted" : info.health,
+      quota: brokerState,
+      quotaUsage: view.quotaUsage,
+      quotaUsageSource: view.quotaUsageSource,
+      quotaStale: view.quotaStale,
       usedBy
     };
   });
@@ -74012,6 +74504,12 @@ function inspectEnv(container, keys) {
   } catch {}
   return out;
 }
+var HOSTD_NOISE_OPS = new Set([
+  "agent_smoke",
+  "get_status",
+  "agent_status",
+  "agent_logs"
+]);
 async function handleGetSystemHealth(config, home2) {
   const broker = { reachable: false };
   try {
@@ -74063,7 +74561,7 @@ async function handleGetSystemHealth(config, home2) {
     if (existsSync47(logPath)) {
       hostd.auditLogPresent = true;
       const raw = readFileSync43(logPath, "utf-8");
-      hostd.recent = readAndFilter(raw, {}, 10);
+      hostd.recent = readAndFilter(raw, {}, 1000).filter((e) => !HOSTD_NOISE_OPS.has(e.op)).slice(-10);
     }
   } catch (err) {
     hostd.error = err instanceof Error ? err.message : String(err);
@@ -74084,8 +74582,10 @@ async function handleGetGoogleAccounts(config) {
       }
     });
   } catch (err) {
-    if (!(err instanceof AuthBrokerUnreachableError))
-      throw err;
+    if (!(err instanceof AuthBrokerUnreachableError)) {
+      process.stderr.write(`dashboard: live broker error reading workspace accounts ` + `(${err instanceof AuthBrokerError ? err.code : "unknown"}); ` + `showing config-only ACL: ${err instanceof Error ? err.message : String(err)}
+`);
+    }
   }
   const cfgAccounts = config.google_accounts ?? {};
   const keys = new Set([
@@ -74122,8 +74622,10 @@ async function handleGetMicrosoftAccounts(config) {
       }
     });
   } catch (err) {
-    if (!(err instanceof AuthBrokerUnreachableError))
-      throw err;
+    if (!(err instanceof AuthBrokerUnreachableError)) {
+      process.stderr.write(`dashboard: live broker error reading workspace accounts ` + `(${err instanceof AuthBrokerError ? err.code : "unknown"}); ` + `showing config-only ACL: ${err instanceof Error ? err.message : String(err)}
+`);
+    }
   }
   const cfgAccounts = config.microsoft_accounts ?? {};
   const keys = new Set([
@@ -74328,7 +74830,16 @@ function handleSetConnectionAccess(configPath, config, args, deps = {}) {
   });
   return { ok: true, changed: true, requestId, pendingApproval: true };
 }
-function handleGetSchedule(config) {
+async function handleGetSchedule(config, deps = {}) {
+  const fetchSchedule = deps.fetchSchedule ?? fetchScheduleViaHostd;
+  const viaHostd = await fetchSchedule();
+  if (viaHostd) {
+    return {
+      entries: viaHostd.entries,
+      recentByAgent: viaHostd.recentByAgent,
+      ...viaHostd.truncated ? { truncated: true } : {}
+    };
+  }
   const entries = collectScheduleEntries(config);
   const agentsDir = resolveAgentsDir(config);
   const recentByAgent = {};
@@ -74338,7 +74849,12 @@ function handleGetSchedule(config) {
     if (rows.length > 0)
       recentByAgent[agent] = rows.slice(-10);
   }
-  return { entries, recentByAgent };
+  return {
+    entries,
+    recentByAgent,
+    degraded: true,
+    reason: "schedule view needs hostd \u2014 showing base-config only " + "(agent-authored schedule.d crons are not included). " + "Ensure host_control is enabled."
+  };
 }
 async function handleGetApprovals() {
   const opSock = resolveKernelOperatorSocket();
@@ -74360,6 +74876,48 @@ async function handleGetApprovals() {
   const sorted = [...decisions].sort((a, b) => b.granted_at - a.granted_at);
   return { reachable: true, decisions: sorted };
 }
+function brokerOperatorSocketPath(home2 = process.env.HOME || homedir23()) {
+  return join44(home2, ".switchroom", "broker-operator", "sock");
+}
+function resolveBrokerOperatorSocket(home2 = process.env.HOME || homedir23()) {
+  const p = brokerOperatorSocketPath(home2);
+  return existsSync47(p) ? p : null;
+}
+async function handleGetGrants(deps = {}) {
+  const socket = "socketPath" in deps ? deps.socketPath : resolveBrokerOperatorSocket();
+  if (socket == null) {
+    return {
+      reachable: false,
+      grants: [],
+      error: "vault-broker operator socket not present \u2014 host-side grant " + "listing needs a broker-operator bind (re-apply to (re)create it)."
+    };
+  }
+  const list = deps.list ?? listGrantsViaBroker;
+  let result;
+  try {
+    result = await list(undefined, { socket });
+  } catch (err) {
+    return {
+      reachable: false,
+      grants: [],
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+  if (result.kind !== "ok") {
+    return { reachable: false, grants: [], error: result.msg };
+  }
+  const rows = result.grants.map((g) => ({
+    id: g.id,
+    agent: g.agent_slug,
+    keys: g.key_allow,
+    writeKeys: g.write_allow,
+    expiresAt: g.expires_at == null ? null : g.expires_at * 1000,
+    createdAt: g.created_at * 1000,
+    description: g.description
+  }));
+  rows.sort((a, b) => b.createdAt - a.createdAt);
+  return { reachable: true, grants: rows };
+}
 async function handleGetMemoryHealth(config, opts) {
   const url = config.memory?.config?.url ?? "http://127.0.0.1:18888/mcp/";
   const now = opts?.now ?? new Date;
@@ -74381,6 +74939,8 @@ async function handleGetMemoryHealth(config, opts) {
     const gaps = recentUnextracted(h.unextractedDocuments, 30, now);
     const stale = staleMentalModels(h.mentalModels, 7, now);
     const corrupted = corruptedMentalModels(h.mentalModels);
+    const newestAge = ageDays(h.newestDocumentAt, now);
+    const pendingStuck = h.pendingOperations > 0 && newestAge !== null && newestAge > 1;
     let status = "ok";
     let statusDetail = "facts flowing";
     if (!h.ok) {
@@ -74392,6 +74952,9 @@ async function handleGetMemoryHealth(config, opts) {
     } else if (gaps.length > 0) {
       status = "fail";
       statusDetail = `${gaps.length} recent conversation(s) stored with zero extracted facts \u2014 invisible to recall`;
+    } else if (pendingStuck) {
+      status = "warn";
+      statusDetail = `${h.pendingOperations} memory operation(s) pending with no new documents for ${Math.round(newestAge)}d \u2014 pipeline may be stuck`;
     } else if (stale.length > 0) {
       status = "warn";
       statusDetail = `${stale.length} mental model(s) not refreshed in >7d`;
@@ -74410,6 +74973,7 @@ async function handleGetMemoryHealth(config, opts) {
       newestDocumentAt: h.newestDocumentAt,
       recentUnextractedCount: gaps.length,
       oldestUnextractedAt: gaps[0]?.createdAt ?? null,
+      unextractedDocIds: gaps.slice(0, 20).map((d) => d.id),
       mentalModels: h.mentalModels,
       staleMentalModelCount: stale.length,
       corruptedMentalModelNames: corrupted.map((m) => m.name),
@@ -74420,11 +74984,236 @@ async function handleGetMemoryHealth(config, opts) {
   rows.sort((a, b) => a.bank.localeCompare(b.bank));
   return { reachable, url, banks: rows };
 }
+function resolveMemoryUrl(config) {
+  return config.memory?.config?.url ?? "http://127.0.0.1:18888/mcp/";
+}
+function isKnownBank(config, bank) {
+  for (const agentName of Object.keys(config.agents)) {
+    if (getCollectionForAgent(agentName, config) === bank)
+      return true;
+  }
+  return false;
+}
+async function handleMemoryReprocess(config, body, deps) {
+  const bank = typeof body.bank === "string" ? body.bank : "";
+  if (!bank)
+    return { ok: false, error: "Body must include `bank` (string)." };
+  if (!isKnownBank(config, bank))
+    return { ok: false, error: `Unknown bank: ${bank}` };
+  const url = resolveMemoryUrl(config);
+  const inspect = deps?.inspect ?? inspectBankHealth;
+  const trigger = deps?.trigger ?? reprocessDocuments;
+  const now = deps?.now ?? new Date;
+  try {
+    const h = await inspect(url, bank, { fetchImpl: deps?.fetchImpl });
+    if (!h.ok)
+      return { ok: false, error: `inspection failed: ${h.reason ?? "unknown"}` };
+    const gaps = recentUnextracted(h.unextractedDocuments, 30, now);
+    const docIds = gaps.slice(0, 20).map((d) => d.id);
+    if (docIds.length === 0)
+      return { ok: true, triggered: 0, failed: 0 };
+    const result = await trigger(restBaseFromMcpUrl(url), bank, docIds, {
+      fetchImpl: deps?.fetchImpl
+    });
+    return {
+      ok: result.failed === 0,
+      triggered: result.triggered,
+      failed: result.failed,
+      ...result.error ? { error: result.error } : {}
+    };
+  } catch (err) {
+    return { ok: false, error: String(err.message ?? err) };
+  }
+}
+async function handleMemoryRefreshModel(config, body, deps) {
+  const bank = typeof body.bank === "string" ? body.bank : "";
+  const modelId = typeof body.modelId === "string" ? body.modelId : "";
+  if (!bank)
+    return { ok: false, error: "Body must include `bank` (string)." };
+  if (!modelId)
+    return { ok: false, error: "Body must include `modelId` (string)." };
+  if (!isKnownBank(config, bank))
+    return { ok: false, error: `Unknown bank: ${bank}` };
+  const url = resolveMemoryUrl(config);
+  const inspect = deps?.inspect ?? inspectBankHealth;
+  const trigger = deps?.trigger ?? refreshMentalModel;
+  try {
+    const h = await inspect(url, bank, { fetchImpl: deps?.fetchImpl });
+    if (!h.ok)
+      return { ok: false, error: `inspection failed: ${h.reason ?? "unknown"}` };
+    if (!h.mentalModels.some((m) => m.id === modelId)) {
+      return { ok: false, error: `Unknown mental model for bank ${bank}` };
+    }
+    return await trigger(restBaseFromMcpUrl(url), bank, modelId, {
+      fetchImpl: deps?.fetchImpl
+    });
+  } catch (err) {
+    return { ok: false, error: String(err.message ?? err) };
+  }
+}
+async function handleMemoryBuildProfile(config, body, deps) {
+  const bank = typeof body.bank === "string" ? body.bank : "";
+  if (!bank)
+    return { ok: false, error: "Body must include `bank` (string)." };
+  if (!isKnownBank(config, bank))
+    return { ok: false, error: `Unknown bank: ${bank}` };
+  const url = resolveMemoryUrl(config);
+  const trigger = deps?.trigger ?? buildUserProfile;
+  try {
+    return await trigger(url, bank, { fetchImpl: deps?.fetchImpl });
+  } catch (err) {
+    return { ok: false, error: String(err.message ?? err) };
+  }
+}
+var ATTENTION_SEVERITY_RANK = {
+  critical: 0,
+  warn: 1,
+  info: 2
+};
+var ATTENTION_MAX_ITEMS = 12;
+function deriveAttention(parts, now) {
+  const items = [];
+  const mem = parts.memoryHealth;
+  if (mem) {
+    if (!mem.reachable) {
+      items.push({
+        severity: "critical",
+        title: "Hindsight unreachable",
+        detail: "Memory recall and extraction are down \u2014 agents are amnesiac.",
+        tab: "memory"
+      });
+    }
+    for (const bank of mem.banks ?? []) {
+      for (const name of bank.corruptedMentalModelNames ?? []) {
+        items.push({
+          severity: "critical",
+          title: `Mental model corrupted: ${name}`,
+          detail: `Bank ${bank.bank} \u2014 an LLM-failure message is injected into every turn until refreshed.`,
+          tab: "memory"
+        });
+      }
+      if (bank.recentUnextractedCount > 0) {
+        items.push({
+          severity: "critical",
+          title: `${bank.recentUnextractedCount} unextracted conversation(s)`,
+          detail: `Bank ${bank.bank} \u2014 stored with zero extracted facts, invisible to recall.`,
+          tab: "memory"
+        });
+      }
+      if (bank.staleMentalModelCount > 0) {
+        items.push({
+          severity: "warn",
+          title: `${bank.staleMentalModelCount} stale mental model(s)`,
+          detail: `Bank ${bank.bank} \u2014 not refreshed in >7d.`,
+          tab: "memory"
+        });
+      }
+    }
+  }
+  for (const acct of parts.accounts ?? []) {
+    if (acct?.quota?.exhausted) {
+      items.push({
+        severity: "warn",
+        title: `Account ${acct.label} quota exhausted`,
+        detail: acct.quota.exhausted_until ? `Resets around ${new Date(acct.quota.exhausted_until).toISOString()}.` : undefined,
+        tab: "accounts"
+      });
+    }
+  }
+  for (const [agent, fires] of Object.entries(parts.schedule?.recentByAgent ?? {})) {
+    if ((fires ?? []).some((f) => f && f.exitCode !== 0)) {
+      items.push({
+        severity: "warn",
+        title: `Cron ${agent} last fire failed`,
+        detail: "A recent scheduled fire returned a non-zero exit code.",
+        tab: "schedule"
+      });
+    }
+  }
+  const sys = parts.systemHealth;
+  if (sys) {
+    if (sys.broker?.reachable === false) {
+      items.push({
+        severity: "critical",
+        title: "Auth-broker unreachable",
+        detail: sys.broker.error,
+        tab: "system"
+      });
+    }
+    if (sys.hindsight?.running === false) {
+      items.push({
+        severity: "critical",
+        title: "Hindsight not running",
+        detail: "The memory backend container isn't serving.",
+        tab: "system"
+      });
+    }
+    if (sys.hostd?.error) {
+      items.push({
+        severity: "critical",
+        title: "Hostd error",
+        detail: sys.hostd.error,
+        tab: "system"
+      });
+    }
+  }
+  const DAY_MS = 24 * 60 * 60 * 1000;
+  for (const agent of parts.agents ?? []) {
+    const exp = agent?.auth?.expiresAt;
+    if (typeof exp === "number" && exp - now > 0 && exp - now < DAY_MS) {
+      items.push({
+        severity: "warn",
+        title: `${agent.name} token expires soon`,
+        detail: "OAuth token expires within 24h \u2014 re-auth before it lapses.",
+        tab: "agents"
+      });
+    }
+  }
+  items.sort((a, b) => ATTENTION_SEVERITY_RANK[a.severity] - ATTENTION_SEVERITY_RANK[b.severity]);
+  return items.slice(0, ATTENTION_MAX_ITEMS);
+}
+async function handleGetSummary(deps, now = Date.now()) {
+  const safe = async (p) => {
+    try {
+      const r = await p();
+      return { value: r.value, dataAsOf: r.dataAsOf };
+    } catch {
+      return { value: null, dataAsOf: null };
+    }
+  };
+  const [agents, systemHealth, approvals, schedule, accounts, memoryHealth] = await Promise.all([
+    safe(deps.agents),
+    safe(deps.systemHealth),
+    safe(deps.approvals),
+    safe(deps.schedule),
+    safe(deps.accounts),
+    safe(deps.memoryHealth)
+  ]);
+  const stamps = [agents, systemHealth, approvals, schedule, accounts, memoryHealth].map((p) => p.dataAsOf).filter((d) => typeof d === "number");
+  const dataAsOf = stamps.length > 0 ? Math.min(...stamps) : 0;
+  const attention = deriveAttention({
+    memoryHealth: memoryHealth.value,
+    accounts: accounts.value,
+    schedule: schedule.value,
+    systemHealth: systemHealth.value,
+    agents: agents.value
+  }, now);
+  return {
+    agents: agents.value,
+    systemHealth: systemHealth.value,
+    approvals: approvals.value,
+    schedule: schedule.value,
+    accounts: accounts.value,
+    memoryHealth: memoryHealth.value,
+    attention,
+    dataAsOf
+  };
+}
 
 // src/web/webhook-handler.ts
 import { appendFileSync as appendFileSync4, existsSync as existsSync49, mkdirSync as mkdirSync28, readFileSync as readFileSync45, writeFileSync as writeFileSync26 } from "fs";
-import { join as join45 } from "path";
-import { homedir as homedir24 } from "os";
+import { join as join46 } from "path";
+import { homedir as homedir25 } from "os";
 
 // src/web/webhook-verify.ts
 import { createHmac as createHmac2, timingSafeEqual } from "crypto";
@@ -74630,12 +75419,12 @@ function forwardToGateway(socketPath, req, opts = {}) {
 
 // src/web/webhook-edge.ts
 import { existsSync as existsSync48, readFileSync as readFileSync44 } from "fs";
-import { join as join44 } from "path";
-import { homedir as homedir23 } from "os";
+import { join as join45 } from "path";
+import { homedir as homedir24 } from "os";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var EDGE_HEADER = "x-switchroom-edge";
 function edgeSecretPath() {
-  return join44(homedir23(), ".switchroom", "webhook-edge-secret");
+  return join45(homedir24(), ".switchroom", "webhook-edge-secret");
 }
 function loadEdgeSecret(path4) {
   const p = path4 ?? edgeSecretPath();
@@ -74698,8 +75487,8 @@ var agentDedupCache = new Map;
 function createFileDedupStore(resolveAgentDir) {
   return {
     check(agent, deliveryId, now) {
-      const telegramDir = join45(resolveAgentDir(agent), "telegram");
-      const filePath = join45(telegramDir, "webhook-dedup.json");
+      const telegramDir = join46(resolveAgentDir(agent), "telegram");
+      const filePath = join46(telegramDir, "webhook-dedup.json");
       if (!agentDedupCache.has(agent)) {
         agentDedupCache.set(agent, loadDedupFile(filePath));
       }
@@ -74751,7 +75540,7 @@ function shouldWriteThrottleIssue(agent, source, now, windowMap) {
   return true;
 }
 function writeThrottleIssue(agent, source, now, telegramDir, log) {
-  const issuesPath = join45(telegramDir, "issues.jsonl");
+  const issuesPath = join46(telegramDir, "issues.jsonl");
   try {
     mkdirSync28(telegramDir, { recursive: true });
     const record = {
@@ -74776,7 +75565,7 @@ function writeThrottleIssue(agent, source, now, telegramDir, log) {
 async function handleWebhookIngest(args, deps = {}) {
   const log = deps.log ?? ((s) => process.stderr.write(s));
   const now = (deps.now ?? Date.now)();
-  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join45(homedir24(), ".switchroom", "agents", a));
+  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join46(homedir25(), ".switchroom", "agents", a));
   const rateLimiter = deps.rateLimiter ?? defaultRateLimiter;
   const dedupStore = deps.dedupStore ?? createFileDedupStore(resolveAgentDir);
   if (!args.agentExists) {
@@ -74843,7 +75632,7 @@ async function handleWebhookIngest(args, deps = {}) {
   if (retryAfter !== null) {
     if (!args.viaGateway) {
       const agentDir2 = resolveAgentDir(args.agent);
-      const telegramDir2 = join45(agentDir2, "telegram");
+      const telegramDir2 = join46(agentDir2, "telegram");
       if (shouldWriteThrottleIssue(args.agent, source, now)) {
         writeThrottleIssue(args.agent, source, now, telegramDir2, log);
       }
@@ -74863,7 +75652,7 @@ async function handleWebhookIngest(args, deps = {}) {
   const eventType = source === "github" ? args.headers.get("x-github-event") ?? "unknown" : source === "linear" ? String(payload.type ?? "unknown").toLowerCase() : args.source;
   const rendered = source === "github" ? renderGithubEvent(eventType, payload) : source === "linear" ? renderLinearEvent(eventType, payload) : renderGenericEvent(args.source, payload);
   if (args.viaGateway) {
-    const socketPath = join45(resolveAgentDir(args.agent), "telegram", "webhook.sock");
+    const socketPath = join46(resolveAgentDir(args.agent), "telegram", "webhook.sock");
     const forward = deps.forwardFn ?? forwardToGateway;
     const deliveryId = source === "github" ? args.headers.get("x-github-delivery") ?? undefined : undefined;
     let resp;
@@ -74902,8 +75691,8 @@ async function handleWebhookIngest(args, deps = {}) {
     return jsonReply(202, { ok: true, recorded: true, ts: resp.ts });
   }
   const agentDir = resolveAgentDir(args.agent);
-  const telegramDir = join45(agentDir, "telegram");
-  const logPath = join45(telegramDir, "webhook-events.jsonl");
+  const telegramDir = join46(agentDir, "telegram");
+  const logPath = join46(telegramDir, "webhook-events.jsonl");
   try {
     mkdirSync28(telegramDir, { recursive: true });
     const record = {
@@ -74926,6 +75715,8 @@ async function handleWebhookIngest(args, deps = {}) {
 }
 
 // src/web/server.ts
+var LOG_POLL_INTERVAL_MS = 3000;
+var LOG_POLL_TAIL_LINES = 400;
 var MIME_TYPES = {
   ".html": "text/html",
   ".css": "text/css",
@@ -74956,8 +75747,8 @@ function resolveWebToken() {
   const fromEnv = process.env.SWITCHROOM_WEB_TOKEN;
   if (fromEnv && fromEnv.length > 0)
     return fromEnv;
-  const home2 = process.env.HOME ?? homedir25();
-  const tokenPath = join46(home2, ".switchroom", "web-token");
+  const home2 = process.env.HOME ?? homedir26();
+  const tokenPath = join47(home2, ".switchroom", "web-token");
   if (existsSync50(tokenPath)) {
     const existing = readFileSync46(tokenPath, "utf8").trim();
     if (existing.length > 0)
@@ -75042,7 +75833,7 @@ function checkWsAuth(req, token, server) {
   return presented !== null && constantTimeEqual(presented, token);
 }
 function loadWebhookSecrets() {
-  const path4 = join46(homedir25(), ".switchroom", "webhook-secrets.json");
+  const path4 = join47(homedir26(), ".switchroom", "webhook-secrets.json");
   if (!existsSync50(path4))
     return {};
   try {
@@ -75118,6 +75909,9 @@ function parseRoute(pathname, method) {
   if (method === "GET" && pathname === "/api/agents") {
     return { handler: "getAgents", params: {} };
   }
+  if (method === "GET" && pathname === "/api/summary") {
+    return { handler: "getSummary", params: {} };
+  }
   const logsMatch = pathname.match(/^\/api\/agents\/([^/]+)\/logs$/);
   if (method === "GET" && logsMatch) {
     return { handler: "getLogs", params: { name: logsMatch[1] } };
@@ -75148,6 +75942,15 @@ function parseRoute(pathname, method) {
   if (method === "GET" && pathname === "/api/memory-health") {
     return { handler: "getMemoryHealth", params: {} };
   }
+  if (method === "POST" && pathname === "/api/memory/reprocess") {
+    return { handler: "memoryReprocess", params: {} };
+  }
+  if (method === "POST" && pathname === "/api/memory/refresh-model") {
+    return { handler: "memoryRefreshModel", params: {} };
+  }
+  if (method === "POST" && pathname === "/api/memory/build-profile") {
+    return { handler: "memoryBuildProfile", params: {} };
+  }
   if (method === "GET" && pathname === "/api/google-accounts") {
     return { handler: "getGoogleAccounts", params: {} };
   }
@@ -75163,6 +75966,9 @@ function parseRoute(pathname, method) {
   if (method === "GET" && pathname === "/api/approvals") {
     return { handler: "getApprovals", params: {} };
   }
+  if (method === "GET" && pathname === "/api/grants") {
+    return { handler: "getGrants", params: {} };
+  }
   if (method === "GET" && pathname === "/api/accounts") {
     return { handler: "getAccounts", params: {} };
   }
@@ -75215,6 +76021,14 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
       return config;
     }
   };
+  const cachedAgents = () => dashboardCache.get("agents", DASHBOARD_CACHE_TTL.agents, () => handleGetAgents(freshConfig()));
+  const cachedSystemHealth = () => dashboardCache.get("system-health", DASHBOARD_CACHE_TTL["system-health"], () => handleGetSystemHealth(freshConfig()));
+  const cachedMemoryHealth = () => dashboardCache.get("memory-health", DASHBOARD_CACHE_TTL["memory-health"], () => handleGetMemoryHealth(freshConfig()));
+  const cachedSchedule = () => dashboardCache.get("schedule", DASHBOARD_CACHE_TTL.schedule, () => handleGetSchedule(freshConfig()));
+  const cachedApprovals = () => dashboardCache.get("approvals", DASHBOARD_CACHE_TTL.approvals, () => handleGetApprovals());
+  const cachedGrants = () => dashboardCache.get("grants", DASHBOARD_CACHE_TTL.grants, () => handleGetGrants());
+  const cachedAccounts = () => dashboardCache.get("accounts", DASHBOARD_CACHE_TTL.accounts, () => handleGetAccounts(freshConfig()));
+  const withStamp = (part) => ({ ...part.value, dataAsOf: part.dataAsOf, stale: part.stale });
   const localhostOnly = hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1";
   const server = Bun.serve({
     port,
@@ -75251,7 +76065,16 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
           return authError;
         switch (route.handler) {
           case "getAgents":
-            return jsonResponse(handleGetAgents(config));
+            return (async () => jsonResponse((await cachedAgents()).value))();
+          case "getSummary":
+            return (async () => jsonResponse(await handleGetSummary({
+              agents: cachedAgents,
+              systemHealth: cachedSystemHealth,
+              approvals: cachedApprovals,
+              schedule: cachedSchedule,
+              accounts: cachedAccounts,
+              memoryHealth: cachedMemoryHealth
+            })))();
           case "getLogs": {
             const agentName = route.params.name;
             if (!config.agents[agentName]) {
@@ -75259,28 +76082,28 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
             }
             const rawLines = Number(url.searchParams.get("lines") ?? "50");
             const lines = Number.isInteger(rawLines) && rawLines >= 1 && rawLines <= 1e4 ? rawLines : 50;
-            return jsonResponse(handleGetLogs(agentName, lines));
+            return (async () => jsonResponse(await handleGetLogs(agentName, lines)))();
           }
           case "startAgent": {
             const agentName = route.params.name;
             if (!config.agents[agentName]) {
               return jsonResponse({ ok: false, error: `Unknown agent: ${agentName}` }, 404);
             }
-            return jsonResponse(handleStartAgent(agentName));
+            return (async () => jsonResponse(await handleStartAgent(agentName)))();
           }
           case "stopAgent": {
             const agentName = route.params.name;
             if (!config.agents[agentName]) {
               return jsonResponse({ ok: false, error: `Unknown agent: ${agentName}` }, 404);
             }
-            return jsonResponse(handleStopAgent(agentName));
+            return (async () => jsonResponse(await handleStopAgent(agentName)))();
           }
           case "restartAgent": {
             const agentName = route.params.name;
             if (!config.agents[agentName]) {
               return jsonResponse({ ok: false, error: `Unknown agent: ${agentName}` }, 404);
             }
-            return jsonResponse(handleRestartAgent(agentName));
+            return (async () => jsonResponse(await handleRestartAgent(agentName)))();
           }
           case "getTurns": {
             const agentName = route.params.name;
@@ -75308,9 +76131,9 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
             return jsonResponse(result.subagents);
           }
           case "getSystemHealth":
-            return (async () => jsonResponse(await handleGetSystemHealth(config)))();
+            return (async () => jsonResponse(withStamp(await cachedSystemHealth())))();
           case "getMemoryHealth":
-            return (async () => jsonResponse(await handleGetMemoryHealth(freshConfig())))();
+            return (async () => jsonResponse(withStamp(await cachedMemoryHealth())))();
           case "getGoogleAccounts":
             return (async () => jsonResponse(await handleGetGoogleAccounts(freshConfig())))();
           case "getMicrosoftAccounts":
@@ -75318,11 +76141,13 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
           case "getNotionWorkspace":
             return jsonResponse(handleGetNotionWorkspace(freshConfig()));
           case "getSchedule":
-            return jsonResponse(handleGetSchedule(config));
+            return (async () => jsonResponse(withStamp(await cachedSchedule())))();
           case "getApprovals":
-            return (async () => jsonResponse(await handleGetApprovals()))();
+            return (async () => jsonResponse(withStamp(await cachedApprovals())))();
+          case "getGrants":
+            return (async () => jsonResponse(withStamp(await cachedGrants())))();
           case "getAccounts":
-            return (async () => jsonResponse(await handleGetAccounts(config)))();
+            return (async () => jsonResponse((await cachedAccounts()).value))();
           case "useAccount": {
             return (async () => {
               let body;
@@ -75386,6 +76211,45 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
               return jsonResponse(result, result.ok ? 200 : 502);
             })();
           }
+          case "memoryReprocess": {
+            return (async () => {
+              let body = {};
+              try {
+                const raw = await req.text();
+                body = raw ? JSON.parse(raw) : {};
+              } catch {
+                return jsonResponse({ ok: false, error: "Invalid JSON body" }, 400);
+              }
+              const result = await handleMemoryReprocess(freshConfig(), body);
+              return jsonResponse(result, result.ok ? 200 : 400);
+            })();
+          }
+          case "memoryRefreshModel": {
+            return (async () => {
+              let body = {};
+              try {
+                const raw = await req.text();
+                body = raw ? JSON.parse(raw) : {};
+              } catch {
+                return jsonResponse({ ok: false, error: "Invalid JSON body" }, 400);
+              }
+              const result = await handleMemoryRefreshModel(freshConfig(), body);
+              return jsonResponse(result, result.ok ? 200 : 400);
+            })();
+          }
+          case "memoryBuildProfile": {
+            return (async () => {
+              let body = {};
+              try {
+                const raw = await req.text();
+                body = raw ? JSON.parse(raw) : {};
+              } catch {
+                return jsonResponse({ ok: false, error: "Invalid JSON body" }, 400);
+              }
+              const result = await handleMemoryBuildProfile(freshConfig(), body);
+              return jsonResponse(result, result.ok ? 200 : 400);
+            })();
+          }
           case "getAgentAccounts": {
             const agentName = route.params.name;
             if (!config.agents[agentName]) {
@@ -75403,7 +76267,7 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         }
       }
       let filePath = pathname === "/" ? "/index.html" : pathname;
-      const fullPath = join46(uiDir, filePath);
+      const fullPath = join47(uiDir, filePath);
       if (!existsSync50(fullPath)) {
         return new Response("Not Found", { status: 404 });
       }
@@ -75427,64 +76291,79 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
     websocket: {
       open(_ws) {},
       close(ws) {
-        const proc = ws._logProcess;
-        if (proc) {
-          proc.kill();
-          ws._logProcess = null;
+        const interval = ws._logInterval;
+        if (interval) {
+          clearInterval(interval);
+          ws._logInterval = null;
         }
       },
       message(ws, message) {
+        let data;
         try {
-          const data = JSON.parse(String(message));
-          if (data.type === "subscribe" && data.agent) {
-            const agentName = String(data.agent).replace(/[^a-zA-Z0-9_-]/g, "");
-            if (!agentName || !config.agents[agentName]) {
-              try {
-                ws.send(JSON.stringify({ type: "error", error: "Unknown agent" }));
-              } catch {}
-              return;
-            }
-            const existing = ws._logProcess;
-            if (existing) {
-              existing.kill();
-              ws._logProcess = null;
-            }
-            const child = spawn5("docker", ["logs", "-f", "--tail", "20", containerName(agentName)], { stdio: ["ignore", "pipe", "pipe"] });
-            child.on("error", (err) => {
+          data = JSON.parse(String(message));
+        } catch {
+          return;
+        }
+        const clearLogInterval = () => {
+          const existing = ws._logInterval;
+          if (existing) {
+            clearInterval(existing);
+            ws._logInterval = null;
+          }
+        };
+        if (data && data.type === "unsubscribe") {
+          clearLogInterval();
+          return;
+        }
+        if (data && data.type === "subscribe" && data.agent) {
+          const agentName = String(data.agent).replace(/[^a-zA-Z0-9_-]/g, "");
+          if (!agentName || !config.agents[agentName]) {
+            try {
+              ws.send(JSON.stringify({ type: "error", error: "Unknown agent" }));
+            } catch {}
+            return;
+          }
+          clearLogInterval();
+          const poll = async () => {
+            let result;
+            try {
+              result = await fetchAgentLogsViaHostd(agentName, LOG_POLL_TAIL_LINES);
+            } catch (err) {
               try {
                 ws.send(JSON.stringify({
                   type: "log_error",
                   agent: agentName,
-                  data: `failed to stream logs: ${err.message}
-`
+                  data: err instanceof Error ? err.message : String(err)
                 }));
               } catch {}
-            });
-            child.stdout.on("data", (chunk) => {
+              clearLogInterval();
+              return;
+            }
+            if (result.ok) {
               try {
                 ws.send(JSON.stringify({
                   type: "log",
                   agent: agentName,
-                  data: chunk.toString("utf-8")
+                  data: result.logs,
+                  replace: true
                 }));
               } catch {
-                child.kill();
+                clearLogInterval();
               }
-            });
-            child.stderr.on("data", (chunk) => {
+            } else {
               try {
                 ws.send(JSON.stringify({
                   type: "log_error",
                   agent: agentName,
-                  data: chunk.toString("utf-8")
+                  data: result.error
                 }));
-              } catch {
-                child.kill();
-              }
-            });
-            ws._logProcess = child;
-          }
-        } catch {}
+              } catch {}
+              clearLogInterval();
+            }
+          };
+          poll();
+          ws._logInterval = setInterval(() => void poll(), LOG_POLL_INTERVAL_MS);
+        }
       }
     }
   });
@@ -76447,8 +77326,8 @@ init_loader();
 init_lifecycle();
 import { cpSync as cpSync2, existsSync as existsSync58, mkdirSync as mkdirSync32, readFileSync as readFileSync52, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync26, chownSync as chownSync5 } from "node:fs";
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { join as join60, dirname as dirname14, resolve as resolve34 } from "node:path";
-import { homedir as homedir36 } from "node:os";
+import { join as join61, dirname as dirname14, resolve as resolve34 } from "node:path";
+import { homedir as homedir37 } from "node:os";
 
 // src/cli/release-yaml.ts
 var import_yaml18 = __toESM(require_dist(), 1);
@@ -76487,13 +77366,13 @@ function defaultPersistPin(configPath) {
     } catch {}
   };
 }
-var DEFAULT_COMPOSE_PATH = join60(homedir36(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH = join61(homedir37(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname14(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync58(join60(dir, ".git"))) {
+    if (existsSync58(join61(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync52(join60(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync52(join61(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -76653,7 +77532,7 @@ function planUpdate(opts) {
         return;
       }
       const source = resolve34(import.meta.dirname, "../../skills");
-      const dest = join60(homedir36(), ".switchroom", "skills", "_bundled");
+      const dest = join61(homedir37(), ".switchroom", "skills", "_bundled");
       if (!existsSync58(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
@@ -76767,7 +77646,7 @@ function defaultStatusProbe(composePath) {
       } catch {}
       let dir = dirname14(scriptPath);
       for (let i = 0;i < 8; i++) {
-        const pkgPath = join60(dir, "package.json");
+        const pkgPath = join61(dir, "package.json");
         if (existsSync58(pkgPath)) {
           try {
             const pkg = JSON.parse(readFileSync52(pkgPath, "utf-8"));
@@ -77209,7 +78088,7 @@ init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
 import { existsSync as existsSync59, readFileSync as readFileSync54 } from "node:fs";
-import { dirname as dirname15, join as join61 } from "node:path";
+import { dirname as dirname15, join as join62 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync4("claude --version 2>/dev/null", {
@@ -77259,11 +78138,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const pkgPath = join61(dir, "package.json");
+    const pkgPath = join62(dir, "package.json");
     if (existsSync59(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync54(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync59(join61(dir, ".git"))) {
+        if (pkg.name === "switchroom" && existsSync59(join62(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -77500,7 +78379,7 @@ import {
   writeFileSync as writeFileSync28,
   writeSync as writeSync7
 } from "node:fs";
-import { join as join62 } from "node:path";
+import { join as join63 } from "node:path";
 import { randomBytes as randomBytes12 } from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
 
@@ -77898,7 +78777,7 @@ function redactedMarker(ruleId) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path4 = join62(stateDir, ISSUES_FILE);
+  const path4 = join63(stateDir, ISSUES_FILE);
   if (!existsSync60(path4))
     return [];
   let raw;
@@ -77976,7 +78855,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve37(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync60(join62(stateDir, ISSUES_FILE)))
+  if (!existsSync60(join63(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -77994,7 +78873,7 @@ function resolve37(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync60(join62(stateDir, ISSUES_FILE)))
+  if (!existsSync60(join63(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -78012,7 +78891,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync60(join62(stateDir, ISSUES_FILE)))
+  if (!existsSync60(join63(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -78045,7 +78924,7 @@ function ensureDir(stateDir) {
   mkdirSync33(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path4 = join62(stateDir, ISSUES_FILE);
+  const path4 = join63(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path4}.tmp-${process.pid}-${randomBytes12(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -78067,7 +78946,7 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join62(stateDir, entry);
+    const tmpPath = join63(stateDir, entry);
     try {
       const stat = statSync28(tmpPath);
       if (stat.mtimeMs < cutoff) {
@@ -78079,7 +78958,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join62(stateDir, ISSUES_LOCK);
+  const lockPath = join63(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -78363,8 +79242,8 @@ function relTime(deltaMs) {
 // src/cli/deps.ts
 init_source();
 import { existsSync as existsSync63 } from "node:fs";
-import { homedir as homedir39 } from "node:os";
-import { join as join65, resolve as resolve38 } from "node:path";
+import { homedir as homedir40 } from "node:os";
+import { join as join66, resolve as resolve38 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash11 } from "node:crypto";
@@ -78375,8 +79254,8 @@ import {
   rmSync as rmSync13,
   writeFileSync as writeFileSync29
 } from "node:fs";
-import { dirname as dirname16, join as join63 } from "node:path";
-import { homedir as homedir37 } from "node:os";
+import { dirname as dirname16, join as join64 } from "node:path";
+import { homedir as homedir38 } from "node:os";
 import { execFileSync as execFileSync19 } from "node:child_process";
 
 class PythonEnvError extends Error {
@@ -78388,7 +79267,7 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join63(homedir37(), ".switchroom", "deps", "python");
+  return join64(homedir38(), ".switchroom", "deps", "python");
 }
 function hashFile(path4) {
   return createHash11("sha256").update(readFileSync56(path4)).digest("hex");
@@ -78400,11 +79279,11 @@ function ensurePythonEnv(opts) {
   if (!existsSync61(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join63(cacheRoot, skillName);
-  const stampPath = join63(venvDir, ".requirements.sha256");
-  const binDir = join63(venvDir, "bin");
-  const pythonBin = join63(binDir, "python");
-  const pipBin = join63(binDir, "pip");
+  const venvDir = join64(cacheRoot, skillName);
+  const stampPath = join64(venvDir, ".requirements.sha256");
+  const binDir = join64(venvDir, "bin");
+  const pythonBin = join64(binDir, "python");
+  const pipBin = join64(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
   if (!force && existsSync61(stampPath) && existsSync61(pythonBin)) {
     const existingHash = readFileSync56(stampPath, "utf8").trim();
@@ -78463,8 +79342,8 @@ import {
   rmSync as rmSync14,
   writeFileSync as writeFileSync30
 } from "node:fs";
-import { dirname as dirname17, join as join64 } from "node:path";
-import { homedir as homedir38 } from "node:os";
+import { dirname as dirname17, join as join65 } from "node:path";
+import { homedir as homedir39 } from "node:os";
 import { execFileSync as execFileSync20 } from "node:child_process";
 
 class NodeEnvError extends Error {
@@ -78487,7 +79366,7 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join64(homedir38(), ".switchroom", "deps", "node");
+  return join65(homedir39(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
   const sourceDir = dirname17(packageJsonPath);
@@ -78496,7 +79375,7 @@ function hashDepInputs(packageJsonPath) {
 `);
   hasher.update(readFileSync57(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join64(sourceDir, lockName);
+    const lockPath = join65(sourceDir, lockName);
     if (existsSync62(lockPath)) {
       hasher.update(`
 `);
@@ -78516,10 +79395,10 @@ function ensureNodeEnv(opts) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
   const sourceDir = dirname17(packageJsonPath);
-  const envDir = join64(cacheRoot, skillName);
-  const stampPath = join64(envDir, ".package.sha256");
-  const nodeModulesDir = join64(envDir, "node_modules");
-  const binDir = join64(nodeModulesDir, ".bin");
+  const envDir = join65(cacheRoot, skillName);
+  const stampPath = join65(envDir, ".package.sha256");
+  const nodeModulesDir = join65(envDir, "node_modules");
+  const binDir = join65(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
   if (!force && existsSync62(stampPath) && existsSync62(nodeModulesDir)) {
     const existingHash = readFileSync57(stampPath, "utf8").trim();
@@ -78537,12 +79416,12 @@ function ensureNodeEnv(opts) {
     rmSync14(envDir, { recursive: true, force: true });
   }
   mkdirSync35(envDir, { recursive: true });
-  copyFileSync9(packageJsonPath, join64(envDir, "package.json"));
+  copyFileSync9(packageJsonPath, join65(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join64(sourceDir, lockName);
+    const lockPath = join65(sourceDir, lockName);
     if (existsSync62(lockPath)) {
-      copyFileSync9(lockPath, join64(envDir, lockName));
+      copyFileSync9(lockPath, join65(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -78571,7 +79450,7 @@ function ensureNodeEnv(opts) {
 
 // src/cli/deps.ts
 function builtinSkillsRoot() {
-  return resolve38(homedir39(), ".switchroom/skills/_bundled");
+  return resolve38(homedir40(), ".switchroom/skills/_bundled");
 }
 function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
@@ -78581,13 +79460,13 @@ function registerDepsCommand(program3) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join65(skillsRoot, skill);
+    const skillDir = join66(skillsRoot, skill);
     if (!existsSync63(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join65(skillDir, "requirements.txt");
-    const packageJsonPath = join65(skillDir, "package.json");
+    const requirementsPath = join66(skillDir, "requirements.txt");
+    const packageJsonPath = join66(skillDir, "package.json");
     const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync63(requirementsPath));
     const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync63(packageJsonPath));
     let did = 0;
@@ -79542,7 +80421,7 @@ init_helpers();
 init_loader();
 init_merge();
 import { copyFileSync as copyFileSync10, existsSync as existsSync65, readFileSync as readFileSync58, writeFileSync as writeFileSync31 } from "node:fs";
-import { join as join66, resolve as resolve40 } from "node:path";
+import { join as join67, resolve as resolve40 } from "node:path";
 init_schema();
 function resolveSoulTargetOrExit(program3, agentName) {
   const config = getConfig(program3);
@@ -79566,7 +80445,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join66(workspaceDir, "SOUL.md"),
+    soulPath: join67(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -79633,7 +80512,7 @@ function registerSoulCommand(program3) {
 init_helpers();
 init_loader();
 import { existsSync as existsSync66, readFileSync as readFileSync59, readdirSync as readdirSync23, statSync as statSync29 } from "node:fs";
-import { resolve as resolve41, join as join67 } from "node:path";
+import { resolve as resolve41, join as join68 } from "node:path";
 import { createHash as createHash13 } from "node:crypto";
 init_merge();
 init_hindsight();
@@ -79644,7 +80523,7 @@ function estimateTokens(bytes) {
   return Math.round(bytes / 3.7);
 }
 function readMcpServerNames(agentDir) {
-  const mcpPath = join67(agentDir, ".mcp.json");
+  const mcpPath = join68(agentDir, ".mcp.json");
   if (!existsSync66(mcpPath))
     return [];
   try {
@@ -79658,7 +80537,7 @@ function sha256(content) {
   return createHash13("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join67(claudeConfigDir, "projects");
+  const projectsDir = join68(claudeConfigDir, "projects");
   if (!existsSync66(projectsDir))
     return;
   try {
@@ -79667,8 +80546,8 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join67(projectsDir, entry.name);
-      const transcriptPath = join67(projectPath, "transcript.jsonl");
+      const projectPath = join68(projectsDir, entry.name);
+      const transcriptPath = join68(projectPath, "transcript.jsonl");
       if (!existsSync66(transcriptPath))
         continue;
       const stat3 = statSync29(transcriptPath);
@@ -79737,11 +80616,11 @@ function registerDebugCommand(program3) {
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join67(agentDir, ".claude");
-    const claudeMdPath = join67(agentDir, "CLAUDE.md");
-    const soulMdPath = join67(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join67(workspaceDir, "SOUL.md");
-    const handoffPath = join67(agentDir, ".handoff.md");
+    const claudeConfigDir = join68(agentDir, ".claude");
+    const claudeMdPath = join68(agentDir, "CLAUDE.md");
+    const soulMdPath = join68(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join68(workspaceDir, "SOUL.md");
+    const handoffPath = join68(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -79870,9 +80749,9 @@ function registerDebugCommand(program3) {
     const soulMdBytes = soulMdContent.length;
     const perTurnBytes = dynamicResult.concatenated.length;
     const userBytes = userMessage?.text.length ?? 0;
-    const fleetDir = join67(agentsDir, "..", "fleet");
-    const fleetInvPath = join67(fleetDir, "switchroom-invariants.md");
-    const fleetClaudePath = join67(fleetDir, "CLAUDE.md");
+    const fleetDir = join68(agentsDir, "..", "fleet");
+    const fleetInvPath = join68(fleetDir, "switchroom-invariants.md");
+    const fleetClaudePath = join68(fleetDir, "CLAUDE.md");
     const fleetInvBytes = existsSync66(fleetInvPath) ? readFileSync59(fleetInvPath, "utf-8").length : 0;
     const fleetClaudeBytes = existsSync66(fleetClaudePath) ? readFileSync59(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
@@ -79908,8 +80787,8 @@ init_source();
 // src/worktree/claim.ts
 import { execFileSync as execFileSync21 } from "node:child_process";
 import { closeSync as closeSync12, mkdirSync as mkdirSync37, openSync as openSync12, existsSync as existsSync68, unlinkSync as unlinkSync13 } from "node:fs";
-import { join as join69, resolve as resolve43 } from "node:path";
-import { homedir as homedir41 } from "node:os";
+import { join as join70, resolve as resolve43 } from "node:path";
+import { homedir as homedir42 } from "node:os";
 import { randomBytes as randomBytes13 } from "node:crypto";
 
 // src/worktree/registry.ts
@@ -79922,13 +80801,13 @@ import {
   existsSync as existsSync67,
   renameSync as renameSync13
 } from "node:fs";
-import { join as join68, resolve as resolve42 } from "node:path";
-import { homedir as homedir40 } from "node:os";
+import { join as join69, resolve as resolve42 } from "node:path";
+import { homedir as homedir41 } from "node:os";
 function registryDir() {
-  return resolve42(process.env.SWITCHROOM_WORKTREE_DIR ?? join68(homedir40(), ".switchroom", "worktrees"));
+  return resolve42(process.env.SWITCHROOM_WORKTREE_DIR ?? join69(homedir41(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join68(registryDir(), `${id}.json`);
+  return join69(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
   mkdirSync36(registryDir(), { recursive: true });
@@ -79979,7 +80858,7 @@ function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
   mkdirSync37(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join69(lockDir, `.lock-${lockName}`);
+  const lockPath = join70(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -80006,7 +80885,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve43(process.env.SWITCHROOM_WORKTREE_BASE ?? join69(homedir41(), ".switchroom", "worktree-checkouts"));
+  return resolve43(process.env.SWITCHROOM_WORKTREE_BASE ?? join70(homedir42(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes13(4).toString("hex");
@@ -80028,7 +80907,7 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join69(homedir41(), p.slice(2));
+    return join70(homedir42(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
@@ -80056,7 +80935,7 @@ async function claimWorktree(input, codeRepos) {
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
     mkdirSync37(baseDir, { recursive: true });
-    worktreePath = join69(baseDir, `${id}-${taskSuffix}`);
+    worktreePath = join70(baseDir, `${id}-${taskSuffix}`);
     const now = new Date().toISOString();
     const record2 = {
       id,
@@ -80311,7 +81190,7 @@ import {
   rmSync as rmSync15,
   writeFileSync as writeFileSync33
 } from "node:fs";
-import { join as join70 } from "node:path";
+import { join as join71 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -80501,16 +81380,16 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join70(stateBase, "google-workspace-mcp", "credentials");
+  return join71(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
   mkdirSync38(dir, { recursive: true, mode: 448 });
   chmodSync9(dir, 448);
   for (const name of readdirSync25(dir)) {
-    rmSync15(join70(dir, name), { force: true, recursive: true });
+    rmSync15(join71(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join70(dir, filename);
+  const filePath = join71(dir, filename);
   writeFileSync33(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync9(filePath, 384);
   return filePath;
@@ -80631,9 +81510,9 @@ async function runDriveMcpLauncher(opts) {
   }
   const args = buildUvxArgs(tier);
   const env2 = buildChildEnv(process.env, credentialsDir, brokerCreds.accountEmail);
-  const { spawn: spawn6 } = await import("node:child_process");
+  const { spawn: spawn5 } = await import("node:child_process");
   const os5 = await import("node:os");
-  const child = spawn6("uvx", args, {
+  const child = spawn5("uvx", args, {
     stdio: ["pipe", "pipe", "inherit"],
     env: env2
   });
@@ -80668,9 +81547,9 @@ function registerDriveMcpLauncherCommand(program3) {
 
 // src/cli/m365-mcp-launcher.ts
 init_scaffold_integration();
-import { spawn as spawn6 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 import { writeFileSync as writeFileSync34, mkdirSync as mkdirSync39 } from "node:fs";
-import { dirname as dirname18, join as join71 } from "node:path";
+import { dirname as dirname18, join as join72 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -80702,7 +81581,7 @@ function writeRefreshHeartbeat(agentName, data) {
 function heartbeatPath(agentName) {
   const override = process.env.SWITCHROOM_M365_HEARTBEAT_DIR;
   if (override) {
-    return join71(override, `m365-launcher-${agentName}.heartbeat.json`);
+    return join72(override, `m365-launcher-${agentName}.heartbeat.json`);
   }
   return "/state/agent/m365-launcher.heartbeat.json";
 }
@@ -80874,7 +81753,7 @@ function registerM365McpLauncherCommand(program3) {
         });
       },
       spawnSofteria: (env2) => {
-        return spawn6("npx", buildSofteriaArgs(opts), {
+        return spawn5("npx", buildSofteriaArgs(opts), {
           env: env2,
           stdio: ["pipe", "pipe", "pipe"]
         });
@@ -80886,7 +81765,7 @@ function registerM365McpLauncherCommand(program3) {
 
 // src/cli/notion-mcp-launcher.ts
 init_scaffold_integration();
-import { spawn as spawn7 } from "node:child_process";
+import { spawn as spawn6 } from "node:child_process";
 import { existsSync as existsSync71, mkdirSync as mkdirSync40, writeFileSync as writeFileSync35 } from "node:fs";
 import { dirname as dirname19 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
@@ -80999,7 +81878,7 @@ function registerNotionMcpLauncherCommand(program3) {
         return result.entry.value;
       },
       spawnMcp: (env2, args) => {
-        return spawn7("npx", args, {
+        return spawn6("npx", args, {
           env: env2,
           stdio: ["pipe", "pipe", "pipe"]
         });
@@ -82030,8 +82909,8 @@ agents:
 
 // src/cli/apply.ts
 init_resolver();
-import { dirname as dirname22, join as join74, resolve as resolve45 } from "node:path";
-import { homedir as homedir43 } from "node:os";
+import { dirname as dirname22, join as join75, resolve as resolve45 } from "node:path";
+import { homedir as homedir44 } from "node:os";
 import { execFileSync as execFileSync24 } from "node:child_process";
 init_vault();
 init_loader();
@@ -82039,7 +82918,7 @@ init_loader();
 
 // src/cli/update-prompt-hook.ts
 import { existsSync as existsSync72, readFileSync as readFileSync62, writeFileSync as writeFileSync36, chmodSync as chmodSync10, mkdirSync as mkdirSync41 } from "node:fs";
-import { join as join72 } from "node:path";
+import { join as join73 } from "node:path";
 var HOOK_FILENAME = "update-card-on-prompt.sh";
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -82105,9 +82984,9 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join72(agentDir, ".claude", "hooks");
+  const hooksDir = join73(agentDir, ".claude", "hooks");
   mkdirSync41(hooksDir, { recursive: true });
-  const scriptPath = join72(hooksDir, HOOK_FILENAME);
+  const scriptPath = join73(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
   const existing = existsSync72(scriptPath) ? readFileSync62(scriptPath, "utf-8") : "";
@@ -82120,7 +82999,7 @@ function installUpdatePromptHook(agentDir) {
       chmodSync10(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join72(agentDir, ".claude", "settings.json");
+  const settingsPath = join73(agentDir, ".claude", "settings.json");
   if (!existsSync72(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
@@ -82222,14 +83101,14 @@ var EMBEDDED_EXAMPLES = {
   switchroom: switchroom_default,
   minimal: minimal_default
 };
-var DEFAULT_COMPOSE_PATH2 = join74(homedir43(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH2 = join75(homedir44(), ".switchroom", "compose", "docker-compose.yml");
 var COMPOSE_PROJECT2 = "switchroom";
 function resolveVaultBindMountDir(homeDir, ctx) {
   const isCustomPath = ctx.migrationKind === "custom-path-skipped";
   if (isCustomPath && ctx.customVaultPath) {
     return dirname22(ctx.customVaultPath);
   }
-  return join74(homeDir, ".switchroom", "vault");
+  return join75(homeDir, ".switchroom", "vault");
 }
 function inspectVaultBindMountDir(vaultDir) {
   if (!existsSync74(vaultDir))
@@ -82258,44 +83137,44 @@ function hasVaultRefs(value) {
   return false;
 }
 async function ensureHostMountSources(config) {
-  const home2 = homedir43();
+  const home2 = homedir44();
   const dirs = [
-    join74(home2, ".switchroom", "approvals"),
-    join74(home2, ".switchroom", "scheduler"),
-    join74(home2, ".switchroom", "logs"),
-    join74(home2, ".switchroom", "compose"),
-    join74(home2, ".switchroom", "broker-operator")
+    join75(home2, ".switchroom", "approvals"),
+    join75(home2, ".switchroom", "scheduler"),
+    join75(home2, ".switchroom", "logs"),
+    join75(home2, ".switchroom", "compose"),
+    join75(home2, ".switchroom", "broker-operator")
   ];
   for (const name of Object.keys(config.agents)) {
-    dirs.push(join74(home2, ".switchroom", "agents", name));
-    dirs.push(join74(home2, ".switchroom", "logs", name));
-    dirs.push(join74(home2, ".claude", "projects", name));
-    dirs.push(join74(home2, ".switchroom", "audit", name));
-    if (existsSync74(join74(home2, ".switchroom-config"))) {
-      dirs.push(join74(home2, ".switchroom-config", "agents", name, "personal-skills"));
+    dirs.push(join75(home2, ".switchroom", "agents", name));
+    dirs.push(join75(home2, ".switchroom", "logs", name));
+    dirs.push(join75(home2, ".claude", "projects", name));
+    dirs.push(join75(home2, ".switchroom", "audit", name));
+    if (existsSync74(join75(home2, ".switchroom-config"))) {
+      dirs.push(join75(home2, ".switchroom-config", "agents", name, "personal-skills"));
     }
   }
   for (const dir of dirs) {
     await mkdir2(dir, { recursive: true });
   }
-  const autoUnlockPath = join74(home2, ".switchroom", "vault-auto-unlock");
+  const autoUnlockPath = join75(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync74(autoUnlockPath)) {
     writeFileSync37(autoUnlockPath, "", { mode: 384 });
   }
-  const auditLogPath = join74(home2, ".switchroom", "vault-audit.log");
+  const auditLogPath = join75(home2, ".switchroom", "vault-audit.log");
   if (!existsSync74(auditLogPath)) {
     writeFileSync37(auditLogPath, "", { mode: 420 });
   }
-  const grantsDbPath = join74(home2, ".switchroom", "vault-grants.db");
+  const grantsDbPath = join75(home2, ".switchroom", "vault-grants.db");
   if (!existsSync74(grantsDbPath)) {
     writeFileSync37(grantsDbPath, "", { mode: 384 });
   }
-  const hostdAuditLogPath = join74(home2, ".switchroom", "host-control-audit.log");
+  const hostdAuditLogPath = join75(home2, ".switchroom", "host-control-audit.log");
   if (!existsSync74(hostdAuditLogPath)) {
     writeFileSync37(hostdAuditLogPath, "", { mode: 420 });
   }
   for (const name of Object.keys(config.agents)) {
-    const tokenPath = join74(home2, ".switchroom", "agents", name, ".vault-token");
+    const tokenPath = join75(home2, ".switchroom", "agents", name, ".vault-token");
     if (!existsSync74(tokenPath)) {
       writeFileSync37(tokenPath, "", { mode: 384 });
     }
@@ -82304,15 +83183,15 @@ async function ensureHostMountSources(config) {
       chownSync7(tokenPath, uid, uid);
     } catch {}
   }
-  const fleetDir = join74(home2, ".switchroom", "fleet");
+  const fleetDir = join75(home2, ".switchroom", "fleet");
   await mkdir2(fleetDir, { recursive: true });
-  const invariantsPath = join74(fleetDir, "switchroom-invariants.md");
+  const invariantsPath = join75(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
   const invariantsCurrent = existsSync74(invariantsPath) ? readFileSync63(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
     writeFileSync37(invariantsPath, invariantsCanonical, { mode: 420 });
   }
-  const fleetClaudePath = join74(fleetDir, "CLAUDE.md");
+  const fleetClaudePath = join75(fleetDir, "CLAUDE.md");
   if (!existsSync74(fleetClaudePath)) {
     writeFileSync37(fleetClaudePath, [
       "# Switchroom fleet defaults",
@@ -82395,10 +83274,10 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 `));
   }
 }
-function writeInstallTypeCache(homeDir = homedir43()) {
+function writeInstallTypeCache(homeDir = homedir44()) {
   const ctx = detectInstallType();
-  const dir = join74(homeDir, ".switchroom");
-  const out = join74(dir, "install-type.json");
+  const dir = join75(homeDir, ".switchroom");
+  const out = join75(dir, "install-type.json");
   const tmp = `${out}.tmp`;
   mkdirSync42(dir, { recursive: true });
   const payload = {
@@ -82447,14 +83326,14 @@ Applying switchroom config...
       writeOut(source_default.green(`  + ${name}`) + source_default.gray(` (${agentConfig.extends ?? "default"}) \u2014 ${detail}
 `));
       try {
-        installUpdatePromptHook(join74(agentsDir, name));
+        installUpdatePromptHook(join75(agentsDir, name));
       } catch (hookErr) {
         writeOut(source_default.gray(`    (update-prompt hook install failed for ${name}: ${hookErr.message})
 `));
       }
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join74(agentsDir, name), uid, {
+        alignAgentUid(name, join75(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -82491,7 +83370,7 @@ Applying switchroom config...
     for (const name of agentNames) {
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join74(agentsDir, name), uid, {
+        alignAgentUid(name, join75(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -82505,7 +83384,7 @@ Applying switchroom config...
   }
   const vaultPathConfigured = config.vault?.path;
   const customVaultPath = vaultPathConfigured ? resolvePath(vaultPathConfigured) : undefined;
-  const migrationResult = migrateVaultLayout(homedir43(), {
+  const migrationResult = migrateVaultLayout(homedir44(), {
     customVaultPath
   });
   switch (migrationResult.kind) {
@@ -82531,7 +83410,7 @@ Applying switchroom config...
       writeErr(formatDivergentRecoveryMessage(migrationResult.details));
       process.exit(4);
   }
-  const postMigrationInspect = inspectVaultLayout(homedir43());
+  const postMigrationInspect = inspectVaultLayout(homedir44());
   const acceptable = [
     "no-vault",
     "already-migrated",
@@ -82546,7 +83425,7 @@ Applying switchroom config...
 `));
     process.exit(5);
   }
-  const vaultDir = resolveVaultBindMountDir(homedir43(), {
+  const vaultDir = resolveVaultBindMountDir(homedir44(), {
     migrationKind: migrationResult.kind,
     customVaultPath
   });
@@ -82585,7 +83464,7 @@ Wrote `) + displayComposePath + source_default.gray(` (${composeBytes} bytes)
   writeOut(source_default.gray(`  (If pull returns 401, login to ghcr.io first: see docs/operators/install.md#ghcr-auth)
 `));
   if (process.geteuid?.() === 0 && operatorUid !== undefined) {
-    const restored = restoreOperatorOwnership(homedir43(), operatorUid);
+    const restored = restoreOperatorOwnership(homedir44(), operatorUid);
     if (restored.length > 0) {
       writeOut(source_default.gray(`  Restored operator ownership of ${restored.length} ~/.switchroom path(s)
 `));
@@ -82655,7 +83534,7 @@ function findUnwritableAgentDirs(config, opts) {
   const targets = opts.only ? [opts.only] : Object.keys(config.agents ?? {});
   const unwritable = [];
   for (const name of targets) {
-    const startSh = join74(agentsDir, name, "start.sh");
+    const startSh = join75(agentsDir, name, "start.sh");
     if (!existsSync74(startSh))
       continue;
     try {
@@ -82835,8 +83714,8 @@ function runRedactStdin() {
 
 // src/cli/status-ask.ts
 import { readFileSync as readFileSync64, existsSync as existsSync75, readdirSync as readdirSync27 } from "node:fs";
-import { join as join75 } from "node:path";
-import { homedir as homedir44 } from "node:os";
+import { join as join76 } from "node:path";
+import { homedir as homedir45 } from "node:os";
 
 // src/status-ask/report.ts
 function parseJsonl(content) {
@@ -83171,7 +84050,7 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join75(homedir44(), ".switchroom", "agents");
+    agentsDir = join76(homedir45(), ".switchroom", "agents");
   }
   if (!existsSync75(agentsDir))
     return [];
@@ -83183,7 +84062,7 @@ function resolveSources(explicitPath) {
     return [];
   }
   for (const name of entries) {
-    const path8 = join75(agentsDir, name, "runtime-metrics.jsonl");
+    const path8 = join76(agentsDir, name, "runtime-metrics.jsonl");
     if (existsSync75(path8)) {
       sources.push({ path: path8, agent: name });
     }
@@ -83221,21 +84100,21 @@ import {
   unlinkSync as unlinkSync14,
   writeSync as writeSync8
 } from "node:fs";
-import { join as join76, resolve as resolve46 } from "node:path";
+import { join as join77, resolve as resolve46 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
   const base = opts.root ? resolve46(opts.root, agent) : resolve46(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join76(base, "schedule.d");
-  const scheduleStagingDir = join76(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join76(base, "skills.d");
-  const skillsStagingDir = join76(skillsDir, STAGING_SUBDIR);
+  const scheduleDir = join77(base, "schedule.d");
+  const scheduleStagingDir = join77(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join77(base, "skills.d");
+  const skillsStagingDir = join77(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join76(base, ".lock"),
+    lockPath: join77(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
@@ -83289,8 +84168,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join76(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join76(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join77(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join77(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -83306,8 +84185,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join76(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join76(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join77(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join77(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -83322,7 +84201,7 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join76(paths.skillsDir, `${slug}.yaml`);
+    const finalPath = join77(paths.skillsDir, `${slug}.yaml`);
     if (!existsSync76(finalPath))
       return false;
     unlinkSync14(finalPath);
@@ -83337,7 +84216,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync28(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join76(paths.skillsDir, name);
+    const full = join77(paths.skillsDir, name);
     try {
       const raw = readFileSync65(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -83349,7 +84228,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join76(paths.scheduleDir, `${slug}.yaml`);
+    const finalPath = join77(paths.scheduleDir, `${slug}.yaml`);
     if (!existsSync76(finalPath))
       return false;
     unlinkSync14(finalPath);
@@ -83364,7 +84243,7 @@ function listOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync28(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join76(paths.scheduleDir, name);
+    const full = join77(paths.scheduleDir, name);
     try {
       const raw = readFileSync65(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -83520,12 +84399,12 @@ import {
   writeFileSync as writeFileSync38,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join77 } from "node:path";
+import { join as join78 } from "node:path";
 import { randomBytes as randomBytes14 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join77(paths.scheduleDir, ".pending");
+  return join78(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
@@ -83538,8 +84417,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join77(dir, `${stageId}.yaml`);
-  const metaPath = join77(dir, `${stageId}.meta.json`);
+  const yamlPath = join78(dir, `${stageId}.yaml`);
+  const metaPath = join78(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -83573,8 +84452,8 @@ function listPendingScheduleEntries(agent, opts = {}) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join77(dir, name);
-    const yamlPath = join77(dir, `${stageId}.yaml`);
+    const metaPath = join78(dir, name);
+    const yamlPath = join78(dir, `${stageId}.yaml`);
     if (!existsSync77(yamlPath))
       continue;
     try {
@@ -83593,7 +84472,7 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join77(paths.scheduleDir, `${slug}.yaml`);
+  const finalPath = join78(paths.scheduleDir, `${slug}.yaml`);
   if (existsSync77(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
@@ -84226,7 +85105,7 @@ var import_yaml21 = __toESM(require_dist(), 1);
 import { existsSync as existsSync79 } from "node:fs";
 init_reconcile_default_skills();
 var import_yaml22 = __toESM(require_dist(), 1);
-import { join as join78 } from "node:path";
+import { join as join79 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -84301,7 +85180,7 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join78(poolDir, skillName);
+  const skillPath = join79(poolDir, skillName);
   if (!existsSync79(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
@@ -84479,8 +85358,8 @@ import {
   statSync as statSync32,
   writeFileSync as writeFileSync39
 } from "node:fs";
-import { tmpdir as tmpdir5, homedir as homedir45 } from "node:os";
-import { dirname as dirname23, join as join79, relative as relative2, resolve as resolve47 } from "node:path";
+import { tmpdir as tmpdir5, homedir as homedir46 } from "node:os";
+import { dirname as dirname23, join as join80, relative as relative2, resolve as resolve47 } from "node:path";
 import { spawnSync as spawnSync12 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -84674,10 +85553,10 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join79(homedir45(), raw.slice(2));
+    return join80(homedir46(), raw.slice(2));
   }
   if (raw === "~")
-    return homedir45();
+    return homedir46();
   return resolve47(raw);
 }
 function readStdinSync() {
@@ -84713,7 +85592,7 @@ function loadFromDir(dir) {
   const walk2 = (sub) => {
     const entries = readdirSync30(sub, { withFileTypes: true });
     for (const ent of entries) {
-      const full = join79(sub, ent.name);
+      const full = join80(sub, ent.name);
       const rel = relative2(abs, full);
       if (ent.isSymbolicLink()) {
         fail3(`refusing to read symlink inside --from dir: ${rel}`);
@@ -84748,7 +85627,7 @@ function loadFromTarball(tarPath) {
       fail3(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
-  const staging = mkdtempSync5(join79(tmpdir5(), "skill-apply-extract-"));
+  const staging = mkdtempSync5(join80(tmpdir5(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
     const r = spawnSync12("tar", [
@@ -84834,8 +85713,8 @@ function validatePayload(name, files) {
           errors2.push(`${path8} fails \`bash -n\` syntax check: ${(r.stderr ?? "").trim()}`);
         }
       } else if (PY_SCRIPT_RE2.test(path8)) {
-        const tmp = mkdtempSync5(join79(tmpdir5(), "skill-apply-py-"));
-        const tmpPy = join79(tmp, "check.py");
+        const tmp = mkdtempSync5(join80(tmpdir5(), "skill-apply-py-"));
+        const tmpPy = join80(tmp, "check.py");
         try {
           writeFileSync39(tmpPy, content);
           const r = spawnSync12("python3", ["-m", "py_compile", tmpPy], {
@@ -84858,7 +85737,7 @@ function diffSummary(currentDir, files) {
   if (existsSync80(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync30(sub, { withFileTypes: true })) {
-        const full = join79(sub, ent.name);
+        const full = join80(sub, ent.name);
         const rel = relative2(currentDir, full);
         if (ent.isDirectory()) {
           walk2(full);
@@ -84894,7 +85773,7 @@ function writePayload(poolDir, name, files) {
   if (!existsSync80(poolDir)) {
     mkdirSync45(poolDir, { recursive: true, mode: 493 });
   }
-  const target = join79(poolDir, name);
+  const target = join80(poolDir, name);
   let targetIsSymlink = false;
   try {
     const st = lstatSync8(target);
@@ -84905,11 +85784,11 @@ function writePayload(poolDir, name, files) {
   if (targetIsSymlink) {
     fail3(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
-  const staging = mkdtempSync5(join79(poolDir, `.skill-apply-stage-${name}-`));
+  const staging = mkdtempSync5(join80(poolDir, `.skill-apply-stage-${name}-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join79(staging, path8);
+      const full = join80(staging, path8);
       mkdirSync45(dirname23(full), { recursive: true, mode: 493 });
       const fd = openSync15(full, "wx");
       try {
@@ -84987,7 +85866,7 @@ function registerSkillCommand(program3) {
     }
     const config = loadConfig();
     const poolDir = resolveSkillsPoolDir2(config.switchroom?.skills_dir);
-    const currentDir = join79(poolDir, name);
+    const currentDir = join80(poolDir, name);
     console.log(source_default.bold(`Skill: ${name}`) + source_default.gray(` (${Object.keys(files).length} files, ${sumBytes(files)} bytes)`));
     console.log(source_default.bold("Diff vs current pool content:"));
     console.log(diffSummary(currentDir, files));
@@ -85031,8 +85910,8 @@ import {
   utimesSync,
   writeFileSync as writeFileSync40
 } from "node:fs";
-import { dirname as dirname24, join as join80, relative as relative3, resolve as resolve48 } from "node:path";
-import { homedir as homedir46, tmpdir as tmpdir6 } from "node:os";
+import { dirname as dirname24, join as join81, relative as relative3, resolve as resolve48 } from "node:path";
+import { homedir as homedir47, tmpdir as tmpdir6 } from "node:os";
 import { spawnSync as spawnSync13 } from "node:child_process";
 init_helpers();
 init_source();
@@ -85042,10 +85921,10 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve48(override) : join80(homedir46(), ".switchroom-config");
+  const candidate = override ? resolve48(override) : join81(homedir47(), ".switchroom-config");
   if (!existsSync81(candidate))
     return null;
-  return join80(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
+  return join81(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
@@ -85063,7 +85942,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync17(join80(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync17(join81(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -85072,7 +85951,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   const configSkillsRoot = resolveConfigSkillsDir(agent);
   if (!configSkillsRoot)
     return;
-  const dest = join80(configSkillsRoot, name);
+  const dest = join81(configSkillsRoot, name);
   try {
     if (liveSkillDir !== null) {
       try {
@@ -85087,19 +85966,19 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
       if (existsSync81(dest)) {
-        const trash = join80(configSkillsRoot, `.${name}-trash-${Date.now()}`);
+        const trash = join81(configSkillsRoot, `.${name}-trash-${Date.now()}`);
         renameSync18(dest, trash);
       }
       return;
     }
     mkdirSync46(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
-    const staging = mkdtempSync6(join80(configSkillsRoot, `.${name}-staging-`));
+    const staging = mkdtempSync6(join81(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
       mkdirSync46(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync31(src, { withFileTypes: true })) {
-        const s = join80(src, ent.name);
-        const d = join80(dst, ent.name);
+        const s = join81(src, ent.name);
+        const d = join81(dst, ent.name);
         if (ent.isSymbolicLink())
           continue;
         if (ent.isDirectory())
@@ -85111,7 +85990,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     };
     walk2(liveSkillDir, staging);
     if (existsSync81(dest)) {
-      const prior = join80(configSkillsRoot, `.${name}-prior-${Date.now()}`);
+      const prior = join81(configSkillsRoot, `.${name}-prior-${Date.now()}`);
       renameSync18(dest, prior);
     }
     renameSync18(staging, dest);
@@ -85138,13 +86017,13 @@ function resolveAgent(opts) {
 function resolveAgentsRoot(opts) {
   if (opts.root)
     return resolve48(opts.root);
-  return join80(homedir46(), ".switchroom", "agents");
+  return join81(homedir47(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
-  return join80(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
+  return join81(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
 }
 function trashDir(agentsRoot, agent) {
-  return join80(agentsRoot, agent, ".claude", TRASH_DIRNAME);
+  return join81(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
 function readStdinSync2() {
   const chunks = [];
@@ -85174,7 +86053,7 @@ function loadFromDir2(dir) {
   const files = {};
   const walk2 = (sub) => {
     for (const ent of readdirSync31(sub, { withFileTypes: true })) {
-      const full = join80(sub, ent.name);
+      const full = join81(sub, ent.name);
       if (ent.isSymbolicLink()) {
         fail4(`refusing to read symlink in --from dir: ${relative3(abs, full)}`);
       }
@@ -85227,8 +86106,8 @@ function behavioralValidate(files) {
         errors2.push(`${path8} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
     } else if (PY_SCRIPT_RE.test(path8)) {
-      const tmp = mkdtempSync6(join80(tmpdir6(), "skill-personal-py-"));
-      const tmpPy = join80(tmp, "check.py");
+      const tmp = mkdtempSync6(join81(tmpdir6(), "skill-personal-py-"));
+      const tmpPy = join81(tmp, "check.py");
       try {
         writeFileSync40(tmpPy, content);
         const r = spawnSync13("python3", ["-m", "py_compile", tmpPy], {
@@ -85252,7 +86131,7 @@ function sweepTrash(agentsRoot, agent) {
   for (const ent of readdirSync31(trash, { withFileTypes: true })) {
     if (!ent.isDirectory())
       continue;
-    const entPath = join80(trash, ent.name);
+    const entPath = join81(trash, ent.name);
     try {
       const st = statSync33(entPath);
       if (now - st.mtimeMs > TRASH_TTL_MS) {
@@ -85273,11 +86152,11 @@ function writePersonalSkill(targetDir, files) {
     fail4(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
   mkdirSync46(dirname24(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join80(dirname24(targetDir), `.skill-personal-stage-`));
+  const staging = mkdtempSync6(join81(dirname24(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join80(staging, path8);
+      const full = join81(staging, path8);
       mkdirSync46(dirname24(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
@@ -85410,10 +86289,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join80(homedir46(), ".switchroom", "skills");
+  return join81(homedir47(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join80(homedir46(), ".switchroom", "skills", "_bundled");
+  return join81(homedir47(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -85423,7 +86302,7 @@ function resolveCloneSource(source, opts) {
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
-  const dir = join80(root, slug);
+  const dir = join81(root, slug);
   if (!existsSync81(dir)) {
     fail4(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
@@ -85439,7 +86318,7 @@ function readSourceFiles(dir) {
   const skipped = [];
   const walk2 = (sub) => {
     for (const ent of readdirSync31(sub, { withFileTypes: true })) {
-      const full = join80(sub, ent.name);
+      const full = join81(sub, ent.name);
       if (ent.isSymbolicLink()) {
         continue;
       }
@@ -85550,7 +86429,7 @@ function removePersonalAction(name, opts) {
   const trashRoot = trashDir(agentsRoot, agent);
   mkdirSync46(trashRoot, { recursive: true, mode: 493 });
   const ts = Date.now();
-  const trashTarget = join80(trashRoot, `${name}-${ts}`);
+  const trashTarget = join81(trashRoot, `${name}-${ts}`);
   renameSync18(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
@@ -85569,7 +86448,7 @@ function listPersonalAction(opts) {
   const agent = resolveAgent(opts);
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
-  const skillsDir = join80(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join81(agentsRoot, agent, ".claude", "skills");
   const personal = [];
   if (existsSync81(skillsDir)) {
     for (const ent of readdirSync31(skillsDir, { withFileTypes: true })) {
@@ -85578,7 +86457,7 @@ function listPersonalAction(opts) {
       if (!ent.name.startsWith(PERSONAL_PREFIX))
         continue;
       const skillName = ent.name.slice(PERSONAL_PREFIX.length);
-      const skillPath = join80(skillsDir, ent.name);
+      const skillPath = join81(skillsDir, ent.name);
       let fileCount = 0;
       let totalBytes = 0;
       const walk2 = (sub) => {
@@ -85586,10 +86465,10 @@ function listPersonalAction(opts) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync33(join80(sub, e.name)).size;
+              totalBytes += statSync33(join81(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
-            walk2(join80(sub, e.name));
+            walk2(join81(sub, e.name));
           }
         }
       };
@@ -85629,22 +86508,22 @@ function registerSkillPersonalCommands(program3) {
 init_helpers();
 var import_yaml24 = __toESM(require_dist(), 1);
 import { existsSync as existsSync82, readdirSync as readdirSync32, readFileSync as readFileSync70, statSync as statSync34 } from "node:fs";
-import { homedir as homedir47 } from "node:os";
-import { join as join81, resolve as resolve49 } from "node:path";
+import { homedir as homedir48 } from "node:os";
+import { join as join82, resolve as resolve49 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
 function defaultAgentsRoot() {
-  return resolve49(homedir47(), ".switchroom/agents");
+  return resolve49(homedir48(), ".switchroom/agents");
 }
 function defaultSharedRoot2() {
-  return resolve49(homedir47(), ".switchroom/skills");
+  return resolve49(homedir48(), ".switchroom/skills");
 }
 function defaultBundledRoot2() {
-  return resolve49(homedir47(), ".switchroom/skills/_bundled");
+  return resolve49(homedir48(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join81(skillDir, "SKILL.md");
+  const mdPath = join82(skillDir, "SKILL.md");
   if (!existsSync82(mdPath))
     return null;
   let content;
@@ -85677,7 +86556,7 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join81(skillDir, "SKILL.md");
+  const mdPath = join82(skillDir, "SKILL.md");
   try {
     const st = statSync34(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
@@ -85688,7 +86567,7 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join81(agentsRoot, agent, ".claude/skills");
+  const skillsDir = join82(agentsRoot, agent, ".claude/skills");
   if (!existsSync82(skillsDir))
     return [];
   const out = [];
@@ -85701,7 +86580,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join81(skillsDir, ent);
+    const dirPath = join82(skillsDir, ent);
     try {
       if (!statSync34(dirPath).isDirectory())
         continue;
@@ -85741,7 +86620,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join81(sharedRoot, ent);
+    const dirPath = join82(sharedRoot, ent);
     try {
       if (!statSync34(dirPath).isDirectory())
         continue;
@@ -85777,7 +86656,7 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join81(bundledRoot, ent);
+    const dirPath = join82(bundledRoot, ent);
     try {
       if (!statSync34(dirPath).isDirectory())
         continue;
@@ -85922,8 +86801,8 @@ function registerHostdMcpCommand(program3) {
 init_source();
 init_helpers();
 import { existsSync as existsSync84, mkdirSync as mkdirSync47, readdirSync as readdirSync33, readFileSync as readFileSync72, writeFileSync as writeFileSync41, statSync as statSync35, copyFileSync as copyFileSync12 } from "node:fs";
-import { homedir as homedir48 } from "node:os";
-import { join as join82 } from "node:path";
+import { homedir as homedir49 } from "node:os";
+import { join as join83 } from "node:path";
 import { spawnSync as spawnSync15 } from "node:child_process";
 init_audit_reader();
 function resolveHostdImageTag(explicitTag, release) {
@@ -86036,7 +86915,7 @@ networks:
 # operator surface; the daemon's stderr lands in \`docker logs switchroom-hostd\`.
 `;
 }
-function resolveHostdHostHome(env2 = process.env, home2 = homedir48()) {
+function resolveHostdHostHome(env2 = process.env, home2 = homedir49()) {
   const fromEnv = env2.SWITCHROOM_HOST_HOME?.trim();
   const resolved = fromEnv && fromEnv.length > 0 ? fromEnv : home2;
   if (resolved === "/host-home" || resolved.startsWith("/host-home/")) {
@@ -86047,10 +86926,10 @@ function resolveHostdHostHome(env2 = process.env, home2 = homedir48()) {
   return resolved;
 }
 function hostdDir() {
-  return join82(homedir48(), ".switchroom", "hostd");
+  return join83(homedir49(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join82(hostdDir(), "docker-compose.yml");
+  return join83(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
@@ -86161,7 +87040,7 @@ function doStatus() {
       for (const name of readdirSync33(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join82(dir, name, "sock");
+        const sockPath = join83(dir, name, "sock");
         if (existsSync84(sockPath)) {
           const st = statSync35(sockPath);
           if ((st.mode & 61440) === 49152) {
@@ -86253,8 +87132,8 @@ The log is created when hostd handles its first privileged-verb request.`));
 init_source();
 init_helpers();
 import { existsSync as existsSync85, mkdirSync as mkdirSync48, writeFileSync as writeFileSync42, copyFileSync as copyFileSync13 } from "node:fs";
-import { homedir as homedir49 } from "node:os";
-import { join as join83 } from "node:path";
+import { homedir as homedir50 } from "node:os";
+import { join as join84 } from "node:path";
 import { spawnSync as spawnSync16 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
@@ -86339,10 +87218,10 @@ services:
 `;
 }
 function webdDir() {
-  return join83(homedir49(), ".switchroom", "web");
+  return join84(homedir50(), ".switchroom", "web");
 }
 function webdComposePath() {
-  return join83(webdDir(), "docker-compose.yml");
+  return join84(webdDir(), "docker-compose.yml");
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
@@ -86375,7 +87254,7 @@ async function doInstall2(opts, program3) {
   const cfg = getConfig(program3);
   const imageTag = resolveWebImageTag(opts.tag, cfg.release);
   const yaml = renderWebComposeFile({
-    hostHome: homedir49(),
+    hostHome: homedir50(),
     imageTag,
     operatorUid
   });