switchroom 0.15.34 → 0.15.36

package/dist/cli/switchroom.js

@@ -23528,8 +23528,8 @@ var init_resolver = __esm(() => {
 
 // src/agents/compose.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync13 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync13, lstatSync as lstatSync4, readlinkSync as readlinkSync5 } from "node:fs";
+import { join as join10, isAbsolute, dirname as dirname3, resolve as resolve12 } from "node:path";
 function parseMemToMib(s) {
   const m = /^(\d+(?:\.\d+)?)\s*([gmk]?)b?$/i.exec(s.trim());
   if (!m)
@@ -23707,6 +23707,23 @@ function readStrippedCaps(agent) {
     return caps.map(String);
   return [];
 }
+function conditionalMountPresent(probePath, hostHome, probeHome) {
+  if (existsSync15(probePath))
+    return true;
+  try {
+    if (!lstatSync4(probePath).isSymbolicLink())
+      return false;
+    let target = readlinkSync5(probePath);
+    if (!isAbsolute(target))
+      target = resolve12(dirname3(probePath), target);
+    if (hostHome && probeHome && hostHome !== probeHome && target.startsWith(hostHome + "/")) {
+      target = probeHome + target.slice(hostHome.length);
+    }
+    return existsSync15(target);
+  } catch {
+    return false;
+  }
+}
 function generateCompose(opts) {
   const { config } = opts;
   assertNoAgentUidCollision(config);
@@ -24079,16 +24096,16 @@ function emitAgentService(lines, a, imageTag, buildMode, buildContext, homePrefi
   lines.push(`      - ${homePrefix}/.switchroom/logs/${a.name}:/var/log/switchroom`);
   lines.push(`      - ${homePrefix}/.switchroom/agents/${a.name}:${homePrefix}/.switchroom/agents/${a.name}`);
   lines.push(`      - ${homePrefix}/.claude/projects/${a.name}:${homePrefix}/.claude/projects/${a.name}`);
-  if (existsSync15(`${probeHome}/.switchroom/skills`)) {
+  if (conditionalMountPresent(`${probeHome}/.switchroom/skills`, hostHomeForChecks, probeHome)) {
     lines.push(`      - ${homePrefix}/.switchroom/skills:${homePrefix}/.switchroom/skills:ro`);
   }
-  if (existsSync15(`${probeHome}/.switchroom/mcp-launchers`)) {
+  if (conditionalMountPresent(`${probeHome}/.switchroom/mcp-launchers`, hostHomeForChecks, probeHome)) {
     lines.push(`      - ${homePrefix}/.switchroom/mcp-launchers:${homePrefix}/.switchroom/mcp-launchers:ro`);
   }
-  if (existsSync15(`${probeHome}/.switchroom/fleet`)) {
+  if (conditionalMountPresent(`${probeHome}/.switchroom/fleet`, hostHomeForChecks, probeHome)) {
     lines.push(`      - ${homePrefix}/.switchroom/fleet:${homePrefix}/.switchroom/fleet:ro`);
   }
-  if (existsSync15(`${probeHome}/.switchroom/credentials/${a.name}`)) {
+  if (conditionalMountPresent(`${probeHome}/.switchroom/credentials/${a.name}`, hostHomeForChecks, probeHome)) {
     lines.push(`      - ${homePrefix}/.switchroom/credentials/${a.name}:${homePrefix}/.switchroom/credentials:ro`);
   }
   try {
@@ -24098,7 +24115,7 @@ function emitAgentService(lines, a, imageTag, buildMode, buildContext, homePrefi
     mkdirSync11(`${probeHome}/.switchroom/agents/${a.name}/schedule.d`, { recursive: true });
   } catch {}
   lines.push(`      - ${homePrefix}/.switchroom/audit/${a.name}:${homePrefix}/.switchroom/audit/${a.name}:rw`);
-  if (existsSync15(`${probeHome}/.switchroom-config`)) {
+  if (conditionalMountPresent(`${probeHome}/.switchroom-config`, hostHomeForChecks, probeHome)) {
     try {
       mkdirSync11(`${probeHome}/.switchroom-config/agents/${a.name}/personal-skills`, { recursive: true });
     } catch {}
@@ -24113,8 +24130,9 @@ function emitAgentService(lines, a, imageTag, buildMode, buildContext, homePrefi
   if (existsSync15(`${probeHome}/.switchroom/webkite/config.toml`)) {
     lines.push(`      - ${homePrefix}/.switchroom/webkite/config.toml:/state/agent/home/.config/webkite/config.toml:ro`);
   }
-  if (bundledSkillsPoolDir && existsSync15(bundledSkillsPoolDir) && !bundledSkillsPoolDir.startsWith(`${hostHomeForChecks}/.switchroom/skills`)) {
-    lines.push(`      - ${bundledSkillsPoolDir}:${bundledSkillsPoolDir}:ro`);
+  const bundledSkillsBakeDir = probeHome && hostHomeForChecks && probeHome !== hostHomeForChecks && bundledSkillsPoolDir.startsWith(probeHome + "/") ? hostHomeForChecks + bundledSkillsPoolDir.slice(probeHome.length) : bundledSkillsPoolDir;
+  if (bundledSkillsPoolDir && existsSync15(bundledSkillsPoolDir) && !bundledSkillsBakeDir.startsWith(`${hostHomeForChecks}/.switchroom/skills`)) {
+    lines.push(`      - ${bundledSkillsBakeDir}:${bundledSkillsBakeDir}:ro`);
   }
   if (switchroomConfigPath) {
     lines.push(`      - ${switchroomConfigPath}:/state/config/switchroom.yaml:ro`);
@@ -24227,7 +24245,7 @@ var init_tmux = __esm(() => {
 });
 
 // src/agents/docker-fleet.ts
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve13 } from "node:path";
 import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync6 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { execFileSync as execFileSync6 } from "node:child_process";
@@ -24237,11 +24255,11 @@ function resolveSwitchroomHome(explicit) {
   const envHome = process.env.SWITCHROOM_HOME;
   if (envHome && envHome.length > 0)
     return envHome;
-  return resolve12(process.env.HOME ?? "", ".switchroom");
+  return resolve13(process.env.HOME ?? "", ".switchroom");
 }
 function bringUpAgentService(opts) {
   const home2 = resolveSwitchroomHome(opts.switchroomHome);
-  const composeDir = resolve12(home2, "compose");
+  const composeDir = resolve13(home2, "compose");
   mkdirSync12(composeDir, { recursive: true, mode: 493 });
   let switchroomConfigPath = opts.switchroomConfigPath;
   if (!switchroomConfigPath && !opts.generateComposeContent) {
@@ -24256,7 +24274,7 @@ function bringUpAgentService(opts) {
     homeDir: homedir7(),
     switchroomConfigPath
   });
-  const composePath = resolve12(composeDir, "docker-compose.yml");
+  const composePath = resolve13(composeDir, "docker-compose.yml");
   writeFileSync6(composePath, compose, { mode: 384 });
   const dockerBin = opts.dockerBin ?? "docker";
   const stdio = opts.stdio ?? "inherit";
@@ -24375,7 +24393,7 @@ var init_singleton_reconcile = __esm(() => {
 // src/agents/lifecycle.ts
 import { execFileSync as execFileSync8, spawn, spawnSync } from "node:child_process";
 import { existsSync as existsSync17, mkdirSync as mkdirSync13, writeFileSync as writeFileSync7, renameSync as renameSync4, readFileSync as readFileSync15 } from "node:fs";
-import { resolve as resolve13, join as join13 } from "node:path";
+import { resolve as resolve14, join as join13 } from "node:path";
 import { connect } from "node:net";
 function cleanShutdownMarkerPathForAgent(name) {
   const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? resolveStatePath("agents");
@@ -24438,7 +24456,7 @@ function composeFilePath() {
   const override = process.env.SWITCHROOM_COMPOSE_FILE;
   if (override && override.length > 0)
     return override;
-  return resolve13(resolveSwitchroomHome(), "compose", "docker-compose.yml");
+  return resolve14(resolveSwitchroomHome(), "compose", "docker-compose.yml");
 }
 function reconcileSingletonImages(log) {
   return reconcileSingletons({ composeFile: composeFilePath(), log });
@@ -24487,7 +24505,7 @@ function restartAgent(name, reason) {
 function gracefulRestartAgent(name) {
   return new Promise((resolvePromise, reject) => {
     const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? resolveStatePath("agents");
-    const agentDir = resolve13(agentsDir, name);
+    const agentDir = resolve14(agentsDir, name);
     const socketPath = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join13(agentDir, "telegram", "gateway.sock");
     if (!existsSync17(socketPath)) {
       reject(new Error("Gateway socket not found. Is the gateway running?"));
@@ -25131,7 +25149,7 @@ import {
   chmodSync as chmodSync3,
   statSync as statSync13
 } from "node:fs";
-import { join as join17, resolve as resolve15 } from "node:path";
+import { join as join17, resolve as resolve16 } from "node:path";
 function extractCodeChallenge(url) {
   const match = url.match(/[?&]code_challenge=([A-Za-z0-9_-]+)/);
   return match ? match[1] : null;
@@ -25394,7 +25412,7 @@ function getAllAuthStatuses(config) {
   const agentsDir = resolveAgentsDir(config);
   const statuses = {};
   for (const name of Object.keys(config.agents)) {
-    const agentDir = resolve15(agentsDir, name);
+    const agentDir = resolve16(agentsDir, name);
     statuses[name] = getAuthStatus(name, agentDir);
   }
   return statuses;
@@ -26440,7 +26458,7 @@ class AuthBrokerClient {
       return this.socket;
     if (this.connecting)
       return this.connecting;
-    this.connecting = new Promise((resolve22, reject) => {
+    this.connecting = new Promise((resolve23, reject) => {
       const sock = new net2.Socket;
       const onError = (err) => {
         sock.removeAllListeners();
@@ -26464,7 +26482,7 @@ class AuthBrokerClient {
         sock.on("error", (err) => this.onSocketError(err));
         sock.on("close", () => this.onSocketClose());
         this.socket = sock;
-        resolve22(sock);
+        resolve23(sock);
       });
       sock.connect({ path: this.socketPath });
     });
@@ -26524,7 +26542,7 @@ class AuthBrokerClient {
     const sock = await this.ensureConnected();
     const id = req.id;
     const frame = encodeRequest2(req);
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve23, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new AuthBrokerUnreachableError(`request ${req.op} timed out after ${this.timeoutMs}ms`, this.socketPath));
@@ -26532,7 +26550,7 @@ class AuthBrokerClient {
       this.pending.set(id, {
         resolve: (resp) => {
           if (resp.ok) {
-            resolve22(resp.data);
+            resolve23(resp.data);
           } else {
             reject(new AuthBrokerError(resp.error.code, resp.error.message));
           }
@@ -26632,7 +26650,7 @@ import {
   writeFileSync as writeFileSync14
 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
-import { join as join23, resolve as resolve22 } from "node:path";
+import { join as join23, resolve as resolve23 } from "node:path";
 function accountsRootOverride() {
   const v = process.env.SWITCHROOM_ACCOUNTS_DIR;
   if (v && v.length > 0 && v.startsWith("/"))
@@ -26640,7 +26658,7 @@ function accountsRootOverride() {
   return;
 }
 function accountsRoot(home2 = homedir11()) {
-  return accountsRootOverride() ?? resolve22(home2, ".switchroom", "accounts");
+  return accountsRootOverride() ?? resolve23(home2, ".switchroom", "accounts");
 }
 function accountDir(label, home2 = homedir11()) {
   return join23(accountsRoot(home2), label);
@@ -26991,18 +27009,18 @@ async function openBrowser(url, platform = process.platform, spawnImpl = spawn2)
     cmd = "xdg-open";
     args = [url];
   }
-  return new Promise((resolve23) => {
+  return new Promise((resolve24) => {
     try {
       const p = spawnImpl(cmd, args, { stdio: "ignore", detached: true });
-      p.once("error", () => resolve23(false));
+      p.once("error", () => resolve24(false));
       p.once("spawn", () => {
         try {
           p.unref();
         } catch {}
-        resolve23(true);
+        resolve24(true);
       });
     } catch {
-      resolve23(false);
+      resolve24(false);
     }
   });
 }
@@ -27014,18 +27032,18 @@ async function runLoopbackOAuth(cfg, opts = {}) {
   const state = crypto2.randomBytes(16).toString("hex");
   let server = null;
   let timer = null;
-  const closeServer = () => new Promise((resolve23) => {
+  const closeServer = () => new Promise((resolve24) => {
     if (!server)
-      return resolve23();
+      return resolve24();
     const s = server;
     server = null;
-    s.close(() => resolve23());
+    s.close(() => resolve24());
     try {
       s.unref();
     } catch {}
   });
   try {
-    const { code, redirectUri } = await new Promise((resolve23, reject) => {
+    const { code, redirectUri } = await new Promise((resolve24, reject) => {
       server = http.createServer((req, res) => {
         try {
           const url = new URL(req.url ?? "/", `http://${host}`);
@@ -27054,7 +27072,7 @@ async function runLoopbackOAuth(cfg, opts = {}) {
           }
           renderHtml(res, 200, "Authorization complete", "Authorization complete. You can close this tab and return to the terminal.");
           const hostHeader = req.headers.host ?? `${host}:?`;
-          resolve23({
+          resolve24({
             code: gotCode,
             redirectUri: `http://${hostHeader}`
           });
@@ -27465,7 +27483,7 @@ var init_client3 = __esm(() => {
 
 // src/vault/approvals/wait.ts
 function defaultSleep(ms, signal) {
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve24, reject) => {
     if (signal?.aborted) {
       reject(new DOMException("Aborted", "AbortError"));
       return;
@@ -27476,7 +27494,7 @@ function defaultSleep(ms, signal) {
     };
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve23();
+      resolve24();
     }, ms);
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -27629,7 +27647,7 @@ function getVaultPath(configPath) {
   }
 }
 function promptHidden(prompt) {
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve24, reject) => {
     const rl = createInterface2({
       input: process.stdin,
       output: process.stdout
@@ -27649,7 +27667,7 @@ function promptHidden(prompt) {
           rl.close();
           process.stdout.write(`
 `);
-          resolve23(input);
+          resolve24(input);
         } else if (char === "\x03") {
           stdin.setRawMode(false);
           stdin.removeListener("data", onData);
@@ -27668,20 +27686,20 @@ function promptHidden(prompt) {
     } else {
       rl.question(prompt, (answer) => {
         rl.close();
-        resolve23(answer);
+        resolve24(answer);
       });
     }
   });
 }
 function promptLine(prompt) {
-  return new Promise((resolve23) => {
+  return new Promise((resolve24) => {
     const rl = createInterface2({
       input: process.stdin,
       output: process.stdout
     });
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve23(answer);
+      resolve24(answer);
     });
   });
 }
@@ -28238,18 +28256,18 @@ async function openBrowser2(url, platform = process.platform, spawnImpl = spawn3
     cmd = "xdg-open";
     args = [url];
   }
-  return new Promise((resolve23) => {
+  return new Promise((resolve24) => {
     try {
       const p = spawnImpl(cmd, args, { stdio: "ignore", detached: true });
-      p.once("error", () => resolve23(false));
+      p.once("error", () => resolve24(false));
       p.once("spawn", () => {
         try {
           p.unref();
         } catch {}
-        resolve23(true);
+        resolve24(true);
       });
     } catch {
-      resolve23(false);
+      resolve24(false);
     }
   });
 }
@@ -28262,18 +28280,18 @@ async function runLoopbackOAuth2(cfg, opts = {}) {
   const { verifier, challenge } = generatePkcePair();
   let server = null;
   let timer = null;
-  const closeServer = () => new Promise((resolve23) => {
+  const closeServer = () => new Promise((resolve24) => {
     if (!server)
-      return resolve23();
+      return resolve24();
     const s = server;
     server = null;
-    s.close(() => resolve23());
+    s.close(() => resolve24());
     try {
       s.unref();
     } catch {}
   });
   try {
-    const { code, redirectUri } = await new Promise((resolve23, reject) => {
+    const { code, redirectUri } = await new Promise((resolve24, reject) => {
       server = http2.createServer((req, res) => {
         try {
           const url = new URL(req.url ?? "/", `http://${host}`);
@@ -28303,7 +28321,7 @@ async function runLoopbackOAuth2(cfg, opts = {}) {
           }
           renderHtml2(res, 200, "Microsoft authorization complete", "You can close this tab and return to the terminal.");
           const hostHeader = req.headers.host ?? `${host}:?`;
-          resolve23({
+          resolve24({
             code: gotCode,
             redirectUri: `http://${hostHeader}`
           });
@@ -28460,7 +28478,7 @@ __export(exports_via_claude, {
 });
 import { execFileSync as execFileSync14, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync32, mkdirSync as mkdirSync19, readFileSync as readFileSync27 } from "node:fs";
-import { join as join25, resolve as resolve23 } from "node:path";
+import { join as join25, resolve as resolve24 } from "node:path";
 function tmuxHasSession(session) {
   const r = spawnSync2("tmux", ["has-session", "-t", session], {
     stdio: ["ignore", "ignore", "ignore"]
@@ -28504,7 +28522,7 @@ async function runViaClaude(opts) {
   const urlTimeout = opts.urlTimeoutMs ?? VIA_CLAUDE_DEFAULTS.urlTimeoutMs;
   const credsTimeout = opts.credentialsTimeoutMs ?? VIA_CLAUDE_DEFAULTS.credentialsTimeoutMs;
   const poll = opts.pollMs ?? VIA_CLAUDE_DEFAULTS.pollMs;
-  const configDir = resolve23(opts.configDir);
+  const configDir = resolve24(opts.configDir);
   mkdirSync19(configDir, { recursive: true });
   const credentialsPath2 = join25(configDir, ".credentials.json");
   const capture = opts.capturePane ?? (() => tmuxCapturePane(SESSION));
@@ -29281,7 +29299,7 @@ var init_audit_reader = () => {};
 import { connect as connect2 } from "node:net";
 async function hostdRequest(opts, req) {
   const timeoutMs = opts.timeoutMs ?? 5000;
-  return new Promise((resolve27, reject) => {
+  return new Promise((resolve28, reject) => {
     const socket = connect2(opts.socketPath);
     let buf = "";
     let settled = false;
@@ -29327,7 +29345,7 @@ async function hostdRequest(opts, req) {
         settled = true;
         clearTimeout(timer);
         socket.end();
-        resolve27(resp);
+        resolve28(resp);
       } catch (err) {
         if (settled)
           return;
@@ -29404,7 +29422,7 @@ import {
   readFileSync as readFileSync48,
   readdirSync as readdirSync19
 } from "node:fs";
-import { dirname as dirname12, join as join48 } from "node:path";
+import { dirname as dirname13, join as join48 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
 function locateManifestPath() {
   let dir = import.meta.dirname;
@@ -29412,7 +29430,7 @@ function locateManifestPath() {
     const candidate = join48(dir, "dependencies.json");
     if (existsSync52(candidate))
       return candidate;
-    dir = dirname12(dir);
+    dir = dirname13(dir);
   }
   return null;
 }
@@ -30512,7 +30530,7 @@ import {
   existsSync as realExistsSync,
   readFileSync as realReadFileSync
 } from "node:fs";
-import { join as join51, resolve as resolve30 } from "node:path";
+import { join as join51, resolve as resolve31 } from "node:path";
 import { homedir as homedir29 } from "node:os";
 function resolveDeps(config, deps) {
   let agentsDir = deps.agentsDir;
@@ -30627,7 +30645,7 @@ function checkScaffoldWiring(config, driveAgents, d) {
     ];
   }
   for (const name of driveAgents) {
-    const agentDir = resolve30(d.agentsDir, name);
+    const agentDir = resolve31(d.agentsDir, name);
     if (!d.existsSync(agentDir)) {
       results.push({
         name: `drive: ${name} scaffold`,
@@ -30665,7 +30683,7 @@ function checkScaffoldWiring(config, driveAgents, d) {
     let trustOk = false;
     let trustDetail = "no .claude/.claude.json";
     if (trustRead.kind === "ok") {
-      const proj = trustRead.data?.projects?.[resolve30(agentDir)];
+      const proj = trustRead.data?.projects?.[resolve31(agentDir)];
       const enabled = proj?.enabledMcpjsonServers;
       if (Array.isArray(enabled) && enabled.includes("gdrive")) {
         trustOk = true;
@@ -30990,7 +31008,7 @@ var init_doctor_webkite = __esm(() => {
 
 // src/cli/doctor-cron-session.ts
 import { statSync as realStatSync } from "node:fs";
-import { resolve as resolve31 } from "node:path";
+import { resolve as resolve32 } from "node:path";
 function agentRunsCronSession(config, agent) {
   const raw = config.agents[agent];
   if (!raw)
@@ -31006,7 +31024,7 @@ function runCronSessionChecks(config, deps = defaultDeps2) {
     if (!agentRunsCronSession(config, agent))
       continue;
     const name = `cron-session: ${agent}`;
-    const alivePath = resolve31(agentsDir, agent, "telegram", ".bridge-alive-cron");
+    const alivePath = resolve32(agentsDir, agent, "telegram", ".bridge-alive-cron");
     let mtimeMs;
     try {
       mtimeMs = deps.statMtimeMs(alivePath);
@@ -31055,7 +31073,7 @@ var init_doctor_cron_session = __esm(() => {
 });
 
 // src/cli/doctor-scaffold-wiring.ts
-import { join as join53, resolve as resolve32 } from "node:path";
+import { join as join53, resolve as resolve33 } from "node:path";
 function readJson2(d, path4) {
   if (!d.existsSync(path4))
     return { kind: "absent" };
@@ -31089,7 +31107,7 @@ function checkIntegrationScaffoldWiring(args) {
     ];
   }
   for (const name of agents) {
-    const agentDir = resolve32(agentsDir, name);
+    const agentDir = resolve33(agentsDir, name);
     if (!deps.existsSync(agentDir)) {
       results.push({
         name: `${label}: ${name} scaffold`,
@@ -31129,7 +31147,7 @@ function checkIntegrationScaffoldWiring(args) {
     let trustDetail = "no .claude/.claude.json";
     if (trustRead.kind === "ok") {
       const projects = trustRead.data?.projects ?? {};
-      const proj = projects[resolve32(agentDir)];
+      const proj = projects[resolve33(agentDir)];
       const enabled = proj?.enabledMcpjsonServers;
       if (Array.isArray(enabled) && enabled.includes(mcpKey)) {
         trustOk = true;
@@ -32202,13 +32220,13 @@ import {
   accessSync as accessSync2,
   constants as fsConstants5,
   existsSync as existsSync57,
-  lstatSync as lstatSync6,
+  lstatSync as lstatSync7,
   mkdirSync as mkdirSync31,
   readFileSync as readFileSync51,
   readdirSync as readdirSync21,
   statSync as statSync25
 } from "node:fs";
-import { dirname as dirname13, join as join60, resolve as resolve33 } from "node:path";
+import { dirname as dirname14, join as join60, resolve as resolve34 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
   const nvmRoot = join60(process.env.HOME ?? "", ".nvm", "versions", "node");
@@ -32529,7 +32547,7 @@ function checkLegacyState() {
   const legacySock = join60(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
-    sockStat = lstatSync6(legacySock);
+    sockStat = lstatSync7(legacySock);
   } catch {}
   if (sockStat) {
     results.push({
@@ -33121,7 +33139,7 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const path4 = join60(agentDir, "home", ".switchroom");
   let stats;
   try {
-    stats = lstatSync6(path4);
+    stats = lstatSync7(path4);
   } catch (err) {
     if (err.code === "ENOENT") {
       return {
@@ -33222,7 +33240,7 @@ function checkAgents(config, configPath) {
   const statuses = getAllAgentStatuses(config);
   const authStatuses = getAllAuthStatuses(config);
   for (const [name, agentConfig] of Object.entries(config.agents)) {
-    const agentDir = resolve33(agentsDir, name);
+    const agentDir = resolve34(agentsDir, name);
     if (!existsSync57(agentDir)) {
       results.push({
         name: `${name}: scaffold`,
@@ -33405,7 +33423,7 @@ function mffAgentName(config) {
 function mffEnvPath(config) {
   const home2 = process.env.HOME ?? "/root";
   const agent = mffAgentName(config);
-  return agent ? resolve33(home2, ".switchroom/credentials", agent, "my-family-finance/.env") : resolve33(home2, ".switchroom/credentials/my-family-finance/.env");
+  return agent ? resolve34(home2, ".switchroom/credentials", agent, "my-family-finance/.env") : resolve34(home2, ".switchroom/credentials/my-family-finance/.env");
 }
 function mffEnvState(envPath) {
   if (!existsSync57(envPath))
@@ -33622,7 +33640,7 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
       detail: "skipped (MFF_API_URL not set)"
     };
   }
-  const credDir = dirname13(envPath);
+  const credDir = dirname14(envPath);
   const authScript = join60(credDir, "claude-auth.py");
   if (!existsSync57(authScript)) {
     return {
@@ -33821,14 +33839,14 @@ async function checkManifestDrift(probers) {
   return results;
 }
 function runDockerSection(config) {
-  const composePath = resolve33(process.env.HOME ?? "", ".switchroom", "compose", "docker-compose.yml");
+  const composePath = resolve34(process.env.HOME ?? "", ".switchroom", "compose", "docker-compose.yml");
   const active = isDockerMode({ composePath });
   let composeYaml;
   let dockerfileAgent;
   try {
     composeYaml = readFileSync51(composePath, "utf8");
   } catch {}
-  const dockerfilePath = resolve33(process.env.HOME ?? "", ".switchroom", "docker", "Dockerfile.agent");
+  const dockerfilePath = resolve34(process.env.HOME ?? "", ".switchroom", "docker", "Dockerfile.agent");
   try {
     dockerfileAgent = readFileSync51(dockerfilePath, "utf8");
   } catch {}
@@ -42201,7 +42219,7 @@ class Protocol {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1000;
-        await new Promise((resolve50) => setTimeout(resolve50, pollInterval));
+        await new Promise((resolve51) => setTimeout(resolve51, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -42213,7 +42231,7 @@ class Protocol {
   }
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve50, reject) => {
+    return new Promise((resolve51, reject) => {
       const earlyReject = (error2) => {
         reject(error2);
       };
@@ -42291,7 +42309,7 @@ class Protocol {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve50(parseResult.data);
+            resolve51(parseResult.data);
           }
         } catch (error2) {
           reject(error2);
@@ -42482,12 +42500,12 @@ class Protocol {
         interval = task.pollInterval;
       }
     } catch {}
-    return new Promise((resolve50, reject) => {
+    return new Promise((resolve51, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode2.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve50, interval);
+      const timeoutId = setTimeout(resolve51, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode2.InvalidRequest, "Request cancelled"));
@@ -45472,7 +45490,7 @@ var require_compile = __commonJS((exports2) => {
     const schOrFunc = root.refs[ref];
     if (schOrFunc)
       return schOrFunc;
-    let _sch = resolve50.call(this, root, ref);
+    let _sch = resolve51.call(this, root, ref);
     if (_sch === undefined) {
       const schema = (_a = root.localRefs) === null || _a === undefined ? undefined : _a[ref];
       const { schemaId } = this.opts;
@@ -45499,7 +45517,7 @@ var require_compile = __commonJS((exports2) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve50(root, ref) {
+  function resolve51(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string")
       ref = sch;
@@ -46029,7 +46047,7 @@ var require_fast_uri = __commonJS((exports2, module) => {
     }
     return uri;
   }
-  function resolve50(baseURI, relativeURI, options) {
+  function resolve51(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse6(baseURI, schemelessOptions), parse6(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
@@ -46257,7 +46275,7 @@ var require_fast_uri = __commonJS((exports2, module) => {
   var fastUri = {
     SCHEMES,
     normalize,
-    resolve: resolve50,
+    resolve: resolve51,
     resolveComponent,
     equal,
     serialize,
@@ -49640,12 +49658,12 @@ class StdioServerTransport {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve50) => {
+    return new Promise((resolve51) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve50();
+        resolve51();
       } else {
-        this._stdout.once("drain", resolve50);
+        this._stdout.once("drain", resolve51);
       }
     });
   }
@@ -50574,12 +50592,12 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.15.34";
-var COMMIT_SHA = "508eb512";
+var VERSION = "0.15.36";
+var COMMIT_SHA = "18736aec";
 
 // src/cli/agent.ts
 init_source();
-import { join as join20, resolve as resolve21 } from "node:path";
+import { join as join20, resolve as resolve22 } from "node:path";
 import { rmSync as rmSync9, existsSync as existsSync28, readFileSync as readFileSync23, writeFileSync as writeFileSync13 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 
@@ -54523,7 +54541,7 @@ init_compose();
 import { chownSync as chownSync2 } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
-import { basename as basename4, dirname as dirname3, join as join12 } from "node:path";
+import { basename as basename4, dirname as dirname4, join as join12 } from "node:path";
 
 // src/config/release-resolve.ts
 function resolveImageTag(release) {
@@ -54544,11 +54562,28 @@ function resolveRelease(opts) {
     return opts.root;
   return;
 }
+function parseSemverTag(tag) {
+  if (!tag)
+    return null;
+  const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(tag.trim());
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function compareReleaseTags(a, b) {
+  const pa = parseSemverTag(a);
+  const pb = parseSemverTag(b);
+  if (!pa || !pb)
+    return null;
+  for (let i = 0;i < 3; i++) {
+    if (pa[i] !== pb[i])
+      return pa[i] < pb[i] ? -1 : 1;
+  }
+  return 0;
+}
 // src/cli/operator-uid.ts
 import {
   chownSync,
   existsSync as existsSync16,
-  lstatSync as lstatSync4,
+  lstatSync as lstatSync5,
   readdirSync as readdirSync7,
   realpathSync as realpathSync3,
   statSync as statSync8
@@ -54584,7 +54619,7 @@ function restoreOperatorOwnership(home2, operatorUid, deps = {}) {
   const exists = deps.exists ?? ((p) => existsSync16(p));
   const isSymlink = deps.isSymlink ?? ((p) => {
     try {
-      return lstatSync4(p).isSymbolicLink();
+      return lstatSync5(p).isSymbolicLink();
     } catch {
       return false;
     }
@@ -54676,7 +54711,7 @@ async function writeComposeFile(opts) {
     previous = null;
   }
   const previousImageTag = previous ? AGENT_IMAGE_TAG_RE.exec(previous)?.[1] ?? null : null;
-  await mkdir(dirname3(opts.composePath), { recursive: true });
+  await mkdir(dirname4(opts.composePath), { recursive: true });
   await writeFile(opts.composePath, content, { encoding: "utf8", mode: 384 });
   if (operatorUid !== undefined && process.geteuid?.() === 0) {
     try {
@@ -54698,7 +54733,7 @@ init_merge();
 
 // src/agents/in-flight.ts
 import { readdirSync as readdirSync8, statSync as statSync9 } from "node:fs";
-import { resolve as resolve14 } from "node:path";
+import { resolve as resolve15 } from "node:path";
 var DEFAULT_RECENCY_MS = 30000;
 function safeReaddir(path) {
   try {
@@ -54725,7 +54760,7 @@ function collectJsonl(root, maxDepth = 4) {
   while (stack.length > 0) {
     const { dir, depth } = stack.pop();
     for (const entry of safeReaddir(dir)) {
-      const full = resolve14(dir, entry);
+      const full = resolve15(dir, entry);
       let isDir = false;
       try {
         isDir = statSync9(full).isDirectory();
@@ -54753,16 +54788,16 @@ function detectInFlight(opts) {
     lastActivityMs: 0,
     details: []
   };
-  const tasksRoot = resolve14(opts.agentDir, ".claude", "tasks");
+  const tasksRoot = resolve15(opts.agentDir, ".claude", "tasks");
   for (const sessionId of safeReaddir(tasksRoot)) {
-    const sessionDir = resolve14(tasksRoot, sessionId);
+    const sessionDir = resolve15(tasksRoot, sessionId);
     let sessionHasRecent = false;
     let newestSubject = null;
     let newestMtime = 0;
     for (const entry of safeReaddir(sessionDir)) {
       if (!entry.endsWith(".json"))
         continue;
-      const mtime = safeMtimeMs(resolve14(sessionDir, entry));
+      const mtime = safeMtimeMs(resolve15(sessionDir, entry));
       if (mtime > result.lastActivityMs)
         result.lastActivityMs = mtime;
       if (isRecent(mtime, cutoff)) {
@@ -54778,9 +54813,9 @@ function detectInFlight(opts) {
       result.details.push(`session ${sessionId.slice(0, 8)} task ${newestSubject ?? "?"}`);
     }
   }
-  const projectsRoot = resolve14(opts.agentDir, ".claude", "projects");
+  const projectsRoot = resolve15(opts.agentDir, ".claude", "projects");
   for (const slug of safeReaddir(projectsRoot)) {
-    const slugDir = resolve14(projectsRoot, slug);
+    const slugDir = resolve15(projectsRoot, slug);
     for (const jsonl of collectJsonl(slugDir, 4)) {
       const mtime = safeMtimeMs(jsonl);
       if (mtime > result.lastActivityMs)
@@ -54831,11 +54866,11 @@ async function ask(question, defaultValue) {
     throw new Error(`Non-interactive mode: no default for "${question}"`);
   }
   const rl = createReadlineInterface();
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const suffix = defaultValue ? ` [${defaultValue}]` : "";
     rl.question(`${question}${suffix}: `, (answer) => {
       rl.close();
-      resolve15(answer.trim() || defaultValue || "");
+      resolve16(answer.trim() || defaultValue || "");
     });
   });
 }
@@ -54845,14 +54880,14 @@ async function askYesNo(question, defaultYes = true) {
   }
   const hint = defaultYes ? "[Y/n]" : "[y/N]";
   const rl = createReadlineInterface();
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     rl.question(`${question} ${hint} `, (answer) => {
       rl.close();
       const normalized = answer.trim().toLowerCase();
       if (normalized === "") {
-        resolve15(defaultYes);
+        resolve16(defaultYes);
       } else {
-        resolve15(normalized === "y" || normalized === "yes");
+        resolve16(normalized === "y" || normalized === "yes");
       }
     });
   });
@@ -54867,14 +54902,14 @@ ${question}`);
     console.log(`  ${i + 1}) ${choices[i]}`);
   }
   const rl = createReadlineInterface();
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     rl.question(`Enter choice [1-${choices.length}]: `, (answer) => {
       rl.close();
       const idx = parseInt(answer.trim(), 10) - 1;
       if (idx >= 0 && idx < choices.length) {
-        resolve15(choices[idx]);
+        resolve16(choices[idx]);
       } else {
-        resolve15(choices[0]);
+        resolve16(choices[0]);
       }
     });
   });
@@ -54885,11 +54920,11 @@ async function waitForAction(message) {
     return;
   }
   const rl = createReadlineInterface();
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     rl.question(`${message}
   Press Enter when ready...`, () => {
       rl.close();
-      resolve15();
+      resolve16();
     });
   });
 }
@@ -55772,7 +55807,7 @@ function readCacheTelemetry(agentDir) {
 
 // src/agents/create-orchestrator.ts
 init_loader();
-import { resolve as resolve16 } from "node:path";
+import { resolve as resolve17 } from "node:path";
 import { existsSync as existsSync23, rmSync as rmSync6 } from "node:fs";
 init_lifecycle();
 init_manager();
@@ -55849,7 +55884,7 @@ async function pollForDmStart(token, timeoutMs = 120000) {
   throw new Error("Timed out waiting for /start DM");
 }
 function sleep(ms) {
-  return new Promise((resolve16) => setTimeout(resolve16, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 
 // src/agents/create-orchestrator.ts
@@ -55876,8 +55911,8 @@ async function createAgent(opts) {
   const configPath = configPathOpt ?? (() => {
     const cwd = process.cwd();
     const candidates = [
-      resolve16(cwd, "switchroom.yaml"),
-      resolve16(cwd, "switchroom.yml")
+      resolve17(cwd, "switchroom.yaml"),
+      resolve17(cwd, "switchroom.yml")
     ];
     for (const c of candidates) {
       if (existsSync23(c))
@@ -55920,7 +55955,7 @@ async function createAgent(opts) {
     throw new Error(`Internal: wrote agent "${name}" to yaml but reload didn't pick it up.`);
   }
   const agentsDir = resolveAgentsDir(config);
-  const agentDir = resolve16(agentsDir, name);
+  const agentDir = resolve17(agentsDir, name);
   await withRollback(() => {
     scaffoldAgent(name, agentConfig, agentsDir, config.telegram, config, undefined, configPath);
     rollbackStack.push(() => rmSync6(agentDir, { recursive: true, force: true }));
@@ -55941,7 +55976,7 @@ async function completeCreation(name, code, opts = {}) {
   }
   const configPath = opts.configPath ?? (() => {
     const cwd = process.cwd();
-    const candidates = [resolve16(cwd, "switchroom.yaml"), resolve16(cwd, "switchroom.yml")];
+    const candidates = [resolve17(cwd, "switchroom.yaml"), resolve17(cwd, "switchroom.yml")];
     for (const c of candidates)
       if (existsSync23(c))
         return c;
@@ -55949,7 +55984,7 @@ async function completeCreation(name, code, opts = {}) {
   })();
   const config = loadConfig(configPath);
   const agentsDir = resolveAgentsDir(config);
-  const agentDir = resolve16(agentsDir, name);
+  const agentDir = resolve17(agentsDir, name);
   if (!existsSync23(agentDir)) {
     throw new Error(`Agent dir not found: ${agentDir}. Run createAgent first.`);
   }
@@ -55989,7 +56024,7 @@ async function completeCreation(name, code, opts = {}) {
 }
 
 // src/agents/add-orchestrator.ts
-import { resolve as resolve18, join as join18 } from "node:path";
+import { resolve as resolve19, join as join18 } from "node:path";
 import { existsSync as existsSync25, rmSync as rmSync7, statSync as statSync15 } from "node:fs";
 import { execFileSync as execFileSync12 } from "node:child_process";
 
@@ -56082,7 +56117,7 @@ function enforceUsername(username, agentSlug, expectedUsername, loose, warn) {
 
 // src/setup/profile-picker.ts
 import { existsSync as existsSync24, readdirSync as readdirSync12, statSync as statSync14 } from "node:fs";
-import { resolve as resolve17 } from "node:path";
+import { resolve as resolve18 } from "node:path";
 var PROFILE_GLOSSES = {
   default: "minimal baseline \u2014 generic chat helper, no opinion.",
   coding: "developer copilot \u2014 architecture + code-review skills.",
@@ -56090,16 +56125,16 @@ var PROFILE_GLOSSES = {
   "health-coach": "wellness coach \u2014 daily check-ins, weekly reviews."
 };
 var DEFAULT_MAX_ATTEMPTS2 = 3;
-var PROFILES_ROOT2 = resolve17(import.meta.dirname, "../../profiles");
+var PROFILES_ROOT2 = resolve18(import.meta.dirname, "../../profiles");
 function defaultListProfileSkills(profileName) {
-  const skillsDir = resolve17(PROFILES_ROOT2, profileName, "skills");
+  const skillsDir = resolve18(PROFILES_ROOT2, profileName, "skills");
   if (!existsSync24(skillsDir)) {
     return [];
   }
   try {
     return readdirSync12(skillsDir).filter((entry) => {
       try {
-        return statSync14(resolve17(skillsDir, entry)).isDirectory();
+        return statSync14(resolve18(skillsDir, entry)).isDirectory();
       } catch {
         return false;
       }
@@ -56378,7 +56413,7 @@ async function addAgent(opts) {
 }
 function runFinalPreflight(inputs) {
   const { name, agentDir, expectedUserId, isUnitActive, configPath } = inputs;
-  const unitPath = resolve18(process.env.HOME ?? "/root", ".config/systemd/user", `switchroom-${name}.service`);
+  const unitPath = resolve19(process.env.HOME ?? "/root", ".config/systemd/user", `switchroom-${name}.service`);
   let autoaccept = { ok: false, detail: `unit not found at ${unitPath}` };
   if (existsSync25(unitPath)) {
     const fs2 = __require("node:fs");
@@ -56397,7 +56432,7 @@ function runFinalPreflight(inputs) {
       detail: `systemd unit missing at ${unitPath}. ` + `Fix: switchroom agent reconcile ${name}`
     };
   }
-  const envPath = resolve18(agentDir, "telegram", ".env");
+  const envPath = resolve19(agentDir, "telegram", ".env");
   let token = { ok: false, detail: `telegram/.env missing at ${envPath}` };
   if (existsSync25(envPath)) {
     const fs2 = __require("node:fs");
@@ -56425,7 +56460,7 @@ function runFinalPreflight(inputs) {
       detail: `systemctl probe failed: ${err.message}`
     };
   }
-  const accessPath = resolve18(agentDir, "telegram", "access.json");
+  const accessPath = resolve19(agentDir, "telegram", "access.json");
   let access;
   if (!existsSync25(accessPath)) {
     access = {
@@ -56452,7 +56487,7 @@ function runFinalPreflight(inputs) {
       };
     }
   }
-  const settingsPath = resolve18(agentDir, ".claude", "settings.json");
+  const settingsPath = resolve19(agentDir, ".claude", "settings.json");
   let mcp;
   if (!existsSync25(settingsPath)) {
     mcp = {
@@ -56533,7 +56568,7 @@ function runFinalPreflight(inputs) {
   };
 }
 function pruneBundledSkills(agentDir, keep, scope) {
-  const skillsDir = resolve18(agentDir, ".claude", "skills");
+  const skillsDir = resolve19(agentDir, ".claude", "skills");
   if (!existsSync25(skillsDir)) {
     return [];
   }
@@ -56581,7 +56616,7 @@ import { execFileSync as dockerExecFile } from "node:child_process";
 init_loader();
 init_vault();
 init_lifecycle();
-import { resolve as resolve19 } from "node:path";
+import { resolve as resolve20 } from "node:path";
 import {
   existsSync as existsSync26,
   mkdtempSync as mkdtempSync3,
@@ -56609,7 +56644,7 @@ function defaultDeps() {
     saveVault,
     resolveVaultPath: (config) => resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc"),
     snapshotDir: (src) => {
-      const tmp = mkdtempSync3(resolve19(tmpdir2(), "switchroom-rename-snap-"));
+      const tmp = mkdtempSync3(resolve20(tmpdir2(), "switchroom-rename-snap-"));
       cpSync(src, tmp, { recursive: true });
       return tmp;
     },
@@ -56681,8 +56716,8 @@ async function renameAgent(opts, injectedDeps) {
   if (config.agents[newName]) {
     throw new Error(`Agent "${newName}" is already defined in switchroom.yaml. ` + `Choose a different name or remove the existing entry first.`);
   }
-  const oldAgentDir = resolve19(agentsDir, oldName);
-  const newAgentDir = resolve19(agentsDir, newName);
+  const oldAgentDir = resolve20(agentsDir, oldName);
+  const newAgentDir = resolve20(agentsDir, newName);
   if (!_existsSync(oldAgentDir)) {
     throw new Error(`Agent directory not found: ${oldAgentDir}. ` + `The agent may not have been scaffolded yet.`);
   }
@@ -56819,7 +56854,7 @@ async function renameAgent(opts, injectedDeps) {
 init_source();
 init_helpers();
 init_loader();
-import { resolve as resolve20 } from "node:path";
+import { resolve as resolve21 } from "node:path";
 function registerAgentPerfCommand(agent) {
   agent.command("perf <name>").description("Show cache-hit telemetry for an agent (cache_read / cache_creation per-turn from the latest session JSONL)").option("--last <n>", "Number of recent assistant turns to analyze", "20").option("--full", "Analyze every turn in the JSONL (overrides --last)").option("--json", "Output as JSON").action(withConfigError(async (name, opts) => {
     const config = getConfig(program2(agent));
@@ -56829,8 +56864,8 @@ function registerAgentPerfCommand(agent) {
       console.error(source_default.red(`Agent "${name}" is not defined in switchroom.yaml`));
       process.exit(1);
     }
-    const agentDir = resolve20(agentsDir, name);
-    const claudeConfigDir = resolve20(agentDir, ".claude");
+    const agentDir = resolve21(agentsDir, name);
+    const claudeConfigDir = resolve21(agentDir, ".claude");
     const jsonl = findLatestSessionJsonl(claudeConfigDir);
     if (!jsonl) {
       if (opts.json) {
@@ -57031,11 +57066,11 @@ function checkQuarantineRefusal(agentsDir, name) {
 }
 function preflightCheck(name, agentDir, _usesDevChannels) {
   const errors2 = [];
-  const startSh = resolve21(agentDir, "start.sh");
+  const startSh = resolve22(agentDir, "start.sh");
   if (!existsSync28(startSh)) {
     errors2.push(`start.sh not found at ${startSh}`);
   }
-  const envPath = resolve21(agentDir, "telegram", ".env");
+  const envPath = resolve22(agentDir, "telegram", ".env");
   if (existsSync28(envPath)) {
     const envContent = readFileSync23(envPath, "utf-8");
     if (!envContent.includes("TELEGRAM_BOT_TOKEN=") || envContent.includes("# Set your bot token")) {
@@ -57044,13 +57079,13 @@ function preflightCheck(name, agentDir, _usesDevChannels) {
   } else {
     errors2.push(`telegram/.env not found at ${envPath}`);
   }
-  if (!existsSync28(resolve21(agentDir, ".claude", "settings.json"))) {
+  if (!existsSync28(resolve22(agentDir, ".claude", "settings.json"))) {
     errors2.push(`.claude/settings.json not found. Run: switchroom agent reconcile ${name}`);
   }
   return errors2;
 }
 function buildStatusInputs(name, config, agentsDir) {
-  const agentDir = resolve21(agentsDir, name);
+  const agentDir = resolve22(agentsDir, name);
   const agentConfig = config.agents[name];
   let hindsightApiUrl = null;
   let hindsightBankId = name;
@@ -57199,7 +57234,7 @@ async function reconcileAndRestartAgent(name, config, agentsDir, configPath, opt
     }
   }
   if (!opts.force) {
-    const envPath = resolve21(agentsDir, name, "telegram", ".env");
+    const envPath = resolve22(agentsDir, name, "telegram", ".env");
     if (existsSync28(envPath)) {
       const envContent = readFileSync23(envPath, "utf-8");
       const match = envContent.match(/^TELEGRAM_BOT_TOKEN=(.+)$/m);
@@ -57318,7 +57353,7 @@ function registerAgentCommand(program3) {
       console.error(source_default.red(`Agent "${name}" is not defined in switchroom.yaml`));
       process.exit(1);
     }
-    const agentDir = resolve21(agentsDir, name);
+    const agentDir = resolve22(agentsDir, name);
     let hindsightApiUrl = null;
     let hindsightBankId = name;
     if (isHindsightEnabled(config)) {
@@ -57389,7 +57424,7 @@ function registerAgentCommand(program3) {
 Scaffolding agent: ${name}
 `));
     scaffoldAgent(name, agentConfig, agentsDir, config.telegram, config, undefined, getConfigPath(program3));
-    const agentDir = resolve21(agentsDir, name);
+    const agentDir = resolve22(agentsDir, name);
     console.log(source_default.green(`  Agent "${name}" scaffolded at ${agentDir}`));
     console.log(source_default.gray(`
   Next: switchroom apply  (regenerates docker-compose.yml + brings up new agent)
@@ -57408,7 +57443,7 @@ Scaffolding agent: ${name}
         continue;
       }
       if (!opts.force) {
-        const agentDir = resolve21(agentsDir, n);
+        const agentDir = resolve22(agentsDir, n);
         const usesDevChannels = config.agents[n].channels?.telegram?.plugin !== "official";
         const errors2 = preflightCheck(n, agentDir, usesDevChannels);
         if (errors2.length > 0) {
@@ -57510,7 +57545,7 @@ Scaffolding agent: ${name}
         sawAbort = true;
         continue;
       }
-      const agentDir = resolve21(agentsDir, n);
+      const agentDir = resolve22(agentsDir, n);
       if (!opts.force) {
         const usesDevChannels = config.agents[n].channels?.telegram?.plugin !== "official";
         const errors2 = preflightCheck(n, agentDir, usesDevChannels);
@@ -57696,7 +57731,7 @@ Scaffolding agent: ${name}
           useSwitchroomPlugin: usesSwitchroomTelegramPlugin(agentConfig),
           configPath
         });
-        const settingsPath = resolve21(agentsDir, n, ".claude", "settings.json");
+        const settingsPath = resolve22(agentsDir, n, ".claude", "settings.json");
         let actual = {};
         if (existsSync28(settingsPath)) {
           try {
@@ -57941,7 +57976,7 @@ Reconciled ${agentsTouched} agent(s), ${totalChanges} file(s) changed.`));
   agent.command("permissions <name>").description("Show the current permissions.allow list for an agent").action(withConfigError(async (name) => {
     const config = getConfig(program3);
     const agentsDir = resolveAgentsDir(config);
-    const settingsPath = resolve21(agentsDir, name, ".claude", "settings.json");
+    const settingsPath = resolve22(agentsDir, name, ".claude", "settings.json");
     if (!existsSync28(settingsPath)) {
       console.error(source_default.red(`Agent "${name}" not found at ${settingsPath}`));
       process.exit(1);
@@ -57971,12 +58006,12 @@ Permissions for ${name}
   agent.command("destroy <name>").description("Remove an agent's directory (run `switchroom apply` after to remove the container)").option("-y, --yes", "Skip confirmation prompt").action(withConfigError(async (name, opts) => {
     const config = getConfig(program3);
     const agentsDir = resolveAgentsDir(config);
-    const agentDir = resolve21(agentsDir, name);
+    const agentDir = resolve22(agentsDir, name);
     if (!opts.yes) {
       process.stdout.write(source_default.yellow(`Destroy agent "${name}"? This removes ${agentDir}. (Run \`switchroom apply\` after to take the container down.) [y/N] `));
-      const response = await new Promise((resolve22) => {
+      const response = await new Promise((resolve23) => {
         process.stdin.setEncoding("utf-8");
-        process.stdin.once("data", (data) => resolve22(data.toString().trim()));
+        process.stdin.once("data", (data) => resolve23(data.toString().trim()));
       });
       if (response.toLowerCase() !== "y") {
         console.log("Aborted.");
@@ -58051,7 +58086,7 @@ Bootstrapping agent: ${name}
 `));
     }
     process.stdout.write(source_default.bold("  Paste the browser code here: "));
-    const code = await new Promise((resolve22) => {
+    const code = await new Promise((resolve23) => {
       process.stdin.setEncoding("utf-8");
       let buf = "";
       process.stdin.on("data", (chunk) => {
@@ -58060,7 +58095,7 @@ Bootstrapping agent: ${name}
 `);
         if (newlineIdx !== -1) {
           process.stdin.removeAllListeners("data");
-          resolve22(buf.slice(0, newlineIdx).trim());
+          resolve23(buf.slice(0, newlineIdx).trim());
         }
       });
     });
@@ -58188,7 +58223,7 @@ switchroom agent add: ${name}
           composePath = upRes.composePath;
           console.log(source_default.gray(`  Wrote compose: ${composePath}`));
         } catch (err) {
-          composePath = resolve21(process.env.SWITCHROOM_HOME ?? resolve21(process.env.HOME ?? "", ".switchroom"), "compose", "docker-compose.yml");
+          composePath = resolve22(process.env.SWITCHROOM_HOME ?? resolve22(process.env.HOME ?? "", ".switchroom"), "compose", "docker-compose.yml");
           console.error(source_default.red(`  docker compose up failed: ${err.message}`));
           try {
             dockerExecFile("docker", [
@@ -58204,7 +58239,7 @@ switchroom agent add: ${name}
             stopAgent(name);
           } catch {}
           const agentsDirRollback = resolveAgentsDir(cfg);
-          const agentDirRollback = resolve21(agentsDirRollback, name);
+          const agentDirRollback = resolve22(agentsDirRollback, name);
           if (existsSync28(agentDirRollback)) {
             rmSync9(agentDirRollback, { recursive: true, force: true });
             console.log(source_default.gray(`  Rolled back: removed ${agentDirRollback}`));
@@ -58256,9 +58291,9 @@ Rename agent "${oldName}" \u2192 "${newName}"?
 ` + `  reconcile, and start ${newName}.
 ` + `  Hindsight mode: ${hindsightMode}
 ` + `[y/N] `));
-      const answer = await new Promise((resolve22) => {
+      const answer = await new Promise((resolve23) => {
         process.stdin.setEncoding("utf-8");
-        process.stdin.once("data", (d) => resolve22(d.toString().trim()));
+        process.stdin.once("data", (d) => resolve23(d.toString().trim()));
       });
       if (answer.toLowerCase() !== "y") {
         console.log("Aborted.");
@@ -58787,7 +58822,7 @@ init_loader();
 init_manager();
 init_helpers();
 import { existsSync as existsSync33, readFileSync as readFileSync28 } from "node:fs";
-import { join as join26, resolve as resolve24 } from "node:path";
+import { join as join26, resolve as resolve25 } from "node:path";
 
 // src/cli/auth-google.ts
 init_source();
@@ -59356,8 +59391,8 @@ async function readVisibleLine(prompt) {
     output: process.stdout
   });
   try {
-    return await new Promise((resolve23) => {
-      rl.question(prompt, (answer) => resolve23(answer));
+    return await new Promise((resolve24) => {
+      rl.question(prompt, (answer) => resolve24(answer));
     });
   } finally {
     rl.close();
@@ -59365,7 +59400,7 @@ async function readVisibleLine(prompt) {
 }
 async function readHiddenLine(prompt) {
   const { createInterface: createInterface3 } = await import("node:readline");
-  return await new Promise((resolve23, reject) => {
+  return await new Promise((resolve24, reject) => {
     const rl = createInterface3({
       input: process.stdin,
       output: process.stdout
@@ -59385,7 +59420,7 @@ async function readHiddenLine(prompt) {
           rl.close();
           process.stdout.write(`
 `);
-          resolve23(input);
+          resolve24(input);
         } else if (char === "\x03") {
           stdin.setRawMode(false);
           stdin.removeListener("data", onData);
@@ -59404,7 +59439,7 @@ async function readHiddenLine(prompt) {
     } else {
       rl.question(prompt, (answer) => {
         rl.close();
-        resolve23(answer);
+        resolve24(answer);
       });
     }
   });
@@ -60024,14 +60059,14 @@ async function readHiddenLine2(prompt) {
       input: process.stdin,
       output: process.stdout
     });
-    return new Promise((resolve23) => {
+    return new Promise((resolve24) => {
       rl.question(prompt, (answer) => {
         rl.close();
-        resolve23(answer);
+        resolve24(answer);
       });
     });
   }
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve24, reject) => {
     const rl = readline.createInterface({
       input: process.stdin,
       output: process.stdout
@@ -60053,7 +60088,7 @@ async function readHiddenLine2(prompt) {
           rl.close();
           stdout.write(`
 `);
-          resolve23(line);
+          resolve24(line);
           return;
         }
         if (ch === "" || ch === "\b") {
@@ -60497,7 +60532,7 @@ function printAgentDetail(state, agent) {
 function loadCredentialsFromAgent(agentName) {
   const config = getConfigSafe();
   const agentsDir = resolveAgentsDir(config);
-  const agentDir = resolve24(agentsDir, agentName);
+  const agentDir = resolve25(agentsDir, agentName);
   const credsPath = join26(agentDir, ".claude", ".credentials.json");
   if (!existsSync33(credsPath)) {
     console.error(source_default.red(`  Agent "${agentName}" has no .claude/.credentials.json \u2014 log it in first.`));
@@ -60570,8 +60605,8 @@ async function loadCredentialsViaClaude(label) {
         output: process.stdout
       });
       try {
-        return await new Promise((resolve25) => {
-          rl.question("  Paste the code Claude shows you: ", (answer) => resolve25(answer));
+        return await new Promise((resolve26) => {
+          rl.question("  Paste the code Claude shows you: ", (answer) => resolve26(answer));
         });
       } finally {
         rl.close();
@@ -61229,7 +61264,7 @@ init_compose();
 init_vault();
 import * as net3 from "node:net";
 import { mkdirSync as mkdirSync23, chmodSync as chmodSync7, chownSync as chownSync4, existsSync as existsSync37, readFileSync as readFileSync32, readdirSync as readdirSync17, statSync as statSync20, unlinkSync as unlinkSync8, writeFileSync as writeFileSync19, renameSync as renameSync10 } from "node:fs";
-import { dirname as dirname7, resolve as resolve26, basename as basename6 } from "node:path";
+import { dirname as dirname8, resolve as resolve27, basename as basename6 } from "node:path";
 import * as os4 from "node:os";
 import * as path3 from "node:path";
 
@@ -61240,7 +61275,7 @@ import {
   chmodSync as chmodSync4,
   existsSync as existsSync35,
   fsyncSync as fsyncSync4,
-  lstatSync as lstatSync5,
+  lstatSync as lstatSync6,
   mkdirSync as mkdirSync20,
   openSync as openSync6,
   closeSync as closeSync6,
@@ -61251,7 +61286,7 @@ import {
   unlinkSync as unlinkSync7
 } from "node:fs";
 import { createHash as createHash5 } from "node:crypto";
-import { basename as basename5, dirname as dirname4, join as join28 } from "node:path";
+import { basename as basename5, dirname as dirname5, join as join28 } from "node:path";
 function vaultLayoutPaths(home2) {
   const switchroomRoot = join28(home2, ".switchroom");
   return {
@@ -61394,7 +61429,7 @@ your fleet works after \`switchroom apply\`, then delete it.
 }
 function lstatSyncOrNull(path) {
   try {
-    return lstatSync5(path);
+    return lstatSync6(path);
   } catch {
     return null;
   }
@@ -61404,7 +61439,7 @@ function sha256File(path) {
   return createHash5("sha256").update(data).digest("hex");
 }
 function atomicReplaceWithSymlink(target, linkTarget) {
-  const tmp = join28(dirname4(target), `.${basename5(target)}.symlink-tmp`);
+  const tmp = join28(dirname5(target), `.${basename5(target)}.symlink-tmp`);
   if (existsSync35(tmp)) {
     try {
       unlinkSync7(tmp);
@@ -61436,7 +61471,7 @@ init_loader();
 // src/vault/auto-unlock.ts
 import { createHmac, randomBytes as randomBytes6, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "node:crypto";
 import { chmodSync as chmodSync5, existsSync as existsSync36, mkdirSync as mkdirSync21, readFileSync as readFileSync31, writeFileSync as writeFileSync18 } from "node:fs";
-import { dirname as dirname5 } from "node:path";
+import { dirname as dirname6 } from "node:path";
 var FORMAT_VERSION = 1;
 var SALT_LEN = 16;
 var NONCE_LEN = 12;
@@ -61525,7 +61560,7 @@ function decryptAutoUnlock(blob, machineId) {
 }
 function writeAutoUnlockFile(passphrase, filePath) {
   const blob = encryptAutoUnlock(passphrase);
-  mkdirSync21(dirname5(filePath), { recursive: true, mode: 448 });
+  mkdirSync21(dirname6(filePath), { recursive: true, mode: 448 });
   writeFileSync18(filePath, blob, { mode: 384 });
   chmodSync5(filePath, 384);
 }
@@ -61557,7 +61592,7 @@ import * as path from "node:path";
 // src/vault/broker/test-isolation-guard.ts
 import { mkdtempSync as mkdtempSync4 } from "node:fs";
 import { homedir as homedir14, tmpdir as tmpdir3 } from "node:os";
-import { join as join29, resolve as resolve25, sep } from "node:path";
+import { join as join29, resolve as resolve26, sep } from "node:path";
 function isTestRuntime() {
   return process.env.VITEST !== undefined;
 }
@@ -61565,11 +61600,11 @@ function escapeHatchSet() {
   return process.env.SWITCHROOM_ALLOW_PROD_VAULT_IN_TEST === "1";
 }
 function realSwitchroomHome() {
-  return resolve25(homedir14(), ".switchroom");
+  return resolve26(homedir14(), ".switchroom");
 }
 function isUnderRealSwitchroomHome(p) {
   const home2 = realSwitchroomHome();
-  const r = resolve25(p);
+  const r = resolve26(p);
   return r === home2 || r.startsWith(home2 + sep);
 }
 var warnedVault = false;
@@ -61704,13 +61739,13 @@ function genSalt(rounds, seed_length, callback) {
       throw Error("Illegal callback: " + typeof callback);
     _async(callback);
   } else
-    return new Promise(function(resolve26, reject) {
+    return new Promise(function(resolve27, reject) {
       _async(function(err, res) {
         if (err) {
           reject(err);
           return;
         }
-        resolve26(res);
+        resolve27(res);
       });
     });
 }
@@ -61730,13 +61765,13 @@ function hash(password, salt, callback, progressCallback) {
       throw Error("Illegal callback: " + typeof callback);
     _async(callback);
   } else
-    return new Promise(function(resolve26, reject) {
+    return new Promise(function(resolve27, reject) {
       _async(function(err, res) {
         if (err) {
           reject(err);
           return;
         }
-        resolve26(res);
+        resolve27(res);
       });
     });
 }
@@ -61769,13 +61804,13 @@ function compare(password, hashValue, callback, progressCallback) {
       throw Error("Illegal callback: " + typeof callback);
     _async(callback);
   } else
-    return new Promise(function(resolve26, reject) {
+    return new Promise(function(resolve27, reject) {
       _async(function(err, res) {
         if (err) {
           reject(err);
           return;
         }
-        resolve26(res);
+        resolve27(res);
       });
     });
 }
@@ -63935,7 +63970,7 @@ class VaultBroker {
     if (process.platform !== "linux" && process.env.SWITCHROOM_BROKER_ALLOW_NON_LINUX !== "1") {
       throw new Error(`vault-broker is Linux-only (running on ${process.platform}). ` + `The broker's ACL relies on cgroup-based systemd unit identification, ` + `which is not available on this platform. ` + `Use 'switchroom vault get --no-broker' for direct vault access. ` + `If you need to run the broker for development on this platform, ` + `set SWITCHROOM_BROKER_ALLOW_NON_LINUX=1 \u2014 but understand that the ` + `broker will accept any same-user caller without per-cron ACL enforcement.`);
     }
-    this.socketPath = resolve26(socketPath);
+    this.socketPath = resolve27(socketPath);
     this.unlockSocketPath = unlockSocketFor(this.socketPath);
     this.startedAt = Date.now();
     if (this.testOpts._testConfig) {
@@ -63945,7 +63980,7 @@ class VaultBroker {
       this.config = loadConfig2(configPath);
     }
     if (vaultPath) {
-      this.vaultPath = resolve26(vaultPath);
+      this.vaultPath = resolve27(vaultPath);
     } else {
       this.vaultPath = resolvePath(this.config.vault?.path ?? "~/.switchroom/vault.enc");
     }
@@ -63957,7 +63992,7 @@ class VaultBroker {
       this.passphrase = this.testOpts._testPassphrase;
     }
     process.umask(63);
-    const parentDir = dirname7(this.socketPath);
+    const parentDir = dirname8(this.socketPath);
     mkdirSync23(parentDir, { recursive: true, mode: 448 });
     try {
       chmodSync7(parentDir, 448);
@@ -64060,7 +64095,7 @@ class VaultBroker {
     return this.secrets;
   }
   bindAgentSocket(socketPath) {
-    const abs = resolve26(socketPath);
+    const abs = resolve27(socketPath);
     const agentName = socketPathToAgent(abs);
     if (agentName === null) {
       return Promise.reject(new Error(`bindAgentSocket: socket path '${abs}' does not match the canonical ` + `/run/switchroom/broker/<agent>.sock shape \u2014 refusing to bind without ` + `a verifiable agent identity`));
@@ -64140,7 +64175,7 @@ class VaultBroker {
     });
   }
   _bindDataSocket() {
-    return new Promise((resolve27, reject) => {
+    return new Promise((resolve28, reject) => {
       const server = net3.createServer((socket) => {
         this._handleDataConnection(socket);
       });
@@ -64152,7 +64187,7 @@ class VaultBroker {
           chmodSync7(this.socketPath, 384);
         } catch {}
         this.server = server;
-        resolve27();
+        resolve28();
       });
     });
   }
@@ -64169,7 +64204,7 @@ class VaultBroker {
     } catch {}
   }
   bindOperatorListener(socketPath, operatorUid) {
-    const abs = resolve26(socketPath);
+    const abs = resolve27(socketPath);
     const identity = socketPathToIdentity(abs);
     if (identity?.kind !== "operator") {
       return Promise.reject(new Error(`bindOperatorListener: socket path '${abs}' does not match the canonical ` + `/run/switchroom/broker/operator/sock shape \u2014 refusing to bind`));
@@ -64233,7 +64268,7 @@ class VaultBroker {
     });
   }
   _bindUnlockSocket() {
-    return new Promise((resolve27, reject) => {
+    return new Promise((resolve28, reject) => {
       const server = net3.createServer((socket) => {
         this._handleUnlockConnection(socket);
       });
@@ -64245,7 +64280,7 @@ class VaultBroker {
           chmodSync7(this.unlockSocketPath, 384);
         } catch {}
         this.unlockServer = server;
-        resolve27();
+        resolve28();
       });
     });
   }
@@ -65430,15 +65465,15 @@ class VaultBroker {
   }
 }
 function detectVaultLayoutDrift(vaultPath) {
-  const dir = dirname7(vaultPath);
+  const dir = dirname8(vaultPath);
   if (basename6(dir) !== "vault")
     return;
   if (basename6(vaultPath) !== "vault.enc")
     return;
-  const switchroomDir = dirname7(dir);
+  const switchroomDir = dirname8(dir);
   if (basename6(switchroomDir) !== ".switchroom")
     return;
-  const home2 = dirname7(switchroomDir);
+  const home2 = dirname8(switchroomDir);
   const result = inspectVaultLayout(home2);
   if (result.kind === "divergent") {
     throw new VaultError(`Vault layout divergence detected at boot: ${result.details.oldPath} and ${result.details.newPath} are both regular files with different content. An older switchroom CLI may have written to the legacy path after migration ran. Run \`switchroom apply\` from the host to surface the recovery recipe (state E refusal with literal \`mv\` commands). See docs/operators/state-e-recovery.md.`);
@@ -65472,11 +65507,11 @@ async function main() {
         if (e.name.startsWith("."))
           continue;
         if ((e.isFile() || e.isSocket()) && e.name.endsWith(".sock")) {
-          flat.push(resolve26(perAgentDir, e.name));
+          flat.push(resolve27(perAgentDir, e.name));
           continue;
         }
         if (e.isDirectory()) {
-          const candidate = resolve26(perAgentDir, e.name, "sock");
+          const candidate = resolve27(perAgentDir, e.name, "sock");
           if (socketPathToAgent(candidate) !== null) {
             subdirs.push(candidate);
           }
@@ -65658,7 +65693,7 @@ function getAutoUnlockCredPath(configPath) {
 async function promptPassphrase() {
   if (!process.stdin.isTTY) {
     const { createInterface: createInterface3 } = await import("node:readline");
-    return new Promise((resolve27, reject) => {
+    return new Promise((resolve28, reject) => {
       const rl = createInterface3({ input: process.stdin, terminal: false });
       let settled = false;
       rl.once("line", (line) => {
@@ -65669,7 +65704,7 @@ async function promptPassphrase() {
           reject(new Error("Empty passphrase \u2014 aborting"));
           return;
         }
-        resolve27(passphrase);
+        resolve28(passphrase);
       });
       rl.once("close", () => {
         if (!settled) {
@@ -65678,7 +65713,7 @@ async function promptPassphrase() {
       });
     });
   }
-  return new Promise((resolve27, reject) => {
+  return new Promise((resolve28, reject) => {
     process.stdout.write("Vault passphrase: ");
     const stdin = process.stdin;
     stdin.setRawMode(true);
@@ -65698,7 +65733,7 @@ async function promptPassphrase() {
         if (!input) {
           reject(new Error("Empty passphrase \u2014 aborting"));
         } else {
-          resolve27(input);
+          resolve28(input);
         }
       } else if (char === "\x03") {
         cleanup();
@@ -66773,7 +66808,7 @@ function getVaultPath4(configPath) {
   }
 }
 function promptLine2(prompt, hidden = false) {
-  return new Promise((resolve27, reject) => {
+  return new Promise((resolve28, reject) => {
     const rl = createInterface3({
       input: process.stdin,
       output: process.stderr
@@ -66793,7 +66828,7 @@ function promptLine2(prompt, hidden = false) {
           rl.close();
           process.stderr.write(`
 `);
-          resolve27(input);
+          resolve28(input);
         } else if (char === "\x03") {
           stdin.setRawMode(false);
           stdin.removeListener("data", onData);
@@ -66813,17 +66848,17 @@ function promptLine2(prompt, hidden = false) {
     } else {
       rl.question(prompt, (answer) => {
         rl.close();
-        resolve27(answer);
+        resolve28(answer);
       });
     }
   });
 }
 function readStdinToEnd() {
-  return new Promise((resolve27, reject) => {
+  return new Promise((resolve28, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
     process.stdin.on("end", () => {
-      resolve27(Buffer.concat(chunks).toString("utf8"));
+      resolve28(Buffer.concat(chunks).toString("utf8"));
     });
     process.stdin.on("error", reject);
   });
@@ -68073,7 +68108,7 @@ function registerDispatchVerb(tg, _program) {
   }));
 }
 function promptHidden2(prompt) {
-  return new Promise((resolve27, reject) => {
+  return new Promise((resolve28, reject) => {
     const rl = createInterface4({ input: process.stdin, output: process.stdout });
     if (process.stdin.isTTY) {
       process.stdout.write(prompt);
@@ -68090,7 +68125,7 @@ function promptHidden2(prompt) {
           rl.close();
           process.stdout.write(`
 `);
-          resolve27(input);
+          resolve28(input);
         } else if (char === "\x03") {
           stdin.setRawMode(false);
           stdin.removeListener("data", onData);
@@ -68109,7 +68144,7 @@ function promptHidden2(prompt) {
     } else {
       rl.question(prompt, (answer) => {
         rl.close();
-        resolve27(answer);
+        resolve28(answer);
       });
     }
   });
@@ -68447,11 +68482,11 @@ var HINDSIGHT_DEFAULT_MEM_RESERVATION = "2g";
 var HINDSIGHT_DEFAULT_PIDS_LIMIT = 1000;
 var HINDSIGHT_DEFAULT_SHM_SIZE = "2g";
 function isPortFree(port) {
-  return new Promise((resolve27) => {
+  return new Promise((resolve28) => {
     const server = createServer4();
-    server.once("error", () => resolve27(false));
+    server.once("error", () => resolve28(false));
     server.once("listening", () => {
-      server.close(() => resolve27(true));
+      server.close(() => resolve28(true));
     });
     server.listen(port, "127.0.0.1");
   });
@@ -68982,7 +69017,7 @@ import {
   writeSync as writeSync6,
   constants as fsConstants3
 } from "node:fs";
-import { resolve as resolve28, extname, join as join47, relative, dirname as dirname10 } from "node:path";
+import { resolve as resolve29, extname, join as join47, relative, dirname as dirname11 } from "node:path";
 import { homedir as homedir26 } from "node:os";
 import { timingSafeEqual as timingSafeEqual3, randomBytes as randomBytes11 } from "node:crypto";
 
@@ -68992,7 +69027,7 @@ init_manager();
 init_hindsight();
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { existsSync as existsSync47, readFileSync as readFileSync43, statSync as statSync22 } from "node:fs";
-import { resolve as resolve27, join as join44 } from "node:path";
+import { resolve as resolve28, join as join44 } from "node:path";
 
 // src/web/memory-remediation.ts
 init_hindsight();
@@ -69126,7 +69161,7 @@ init_client();
 import { homedir as homedir23 } from "node:os";
 
 // node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/modifiers/module.node.mjs
-import { dirname as dirname8, posix, sep as sep2 } from "path";
+import { dirname as dirname9, posix, sep as sep2 } from "path";
 function createModulerModifier() {
   const getModuleFromFileName = createGetModuleFromFilename();
   return async (frames) => {
@@ -69135,7 +69170,7 @@ function createModulerModifier() {
     return frames;
   };
 }
-function createGetModuleFromFilename(basePath = process.argv[1] ? dirname8(process.argv[1]) : process.cwd(), isWindows = sep2 === "\\") {
+function createGetModuleFromFilename(basePath = process.argv[1] ? dirname9(process.argv[1]) : process.cwd(), isWindows = sep2 === "\\") {
   const normalizedBase = isWindows ? normalizeWindowsPath(basePath) : basePath;
   return (filename) => {
     if (!filename)
@@ -71474,14 +71509,14 @@ async function addSourceContext(frames) {
   return frames;
 }
 function getContextLinesFromFile(path4, ranges, output) {
-  return new Promise((resolve27) => {
+  return new Promise((resolve28) => {
     const stream = createReadStream(path4);
     const lineReaded = createInterface5({
       input: stream
     });
     function destroyStreamAndResolve() {
       stream.destroy();
-      resolve27();
+      resolve28();
     }
     let lineNumber = 0;
     let currentRangeIndex = 0;
@@ -72721,9 +72756,9 @@ class PostHogBackendClient extends PostHogCoreStateless {
     if (this.disabled || this.optedOut)
       return;
     if (!this._waitUntilCycle) {
-      let resolve27;
+      let resolve28;
       const promise = new Promise((r) => {
-        resolve27 = r;
+        resolve28 = r;
       });
       try {
         waitUntil(promise);
@@ -72731,7 +72766,7 @@ class PostHogBackendClient extends PostHogCoreStateless {
         return;
       }
       this._waitUntilCycle = {
-        resolve: resolve27,
+        resolve: resolve28,
         startedAt: Date.now(),
         timer: undefined
       };
@@ -72757,11 +72792,11 @@ class PostHogBackendClient extends PostHogCoreStateless {
     return cycle?.resolve;
   }
   async resolveWaitUntilFlush() {
-    const resolve27 = this._consumeWaitUntilCycle();
+    const resolve28 = this._consumeWaitUntilCycle();
     try {
       await super.flush();
     } catch {} finally {
-      resolve27?.();
+      resolve28?.();
     }
   }
   getPersistedProperty(key) {
@@ -72861,15 +72896,15 @@ class PostHogBackendClient extends PostHogCoreStateless {
       return true;
     if (this.featureFlagsPoller === undefined)
       return false;
-    return new Promise((resolve27) => {
+    return new Promise((resolve28) => {
       const timeout = setTimeout(() => {
         cleanup();
-        resolve27(false);
+        resolve28(false);
       }, timeoutMs);
       const cleanup = this._events.on("localEvaluationFlagsLoaded", (count) => {
         clearTimeout(timeout);
         cleanup();
-        resolve27(count > 0);
+        resolve28(count > 0);
       });
     });
   }
@@ -73213,13 +73248,13 @@ class PostHogBackendClient extends PostHogCoreStateless {
     this.context?.enter(data, options);
   }
   async _shutdown(shutdownTimeoutMs) {
-    const resolve27 = this._consumeWaitUntilCycle();
+    const resolve28 = this._consumeWaitUntilCycle();
     await this.featureFlagsPoller?.stopPoller(shutdownTimeoutMs);
     this.errorTracking.shutdown();
     try {
       return await super._shutdown(shutdownTimeoutMs);
     } finally {
-      resolve27?.();
+      resolve28?.();
     }
   }
   async _requestRemoteConfigPayload(flagKey) {
@@ -73573,7 +73608,7 @@ import {
   readFileSync as readFileSync41,
   writeFileSync as writeFileSync24
 } from "node:fs";
-import { dirname as dirname9 } from "node:path";
+import { dirname as dirname10 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 var DEFAULT_KEY = "phc_qKY87cKWZm6ZyCtk7LcRd2cU8Sg42u7Ywhui5stYCegd";
 var DEFAULT_HOST = "https://us.i.posthog.com";
@@ -73601,7 +73636,7 @@ function getDistinctId() {
   const id = randomUUID3();
   cachedDistinctId = id;
   try {
-    mkdirSync25(dirname9(path4), { recursive: true });
+    mkdirSync25(dirname10(path4), { recursive: true });
     writeFileSync24(path4, id, "utf-8");
   } catch {}
   return id;
@@ -73657,7 +73692,7 @@ function installGlobalErrorHandlers() {
   const flushWithTimeout = async (error, kind) => {
     await Promise.race([
       captureException(error, { kind }),
-      new Promise((resolve27) => setTimeout(resolve27, FLUSH_TIMEOUT_MS))
+      new Promise((resolve28) => setTimeout(resolve28, FLUSH_TIMEOUT_MS))
     ]);
   };
   process.on("uncaughtException", (err) => {
@@ -74266,7 +74301,7 @@ var DASHBOARD_CACHE_TTL = {
 };
 function readLastTurnAt(agentsDir, name) {
   try {
-    const db = openTurnsDb(resolve27(agentsDir, name));
+    const db = openTurnsDb(resolve28(agentsDir, name));
     try {
       const turns = listTurnsForAgent(db, { limit: 1 });
       return turns.length > 0 ? turns[0].started_at : null;
@@ -74279,7 +74314,7 @@ function readLastTurnAt(agentsDir, name) {
 }
 function agentBridgeAlive(agentsDir, name, maxAgeMs = 30000, now = Date.now()) {
   try {
-    const f = resolve27(agentsDir, name, "telegram", ".bridge-alive");
+    const f = resolve28(agentsDir, name, "telegram", ".bridge-alive");
     return now - statSync22(f).mtimeMs <= maxAgeMs;
   } catch {
     return false;
@@ -74367,7 +74402,7 @@ async function handleGetLogs(name, lines = 50, deps = {}) {
 function handleGetTurns(config, agentName, limit) {
   try {
     const agentsDir = resolveAgentsDir(config);
-    const agentDir = resolve27(agentsDir, agentName);
+    const agentDir = resolve28(agentsDir, agentName);
     const db = openTurnsDb(agentDir);
     try {
       const turns = listTurnsForAgent(db, { limit });
@@ -74385,7 +74420,7 @@ function handleGetTurns(config, agentName, limit) {
 function handleGetSubagents(config, agentName, status) {
   try {
     const agentsDir = resolveAgentsDir(config);
-    const agentDir = resolve27(agentsDir, agentName);
+    const agentDir = resolve28(agentsDir, agentName);
     const db = openTurnsDb(agentDir);
     try {
       applySubagentsSchema(db);
@@ -74929,7 +74964,7 @@ async function handleGetSchedule(config, deps = {}) {
   const recentByAgent = {};
   const agents = new Set(entries.map((e) => e.agent));
   for (const agent of agents) {
-    const rows = readRecentFires(resolve27(agentsDir, agent, "scheduler.jsonl"));
+    const rows = readRecentFires(resolve28(agentsDir, agent, "scheduler.jsonl"));
     if (rows.length > 0)
       recentByAgent[agent] = rows.slice(-10);
   }
@@ -75479,7 +75514,7 @@ function escapeHtml3(s) {
 import net4 from "node:net";
 function forwardToGateway(socketPath, req, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 5000;
-  return new Promise((resolve28) => {
+  return new Promise((resolve29) => {
     let settled = false;
     let buf = "";
     const done = (value) => {
@@ -75489,7 +75524,7 @@ function forwardToGateway(socketPath, req, opts = {}) {
       try {
         conn.destroy();
       } catch {}
-      resolve28(value);
+      resolve29(value);
     };
     const conn = net4.createConnection(socketPath);
     conn.setEncoding("utf8");
@@ -75857,7 +75892,7 @@ function resolveWebToken() {
       return existing;
   }
   const token = randomBytes11(32).toString("hex");
-  mkdirSync29(dirname10(tokenPath), { recursive: true, mode: 448 });
+  mkdirSync29(dirname11(tokenPath), { recursive: true, mode: 448 });
   try {
     const fd = openSync10(tokenPath, fsConstants3.O_WRONLY | fsConstants3.O_CREAT | fsConstants3.O_EXCL, 384);
     try {
@@ -76114,7 +76149,7 @@ function parseRoute(pathname, method) {
   return null;
 }
 function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
-  const uiDirRaw = resolve28(import.meta.dirname, "ui");
+  const uiDirRaw = resolve29(import.meta.dirname, "ui");
   const uiDir = existsSync50(uiDirRaw) ? realpathSync4(uiDirRaw) : uiDirRaw;
   const token = resolveWebToken();
   const freshConfig = () => {
@@ -76391,7 +76426,7 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         return new Response("Not Found", { status: 404 });
       }
       const rel = relative(uiDir, realFullPath);
-      if (rel.startsWith("..") || resolve28(uiDir, rel) !== realFullPath) {
+      if (rel.startsWith("..") || resolve29(uiDir, rel) !== realFullPath) {
         return new Response("Forbidden", { status: 403 });
       }
       const ext = extname(realFullPath);
@@ -76546,7 +76581,7 @@ Starting Switchroom dashboard...
 init_source();
 init_loader();
 import { existsSync as existsSync51, copyFileSync as copyFileSync8, readFileSync as readFileSync47, writeFileSync as writeFileSync27, mkdirSync as mkdirSync30 } from "node:fs";
-import { resolve as resolve29, dirname as dirname11 } from "node:path";
+import { resolve as resolve30, dirname as dirname12 } from "node:path";
 init_vault();
 init_manager();
 
@@ -76737,12 +76772,12 @@ async function stepConfigFile(configPath, nonInteractive) {
     console.log(source_default.gray(`  Loading ${existingConfig}`));
     const config = loadConfig(existingConfig);
     console.log(source_default.green(`  ${STEP_DONE} Config loaded`) + source_default.gray(` (${Object.keys(config.agents).length} agents)`));
-    return { config, configPath: resolve29(existingConfig) };
+    return { config, configPath: resolve30(existingConfig) };
   }
   return await copyExampleConfig(nonInteractive);
 }
 async function copyExampleConfig(nonInteractive) {
-  const examplesDir = resolve29(import.meta.dirname, "../../examples");
+  const examplesDir = resolve30(import.meta.dirname, "../../examples");
   let choice;
   if (nonInteractive) {
     choice = "switchroom";
@@ -76753,18 +76788,18 @@ async function copyExampleConfig(nonInteractive) {
     ]);
     choice = choice.split(" ")[0];
   }
-  const srcFile = resolve29(examplesDir, `${choice}.yaml`);
+  const srcFile = resolve30(examplesDir, `${choice}.yaml`);
   const destFile = resolvePath("~/.switchroom/switchroom.yaml");
   if (!existsSync51(srcFile)) {
     throw new ConfigError(`Example config not found: ${choice}.yaml`);
   }
-  mkdirSync30(dirname11(destFile), { recursive: true });
+  mkdirSync30(dirname12(destFile), { recursive: true });
   copyFileSync8(srcFile, destFile);
   console.log(source_default.green(`  Copied ${choice}.yaml -> ${destFile}`));
   console.log(source_default.yellow(`  Edit ${destFile} to customize, then re-run switchroom setup.`));
   const config = loadConfig(destFile);
   console.log(source_default.green(`  ${STEP_DONE} Config loaded`) + source_default.gray(` (${Object.keys(config.agents).length} agents)`));
-  return { config, configPath: resolve29(destFile) };
+  return { config, configPath: resolve30(destFile) };
 }
 async function stepBotToken(config, nonInteractive) {
   stepHeader(2, "Bot tokens", STEP_ACTIVE);
@@ -77272,7 +77307,7 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
   const choice = await askChoice("  Approval posture", [PASSPHRASE_CHOICE, TELEGRAM_ID_CHOICE]);
   if (choice === TELEGRAM_ID_CHOICE) {
     try {
-      const yamlPath = existsSync51(resolve29(process.cwd(), "switchroom.yaml")) ? resolve29(process.cwd(), "switchroom.yaml") : resolve29(process.cwd(), "switchroom.yml");
+      const yamlPath = existsSync51(resolve30(process.cwd(), "switchroom.yaml")) ? resolve30(process.cwd(), "switchroom.yaml") : resolve30(process.cwd(), "switchroom.yml");
       if (existsSync51(yamlPath)) {
         const content = readFileSync47(yamlPath, "utf-8");
         const result = insertVaultBrokerApprovalAuth(content, "telegram-id");
@@ -77304,8 +77339,8 @@ async function stepDangerousMode(config, nonInteractive) {
   }
   if (enableDangerous) {
     const configPaths = [
-      resolve29(process.cwd(), "switchroom.yaml"),
-      resolve29(process.cwd(), "switchroom.yml")
+      resolve30(process.cwd(), "switchroom.yaml"),
+      resolve30(process.cwd(), "switchroom.yml")
     ];
     for (const configPath of configPaths) {
       if (existsSync51(configPath)) {
@@ -77339,7 +77374,7 @@ async function stepOnboardingGuidance(config, nonInteractive) {
   const agentNames = Object.keys(config.agents);
   let allAuthenticated = true;
   for (const name of agentNames) {
-    const agentDir = resolve29(agentsDir, name);
+    const agentDir = resolve30(agentsDir, name);
     const status = getAuthStatus(name, agentDir);
     if (status.authenticated) {
       console.log(`  ${source_default.green("OK")} ${source_default.bold(name)}` + source_default.gray(` - authenticated (expires: ${status.timeUntilExpiry ?? "unknown"})`));
@@ -77439,7 +77474,7 @@ init_loader();
 init_lifecycle();
 import { cpSync as cpSync2, existsSync as existsSync58, mkdirSync as mkdirSync32, readFileSync as readFileSync52, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync26, chownSync as chownSync5 } from "node:fs";
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { join as join61, dirname as dirname14, resolve as resolve34 } from "node:path";
+import { join as join61, dirname as dirname15, resolve as resolve35 } from "node:path";
 import { homedir as homedir37 } from "node:os";
 
 // src/cli/release-yaml.ts
@@ -77481,7 +77516,7 @@ function defaultPersistPin(configPath) {
 }
 var DEFAULT_COMPOSE_PATH = join61(homedir37(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
-  let dir = dirname14(scriptPath);
+  let dir = dirname15(scriptPath);
   for (let i = 0;i < 12; i++) {
     if (existsSync58(join61(dir, ".git"))) {
       try {
@@ -77490,7 +77525,7 @@ function runningFromSwitchroomCheckout(scriptPath) {
           return true;
       } catch {}
     }
-    const parent = dirname14(dir);
+    const parent = dirname15(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -77644,7 +77679,7 @@ function planUpdate(opts) {
         opts.syncBundledSkillsFn();
         return;
       }
-      const source = resolve34(import.meta.dirname, "../../skills");
+      const source = resolve35(import.meta.dirname, "../../skills");
       const dest = join61(homedir37(), ".switchroom", "skills", "_bundled");
       if (!existsSync58(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
@@ -77655,7 +77690,7 @@ function planUpdate(opts) {
         if (existsSync58(dest)) {
           rmSync12(dest, { recursive: true, force: true });
         }
-        mkdirSync32(dirname14(dest), { recursive: true });
+        mkdirSync32(dirname15(dest), { recursive: true });
         cpSync2(source, dest, { recursive: true, dereference: false });
       } catch (err) {
         throw new Error(`sync-bundled-skills failed: ${err.message}`);
@@ -77757,7 +77792,7 @@ function defaultStatusProbe(composePath) {
       try {
         cliBuiltAt = new Date(statSync26(scriptPath).mtimeMs).toISOString();
       } catch {}
-      let dir = dirname14(scriptPath);
+      let dir = dirname15(scriptPath);
       for (let i = 0;i < 8; i++) {
         const pkgPath = join61(dir, "package.json");
         if (existsSync58(pkgPath)) {
@@ -77770,7 +77805,7 @@ function defaultStatusProbe(composePath) {
           }
           break;
         }
-        const parent = dirname14(dir);
+        const parent = dirname15(dir);
         if (parent === dir)
           break;
         dir = parent;
@@ -78193,7 +78228,7 @@ init_source();
 init_helpers();
 init_loader();
 init_lifecycle();
-import { resolve as resolve35 } from "node:path";
+import { resolve as resolve36 } from "node:path";
 
 // src/cli/version.ts
 init_source();
@@ -78201,7 +78236,7 @@ init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
 import { existsSync as existsSync59, readFileSync as readFileSync54 } from "node:fs";
-import { dirname as dirname15, join as join62 } from "node:path";
+import { dirname as dirname16, join as join62 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync4("claude --version 2>/dev/null", {
@@ -78260,7 +78295,7 @@ function locateSwitchroomInstallDir() {
         }
       } catch {}
     }
-    dir = dirname15(dir);
+    dir = dirname16(dir);
   }
   return null;
 }
@@ -78348,7 +78383,7 @@ function registerRestartCommand(program3) {
         }
         const didRestart = res.restarted || !graceful;
         if (didRestart) {
-          const agentDir = resolve35(agentsDir, name);
+          const agentDir = resolve36(agentsDir, name);
           const converged = waitForAuthConverge(name, agentDir);
           if (!converged) {
             console.log(source_default.yellow(`  ${name}: agent is up but auth status didn't converge in 30s \u2014 check logs`));
@@ -78429,7 +78464,7 @@ Dependency manifest`));
 // src/cli/handoff.ts
 init_helpers();
 init_loader();
-import { resolve as resolve36 } from "node:path";
+import { resolve as resolve37 } from "node:path";
 function registerHandoffCommand(program3) {
   program3.command("handoff <agent>", { hidden: true }).description("Build the agent's session handoff sidecars \u2014 a transcript-tail " + "briefing (.handoff.md) and topic line (.handoff-topic). " + "[internal \u2014 used by the Stop hook]").option("--max-turns <n>", "Max turns kept in the handoff transcript tail", String(DEFAULT_MAX_TURNS)).action(withConfigError(async (agentName, opts) => {
     let agentConfig;
@@ -78443,7 +78478,7 @@ function registerHandoffCommand(program3) {
         return;
       }
       const agentsDir = resolveAgentsDir(config);
-      agentDir = resolve36(agentsDir, agentName);
+      agentDir = resolve37(agentsDir, agentName);
     } catch (err) {
       if (!(err instanceof ConfigError))
         throw err;
@@ -78458,7 +78493,7 @@ function registerHandoffCommand(program3) {
 `);
       return;
     }
-    const claudeConfigDir = resolve36(agentDir, ".claude");
+    const claudeConfigDir = resolve37(agentDir, ".claude");
     const jsonl = findLatestSessionJsonl(claudeConfigDir);
     if (!jsonl) {
       process.stderr.write(`handoff: no session JSONL under ${claudeConfigDir}/projects; skipping
@@ -78967,7 +79002,7 @@ function record(stateDir, input, nowFn = Date.now) {
     return result;
   });
 }
-function resolve37(stateDir, fingerprint, nowFn = Date.now) {
+function resolve38(stateDir, fingerprint, nowFn = Date.now) {
   if (!existsSync60(join63(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
@@ -79255,11 +79290,11 @@ function registerIssuesCommand(program3) {
       const stateDir = resolveStateDir2(opts);
       let flipped;
       if (opts.source && opts.code) {
-        flipped = resolve37(stateDir, computeFingerprint(opts.source, opts.code));
+        flipped = resolve38(stateDir, computeFingerprint(opts.source, opts.code));
       } else if (opts.source && !fingerprint) {
         flipped = resolveAllBySource(stateDir, opts.source);
       } else if (fingerprint) {
-        flipped = resolve37(stateDir, fingerprint);
+        flipped = resolve38(stateDir, fingerprint);
       } else {
         process.stderr.write(`issues resolve: need either <fingerprint>, --source, or --source + --code
 `);
@@ -79356,7 +79391,7 @@ function relTime(deltaMs) {
 init_source();
 import { existsSync as existsSync63 } from "node:fs";
 import { homedir as homedir40 } from "node:os";
-import { join as join66, resolve as resolve38 } from "node:path";
+import { join as join66, resolve as resolve39 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash11 } from "node:crypto";
@@ -79367,7 +79402,7 @@ import {
   rmSync as rmSync13,
   writeFileSync as writeFileSync29
 } from "node:fs";
-import { dirname as dirname16, join as join64 } from "node:path";
+import { dirname as dirname17, join as join64 } from "node:path";
 import { homedir as homedir38 } from "node:os";
 import { execFileSync as execFileSync19 } from "node:child_process";
 
@@ -79414,7 +79449,7 @@ function ensurePythonEnv(opts) {
   if (existsSync61(venvDir)) {
     rmSync13(venvDir, { recursive: true, force: true });
   }
-  mkdirSync34(dirname16(venvDir), { recursive: true });
+  mkdirSync34(dirname17(venvDir), { recursive: true });
   try {
     execFileSync19(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
   } catch (err) {
@@ -79455,7 +79490,7 @@ import {
   rmSync as rmSync14,
   writeFileSync as writeFileSync30
 } from "node:fs";
-import { dirname as dirname17, join as join65 } from "node:path";
+import { dirname as dirname18, join as join65 } from "node:path";
 import { homedir as homedir39 } from "node:os";
 import { execFileSync as execFileSync20 } from "node:child_process";
 
@@ -79482,7 +79517,7 @@ function defaultNodeCacheRoot() {
   return join65(homedir39(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
-  const sourceDir = dirname17(packageJsonPath);
+  const sourceDir = dirname18(packageJsonPath);
   const hasher = createHash12("sha256");
   hasher.update(`package.json
 `);
@@ -79507,7 +79542,7 @@ function ensureNodeEnv(opts) {
   if (!existsSync62(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
-  const sourceDir = dirname17(packageJsonPath);
+  const sourceDir = dirname18(packageJsonPath);
   const envDir = join65(cacheRoot, skillName);
   const stampPath = join65(envDir, ".package.sha256");
   const nodeModulesDir = join65(envDir, "node_modules");
@@ -79563,7 +79598,7 @@ function ensureNodeEnv(opts) {
 
 // src/cli/deps.ts
 function builtinSkillsRoot() {
-  return resolve38(homedir40(), ".switchroom/skills/_bundled");
+  return resolve39(homedir40(), ".switchroom/skills/_bundled");
 }
 function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
@@ -79642,7 +79677,7 @@ function registerDepsCommand(program3) {
 init_helpers();
 init_loader();
 import { existsSync as existsSync64 } from "node:fs";
-import { resolve as resolve39, sep as sep3 } from "node:path";
+import { resolve as resolve40, sep as sep3 } from "node:path";
 import { spawnSync as spawnSync11 } from "node:child_process";
 
 // src/agents/workspace.ts
@@ -80348,8 +80383,8 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const resolvedWorkspace = resolve39(dir);
-    const target = resolve39(resolvedWorkspace, file ?? "AGENTS.md");
+    const resolvedWorkspace = resolve40(dir);
+    const target = resolve40(resolvedWorkspace, file ?? "AGENTS.md");
     if (!isInsideWorkspace(resolvedWorkspace, target)) {
       process.stderr.write(`workspace edit: refusing path traversal outside workspace dir (${target})
 `);
@@ -80417,7 +80452,7 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const gitDir = resolve39(dir, ".git");
+    const gitDir = resolve40(dir, ".git");
     if (!existsSync64(gitDir)) {
       process.stdout.write(`Workspace is not a git repository. Re-run \`switchroom agent create ${agentName}\` ` + `or manually \`git init\` in ${dir} to enable versioning.
 `);
@@ -80471,7 +80506,7 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const gitDir = resolve39(dir, ".git");
+    const gitDir = resolve40(dir, ".git");
     if (!existsSync64(gitDir)) {
       process.stdout.write(`Workspace is not a git repository.
 `);
@@ -80495,7 +80530,7 @@ function resolveAgentWorkspaceDirOrExit(program3, agentName) {
     return;
   }
   const agentsDir = resolveAgentsDir(config);
-  const agentDir = resolve39(agentsDir, agentName);
+  const agentDir = resolve40(agentsDir, agentName);
   const dir = resolveAgentWorkspaceDir(agentDir);
   if (!existsSync64(dir)) {
     process.stderr.write(`workspace: ${dir} does not exist yet. Run \`switchroom setup\` or \`switchroom agent scaffold ${agentName}\` to seed it.
@@ -80534,7 +80569,7 @@ init_helpers();
 init_loader();
 init_merge();
 import { copyFileSync as copyFileSync10, existsSync as existsSync65, readFileSync as readFileSync58, writeFileSync as writeFileSync31 } from "node:fs";
-import { join as join67, resolve as resolve40 } from "node:path";
+import { join as join67, resolve as resolve41 } from "node:path";
 init_schema();
 function resolveSoulTargetOrExit(program3, agentName) {
   const config = getConfig(program3);
@@ -80547,7 +80582,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
   const profileName = merged.extends ?? DEFAULT_PROFILE;
   const profilePath = getProfilePath(profileName);
   const agentsDir = resolveAgentsDir(config);
-  const agentDir = resolve40(agentsDir, agentName);
+  const agentDir = resolve41(agentsDir, agentName);
   const workspaceDir = resolveAgentWorkspaceDir(agentDir);
   if (!existsSync65(workspaceDir)) {
     console.error(`soul: ${workspaceDir} does not exist yet. Run \`switchroom setup\` ` + `or \`switchroom agent scaffold ${agentName}\` to seed it.`);
@@ -80625,7 +80660,7 @@ function registerSoulCommand(program3) {
 init_helpers();
 init_loader();
 import { existsSync as existsSync66, readFileSync as readFileSync59, readdirSync as readdirSync23, statSync as statSync29 } from "node:fs";
-import { resolve as resolve41, join as join68 } from "node:path";
+import { resolve as resolve42, join as join68 } from "node:path";
 import { createHash as createHash13 } from "node:crypto";
 init_merge();
 init_hindsight();
@@ -80723,7 +80758,7 @@ function registerDebugCommand(program3) {
       process.exit(1);
     }
     const agentsDir = resolveAgentsDir(config);
-    const agentDir = resolve41(agentsDir, agentName);
+    const agentDir = resolve42(agentsDir, agentName);
     if (!existsSync66(agentDir)) {
       console.error(`Agent directory not found: ${agentDir}`);
       process.exit(1);
@@ -80900,7 +80935,7 @@ init_source();
 // src/worktree/claim.ts
 import { execFileSync as execFileSync21 } from "node:child_process";
 import { closeSync as closeSync12, mkdirSync as mkdirSync37, openSync as openSync12, existsSync as existsSync68, unlinkSync as unlinkSync13 } from "node:fs";
-import { join as join70, resolve as resolve43 } from "node:path";
+import { join as join70, resolve as resolve44 } from "node:path";
 import { homedir as homedir42 } from "node:os";
 import { randomBytes as randomBytes13 } from "node:crypto";
 
@@ -80914,10 +80949,10 @@ import {
   existsSync as existsSync67,
   renameSync as renameSync13
 } from "node:fs";
-import { join as join69, resolve as resolve42 } from "node:path";
+import { join as join69, resolve as resolve43 } from "node:path";
 import { homedir as homedir41 } from "node:os";
 function registryDir() {
-  return resolve42(process.env.SWITCHROOM_WORKTREE_DIR ?? join69(homedir41(), ".switchroom", "worktrees"));
+  return resolve43(process.env.SWITCHROOM_WORKTREE_DIR ?? join69(homedir41(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
   return join69(registryDir(), `${id}.json`);
@@ -80998,7 +81033,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve43(process.env.SWITCHROOM_WORKTREE_BASE ?? join70(homedir42(), ".switchroom", "worktree-checkouts"));
+  return resolve44(process.env.SWITCHROOM_WORKTREE_BASE ?? join70(homedir42(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes13(4).toString("hex");
@@ -81662,7 +81697,7 @@ function registerDriveMcpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn5 } from "node:child_process";
 import { writeFileSync as writeFileSync34, mkdirSync as mkdirSync39 } from "node:fs";
-import { dirname as dirname18, join as join72 } from "node:path";
+import { dirname as dirname19, join as join72 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -81687,7 +81722,7 @@ function computeRefreshDelayMs(expiresAt, now, leadMs = DEFAULT_REFRESH_LEAD_MS)
 function writeRefreshHeartbeat(agentName, data) {
   const path7 = heartbeatPath(agentName);
   try {
-    mkdirSync39(dirname18(path7), { recursive: true });
+    mkdirSync39(dirname19(path7), { recursive: true });
     writeFileSync34(path7, JSON.stringify(data, null, 2), { mode: 420 });
   } catch {}
 }
@@ -81718,20 +81753,20 @@ function wireStdio(child) {
 async function killChild(child, gracefulMs = 3000) {
   if (child.exitCode !== null || child.signalCode !== null)
     return;
-  return new Promise((resolve44) => {
+  return new Promise((resolve45) => {
     let killTimer = null;
     const onExit = () => {
       if (killTimer) {
         clearTimeout(killTimer);
         killTimer = null;
       }
-      resolve44();
+      resolve45();
     };
     child.once("exit", onExit);
     try {
       child.kill("SIGTERM");
     } catch {
-      resolve44();
+      resolve45();
       return;
     }
     killTimer = setTimeout(() => {
@@ -81845,8 +81880,8 @@ async function runMs365McpLauncher(opts, rt) {
   };
   process.on("SIGINT", onSignal);
   process.on("SIGTERM", onSignal);
-  return new Promise((resolve44) => {
-    resolveLauncher = resolve44;
+  return new Promise((resolve45) => {
+    resolveLauncher = resolve45;
   });
 }
 function registerM365McpLauncherCommand(program3) {
@@ -81880,7 +81915,7 @@ function registerM365McpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
 import { existsSync as existsSync71, mkdirSync as mkdirSync40, writeFileSync as writeFileSync35 } from "node:fs";
-import { dirname as dirname19 } from "node:path";
+import { dirname as dirname20 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
 var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
 var DEFAULT_VAULT_KEY = "notion/integration-token";
@@ -81890,7 +81925,7 @@ function buildNotionMcpArgs(opts) {
 }
 function defaultWriteHeartbeat(path7, contents) {
   try {
-    const dir = dirname19(path7);
+    const dir = dirname20(path7);
     if (!existsSync71(dir))
       mkdirSync40(dir, { recursive: true });
     writeFileSync35(path7, contents);
@@ -81948,23 +81983,23 @@ async function runNotionMcpLauncher(opts, runtime) {
   };
   process.on("SIGTERM", () => forward("SIGTERM"));
   process.on("SIGINT", () => forward("SIGINT"));
-  const exitCode = await new Promise((resolve44) => {
+  const exitCode = await new Promise((resolve45) => {
     child.once("exit", (code, signal) => {
       clearTimer(heartbeatHandle);
       if (typeof code === "number") {
-        resolve44(code);
+        resolve45(code);
       } else if (signal) {
         const sigCode = { SIGTERM: 15, SIGINT: 2, SIGKILL: 9 }[signal] ?? 1;
-        resolve44(128 + sigCode);
+        resolve45(128 + sigCode);
       } else {
-        resolve44(1);
+        resolve45(1);
       }
     });
     child.once("error", (err) => {
       clearTimer(heartbeatHandle);
       process.stderr.write(`notion-mcp-launcher: child spawn error: ${err.message}
 `);
-      resolve44(1);
+      resolve45(1);
     });
   });
   return exitCode;
@@ -83022,7 +83057,7 @@ agents:
 
 // src/cli/apply.ts
 init_resolver();
-import { dirname as dirname22, join as join75, resolve as resolve45 } from "node:path";
+import { dirname as dirname23, join as join75, resolve as resolve46 } from "node:path";
 import { homedir as homedir44 } from "node:os";
 import { execFileSync as execFileSync24 } from "node:child_process";
 init_vault();
@@ -83219,7 +83254,7 @@ var COMPOSE_PROJECT2 = "switchroom";
 function resolveVaultBindMountDir(homeDir, ctx) {
   const isCustomPath = ctx.migrationKind === "custom-path-skipped";
   if (isCustomPath && ctx.customVaultPath) {
-    return dirname22(ctx.customVaultPath);
+    return dirname23(ctx.customVaultPath);
   }
   return join75(homeDir, ".switchroom", "vault");
 }
@@ -83624,7 +83659,7 @@ function copyExampleConfig2(name) {
   if (!/^[a-z0-9_-]+$/.test(name)) {
     throw new Error(`Invalid example name: ${name} (must match /^[a-z0-9_-]+$/)`);
   }
-  const dest = resolve45(process.cwd(), "switchroom.yaml");
+  const dest = resolve46(process.cwd(), "switchroom.yaml");
   if (existsSync74(dest)) {
     console.error(source_default.yellow("switchroom.yaml already exists \u2014 skipping example copy"));
     return;
@@ -83635,7 +83670,7 @@ function copyExampleConfig2(name) {
     console.log(source_default.green(`Copied ${name}.yaml -> switchroom.yaml`));
     return;
   }
-  const exampleFile = resolve45(import.meta.dirname, `../../examples/${name}.yaml`);
+  const exampleFile = resolve46(import.meta.dirname, `../../examples/${name}.yaml`);
   if (!existsSync74(exampleFile)) {
     throw new Error(`Example config not found: ${name}.yaml (available: ${Object.keys(EMBEDDED_EXAMPLES).join(", ")})`);
   }
@@ -84213,10 +84248,10 @@ import {
   unlinkSync as unlinkSync14,
   writeSync as writeSync8
 } from "node:fs";
-import { join as join77, resolve as resolve46 } from "node:path";
+import { join as join77, resolve as resolve47 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
-  const base = opts.root ? resolve46(opts.root, agent) : resolve46(resolveDualPath(`~/.switchroom/agents/${agent}`));
+  const base = opts.root ? resolve47(opts.root, agent) : resolve47(resolveDualPath(`~/.switchroom/agents/${agent}`));
   const scheduleDir = join77(base, "schedule.d");
   const scheduleStagingDir = join77(scheduleDir, STAGING_SUBDIR);
   const skillsDir = join77(base, "skills.d");
@@ -85459,7 +85494,7 @@ function registerAgentConfigSkillWriteCommands(program3) {
 import {
   closeSync as closeSync15,
   existsSync as existsSync80,
-  lstatSync as lstatSync8,
+  lstatSync as lstatSync9,
   mkdirSync as mkdirSync45,
   mkdtempSync as mkdtempSync5,
   openSync as openSync15,
@@ -85472,7 +85507,7 @@ import {
   writeFileSync as writeFileSync39
 } from "node:fs";
 import { tmpdir as tmpdir5, homedir as homedir46 } from "node:os";
-import { dirname as dirname23, join as join80, relative as relative2, resolve as resolve47 } from "node:path";
+import { dirname as dirname24, join as join80, relative as relative2, resolve as resolve48 } from "node:path";
 import { spawnSync as spawnSync12 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -85670,7 +85705,7 @@ function resolveSkillsPoolDir2(override) {
   }
   if (raw === "~")
     return homedir46();
-  return resolve47(raw);
+  return resolve48(raw);
 }
 function readStdinSync() {
   const chunks = [];
@@ -85889,7 +85924,7 @@ function writePayload(poolDir, name, files) {
   const target = join80(poolDir, name);
   let targetIsSymlink = false;
   try {
-    const st = lstatSync8(target);
+    const st = lstatSync9(target);
     if (st.isSymbolicLink()) {
       targetIsSymlink = true;
     }
@@ -85902,7 +85937,7 @@ function writePayload(poolDir, name, files) {
   try {
     for (const [path8, content] of Object.entries(files)) {
       const full = join80(staging, path8);
-      mkdirSync45(dirname23(full), { recursive: true, mode: 493 });
+      mkdirSync45(dirname24(full), { recursive: true, mode: 493 });
       const fd = openSync15(full, "wx");
       try {
         writeFileSync39(fd, content);
@@ -85916,7 +85951,7 @@ function writePayload(poolDir, name, files) {
     }
     let targetExists = false;
     try {
-      lstatSync8(target);
+      lstatSync9(target);
       targetExists = true;
     } catch {}
     if (targetExists) {
@@ -85954,7 +85989,7 @@ function registerSkillCommand(program3) {
     if (opts.from === undefined) {
       files = loadFromStdin();
     } else {
-      const fromPath = resolve47(opts.from);
+      const fromPath = resolve48(opts.from);
       if (!existsSync80(fromPath)) {
         fail3(`--from path does not exist: ${opts.from}`);
       }
@@ -86011,7 +86046,7 @@ function sumBytes(files) {
 import {
   closeSync as closeSync16,
   existsSync as existsSync81,
-  lstatSync as lstatSync9,
+  lstatSync as lstatSync10,
   mkdirSync as mkdirSync46,
   mkdtempSync as mkdtempSync6,
   openSync as openSync16,
@@ -86023,7 +86058,7 @@ import {
   utimesSync,
   writeFileSync as writeFileSync40
 } from "node:fs";
-import { dirname as dirname24, join as join81, relative as relative3, resolve as resolve48 } from "node:path";
+import { dirname as dirname25, join as join81, relative as relative3, resolve as resolve49 } from "node:path";
 import { homedir as homedir47, tmpdir as tmpdir6 } from "node:os";
 import { spawnSync as spawnSync13 } from "node:child_process";
 init_helpers();
@@ -86034,7 +86069,7 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve48(override) : join81(homedir47(), ".switchroom-config");
+  const candidate = override ? resolve49(override) : join81(homedir47(), ".switchroom-config");
   if (!existsSync81(candidate))
     return null;
   return join81(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
@@ -86068,7 +86103,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   try {
     if (liveSkillDir !== null) {
       try {
-        const st = lstatSync9(liveSkillDir);
+        const st = lstatSync10(liveSkillDir);
         if (st.isSymbolicLink()) {
           process.stderr.write(source_default.yellow(`warning: refusing to mirror ${liveSkillDir} \u2014 source is a symlink
 `));
@@ -86129,7 +86164,7 @@ function resolveAgent(opts) {
 }
 function resolveAgentsRoot(opts) {
   if (opts.root)
-    return resolve48(opts.root);
+    return resolve49(opts.root);
   return join81(homedir47(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
@@ -86159,7 +86194,7 @@ function readStdinSync2() {
   return Buffer.concat(chunks).toString("utf-8");
 }
 function loadFromDir2(dir) {
-  const abs = resolve48(dir);
+  const abs = resolve49(dir);
   if (!statSync33(abs).isDirectory()) {
     fail4(`--from path is not a directory: ${dir}`);
   }
@@ -86256,7 +86291,7 @@ function sweepTrash(agentsRoot, agent) {
 function writePersonalSkill(targetDir, files) {
   let targetIsSymlink = false;
   try {
-    const st = lstatSync9(targetDir);
+    const st = lstatSync10(targetDir);
     if (st.isSymbolicLink()) {
       targetIsSymlink = true;
     }
@@ -86264,13 +86299,13 @@ function writePersonalSkill(targetDir, files) {
   if (targetIsSymlink) {
     fail4(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
-  mkdirSync46(dirname24(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join81(dirname24(targetDir), `.skill-personal-stage-`));
+  mkdirSync46(dirname25(targetDir), { recursive: true, mode: 493 });
+  const staging = mkdtempSync6(join81(dirname25(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
       const full = join81(staging, path8);
-      mkdirSync46(dirname24(full), { recursive: true, mode: 493 });
+      mkdirSync46(dirname25(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
         writeFileSync40(fd, content);
@@ -86284,7 +86319,7 @@ function writePersonalSkill(targetDir, files) {
     }
     let targetExists = false;
     try {
-      lstatSync9(targetDir);
+      lstatSync10(targetDir);
       targetExists = true;
     } catch {}
     if (targetExists) {
@@ -86319,7 +86354,7 @@ function loadValidateWrite(agentsRoot, agent, name, files, ensureNew) {
   const target = personalSkillDir(agentsRoot, agent, name);
   const exists = (() => {
     try {
-      lstatSync9(target);
+      lstatSync10(target);
       return true;
     } catch {
       return false;
@@ -86353,7 +86388,7 @@ function loadFiles(opts) {
   if (opts.from === undefined) {
     return loadFromStdin2();
   }
-  const p = resolve48(opts.from);
+  const p = resolve49(opts.from);
   if (!existsSync81(p)) {
     fail4(`--from path does not exist: ${opts.from}`);
   }
@@ -86419,7 +86454,7 @@ function resolveCloneSource(source, opts) {
   if (!existsSync81(dir)) {
     fail4(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
-  const st = lstatSync9(dir);
+  const st = lstatSync10(dir);
   if (st.isSymbolicLink()) {
     fail4(`clone source ${JSON.stringify(source)} is a symlink at ${dir}; ` + `point clone at the canonical pool path instead`);
   }
@@ -86446,7 +86481,7 @@ function readSourceFiles(dir) {
           continue;
         }
         try {
-          const st = lstatSync9(full);
+          const st = lstatSync10(full);
           if (st.size > CLONE_MAX_FILE_BYTES) {
             fail4(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
           }
@@ -86528,7 +86563,7 @@ function removePersonalAction(name, opts) {
   }
   const target = personalSkillDir(agentsRoot, agent, name);
   try {
-    const st = lstatSync9(target);
+    const st = lstatSync10(target);
     if (st.isSymbolicLink()) {
       fail4(`refusing to remove symlink at ${target}; investigate manually`);
     }
@@ -86622,18 +86657,18 @@ init_helpers();
 var import_yaml24 = __toESM(require_dist(), 1);
 import { existsSync as existsSync82, readdirSync as readdirSync32, readFileSync as readFileSync70, statSync as statSync34 } from "node:fs";
 import { homedir as homedir48 } from "node:os";
-import { join as join82, resolve as resolve49 } from "node:path";
+import { join as join82, resolve as resolve50 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
 function defaultAgentsRoot() {
-  return resolve49(homedir48(), ".switchroom/agents");
+  return resolve50(homedir48(), ".switchroom/agents");
 }
 function defaultSharedRoot2() {
-  return resolve49(homedir48(), ".switchroom/skills");
+  return resolve50(homedir48(), ".switchroom/skills");
 }
 function defaultBundledRoot2() {
-  return resolve49(homedir48(), ".switchroom/skills/_bundled");
+  return resolve50(homedir48(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
   const mdPath = join82(skillDir, "SKILL.md");
@@ -86916,7 +86951,46 @@ init_helpers();
 import { existsSync as existsSync84, mkdirSync as mkdirSync47, readdirSync as readdirSync33, readFileSync as readFileSync72, writeFileSync as writeFileSync41, statSync as statSync35, copyFileSync as copyFileSync12 } from "node:fs";
 import { homedir as homedir49 } from "node:os";
 import { join as join83 } from "node:path";
+import { spawnSync as spawnSync16 } from "node:child_process";
+
+// src/cli/deploy-version-guard.ts
 import { spawnSync as spawnSync15 } from "node:child_process";
+var defaultRunner2 = (args) => {
+  const r = spawnSync15("docker", args, { encoding: "utf8" });
+  return { ok: r.status === 0, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+};
+function deployedImageTag(container, run = defaultRunner2) {
+  const r = run(["inspect", "-f", "{{.Config.Image}}", container]);
+  if (!r.ok)
+    return null;
+  const ref = r.stdout.trim();
+  if (!ref)
+    return null;
+  const noDigest = ref.split("@")[0];
+  const colon = noDigest.lastIndexOf(":");
+  if (colon < 0)
+    return null;
+  const tag = noDigest.slice(colon + 1);
+  return tag && !tag.includes("/") ? tag : null;
+}
+function checkDowngrade(opts) {
+  const running = deployedImageTag(opts.container, opts.run);
+  if (opts.allowDowngrade)
+    return { skip: false, running };
+  const cmp = compareReleaseTags(opts.targetTag, running);
+  if (cmp !== null && cmp < 0) {
+    return {
+      skip: true,
+      running,
+      message: `Skipping ${opts.container} deploy \u2014 it is already on ${running}, newer than the ` + `requested ${opts.targetTag}.
+` + `     Refusing to downgrade: this guards against a concurrent rollout/update ` + `reverting a newer build.
+` + `     To force the downgrade, re-run with --allow-downgrade.`
+    };
+  }
+  return { skip: false, running };
+}
+
+// src/cli/hostd.ts
 init_audit_reader();
 function resolveHostdImageTag(explicitTag, release) {
   if (explicitTag)
@@ -87054,7 +87128,7 @@ function backupExistingCompose() {
   return bak;
 }
 function runDocker(args) {
-  const r = spawnSync15("docker", args, { encoding: "utf8" });
+  const r = spawnSync16("docker", args, { encoding: "utf8" });
   return {
     ok: r.status === 0,
     stdout: r.stdout ?? "",
@@ -87081,6 +87155,15 @@ async function doInstall(opts, program3) {
   const composePath = hostdComposePath();
   mkdirSync47(dir, { recursive: true });
   const imageTag = resolveHostdImageTag(opts.tag, cfg.release);
+  const guard = checkDowngrade({
+    container: "switchroom-hostd",
+    targetTag: imageTag,
+    allowDowngrade: opts.allowDowngrade
+  });
+  if (guard.skip) {
+    console.log(source_default.yellow(`  \u23ed  ${opts.dryRun ? "[dry-run] " : ""}${guard.message}`));
+    return;
+  }
   const yaml = renderHostdComposeFile({
     hostHome: resolveHostdHostHome(),
     imageTag,
@@ -87190,7 +87273,7 @@ ${down.stderr}`));
 }
 function registerHostdCommand(program3) {
   const hostd = program3.command("hostd").description("Manage switchroom-hostd, the host-control daemon for admin agents (RFC C)");
-  hostd.command("install").description("Install or refresh the hostd container (writes ~/.switchroom/hostd/docker-compose.yml + docker compose up -d)").option("--tag <tag>", "Image tag override (default: resolved from release.pin in switchroom.yaml, else latest)").option("--dry-run", "Print the compose file and the docker commands without writing or running anything").action(withConfigError(async (opts) => {
+  hostd.command("install").description("Install or refresh the hostd container (writes ~/.switchroom/hostd/docker-compose.yml + docker compose up -d)").option("--tag <tag>", "Image tag override (default: resolved from release.pin in switchroom.yaml, else latest)").option("--dry-run", "Print the compose file and the docker commands without writing or running anything").option("--allow-downgrade", "Deploy even if the running container is on a newer version (overrides the anti-revert guard)").action(withConfigError(async (opts) => {
     await doInstall(opts, program3);
   }));
   hostd.command("status").description("Show daemon state and bound sockets").action(() => doStatus());
@@ -87247,7 +87330,7 @@ init_helpers();
 import { existsSync as existsSync85, mkdirSync as mkdirSync48, writeFileSync as writeFileSync42, copyFileSync as copyFileSync13 } from "node:fs";
 import { homedir as homedir50 } from "node:os";
 import { join as join84 } from "node:path";
-import { spawnSync as spawnSync16 } from "node:child_process";
+import { spawnSync as spawnSync17 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
     return explicitTag;
@@ -87346,7 +87429,7 @@ function backupExistingCompose2() {
   return bak;
 }
 function runDocker2(args) {
-  const r = spawnSync16("docker", args, { encoding: "utf8" });
+  const r = spawnSync17("docker", args, { encoding: "utf8" });
   return {
     ok: r.status === 0,
     stdout: r.stdout ?? "",
@@ -87366,6 +87449,15 @@ async function doInstall2(opts, program3) {
   mkdirSync48(dir, { recursive: true });
   const cfg = getConfig(program3);
   const imageTag = resolveWebImageTag(opts.tag, cfg.release);
+  const guard = checkDowngrade({
+    container: "switchroom-web",
+    targetTag: imageTag,
+    allowDowngrade: opts.allowDowngrade
+  });
+  if (guard.skip) {
+    console.log(source_default.yellow(`  \u23ed  ${opts.dryRun ? "[dry-run] " : ""}${guard.message}`));
+    return;
+  }
   const yaml = renderWebComposeFile({
     hostHome: homedir50(),
     imageTag,
@@ -87456,7 +87548,7 @@ ${down.stderr}`));
 }
 function registerWebdCommand(program3) {
   const webd = program3.command("webd").description("Manage switchroom-web, the dashboard + GitHub-webhook receiver container");
-  webd.command("install").description("Install or refresh the web container (writes ~/.switchroom/web/docker-compose.yml + docker compose up -d)").option("--tag <tag>", "Image tag override (default: resolved from release.pin in switchroom.yaml, else latest)").option("--dry-run", "Print the compose file and the docker commands without writing or running anything").action(withConfigError(async (opts) => {
+  webd.command("install").description("Install or refresh the web container (writes ~/.switchroom/web/docker-compose.yml + docker compose up -d)").option("--tag <tag>", "Image tag override (default: resolved from release.pin in switchroom.yaml, else latest)").option("--dry-run", "Print the compose file and the docker commands without writing or running anything").option("--allow-downgrade", "Deploy even if the running container is on a newer version (overrides the anti-revert guard)").action(withConfigError(async (opts) => {
     await doInstall2(opts, program3);
   }));
   webd.command("status").description("Show web-service container state").action(() => doStatus2());