switchroom 0.16.22 → 0.16.24

package/dist/cli/switchroom.js

@@ -51218,7 +51218,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes15 } from "node:crypto";
-import { existsSync as existsSync86, readFileSync as readFileSync74 } from "node:fs";
+import { existsSync as existsSync86, readFileSync as readFileSync75 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -51422,7 +51422,7 @@ function getLastUpdateApplyStatus() {
   }
   let raw;
   try {
-    raw = readFileSync74(path8, "utf-8");
+    raw = readFileSync75(path8, "utf-8");
   } catch (err2) {
     return errorText2(`get_status: failed to read audit log at ${path8}: ${err2.message}`);
   }
@@ -51692,8 +51692,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.16.22";
-var COMMIT_SHA = "ea287bf4";
+var VERSION = "0.16.23";
+var COMMIT_SHA = "3c17304c";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
@@ -75714,7 +75714,12 @@ function openTurnsDb(agentDir) {
   const db = new Database2(path4, { create: true });
   applySchema(db);
   try {
-    chmodSync8(path4, 384);
+    chmodSync8(path4, 420);
+    for (const suffix of ["-shm", "-wal"]) {
+      try {
+        chmodSync8(path4 + suffix, 420);
+      } catch {}
+    }
   } catch {}
   return db;
 }
@@ -75737,8 +75742,34 @@ function mapRow(row) {
     updated_at: row.updated_at
   };
 }
+function listDistinctThreadIds(db, chatId) {
+  const rows = db.prepare(`
+    SELECT DISTINCT thread_id FROM turns
+    WHERE chat_id = ?
+    ORDER BY thread_id ASC
+  `).all(chatId);
+  return rows.map((r) => r.thread_id);
+}
 function listTurnsForAgent(db, opts = {}) {
   const limit = Math.min(Math.max(1, opts.limit ?? 20), 200);
+  if (opts.chatId && "threadId" in opts) {
+    const rows2 = db.prepare(`
+      SELECT * FROM turns
+      WHERE chat_id = ? AND thread_id IS ?
+      ORDER BY started_at DESC
+      LIMIT ?
+    `).all(opts.chatId, opts.threadId ?? null, limit);
+    return rows2.map(mapRow);
+  }
+  if (opts.chatId) {
+    const rows2 = db.prepare(`
+      SELECT * FROM turns
+      WHERE chat_id = ?
+      ORDER BY started_at DESC
+      LIMIT ?
+    `).all(opts.chatId, limit);
+    return rows2.map(mapRow);
+  }
   const rows = db.prepare(`
     SELECT * FROM turns
     ORDER BY started_at DESC
@@ -75985,13 +76016,24 @@ async function handleGetLogs(name, lines = 50, deps = {}) {
   const fetchLogs = deps.fetchLogs ?? fetchAgentLogsViaHostd;
   return await fetchLogs(name, lines);
 }
-function handleGetTurns(config, agentName, limit) {
+function parseHermesSessionId(sessionId) {
+  const tilde = sessionId.indexOf("~");
+  if (tilde === -1)
+    return { agentName: sessionId };
+  return { agentName: sessionId.slice(0, tilde), threadId: sessionId.slice(tilde + 1) || null };
+}
+function handleGetTurns(config, sessionId, limit) {
   try {
+    const parsed = parseHermesSessionId(sessionId);
+    const agentName = parsed.agentName;
+    const hasThread = "threadId" in parsed;
     const agentsDir = resolveAgentsDir(config);
     const agentDir = resolve28(agentsDir, agentName);
+    const chatId = config.agents?.[agentName]?.channels?.telegram?.chat_id ?? undefined;
     const db = openTurnsDb(agentDir);
     try {
-      const turns = listTurnsForAgent(db, { limit });
+      const opts = chatId && hasThread ? { limit, chatId, threadId: parsed.threadId } : chatId ? { limit, chatId } : { limit };
+      const turns = listTurnsForAgent(db, opts);
       return { ok: true, turns };
     } finally {
       db.close();
@@ -76003,6 +76045,22 @@ function handleGetTurns(config, agentName, limit) {
     };
   }
 }
+function handleListThreadIds(config, agentName) {
+  try {
+    const chatId = config.agents?.[agentName]?.channels?.telegram?.chat_id;
+    if (!chatId)
+      return [];
+    const agentsDir = resolveAgentsDir(config);
+    const db = openTurnsDb(resolve28(agentsDir, agentName));
+    try {
+      return listDistinctThreadIds(db, chatId);
+    } finally {
+      db.close();
+    }
+  } catch {
+    return [];
+  }
+}
 function handleGetSubagents(config, agentName, status) {
   try {
     const agentsDir = resolveAgentsDir(config);
@@ -77519,12 +77577,28 @@ function agentLiveness(config, agentName) {
     return "idle";
   return "offline";
 }
-function toHermesSession(agent, liveness) {
+function sessionTitle(config, sessionId) {
+  const { agentName, threadId } = parseHermesSessionId(sessionId);
+  if (threadId === undefined)
+    return agentName;
+  const aliases = config.agents?.[agentName]?.channels?.telegram?.topic_aliases ?? {};
+  const byId = Object.fromEntries(Object.entries(aliases).map(([name2, id]) => [String(id), name2]));
+  if (threadId === null) {
+    return `${agentName} \u00b7 ${byId["1"] ?? "General"}`;
+  }
+  const name = byId[threadId];
+  return name ? `${agentName} \u00b7 ${name}` : `${agentName} \u00b7 ${threadId}`;
+}
+function isKnownSession(config, sessionId) {
+  const { agentName } = parseHermesSessionId(sessionId);
+  return !!config.agents?.[agentName];
+}
+function toHermesSession(sessionId, agent, liveness, config) {
   const nowSec = Math.floor(Date.now() / 1000);
   return {
-    id: agent.name,
-    name: agent.name,
-    title: agent.name,
+    id: sessionId,
+    name: sessionId,
+    title: sessionTitle(config, sessionId),
     status: liveness,
     model: "claude",
     is_active: liveness === "active",
@@ -77542,10 +77616,35 @@ function toHermesSession(agent, liveness) {
     quota: agent.primaryAccount ? { used_pct: null, slot: agent.primaryAccount } : null
   };
 }
-function resolveAgentChat(config, agentName, agentsDir) {
+async function buildAllSessions(config) {
+  const agents = await handleGetAgents(config);
+  const sessions = [];
+  for (const agent of agents) {
+    const liveness = agentLiveness(config, agent.name);
+    const chatId = config.agents?.[agent.name]?.channels?.telegram?.chat_id;
+    if (chatId) {
+      const threadIds = handleListThreadIds(config, agent.name);
+      if (threadIds.length === 0) {
+        sessions.push(toHermesSession(agent.name, agent, liveness, config));
+      } else {
+        for (const threadId of threadIds) {
+          const sessionId = threadId === null ? agent.name : `${agent.name}~${threadId}`;
+          sessions.push(toHermesSession(sessionId, agent, liveness, config));
+        }
+      }
+    } else {
+      sessions.push(toHermesSession(agent.name, agent, liveness, config));
+    }
+  }
+  return sessions;
+}
+function resolveAgentChat(config, sessionId, agentsDir) {
+  const { agentName, threadId: topicId } = parseHermesSessionId(sessionId);
   const channel = resolveChannelTarget(config, agentName);
-  if (channel)
-    return { chatId: channel.chatId, threadId: channel.threadId };
+  if (channel) {
+    const threadId = topicId !== undefined ? topicId === null ? undefined : parseInt(topicId, 10) || undefined : channel.threadId;
+    return { chatId: channel.chatId, threadId };
+  }
   const accessPath = resolve29(agentsDir, agentName, "telegram", "access.json");
   if (!existsSync51(accessPath))
     return null;
@@ -77637,15 +77736,26 @@ function cronJobRuns(schedule, jobId) {
   const agent = jobId.slice(0, tilde);
   const index = parseInt(jobId.slice(tilde + 1), 10);
   const fires = schedule.recentByAgent[agent] ?? [];
-  return fires.filter((f) => f.scheduleIndex === index).map((f) => ({
-    id: `${jobId}/${f.startedAt}`,
-    job_id: jobId,
-    started_at: new Date(f.startedAt).toISOString(),
-    finished_at: new Date(f.finishedAt).toISOString(),
-    exit_code: f.exitCode,
-    output: f.outputSummary,
-    status: f.exitCode === 0 ? "success" : "error"
-  }));
+  return fires.filter((f) => f.scheduleIndex === index).map((f) => {
+    const d = new Date(f.startedAt);
+    const name = d.toLocaleString("en-US", {
+      month: "short",
+      day: "numeric",
+      hour: "2-digit",
+      minute: "2-digit",
+      hour12: false
+    });
+    return {
+      id: `${jobId}/${f.startedAt}`,
+      job_id: jobId,
+      name,
+      started_at: new Date(f.startedAt).toISOString(),
+      finished_at: new Date(f.finishedAt).toISOString(),
+      exit_code: f.exitCode,
+      output: f.outputSummary,
+      status: f.exitCode === 0 ? "success" : "error"
+    };
+  });
 }
 function turnsToMessages(turns) {
   const messages = [];
@@ -77730,8 +77840,7 @@ function switchroomCommandsCatalog() {
 }
 async function handleHermesRest(method, pathname, config, search = "") {
   if (method === "GET" && (pathname === "/api/sessions" || pathname === "/api/profiles/sessions")) {
-    const agents = await handleGetAgents(config);
-    const sessions = agents.map((a) => toHermesSession(a, agentLiveness(config, a.name)));
+    const sessions = await buildAllSessions(config);
     return {
       status: 200,
       body: {
@@ -77746,22 +77855,21 @@ async function handleHermesRest(method, pathname, config, search = "") {
   const sessionMatch = pathname.match(/^\/api\/sessions\/([^/]+)$/);
   if (method === "GET" && sessionMatch) {
     const id = decodeURIComponent(sessionMatch[1]);
-    if (!config.agents?.[id])
+    if (!isKnownSession(config, id))
       return { status: 404, body: { error: "Unknown session" } };
+    const { agentName } = parseHermesSessionId(id);
     const agents = await handleGetAgents(config);
-    const agent = agents.find((a) => a.name === id);
+    const agent = agents.find((a) => a.name === agentName);
     if (!agent)
       return { status: 404, body: { error: "Unknown session" } };
-    return { status: 200, body: { session: toHermesSession(agent, agentLiveness(config, id)) } };
+    return { status: 200, body: { session: toHermesSession(id, agent, agentLiveness(config, agentName), config) } };
   }
   const messagesMatch = pathname.match(/^\/api\/sessions\/([^/]+)\/messages$/);
   if (method === "GET" && messagesMatch) {
     const id = decodeURIComponent(messagesMatch[1]);
-    if (!config.agents?.[id])
+    if (!isKnownSession(config, id))
       return { status: 404, body: { error: "Unknown session" } };
     const result = handleGetTurns(config, id, 100);
-    if (!result.ok)
-      return { status: 500, body: { error: result.error } };
     const messages = turnsToMessages(result.turns ?? []);
     return { status: 200, body: { session_id: id, messages } };
   }
@@ -77929,52 +78037,48 @@ async function onHermesMessage(ctx, raw) {
   const config = ctx.config;
   switch (req.method) {
     case "session.list": {
-      const agents = await handleGetAgents(config);
-      const sessions = agents.map((a) => toHermesSession(a, agentLiveness(config, a.name)));
+      const sessions = await buildAllSessions(config);
       sendResponse(ctx, rpcOk(id, { sessions }));
       break;
     }
     case "session.most_recent": {
-      const agents = await handleGetAgents(config);
-      if (agents.length === 0) {
-        sendResponse(ctx, rpcOk(id, { session: null }));
-        break;
-      }
-      const a = agents[0];
-      sendResponse(ctx, rpcOk(id, { session: toHermesSession(a, agentLiveness(config, a.name)) }));
+      const sessions = await buildAllSessions(config);
+      sendResponse(ctx, rpcOk(id, { session: sessions[0] ?? null }));
       break;
     }
     case "session.status": {
       const sessionId = String(params.session_id ?? "");
-      if (!config.agents?.[sessionId]) {
+      if (!isKnownSession(config, sessionId)) {
         sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
         break;
       }
+      const { agentName } = parseHermesSessionId(sessionId);
       const agents = await handleGetAgents(config);
-      const agent = agents.find((a) => a.name === sessionId);
+      const agent = agents.find((a) => a.name === agentName);
       if (!agent) {
         sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
         break;
       }
-      sendResponse(ctx, rpcOk(id, { session: toHermesSession(agent, agentLiveness(config, sessionId)) }));
+      sendResponse(ctx, rpcOk(id, { session: toHermesSession(sessionId, agent, agentLiveness(config, agentName), config) }));
       break;
     }
     case "session.create":
     case "session.resume":
     case "session.activate": {
       const sessionId = String(params.session_id ?? params.name ?? "");
-      if (!config.agents?.[sessionId]) {
+      if (!isKnownSession(config, sessionId)) {
         sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
         break;
       }
       ctx.activeSessionId = sessionId;
+      const { agentName } = parseHermesSessionId(sessionId);
       const agents = await handleGetAgents(config);
-      const agent = agents.find((a) => a.name === sessionId);
+      const agent = agents.find((a) => a.name === agentName);
       if (!agent) {
         sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
         break;
       }
-      const session = toHermesSession(agent, agentLiveness(config, sessionId));
+      const session = toHermesSession(sessionId, agent, agentLiveness(config, agentName), config);
       sendResponse(ctx, rpcOk(id, { session }));
       sendEvent(ctx, "session.info", sessionId, session);
       break;
@@ -77986,27 +78090,24 @@ async function onHermesMessage(ctx, raw) {
     }
     case "session.history": {
       const sessionId = String(params.session_id ?? ctx.activeSessionId ?? "");
-      if (!config.agents?.[sessionId]) {
+      if (!isKnownSession(config, sessionId)) {
         sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
         break;
       }
       const limit = typeof params.limit === "number" ? params.limit : 50;
       const result = handleGetTurns(config, sessionId, Math.min(limit, 200));
-      if (!result.ok) {
-        sendResponse(ctx, rpcErr(id, -32603, result.error ?? "Failed to read history"));
-        break;
-      }
       sendResponse(ctx, rpcOk(id, { session_id: sessionId, messages: turnsToMessages(result.turns ?? []) }));
       break;
     }
     case "session.usage": {
       const sessionId = String(params.session_id ?? ctx.activeSessionId ?? "");
-      if (!config.agents?.[sessionId]) {
+      if (!isKnownSession(config, sessionId)) {
         sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
         break;
       }
+      const { agentName: usageAgentName } = parseHermesSessionId(sessionId);
       const agents = await handleGetAgents(config);
-      const agent = agents.find((a) => a.name === sessionId);
+      const agent = agents.find((a) => a.name === usageAgentName);
       sendResponse(ctx, rpcOk(id, {
         session_id: sessionId,
         quota: agent?.primaryAccount ? { slot: agent.primaryAccount, state: agent.auth.subscriptionType ?? null } : null
@@ -78017,7 +78118,7 @@ async function onHermesMessage(ctx, raw) {
     case "prompt.background": {
       const sessionId = String(params.session_id ?? ctx.activeSessionId ?? "");
       const content = String(params.content ?? params.text ?? "");
-      if (!sessionId || !config.agents?.[sessionId]) {
+      if (!sessionId || !isKnownSession(config, sessionId)) {
         sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
         break;
       }
@@ -78025,6 +78126,7 @@ async function onHermesMessage(ctx, raw) {
         sendResponse(ctx, rpcErr(id, -32602, "content is required"));
         break;
       }
+      const { agentName: submitAgent } = parseHermesSessionId(sessionId);
       const agentsDir = resolveAgentsDir(config);
       const chat = resolveAgentChat(config, sessionId, agentsDir);
       if (!chat) {
@@ -78033,7 +78135,7 @@ async function onHermesMessage(ctx, raw) {
       }
       const promptKey = createHash10("sha256").update(`${sessionId}:${Date.now()}:${content}`).digest("hex").slice(0, 12);
       sendEvent(ctx, "message.start", sessionId, { prompt_key: promptKey });
-      const result = await injectInbound(agentsDir, sessionId, chat.chatId, chat.threadId, content, promptKey);
+      const result = await injectInbound(agentsDir, submitAgent, chat.chatId, chat.threadId, content, promptKey);
       if (!result.ok) {
         sendEvent(ctx, "error", sessionId, { message: result.error, prompt_key: promptKey });
         sendResponse(ctx, rpcErr(id, -32603, result.error ?? "inject failed"));
@@ -78052,10 +78154,11 @@ async function onHermesMessage(ctx, raw) {
     }
     case "session.interrupt": {
       const sessionId = String(params.session_id ?? ctx.activeSessionId ?? "");
-      if (!sessionId || !config.agents?.[sessionId]) {
+      if (!sessionId || !isKnownSession(config, sessionId)) {
         sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
         break;
       }
+      const { agentName: intAgent } = parseHermesSessionId(sessionId);
       const agentsDir = resolveAgentsDir(config);
       const chat = resolveAgentChat(config, sessionId, agentsDir);
       if (!chat) {
@@ -78063,7 +78166,7 @@ async function onHermesMessage(ctx, raw) {
         break;
       }
       const promptKey = `interrupt-${Date.now()}`;
-      const intResult = await injectInbound(agentsDir, sessionId, chat.chatId, chat.threadId, "! ", promptKey);
+      const intResult = await injectInbound(agentsDir, intAgent, chat.chatId, chat.threadId, "! ", promptKey);
       if (!intResult.ok) {
         sendResponse(ctx, rpcErr(id, -32603, intResult.error ?? "interrupt inject failed"));
         break;
@@ -78091,14 +78194,15 @@ async function onHermesMessage(ctx, raw) {
       const sessionId = String(params.session_id ?? ctx.activeSessionId ?? "");
       const key = String(params.key ?? "");
       const value = String(params.value ?? "");
-      if (key === "model" && sessionId && config.agents?.[sessionId]) {
+      if (key === "model" && sessionId && isKnownSession(config, sessionId)) {
         const modelName = value.replace(/\s+--provider\s+\S+$/, "").trim();
         if (modelName) {
           const agentsDir = resolveAgentsDir(config);
           const chat = resolveAgentChat(config, sessionId, agentsDir);
           if (chat) {
             const promptKey = `model-switch-${Date.now()}`;
-            injectInbound(agentsDir, sessionId, chat.chatId, chat.threadId, `/model ${modelName}`, promptKey);
+            const { agentName: modelAgent } = parseHermesSessionId(sessionId);
+            injectInbound(agentsDir, modelAgent, chat.chatId, chat.threadId, `/model ${modelName}`, promptKey);
           }
         }
       }
@@ -78113,7 +78217,7 @@ async function onHermesMessage(ctx, raw) {
       const sessionId = String(params.session_id ?? ctx.activeSessionId ?? "");
       const bare = String(params.command ?? "").replace(/^\/+/, "");
       const arg = params.arg != null ? String(params.arg) : "";
-      if (!sessionId || !config.agents?.[sessionId]) {
+      if (!sessionId || !isKnownSession(config, sessionId)) {
         sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
         break;
       }
@@ -78121,6 +78225,7 @@ async function onHermesMessage(ctx, raw) {
         sendResponse(ctx, rpcErr(id, -32602, "command is required"));
         break;
       }
+      const { agentName: slashAgent } = parseHermesSessionId(sessionId);
       const fullCommand = arg ? `/${bare} ${arg}` : `/${bare}`;
       const verb = `/${bare}`;
       if (INJECT_BLOCKLIST.has(verb)) {
@@ -78130,7 +78235,7 @@ async function onHermesMessage(ctx, raw) {
       if (INJECT_ALLOWLIST.has(verb)) {
         let injectResult;
         try {
-          injectResult = await injectSlashCommand(sessionId, fullCommand);
+          injectResult = await injectSlashCommand(slashAgent, fullCommand);
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           sendResponse(ctx, rpcErr(id, -32603, msg));
@@ -78147,7 +78252,7 @@ async function onHermesMessage(ctx, raw) {
         break;
       }
       const promptKey = `slash-${bare}-${Date.now()}`;
-      const result = await injectInbound(agentsDir, sessionId, chat.chatId, chat.threadId, fullCommand, promptKey);
+      const result = await injectInbound(agentsDir, slashAgent, chat.chatId, chat.threadId, fullCommand, promptKey);
       if (!result.ok) {
         sendResponse(ctx, rpcErr(id, -32603, result.error ?? "inject failed"));
         break;
@@ -89080,6 +89185,7 @@ import { spawnSync as spawnSync14 } from "node:child_process";
 
 // src/cli/skill-common.ts
 var import_yaml24 = __toESM(require_dist(), 1);
+var MAX_SKILLS_PER_AGENT2 = 20;
 var MAX_FILE_BYTES = 256 * 1024;
 var MAX_SKILL_BYTES = 2 * 1024 * 1024;
 var MAX_FILES_PER_SKILL = 50;
@@ -89252,6 +89358,45 @@ function validateSkillBundle(name, files) {
   }
   return { ok: errors2.length === 0, errors: errors2 };
 }
+var SECRET_RULE_LABELS = {
+  anthropic_api_key: "Anthropic API key (sk-ant-\u2026)",
+  anthropic_oauth_code: "Anthropic OAuth code",
+  openai_api_key: "API key (sk-\u2026)",
+  github_pat_classic: "GitHub personal access token (ghp_\u2026)",
+  github_pat_fine_grained: "GitHub fine-grained PAT (github_pat_\u2026)",
+  slack_token: "Slack token (xox\u2026)",
+  slack_app_token: "Slack app token (xapp-\u2026)",
+  google_api_key: "Google API key (AIza\u2026)",
+  aws_access_key: "AWS access key (AKIA\u2026)",
+  aws_temp_access_key: "AWS temporary access key (ASIA\u2026)",
+  jwt: "JWT",
+  pem_private_key: "PEM private-key block",
+  env_key_value: "KEY=value secret assignment",
+  json_secret_field: "JSON secret field",
+  bearer_auth_header: "Authorization: Bearer token",
+  bearer_loose: "Bearer token",
+  cli_flag: "secret CLI flag",
+  laravel_sanctum_token: "personal access token (id|token)",
+  telegram_bot_token: "Telegram bot token",
+  telegram_bot_token_prefixed: "Telegram bot token",
+  generic_high_entropy: "high-entropy string (likely a credential)"
+};
+function scanBundleForSecrets(files) {
+  const findings = [];
+  for (const [file, content] of Object.entries(files)) {
+    if (typeof content !== "string" || content.length === 0)
+      continue;
+    for (const d of detectSecrets(content)) {
+      findings.push({
+        file,
+        pattern: SECRET_RULE_LABELS[d.rule_id] ?? d.rule_id,
+        rule_id: d.rule_id,
+        offset: d.start
+      });
+    }
+  }
+  return findings;
+}
 
 // src/cli/skill.ts
 init_loader();
@@ -89741,6 +89886,17 @@ function personalSkillDir(agentsRoot, agent, name) {
 function trashDir(agentsRoot, agent) {
   return join85(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
+function countPersonalSkills(agentsRoot, agent) {
+  const skillsDir = join85(agentsRoot, agent, ".claude", "skills");
+  if (!existsSync84(skillsDir))
+    return 0;
+  let n = 0;
+  for (const ent of readdirSync32(skillsDir, { withFileTypes: true })) {
+    if (ent.isDirectory() && ent.name.startsWith(PERSONAL_PREFIX))
+      n += 1;
+  }
+  return n;
+}
 function readStdinSync2() {
   const chunks = [];
   const buf = Buffer.alloc(64 * 1024);
@@ -89934,6 +90090,12 @@ function loadValidateWrite(agentsRoot, agent, name, files, ensureNew) {
   if (!ensureNew && !exists) {
     fail4(`personal skill ${JSON.stringify(name)} does not exist for agent ${JSON.stringify(agent)}. ` + `Use \`skill init-personal\` to create it.`, 9);
   }
+  if (ensureNew) {
+    const existingCount = countPersonalSkills(agentsRoot, agent);
+    if (existingCount >= MAX_SKILLS_PER_AGENT2) {
+      fail4(`agent ${JSON.stringify(agent)} already has ${existingCount} personal skills ` + `(cap is ${MAX_SKILLS_PER_AGENT2}). Remove one with \`skill remove-personal\` ` + `before adding a new skill, or edit an existing skill instead.`, 15);
+    }
+  }
   const v = validateSkillBundle(name, files);
   if (!v.ok) {
     console.error(source_default.red("Validation failed:"));
@@ -89950,6 +90112,14 @@ function loadValidateWrite(agentsRoot, agent, name, files, ensureNew) {
     }
     process.exit(3);
   }
+  const secretFindings = scanBundleForSecrets(files);
+  if (secretFindings.length > 0) {
+    console.error(source_default.red("Secret scan failed \u2014 refusing to write skill:"));
+    for (const f of secretFindings) {
+      console.error(source_default.red(`  - ${f.file}: ${f.pattern} detected (at byte offset ${f.offset}). ` + `Remove the secret from the skill content and use the vault instead.`));
+    }
+    process.exit(3);
+  }
   writePersonalSkill(target, files);
 }
 function loadFiles(opts) {
@@ -90220,31 +90390,106 @@ function registerSkillPersonalCommands(program3) {
   }));
 }
 
+// src/cli/self-improve-propose-skill.ts
+import { createConnection as createConnection4 } from "node:net";
+import { homedir as homedir50 } from "node:os";
+import { join as join86 } from "node:path";
+import { readFileSync as readFileSync73 } from "node:fs";
+var IPC_CONNECT_TIMEOUT_MS = 5000;
+function gatewaySocketPath() {
+  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join86(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join86(homedir50(), ".claude", "channels", "telegram", "gateway.sock"));
+}
+function fail5(msg, code = 1) {
+  console.error(msg);
+  process.exit(code);
+}
+function sendProposal(payload) {
+  return new Promise((resolve52, reject) => {
+    const sock = createConnection4({ path: gatewaySocketPath() });
+    const t = setTimeout(() => {
+      sock.destroy();
+      reject(new Error("gateway IPC connect timeout"));
+    }, IPC_CONNECT_TIMEOUT_MS);
+    sock.on("connect", () => {
+      clearTimeout(t);
+      sock.write(JSON.stringify(payload) + `
+`, () => {
+        sock.end();
+        resolve52();
+      });
+    });
+    sock.on("error", (err2) => {
+      clearTimeout(t);
+      reject(new Error(`gateway IPC error: ${err2.message}`));
+    });
+  });
+}
+function registerSelfImproveProposeSkillCommand(program3) {
+  const parent = program3.commands.find((c) => c.name() === "self-improve") ?? program3.command("self-improve").description("Agent self-improvement ops");
+  parent.command("propose-skill").description("Surface a drafted personal skill as a one-tap Telegram approval card").requiredOption("--slug <slug>", "target personal-skill slug").requiredOption("--lesson <text>", "one-line lesson the skill captures").option("--evidence <text>", "evidence line (e.g. 'seen across 3 sessions')", "").option("--edit", "this is an edit to an existing personal skill (not new)").requiredOption("--draft <path>", "path to a JSON file mapping skill-relative paths to file contents").requiredOption("--chat <id>", "agent's own chat id to post the card to").option("--thread <id>", "forum topic thread id").option("--agent <name>", "agent name (defaults to $SWITCHROOM_AGENT_NAME)").action((opts) => {
+    const agent = opts.agent ?? process.env.SWITCHROOM_AGENT_NAME;
+    if (!agent)
+      fail5("agent name required (--agent or $SWITCHROOM_AGENT_NAME)");
+    let draft;
+    try {
+      draft = JSON.parse(readFileSync73(opts.draft, "utf-8"));
+    } catch (e) {
+      fail5(`failed to read/parse --draft: ${e.message}`);
+    }
+    if (typeof draft !== "object" || draft === null || Array.isArray(draft)) {
+      fail5("--draft must be a JSON object of { path: content }");
+    }
+    if (typeof draft["SKILL.md"] !== "string" || draft["SKILL.md"].length === 0) {
+      fail5("--draft must contain a non-empty SKILL.md");
+    }
+    const payload = {
+      type: "post_skill_proposal",
+      agentName: agent,
+      chatId: opts.chat,
+      skillSlug: opts.slug,
+      isNew: opts.edit !== true,
+      lesson: opts.lesson,
+      evidence: opts.evidence ?? "",
+      draft
+    };
+    if (opts.thread != null) {
+      const n = Number.parseInt(opts.thread, 10);
+      if (Number.isInteger(n))
+        payload.threadId = n;
+    }
+    sendProposal(payload).then(() => {
+      console.log(JSON.stringify({ ok: true, action: "propose-skill", slug: opts.slug, agent }));
+    }).catch((err2) => {
+      fail5(`propose-skill failed: ${err2.message}`);
+    });
+  });
+}
+
 // src/cli/skill-search.ts
 init_helpers();
 var import_yaml25 = __toESM(require_dist(), 1);
-import { existsSync as existsSync85, readdirSync as readdirSync33, readFileSync as readFileSync73, statSync as statSync36 } from "node:fs";
-import { homedir as homedir50 } from "node:os";
-import { join as join86, resolve as resolve52 } from "node:path";
+import { existsSync as existsSync85, readdirSync as readdirSync33, readFileSync as readFileSync74, statSync as statSync36 } from "node:fs";
+import { homedir as homedir51 } from "node:os";
+import { join as join87, resolve as resolve52 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
 function defaultAgentsRoot() {
-  return resolve52(homedir50(), ".switchroom/agents");
+  return resolve52(homedir51(), ".switchroom/agents");
 }
 function defaultSharedRoot2() {
-  return resolve52(homedir50(), ".switchroom/skills");
+  return resolve52(homedir51(), ".switchroom/skills");
 }
 function defaultBundledRoot2() {
-  return resolve52(homedir50(), ".switchroom/skills/_bundled");
+  return resolve52(homedir51(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join86(skillDir, "SKILL.md");
+  const mdPath = join87(skillDir, "SKILL.md");
   if (!existsSync85(mdPath))
     return null;
   let content;
   try {
-    content = readFileSync73(mdPath, "utf-8");
+    content = readFileSync74(mdPath, "utf-8");
   } catch {
     return null;
   }
@@ -90272,7 +90517,7 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join86(skillDir, "SKILL.md");
+  const mdPath = join87(skillDir, "SKILL.md");
   try {
     const st = statSync36(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
@@ -90283,7 +90528,7 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join86(agentsRoot, agent, ".claude/skills");
+  const skillsDir = join87(agentsRoot, agent, ".claude/skills");
   if (!existsSync85(skillsDir))
     return [];
   const out = [];
@@ -90296,7 +90541,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join86(skillsDir, ent);
+    const dirPath = join87(skillsDir, ent);
     try {
       if (!statSync36(dirPath).isDirectory())
         continue;
@@ -90336,7 +90581,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join86(sharedRoot, ent);
+    const dirPath = join87(sharedRoot, ent);
     try {
       if (!statSync36(dirPath).isDirectory())
         continue;
@@ -90372,7 +90617,7 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join86(bundledRoot, ent);
+    const dirPath = join87(bundledRoot, ent);
     try {
       if (!statSync36(dirPath).isDirectory())
         continue;
@@ -90516,9 +90761,9 @@ function registerHostdMcpCommand(program3) {
 // src/cli/hostd.ts
 init_source();
 init_helpers();
-import { existsSync as existsSync87, mkdirSync as mkdirSync49, readdirSync as readdirSync34, readFileSync as readFileSync75, writeFileSync as writeFileSync42, statSync as statSync37, copyFileSync as copyFileSync12 } from "node:fs";
-import { homedir as homedir51 } from "node:os";
-import { join as join87 } from "node:path";
+import { existsSync as existsSync87, mkdirSync as mkdirSync49, readdirSync as readdirSync34, readFileSync as readFileSync76, writeFileSync as writeFileSync42, statSync as statSync37, copyFileSync as copyFileSync12 } from "node:fs";
+import { homedir as homedir52 } from "node:os";
+import { join as join88 } from "node:path";
 import { spawnSync as spawnSync19 } from "node:child_process";
 
 // src/cli/deploy-version-guard.ts
@@ -90721,7 +90966,7 @@ networks:
 # operator surface; the daemon's stderr lands in \`docker logs switchroom-hostd\`.
 `;
 }
-function resolveHostdHostHome(env2 = process.env, home2 = homedir51()) {
+function resolveHostdHostHome(env2 = process.env, home2 = homedir52()) {
   const fromEnv = env2.SWITCHROOM_HOST_HOME?.trim();
   const resolved = fromEnv && fromEnv.length > 0 ? fromEnv : home2;
   if (resolved === "/host-home" || resolved.startsWith("/host-home/")) {
@@ -90732,10 +90977,10 @@ function resolveHostdHostHome(env2 = process.env, home2 = homedir51()) {
   return resolved;
 }
 function hostdDir() {
-  return join87(homedir51(), ".switchroom", "hostd");
+  return join88(homedir52(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join87(hostdDir(), "docker-compose.yml");
+  return join88(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
@@ -90862,7 +91107,7 @@ function doStatus() {
       for (const name of readdirSync34(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join87(dir, name, "sock");
+        const sockPath = join88(dir, name, "sock");
         if (existsSync87(sockPath)) {
           const st = statSync37(sockPath);
           if ((st.mode & 61440) === 49152) {
@@ -90911,7 +91156,7 @@ function registerHostdCommand(program3) {
 The log is created when hostd handles its first privileged-verb request.`));
       return;
     }
-    const raw = readFileSync75(logPath, "utf-8");
+    const raw = readFileSync76(logPath, "utf-8");
     const limit = Math.max(1, parseInt(opts.tail ?? "50", 10) || 50);
     const filters = {
       agent: opts.agent,
@@ -90954,8 +91199,8 @@ The log is created when hostd handles its first privileged-verb request.`));
 init_source();
 init_helpers();
 import { existsSync as existsSync88, mkdirSync as mkdirSync50, writeFileSync as writeFileSync43, copyFileSync as copyFileSync13 } from "node:fs";
-import { homedir as homedir52 } from "node:os";
-import { join as join88 } from "node:path";
+import { homedir as homedir53 } from "node:os";
+import { join as join89 } from "node:path";
 import { spawnSync as spawnSync20 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
@@ -91040,10 +91285,10 @@ services:
 `;
 }
 function webdDir() {
-  return join88(homedir52(), ".switchroom", "web");
+  return join89(homedir53(), ".switchroom", "web");
 }
 function webdComposePath() {
-  return join88(webdDir(), "docker-compose.yml");
+  return join89(webdDir(), "docker-compose.yml");
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
@@ -91085,7 +91330,7 @@ async function doInstall2(opts, program3) {
     return;
   }
   const yaml = renderWebComposeFile({
-    hostHome: homedir52(),
+    hostHome: homedir53(),
     imageTag,
     operatorUid
   });
@@ -91184,10 +91429,10 @@ function registerWebdCommand(program3) {
 
 // src/cli/host-repair.ts
 init_source();
-import { homedir as homedir53 } from "node:os";
-import { join as join89 } from "node:path";
+import { homedir as homedir54 } from "node:os";
+import { join as join90 } from "node:path";
 var ARTIFACT_ALLOWLIST = {
-  dockerComposePluginDir: (home2) => join89(home2, ".docker", "cli-plugins", "docker-compose"),
+  dockerComposePluginDir: (home2) => join90(home2, ".docker", "cli-plugins", "docker-compose"),
   stateSentinel: "/state"
 };
 function isStateBogusAutoDir(probe2) {
@@ -91236,7 +91481,7 @@ function isStateBogusAutoDir(probe2) {
   return true;
 }
 function planMountRepairs(probe2, opts = {}) {
-  const home2 = opts.hostHome ?? homedir53();
+  const home2 = opts.hostHome ?? homedir54();
   const items = [];
   const dockerComposePath = ARTIFACT_ALLOWLIST.dockerComposePluginDir(home2);
   const dockerComposeSt = probe2.lstat(dockerComposePath);
@@ -91472,6 +91717,7 @@ registerAgentConfigWriteCommands(program3);
 registerAgentConfigSkillWriteCommands(program3);
 registerSkillCommand(program3);
 registerSkillPersonalCommands(program3);
+registerSelfImproveProposeSkillCommand(program3);
 registerSkillSearchCommand(program3);
 registerAgentConfigMcpCommand(program3);
 registerHostdMcpCommand(program3);