switchroom 0.15.3 → 0.15.4

package/dist/cli/switchroom.js

@@ -13654,7 +13654,8 @@ var init_schema = __esm(() => {
     stream_mode: exports_external.enum(["pty", "checklist"]).optional().describe("How live progress is streamed to Telegram during a turn. " + "'pty' (default) surfaces text snapshots of Claude Code's TUI \u2014 " + "compatible but can flicker as Ink re-renders. 'checklist' drives " + "a structured progress card from session-tail events \u2014 stable " + "order, per-tool status emojis, fires only on semantic transitions."),
     stream_throttle_ms: exports_external.number().int().nonnegative().optional().describe("Throttle window in ms between successive stream edits (or " + "sendMessageDraft tics) during a turn. Lower = more responsive " + "stream, higher = fewer API calls. Floored at 250 by draft-stream " + "itself. Default 300 for draft transport (DMs) and 1000 for " + "message transport (groups/forums). Override per-agent if a " + "particular agent needs snappier or quieter streaming."),
     clear_status_on_completion: exports_external.boolean().optional().describe("When true, the live activity/status feed (the in-place 'what it's " + "doing' message \u2014 Reading X, Searching the web for Y, \u2026) is DELETED " + "when the turn's final answer lands, so only the reply remains. " + "Default false: the status message is left in the chat as a record " + "(its last step marked done) \u2014 no post-then-delete. Per-agent " + "override; cascades defaults \u2192 profile \u2192 agent (per-key)."),
-    hotReloadStable: exports_external.boolean().optional().describe("If true, the stable workspace prefix (AGENTS.md, SOUL.md, USER.md, " + "IDENTITY.md, TOOLS.md, HEARTBEAT.md) is re-injected on every turn via " + "the UserPromptSubmit hook instead of baked into --append-system-prompt " + "at session start. Lets workspace edits propagate without a restart. " + "Costs ~5-10% per-turn latency/spend since the stable prefix is no " + "longer prompt-cached."),
+    hotReloadStable: exports_external.boolean().optional().describe("If true, the stable workspace prefix (AGENTS.md, SOUL.md, USER.md, " + "IDENTITY.md, TOOLS.md) is re-injected on every turn via " + "the UserPromptSubmit hook instead of baked into --append-system-prompt " + "at session start. Lets workspace edits propagate without a restart. " + "Costs ~5-10% per-turn latency/spend since the stable prefix is no " + "longer prompt-cached."),
+    inject_on_change: exports_external.boolean().optional().describe("Context-efficiency gate for per-turn hook injection (default true). " + "When true (the default), the turn-pacing directive and dynamic " + "workspace content are only re-emitted when their content changes or " + "the session_id changes \u2014 suppressing redundant injection that " + "otherwise triples compaction frequency. Set to false to revert to " + "the legacy always-emit behaviour (every turn injects the full " + "content regardless of whether it changed)."),
     orphan_promotion_ms: exports_external.number().int().nonnegative().optional().describe("How long (ms) a parent turn waits for a sub-agent JSONL watcher " + "to deliver sub_agent_started before the heartbeat promotes the spawn " + "to a synthesised 'running' row. Default 5000. Set to 0 to disable " + "orphan promotion entirely."),
     cold_sub_agent_threshold_ms: exports_external.number().int().nonnegative().optional().describe("JSONL-cold threshold (ms). When a running sub-agent emits no events " + "for this long, the heartbeat synthesises a turn_end for it so the " + "deferred-completion path can proceed. Default 30000. Set to 0 to " + "disable the synthetic close."),
     deferred_completion_timeout_ms: exports_external.number().int().nonnegative().optional().describe("Force-close timeout (ms) for deferred sub-agent completion. After " + "the parent turn_end arrives while sub-agents are still running, the " + "card is force-closed after this many ms even if sub-agents never " + "finish. Watcher-disconnect safety net. Default 180000 (3 min)."),
@@ -23264,6 +23265,14 @@ function normalizeBindMountPath(p) {
     out = out.slice(0, -1);
   return out;
 }
+function resolveConfigMountSource(switchroomConfigPath, homePrefix) {
+  if (!switchroomConfigPath)
+    return;
+  if (switchroomConfigPath === CONTAINER_CONFIG_PATH || switchroomConfigPath.startsWith("/state/")) {
+    return `${homePrefix}/.switchroom/switchroom.yaml`;
+  }
+  return switchroomConfigPath;
+}
 function resolveBindMount(agentName, entry) {
   const rawSource = entry.source;
   if (typeof rawSource !== "string" || rawSource.length === 0) {
@@ -23320,10 +23329,15 @@ function generateCompose(opts) {
   const buildMode = opts.buildMode ?? "pull";
   const buildContext = opts.buildContext;
   const homePrefix = opts.homeDir ?? "${HOME}";
+  if (homePrefix === "/host-home" || homePrefix.startsWith("/host-home/")) {
+    throw new Error(`compose: refusing to generate \u2014 the host-home prefix resolved to "${homePrefix}", ` + `which is the IN-CONTAINER mount point, not a host path. Emitting it as a bind-mount ` + `source would make docker create empty dirs on the host and crash the fleet (start.sh ` + `missing \u2192 exec 127; broker EISDIR).
+
+` + `Cause: \`apply\` ran inside a container without SWITCHROOM_HOST_HOME set to the real ` + `host home. Recovery: run \`switchroom apply\` once from the HOST shell (not via an ` + `agent / hostd), which regenerates the compose with correct host paths and re-bakes a ` + `correct SWITCHROOM_HOST_HOME into the fleet.`);
+  }
   const containerNamePrefix = opts.containerNamePrefix ?? "switchroom";
   const hostControlEnabled = config.host_control?.enabled !== false;
   const hostHomeForChecks = opts.homeDir ?? process.env.HOME ?? "";
-  const switchroomConfigPath = opts.switchroomConfigPath;
+  const switchroomConfigPath = resolveConfigMountSource(opts.switchroomConfigPath, homePrefix);
   const bundledSkillsPoolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
   let resolvedAnalyticsId = null;
   if (hostHomeForChecks !== "") {
@@ -23608,6 +23622,9 @@ function emitAgentService(lines, a, imageTag, buildMode, buildContext, homePrefi
     SWITCHROOM_TIMEZONE: a.timezone,
     TZ: a.timezone
   };
+  if (hostHomeForChecks) {
+    env2.SWITCHROOM_HOST_HOME = hostHomeForChecks;
+  }
   if (posthog.analyticsId != null) {
     env2.SWITCHROOM_ANALYTICS_ID = posthog.analyticsId;
   }
@@ -23717,7 +23734,7 @@ function emitAgentService(lines, a, imageTag, buildMode, buildContext, homePrefi
   lines.push(`      - ${homePrefix}/.switchroom/logs/${a.name}:${homePrefix}/.switchroom/logs/${a.name}`);
   lines.push(``);
 }
-var AGENT_UID_MIN = 10001, AGENT_UID_MAX = 10999, RESOURCE_BY_PROFILE, CRON_SESSION_MEM_BUMP_MIB = 512, CRON_SESSION_PIDS_BUMP = 128, BIND_MOUNT_SOURCE_DENYLIST, BIND_MOUNT_TARGET_DENYLIST, BIND_MOUNT_EXACT_SOURCE_DENY;
+var AGENT_UID_MIN = 10001, AGENT_UID_MAX = 10999, RESOURCE_BY_PROFILE, CRON_SESSION_MEM_BUMP_MIB = 512, CRON_SESSION_PIDS_BUMP = 128, BIND_MOUNT_SOURCE_DENYLIST, BIND_MOUNT_TARGET_DENYLIST, BIND_MOUNT_EXACT_SOURCE_DENY, CONTAINER_CONFIG_PATH = "/state/config/switchroom.yaml";
 var init_compose = __esm(() => {
   init_cron_routing();
   init_merge();
@@ -23969,16 +23986,16 @@ var init_singleton_reconcile = __esm(() => {
 // src/agents/lifecycle.ts
 import { execFileSync as execFileSync8, spawn, spawnSync } from "node:child_process";
 import { existsSync as existsSync17, mkdirSync as mkdirSync13, writeFileSync as writeFileSync7, renameSync as renameSync4, readFileSync as readFileSync15 } from "node:fs";
-import { resolve as resolve13, join as join12 } from "node:path";
+import { resolve as resolve13, join as join13 } from "node:path";
 import { connect } from "node:net";
 function cleanShutdownMarkerPathForAgent(name) {
   const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? resolveStatePath("agents");
-  return join12(agentsDir, name, "telegram", "clean-shutdown.json");
+  return join13(agentsDir, name, "telegram", "clean-shutdown.json");
 }
 function writeRestartReasonMarker(name, reason, opts = {}) {
   const path = cleanShutdownMarkerPathForAgent(name);
   try {
-    mkdirSync13(join12(path, ".."), { recursive: true });
+    mkdirSync13(join13(path, ".."), { recursive: true });
     if (opts.preserveExisting && existsSync17(path)) {
       try {
         const prev = JSON.parse(readFileSync15(path, "utf-8"));
@@ -24082,7 +24099,7 @@ function gracefulRestartAgent(name) {
   return new Promise((resolvePromise, reject) => {
     const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? resolveStatePath("agents");
     const agentDir = resolve13(agentsDir, name);
-    const socketPath = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join12(agentDir, "telegram", "gateway.sock");
+    const socketPath = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join13(agentDir, "telegram", "gateway.sock");
     if (!existsSync17(socketPath)) {
       reject(new Error("Gateway socket not found. Is the gateway running?"));
       return;
@@ -24478,30 +24495,30 @@ import {
   writeFileSync as writeFileSync9
 } from "node:fs";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 function claudeDir(agentDir) {
-  return join15(agentDir, ".claude");
+  return join16(agentDir, ".claude");
 }
 function accountsDir(agentDir) {
-  return join15(claudeDir(agentDir), "accounts");
+  return join16(claudeDir(agentDir), "accounts");
 }
 function slotDir(agentDir, slot) {
-  return join15(accountsDir(agentDir), slot);
+  return join16(accountsDir(agentDir), slot);
 }
 function slotTokenPath(agentDir, slot) {
-  return join15(slotDir(agentDir, slot), ".oauth-token");
+  return join16(slotDir(agentDir, slot), ".oauth-token");
 }
 function slotMetaPath(agentDir, slot) {
-  return join15(slotDir(agentDir, slot), ".oauth-token.meta.json");
+  return join16(slotDir(agentDir, slot), ".oauth-token.meta.json");
 }
 function activeMarkerPath(agentDir) {
-  return join15(claudeDir(agentDir), "active");
+  return join16(claudeDir(agentDir), "active");
 }
 function legacyTokenPath(agentDir) {
-  return join15(claudeDir(agentDir), ".oauth-token");
+  return join16(claudeDir(agentDir), ".oauth-token");
 }
 function legacyMetaPath(agentDir) {
-  return join15(claudeDir(agentDir), ".oauth-token.meta.json");
+  return join16(claudeDir(agentDir), ".oauth-token.meta.json");
 }
 function validateSlotName(slot) {
   if (typeof slot !== "string" || slot.length === 0) {
@@ -24544,7 +24561,7 @@ function listSlots(agentDir) {
   try {
     return readdirSync10(dir).filter((name) => {
       try {
-        return statSync12(join15(dir, name)).isDirectory();
+        return statSync12(join16(dir, name)).isDirectory();
       } catch {
         return false;
       }
@@ -24723,7 +24740,7 @@ import {
   chmodSync as chmodSync3,
   statSync as statSync13
 } from "node:fs";
-import { join as join16, resolve as resolve15 } from "node:path";
+import { join as join17, resolve as resolve15 } from "node:path";
 function extractCodeChallenge(url) {
   const match = url.match(/[?&]code_challenge=([A-Za-z0-9_-]+)/);
   return match ? match[1] : null;
@@ -24738,22 +24755,22 @@ function stripAnsi(text) {
   return text.replace(/\x1B\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\x1B[@-_]/g, "").replace(/\r/g, "");
 }
 function claudeDir2(agentDir) {
-  return join16(agentDir, ".claude");
+  return join17(agentDir, ".claude");
 }
 function credentialsPath(agentDir) {
-  return join16(claudeDir2(agentDir), ".credentials.json");
+  return join17(claudeDir2(agentDir), ".credentials.json");
 }
 function oauthTokenPath(agentDir) {
-  return join16(claudeDir2(agentDir), ".oauth-token");
+  return join17(claudeDir2(agentDir), ".oauth-token");
 }
 function oauthTokenMetaPath(agentDir) {
-  return join16(claudeDir2(agentDir), ".oauth-token.meta.json");
+  return join17(claudeDir2(agentDir), ".oauth-token.meta.json");
 }
 function authLogPath(agentDir) {
-  return join16(claudeDir2(agentDir), ".setup-token.log");
+  return join17(claudeDir2(agentDir), ".setup-token.log");
 }
 function authSessionMetaPath(agentDir) {
-  return join16(claudeDir2(agentDir), ".setup-token.session.json");
+  return join17(claudeDir2(agentDir), ".setup-token.session.json");
 }
 function authSessionName(name, slot) {
   const base = `switchroom-auth-${name.replace(/[^a-zA-Z0-9_.-]/g, "-")}`;
@@ -24873,7 +24890,7 @@ function cleanupAuthTempDirs(agentDir) {
   try {
     for (const entry of readdirSync11(dir)) {
       if (entry.startsWith(".setup-token-tmp-")) {
-        rmSync5(join16(dir, entry), { recursive: true, force: true });
+        rmSync5(join17(dir, entry), { recursive: true, force: true });
       }
     }
   } catch {}
@@ -25034,14 +25051,14 @@ function startAuthSession(name, agentDir, opts = {}) {
   rmSync5(logPath, { force: true });
   let configDir;
   if (opts.force) {
-    configDir = mkdtempSync2(join16(claudeDir2(agentDir), ".setup-token-tmp-"));
+    configDir = mkdtempSync2(join17(claudeDir2(agentDir), ".setup-token-tmp-"));
     try {
       chmodSync3(configDir, 448);
     } catch {}
   } else {
     configDir = claudeDir2(agentDir);
   }
-  const credentialsMtimeAtStart = fileMtimeMs(join16(configDir, ".credentials.json"));
+  const credentialsMtimeAtStart = fileMtimeMs(join17(configDir, ".credentials.json"));
   const commandParts = [];
   commandParts.push(`CLAUDE_CONFIG_DIR=${shellQuote(configDir)}`);
   commandParts.push(`LOG_PATH=${shellQuote(logPath)}`);
@@ -25129,7 +25146,7 @@ function submitAuthCode(name, agentDir, code, slot, _opts = {}) {
   tmux(["send-keys", "-l", "-t", sessionName, code.trim()]);
   tmux(["send-keys", "-t", sessionName, "Enter"]);
   const meta = readJsonFile(authSessionMetaPath(agentDir));
-  const credFileToWatch = meta?.configDir ? join16(meta.configDir, ".credentials.json") : credentialsPath(agentDir);
+  const credFileToWatch = meta?.configDir ? join17(meta.configDir, ".credentials.json") : credentialsPath(agentDir);
   const credsMtimeSnapshot = meta?.credentialsMtimeAtStart ?? 0;
   const logPath = authLogPath(agentDir);
   let token = null;
@@ -25235,9 +25252,9 @@ import {
   unlinkSync as unlinkSync6,
   writeFileSync as writeFileSync12
 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 function quarantineMarkerPath(telegramStateDir) {
-  return join18(telegramStateDir, QUARANTINE_FILENAME);
+  return join19(telegramStateDir, QUARANTINE_FILENAME);
 }
 function readQuarantineMarker(telegramStateDir) {
   const path = quarantineMarkerPath(telegramStateDir);
@@ -25277,7 +25294,7 @@ function clearQuarantineMarker(telegramStateDir) {
   }
 }
 function hostTelegramStateDir(agentsDir, name) {
-  return join18(agentsDir, name, "telegram");
+  return join19(agentsDir, name, "telegram");
 }
 function readQuarantineMarkerForAgent(agentsDir, name) {
   return readQuarantineMarker(hostTelegramStateDir(agentsDir, name));
@@ -25855,7 +25872,7 @@ import * as net2 from "node:net";
 import { existsSync as existsSync29 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 import { randomUUID } from "node:crypto";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 function reviveDate(v) {
   if (v == null)
     return null;
@@ -25865,7 +25882,7 @@ function reviveDate(v) {
   return Number.isNaN(d.getTime()) ? null : d;
 }
 function operatorSocketPath(home2 = homedir9()) {
-  return join20(home2, ".switchroom", "state", "auth-broker-operator", "sock");
+  return join21(home2, ".switchroom", "state", "auth-broker-operator", "sock");
 }
 function resolveAuthBrokerSocketPath(opts) {
   if (opts?.socket)
@@ -26223,7 +26240,7 @@ import {
   writeFileSync as writeFileSync14
 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
-import { join as join22, resolve as resolve22 } from "node:path";
+import { join as join23, resolve as resolve22 } from "node:path";
 function accountsRootOverride() {
   const v = process.env.SWITCHROOM_ACCOUNTS_DIR;
   if (v && v.length > 0 && v.startsWith("/"))
@@ -26234,13 +26251,13 @@ function accountsRoot(home2 = homedir11()) {
   return accountsRootOverride() ?? resolve22(home2, ".switchroom", "accounts");
 }
 function accountDir(label, home2 = homedir11()) {
-  return join22(accountsRoot(home2), label);
+  return join23(accountsRoot(home2), label);
 }
 function accountCredentialsPath(label, home2 = homedir11()) {
-  return join22(accountDir(label, home2), "credentials.json");
+  return join23(accountDir(label, home2), "credentials.json");
 }
 function accountMetaPath(label, home2 = homedir11()) {
-  return join22(accountDir(label, home2), "meta.json");
+  return join23(accountDir(label, home2), "meta.json");
 }
 function listAccounts(home2 = homedir11()) {
   const root = accountsRoot(home2);
@@ -26249,7 +26266,7 @@ function listAccounts(home2 = homedir11()) {
   try {
     return readdirSync15(root).filter((name) => {
       try {
-        return statSync16(join22(root, name)).isDirectory();
+        return statSync16(join23(root, name)).isDirectory();
       } catch {
         return false;
       }
@@ -26965,9 +26982,9 @@ var init_disconnect = __esm(() => {
 // src/vault/approvals/client.ts
 import { existsSync as existsSync31 } from "node:fs";
 import { homedir as homedir12 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 function kernelOperatorSocketPath(home2 = homedir12()) {
-  return join23(home2, ".switchroom", "state", "kernel-operator", "sock");
+  return join24(home2, ".switchroom", "state", "kernel-operator", "sock");
 }
 function resolveKernelOperatorSocket(home2 = homedir12()) {
   const p = kernelOperatorSocketPath(home2);
@@ -28051,7 +28068,7 @@ __export(exports_via_claude, {
 });
 import { execFileSync as execFileSync14, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync32, mkdirSync as mkdirSync19, readFileSync as readFileSync27 } from "node:fs";
-import { join as join24, resolve as resolve23 } from "node:path";
+import { join as join25, resolve as resolve23 } from "node:path";
 function tmuxHasSession(session) {
   const r = spawnSync2("tmux", ["has-session", "-t", session], {
     stdio: ["ignore", "ignore", "ignore"]
@@ -28097,7 +28114,7 @@ async function runViaClaude(opts) {
   const poll = opts.pollMs ?? VIA_CLAUDE_DEFAULTS.pollMs;
   const configDir = resolve23(opts.configDir);
   mkdirSync19(configDir, { recursive: true });
-  const credentialsPath2 = join24(configDir, ".credentials.json");
+  const credentialsPath2 = join25(configDir, ".credentials.json");
   const capture = opts.capturePane ?? (() => tmuxCapturePane(SESSION));
   const send = opts.sendKeys ?? ((keys, literal) => tmuxSendKeys(SESSION, keys, literal === true));
   if (!opts.spawnClaude) {
@@ -28852,9 +28869,9 @@ var DOCUMENTS_PAGE_LIMIT = 500;
 
 // src/host-control/audit-reader.ts
 import { homedir as homedir21 } from "node:os";
-import { join as join39 } from "node:path";
+import { join as join40 } from "node:path";
 function defaultAuditLogPath2(home2 = homedir21()) {
-  return join39(home2, ".switchroom", "host-control-audit.log");
+  return join40(home2, ".switchroom", "host-control-audit.log");
 }
 function parseAuditLine2(line) {
   const trimmed = line.trim();
@@ -29117,12 +29134,12 @@ import {
   readFileSync as readFileSync47,
   readdirSync as readdirSync19
 } from "node:fs";
-import { dirname as dirname12, join as join46 } from "node:path";
+import { dirname as dirname12, join as join47 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
 function locateManifestPath() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const candidate = join46(dir, "dependencies.json");
+    const candidate = join47(dir, "dependencies.json");
     if (existsSync52(candidate))
       return candidate;
     dir = dirname12(dir);
@@ -29192,13 +29209,13 @@ function probeClaudeVersion() {
 }
 function probePlaywrightMcpVersion() {
   const home2 = process.env.HOME ?? "";
-  const npxCache = join46(home2, ".npm/_npx");
+  const npxCache = join47(home2, ".npm/_npx");
   if (!existsSync52(npxCache))
     return null;
   try {
     const entries = readdirSync19(npxCache);
     for (const entry of entries) {
-      const pkgPath = join46(npxCache, entry, "node_modules/@playwright/mcp/package.json");
+      const pkgPath = join47(npxCache, entry, "node_modules/@playwright/mcp/package.json");
       if (existsSync52(pkgPath)) {
         try {
           const pkg = JSON.parse(readFileSync47(pkgPath, "utf-8"));
@@ -29644,7 +29661,7 @@ import { existsSync as existsSync53, readFileSync as readFileSync49 } from "node
 import { createHash as createHash10 } from "node:crypto";
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { homedir as homedir26 } from "node:os";
-import { join as join47 } from "node:path";
+import { join as join48 } from "node:path";
 function defaultDockerInspect(container, format) {
   try {
     const r = spawnSync6("docker", ["inspect", "-f", format, container], { encoding: "utf-8", timeout: 5000 });
@@ -29744,7 +29761,7 @@ function checkAuthBrokerPerAgentSockets(config, deps = {}) {
 }
 function checkAuthBrokerDrift(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const indexPath = join47(stateDir, "sha-index.json");
+  const indexPath = join48(stateDir, "sha-index.json");
   if (!existsSync53(indexPath)) {
     return {
       name: "auth-broker: drift",
@@ -29805,7 +29822,7 @@ function checkAuthBrokerDrift(deps = {}) {
 }
 function checkAuthBrokerThresholdViolations(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const path4 = join47(stateDir, "threshold-violations.json");
+  const path4 = join48(stateDir, "threshold-violations.json");
   if (!existsSync53(path4)) {
     return {
       name: "auth-broker: threshold violations",
@@ -30002,7 +30019,7 @@ import {
   statSync as statSync23
 } from "node:fs";
 import { userInfo, homedir as homedir27 } from "node:os";
-import { join as join48 } from "node:path";
+import { join as join49 } from "node:path";
 function resolveVaultPath2(config) {
   return config.vault?.path ? config.vault.path.replace(/^~/, process.env.HOME ?? "") : resolveStatePath("vault.enc");
 }
@@ -30140,7 +30157,7 @@ async function runSecretAccessChecks(config, deps = {}) {
   };
   const passphrase = deps.passphrase ?? process.env.SWITCHROOM_VAULT_PASSPHRASE;
   if (!passphrase) {
-    const sock = deps.brokerOperatorSocket ?? join48(homedir27(), ".switchroom", "broker-operator", "sock");
+    const sock = deps.brokerOperatorSocket ?? join49(homedir27(), ".switchroom", "broker-operator", "sock");
     const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
     for (const name of Object.keys(config.agents ?? {})) {
       const resolved = resolveAgentConfig(config.defaults, config.profiles, config.agents[name]);
@@ -30225,7 +30242,7 @@ import {
   existsSync as realExistsSync,
   readFileSync as realReadFileSync
 } from "node:fs";
-import { join as join49, resolve as resolve30 } from "node:path";
+import { join as join50, resolve as resolve30 } from "node:path";
 import { homedir as homedir28 } from "node:os";
 function resolveDeps(config, deps) {
   let agentsDir = deps.agentsDir;
@@ -30349,8 +30366,8 @@ function checkScaffoldWiring(config, driveAgents, d) {
       });
       continue;
     }
-    const mcpPath = join49(agentDir, ".mcp.json");
-    const claudeJsonPath = join49(agentDir, ".claude", ".claude.json");
+    const mcpPath = join50(agentDir, ".mcp.json");
+    const claudeJsonPath = join50(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson(d, mcpPath);
     const trustRead = readJson(d, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -30463,7 +30480,7 @@ async function runDriveBrokerReachabilityChecks(config, deps = {}) {
       }
     ];
   }
-  const sock = deps.brokerOperatorSocket ?? join49(homedir28(), ".switchroom", "broker-operator", "sock");
+  const sock = deps.brokerOperatorSocket ?? join50(homedir28(), ".switchroom", "broker-operator", "sock");
   const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
   const results = [];
   for (const agent of driveAgents) {
@@ -30517,7 +30534,7 @@ import {
   readSync as realReadSync,
   closeSync as realCloseSync
 } from "node:fs";
-import { join as join50 } from "node:path";
+import { join as join51 } from "node:path";
 import { homedir as homedir29 } from "node:os";
 function defaultReadHead(p, n) {
   let fd;
@@ -30575,7 +30592,7 @@ function runWebkiteChecks(config, deps = {}) {
     return [];
   const d = resolveDeps2(config, deps);
   const results = [];
-  const binPath = join50(d.homeDir, ".switchroom", "bin", "webkite");
+  const binPath = join51(d.homeDir, ".switchroom", "bin", "webkite");
   if (!d.existsSync(binPath)) {
     results.push({
       name: "webkite: binary",
@@ -30605,12 +30622,12 @@ function runWebkiteChecks(config, deps = {}) {
       });
     }
   }
-  const cloakDir = join50(d.homeDir, ".cloakbrowser");
+  const cloakDir = join51(d.homeDir, ".cloakbrowser");
   let chromeFound = false;
   if (d.existsSync(cloakDir)) {
     try {
       for (const entry of d.readdirSync(cloakDir)) {
-        if (entry.startsWith("chromium-") && d.existsSync(join50(cloakDir, entry, "chrome"))) {
+        if (entry.startsWith("chromium-") && d.existsSync(join51(cloakDir, entry, "chrome"))) {
           chromeFound = true;
           break;
         }
@@ -30636,9 +30653,9 @@ function runWebkiteChecks(config, deps = {}) {
     return results;
   }
   for (const agent of enabledAgents) {
-    const agentDir = join50(d.agentsDir, agent);
-    const settingsPath = join50(agentDir, ".claude", "settings.json");
-    const mcpPath = join50(agentDir, ".mcp.json");
+    const agentDir = join51(d.agentsDir, agent);
+    const settingsPath = join51(agentDir, ".claude", "settings.json");
+    const mcpPath = join51(agentDir, ".mcp.json");
     if (!d.existsSync(settingsPath) && !d.existsSync(mcpPath)) {
       continue;
     }
@@ -30702,7 +30719,7 @@ var init_doctor_webkite = __esm(() => {
 });
 
 // src/cli/doctor-scaffold-wiring.ts
-import { join as join51, resolve as resolve31 } from "node:path";
+import { join as join52, resolve as resolve31 } from "node:path";
 function readJson2(d, path4) {
   if (!d.existsSync(path4))
     return { kind: "absent" };
@@ -30745,8 +30762,8 @@ function checkIntegrationScaffoldWiring(args) {
       });
       continue;
     }
-    const mcpPath = join51(agentDir, ".mcp.json");
-    const claudeJsonPath = join51(agentDir, ".claude", ".claude.json");
+    const mcpPath = join52(agentDir, ".mcp.json");
+    const claudeJsonPath = join52(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson2(deps, mcpPath);
     const trustRead = readJson2(deps, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -30810,14 +30827,14 @@ import {
   existsSync as realExistsSync3,
   readFileSync as realReadFileSync3
 } from "node:fs";
-import { join as join52 } from "node:path";
+import { join as join53 } from "node:path";
 import { homedir as homedir30 } from "node:os";
 function resolveDeps3(deps) {
   const home2 = deps.homeDir?.() ?? homedir30();
   return {
     existsSync: deps.existsSync ?? realExistsSync3,
     readFileSync: deps.readFileSync ?? realReadFileSync3,
-    agentsDir: join52(home2, ".switchroom", "agents"),
+    agentsDir: join53(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now
   };
 }
@@ -30900,7 +30917,7 @@ function checkOAuthClient2(config, anyAgentEnabled) {
   ];
 }
 function readHeartbeat(d, agentName) {
-  const path4 = join52(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
+  const path4 = join53(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
   if (!d.existsSync(path4)) {
     return { error: "heartbeat file missing \u2014 launcher has not yet started" };
   }
@@ -30997,7 +31014,7 @@ import {
   readFileSync as realReadFileSync4,
   statSync as realStatSync
 } from "node:fs";
-import { join as join53 } from "node:path";
+import { join as join54 } from "node:path";
 import { homedir as homedir31 } from "node:os";
 function resolveDeps4(deps) {
   const home2 = deps.homeDir?.() ?? homedir31();
@@ -31005,7 +31022,7 @@ function resolveDeps4(deps) {
     existsSync: deps.existsSync ?? realExistsSync4,
     readFileSync: deps.readFileSync ?? realReadFileSync4,
     statSync: deps.statSync ?? realStatSync,
-    agentsDir: join53(home2, ".switchroom", "agents"),
+    agentsDir: join54(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now,
     vaultAclReader: deps.vaultAclReader ?? (async () => ({ kind: "unreachable", msg: "no default reader wired" }))
   };
@@ -31130,7 +31147,7 @@ function checkLauncherHeartbeat2(notionAgents, d) {
     return [];
   const results = [];
   for (const name of notionAgents) {
-    const heartbeatPath = join53(d.agentsDir, name, "notion-launcher.heartbeat.json");
+    const heartbeatPath = join54(d.agentsDir, name, "notion-launcher.heartbeat.json");
     if (!d.existsSync(heartbeatPath)) {
       results.push({
         name: `notion:launcher-heartbeat:${name}`,
@@ -31206,9 +31223,9 @@ import {
   statSync as realStatSync2
 } from "node:fs";
 import { homedir as homedir32 } from "node:os";
-import { join as join54 } from "node:path";
+import { join as join55 } from "node:path";
 function runCredentialsMigrationChecks(config, deps = {}) {
-  const credDir = deps.credentialsDir ?? join54(homedir32(), ".switchroom", "credentials");
+  const credDir = deps.credentialsDir ?? join55(homedir32(), ".switchroom", "credentials");
   const existsSync55 = deps.existsSync ?? ((p) => realExistsSync5(p));
   const readdirSync21 = deps.readdirSync ?? ((p) => realReaddirSync2(p));
   const isDirectory = deps.isDirectory ?? ((p) => {
@@ -31236,7 +31253,7 @@ function runCredentialsMigrationChecks(config, deps = {}) {
   const flat = [];
   const perAgentDirs = [];
   for (const e of entries) {
-    const full = join54(credDir, e);
+    const full = join55(credDir, e);
     if (isDirectory(full) && agentNames.has(e)) {
       perAgentDirs.push(e);
     } else {
@@ -31360,13 +31377,13 @@ var init_doctor_inlined_secrets = __esm(() => {
 // src/cli/doctor-audit-integrity.ts
 import { readFileSync as fsReadFileSync2 } from "node:fs";
 import { homedir as homedir33 } from "node:os";
-import { join as join55 } from "node:path";
+import { join as join56 } from "node:path";
 function rootWrittenLogs(home2) {
   return [
-    { label: "vault-broker", path: join55(home2, ".switchroom", "vault-audit.log") },
+    { label: "vault-broker", path: join56(home2, ".switchroom", "vault-audit.log") },
     {
       label: "hostd",
-      path: join55(home2, ".switchroom", "host-control-audit.log")
+      path: join56(home2, ".switchroom", "host-control-audit.log")
     }
   ];
 }
@@ -31430,13 +31447,13 @@ var init_doctor_audit_integrity = __esm(() => {
 // src/cli/doctor-agent-smoke.ts
 import { existsSync as existsSync55 } from "node:fs";
 import { homedir as homedir34 } from "node:os";
-import { join as join56 } from "node:path";
+import { join as join57 } from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 async function runAgentSmokeChecks(config, deps = {}) {
   if (deps.fast)
     return [];
   const home2 = deps.homeDir ?? homedir34();
-  const sock = deps.operatorSockPath ?? join56(home2, ".switchroom", "hostd", "operator", "sock");
+  const sock = deps.operatorSockPath ?? join57(home2, ".switchroom", "hostd", "operator", "sock");
   if (!deps.hostdRequestImpl && !existsSync55(sock)) {
     return [
       {
@@ -31517,7 +31534,7 @@ var init_doctor_agent_smoke = __esm(() => {
 import { execFileSync as execFileSync18 } from "node:child_process";
 import { existsSync as existsSync56, statSync as statSync24 } from "node:fs";
 import { homedir as homedir35 } from "node:os";
-import { join as join57 } from "node:path";
+import { join as join58 } from "node:path";
 function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   const statHost = opts?.statHost ?? defaultStatHost;
   const statBroker = opts?.statBroker ?? defaultStatBroker;
@@ -31666,16 +31683,16 @@ function runVaultBrokerDurabilityChecks(_config, opts) {
     probeBrokerUnlocked(opts?.statusProbe),
     probeAutoUnlockBlob(home2),
     probeMachineIdMount(),
-    formatBindMountResult("vault-broker: vault.enc bind mount", join57(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join57(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
-    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join57(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join57(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
-    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join57(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join57(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
+    formatBindMountResult("vault-broker: vault.enc bind mount", join58(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join58(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
+    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join58(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join58(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
+    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join58(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join58(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
     probeKernelDbDurability(home2, {
       statBroker: opts?.kernelStatBroker
     })
   ];
 }
 function probeKernelDbDurability(home2, opts) {
-  const hostDir = join57(home2, ".switchroom", "approvals");
+  const hostDir = join58(home2, ".switchroom", "approvals");
   const containerDir = "/state/approvals";
   const name = "approval-kernel: approvals bind mount (allow_always durability)";
   const kernelStat = opts?.statBroker ?? defaultKernelStatBroker;
@@ -31743,7 +31760,7 @@ function defaultKernelStatBroker(p) {
   return { kind: "ok-with-stat", ino: inoStr, size };
 }
 function probeAutoUnlockBlob(home2) {
-  const blobPath = join57(home2, ".switchroom", "vault-auto-unlock");
+  const blobPath = join58(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync56(blobPath)) {
     return {
       name: "vault-broker: auto-unlock blob",
@@ -31855,16 +31872,16 @@ import {
   readdirSync as readdirSync21,
   statSync as statSync25
 } from "node:fs";
-import { dirname as dirname13, join as join58, resolve as resolve32 } from "node:path";
+import { dirname as dirname13, join as join59, resolve as resolve32 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
-  const nvmRoot = join58(process.env.HOME ?? "", ".nvm", "versions", "node");
+  const nvmRoot = join59(process.env.HOME ?? "", ".nvm", "versions", "node");
   if (!existsSync57(nvmRoot))
     return null;
   try {
     const versions = readdirSync21(nvmRoot).sort().reverse();
     for (const v of versions) {
-      const candidate = join58(nvmRoot, v, "bin", bin);
+      const candidate = join59(nvmRoot, v, "bin", bin);
       try {
         const s = statSync25(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
@@ -32029,7 +32046,7 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
   if (envBrowsersPath && envBrowsersPath.length > 0) {
     cacheLocations.push(envBrowsersPath);
   }
-  cacheLocations.push(join58(homeDir, ".cache", "ms-playwright"));
+  cacheLocations.push(join59(homeDir, ".cache", "ms-playwright"));
   for (const cacheDir of cacheLocations) {
     if (!existsSync57(cacheDir))
       continue;
@@ -32037,10 +32054,10 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
       const entries = readdirSync21(cacheDir).filter((e) => e.startsWith("chromium"));
       for (const entry of entries) {
         const candidates2 = [
-          join58(cacheDir, entry, "chrome-linux64", "chrome"),
-          join58(cacheDir, entry, "chrome-linux", "chrome"),
-          join58(cacheDir, entry, "chrome-linux64", "headless_shell"),
-          join58(cacheDir, entry, "chrome-linux", "headless_shell")
+          join59(cacheDir, entry, "chrome-linux64", "chrome"),
+          join59(cacheDir, entry, "chrome-linux", "chrome"),
+          join59(cacheDir, entry, "chrome-linux64", "headless_shell"),
+          join59(cacheDir, entry, "chrome-linux", "headless_shell")
         ];
         for (const path4 of candidates2) {
           if (existsSync57(path4))
@@ -32163,7 +32180,7 @@ function checkUserDeclaredMcps(name, agentConfig, config, renderedMcpServers) {
 function checkLegacyState() {
   const results = [];
   const h = process.env.HOME ?? "/root";
-  const clerkDir = join58(h, LEGACY_STATE_DIR);
+  const clerkDir = join59(h, LEGACY_STATE_DIR);
   const clerkPresent = existsSync57(clerkDir);
   results.push({
     name: "legacy ~/.clerk state",
@@ -32173,7 +32190,7 @@ function checkLegacyState() {
       fix: "Legacy state detected. Run `mv ~/.clerk ~/.switchroom` and rename " + "any top-level `clerk:` key in switchroom.yaml to `switchroom:`. " + "This back-compat shim is REMOVED in v0.13.0 \u2014 no automatic " + "migration exists."
     } : {}
   });
-  const legacySock = join58(h, ".switchroom", "vault-broker.sock");
+  const legacySock = join59(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
     sockStat = lstatSync6(legacySock);
@@ -32551,7 +32568,7 @@ async function checkHindsight(config) {
 }
 function checkPendingRetainsQueue(dir) {
   const home2 = process.env.HOME ?? "";
-  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join58(home2, ".hindsight", "pending-retains");
+  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join59(home2, ".hindsight", "pending-retains");
   if (!existsSync57(pendingDir)) {
     return {
       name: "pending-retains queue",
@@ -32682,7 +32699,7 @@ async function checkTelegram(config) {
     const plugin = agentConfig.channels?.telegram?.plugin ?? "switchroom";
     if (plugin !== "switchroom")
       continue;
-    const envPath = join58(agentsDir, name, "telegram", ".env");
+    const envPath = join59(agentsDir, name, "telegram", ".env");
     const read = tryReadHostFile(envPath);
     if (read.kind === "eacces") {
       results.push({
@@ -32765,7 +32782,7 @@ function checkStartShStale(agentName, startShPath) {
 }
 function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const label = `${agentName}: $HOME/.switchroom symlink (#910)`;
-  const path4 = join58(agentDir, "home", ".switchroom");
+  const path4 = join59(agentDir, "home", ".switchroom");
   let stats;
   try {
     stats = lstatSync6(path4);
@@ -32802,7 +32819,7 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
 }
 function checkRepoHygiene(repoRoot) {
   const results = [];
-  const exportDir = join58(repoRoot, "clerk-export");
+  const exportDir = join59(repoRoot, "clerk-export");
   if (existsSync57(exportDir)) {
     results.push({
       name: "repo hygiene: clerk-export/ on disk (#1072)",
@@ -32811,7 +32828,7 @@ function checkRepoHygiene(repoRoot) {
       fix: `Run scripts/migrate-clerk-export-to-vault.sh to move the bundle ` + `into the vault, then delete the on-disk copy.`
     });
   }
-  const knownTarball = join58(repoRoot, "clerk-export-with-secrets.tar.gz");
+  const knownTarball = join59(repoRoot, "clerk-export-with-secrets.tar.gz");
   if (existsSync57(knownTarball)) {
     results.push({
       name: "repo hygiene: clerk-export-with-secrets.tar.gz on disk (#1072)",
@@ -32829,7 +32846,7 @@ function checkRepoHygiene(repoRoot) {
         results.push({
           name: `repo hygiene: ${name} on disk (#1072)`,
           status: "warn",
-          detail: `${join58(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
+          detail: `${join59(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
           fix: `Inspect, migrate any secrets into the vault, then delete the ` + `archive.`
         });
       }
@@ -32852,9 +32869,9 @@ function checkRepoHygiene(repoRoot) {
 }
 function isSwitchroomCheckout(dir) {
   try {
-    if (!existsSync57(join58(dir, ".git")))
+    if (!existsSync57(join59(dir, ".git")))
       return false;
-    const pkgPath = join58(dir, "package.json");
+    const pkgPath = join59(dir, "package.json");
     if (!existsSync57(pkgPath))
       return false;
     const pkg = JSON.parse(readFileSync50(pkgPath, "utf-8"));
@@ -32891,7 +32908,7 @@ function checkAgents(config, configPath) {
         fix: `Rotate the bot token (e.g. via \`switchroom vault\`), then run ` + `\`switchroom agent unquarantine ${name}\` and \`switchroom agent restart ${name}\``
       });
     }
-    results.push(checkStartShStale(name, join58(agentDir, "start.sh")));
+    results.push(checkStartShStale(name, join59(agentDir, "start.sh")));
     results.push(checkLeakedHomeSwitchroom(name, agentDir));
     const status = statuses[name];
     const active = status?.active ?? "unknown";
@@ -32968,7 +32985,7 @@ function checkAgents(config, configPath) {
       }
     }
     if (agentConfig.channels?.telegram?.plugin === "switchroom") {
-      const mcpJsonPath = join58(agentDir, ".mcp.json");
+      const mcpJsonPath = join59(agentDir, ".mcp.json");
       if (!existsSync57(mcpJsonPath)) {
         results.push({
           name: `${name}: .mcp.json`,
@@ -33270,7 +33287,7 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
     };
   }
   const credDir = dirname13(envPath);
-  const authScript = join58(credDir, "claude-auth.py");
+  const authScript = join59(credDir, "claude-auth.py");
   if (!existsSync57(authScript)) {
     return {
       name: "mff: auth flow",
@@ -50182,12 +50199,12 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.15.3";
-var COMMIT_SHA = "af652154";
+var VERSION = "0.15.4";
+var COMMIT_SHA = "dd68b93e";
 
 // src/cli/agent.ts
 init_source();
-import { join as join19, resolve as resolve21 } from "node:path";
+import { join as join20, resolve as resolve21 } from "node:path";
 import { rmSync as rmSync9, existsSync as existsSync28, readFileSync as readFileSync23, writeFileSync as writeFileSync13 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 
@@ -52922,8 +52939,6 @@ function classifyChange(path, agentDir, useHotReloadStable) {
     return "hot";
   if (relPath.startsWith("workspace/memory/") && relPath.endsWith(".md"))
     return "hot";
-  if (relPath === "workspace/HEARTBEAT.md")
-    return "hot";
   if (relPath === "workspace/SOUL.md" || relPath === "workspace/SOUL.custom.md") {
     return useHotReloadStable ? "hot" : "restart-required";
   }
@@ -53116,6 +53131,7 @@ function buildSettingsHooksBlock(p) {
     }
   ] : [];
   const useHotReloadStable = agentConfig.channels?.telegram?.hotReloadStable === true;
+  const useInjectOnChange = agentConfig.channels?.telegram?.inject_on_change !== false;
   const turnPacingDirective = "<turn-pacing>You are messaging a human via Telegram. The framework " + "automatically shows the user a live preview in their compose area as " + 'you work \u2014 they see "Read a file", "Ran 2 commands", etc. as your ' + `tool_use events stream. You do NOT need to ack manually.
 
 ` + "ALWAYS reply to a message the user sends you. A direct message " + 'expects a response: a greeting ("hi", "hey", "you there?") gets a ' + "greeting back; a thanks gets a brief acknowledgement; a question " + "gets an answer. NEVER end a turn with NO_REPLY when the user has " + "just sent you something \u2014 NO_REPLY is only for genuine non-prompts " + `(a system-synthesized event you have already fully handled).
@@ -53150,7 +53166,7 @@ function buildSettingsHooksBlock(p) {
       hooks: [
         {
           type: "command",
-          command: wrap("hook:workspace-dynamic", `bash "${join9(DOCKER_BIN_PATH, "workspace-dynamic-hook.sh")}"`),
+          command: wrap("hook:workspace-dynamic", `${useInjectOnChange ? `env SWITCHROOM_INJECT_ON_CHANGE=1 ` : ""}bash "${join9(DOCKER_BIN_PATH, "workspace-dynamic-hook.sh")}"`),
           timeout: 5
         }
       ]
@@ -53168,7 +53184,10 @@ function buildSettingsHooksBlock(p) {
       hooks: [
         {
           type: "command",
-          command: wrap("hook:turn-pacing", `printf '%s\\n' ${shellSingleQuote(turnPacingDirective)}`),
+          command: useInjectOnChange ? (() => {
+            const directiveHash = createHash2("sha256").update(turnPacingDirective).digest("hex");
+            return wrap("hook:turn-pacing", `env TURN_PACING_DIRECTIVE=${shellSingleQuote(turnPacingDirective)} TURN_PACING_HASH=${shellSingleQuote(directiveHash)} bash "${join9(DOCKER_BIN_PATH, "turn-pacing-hook.sh")}"`);
+          })() : wrap("hook:turn-pacing", `printf '%s\\n' ${shellSingleQuote(turnPacingDirective)}`),
           timeout: 3
         }
       ]
@@ -53984,7 +54003,7 @@ init_compose();
 import { chownSync as chownSync2 } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname3 } from "node:path";
+import { basename as basename3, dirname as dirname3, join as join12 } from "node:path";
 
 // src/config/release-resolve.ts
 function resolveImageTag(release) {
@@ -54005,7 +54024,6 @@ function resolveRelease(opts) {
     return opts.root;
   return;
 }
-
 // src/cli/operator-uid.ts
 import {
   chownSync,
@@ -54098,17 +54116,36 @@ function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
 
 // src/cli/write-compose.ts
 var AGENT_IMAGE_TAG_RE = /image:\s*\S*switchroom-agent:(\S+)/;
+var CONTAINER_CONFIG_PREFIX = "/state/config/";
+function resolveHostSwitchroomConfigPath(rawPath) {
+  if (!isDockerRuntime()) {
+    return rawPath;
+  }
+  if (!rawPath.startsWith(CONTAINER_CONFIG_PREFIX)) {
+    return rawPath;
+  }
+  const hostHome = process.env.SWITCHROOM_HOST_HOME;
+  if (!hostHome || hostHome.length === 0) {
+    throw new Error(`switchroom apply: running inside a container but SWITCHROOM_HOST_HOME is not set.
+` + `The config path "${rawPath}" is a container-internal path \u2014 emitting it as a ` + `Docker bind-mount source would cause Docker to create an empty directory at that ` + `path on the host, crashing the vault-broker and auth-broker with EISDIR.
+
+` + `Recovery: run \`switchroom apply\` once from the HOST (not from inside the container). ` + `That will regenerate the compose file with SWITCHROOM_HOST_HOME set, after which ` + `in-container apply will work correctly.`);
+  }
+  const filename = basename3(rawPath);
+  return join12(hostHome, ".switchroom", filename);
+}
 async function writeComposeFile(opts) {
   const release = resolveRelease({ override: opts.releaseOverride, root: opts.config.release });
   const imageTag = resolveImageTag(release);
   const operatorUid = resolveOperatorUid();
+  const resolvedConfigPath = opts.switchroomConfigPath !== undefined ? resolveHostSwitchroomConfigPath(opts.switchroomConfigPath) : undefined;
   const content = generateCompose({
     config: opts.config,
     imageTag,
     buildMode: opts.buildMode ?? "pull",
     buildContext: opts.buildContext,
-    homeDir: homedir6(),
-    switchroomConfigPath: opts.switchroomConfigPath,
+    homeDir: process.env.SWITCHROOM_HOST_HOME || homedir6(),
+    switchroomConfigPath: resolvedConfigPath,
     operatorUid
   });
   let previous = null;
@@ -54360,12 +54397,12 @@ function spinner(message) {
 
 // src/agents/status.ts
 import { existsSync as existsSync20, readFileSync as readFileSync18, statSync as statSync11 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 import { execFileSync as execFileSync9 } from "node:child_process";
 
 // src/agents/handoff-summarizer.ts
 import { readFileSync as readFileSync16, writeFileSync as writeFileSync8, renameSync as renameSync5, mkdirSync as mkdirSync14, existsSync as existsSync18, statSync as statSync10, readdirSync as readdirSync9 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 var DEFAULT_MAX_TURNS = 50;
 var TOPIC_MAX_CHARS = 117;
 var TURN_TEXT_MAX_CHARS = 1200;
@@ -54500,8 +54537,8 @@ function clampTopic(s) {
 }
 function writeSidecarsAtomic(agentDir, briefing, topic) {
   mkdirSync14(agentDir, { recursive: true });
-  const handoffPath = join13(agentDir, ".handoff.md");
-  const topicPath = join13(agentDir, ".handoff-topic");
+  const handoffPath = join14(agentDir, ".handoff.md");
+  const topicPath = join14(agentDir, ".handoff-topic");
   const handoffTmp = handoffPath + ".tmp";
   const topicTmp = topicPath + ".tmp";
   writeFileSync8(handoffTmp, briefing, "utf-8");
@@ -54562,7 +54599,7 @@ async function mirrorToHindsight(briefing, opts) {
   }
 }
 function findLatestSessionJsonl(claudeConfigDir) {
-  const projects = join13(claudeConfigDir, "projects");
+  const projects = join14(claudeConfigDir, "projects");
   if (!existsSync18(projects))
     return null;
   let latest = null;
@@ -54574,7 +54611,7 @@ function findLatestSessionJsonl(claudeConfigDir) {
       return;
     }
     for (const name of entries) {
-      const full = join13(dir, name);
+      const full = join14(dir, name);
       let st;
       try {
         st = statSync10(full);
@@ -54910,10 +54947,10 @@ async function buildAgentStatusReport(inputs) {
       };
     }
   }
-  const logPath = join14(inputs.agentDir, "telegram", "gateway.log");
+  const logPath = join15(inputs.agentDir, "telegram", "gateway.log");
   const logContent = inputs.readGatewayLog(logPath);
   const polling = buildPollingStatus(logContent);
-  const historyDbPath = join14(inputs.agentDir, "telegram", "history.db");
+  const historyDbPath = join15(inputs.agentDir, "telegram", "history.db");
   const messagesResult = inputs.getLastMessages(historyDbPath);
   const messages = buildMessageStatus(messagesResult);
   const checks = [
@@ -55191,7 +55228,7 @@ function defaultStatusInputs(params) {
 }
 function readCacheTelemetry(agentDir) {
   try {
-    const claudeConfigDir = join14(agentDir, ".claude");
+    const claudeConfigDir = join15(agentDir, ".claude");
     const jsonl = findLatestSessionJsonl(claudeConfigDir);
     if (!jsonl)
       return null;
@@ -55431,7 +55468,7 @@ async function completeCreation(name, code, opts = {}) {
 }
 
 // src/agents/add-orchestrator.ts
-import { resolve as resolve18, join as join17 } from "node:path";
+import { resolve as resolve18, join as join18 } from "node:path";
 import { existsSync as existsSync25, rmSync as rmSync7, statSync as statSync15 } from "node:fs";
 import { execFileSync as execFileSync12 } from "node:child_process";
 
@@ -55985,7 +56022,7 @@ function pruneBundledSkills(agentDir, keep, scope) {
   for (const entry of scopeSet) {
     if (keepSet.has(entry))
       continue;
-    const entryPath = join17(skillsDir, entry);
+    const entryPath = join18(skillsDir, entry);
     if (!existsSync25(entryPath))
       continue;
     let isDir = false;
@@ -56706,7 +56743,7 @@ function registerAgentCommand(program3) {
       }
       return;
     }
-    const logsDir = join19(homedir8(), ".switchroom", "logs");
+    const logsDir = join20(homedir8(), ".switchroom", "logs");
     const schedulerStates = Object.fromEntries(agentNames.map((n) => [n, getSchedulerState(n, logsDir)]));
     if (opts.json) {
       const data = agentNames.map((name) => {
@@ -57746,7 +57783,7 @@ init_lifecycle();
 import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
 import { homedir as homedir10 } from "node:os";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 init_helpers();
 init_broker_call();
 var execFileP = promisify2(execFile2);
@@ -57818,7 +57855,7 @@ function registerStatusCommand(program3) {
     const config = getConfig(program3);
     const agentNames = Object.keys(config.agents ?? {}).sort();
     const statuses = getAllAgentStatuses(config);
-    const logsDir = join21(homedir10(), ".switchroom", "logs");
+    const logsDir = join22(homedir10(), ".switchroom", "logs");
     const schedulerStates = Object.fromEntries(agentNames.map((n) => [n, getSchedulerState(n, logsDir)]));
     const accountsP = fetchAccounts();
     const mcpEnabled = opts.mcp !== false;
@@ -58228,7 +58265,7 @@ init_loader();
 init_manager();
 init_helpers();
 import { existsSync as existsSync33, readFileSync as readFileSync28 } from "node:fs";
-import { join as join25, resolve as resolve24 } from "node:path";
+import { join as join26, resolve as resolve24 } from "node:path";
 
 // src/cli/auth-google.ts
 init_source();
@@ -59753,8 +59790,8 @@ var SEVERITY_RANK = {
 };
 function diagnoseAuthState(claudeConfigDir) {
   const findings = [];
-  const credsPath = join25(claudeConfigDir, ".credentials.json");
-  const oauthTokenPath2 = join25(claudeConfigDir, ".oauth-token");
+  const credsPath = join26(claudeConfigDir, ".credentials.json");
+  const oauthTokenPath2 = join26(claudeConfigDir, ".oauth-token");
   const hasCreds = existsSync33(credsPath);
   const hasOauthToken = existsSync33(oauthTokenPath2);
   if (!hasCreds && !hasOauthToken) {
@@ -59939,7 +59976,7 @@ function loadCredentialsFromAgent(agentName) {
   const config = getConfigSafe();
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve24(agentsDir, agentName);
-  const credsPath = join25(agentDir, ".claude", ".credentials.json");
+  const credsPath = join26(agentDir, ".claude", ".credentials.json");
   if (!existsSync33(credsPath)) {
     console.error(source_default.red(`  Agent "${agentName}" has no .claude/.credentials.json \u2014 log it in first.`));
     process.exit(1);
@@ -60002,7 +60039,7 @@ async function loadCredentialsViaClaude(label) {
     import("node:os"),
     import("node:readline")
   ]);
-  const configDir = join25(homedir13(), ".switchroom", "accounts", label);
+  const configDir = join26(homedir13(), ".switchroom", "accounts", label);
   const result = await runViaClaude2({
     configDir,
     promptForCode: async (_url) => {
@@ -60044,7 +60081,7 @@ function registerAuthCommand(program3) {
       await withConfigError(async () => {
         const config = getConfig(program3);
         const agentsDir = resolveAgentsDir(config);
-        configDir = join25(agentsDir, agent, ".claude");
+        configDir = join26(agentsDir, agent, ".claude");
       })();
     }
     const diag = diagnoseAuthState(configDir);
@@ -60203,7 +60240,7 @@ function registerAuthCommand(program3) {
   }));
   auth.command("reauth <agent>").description("Start/resume an OAuth re-auth session for an agent; prints the login URL").option("--slot <label>", "Target a specific account slot/label instead of the agent's active one").option("--force", "Kill any existing session and force a fresh login (use to switch accounts)").action(withConfigError(async (agent, opts) => {
     const config = getConfig(program3);
-    const agentDir = join25(resolveAgentsDir(config), agent);
+    const agentDir = join26(resolveAgentsDir(config), agent);
     const r = startAuthSession(agent, agentDir, {
       force: opts.force,
       slot: opts.slot
@@ -60216,7 +60253,7 @@ function registerAuthCommand(program3) {
   }));
   auth.command("code <agent> <code>").description("Submit the browser OAuth code to complete a pending `auth reauth`").option("--slot <label>", "Target a specific account slot/label").option("--json", "Emit the structured AuthCodeResult as JSON (consumed by the Telegram gateway)").action(withConfigError(async (agent, code, opts) => {
     const config = getConfig(program3);
-    const agentDir = join25(resolveAgentsDir(config), agent);
+    const agentDir = join26(resolveAgentsDir(config), agent);
     const r = submitAuthCode(agent, agentDir, code, opts.slot);
     if (opts.json) {
       console.log(JSON.stringify({
@@ -60233,7 +60270,7 @@ function registerAuthCommand(program3) {
   }));
   auth.command("cancel <agent>").description("Cancel a pending `auth reauth` session for an agent").option("--slot <label>", "Target a specific account slot/label").action(withConfigError(async (agent, opts) => {
     const config = getConfig(program3);
-    const agentDir = join25(resolveAgentsDir(config), agent);
+    const agentDir = join26(resolveAgentsDir(config), agent);
     const r = cancelAuthSession(agent, agentDir, opts.slot);
     for (const line of r.instructions)
       console.log(line);
@@ -60255,7 +60292,7 @@ init_vault();
 init_hindsight();
 import { readFileSync as readFileSync29, writeFileSync as writeFileSync17, copyFileSync as copyFileSync6, existsSync as existsSync34, readdirSync as readdirSync16, statSync as statSync18 } from "node:fs";
 import { execFileSync as execFileSync15 } from "node:child_process";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 import { homedir as homedir13 } from "node:os";
 function getVaultPath2(configPath) {
   try {
@@ -60271,7 +60308,7 @@ function maskToken(s) {
   return "***";
 }
 function findClaudeTranscripts() {
-  const root = join26(homedir13(), ".claude", "projects");
+  const root = join27(homedir13(), ".claude", "projects");
   if (!existsSync34(root))
     return [];
   const out = [];
@@ -60283,7 +60320,7 @@ function findClaudeTranscripts() {
       return;
     }
     for (const e of entries) {
-      const p = join26(dir, e);
+      const p = join27(dir, e);
       let st;
       try {
         st = statSync18(p);
@@ -60302,8 +60339,8 @@ function findClaudeTranscripts() {
 }
 function findTelegramHistoryDb() {
   const candidates = [
-    process.env.TELEGRAM_STATE_DIR ? join26(process.env.TELEGRAM_STATE_DIR, "history.db") : null,
-    join26(homedir13(), ".claude", "channels", "telegram", "history.db")
+    process.env.TELEGRAM_STATE_DIR ? join27(process.env.TELEGRAM_STATE_DIR, "history.db") : null,
+    join27(homedir13(), ".claude", "channels", "telegram", "history.db")
   ].filter(Boolean);
   for (const c of candidates) {
     if (existsSync34(c))
@@ -60670,7 +60707,7 @@ init_compose();
 init_vault();
 import * as net3 from "node:net";
 import { mkdirSync as mkdirSync23, chmodSync as chmodSync7, chownSync as chownSync4, existsSync as existsSync37, readFileSync as readFileSync32, readdirSync as readdirSync17, statSync as statSync20, unlinkSync as unlinkSync8, writeFileSync as writeFileSync19, renameSync as renameSync10 } from "node:fs";
-import { dirname as dirname7, resolve as resolve26, basename as basename4 } from "node:path";
+import { dirname as dirname7, resolve as resolve26, basename as basename5 } from "node:path";
 import * as os4 from "node:os";
 import * as path3 from "node:path";
 
@@ -60692,13 +60729,13 @@ import {
   unlinkSync as unlinkSync7
 } from "node:fs";
 import { createHash as createHash5 } from "node:crypto";
-import { basename as basename3, dirname as dirname4, join as join27 } from "node:path";
+import { basename as basename4, dirname as dirname4, join as join28 } from "node:path";
 function vaultLayoutPaths(home2) {
-  const switchroomRoot = join27(home2, ".switchroom");
+  const switchroomRoot = join28(home2, ".switchroom");
   return {
-    oldPath: join27(switchroomRoot, "vault.enc"),
-    newPath: join27(switchroomRoot, "vault", "vault.enc"),
-    parent: join27(switchroomRoot, "vault"),
+    oldPath: join28(switchroomRoot, "vault.enc"),
+    newPath: join28(switchroomRoot, "vault", "vault.enc"),
+    parent: join28(switchroomRoot, "vault"),
     switchroomRoot
   };
 }
@@ -60845,7 +60882,7 @@ function sha256File(path) {
   return createHash5("sha256").update(data).digest("hex");
 }
 function atomicReplaceWithSymlink(target, linkTarget) {
-  const tmp = join27(dirname4(target), `.${basename3(target)}.symlink-tmp`);
+  const tmp = join28(dirname4(target), `.${basename4(target)}.symlink-tmp`);
   if (existsSync35(tmp)) {
     try {
       unlinkSync7(tmp);
@@ -60998,7 +61035,7 @@ import * as path from "node:path";
 // src/vault/broker/test-isolation-guard.ts
 import { mkdtempSync as mkdtempSync4 } from "node:fs";
 import { homedir as homedir14, tmpdir as tmpdir3 } from "node:os";
-import { join as join28, resolve as resolve25, sep } from "node:path";
+import { join as join29, resolve as resolve25, sep } from "node:path";
 function isTestRuntime() {
   return process.env.VITEST !== undefined;
 }
@@ -61019,7 +61056,7 @@ function safeVaultPath(requestedPath) {
     return requestedPath;
   if (!isUnderRealSwitchroomHome(requestedPath))
     return requestedPath;
-  const redirected = join28(mkdtempSync4(join28(tmpdir3(), "sw-test-vault-")), "vault.enc");
+  const redirected = join29(mkdtempSync4(join29(tmpdir3(), "sw-test-vault-")), "vault.enc");
   if (!warnedVault) {
     warnedVault = true;
     process.stderr.write(`[test-isolation guard] vault path redirected away from the ` + `production tree to an isolated tmpdir \u2014 a vault/broker test ` + `resolved its vault path inside ~/.switchroom. See CLAUDE.md ` + `"Vault & shared-state test discipline".
@@ -61035,7 +61072,7 @@ function safeAuditLogPath(requestedPath) {
   if (!isUnderRealSwitchroomHome(requestedPath))
     return requestedPath;
   if (!cachedTmpAuditLog) {
-    cachedTmpAuditLog = join28(mkdtempSync4(join28(tmpdir3(), "sw-test-audit-")), "vault-audit.log");
+    cachedTmpAuditLog = join29(mkdtempSync4(join29(tmpdir3(), "sw-test-audit-")), "vault-audit.log");
   }
   if (!warnedAudit) {
     warnedAudit = true;
@@ -64872,12 +64909,12 @@ class VaultBroker {
 }
 function detectVaultLayoutDrift(vaultPath) {
   const dir = dirname7(vaultPath);
-  if (basename4(dir) !== "vault")
+  if (basename5(dir) !== "vault")
     return;
-  if (basename4(vaultPath) !== "vault.enc")
+  if (basename5(vaultPath) !== "vault.enc")
     return;
   const switchroomDir = dirname7(dir);
-  if (basename4(switchroomDir) !== ".switchroom")
+  if (basename5(switchroomDir) !== ".switchroom")
     return;
   const home2 = dirname7(switchroomDir);
   const result = inspectVaultLayout(home2);
@@ -64988,7 +65025,7 @@ var import_yaml10 = __toESM(require_dist(), 1);
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { readFileSync as readFileSync33, writeFileSync as writeFileSync20 } from "node:fs";
 import { homedir as homedir18 } from "node:os";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 class EncryptFailedError extends Error {
   detail;
   constructor(detail) {
@@ -65021,7 +65058,7 @@ function setVaultBrokerAutoUnlock(configPath, value) {
   doc.setIn(["vault", "broker", "autoUnlock"], value);
   writeFileSync20(configPath, doc.toString(), "utf-8");
 }
-var DEFAULT_COMPOSE_FILE = join33(homedir18(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_FILE = join34(homedir18(), ".switchroom", "compose", "docker-compose.yml");
 async function applyAutoUnlock(opts = {}) {
   const log = opts.log ?? ((s) => console.log(s));
   const err = opts.err ?? ((s) => console.error(s));
@@ -65740,7 +65777,7 @@ init_source();
 init_loader();
 init_loader();
 init_client();
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 import { homedir as homedir19 } from "node:os";
 function parseDuration(raw) {
   const lower = raw.toLowerCase().trim();
@@ -65833,7 +65870,7 @@ function registerVaultGrantCommands(vault, program3) {
       console.error(source_default.red(`Failed to mint grant: ${result.msg}`));
       process.exit(1);
     }
-    const tokenPath = join34(homedir19(), ".switchroom", "agents", agent, ".vault-token");
+    const tokenPath = join35(homedir19(), ".switchroom", "agents", agent, ".vault-token");
     console.log(source_default.green(`\u2713 Grant minted`));
     if (process.stdout.isTTY) {
       console.log(source_default.bold("Token: ") + result.token);
@@ -65885,7 +65922,7 @@ The token file was written to the agent directory (mode 0600).`));
 init_source();
 init_loader();
 import { existsSync as existsSync42 } from "node:fs";
-import { join as join36 } from "node:path";
+import { join as join37 } from "node:path";
 
 // src/vault/backup.ts
 import {
@@ -65908,7 +65945,7 @@ import {
   writeSync as writeSync5
 } from "node:fs";
 import { homedir as homedir20 } from "node:os";
-import { join as join35, resolve as resolvePath2 } from "node:path";
+import { join as join36, resolve as resolvePath2 } from "node:path";
 var LATEST_SYMLINK = "vault.enc.latest.bak";
 var MANIFEST_FILE = "manifest.jsonl";
 var DEFAULT_RETAIN = 30;
@@ -65983,9 +66020,9 @@ function resolveBackupDestination(input) {
   if (input.configDestination)
     return resolvePath2(input.configDestination);
   if (input.hasSwitchroomConfigRepo) {
-    return join35(input.home, ".switchroom-config", "vault-backups");
+    return join36(input.home, ".switchroom-config", "vault-backups");
   }
-  return join35(input.home, ".switchroom", "vault-backups");
+  return join36(input.home, ".switchroom", "vault-backups");
 }
 function findAutoUnlockSibling(entries) {
   for (const name of entries) {
@@ -66036,9 +66073,9 @@ function backupVault(opts) {
     throw new Error(`vault backup refused: destination '${opts.destDir}' contains a file ` + `that looks like an auto-unlock credential ('${offender}'). The ` + `machine-bound auto-unlock blob MUST NOT be co-located with the ` + `encrypted vault \u2014 if they're together in version control, the ` + `passphrase gate is bypassed. Move/remove that file and retry.`);
   }
   const filename = computeBackupFilename(now);
-  const fullPath = join35(opts.destDir, filename);
+  const fullPath = join36(opts.destDir, filename);
   const tmpName = `.tmp.${process.pid}.${randomBytes10(4).toString("hex")}`;
-  const tmpPath = join35(opts.destDir, tmpName);
+  const tmpPath = join36(opts.destDir, tmpName);
   const src = readFileSync36(opts.vaultPath);
   const fd = openSync9(tmpPath, "wx", 384);
   try {
@@ -66062,9 +66099,9 @@ function backupVault(opts) {
     size_bytes: stat.size,
     sha256
   };
-  appendFileSync3(join35(opts.destDir, MANIFEST_FILE), JSON.stringify(row) + `
+  appendFileSync3(join36(opts.destDir, MANIFEST_FILE), JSON.stringify(row) + `
 `, { mode: 384 });
-  const latestPath = join35(opts.destDir, LATEST_SYMLINK);
+  const latestPath = join36(opts.destDir, LATEST_SYMLINK);
   try {
     unlinkSync10(latestPath);
   } catch {}
@@ -66083,7 +66120,7 @@ function backupVault(opts) {
   const pruneNames = selectBackupsToPrune(sorted, retain);
   for (const old of pruneNames) {
     try {
-      unlinkSync10(join35(opts.destDir, old));
+      unlinkSync10(join36(opts.destDir, old));
     } catch {}
   }
   if (pruneNames.length > 0) {
@@ -66132,7 +66169,7 @@ function registerVaultBackupCommand(vault, program3) {
         }
       } catch {}
       const home2 = defaultHome();
-      const hasSwitchroomConfigRepo = existsSync42(join36(home2, ".switchroom-config"));
+      const hasSwitchroomConfigRepo = existsSync42(join37(home2, ".switchroom-config"));
       const destDir = resolveBackupDestination({
         cliToFlag: opts.to ? resolvePath(opts.to) : undefined,
         configDestination,
@@ -66759,7 +66796,7 @@ Push passphrase to broker for future requests? [Y/n]: `);
 // src/cli/telegram.ts
 init_source();
 import { existsSync as existsSync43, readFileSync as readFileSync38, writeFileSync as writeFileSync21 } from "node:fs";
-import { join as join37 } from "node:path";
+import { join as join38 } from "node:path";
 
 // src/web/webhook-dispatch.ts
 function renderTemplate2(template, ctx) {
@@ -67021,7 +67058,7 @@ async function runTopicsDiscover(program3, chatId, opts) {
     fail(`Unknown agent '${agentName}'. Check switchroom.yaml.`);
   }
   const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? resolveStatePath("agents");
-  const dbPath = join37(agentsDir, agentName, "telegram", "history.db");
+  const dbPath = join38(agentsDir, agentName, "telegram", "history.db");
   if (!existsSync43(dbPath)) {
     fail(`No history DB at ${dbPath}.
 ` + `  The agent may not have received any Telegram messages yet, or it may be offline.
@@ -67687,9 +67724,9 @@ async function ensureHindsightConsumer(configPath, account, uid = HINDSIGHT_DEFA
 init_loader();
 var import_yaml12 = __toESM(require_dist(), 1);
 import { existsSync as existsSync44, readFileSync as readFileSync39, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 function readRecallLog(agentDir, limit) {
-  const path4 = join38(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
+  const path4 = join39(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
   if (!existsSync44(path4))
     return [];
   let raw;
@@ -67930,7 +67967,7 @@ Cross-agent reflection plan
       process.exit(1);
     })() : Object.keys(config.agents);
     for (const name of targets) {
-      const agentDir = join38(agentsDir, name);
+      const agentDir = join39(agentsDir, name);
       const entries = readRecallLog(agentDir, limit);
       if (opts.json) {
         for (const e of entries) {
@@ -68006,7 +68043,7 @@ import {
   writeSync as writeSync6,
   constants as fsConstants3
 } from "node:fs";
-import { resolve as resolve28, extname, join as join45, relative, dirname as dirname10 } from "node:path";
+import { resolve as resolve28, extname, join as join46, relative, dirname as dirname10 } from "node:path";
 import { homedir as homedir25 } from "node:os";
 import { spawn as spawn5 } from "node:child_process";
 import { timingSafeEqual as timingSafeEqual3, randomBytes as randomBytes11 } from "node:crypto";
@@ -72726,19 +72763,19 @@ import {
 } from "node:fs";
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join40 } from "node:path";
+import { join as join41 } from "node:path";
 
 class ConfigDiffError extends Error {
 }
 function generateUnifiedDiff(before, after, name = "switchroom.yaml", gitBin = "git") {
   if (before === after)
     return "";
-  const dir = mkdtemp(join40(tmpdir4(), "switchroom-config-diff-"));
+  const dir = mkdtemp(join41(tmpdir4(), "switchroom-config-diff-"));
   try {
-    mkdirSync26(join40(dir, "cur"), { recursive: true });
-    mkdirSync26(join40(dir, "new"), { recursive: true });
-    writeFileSync24(join40(dir, "cur", name), before);
-    writeFileSync24(join40(dir, "new", name), after);
+    mkdirSync26(join41(dir, "cur"), { recursive: true });
+    mkdirSync26(join41(dir, "new"), { recursive: true });
+    writeFileSync24(join41(dir, "cur", name), before);
+    writeFileSync24(join41(dir, "new", name), after);
     const r = spawnSync4(gitBin, ["diff", "--no-index", "--no-color", "--", `cur/${name}`, `new/${name}`], { cwd: dir, encoding: "utf-8", timeout: 1e4 });
     if (r.status === 0)
       return "";
@@ -72772,7 +72809,7 @@ function generateUnifiedDiff(before, after, name = "switchroom.yaml", gitBin = "
 init_client4();
 import { existsSync as existsSync46 } from "node:fs";
 import { homedir as homedir22 } from "node:os";
-import { join as join41 } from "node:path";
+import { join as join42 } from "node:path";
 var PROPOSE_TIMEOUT_MS = 11 * 60 * 1000;
 function resolveHostdOperatorSocket(env2 = process.env) {
   const override = env2.SWITCHROOM_HOSTD_OPERATOR_SOCKET;
@@ -72780,7 +72817,7 @@ function resolveHostdOperatorSocket(env2 = process.env) {
     return override;
   const candidates = [
     "/host-home/.switchroom/hostd/operator/sock",
-    join41(homedir22(), ".switchroom", "hostd", "operator", "sock")
+    join42(homedir22(), ".switchroom", "hostd", "operator", "sock")
   ];
   for (const c of candidates) {
     if (existsSync46(c))
@@ -72876,7 +72913,7 @@ init_client2();
 
 // telegram-plugin/registry/turns-schema.ts
 import { chmodSync as chmodSync8, mkdirSync as mkdirSync27 } from "fs";
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 var DatabaseClass = null;
 function loadDatabaseClass() {
   if (DatabaseClass != null)
@@ -72939,9 +72976,9 @@ function applySchema(db) {
 }
 function openTurnsDb(agentDir) {
   const Database2 = loadDatabaseClass();
-  const dir = join42(agentDir, "telegram");
+  const dir = join43(agentDir, "telegram");
   mkdirSync27(dir, { recursive: true, mode: 448 });
-  const path4 = join42(dir, "registry.db");
+  const path4 = join43(dir, "registry.db");
   const db = new Database2(path4, { create: true });
   applySchema(db);
   try {
@@ -73736,7 +73773,7 @@ async function handleGetMemoryHealth(config, opts) {
 
 // src/web/webhook-handler.ts
 import { appendFileSync as appendFileSync4, existsSync as existsSync49, mkdirSync as mkdirSync28, readFileSync as readFileSync44, writeFileSync as writeFileSync25 } from "fs";
-import { join as join44 } from "path";
+import { join as join45 } from "path";
 import { homedir as homedir24 } from "os";
 
 // src/web/webhook-verify.ts
@@ -73888,12 +73925,12 @@ function forwardToGateway(socketPath, req, opts = {}) {
 
 // src/web/webhook-edge.ts
 import { existsSync as existsSync48, readFileSync as readFileSync43 } from "fs";
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 import { homedir as homedir23 } from "os";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var EDGE_HEADER = "x-switchroom-edge";
 function edgeSecretPath() {
-  return join43(homedir23(), ".switchroom", "webhook-edge-secret");
+  return join44(homedir23(), ".switchroom", "webhook-edge-secret");
 }
 function loadEdgeSecret(path4) {
   const p = path4 ?? edgeSecretPath();
@@ -73956,8 +73993,8 @@ var agentDedupCache = new Map;
 function createFileDedupStore(resolveAgentDir) {
   return {
     check(agent, deliveryId, now) {
-      const telegramDir = join44(resolveAgentDir(agent), "telegram");
-      const filePath = join44(telegramDir, "webhook-dedup.json");
+      const telegramDir = join45(resolveAgentDir(agent), "telegram");
+      const filePath = join45(telegramDir, "webhook-dedup.json");
       if (!agentDedupCache.has(agent)) {
         agentDedupCache.set(agent, loadDedupFile(filePath));
       }
@@ -74009,7 +74046,7 @@ function shouldWriteThrottleIssue(agent, source, now, windowMap) {
   return true;
 }
 function writeThrottleIssue(agent, source, now, telegramDir, log) {
-  const issuesPath = join44(telegramDir, "issues.jsonl");
+  const issuesPath = join45(telegramDir, "issues.jsonl");
   try {
     mkdirSync28(telegramDir, { recursive: true });
     const record = {
@@ -74034,7 +74071,7 @@ function writeThrottleIssue(agent, source, now, telegramDir, log) {
 async function handleWebhookIngest(args, deps = {}) {
   const log = deps.log ?? ((s) => process.stderr.write(s));
   const now = (deps.now ?? Date.now)();
-  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join44(homedir24(), ".switchroom", "agents", a));
+  const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join45(homedir24(), ".switchroom", "agents", a));
   const rateLimiter = deps.rateLimiter ?? defaultRateLimiter;
   const dedupStore = deps.dedupStore ?? createFileDedupStore(resolveAgentDir);
   if (!args.agentExists) {
@@ -74098,7 +74135,7 @@ async function handleWebhookIngest(args, deps = {}) {
   if (retryAfter !== null) {
     if (!args.viaGateway) {
       const agentDir2 = resolveAgentDir(args.agent);
-      const telegramDir2 = join44(agentDir2, "telegram");
+      const telegramDir2 = join45(agentDir2, "telegram");
       if (shouldWriteThrottleIssue(args.agent, source, now)) {
         writeThrottleIssue(args.agent, source, now, telegramDir2, log);
       }
@@ -74118,7 +74155,7 @@ async function handleWebhookIngest(args, deps = {}) {
   const eventType = source === "github" ? args.headers.get("x-github-event") ?? "unknown" : args.source;
   const rendered = source === "github" ? renderGithubEvent(eventType, payload) : renderGenericEvent(args.source, payload);
   if (args.viaGateway) {
-    const socketPath = join44(resolveAgentDir(args.agent), "telegram", "webhook.sock");
+    const socketPath = join45(resolveAgentDir(args.agent), "telegram", "webhook.sock");
     const forward = deps.forwardFn ?? forwardToGateway;
     const deliveryId = source === "github" ? args.headers.get("x-github-delivery") ?? undefined : undefined;
     let resp;
@@ -74157,8 +74194,8 @@ async function handleWebhookIngest(args, deps = {}) {
     return jsonReply(202, { ok: true, recorded: true, ts: resp.ts });
   }
   const agentDir = resolveAgentDir(args.agent);
-  const telegramDir = join44(agentDir, "telegram");
-  const logPath = join44(telegramDir, "webhook-events.jsonl");
+  const telegramDir = join45(agentDir, "telegram");
+  const logPath = join45(telegramDir, "webhook-events.jsonl");
   try {
     mkdirSync28(telegramDir, { recursive: true });
     const record = {
@@ -74212,7 +74249,7 @@ function resolveWebToken() {
   if (fromEnv && fromEnv.length > 0)
     return fromEnv;
   const home2 = process.env.HOME ?? homedir25();
-  const tokenPath = join45(home2, ".switchroom", "web-token");
+  const tokenPath = join46(home2, ".switchroom", "web-token");
   if (existsSync50(tokenPath)) {
     const existing = readFileSync45(tokenPath, "utf8").trim();
     if (existing.length > 0)
@@ -74297,7 +74334,7 @@ function checkWsAuth(req, token, server) {
   return presented !== null && constantTimeEqual(presented, token);
 }
 function loadWebhookSecrets() {
-  const path4 = join45(homedir25(), ".switchroom", "webhook-secrets.json");
+  const path4 = join46(homedir25(), ".switchroom", "webhook-secrets.json");
   if (!existsSync50(path4))
     return {};
   try {
@@ -74633,7 +74670,7 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         }
       }
       let filePath = pathname === "/" ? "/index.html" : pathname;
-      const fullPath = join45(uiDir, filePath);
+      const fullPath = join46(uiDir, filePath);
       if (!existsSync50(fullPath)) {
         return new Response("Not Found", { status: 404 });
       }
@@ -75678,15 +75715,15 @@ init_loader();
 init_lifecycle();
 import { cpSync as cpSync2, existsSync as existsSync58, mkdirSync as mkdirSync32, readFileSync as readFileSync51, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync26 } from "node:fs";
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { join as join59, dirname as dirname14, resolve as resolve33 } from "node:path";
+import { join as join60, dirname as dirname14, resolve as resolve33 } from "node:path";
 import { homedir as homedir36 } from "node:os";
-var DEFAULT_COMPOSE_PATH = join59(homedir36(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH = join60(homedir36(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname14(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync58(join59(dir, ".git"))) {
+    if (existsSync58(join60(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync51(join59(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync51(join60(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -75837,7 +75874,7 @@ function planUpdate(opts) {
         return;
       }
       const source = resolve33(import.meta.dirname, "../../skills");
-      const dest = join59(homedir36(), ".switchroom", "skills", "_bundled");
+      const dest = join60(homedir36(), ".switchroom", "skills", "_bundled");
       if (!existsSync58(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
@@ -75951,7 +75988,7 @@ function defaultStatusProbe(composePath) {
       } catch {}
       let dir = dirname14(scriptPath);
       for (let i = 0;i < 8; i++) {
-        const pkgPath = join59(dir, "package.json");
+        const pkgPath = join60(dir, "package.json");
         if (existsSync58(pkgPath)) {
           try {
             const pkg = JSON.parse(readFileSync51(pkgPath, "utf-8"));
@@ -76171,7 +76208,7 @@ init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
 import { existsSync as existsSync59, readFileSync as readFileSync52 } from "node:fs";
-import { dirname as dirname15, join as join60 } from "node:path";
+import { dirname as dirname15, join as join61 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync4("claude --version 2>/dev/null", {
@@ -76221,11 +76258,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const pkgPath = join60(dir, "package.json");
+    const pkgPath = join61(dir, "package.json");
     if (existsSync59(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync52(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync59(join60(dir, ".git"))) {
+        if (pkg.name === "switchroom" && existsSync59(join61(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -76462,7 +76499,7 @@ import {
   writeFileSync as writeFileSync27,
   writeSync as writeSync7
 } from "node:fs";
-import { join as join61 } from "node:path";
+import { join as join62 } from "node:path";
 import { randomBytes as randomBytes12 } from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
 
@@ -76860,7 +76897,7 @@ function redactedMarker(ruleId) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path4 = join61(stateDir, ISSUES_FILE);
+  const path4 = join62(stateDir, ISSUES_FILE);
   if (!existsSync60(path4))
     return [];
   let raw;
@@ -76938,7 +76975,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve36(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync60(join61(stateDir, ISSUES_FILE)))
+  if (!existsSync60(join62(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -76956,7 +76993,7 @@ function resolve36(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync60(join61(stateDir, ISSUES_FILE)))
+  if (!existsSync60(join62(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -76974,7 +77011,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync60(join61(stateDir, ISSUES_FILE)))
+  if (!existsSync60(join62(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -77007,7 +77044,7 @@ function ensureDir(stateDir) {
   mkdirSync33(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path4 = join61(stateDir, ISSUES_FILE);
+  const path4 = join62(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path4}.tmp-${process.pid}-${randomBytes12(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -77029,7 +77066,7 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join61(stateDir, entry);
+    const tmpPath = join62(stateDir, entry);
     try {
       const stat = statSync27(tmpPath);
       if (stat.mtimeMs < cutoff) {
@@ -77041,7 +77078,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join61(stateDir, ISSUES_LOCK);
+  const lockPath = join62(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -77326,7 +77363,7 @@ function relTime(deltaMs) {
 init_source();
 import { existsSync as existsSync63 } from "node:fs";
 import { homedir as homedir39 } from "node:os";
-import { join as join64, resolve as resolve37 } from "node:path";
+import { join as join65, resolve as resolve37 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash11 } from "node:crypto";
@@ -77337,7 +77374,7 @@ import {
   rmSync as rmSync13,
   writeFileSync as writeFileSync28
 } from "node:fs";
-import { dirname as dirname16, join as join62 } from "node:path";
+import { dirname as dirname16, join as join63 } from "node:path";
 import { homedir as homedir37 } from "node:os";
 import { execFileSync as execFileSync19 } from "node:child_process";
 
@@ -77350,7 +77387,7 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join62(homedir37(), ".switchroom", "deps", "python");
+  return join63(homedir37(), ".switchroom", "deps", "python");
 }
 function hashFile(path4) {
   return createHash11("sha256").update(readFileSync54(path4)).digest("hex");
@@ -77362,11 +77399,11 @@ function ensurePythonEnv(opts) {
   if (!existsSync61(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join62(cacheRoot, skillName);
-  const stampPath = join62(venvDir, ".requirements.sha256");
-  const binDir = join62(venvDir, "bin");
-  const pythonBin = join62(binDir, "python");
-  const pipBin = join62(binDir, "pip");
+  const venvDir = join63(cacheRoot, skillName);
+  const stampPath = join63(venvDir, ".requirements.sha256");
+  const binDir = join63(venvDir, "bin");
+  const pythonBin = join63(binDir, "python");
+  const pipBin = join63(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
   if (!force && existsSync61(stampPath) && existsSync61(pythonBin)) {
     const existingHash = readFileSync54(stampPath, "utf8").trim();
@@ -77425,7 +77462,7 @@ import {
   rmSync as rmSync14,
   writeFileSync as writeFileSync29
 } from "node:fs";
-import { dirname as dirname17, join as join63 } from "node:path";
+import { dirname as dirname17, join as join64 } from "node:path";
 import { homedir as homedir38 } from "node:os";
 import { execFileSync as execFileSync20 } from "node:child_process";
 
@@ -77449,7 +77486,7 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join63(homedir38(), ".switchroom", "deps", "node");
+  return join64(homedir38(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
   const sourceDir = dirname17(packageJsonPath);
@@ -77458,7 +77495,7 @@ function hashDepInputs(packageJsonPath) {
 `);
   hasher.update(readFileSync55(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join63(sourceDir, lockName);
+    const lockPath = join64(sourceDir, lockName);
     if (existsSync62(lockPath)) {
       hasher.update(`
 `);
@@ -77478,10 +77515,10 @@ function ensureNodeEnv(opts) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
   const sourceDir = dirname17(packageJsonPath);
-  const envDir = join63(cacheRoot, skillName);
-  const stampPath = join63(envDir, ".package.sha256");
-  const nodeModulesDir = join63(envDir, "node_modules");
-  const binDir = join63(nodeModulesDir, ".bin");
+  const envDir = join64(cacheRoot, skillName);
+  const stampPath = join64(envDir, ".package.sha256");
+  const nodeModulesDir = join64(envDir, "node_modules");
+  const binDir = join64(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
   if (!force && existsSync62(stampPath) && existsSync62(nodeModulesDir)) {
     const existingHash = readFileSync55(stampPath, "utf8").trim();
@@ -77499,12 +77536,12 @@ function ensureNodeEnv(opts) {
     rmSync14(envDir, { recursive: true, force: true });
   }
   mkdirSync35(envDir, { recursive: true });
-  copyFileSync9(packageJsonPath, join63(envDir, "package.json"));
+  copyFileSync9(packageJsonPath, join64(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join63(sourceDir, lockName);
+    const lockPath = join64(sourceDir, lockName);
     if (existsSync62(lockPath)) {
-      copyFileSync9(lockPath, join63(envDir, lockName));
+      copyFileSync9(lockPath, join64(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -77543,13 +77580,13 @@ function registerDepsCommand(program3) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join64(skillsRoot, skill);
+    const skillDir = join65(skillsRoot, skill);
     if (!existsSync63(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join64(skillDir, "requirements.txt");
-    const packageJsonPath = join64(skillDir, "package.json");
+    const requirementsPath = join65(skillDir, "requirements.txt");
+    const packageJsonPath = join65(skillDir, "package.json");
     const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync63(requirementsPath));
     const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync63(packageJsonPath));
     let did = 0;
@@ -77826,7 +77863,6 @@ var DEFAULT_SOUL_FILENAME = "SOUL.md";
 var DEFAULT_TOOLS_FILENAME = "TOOLS.md";
 var DEFAULT_IDENTITY_FILENAME = "IDENTITY.md";
 var DEFAULT_USER_FILENAME = "USER.md";
-var DEFAULT_HEARTBEAT_FILENAME = "HEARTBEAT.md";
 var DEFAULT_BOOTSTRAP_FILENAME = "BOOTSTRAP.md";
 var DEFAULT_MEMORY_FILENAME = "MEMORY.md";
 
@@ -77843,8 +77879,7 @@ var STABLE_BOOTSTRAP_FILENAMES = [
   DEFAULT_BOOTSTRAP_FILENAME
 ];
 var DYNAMIC_BOOTSTRAP_FILENAMES = [
-  DEFAULT_MEMORY_FILENAME,
-  DEFAULT_HEARTBEAT_FILENAME
+  DEFAULT_MEMORY_FILENAME
 ];
 var DEFAULT_BOOTSTRAP_MAX_CHARS = 12000;
 var DEFAULT_BOOTSTRAP_TOTAL_MAX_CHARS = 64000;
@@ -78258,7 +78293,7 @@ function registerWorkspaceCommand(program3) {
     process.stdout.write(`${dir}
 `);
   }));
-  cmd.command("render <agent>").description("Render the agent's workspace bootstrap block to stdout " + "(used by start.sh and the UserPromptSubmit hook)").option("--stable", "Render only stable files (AGENTS/SOUL/USER/IDENTITY/TOOLS/BOOTSTRAP)").option("--dynamic", "Render only dynamic files (MEMORY + today/yesterday daily + HEARTBEAT)").option("--warning-mode <mode>", "Truncation warning mode: off | once | always | error (default: off for start.sh use)", "off").option("--max-per-file <n>", "Per-file char cap", String(DEFAULT_BOOTSTRAP_MAX_CHARS)).option("--max-total <n>", "Total char cap (defaults differ for stable vs dynamic)").action(withConfigError(async (agentName, opts) => {
+  cmd.command("render <agent>").description("Render the agent's workspace bootstrap block to stdout " + "(used by start.sh and the UserPromptSubmit hook)").option("--stable", "Render only stable files (AGENTS/SOUL/USER/IDENTITY/TOOLS/BOOTSTRAP)").option("--dynamic", "Render only dynamic files (MEMORY + today/yesterday daily)").option("--warning-mode <mode>", "Truncation warning mode: off | once | always | error (default: off for start.sh use)", "off").option("--max-per-file <n>", "Per-file char cap", String(DEFAULT_BOOTSTRAP_MAX_CHARS)).option("--max-total <n>", "Total char cap (defaults differ for stable vs dynamic)").action(withConfigError(async (agentName, opts) => {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
@@ -78506,7 +78541,7 @@ init_helpers();
 init_loader();
 init_merge();
 import { copyFileSync as copyFileSync10, existsSync as existsSync65, readFileSync as readFileSync56, writeFileSync as writeFileSync30 } from "node:fs";
-import { join as join65, resolve as resolve39 } from "node:path";
+import { join as join66, resolve as resolve39 } from "node:path";
 init_schema();
 function resolveSoulTargetOrExit(program3, agentName) {
   const config = getConfig(program3);
@@ -78530,7 +78565,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join65(workspaceDir, "SOUL.md"),
+    soulPath: join66(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -78597,7 +78632,7 @@ function registerSoulCommand(program3) {
 init_helpers();
 init_loader();
 import { existsSync as existsSync66, readFileSync as readFileSync57, readdirSync as readdirSync23, statSync as statSync28 } from "node:fs";
-import { resolve as resolve40, join as join66 } from "node:path";
+import { resolve as resolve40, join as join67 } from "node:path";
 import { createHash as createHash13 } from "node:crypto";
 init_merge();
 init_hindsight();
@@ -78608,7 +78643,7 @@ function estimateTokens(bytes) {
   return Math.round(bytes / 3.7);
 }
 function readMcpServerNames(agentDir) {
-  const mcpPath = join66(agentDir, ".mcp.json");
+  const mcpPath = join67(agentDir, ".mcp.json");
   if (!existsSync66(mcpPath))
     return [];
   try {
@@ -78622,7 +78657,7 @@ function sha256(content) {
   return createHash13("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join66(claudeConfigDir, "projects");
+  const projectsDir = join67(claudeConfigDir, "projects");
   if (!existsSync66(projectsDir))
     return;
   try {
@@ -78631,8 +78666,8 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join66(projectsDir, entry.name);
-      const transcriptPath = join66(projectPath, "transcript.jsonl");
+      const projectPath = join67(projectsDir, entry.name);
+      const transcriptPath = join67(projectPath, "transcript.jsonl");
       if (!existsSync66(transcriptPath))
         continue;
       const stat3 = statSync28(transcriptPath);
@@ -78701,11 +78736,11 @@ function registerDebugCommand(program3) {
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join66(agentDir, ".claude");
-    const claudeMdPath = join66(agentDir, "CLAUDE.md");
-    const soulMdPath = join66(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join66(workspaceDir, "SOUL.md");
-    const handoffPath = join66(agentDir, ".handoff.md");
+    const claudeConfigDir = join67(agentDir, ".claude");
+    const claudeMdPath = join67(agentDir, "CLAUDE.md");
+    const soulMdPath = join67(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join67(workspaceDir, "SOUL.md");
+    const handoffPath = join67(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -78834,9 +78869,9 @@ function registerDebugCommand(program3) {
     const soulMdBytes = soulMdContent.length;
     const perTurnBytes = dynamicResult.concatenated.length;
     const userBytes = userMessage?.text.length ?? 0;
-    const fleetDir = join66(agentsDir, "..", "fleet");
-    const fleetInvPath = join66(fleetDir, "switchroom-invariants.md");
-    const fleetClaudePath = join66(fleetDir, "CLAUDE.md");
+    const fleetDir = join67(agentsDir, "..", "fleet");
+    const fleetInvPath = join67(fleetDir, "switchroom-invariants.md");
+    const fleetClaudePath = join67(fleetDir, "CLAUDE.md");
     const fleetInvBytes = existsSync66(fleetInvPath) ? readFileSync57(fleetInvPath, "utf-8").length : 0;
     const fleetClaudeBytes = existsSync66(fleetClaudePath) ? readFileSync57(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
@@ -78872,7 +78907,7 @@ init_source();
 // src/worktree/claim.ts
 import { execFileSync as execFileSync21 } from "node:child_process";
 import { closeSync as closeSync12, mkdirSync as mkdirSync37, openSync as openSync12, existsSync as existsSync68, unlinkSync as unlinkSync13 } from "node:fs";
-import { join as join68, resolve as resolve42 } from "node:path";
+import { join as join69, resolve as resolve42 } from "node:path";
 import { homedir as homedir41 } from "node:os";
 import { randomBytes as randomBytes13 } from "node:crypto";
 
@@ -78886,13 +78921,13 @@ import {
   existsSync as existsSync67,
   renameSync as renameSync13
 } from "node:fs";
-import { join as join67, resolve as resolve41 } from "node:path";
+import { join as join68, resolve as resolve41 } from "node:path";
 import { homedir as homedir40 } from "node:os";
 function registryDir() {
-  return resolve41(process.env.SWITCHROOM_WORKTREE_DIR ?? join67(homedir40(), ".switchroom", "worktrees"));
+  return resolve41(process.env.SWITCHROOM_WORKTREE_DIR ?? join68(homedir40(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join67(registryDir(), `${id}.json`);
+  return join68(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
   mkdirSync36(registryDir(), { recursive: true });
@@ -78943,7 +78978,7 @@ function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
   mkdirSync37(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join68(lockDir, `.lock-${lockName}`);
+  const lockPath = join69(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -78970,7 +79005,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve42(process.env.SWITCHROOM_WORKTREE_BASE ?? join68(homedir41(), ".switchroom", "worktree-checkouts"));
+  return resolve42(process.env.SWITCHROOM_WORKTREE_BASE ?? join69(homedir41(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes13(4).toString("hex");
@@ -78992,7 +79027,7 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join68(homedir41(), p.slice(2));
+    return join69(homedir41(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
@@ -79020,7 +79055,7 @@ async function claimWorktree(input, codeRepos) {
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
     mkdirSync37(baseDir, { recursive: true });
-    worktreePath = join68(baseDir, `${id}-${taskSuffix}`);
+    worktreePath = join69(baseDir, `${id}-${taskSuffix}`);
     const now = new Date().toISOString();
     const record2 = {
       id,
@@ -79275,7 +79310,7 @@ import {
   rmSync as rmSync15,
   writeFileSync as writeFileSync32
 } from "node:fs";
-import { join as join69 } from "node:path";
+import { join as join70 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -79465,16 +79500,16 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join69(stateBase, "google-workspace-mcp", "credentials");
+  return join70(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
   mkdirSync38(dir, { recursive: true, mode: 448 });
   chmodSync9(dir, 448);
   for (const name of readdirSync25(dir)) {
-    rmSync15(join69(dir, name), { force: true, recursive: true });
+    rmSync15(join70(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join69(dir, filename);
+  const filePath = join70(dir, filename);
   writeFileSync32(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync9(filePath, 384);
   return filePath;
@@ -79634,7 +79669,7 @@ function registerDriveMcpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
 import { writeFileSync as writeFileSync33, mkdirSync as mkdirSync39 } from "node:fs";
-import { dirname as dirname18, join as join70 } from "node:path";
+import { dirname as dirname18, join as join71 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -79666,7 +79701,7 @@ function writeRefreshHeartbeat(agentName, data) {
 function heartbeatPath(agentName) {
   const override = process.env.SWITCHROOM_M365_HEARTBEAT_DIR;
   if (override) {
-    return join70(override, `m365-launcher-${agentName}.heartbeat.json`);
+    return join71(override, `m365-launcher-${agentName}.heartbeat.json`);
   }
   return "/state/agent/m365-launcher.heartbeat.json";
 }
@@ -79976,10 +80011,10 @@ function registerNotionMcpLauncherCommand(program3) {
 // src/cli/deliver-file.ts
 init_client2();
 import { readFileSync as readFileSync59, statSync as statSync29 } from "node:fs";
-import { basename as basename7 } from "node:path";
+import { basename as basename8 } from "node:path";
 
 // src/delivery/onedrive.ts
-import { basename as basename5 } from "node:path";
+import { basename as basename6 } from "node:path";
 var GRAPH = "https://graph.microsoft.com/v1.0";
 var ONEDRIVE_INLINE_MAX_BYTES = 4 * 1024 * 1024;
 function authHeaders(token) {
@@ -80102,14 +80137,14 @@ async function createShareLink(deps, item, scopes = ["anonymous", "organization"
 async function deliverToOneDrive(args) {
   const deps = { accessToken: args.accessToken, fetchImpl: args.fetchImpl };
   const folder = await ensureSwitchroomFolder(deps, args.agentName);
-  const filename = basename5(args.localPath);
+  const filename = basename6(args.localPath);
   const item = await uploadFile(deps, folder.id, filename, args.bytes);
   const link = await createShareLink(deps, item, args.linkScopes);
   return { itemId: item.id, link, folderPath: `Switchroom/${args.agentName}` };
 }
 
 // src/delivery/gdrive.ts
-import { basename as basename6 } from "node:path";
+import { basename as basename7 } from "node:path";
 var DRIVE = "https://www.googleapis.com/drive/v3";
 var UPLOAD = "https://www.googleapis.com/upload/drive/v3";
 var FOLDER_MIME = "application/vnd.google-apps.folder";
@@ -80257,7 +80292,7 @@ async function createShareLink2(deps, file, scopes = ["anyone"]) {
 async function deliverToGoogleDrive(args) {
   const deps = { accessToken: args.accessToken, fetchImpl: args.fetchImpl };
   const folder = await ensureSwitchroomFolder2(deps, args.agentName);
-  const filename = basename6(args.localPath);
+  const filename = basename7(args.localPath);
   const file = await uploadFile2(deps, folder.id, filename, args.bytes);
   const link = await createShareLink2(deps, file, args.linkScopes);
   return { itemId: file.id, link, folderPath: `Switchroom/${args.agentName}` };
@@ -80336,7 +80371,7 @@ async function runDeliverFile(localPath, deps = {}) {
   try {
     const bytes = read(localPath);
     const out = await provider.deliver({ agentName, localPath, bytes });
-    return { ok: true, provider: provider.name, link: out.link, folderPath: out.folderPath, filename: basename7(localPath) };
+    return { ok: true, provider: provider.name, link: out.link, folderPath: out.folderPath, filename: basename8(localPath) };
   } catch (err) {
     return { ok: false, provider: provider.name, error: `upload failed: ${err.message}` };
   }
@@ -80994,7 +81029,7 @@ agents:
 
 // src/cli/apply.ts
 init_resolver();
-import { dirname as dirname22, join as join73, resolve as resolve44 } from "node:path";
+import { dirname as dirname22, join as join74, resolve as resolve44 } from "node:path";
 import { homedir as homedir43 } from "node:os";
 import { execFileSync as execFileSync24 } from "node:child_process";
 init_vault();
@@ -81003,7 +81038,7 @@ init_loader();
 
 // src/cli/update-prompt-hook.ts
 import { existsSync as existsSync72, readFileSync as readFileSync60, writeFileSync as writeFileSync35, chmodSync as chmodSync10, mkdirSync as mkdirSync41 } from "node:fs";
-import { join as join71 } from "node:path";
+import { join as join72 } from "node:path";
 var HOOK_FILENAME = "update-card-on-prompt.sh";
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -81069,9 +81104,9 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join71(agentDir, ".claude", "hooks");
+  const hooksDir = join72(agentDir, ".claude", "hooks");
   mkdirSync41(hooksDir, { recursive: true });
-  const scriptPath = join71(hooksDir, HOOK_FILENAME);
+  const scriptPath = join72(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
   const existing = existsSync72(scriptPath) ? readFileSync60(scriptPath, "utf-8") : "";
@@ -81084,7 +81119,7 @@ function installUpdatePromptHook(agentDir) {
       chmodSync10(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join71(agentDir, ".claude", "settings.json");
+  const settingsPath = join72(agentDir, ".claude", "settings.json");
   if (!existsSync72(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
@@ -81186,14 +81221,14 @@ var EMBEDDED_EXAMPLES = {
   switchroom: switchroom_default,
   minimal: minimal_default
 };
-var DEFAULT_COMPOSE_PATH2 = join73(homedir43(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH2 = join74(homedir43(), ".switchroom", "compose", "docker-compose.yml");
 var COMPOSE_PROJECT2 = "switchroom";
 function resolveVaultBindMountDir(homeDir, ctx) {
   const isCustomPath = ctx.migrationKind === "custom-path-skipped";
   if (isCustomPath && ctx.customVaultPath) {
     return dirname22(ctx.customVaultPath);
   }
-  return join73(homeDir, ".switchroom", "vault");
+  return join74(homeDir, ".switchroom", "vault");
 }
 function inspectVaultBindMountDir(vaultDir) {
   if (!existsSync74(vaultDir))
@@ -81224,42 +81259,42 @@ function hasVaultRefs(value) {
 async function ensureHostMountSources(config) {
   const home2 = homedir43();
   const dirs = [
-    join73(home2, ".switchroom", "approvals"),
-    join73(home2, ".switchroom", "scheduler"),
-    join73(home2, ".switchroom", "logs"),
-    join73(home2, ".switchroom", "compose"),
-    join73(home2, ".switchroom", "broker-operator")
+    join74(home2, ".switchroom", "approvals"),
+    join74(home2, ".switchroom", "scheduler"),
+    join74(home2, ".switchroom", "logs"),
+    join74(home2, ".switchroom", "compose"),
+    join74(home2, ".switchroom", "broker-operator")
   ];
   for (const name of Object.keys(config.agents)) {
-    dirs.push(join73(home2, ".switchroom", "agents", name));
-    dirs.push(join73(home2, ".switchroom", "logs", name));
-    dirs.push(join73(home2, ".claude", "projects", name));
-    dirs.push(join73(home2, ".switchroom", "audit", name));
-    if (existsSync74(join73(home2, ".switchroom-config"))) {
-      dirs.push(join73(home2, ".switchroom-config", "agents", name, "personal-skills"));
+    dirs.push(join74(home2, ".switchroom", "agents", name));
+    dirs.push(join74(home2, ".switchroom", "logs", name));
+    dirs.push(join74(home2, ".claude", "projects", name));
+    dirs.push(join74(home2, ".switchroom", "audit", name));
+    if (existsSync74(join74(home2, ".switchroom-config"))) {
+      dirs.push(join74(home2, ".switchroom-config", "agents", name, "personal-skills"));
     }
   }
   for (const dir of dirs) {
     await mkdir2(dir, { recursive: true });
   }
-  const autoUnlockPath = join73(home2, ".switchroom", "vault-auto-unlock");
+  const autoUnlockPath = join74(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync74(autoUnlockPath)) {
     writeFileSync36(autoUnlockPath, "", { mode: 384 });
   }
-  const auditLogPath = join73(home2, ".switchroom", "vault-audit.log");
+  const auditLogPath = join74(home2, ".switchroom", "vault-audit.log");
   if (!existsSync74(auditLogPath)) {
     writeFileSync36(auditLogPath, "", { mode: 420 });
   }
-  const grantsDbPath = join73(home2, ".switchroom", "vault-grants.db");
+  const grantsDbPath = join74(home2, ".switchroom", "vault-grants.db");
   if (!existsSync74(grantsDbPath)) {
     writeFileSync36(grantsDbPath, "", { mode: 384 });
   }
-  const hostdAuditLogPath = join73(home2, ".switchroom", "host-control-audit.log");
+  const hostdAuditLogPath = join74(home2, ".switchroom", "host-control-audit.log");
   if (!existsSync74(hostdAuditLogPath)) {
     writeFileSync36(hostdAuditLogPath, "", { mode: 420 });
   }
   for (const name of Object.keys(config.agents)) {
-    const tokenPath = join73(home2, ".switchroom", "agents", name, ".vault-token");
+    const tokenPath = join74(home2, ".switchroom", "agents", name, ".vault-token");
     if (!existsSync74(tokenPath)) {
       writeFileSync36(tokenPath, "", { mode: 384 });
     }
@@ -81268,15 +81303,15 @@ async function ensureHostMountSources(config) {
       chownSync5(tokenPath, uid, uid);
     } catch {}
   }
-  const fleetDir = join73(home2, ".switchroom", "fleet");
+  const fleetDir = join74(home2, ".switchroom", "fleet");
   await mkdir2(fleetDir, { recursive: true });
-  const invariantsPath = join73(fleetDir, "switchroom-invariants.md");
+  const invariantsPath = join74(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
   const invariantsCurrent = existsSync74(invariantsPath) ? readFileSync61(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
     writeFileSync36(invariantsPath, invariantsCanonical, { mode: 420 });
   }
-  const fleetClaudePath = join73(fleetDir, "CLAUDE.md");
+  const fleetClaudePath = join74(fleetDir, "CLAUDE.md");
   if (!existsSync74(fleetClaudePath)) {
     writeFileSync36(fleetClaudePath, [
       "# Switchroom fleet defaults",
@@ -81361,8 +81396,8 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 }
 function writeInstallTypeCache(homeDir = homedir43()) {
   const ctx = detectInstallType();
-  const dir = join73(homeDir, ".switchroom");
-  const out = join73(dir, "install-type.json");
+  const dir = join74(homeDir, ".switchroom");
+  const out = join74(dir, "install-type.json");
   const tmp = `${out}.tmp`;
   mkdirSync42(dir, { recursive: true });
   const payload = {
@@ -81411,14 +81446,14 @@ Applying switchroom config...
       writeOut(source_default.green(`  + ${name}`) + source_default.gray(` (${agentConfig.extends ?? "default"}) \u2014 ${detail}
 `));
       try {
-        installUpdatePromptHook(join73(agentsDir, name));
+        installUpdatePromptHook(join74(agentsDir, name));
       } catch (hookErr) {
         writeOut(source_default.gray(`    (update-prompt hook install failed for ${name}: ${hookErr.message})
 `));
       }
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join73(agentsDir, name), uid, {
+        alignAgentUid(name, join74(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -81455,7 +81490,7 @@ Applying switchroom config...
     for (const name of agentNames) {
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join73(agentsDir, name), uid, {
+        alignAgentUid(name, join74(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -81618,7 +81653,7 @@ function findUnwritableAgentDirs(config, opts) {
   const targets = opts.only ? [opts.only] : Object.keys(config.agents ?? {});
   const unwritable = [];
   for (const name of targets) {
-    const startSh = join73(agentsDir, name, "start.sh");
+    const startSh = join74(agentsDir, name, "start.sh");
     if (!existsSync74(startSh))
       continue;
     try {
@@ -81685,7 +81720,7 @@ function registerApplyCommand(program3) {
       }
       const parentOpts = program3.opts();
       const config = loadConfig(parentOpts.config);
-      const switchroomConfigPath = parentOpts.config ?? findConfigFile();
+      const switchroomConfigPath = resolveHostSwitchroomConfigPath(parentOpts.config ?? findConfigFile());
       if (opts.printSudoCmd) {
         const argv = ["sudo", ...buildSelfElevateArgv()];
         process.stdout.write(argv.join(" ") + `
@@ -81798,7 +81833,7 @@ function runRedactStdin() {
 
 // src/cli/status-ask.ts
 import { readFileSync as readFileSync62, existsSync as existsSync75, readdirSync as readdirSync27 } from "node:fs";
-import { join as join74 } from "node:path";
+import { join as join75 } from "node:path";
 import { homedir as homedir44 } from "node:os";
 
 // src/status-ask/report.ts
@@ -82134,7 +82169,7 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join74(homedir44(), ".switchroom", "agents");
+    agentsDir = join75(homedir44(), ".switchroom", "agents");
   }
   if (!existsSync75(agentsDir))
     return [];
@@ -82146,7 +82181,7 @@ function resolveSources(explicitPath) {
     return [];
   }
   for (const name of entries) {
-    const path8 = join74(agentsDir, name, "runtime-metrics.jsonl");
+    const path8 = join75(agentsDir, name, "runtime-metrics.jsonl");
     if (existsSync75(path8)) {
       sources.push({ path: path8, agent: name });
     }
@@ -82184,21 +82219,21 @@ import {
   unlinkSync as unlinkSync14,
   writeSync as writeSync8
 } from "node:fs";
-import { join as join75, resolve as resolve45 } from "node:path";
+import { join as join76, resolve as resolve45 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
   const base = opts.root ? resolve45(opts.root, agent) : resolve45(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join75(base, "schedule.d");
-  const scheduleStagingDir = join75(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join75(base, "skills.d");
-  const skillsStagingDir = join75(skillsDir, STAGING_SUBDIR);
+  const scheduleDir = join76(base, "schedule.d");
+  const scheduleStagingDir = join76(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join76(base, "skills.d");
+  const skillsStagingDir = join76(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join75(base, ".lock"),
+    lockPath: join76(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
@@ -82252,8 +82287,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join75(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join75(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join76(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join76(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -82269,8 +82304,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join75(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join75(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join76(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join76(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -82285,7 +82320,7 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join75(paths.skillsDir, `${slug}.yaml`);
+    const finalPath = join76(paths.skillsDir, `${slug}.yaml`);
     if (!existsSync76(finalPath))
       return false;
     unlinkSync14(finalPath);
@@ -82300,7 +82335,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync28(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join75(paths.skillsDir, name);
+    const full = join76(paths.skillsDir, name);
     try {
       const raw = readFileSync63(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -82312,7 +82347,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join75(paths.scheduleDir, `${slug}.yaml`);
+    const finalPath = join76(paths.scheduleDir, `${slug}.yaml`);
     if (!existsSync76(finalPath))
       return false;
     unlinkSync14(finalPath);
@@ -82327,7 +82362,7 @@ function listOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync28(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join75(paths.scheduleDir, name);
+    const full = join76(paths.scheduleDir, name);
     try {
       const raw = readFileSync63(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -82483,12 +82518,12 @@ import {
   writeFileSync as writeFileSync37,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join76 } from "node:path";
+import { join as join77 } from "node:path";
 import { randomBytes as randomBytes14 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join76(paths.scheduleDir, ".pending");
+  return join77(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
@@ -82501,8 +82536,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join76(dir, `${stageId}.yaml`);
-  const metaPath = join76(dir, `${stageId}.meta.json`);
+  const yamlPath = join77(dir, `${stageId}.yaml`);
+  const metaPath = join77(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -82536,8 +82571,8 @@ function listPendingScheduleEntries(agent, opts = {}) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join76(dir, name);
-    const yamlPath = join76(dir, `${stageId}.yaml`);
+    const metaPath = join77(dir, name);
+    const yamlPath = join77(dir, `${stageId}.yaml`);
     if (!existsSync77(yamlPath))
       continue;
     try {
@@ -82556,7 +82591,7 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join76(paths.scheduleDir, `${slug}.yaml`);
+  const finalPath = join77(paths.scheduleDir, `${slug}.yaml`);
   if (existsSync77(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
@@ -83171,7 +83206,7 @@ var import_yaml20 = __toESM(require_dist(), 1);
 import { existsSync as existsSync79 } from "node:fs";
 init_reconcile_default_skills();
 var import_yaml21 = __toESM(require_dist(), 1);
-import { join as join77 } from "node:path";
+import { join as join78 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -83246,7 +83281,7 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join77(poolDir, skillName);
+  const skillPath = join78(poolDir, skillName);
   if (!existsSync79(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
@@ -83425,7 +83460,7 @@ import {
   writeFileSync as writeFileSync38
 } from "node:fs";
 import { tmpdir as tmpdir5, homedir as homedir45 } from "node:os";
-import { dirname as dirname23, join as join78, relative as relative2, resolve as resolve46 } from "node:path";
+import { dirname as dirname23, join as join79, relative as relative2, resolve as resolve46 } from "node:path";
 import { spawnSync as spawnSync11 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -83619,7 +83654,7 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join78(homedir45(), raw.slice(2));
+    return join79(homedir45(), raw.slice(2));
   }
   if (raw === "~")
     return homedir45();
@@ -83658,7 +83693,7 @@ function loadFromDir(dir) {
   const walk2 = (sub) => {
     const entries = readdirSync30(sub, { withFileTypes: true });
     for (const ent of entries) {
-      const full = join78(sub, ent.name);
+      const full = join79(sub, ent.name);
       const rel = relative2(abs, full);
       if (ent.isSymbolicLink()) {
         fail2(`refusing to read symlink inside --from dir: ${rel}`);
@@ -83693,7 +83728,7 @@ function loadFromTarball(tarPath) {
       fail2(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
-  const staging = mkdtempSync5(join78(tmpdir5(), "skill-apply-extract-"));
+  const staging = mkdtempSync5(join79(tmpdir5(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
     const r = spawnSync11("tar", [
@@ -83779,8 +83814,8 @@ function validatePayload(name, files) {
           errors2.push(`${path8} fails \`bash -n\` syntax check: ${(r.stderr ?? "").trim()}`);
         }
       } else if (PY_SCRIPT_RE2.test(path8)) {
-        const tmp = mkdtempSync5(join78(tmpdir5(), "skill-apply-py-"));
-        const tmpPy = join78(tmp, "check.py");
+        const tmp = mkdtempSync5(join79(tmpdir5(), "skill-apply-py-"));
+        const tmpPy = join79(tmp, "check.py");
         try {
           writeFileSync38(tmpPy, content);
           const r = spawnSync11("python3", ["-m", "py_compile", tmpPy], {
@@ -83803,7 +83838,7 @@ function diffSummary(currentDir, files) {
   if (existsSync80(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync30(sub, { withFileTypes: true })) {
-        const full = join78(sub, ent.name);
+        const full = join79(sub, ent.name);
         const rel = relative2(currentDir, full);
         if (ent.isDirectory()) {
           walk2(full);
@@ -83839,7 +83874,7 @@ function writePayload(poolDir, name, files) {
   if (!existsSync80(poolDir)) {
     mkdirSync45(poolDir, { recursive: true, mode: 493 });
   }
-  const target = join78(poolDir, name);
+  const target = join79(poolDir, name);
   let targetIsSymlink = false;
   try {
     const st = lstatSync8(target);
@@ -83850,11 +83885,11 @@ function writePayload(poolDir, name, files) {
   if (targetIsSymlink) {
     fail2(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
-  const staging = mkdtempSync5(join78(poolDir, `.skill-apply-stage-${name}-`));
+  const staging = mkdtempSync5(join79(poolDir, `.skill-apply-stage-${name}-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join78(staging, path8);
+      const full = join79(staging, path8);
       mkdirSync45(dirname23(full), { recursive: true, mode: 493 });
       const fd = openSync15(full, "wx");
       try {
@@ -83932,7 +83967,7 @@ function registerSkillCommand(program3) {
     }
     const config = loadConfig();
     const poolDir = resolveSkillsPoolDir2(config.switchroom?.skills_dir);
-    const currentDir = join78(poolDir, name);
+    const currentDir = join79(poolDir, name);
     console.log(source_default.bold(`Skill: ${name}`) + source_default.gray(` (${Object.keys(files).length} files, ${sumBytes(files)} bytes)`));
     console.log(source_default.bold("Diff vs current pool content:"));
     console.log(diffSummary(currentDir, files));
@@ -83976,7 +84011,7 @@ import {
   utimesSync,
   writeFileSync as writeFileSync39
 } from "node:fs";
-import { dirname as dirname24, join as join79, relative as relative3, resolve as resolve47 } from "node:path";
+import { dirname as dirname24, join as join80, relative as relative3, resolve as resolve47 } from "node:path";
 import { homedir as homedir46, tmpdir as tmpdir6 } from "node:os";
 import { spawnSync as spawnSync12 } from "node:child_process";
 init_helpers();
@@ -83987,10 +84022,10 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve47(override) : join79(homedir46(), ".switchroom-config");
+  const candidate = override ? resolve47(override) : join80(homedir46(), ".switchroom-config");
   if (!existsSync81(candidate))
     return null;
-  return join79(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
+  return join80(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
@@ -84008,7 +84043,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync17(join79(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync17(join80(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -84017,7 +84052,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   const configSkillsRoot = resolveConfigSkillsDir(agent);
   if (!configSkillsRoot)
     return;
-  const dest = join79(configSkillsRoot, name);
+  const dest = join80(configSkillsRoot, name);
   try {
     if (liveSkillDir !== null) {
       try {
@@ -84032,19 +84067,19 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
       if (existsSync81(dest)) {
-        const trash = join79(configSkillsRoot, `.${name}-trash-${Date.now()}`);
+        const trash = join80(configSkillsRoot, `.${name}-trash-${Date.now()}`);
         renameSync18(dest, trash);
       }
       return;
     }
     mkdirSync46(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
-    const staging = mkdtempSync6(join79(configSkillsRoot, `.${name}-staging-`));
+    const staging = mkdtempSync6(join80(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
       mkdirSync46(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync31(src, { withFileTypes: true })) {
-        const s = join79(src, ent.name);
-        const d = join79(dst, ent.name);
+        const s = join80(src, ent.name);
+        const d = join80(dst, ent.name);
         if (ent.isSymbolicLink())
           continue;
         if (ent.isDirectory())
@@ -84056,7 +84091,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     };
     walk2(liveSkillDir, staging);
     if (existsSync81(dest)) {
-      const prior = join79(configSkillsRoot, `.${name}-prior-${Date.now()}`);
+      const prior = join80(configSkillsRoot, `.${name}-prior-${Date.now()}`);
       renameSync18(dest, prior);
     }
     renameSync18(staging, dest);
@@ -84083,13 +84118,13 @@ function resolveAgent(opts) {
 function resolveAgentsRoot(opts) {
   if (opts.root)
     return resolve47(opts.root);
-  return join79(homedir46(), ".switchroom", "agents");
+  return join80(homedir46(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
-  return join79(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
+  return join80(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
 }
 function trashDir(agentsRoot, agent) {
-  return join79(agentsRoot, agent, ".claude", TRASH_DIRNAME);
+  return join80(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
 function readStdinSync2() {
   const chunks = [];
@@ -84119,7 +84154,7 @@ function loadFromDir2(dir) {
   const files = {};
   const walk2 = (sub) => {
     for (const ent of readdirSync31(sub, { withFileTypes: true })) {
-      const full = join79(sub, ent.name);
+      const full = join80(sub, ent.name);
       if (ent.isSymbolicLink()) {
         fail3(`refusing to read symlink in --from dir: ${relative3(abs, full)}`);
       }
@@ -84172,8 +84207,8 @@ function behavioralValidate(files) {
         errors2.push(`${path8} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
     } else if (PY_SCRIPT_RE.test(path8)) {
-      const tmp = mkdtempSync6(join79(tmpdir6(), "skill-personal-py-"));
-      const tmpPy = join79(tmp, "check.py");
+      const tmp = mkdtempSync6(join80(tmpdir6(), "skill-personal-py-"));
+      const tmpPy = join80(tmp, "check.py");
       try {
         writeFileSync39(tmpPy, content);
         const r = spawnSync12("python3", ["-m", "py_compile", tmpPy], {
@@ -84197,7 +84232,7 @@ function sweepTrash(agentsRoot, agent) {
   for (const ent of readdirSync31(trash, { withFileTypes: true })) {
     if (!ent.isDirectory())
       continue;
-    const entPath = join79(trash, ent.name);
+    const entPath = join80(trash, ent.name);
     try {
       const st = statSync32(entPath);
       if (now - st.mtimeMs > TRASH_TTL_MS) {
@@ -84218,11 +84253,11 @@ function writePersonalSkill(targetDir, files) {
     fail3(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
   mkdirSync46(dirname24(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join79(dirname24(targetDir), `.skill-personal-stage-`));
+  const staging = mkdtempSync6(join80(dirname24(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join79(staging, path8);
+      const full = join80(staging, path8);
       mkdirSync46(dirname24(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
@@ -84355,10 +84390,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join79(homedir46(), ".switchroom", "skills");
+  return join80(homedir46(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join79(homedir46(), ".switchroom", "skills", "_bundled");
+  return join80(homedir46(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -84368,7 +84403,7 @@ function resolveCloneSource(source, opts) {
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
-  const dir = join79(root, slug);
+  const dir = join80(root, slug);
   if (!existsSync81(dir)) {
     fail3(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
@@ -84384,7 +84419,7 @@ function readSourceFiles(dir) {
   const skipped = [];
   const walk2 = (sub) => {
     for (const ent of readdirSync31(sub, { withFileTypes: true })) {
-      const full = join79(sub, ent.name);
+      const full = join80(sub, ent.name);
       if (ent.isSymbolicLink()) {
         continue;
       }
@@ -84495,7 +84530,7 @@ function removePersonalAction(name, opts) {
   const trashRoot = trashDir(agentsRoot, agent);
   mkdirSync46(trashRoot, { recursive: true, mode: 493 });
   const ts = Date.now();
-  const trashTarget = join79(trashRoot, `${name}-${ts}`);
+  const trashTarget = join80(trashRoot, `${name}-${ts}`);
   renameSync18(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
@@ -84514,7 +84549,7 @@ function listPersonalAction(opts) {
   const agent = resolveAgent(opts);
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
-  const skillsDir = join79(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join80(agentsRoot, agent, ".claude", "skills");
   const personal = [];
   if (existsSync81(skillsDir)) {
     for (const ent of readdirSync31(skillsDir, { withFileTypes: true })) {
@@ -84523,7 +84558,7 @@ function listPersonalAction(opts) {
       if (!ent.name.startsWith(PERSONAL_PREFIX))
         continue;
       const skillName = ent.name.slice(PERSONAL_PREFIX.length);
-      const skillPath = join79(skillsDir, ent.name);
+      const skillPath = join80(skillsDir, ent.name);
       let fileCount = 0;
       let totalBytes = 0;
       const walk2 = (sub) => {
@@ -84531,10 +84566,10 @@ function listPersonalAction(opts) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync32(join79(sub, e.name)).size;
+              totalBytes += statSync32(join80(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
-            walk2(join79(sub, e.name));
+            walk2(join80(sub, e.name));
           }
         }
       };
@@ -84575,7 +84610,7 @@ init_helpers();
 var import_yaml23 = __toESM(require_dist(), 1);
 import { existsSync as existsSync82, readdirSync as readdirSync32, readFileSync as readFileSync68, statSync as statSync33 } from "node:fs";
 import { homedir as homedir47 } from "node:os";
-import { join as join80, resolve as resolve48 } from "node:path";
+import { join as join81, resolve as resolve48 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
@@ -84589,7 +84624,7 @@ function defaultBundledRoot2() {
   return resolve48(homedir47(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join80(skillDir, "SKILL.md");
+  const mdPath = join81(skillDir, "SKILL.md");
   if (!existsSync82(mdPath))
     return null;
   let content;
@@ -84622,7 +84657,7 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join80(skillDir, "SKILL.md");
+  const mdPath = join81(skillDir, "SKILL.md");
   try {
     const st = statSync33(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
@@ -84633,7 +84668,7 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join80(agentsRoot, agent, ".claude/skills");
+  const skillsDir = join81(agentsRoot, agent, ".claude/skills");
   if (!existsSync82(skillsDir))
     return [];
   const out = [];
@@ -84646,7 +84681,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join80(skillsDir, ent);
+    const dirPath = join81(skillsDir, ent);
     try {
       if (!statSync33(dirPath).isDirectory())
         continue;
@@ -84686,7 +84721,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join80(sharedRoot, ent);
+    const dirPath = join81(sharedRoot, ent);
     try {
       if (!statSync33(dirPath).isDirectory())
         continue;
@@ -84722,7 +84757,7 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join80(bundledRoot, ent);
+    const dirPath = join81(bundledRoot, ent);
     try {
       if (!statSync33(dirPath).isDirectory())
         continue;
@@ -84868,7 +84903,7 @@ init_source();
 init_helpers();
 import { existsSync as existsSync84, mkdirSync as mkdirSync47, readdirSync as readdirSync33, readFileSync as readFileSync70, writeFileSync as writeFileSync40, statSync as statSync34, copyFileSync as copyFileSync12 } from "node:fs";
 import { homedir as homedir48 } from "node:os";
-import { join as join81 } from "node:path";
+import { join as join82 } from "node:path";
 import { spawnSync as spawnSync14 } from "node:child_process";
 init_audit_reader();
 var DEFAULT_IMAGE_TAG = "latest";
@@ -84937,6 +84972,19 @@ services:
       # operator's home), so the socket paths the agent fleet sees
       # (~/.switchroom/hostd/<agent>/sock) match the paths hostd binds.
       HOME: /host-home
+      # The REAL host home path. HOME above is pinned to /host-home (the
+      # in-container mount point) for the socket-path convention, but that
+      # is NOT a host filesystem path. When hostd shells out \`switchroom
+      # apply\` / \`agent restart\`, the compose generator must emit HOST
+      # paths as bind-mount SOURCES \u2014 homedir() inside here returns
+      # /host-home, which docker would auto-create as empty dirs on the
+      # host (start.sh missing \u2192 every agent exec-fails 127; broker EISDIR
+      # \u2014 the 2026-06-11/12 fleet outages). SWITCHROOM_HOST_HOME is the
+      # generator's authoritative host home (write-compose.ts prefers it
+      # over homedir(); compose.ts bakes it into each agent). Without it,
+      # an in-container apply poisons every bind source with /host-home AND
+      # re-bakes /host-home into the fleet, self-perpetuating.
+      SWITCHROOM_HOST_HOME: ${hostHome}
       # Hostd's CLI shellouts (\`switchroom <verb>\`) need to pick up the
       # same config the agent fleet's compose generator did. Point at
       # the resolved /state/config bind so the agent fleet's config-path
@@ -84959,10 +85007,10 @@ networks:
 `;
 }
 function hostdDir() {
-  return join81(homedir48(), ".switchroom", "hostd");
+  return join82(homedir48(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join81(hostdDir(), "docker-compose.yml");
+  return join82(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
@@ -85072,7 +85120,7 @@ function doStatus() {
       for (const name of readdirSync33(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join81(dir, name, "sock");
+        const sockPath = join82(dir, name, "sock");
         if (existsSync84(sockPath)) {
           const st = statSync34(sockPath);
           if ((st.mode & 61440) === 49152) {
@@ -85165,7 +85213,7 @@ init_source();
 init_helpers();
 import { existsSync as existsSync85, mkdirSync as mkdirSync48, writeFileSync as writeFileSync41, copyFileSync as copyFileSync13 } from "node:fs";
 import { homedir as homedir49 } from "node:os";
-import { join as join82 } from "node:path";
+import { join as join83 } from "node:path";
 import { spawnSync as spawnSync15 } from "node:child_process";
 var DEFAULT_IMAGE_TAG2 = "latest";
 var WEB_COMPOSE_PROJECT = "switchroom-web";
@@ -85246,10 +85294,10 @@ services:
 `;
 }
 function webdDir() {
-  return join82(homedir49(), ".switchroom", "web");
+  return join83(homedir49(), ".switchroom", "web");
 }
 function webdComposePath() {
-  return join82(webdDir(), "docker-compose.yml");
+  return join83(webdDir(), "docker-compose.yml");
 }
 function backupExistingCompose2() {
   const p = webdComposePath();