switchroom 0.16.6 → 0.16.8

package/dist/cli/switchroom.js

@@ -29955,17 +29955,17 @@ var init_thinking_effort_risk = __esm(() => {
 
 // src/manifest.ts
 import {
-  existsSync as existsSync53,
-  readFileSync as readFileSync49,
+  existsSync as existsSync54,
+  readFileSync as readFileSync50,
   readdirSync as readdirSync19
 } from "node:fs";
-import { dirname as dirname14, join as join49 } from "node:path";
+import { dirname as dirname14, join as join50 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
 function locateManifestPath() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const candidate = join49(dir, "dependencies.json");
-    if (existsSync53(candidate))
+    const candidate = join50(dir, "dependencies.json");
+    if (existsSync54(candidate))
       return candidate;
     dir = dirname14(dir);
   }
@@ -29978,7 +29978,7 @@ function loadManifest(manifestPath) {
   }
   let raw;
   try {
-    raw = readFileSync49(path4, "utf-8");
+    raw = readFileSync50(path4, "utf-8");
   } catch (err) {
     throw new Error(`Failed to read manifest at ${path4}: ${err.message}`);
   }
@@ -30034,16 +30034,16 @@ function probeClaudeVersion() {
 }
 function probePlaywrightMcpVersion() {
   const home2 = process.env.HOME ?? "";
-  const npxCache = join49(home2, ".npm/_npx");
-  if (!existsSync53(npxCache))
+  const npxCache = join50(home2, ".npm/_npx");
+  if (!existsSync54(npxCache))
     return null;
   try {
     const entries = readdirSync19(npxCache);
     for (const entry of entries) {
-      const pkgPath = join49(npxCache, entry, "node_modules/@playwright/mcp/package.json");
-      if (existsSync53(pkgPath)) {
+      const pkgPath = join50(npxCache, entry, "node_modules/@playwright/mcp/package.json");
+      if (existsSync54(pkgPath)) {
         try {
-          const pkg = JSON.parse(readFileSync49(pkgPath, "utf-8"));
+          const pkg = JSON.parse(readFileSync50(pkgPath, "utf-8"));
           if (pkg.version)
             return pkg.version;
         } catch {}
@@ -30278,7 +30278,7 @@ var init_doctor_memory = __esm(() => {
 });
 
 // src/cli/doctor-docker.ts
-import { readFileSync as readFileSync50 } from "node:fs";
+import { readFileSync as readFileSync51 } from "node:fs";
 import { spawnSync as spawnSync7 } from "node:child_process";
 function imageTagOf(ref) {
   if (!ref)
@@ -30294,7 +30294,7 @@ function isDockerMode(opts) {
     return true;
   if (opts?.composePath) {
     try {
-      readFileSync50(opts.composePath, "utf8");
+      readFileSync51(opts.composePath, "utf8");
       return true;
     } catch {}
   }
@@ -30576,11 +30576,11 @@ var init_doctor_docker = __esm(() => {
 });
 
 // src/cli/doctor-auth-broker.ts
-import { existsSync as existsSync54, readFileSync as readFileSync51 } from "node:fs";
-import { createHash as createHash10 } from "node:crypto";
+import { existsSync as existsSync55, readFileSync as readFileSync52 } from "node:fs";
+import { createHash as createHash11 } from "node:crypto";
 import { spawnSync as spawnSync8 } from "node:child_process";
 import { homedir as homedir27 } from "node:os";
-import { join as join50 } from "node:path";
+import { join as join51 } from "node:path";
 function defaultDockerInspect(container, format) {
   try {
     const r = spawnSync8("docker", ["inspect", "-f", format, container], { encoding: "utf-8", timeout: 5000 });
@@ -30603,7 +30603,7 @@ function resolveStateDir(deps) {
   return deps.stateDir ?? resolveStatePath("state/auth-broker");
 }
 function sha256Hex(content) {
-  return createHash10("sha256").update(content).digest("hex");
+  return createHash11("sha256").update(content).digest("hex");
 }
 function checkAuthBrokerServiceHealth(deps = {}) {
   const inspect = deps.dockerInspect ?? defaultDockerInspect;
@@ -30680,8 +30680,8 @@ function checkAuthBrokerPerAgentSockets(config, deps = {}) {
 }
 function checkAuthBrokerDrift(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const indexPath = join50(stateDir, "sha-index.json");
-  if (!existsSync54(indexPath)) {
+  const indexPath = join51(stateDir, "sha-index.json");
+  if (!existsSync55(indexPath)) {
     return {
       name: "auth-broker: drift",
       status: "ok",
@@ -30690,7 +30690,7 @@ function checkAuthBrokerDrift(deps = {}) {
   }
   let index;
   try {
-    index = JSON.parse(readFileSync51(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync52(indexPath, "utf-8"));
   } catch (err) {
     return {
       name: "auth-broker: drift",
@@ -30704,13 +30704,13 @@ function checkAuthBrokerDrift(deps = {}) {
   const missingOnDisk = [];
   for (const [label, expected] of Object.entries(index)) {
     const credsPath = accountCredentialsPath(label, home2);
-    if (!existsSync54(credsPath)) {
+    if (!existsSync55(credsPath)) {
       missingOnDisk.push(label);
       continue;
     }
     let got;
     try {
-      got = sha256Hex(readFileSync51(credsPath, "utf-8"));
+      got = sha256Hex(readFileSync52(credsPath, "utf-8"));
     } catch (err) {
       divergent.push(`${label} (read failed: ${err.message})`);
       continue;
@@ -30741,8 +30741,8 @@ function checkAuthBrokerDrift(deps = {}) {
 }
 function checkAuthBrokerThresholdViolations(deps = {}) {
   const stateDir = resolveStateDir(deps);
-  const path4 = join50(stateDir, "threshold-violations.json");
-  if (!existsSync54(path4)) {
+  const path4 = join51(stateDir, "threshold-violations.json");
+  if (!existsSync55(path4)) {
     return {
       name: "auth-broker: threshold violations",
       status: "ok",
@@ -30751,7 +30751,7 @@ function checkAuthBrokerThresholdViolations(deps = {}) {
   }
   let violations;
   try {
-    violations = JSON.parse(readFileSync51(path4, "utf-8"));
+    violations = JSON.parse(readFileSync52(path4, "utf-8"));
   } catch (err) {
     return {
       name: "auth-broker: threshold violations",
@@ -30787,7 +30787,7 @@ function checkAuthBrokerActiveAccount(config, deps = {}) {
   }
   const home2 = deps.home ?? homedir27();
   const dir = accountDir(active, home2);
-  if (!existsSync54(dir)) {
+  if (!existsSync55(dir)) {
     return {
       name: "auth-broker: fleet active account",
       status: "fail",
@@ -30796,7 +30796,7 @@ function checkAuthBrokerActiveAccount(config, deps = {}) {
     };
   }
   const creds = accountCredentialsPath(active, home2);
-  if (!existsSync54(creds)) {
+  if (!existsSync55(creds)) {
     return {
       name: "auth-broker: fleet active account",
       status: "fail",
@@ -30933,17 +30933,17 @@ var init_doctor_hostd = () => {};
 import {
   accessSync,
   constants as fsConstants4,
-  existsSync as existsSync55,
+  existsSync as existsSync56,
   realpathSync as realpathSync5,
   statSync as statSync23
 } from "node:fs";
 import { userInfo, homedir as homedir28 } from "node:os";
-import { join as join51 } from "node:path";
+import { join as join52 } from "node:path";
 function resolveVaultPath2(config) {
   return config.vault?.path ? config.vault.path.replace(/^~/, process.env.HOME ?? "") : resolveStatePath("vault.enc");
 }
 function defaultStatVault(path4) {
-  if (!existsSync55(path4)) {
+  if (!existsSync56(path4)) {
     return { exists: false, readable: false, uid: -1, mode: 0, realPath: path4 };
   }
   let real = path4;
@@ -31076,7 +31076,7 @@ async function runSecretAccessChecks(config, deps = {}) {
   };
   const passphrase = deps.passphrase ?? process.env.SWITCHROOM_VAULT_PASSPHRASE;
   if (!passphrase) {
-    const sock = deps.brokerOperatorSocket ?? join51(homedir28(), ".switchroom", "broker-operator", "sock");
+    const sock = deps.brokerOperatorSocket ?? join52(homedir28(), ".switchroom", "broker-operator", "sock");
     const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
     for (const name of Object.keys(config.agents ?? {})) {
       const resolved = resolveAgentConfig(config.defaults, config.profiles, config.agents[name]);
@@ -31161,7 +31161,7 @@ import {
   existsSync as realExistsSync,
   readFileSync as realReadFileSync
 } from "node:fs";
-import { join as join52, resolve as resolve31 } from "node:path";
+import { join as join53, resolve as resolve32 } from "node:path";
 import { homedir as homedir29 } from "node:os";
 function resolveDeps(config, deps) {
   let agentsDir = deps.agentsDir;
@@ -31276,7 +31276,7 @@ function checkScaffoldWiring(config, driveAgents, d) {
     ];
   }
   for (const name of driveAgents) {
-    const agentDir = resolve31(d.agentsDir, name);
+    const agentDir = resolve32(d.agentsDir, name);
     if (!d.existsSync(agentDir)) {
       results.push({
         name: `drive: ${name} scaffold`,
@@ -31285,8 +31285,8 @@ function checkScaffoldWiring(config, driveAgents, d) {
       });
       continue;
     }
-    const mcpPath = join52(agentDir, ".mcp.json");
-    const claudeJsonPath = join52(agentDir, ".claude", ".claude.json");
+    const mcpPath = join53(agentDir, ".mcp.json");
+    const claudeJsonPath = join53(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson(d, mcpPath);
     const trustRead = readJson(d, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -31314,7 +31314,7 @@ function checkScaffoldWiring(config, driveAgents, d) {
     let trustOk = false;
     let trustDetail = "no .claude/.claude.json";
     if (trustRead.kind === "ok") {
-      const proj = trustRead.data?.projects?.[resolve31(agentDir)];
+      const proj = trustRead.data?.projects?.[resolve32(agentDir)];
       const enabled = proj?.enabledMcpjsonServers;
       if (Array.isArray(enabled) && enabled.includes("gdrive")) {
         trustOk = true;
@@ -31399,7 +31399,7 @@ async function runDriveBrokerReachabilityChecks(config, deps = {}) {
       }
     ];
   }
-  const sock = deps.brokerOperatorSocket ?? join52(homedir29(), ".switchroom", "broker-operator", "sock");
+  const sock = deps.brokerOperatorSocket ?? join53(homedir29(), ".switchroom", "broker-operator", "sock");
   const preflight = deps.preflight ?? ((a, k) => defaultPreflight(sock, a, k));
   const results = [];
   for (const agent of driveAgents) {
@@ -31453,7 +31453,7 @@ import {
   readSync as realReadSync,
   closeSync as realCloseSync
 } from "node:fs";
-import { join as join53 } from "node:path";
+import { join as join54 } from "node:path";
 import { homedir as homedir30 } from "node:os";
 function defaultReadHead(p, n) {
   let fd;
@@ -31511,7 +31511,7 @@ function runWebkiteChecks(config, deps = {}) {
     return [];
   const d = resolveDeps2(config, deps);
   const results = [];
-  const binPath = join53(d.homeDir, ".switchroom", "bin", "webkite");
+  const binPath = join54(d.homeDir, ".switchroom", "bin", "webkite");
   if (!d.existsSync(binPath)) {
     results.push({
       name: "webkite: binary",
@@ -31541,12 +31541,12 @@ function runWebkiteChecks(config, deps = {}) {
       });
     }
   }
-  const cloakDir = join53(d.homeDir, ".cloakbrowser");
+  const cloakDir = join54(d.homeDir, ".cloakbrowser");
   let chromeFound = false;
   if (d.existsSync(cloakDir)) {
     try {
       for (const entry of d.readdirSync(cloakDir)) {
-        if (entry.startsWith("chromium-") && d.existsSync(join53(cloakDir, entry, "chrome"))) {
+        if (entry.startsWith("chromium-") && d.existsSync(join54(cloakDir, entry, "chrome"))) {
           chromeFound = true;
           break;
         }
@@ -31572,9 +31572,9 @@ function runWebkiteChecks(config, deps = {}) {
     return results;
   }
   for (const agent of enabledAgents) {
-    const agentDir = join53(d.agentsDir, agent);
-    const settingsPath = join53(agentDir, ".claude", "settings.json");
-    const mcpPath = join53(agentDir, ".mcp.json");
+    const agentDir = join54(d.agentsDir, agent);
+    const settingsPath = join54(agentDir, ".claude", "settings.json");
+    const mcpPath = join54(agentDir, ".mcp.json");
     if (!d.existsSync(settingsPath) && !d.existsSync(mcpPath)) {
       continue;
     }
@@ -31639,7 +31639,7 @@ var init_doctor_webkite = __esm(() => {
 
 // src/cli/doctor-cron-session.ts
 import { statSync as realStatSync } from "node:fs";
-import { resolve as resolve32 } from "node:path";
+import { resolve as resolve33 } from "node:path";
 function agentRunsCronSession(config, agent) {
   const raw = config.agents[agent];
   if (!raw)
@@ -31655,7 +31655,7 @@ function runCronSessionChecks(config, deps = defaultDeps2) {
     if (!agentRunsCronSession(config, agent))
       continue;
     const name = `cron-session: ${agent}`;
-    const alivePath = resolve32(agentsDir, agent, "telegram", ".bridge-alive-cron");
+    const alivePath = resolve33(agentsDir, agent, "telegram", ".bridge-alive-cron");
     let mtimeMs;
     try {
       mtimeMs = deps.statMtimeMs(alivePath);
@@ -31704,7 +31704,7 @@ var init_doctor_cron_session = __esm(() => {
 });
 
 // src/cli/doctor-scaffold-wiring.ts
-import { join as join54, resolve as resolve33 } from "node:path";
+import { join as join55, resolve as resolve34 } from "node:path";
 function readJson2(d, path4) {
   if (!d.existsSync(path4))
     return { kind: "absent" };
@@ -31738,7 +31738,7 @@ function checkIntegrationScaffoldWiring(args) {
     ];
   }
   for (const name of agents) {
-    const agentDir = resolve33(agentsDir, name);
+    const agentDir = resolve34(agentsDir, name);
     if (!deps.existsSync(agentDir)) {
       results.push({
         name: `${label}: ${name} scaffold`,
@@ -31747,8 +31747,8 @@ function checkIntegrationScaffoldWiring(args) {
       });
       continue;
     }
-    const mcpPath = join54(agentDir, ".mcp.json");
-    const claudeJsonPath = join54(agentDir, ".claude", ".claude.json");
+    const mcpPath = join55(agentDir, ".mcp.json");
+    const claudeJsonPath = join55(agentDir, ".claude", ".claude.json");
     const mcpRead = readJson2(deps, mcpPath);
     const trustRead = readJson2(deps, claudeJsonPath);
     if (mcpRead.kind === "unreadable" || trustRead.kind === "unreadable") {
@@ -31778,7 +31778,7 @@ function checkIntegrationScaffoldWiring(args) {
     let trustDetail = "no .claude/.claude.json";
     if (trustRead.kind === "ok") {
       const projects = trustRead.data?.projects ?? {};
-      const proj = projects[resolve33(agentDir)];
+      const proj = projects[resolve34(agentDir)];
       const enabled = proj?.enabledMcpjsonServers;
       if (Array.isArray(enabled) && enabled.includes(mcpKey)) {
         trustOk = true;
@@ -31812,14 +31812,14 @@ import {
   existsSync as realExistsSync3,
   readFileSync as realReadFileSync3
 } from "node:fs";
-import { join as join55 } from "node:path";
+import { join as join56 } from "node:path";
 import { homedir as homedir31 } from "node:os";
 function resolveDeps3(deps) {
   const home2 = deps.homeDir?.() ?? homedir31();
   return {
     existsSync: deps.existsSync ?? realExistsSync3,
     readFileSync: deps.readFileSync ?? realReadFileSync3,
-    agentsDir: join55(home2, ".switchroom", "agents"),
+    agentsDir: join56(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now
   };
 }
@@ -31902,7 +31902,7 @@ function checkOAuthClient2(config, anyAgentEnabled) {
   ];
 }
 function readHeartbeat(d, agentName) {
-  const path4 = join55(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
+  const path4 = join56(d.agentsDir, agentName, "m365-launcher.heartbeat.json");
   if (!d.existsSync(path4)) {
     return { error: "heartbeat file missing \u2014 launcher has not yet started" };
   }
@@ -31999,7 +31999,7 @@ import {
   readFileSync as realReadFileSync4,
   statSync as realStatSync2
 } from "node:fs";
-import { join as join56 } from "node:path";
+import { join as join57 } from "node:path";
 import { homedir as homedir32 } from "node:os";
 function resolveDeps4(deps) {
   const home2 = deps.homeDir?.() ?? homedir32();
@@ -32007,7 +32007,7 @@ function resolveDeps4(deps) {
     existsSync: deps.existsSync ?? realExistsSync4,
     readFileSync: deps.readFileSync ?? realReadFileSync4,
     statSync: deps.statSync ?? realStatSync2,
-    agentsDir: join56(home2, ".switchroom", "agents"),
+    agentsDir: join57(home2, ".switchroom", "agents"),
     now: deps.now ?? Date.now,
     vaultAclReader: deps.vaultAclReader ?? (async () => ({ kind: "unreachable", msg: "no default reader wired" }))
   };
@@ -32132,7 +32132,7 @@ function checkLauncherHeartbeat2(notionAgents, d) {
     return [];
   const results = [];
   for (const name of notionAgents) {
-    const heartbeatPath = join56(d.agentsDir, name, "notion-launcher.heartbeat.json");
+    const heartbeatPath = join57(d.agentsDir, name, "notion-launcher.heartbeat.json");
     if (!d.existsSync(heartbeatPath)) {
       results.push({
         name: `notion:launcher-heartbeat:${name}`,
@@ -32354,10 +32354,10 @@ import {
   statSync as realStatSync3
 } from "node:fs";
 import { homedir as homedir33 } from "node:os";
-import { join as join57 } from "node:path";
+import { join as join58 } from "node:path";
 function runCredentialsMigrationChecks(config, deps = {}) {
-  const credDir = deps.credentialsDir ?? join57(homedir33(), ".switchroom", "credentials");
-  const existsSync56 = deps.existsSync ?? ((p) => realExistsSync5(p));
+  const credDir = deps.credentialsDir ?? join58(homedir33(), ".switchroom", "credentials");
+  const existsSync57 = deps.existsSync ?? ((p) => realExistsSync5(p));
   const readdirSync21 = deps.readdirSync ?? ((p) => realReaddirSync2(p));
   const isDirectory = deps.isDirectory ?? ((p) => {
     try {
@@ -32366,7 +32366,7 @@ function runCredentialsMigrationChecks(config, deps = {}) {
       return false;
     }
   });
-  if (!existsSync56(credDir))
+  if (!existsSync57(credDir))
     return [];
   const agentNames = new Set(Object.keys(config.agents ?? {}));
   let entries;
@@ -32384,7 +32384,7 @@ function runCredentialsMigrationChecks(config, deps = {}) {
   const flat = [];
   const perAgentDirs = [];
   for (const e of entries) {
-    const full = join57(credDir, e);
+    const full = join58(credDir, e);
     if (isDirectory(full) && agentNames.has(e)) {
       perAgentDirs.push(e);
     } else {
@@ -32508,13 +32508,13 @@ var init_doctor_inlined_secrets = __esm(() => {
 // src/cli/doctor-audit-integrity.ts
 import { readFileSync as fsReadFileSync2 } from "node:fs";
 import { homedir as homedir34 } from "node:os";
-import { join as join58 } from "node:path";
+import { join as join59 } from "node:path";
 function rootWrittenLogs(home2) {
   return [
-    { label: "vault-broker", path: join58(home2, ".switchroom", "vault-audit.log") },
+    { label: "vault-broker", path: join59(home2, ".switchroom", "vault-audit.log") },
     {
       label: "hostd",
-      path: join58(home2, ".switchroom", "host-control-audit.log")
+      path: join59(home2, ".switchroom", "host-control-audit.log")
     }
   ];
 }
@@ -32576,16 +32576,16 @@ var init_doctor_audit_integrity = __esm(() => {
 });
 
 // src/cli/doctor-agent-smoke.ts
-import { existsSync as existsSync56 } from "node:fs";
+import { existsSync as existsSync57 } from "node:fs";
 import { homedir as homedir35 } from "node:os";
-import { join as join59 } from "node:path";
+import { join as join60 } from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 async function runAgentSmokeChecks(config, deps = {}) {
   if (deps.fast)
     return [];
   const home2 = deps.homeDir ?? homedir35();
-  const sock = deps.operatorSockPath ?? join59(home2, ".switchroom", "hostd", "operator", "sock");
-  if (!deps.hostdRequestImpl && !existsSync56(sock)) {
+  const sock = deps.operatorSockPath ?? join60(home2, ".switchroom", "hostd", "operator", "sock");
+  if (!deps.hostdRequestImpl && !existsSync57(sock)) {
     return [
       {
         name: "agent liveness",
@@ -32663,9 +32663,9 @@ var init_doctor_agent_smoke = __esm(() => {
 
 // src/cli/doctor-vault-broker-durability.ts
 import { execFileSync as execFileSync18 } from "node:child_process";
-import { existsSync as existsSync57, statSync as statSync24 } from "node:fs";
+import { existsSync as existsSync58, statSync as statSync24 } from "node:fs";
 import { homedir as homedir36 } from "node:os";
-import { join as join60 } from "node:path";
+import { join as join61 } from "node:path";
 function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   const statHost = opts?.statHost ?? defaultStatHost;
   const statBroker = opts?.statBroker ?? defaultStatBroker;
@@ -32687,7 +32687,7 @@ function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   };
 }
 function defaultStatHost(p) {
-  if (!existsSync57(p))
+  if (!existsSync58(p))
     return null;
   try {
     const s = statSync24(p, { bigint: true });
@@ -32814,16 +32814,16 @@ function runVaultBrokerDurabilityChecks(_config, opts) {
     probeBrokerUnlocked(opts?.statusProbe),
     probeAutoUnlockBlob(home2),
     probeMachineIdMount(),
-    formatBindMountResult("vault-broker: vault.enc bind mount", join60(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join60(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
-    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join60(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join60(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
-    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join60(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join60(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
+    formatBindMountResult("vault-broker: vault.enc bind mount", join61(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join61(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
+    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join61(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join61(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
+    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join61(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join61(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
     probeKernelDbDurability(home2, {
       statBroker: opts?.kernelStatBroker
     })
   ];
 }
 function probeKernelDbDurability(home2, opts) {
-  const hostDir = join60(home2, ".switchroom", "approvals");
+  const hostDir = join61(home2, ".switchroom", "approvals");
   const containerDir = "/state/approvals";
   const name = "approval-kernel: approvals bind mount (allow_always durability)";
   const kernelStat = opts?.statBroker ?? defaultKernelStatBroker;
@@ -32891,8 +32891,8 @@ function defaultKernelStatBroker(p) {
   return { kind: "ok-with-stat", ino: inoStr, size };
 }
 function probeAutoUnlockBlob(home2) {
-  const blobPath = join60(home2, ".switchroom", "vault-auto-unlock");
-  if (!existsSync57(blobPath)) {
+  const blobPath = join61(home2, ".switchroom", "vault-auto-unlock");
+  if (!existsSync58(blobPath)) {
     return {
       name: "vault-broker: auto-unlock blob",
       status: "warn",
@@ -32916,7 +32916,7 @@ function probeAutoUnlockBlob(home2) {
   };
 }
 function probeMachineIdMount() {
-  const hostExists = existsSync57("/etc/machine-id");
+  const hostExists = existsSync58("/etc/machine-id");
   if (!hostExists) {
     return {
       name: "vault-broker: machine-id passthrough",
@@ -33064,23 +33064,23 @@ import { execSync as execSync3, spawnSync as spawnSync10 } from "node:child_proc
 import {
   accessSync as accessSync2,
   constants as fsConstants5,
-  existsSync as existsSync58,
+  existsSync as existsSync59,
   lstatSync as lstatSync7,
   mkdirSync as mkdirSync31,
-  readFileSync as readFileSync52,
+  readFileSync as readFileSync53,
   readdirSync as readdirSync21,
   statSync as statSync25
 } from "node:fs";
-import { dirname as dirname15, join as join61, resolve as resolve34 } from "node:path";
+import { dirname as dirname15, join as join62, resolve as resolve35 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
-  const nvmRoot = join61(process.env.HOME ?? "", ".nvm", "versions", "node");
-  if (!existsSync58(nvmRoot))
+  const nvmRoot = join62(process.env.HOME ?? "", ".nvm", "versions", "node");
+  if (!existsSync59(nvmRoot))
     return null;
   try {
     const versions = readdirSync21(nvmRoot).sort().reverse();
     for (const v of versions) {
-      const candidate = join61(nvmRoot, v, "bin", bin);
+      const candidate = join62(nvmRoot, v, "bin", bin);
       try {
         const s = statSync25(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
@@ -33245,21 +33245,21 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
   if (envBrowsersPath && envBrowsersPath.length > 0) {
     cacheLocations.push(envBrowsersPath);
   }
-  cacheLocations.push(join61(homeDir, ".cache", "ms-playwright"));
+  cacheLocations.push(join62(homeDir, ".cache", "ms-playwright"));
   for (const cacheDir of cacheLocations) {
-    if (!existsSync58(cacheDir))
+    if (!existsSync59(cacheDir))
       continue;
     try {
       const entries = readdirSync21(cacheDir).filter((e) => e.startsWith("chromium"));
       for (const entry of entries) {
         const candidates2 = [
-          join61(cacheDir, entry, "chrome-linux64", "chrome"),
-          join61(cacheDir, entry, "chrome-linux", "chrome"),
-          join61(cacheDir, entry, "chrome-linux64", "headless_shell"),
-          join61(cacheDir, entry, "chrome-linux", "headless_shell")
+          join62(cacheDir, entry, "chrome-linux64", "chrome"),
+          join62(cacheDir, entry, "chrome-linux", "chrome"),
+          join62(cacheDir, entry, "chrome-linux64", "headless_shell"),
+          join62(cacheDir, entry, "chrome-linux", "headless_shell")
         ];
         for (const path4 of candidates2) {
-          if (existsSync58(path4))
+          if (existsSync59(path4))
             return path4;
         }
       }
@@ -33388,7 +33388,7 @@ function checkDeployMounts(opts) {
   const home2 = opts?.home ?? process.env.HOME ?? "/root";
   const { pathKind } = opts?.deps ?? DEFAULT_DEPLOY_MOUNTS_DEPS;
   const results = [];
-  const dockerComposePlugin = join61(home2, ".docker", "cli-plugins", "docker-compose");
+  const dockerComposePlugin = join62(home2, ".docker", "cli-plugins", "docker-compose");
   const pluginKind = pathKind(dockerComposePlugin);
   if (pluginKind === "dir") {
     results.push({
@@ -33426,8 +33426,8 @@ function checkDeployMounts(opts) {
 function checkLegacyState() {
   const results = [];
   const h = process.env.HOME ?? "/root";
-  const clerkDir = join61(h, LEGACY_STATE_DIR);
-  const clerkPresent = existsSync58(clerkDir);
+  const clerkDir = join62(h, LEGACY_STATE_DIR);
+  const clerkPresent = existsSync59(clerkDir);
   results.push({
     name: "legacy ~/.clerk state",
     status: clerkPresent ? "warn" : "ok",
@@ -33436,7 +33436,7 @@ function checkLegacyState() {
       fix: "Legacy state detected. Run `mv ~/.clerk ~/.switchroom` and rename " + "any top-level `clerk:` key in switchroom.yaml to `switchroom:`. " + "This back-compat shim is REMOVED in v0.13.0 \u2014 no automatic " + "migration exists."
     } : {}
   });
-  const legacySock = join61(h, ".switchroom", "vault-broker.sock");
+  const legacySock = join62(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
     sockStat = lstatSync7(legacySock);
@@ -33557,7 +33557,7 @@ function checkVault(config) {
     detail: "Approval auth: passphrase (two-factor)"
   };
   const pairsResult = checkVaultBrokerSocketPairs(config);
-  if (!existsSync58(vaultPath)) {
+  if (!existsSync59(vaultPath)) {
     return [
       postureResult,
       {
@@ -33819,8 +33819,8 @@ async function checkHindsight(config) {
 }
 function checkPendingRetainsQueue(dir) {
   const home2 = process.env.HOME ?? "";
-  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join61(home2, ".hindsight", "pending-retains");
-  if (!existsSync58(pendingDir)) {
+  const pendingDir = dir ?? process.env.HINDSIGHT_PENDING_DIR ?? join62(home2, ".hindsight", "pending-retains");
+  if (!existsSync59(pendingDir)) {
     return {
       name: "pending-retains queue",
       status: "ok",
@@ -33879,7 +33879,7 @@ function classifyReadError(err) {
 }
 function tryReadHostFile(path4) {
   try {
-    return { kind: "ok", content: readFileSync52(path4, "utf-8") };
+    return { kind: "ok", content: readFileSync53(path4, "utf-8") };
   } catch (err) {
     const kind = classifyReadError(err);
     const error = err?.message ?? String(err);
@@ -33891,11 +33891,11 @@ function tryReadHostFile(path4) {
   }
 }
 function parseEnvFile(path4) {
-  if (!existsSync58(path4))
+  if (!existsSync59(path4))
     return {};
   let content;
   try {
-    content = readFileSync52(path4, "utf-8");
+    content = readFileSync53(path4, "utf-8");
   } catch {
     return {};
   }
@@ -33950,7 +33950,7 @@ async function checkTelegram(config) {
     const plugin = agentConfig.channels?.telegram?.plugin ?? "switchroom";
     if (plugin !== "switchroom")
       continue;
-    const envPath = join61(agentsDir, name, "telegram", ".env");
+    const envPath = join62(agentsDir, name, "telegram", ".env");
     const read = tryReadHostFile(envPath);
     if (read.kind === "eacces") {
       results.push({
@@ -34002,7 +34002,7 @@ async function checkTelegram(config) {
 }
 function checkStartShStale(agentName, startShPath) {
   const label = `${agentName}: start.sh scheduler block`;
-  if (!existsSync58(startShPath)) {
+  if (!existsSync59(startShPath)) {
     return {
       name: label,
       status: "warn",
@@ -34012,7 +34012,7 @@ function checkStartShStale(agentName, startShPath) {
   }
   let content;
   try {
-    content = readFileSync52(startShPath, "utf-8");
+    content = readFileSync53(startShPath, "utf-8");
   } catch (err) {
     return {
       name: label,
@@ -34033,7 +34033,7 @@ function checkStartShStale(agentName, startShPath) {
 }
 function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const label = `${agentName}: $HOME/.switchroom symlink (#910)`;
-  const path4 = join61(agentDir, "home", ".switchroom");
+  const path4 = join62(agentDir, "home", ".switchroom");
   let stats;
   try {
     stats = lstatSync7(path4);
@@ -34070,8 +34070,8 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
 }
 function checkRepoHygiene(repoRoot) {
   const results = [];
-  const exportDir = join61(repoRoot, "clerk-export");
-  if (existsSync58(exportDir)) {
+  const exportDir = join62(repoRoot, "clerk-export");
+  if (existsSync59(exportDir)) {
     results.push({
       name: "repo hygiene: clerk-export/ on disk (#1072)",
       status: "warn",
@@ -34079,8 +34079,8 @@ function checkRepoHygiene(repoRoot) {
       fix: `Run scripts/migrate-clerk-export-to-vault.sh to move the bundle ` + `into the vault, then delete the on-disk copy.`
     });
   }
-  const knownTarball = join61(repoRoot, "clerk-export-with-secrets.tar.gz");
-  if (existsSync58(knownTarball)) {
+  const knownTarball = join62(repoRoot, "clerk-export-with-secrets.tar.gz");
+  if (existsSync59(knownTarball)) {
     results.push({
       name: "repo hygiene: clerk-export-with-secrets.tar.gz on disk (#1072)",
       status: "warn",
@@ -34097,7 +34097,7 @@ function checkRepoHygiene(repoRoot) {
         results.push({
           name: `repo hygiene: ${name} on disk (#1072)`,
           status: "warn",
-          detail: `${join61(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
+          detail: `${join62(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
           fix: `Inspect, migrate any secrets into the vault, then delete the ` + `archive.`
         });
       }
@@ -34120,12 +34120,12 @@ function checkRepoHygiene(repoRoot) {
 }
 function isSwitchroomCheckout(dir) {
   try {
-    if (!existsSync58(join61(dir, ".git")))
+    if (!existsSync59(join62(dir, ".git")))
       return false;
-    const pkgPath = join61(dir, "package.json");
-    if (!existsSync58(pkgPath))
+    const pkgPath = join62(dir, "package.json");
+    if (!existsSync59(pkgPath))
       return false;
-    const pkg = JSON.parse(readFileSync52(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync53(pkgPath, "utf-8"));
     return pkg.name === "switchroom";
   } catch {
     return false;
@@ -34137,8 +34137,8 @@ function checkAgents(config, configPath) {
   const statuses = getAllAgentStatuses(config);
   const authStatuses = getAllAuthStatuses(config);
   for (const [name, agentConfig] of Object.entries(config.agents)) {
-    const agentDir = resolve34(agentsDir, name);
-    if (!existsSync58(agentDir)) {
+    const agentDir = resolve35(agentsDir, name);
+    if (!existsSync59(agentDir)) {
       results.push({
         name: `${name}: scaffold`,
         status: "fail",
@@ -34159,7 +34159,7 @@ function checkAgents(config, configPath) {
         fix: `Rotate the bot token (e.g. via \`switchroom vault\`), then run ` + `\`switchroom agent unquarantine ${name}\` and \`switchroom agent restart ${name}\``
       });
     }
-    results.push(checkStartShStale(name, join61(agentDir, "start.sh")));
+    results.push(checkStartShStale(name, join62(agentDir, "start.sh")));
     results.push(checkLeakedHomeSwitchroom(name, agentDir));
     const status = statuses[name];
     const active = status?.active ?? "unknown";
@@ -34236,8 +34236,8 @@ function checkAgents(config, configPath) {
       }
     }
     if (agentConfig.channels?.telegram?.plugin === "switchroom") {
-      const mcpJsonPath = join61(agentDir, ".mcp.json");
-      if (!existsSync58(mcpJsonPath)) {
+      const mcpJsonPath = join62(agentDir, ".mcp.json");
+      if (!existsSync59(mcpJsonPath)) {
         results.push({
           name: `${name}: .mcp.json`,
           status: "fail",
@@ -34246,7 +34246,7 @@ function checkAgents(config, configPath) {
         });
       } else {
         try {
-          const mcp = JSON.parse(readFileSync52(mcpJsonPath, "utf-8"));
+          const mcp = JSON.parse(readFileSync53(mcpJsonPath, "utf-8"));
           const hasSwitchroomTelegram = !!mcp.mcpServers?.["switchroom-telegram"];
           const memoryEnabled = isHindsightEnabled(config);
           const hasHindsight = !!mcp.mcpServers?.hindsight;
@@ -34320,10 +34320,10 @@ function mffAgentName(config) {
 function mffEnvPath(config) {
   const home2 = process.env.HOME ?? "/root";
   const agent = mffAgentName(config);
-  return agent ? resolve34(home2, ".switchroom/credentials", agent, "my-family-finance/.env") : resolve34(home2, ".switchroom/credentials/my-family-finance/.env");
+  return agent ? resolve35(home2, ".switchroom/credentials", agent, "my-family-finance/.env") : resolve35(home2, ".switchroom/credentials/my-family-finance/.env");
 }
 function mffEnvState(envPath) {
-  if (!existsSync58(envPath))
+  if (!existsSync59(envPath))
     return "absent";
   try {
     accessSync2(envPath, fsConstants5.R_OK);
@@ -34341,7 +34341,7 @@ function checkMffVaultKeyPresent(passphrase, vaultPath) {
       fix: "Export SWITCHROOM_VAULT_PASSPHRASE to enable MFF vault probes"
     };
   }
-  if (!existsSync58(vaultPath)) {
+  if (!existsSync59(vaultPath)) {
     return {
       name: "mff: vault key present",
       status: "fail",
@@ -34394,7 +34394,7 @@ function deriveEd25519PublicKeyBytes(keyMaterial) {
   }
 }
 function checkMffVaultKeyFormat(passphrase, vaultPath) {
-  if (!passphrase || !existsSync58(vaultPath)) {
+  if (!passphrase || !existsSync59(vaultPath)) {
     return {
       name: "mff: vault key format",
       status: "warn",
@@ -34538,8 +34538,8 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
     };
   }
   const credDir = dirname15(envPath);
-  const authScript = join61(credDir, "claude-auth.py");
-  if (!existsSync58(authScript)) {
+  const authScript = join62(credDir, "claude-auth.py");
+  if (!existsSync59(authScript)) {
     return {
       name: "mff: auth flow",
       status: "warn",
@@ -34736,16 +34736,16 @@ async function checkManifestDrift(probers) {
   return results;
 }
 function runDockerSection(config) {
-  const composePath = resolve34(process.env.HOME ?? "", ".switchroom", "compose", "docker-compose.yml");
+  const composePath = resolve35(process.env.HOME ?? "", ".switchroom", "compose", "docker-compose.yml");
   const active = isDockerMode({ composePath });
   let composeYaml;
   let dockerfileAgent;
   try {
-    composeYaml = readFileSync52(composePath, "utf8");
+    composeYaml = readFileSync53(composePath, "utf8");
   } catch {}
-  const dockerfilePath = resolve34(process.env.HOME ?? "", ".switchroom", "docker", "Dockerfile.agent");
+  const dockerfilePath = resolve35(process.env.HOME ?? "", ".switchroom", "docker", "Dockerfile.agent");
   try {
-    dockerfileAgent = readFileSync52(dockerfilePath, "utf8");
+    dockerfileAgent = readFileSync53(dockerfilePath, "utf8");
   } catch {}
   return runDockerChecks({
     config,
@@ -43244,7 +43244,7 @@ class Protocol {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1000;
-        await new Promise((resolve52) => setTimeout(resolve52, pollInterval));
+        await new Promise((resolve53) => setTimeout(resolve53, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -43256,7 +43256,7 @@ class Protocol {
   }
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve52, reject) => {
+    return new Promise((resolve53, reject) => {
       const earlyReject = (error2) => {
         reject(error2);
       };
@@ -43334,7 +43334,7 @@ class Protocol {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve52(parseResult.data);
+            resolve53(parseResult.data);
           }
         } catch (error2) {
           reject(error2);
@@ -43525,12 +43525,12 @@ class Protocol {
         interval = task.pollInterval;
       }
     } catch {}
-    return new Promise((resolve52, reject) => {
+    return new Promise((resolve53, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode2.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve52, interval);
+      const timeoutId = setTimeout(resolve53, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode2.InvalidRequest, "Request cancelled"));
@@ -46515,7 +46515,7 @@ var require_compile = __commonJS((exports2) => {
     const schOrFunc = root.refs[ref];
     if (schOrFunc)
       return schOrFunc;
-    let _sch = resolve52.call(this, root, ref);
+    let _sch = resolve53.call(this, root, ref);
     if (_sch === undefined) {
       const schema = (_a = root.localRefs) === null || _a === undefined ? undefined : _a[ref];
       const { schemaId } = this.opts;
@@ -46542,7 +46542,7 @@ var require_compile = __commonJS((exports2) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve52(root, ref) {
+  function resolve53(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string")
       ref = sch;
@@ -47072,7 +47072,7 @@ var require_fast_uri = __commonJS((exports2, module) => {
     }
     return uri;
   }
-  function resolve52(baseURI, relativeURI, options) {
+  function resolve53(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse6(baseURI, schemelessOptions), parse6(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
@@ -47300,7 +47300,7 @@ var require_fast_uri = __commonJS((exports2, module) => {
   var fastUri = {
     SCHEMES,
     normalize,
-    resolve: resolve52,
+    resolve: resolve53,
     resolveComponent,
     equal,
     serialize,
@@ -50683,12 +50683,12 @@ class StdioServerTransport {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve52) => {
+    return new Promise((resolve53) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve52();
+        resolve53();
       } else {
-        this._stdout.once("drain", resolve52);
+        this._stdout.once("drain", resolve53);
       }
     });
   }
@@ -51200,7 +51200,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes15 } from "node:crypto";
-import { existsSync as existsSync85, readFileSync as readFileSync73 } from "node:fs";
+import { existsSync as existsSync86, readFileSync as readFileSync74 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -51218,7 +51218,7 @@ async function dispatchTool2(name, args) {
     return errorText2("hostd MCP: SWITCHROOM_AGENT_NAME env var is not set \u2014 cannot " + "determine which per-agent socket to talk to.");
   }
   const sockPath = selfSocketPath();
-  if (!existsSync85(sockPath)) {
+  if (!existsSync86(sockPath)) {
     return errorText2(`hostd MCP: socket not bound at ${sockPath}. The host-control ` + `daemon is either not installed (run \`switchroom hostd install\`) ` + `or this agent isn't admin-flagged in switchroom.yaml. RFC C ` + `bind-mounts the per-agent socket only when host_control.enabled ` + `is true AND the agent has admin: true.`);
   }
   let req;
@@ -51393,18 +51393,18 @@ function resolveAuditLogPath() {
   if (process.env.HOSTD_AUDIT_LOG_PATH)
     return process.env.HOSTD_AUDIT_LOG_PATH;
   const bindMounted = "/host-home/.switchroom/host-control-audit.log";
-  if (existsSync85(bindMounted))
+  if (existsSync86(bindMounted))
     return bindMounted;
   return defaultAuditLogPath2();
 }
 function getLastUpdateApplyStatus() {
   const path8 = resolveAuditLogPath();
-  if (!existsSync85(path8)) {
+  if (!existsSync86(path8)) {
     return errorText2(`get_status: audit log not found at ${path8}. No update_apply has run yet?`);
   }
   let raw;
   try {
-    raw = readFileSync73(path8, "utf-8");
+    raw = readFileSync74(path8, "utf-8");
   } catch (err2) {
     return errorText2(`get_status: failed to read audit log at ${path8}: ${err2.message}`);
   }
@@ -51674,8 +51674,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.16.6";
-var COMMIT_SHA = "925f5798";
+var VERSION = "0.16.8";
+var COMMIT_SHA = "c2668516";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
@@ -70449,8 +70449,8 @@ init_merge();
 init_loader();
 init_client();
 import {
-  readFileSync as readFileSync47,
-  existsSync as existsSync51,
+  readFileSync as readFileSync48,
+  existsSync as existsSync52,
   realpathSync as realpathSync4,
   mkdirSync as mkdirSync29,
   openSync as openSync10,
@@ -70458,7 +70458,7 @@ import {
   writeSync as writeSync6,
   constants as fsConstants3
 } from "node:fs";
-import { resolve as resolve29, extname, join as join48, relative, dirname as dirname12 } from "node:path";
+import { resolve as resolve30, extname, join as join49, relative, dirname as dirname12 } from "node:path";
 import { homedir as homedir26 } from "node:os";
 import { timingSafeEqual as timingSafeEqual3, randomBytes as randomBytes11 } from "node:crypto";
 
@@ -77286,6 +77286,388 @@ async function handleWebhookIngest(args, deps = {}) {
   return jsonReply(202, { ok: true, recorded: true, ts: now });
 }
 
+// src/web/hermes-adapter.ts
+init_loader();
+import { createConnection as createConnection3 } from "node:net";
+import { createHash as createHash10 } from "node:crypto";
+import { join as join48, resolve as resolve29 } from "node:path";
+import { existsSync as existsSync51, readFileSync as readFileSync47 } from "node:fs";
+
+// src/agent-scheduler/channel-target.ts
+init_merge();
+function resolveChannelTarget(config, agentName) {
+  const agent = config.agents?.[agentName];
+  const tgChannel = agent ? resolveAgentConfig(config.defaults, config.profiles, agent).channels?.telegram : undefined;
+  const supergroupChatId = tgChannel?.chat_id;
+  const supergroupDefaultTopic = tgChannel?.default_topic_id;
+  if (typeof supergroupChatId === "string" && supergroupChatId.length > 0) {
+    return {
+      chatId: supergroupChatId,
+      ...typeof supergroupDefaultTopic === "number" ? { threadId: supergroupDefaultTopic } : {},
+      routerConfig: {
+        ...typeof supergroupDefaultTopic === "number" ? { default_topic_id: supergroupDefaultTopic } : {},
+        ...tgChannel?.topic_aliases ? { topic_aliases: tgChannel.topic_aliases } : {}
+      }
+    };
+  }
+  const forumChatId = config.telegram?.forum_chat_id;
+  if (typeof forumChatId !== "string" || forumChatId.length === 0)
+    return null;
+  const threadId = agent?.topic_id;
+  return {
+    chatId: forumChatId,
+    ...typeof threadId === "number" ? { threadId } : {}
+  };
+}
+
+// src/web/hermes-adapter.ts
+function rpcOk(id, result) {
+  return { jsonrpc: "2.0", id, result };
+}
+function rpcErr(id, code, message, data) {
+  return { jsonrpc: "2.0", id, error: { code, message, ...data !== undefined ? { data } : {} } };
+}
+function hermesEvent(type, sessionId, payload) {
+  return { jsonrpc: "2.0", method: "event", params: { type, session_id: sessionId, payload } };
+}
+function agentLiveness(config, agentName) {
+  const agentsDir = resolveAgentsDir(config);
+  if (agentBridgeAlive(agentsDir, agentName))
+    return "active";
+  const alive = join48(agentsDir, agentName, "telegram", ".bridge-alive");
+  if (existsSync51(alive))
+    return "idle";
+  return "offline";
+}
+function toHermesSession(agent, liveness) {
+  return {
+    id: agent.name,
+    name: agent.name,
+    status: liveness,
+    model: "claude",
+    created_at: null,
+    updated_at: null,
+    quota: agent.primaryAccount ? { used_pct: null, slot: agent.primaryAccount } : null
+  };
+}
+function resolveAgentChat(config, agentName, agentsDir) {
+  const channel = resolveChannelTarget(config, agentName);
+  if (channel)
+    return { chatId: channel.chatId, threadId: channel.threadId };
+  const accessPath = resolve29(agentsDir, agentName, "telegram", "access.json");
+  if (!existsSync51(accessPath))
+    return null;
+  try {
+    const raw = readFileSync47(accessPath, "utf-8");
+    const access = JSON.parse(raw);
+    const chatId = access.allowFrom?.[0];
+    if (!chatId)
+      return null;
+    return { chatId };
+  } catch {
+    return null;
+  }
+}
+async function injectInbound(agentsDir, agentName, chatId, threadId, text, promptKey) {
+  const socketPath = resolve29(agentsDir, agentName, "telegram", "gateway.sock");
+  if (!existsSync51(socketPath)) {
+    return { ok: false, error: `agent ${agentName} gateway socket not found \u2014 is it running?` };
+  }
+  const ts = Date.now();
+  const envelope = JSON.stringify({
+    type: "inject_inbound",
+    agentName,
+    inbound: {
+      type: "inbound",
+      chatId,
+      ...threadId !== undefined ? { threadId } : {},
+      messageId: ts,
+      user: "operator",
+      userId: 0,
+      ts,
+      text,
+      meta: {
+        source: "operator-console",
+        prompt_key: promptKey
+      }
+    }
+  });
+  return new Promise((res) => {
+    const sock = createConnection3(socketPath);
+    let settled = false;
+    const settle = (result) => {
+      if (!settled) {
+        settled = true;
+        sock.destroy();
+        res(result);
+      }
+    };
+    const timeout = setTimeout(() => settle({ ok: false, error: "gateway socket timeout" }), 5000);
+    sock.once("connect", () => {
+      clearTimeout(timeout);
+      sock.write(envelope + `
+`, (err) => {
+        settle(err ? { ok: false, error: err.message } : { ok: true });
+      });
+    });
+    sock.once("error", (err) => {
+      clearTimeout(timeout);
+      settle({ ok: false, error: err.message });
+    });
+  });
+}
+async function handleHermesRest(method, pathname, config) {
+  if (method === "GET" && pathname === "/api/sessions") {
+    const agents = await handleGetAgents(config);
+    const agentsDir = resolveAgentsDir(config);
+    const sessions = agents.map((a) => toHermesSession(a, agentLiveness(config, a.name)));
+    return { status: 200, body: { sessions } };
+  }
+  const sessionMatch = pathname.match(/^\/api\/sessions\/([^/]+)$/);
+  if (method === "GET" && sessionMatch) {
+    const id = decodeURIComponent(sessionMatch[1]);
+    if (!config.agents?.[id])
+      return { status: 404, body: { error: "Unknown session" } };
+    const agents = await handleGetAgents(config);
+    const agent = agents.find((a) => a.name === id);
+    if (!agent)
+      return { status: 404, body: { error: "Unknown session" } };
+    return { status: 200, body: { session: toHermesSession(agent, agentLiveness(config, id)) } };
+  }
+  const historyMatch = pathname.match(/^\/api\/sessions\/([^/]+)\/history$/);
+  if (method === "GET" && historyMatch) {
+    const id = decodeURIComponent(historyMatch[1]);
+    if (!config.agents?.[id])
+      return { status: 404, body: { error: "Unknown session" } };
+    const result = handleGetTurns(config, id, 50);
+    if (!result.ok)
+      return { status: 500, body: { error: result.error } };
+    return { status: 200, body: { history: result.turns ?? [] } };
+  }
+  if (method === "GET" && pathname === "/api/status") {
+    const agents = await handleGetAgents(config);
+    const fleet = agents.map((a) => ({
+      name: a.name,
+      status: agentLiveness(config, a.name)
+    }));
+    return {
+      status: 200,
+      body: {
+        status: "ok",
+        provider: "switchroom",
+        agents: fleet
+      }
+    };
+  }
+  if (method === "GET" && pathname === "/api/config") {
+    const agentNames = Object.keys(config.agents ?? {});
+    return {
+      status: 200,
+      body: {
+        provider: "switchroom",
+        agents: agentNames
+      }
+    };
+  }
+  return null;
+}
+function sendEvent(ctx, type, sessionId, payload) {
+  try {
+    ctx.send(JSON.stringify(hermesEvent(type, sessionId, payload)));
+  } catch {}
+}
+function sendResponse(ctx, resp) {
+  try {
+    ctx.send(JSON.stringify(resp));
+  } catch {}
+}
+function onHermesOpen(ctx) {
+  sendEvent(ctx, "gateway.ready", null, {
+    provider: "switchroom",
+    version: "1.0"
+  });
+  ctx.pollInterval = setInterval(async () => {
+    const agents = await handleGetAgents(ctx.config);
+    for (const agent of agents) {
+      const liveness = agentLiveness(ctx.config, agent.name);
+      sendEvent(ctx, "status.update", agent.name, { status: liveness });
+    }
+  }, 5000);
+}
+function onHermesClose(ctx) {
+  if (ctx.pollInterval) {
+    clearInterval(ctx.pollInterval);
+    ctx.pollInterval = undefined;
+  }
+}
+async function onHermesMessage(ctx, raw) {
+  let req;
+  try {
+    req = JSON.parse(raw);
+  } catch {
+    sendResponse(ctx, rpcErr(null, -32700, "Parse error"));
+    return;
+  }
+  if (!req.method || typeof req.method !== "string") {
+    sendResponse(ctx, rpcErr(req.id ?? null, -32600, "Invalid request"));
+    return;
+  }
+  const id = req.id ?? null;
+  const params = req.params ?? {};
+  const config = ctx.config;
+  switch (req.method) {
+    case "session.list": {
+      const agents = await handleGetAgents(config);
+      const sessions = agents.map((a) => toHermesSession(a, agentLiveness(config, a.name)));
+      sendResponse(ctx, rpcOk(id, { sessions }));
+      break;
+    }
+    case "session.most_recent": {
+      const agents = await handleGetAgents(config);
+      if (agents.length === 0) {
+        sendResponse(ctx, rpcOk(id, { session: null }));
+        break;
+      }
+      const a = agents[0];
+      sendResponse(ctx, rpcOk(id, { session: toHermesSession(a, agentLiveness(config, a.name)) }));
+      break;
+    }
+    case "session.status": {
+      const sessionId = String(params.session_id ?? "");
+      if (!config.agents?.[sessionId]) {
+        sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
+        break;
+      }
+      const agents = await handleGetAgents(config);
+      const agent = agents.find((a) => a.name === sessionId);
+      if (!agent) {
+        sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
+        break;
+      }
+      sendResponse(ctx, rpcOk(id, { session: toHermesSession(agent, agentLiveness(config, sessionId)) }));
+      break;
+    }
+    case "session.create":
+    case "session.resume":
+    case "session.activate": {
+      const sessionId = String(params.session_id ?? params.name ?? "");
+      if (!config.agents?.[sessionId]) {
+        sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
+        break;
+      }
+      ctx.activeSessionId = sessionId;
+      const agents = await handleGetAgents(config);
+      const agent = agents.find((a) => a.name === sessionId);
+      if (!agent) {
+        sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
+        break;
+      }
+      const session = toHermesSession(agent, agentLiveness(config, sessionId));
+      sendResponse(ctx, rpcOk(id, { session }));
+      sendEvent(ctx, "session.info", sessionId, session);
+      break;
+    }
+    case "session.close": {
+      ctx.activeSessionId = undefined;
+      sendResponse(ctx, rpcOk(id, { ok: true }));
+      break;
+    }
+    case "session.history": {
+      const sessionId = String(params.session_id ?? ctx.activeSessionId ?? "");
+      if (!config.agents?.[sessionId]) {
+        sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
+        break;
+      }
+      const limit = typeof params.limit === "number" ? params.limit : 50;
+      const result = handleGetTurns(config, sessionId, Math.min(limit, 200));
+      if (!result.ok) {
+        sendResponse(ctx, rpcErr(id, -32603, result.error ?? "Failed to read history"));
+        break;
+      }
+      sendResponse(ctx, rpcOk(id, { history: result.turns ?? [] }));
+      break;
+    }
+    case "session.usage": {
+      const sessionId = String(params.session_id ?? ctx.activeSessionId ?? "");
+      if (!config.agents?.[sessionId]) {
+        sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
+        break;
+      }
+      const agents = await handleGetAgents(config);
+      const agent = agents.find((a) => a.name === sessionId);
+      sendResponse(ctx, rpcOk(id, {
+        session_id: sessionId,
+        quota: agent?.primaryAccount ? { slot: agent.primaryAccount, state: agent.auth.subscriptionType ?? null } : null
+      }));
+      break;
+    }
+    case "prompt.submit":
+    case "prompt.background": {
+      const sessionId = String(params.session_id ?? ctx.activeSessionId ?? "");
+      const content = String(params.content ?? params.text ?? "");
+      if (!sessionId || !config.agents?.[sessionId]) {
+        sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
+        break;
+      }
+      if (!content) {
+        sendResponse(ctx, rpcErr(id, -32602, "content is required"));
+        break;
+      }
+      const agentsDir = resolveAgentsDir(config);
+      const chat = resolveAgentChat(config, sessionId, agentsDir);
+      if (!chat) {
+        sendResponse(ctx, rpcErr(id, -32603, `Could not resolve chat for ${sessionId} \u2014 ensure the agent has telegram.forum_chat_id or channels.telegram.chat_id configured.`));
+        break;
+      }
+      const promptKey = createHash10("sha256").update(`${sessionId}:${Date.now()}:${content}`).digest("hex").slice(0, 12);
+      sendEvent(ctx, "message.start", sessionId, { prompt_key: promptKey });
+      const result = await injectInbound(agentsDir, sessionId, chat.chatId, chat.threadId, content, promptKey);
+      if (!result.ok) {
+        sendEvent(ctx, "error", sessionId, { message: result.error, prompt_key: promptKey });
+        sendResponse(ctx, rpcErr(id, -32603, result.error ?? "inject failed"));
+        break;
+      }
+      sendEvent(ctx, "message.complete", sessionId, {
+        prompt_key: promptKey,
+        note: "reply delivered to Telegram thread"
+      });
+      sendResponse(ctx, rpcOk(id, { ok: true, prompt_key: promptKey }));
+      break;
+    }
+    case "session.interrupt": {
+      const sessionId = String(params.session_id ?? ctx.activeSessionId ?? "");
+      if (!sessionId || !config.agents?.[sessionId]) {
+        sendResponse(ctx, rpcErr(id, -32602, `Unknown session: ${sessionId}`));
+        break;
+      }
+      const agentsDir = resolveAgentsDir(config);
+      const chat = resolveAgentChat(config, sessionId, agentsDir);
+      if (!chat) {
+        sendResponse(ctx, rpcErr(id, -32603, `Cannot resolve chat for ${sessionId}`));
+        break;
+      }
+      const promptKey = `interrupt-${Date.now()}`;
+      const intResult = await injectInbound(agentsDir, sessionId, chat.chatId, chat.threadId, "! ", promptKey);
+      if (!intResult.ok) {
+        sendResponse(ctx, rpcErr(id, -32603, intResult.error ?? "interrupt inject failed"));
+        break;
+      }
+      sendResponse(ctx, rpcOk(id, { ok: true }));
+      break;
+    }
+    case "approval.request":
+    case "approval.respond":
+    case "sudo.request":
+    case "sudo.respond":
+    case "secret.get":
+    case "secret.set":
+      sendResponse(ctx, rpcErr(id, -32601, `Method not implemented: ${req.method}`));
+      break;
+    default:
+      sendResponse(ctx, rpcErr(id, -32601, `Unknown method: ${req.method}`));
+  }
+}
+
 // src/web/server.ts
 var LOG_POLL_INTERVAL_MS = 3000;
 var LOG_POLL_TAIL_LINES = 400;
@@ -77337,9 +77719,9 @@ function resolveWebToken() {
   if (fromEnv && fromEnv.length > 0)
     return fromEnv;
   const home2 = process.env.HOME ?? homedir26();
-  const tokenPath = join48(home2, ".switchroom", "web-token");
-  if (existsSync51(tokenPath)) {
-    const existing = readFileSync47(tokenPath, "utf8").trim();
+  const tokenPath = join49(home2, ".switchroom", "web-token");
+  if (existsSync52(tokenPath)) {
+    const existing = readFileSync48(tokenPath, "utf8").trim();
     if (existing.length > 0)
       return existing;
   }
@@ -77356,7 +77738,7 @@ function resolveWebToken() {
     return token;
   } catch (err) {
     if (err.code === "EEXIST") {
-      const existing = readFileSync47(tokenPath, "utf8").trim();
+      const existing = readFileSync48(tokenPath, "utf8").trim();
       if (existing.length > 0)
         return existing;
     }
@@ -77422,11 +77804,11 @@ function checkWsAuth(req, token, server) {
   return presented !== null && constantTimeEqual(presented, token);
 }
 function loadWebhookSecrets() {
-  const path4 = join48(homedir26(), ".switchroom", "webhook-secrets.json");
-  if (!existsSync51(path4))
+  const path4 = join49(homedir26(), ".switchroom", "webhook-secrets.json");
+  if (!existsSync52(path4))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync47(path4, "utf-8"));
+    const parsed = JSON.parse(readFileSync48(path4, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (err) {
     process.stderr.write(`webhook-ingest: failed to parse ${path4}: ${err.message} \u2014 webhooks will return 401 until fixed
@@ -77604,8 +77986,8 @@ function parseRoute(pathname, method) {
   return null;
 }
 function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
-  const uiDirRaw = resolve29(import.meta.dirname, "ui");
-  const uiDir = existsSync51(uiDirRaw) ? realpathSync4(uiDirRaw) : uiDirRaw;
+  const uiDirRaw = resolve30(import.meta.dirname, "ui");
+  const uiDir = existsSync52(uiDirRaw) ? realpathSync4(uiDirRaw) : uiDirRaw;
   const token = resolveWebToken();
   const freshConfig = () => {
     if (!configPath)
@@ -77653,6 +78035,21 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         }
         return;
       }
+      if (pathname === "/api/ws") {
+        if (!checkWsAuth(req, token, server2)) {
+          return new Response("Unauthorized", { status: 401 });
+        }
+        const wsProto = req.headers.get("Sec-WebSocket-Protocol");
+        const echoBearer = wsProto && wsProto.split(",").map((s) => s.trim()).includes("bearer");
+        const upgraded = server2.upgrade(req, {
+          headers: echoBearer ? { "Sec-WebSocket-Protocol": "bearer" } : undefined,
+          data: { hermesWs: true }
+        });
+        if (!upgraded) {
+          return new Response("WebSocket upgrade failed", { status: 400 });
+        }
+        return;
+      }
       const route = parseRoute(pathname, req.method);
       if (route) {
         const authError = checkAuth(req, token, server2);
@@ -77871,9 +78268,21 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
           }
         }
       }
+      if (pathname.startsWith("/api/")) {
+        const authError = checkAuth(req, token, server2);
+        if (authError)
+          return authError;
+        return (async () => {
+          const hermesResult = await handleHermesRest(req.method, pathname, config);
+          if (hermesResult !== null) {
+            return jsonResponse(hermesResult.body, hermesResult.status);
+          }
+          return new Response("Not Found", { status: 404 });
+        })();
+      }
       const filePath = resolveDashboardFilePath(pathname);
-      const fullPath = join48(uiDir, filePath);
-      if (!existsSync51(fullPath)) {
+      const fullPath = join49(uiDir, filePath);
+      if (!existsSync52(fullPath)) {
         return new Response("Not Found", { status: 404 });
       }
       let realFullPath;
@@ -77883,12 +78292,12 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         return new Response("Not Found", { status: 404 });
       }
       const rel = relative(uiDir, realFullPath);
-      if (rel.startsWith("..") || resolve29(uiDir, rel) !== realFullPath) {
+      if (rel.startsWith("..") || resolve30(uiDir, rel) !== realFullPath) {
         return new Response("Forbidden", { status: 403 });
       }
       const ext = extname(realFullPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
-      const content = readFileSync47(realFullPath);
+      const content = readFileSync48(realFullPath);
       const headers = { "Content-Type": contentType };
       const cacheControl = dashboardCacheControl(ext);
       if (cacheControl)
@@ -77896,8 +78305,26 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
       return new Response(content, { headers });
     },
     websocket: {
-      open(_ws) {},
+      open(ws) {
+        if (ws.data?.hermesWs) {
+          const ctx = {
+            config,
+            send: (msg) => {
+              try {
+                ws.send(msg);
+              } catch {}
+            }
+          };
+          ws._hermesCtx = ctx;
+          onHermesOpen(ctx);
+        }
+      },
       close(ws) {
+        if (ws._hermesCtx) {
+          onHermesClose(ws._hermesCtx);
+          delete ws._hermesCtx;
+          return;
+        }
         const interval = ws._logInterval;
         if (interval) {
           clearInterval(interval);
@@ -77905,6 +78332,10 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         }
       },
       message(ws, message) {
+        if (ws._hermesCtx) {
+          onHermesMessage(ws._hermesCtx, String(message));
+          return;
+        }
         let data;
         try {
           data = JSON.parse(String(message));
@@ -78039,8 +78470,8 @@ Starting Switchroom dashboard...
 // src/cli/setup.ts
 init_source();
 init_loader();
-import { existsSync as existsSync52, copyFileSync as copyFileSync8, readFileSync as readFileSync48, writeFileSync as writeFileSync27, mkdirSync as mkdirSync30 } from "node:fs";
-import { resolve as resolve30, dirname as dirname13 } from "node:path";
+import { existsSync as existsSync53, copyFileSync as copyFileSync8, readFileSync as readFileSync49, writeFileSync as writeFileSync27, mkdirSync as mkdirSync30 } from "node:fs";
+import { resolve as resolve31, dirname as dirname13 } from "node:path";
 init_vault();
 init_manager();
 init_client();
@@ -78257,7 +78688,7 @@ async function stepConfigFile(configPath, nonInteractive) {
       existingConfig = null;
     }
   }
-  if (existingConfig && existsSync52(existingConfig)) {
+  if (existingConfig && existsSync53(existingConfig)) {
     if (!nonInteractive) {
       const useExisting = await askYesNo(`  Found ${source_default.cyan(existingConfig)}. Use it?`, true);
       if (!useExisting) {
@@ -78269,14 +78700,14 @@ async function stepConfigFile(configPath, nonInteractive) {
     console.log(source_default.green(`  ${STEP_DONE} Config loaded`) + source_default.gray(` (${Object.keys(config.agents).length} agents)`));
     const hasExplicitTimezone = config.switchroom?.timezone !== undefined || config.defaults?.timezone !== undefined;
     if (!hasExplicitTimezone) {
-      await writeDetectedTimezone(resolve30(existingConfig), nonInteractive);
+      await writeDetectedTimezone(resolve31(existingConfig), nonInteractive);
     }
-    return { config, configPath: resolve30(existingConfig) };
+    return { config, configPath: resolve31(existingConfig) };
   }
   return await copyExampleConfig(nonInteractive);
 }
 async function copyExampleConfig(nonInteractive) {
-  const examplesDir = resolve30(import.meta.dirname, "../../examples");
+  const examplesDir = resolve31(import.meta.dirname, "../../examples");
   let choice;
   if (nonInteractive) {
     choice = "switchroom";
@@ -78287,9 +78718,9 @@ async function copyExampleConfig(nonInteractive) {
     ]);
     choice = choice.split(" ")[0];
   }
-  const srcFile = resolve30(examplesDir, `${choice}.yaml`);
+  const srcFile = resolve31(examplesDir, `${choice}.yaml`);
   const destFile = resolvePath("~/.switchroom/switchroom.yaml");
-  if (!existsSync52(srcFile)) {
+  if (!existsSync53(srcFile)) {
     throw new ConfigError(`Example config not found: ${choice}.yaml`);
   }
   mkdirSync30(dirname13(destFile), { recursive: true });
@@ -78299,12 +78730,12 @@ async function copyExampleConfig(nonInteractive) {
   await writeDetectedTimezone(destFile, nonInteractive);
   const config = loadConfig(destFile);
   console.log(source_default.green(`  ${STEP_DONE} Config loaded`) + source_default.gray(` (${Object.keys(config.agents).length} agents)`));
-  return { config, configPath: resolve30(destFile) };
+  return { config, configPath: resolve31(destFile) };
 }
 async function writeDetectedTimezone(destFile, nonInteractive, detect = detectServerTimezone, prompt = ask) {
   const detected = detect();
   if (detected !== undefined && detected !== "UTC" && isValidTimezone(detected)) {
-    const before2 = readFileSync48(destFile, "utf-8");
+    const before2 = readFileSync49(destFile, "utf-8");
     const after2 = setSwitchroomTimezone(before2, detected);
     if (after2 !== before2)
       writeFileSync27(destFile, after2);
@@ -78325,7 +78756,7 @@ async function writeDetectedTimezone(destFile, nonInteractive, detect = detectSe
     console.error(source_default.yellow(`  \u26a0 "${zone}" is not a valid IANA zone (expected Region/City like ` + '"Australia/Melbourne"). Skipping \u2014 agents will use UTC. ' + "Edit switchroom.timezone in switchroom.yaml by hand."));
     return;
   }
-  const before = readFileSync48(destFile, "utf-8");
+  const before = readFileSync49(destFile, "utf-8");
   const after = setSwitchroomTimezone(before, zone);
   if (after !== before)
     writeFileSync27(destFile, after);
@@ -78404,7 +78835,7 @@ async function resolveOrPromptToken(rawToken, label, config, nonInteractive) {
       try {
         const { openVault: openVault2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
         const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-        if (existsSync52(vaultPath)) {
+        if (existsSync53(vaultPath)) {
           const secrets = openVault2(passphrase, vaultPath);
           const key = rawToken.replace("vault:", "");
           const entry = secrets[key];
@@ -78432,7 +78863,7 @@ async function resolveOrPromptToken(rawToken, label, config, nonInteractive) {
 async function storeTokenInVault(config, vaultRef, token) {
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
   const key = vaultRef.replace("vault:", "");
-  if (!existsSync52(vaultPath)) {
+  if (!existsSync53(vaultPath)) {
     console.log(source_default.gray("  Creating encrypted vault..."));
     let passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
     if (!passphrase) {
@@ -78614,7 +79045,7 @@ async function stepMemoryBackend(config, nonInteractive, switchroomConfigPath) {
   try {
     const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
     const passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
-    if (passphrase && existsSync52(vaultPath)) {
+    if (passphrase && existsSync53(vaultPath)) {
       const existing = getStringSecret(passphrase, vaultPath, "hindsight-api-key");
       if (existing) {
         console.log(source_default.gray("  Note: legacy 'hindsight-api-key' is in your vault but is no longer used. You can remove it with `switchroom vault rm hindsight-api-key`."));
@@ -78778,13 +79209,13 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
     return;
   }
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (!existsSync52(vaultPath)) {
+  if (!existsSync53(vaultPath)) {
     console.log(source_default.gray("  Skipping (vault not created yet)."));
     return;
   }
   const credPathRaw = config.vault?.broker?.autoUnlockCredentialPath ?? "~/.switchroom/vault-auto-unlock";
   const credPath = resolvePath(credPathRaw);
-  if (config.vault?.broker?.autoUnlock === true && existsSync52(credPath)) {
+  if (config.vault?.broker?.autoUnlock === true && existsSync53(credPath)) {
     console.log(source_default.green(`  ${STEP_DONE} Already configured (${credPath})`));
     return;
   }
@@ -78850,9 +79281,9 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
   const choice = await askChoice("  Approval posture", [PASSPHRASE_CHOICE, TELEGRAM_ID_CHOICE]);
   if (choice === TELEGRAM_ID_CHOICE) {
     try {
-      const yamlPath = existsSync52(resolve30(process.cwd(), "switchroom.yaml")) ? resolve30(process.cwd(), "switchroom.yaml") : resolve30(process.cwd(), "switchroom.yml");
-      if (existsSync52(yamlPath)) {
-        const content = readFileSync48(yamlPath, "utf-8");
+      const yamlPath = existsSync53(resolve31(process.cwd(), "switchroom.yaml")) ? resolve31(process.cwd(), "switchroom.yaml") : resolve31(process.cwd(), "switchroom.yml");
+      if (existsSync53(yamlPath)) {
+        const content = readFileSync49(yamlPath, "utf-8");
         const result = insertVaultBrokerApprovalAuth(content, "telegram-id");
         if (result.kind === "rewritten") {
           writeFileSync27(yamlPath, result.content, "utf-8");
@@ -78882,12 +79313,12 @@ async function stepDangerousMode(config, nonInteractive) {
   }
   if (enableDangerous) {
     const configPaths = [
-      resolve30(process.cwd(), "switchroom.yaml"),
-      resolve30(process.cwd(), "switchroom.yml")
+      resolve31(process.cwd(), "switchroom.yaml"),
+      resolve31(process.cwd(), "switchroom.yml")
     ];
     for (const configPath of configPaths) {
-      if (existsSync52(configPath)) {
-        let content = readFileSync48(configPath, "utf-8");
+      if (existsSync53(configPath)) {
+        let content = readFileSync49(configPath, "utf-8");
         const agentNames = Object.keys(config.agents);
         for (const name of agentNames) {
           const agentPattern = new RegExp(`(^  ${name}:\\s*\\n)`, "m");
@@ -78917,7 +79348,7 @@ async function stepOnboardingGuidance(config, nonInteractive) {
   const agentNames = Object.keys(config.agents);
   let allAuthenticated = true;
   for (const name of agentNames) {
-    const agentDir = resolve30(agentsDir, name);
+    const agentDir = resolve31(agentsDir, name);
     const status = getAuthStatus(name, agentDir);
     if (status.authenticated) {
       console.log(`  ${source_default.green("OK")} ${source_default.bold(name)}` + source_default.gray(` - authenticated (expires: ${status.timeUntilExpiry ?? "unknown"})`));
@@ -79015,9 +79446,9 @@ init_doctor();
 init_source();
 init_loader();
 init_lifecycle();
-import { cpSync as cpSync2, existsSync as existsSync59, mkdirSync as mkdirSync32, readFileSync as readFileSync53, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync27, chownSync as chownSync5 } from "node:fs";
+import { cpSync as cpSync2, existsSync as existsSync60, mkdirSync as mkdirSync32, readFileSync as readFileSync54, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync27, chownSync as chownSync5 } from "node:fs";
 import { spawnSync as spawnSync11 } from "node:child_process";
-import { join as join62, dirname as dirname16, resolve as resolve35 } from "node:path";
+import { join as join63, dirname as dirname16, resolve as resolve36 } from "node:path";
 import { homedir as homedir37 } from "node:os";
 
 // src/cli/release-yaml.ts
@@ -79109,7 +79540,7 @@ ${lines.join(`
 function defaultPersistPin(configPath) {
   return (pin) => {
     const path4 = configPath ?? findConfigFile();
-    const before = readFileSync53(path4, "utf8");
+    const before = readFileSync54(path4, "utf8");
     const after = setReleasePinInConfig(before, pin);
     if (after === before)
       return;
@@ -79123,13 +79554,13 @@ function defaultPersistPin(configPath) {
     } catch {}
   };
 }
-var DEFAULT_COMPOSE_PATH = join62(homedir37(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH = join63(homedir37(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname16(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync59(join62(dir, ".git"))) {
+    if (existsSync60(join63(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync53(join62(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync54(join63(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -79198,7 +79629,7 @@ function planUpdate(opts) {
   steps.push({
     name: "pull-images",
     description: "Pull broker / kernel / agent images from GHCR",
-    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync59(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
+    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync60(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
     run: () => {
       const r = runner("docker", [
         "compose",
@@ -79318,15 +79749,15 @@ function planUpdate(opts) {
         opts.syncBundledSkillsFn();
         return;
       }
-      const source = resolve35(import.meta.dirname, "../../skills");
-      const dest = join62(homedir37(), ".switchroom", "skills", "_bundled");
-      if (!existsSync59(source)) {
+      const source = resolve36(import.meta.dirname, "../../skills");
+      const dest = join63(homedir37(), ".switchroom", "skills", "_bundled");
+      if (!existsSync60(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
         return;
       }
       try {
-        if (existsSync59(dest)) {
+        if (existsSync60(dest)) {
           rmSync12(dest, { recursive: true, force: true });
         }
         mkdirSync32(dirname16(dest), { recursive: true });
@@ -79365,7 +79796,7 @@ function planUpdate(opts) {
     description: "docker compose up -d --remove-orphans (recreates services with new images / compose)",
     run: () => {
       try {
-        const composeText = readFileSync53(composePath, "utf8");
+        const composeText = readFileSync54(composePath, "utf8");
         const pf = validateBindSources(composeText);
         if (!pf.ok)
           throw new Error(formatPreflightError(pf));
@@ -79443,10 +79874,10 @@ function defaultStatusProbe(composePath) {
       } catch {}
       let dir = dirname16(scriptPath);
       for (let i = 0;i < 8; i++) {
-        const pkgPath = join62(dir, "package.json");
-        if (existsSync59(pkgPath)) {
+        const pkgPath = join63(dir, "package.json");
+        if (existsSync60(pkgPath)) {
           try {
-            const pkg = JSON.parse(readFileSync53(pkgPath, "utf-8"));
+            const pkg = JSON.parse(readFileSync54(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
               cliVersion = pkg.version;
           } catch (err) {
@@ -79467,7 +79898,7 @@ function defaultStatusProbe(composePath) {
     warnings.push("could not resolve CLI version (no package.json found above the resolved script path)");
   }
   const services = [];
-  if (!existsSync59(composePath)) {
+  if (!existsSync60(composePath)) {
     warnings.push(`compose file not found at ${composePath}; service status unknown`);
     return { cliVersion, cliBuiltAt, services, warnings };
   }
@@ -79663,7 +80094,7 @@ function registerUpdateCommand(program3) {
 // src/cli/rollout.ts
 init_helpers();
 import { spawnSync as spawnSync12 } from "node:child_process";
-import { readFileSync as readFileSync54, chownSync as chownSync6, statSync as statSync28 } from "node:fs";
+import { readFileSync as readFileSync55, chownSync as chownSync6, statSync as statSync28 } from "node:fs";
 import { homedir as homedir38 } from "node:os";
 init_atomic();
 init_audit_reader();
@@ -79847,7 +80278,7 @@ function resolveRollbackTarget(auditLogPath) {
   const logPath = auditLogPath ?? defaultAuditLogPath2(homedir38());
   let raw;
   try {
-    raw = readFileSync54(logPath, "utf8");
+    raw = readFileSync55(logPath, "utf8");
   } catch {
     return null;
   }
@@ -79959,7 +80390,7 @@ function registerRolloutCommand(program3) {
       log: (line) => process.stdout.write(line + `
 `),
       persistPin: (pin) => {
-        const before = readFileSync54(configPath, "utf8");
+        const before = readFileSync55(configPath, "utf8");
         const after = setReleasePinInConfig(before, pin);
         if (after === before)
           return;
@@ -80024,15 +80455,15 @@ init_source();
 init_helpers();
 init_loader();
 init_lifecycle();
-import { resolve as resolve36 } from "node:path";
+import { resolve as resolve37 } from "node:path";
 
 // src/cli/version.ts
 init_source();
 init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
-import { existsSync as existsSync60, readFileSync as readFileSync55 } from "node:fs";
-import { dirname as dirname17, join as join63 } from "node:path";
+import { existsSync as existsSync61, readFileSync as readFileSync56 } from "node:fs";
+import { dirname as dirname17, join as join64 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync4("claude --version 2>/dev/null", {
@@ -80082,11 +80513,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const pkgPath = join63(dir, "package.json");
-    if (existsSync60(pkgPath)) {
+    const pkgPath = join64(dir, "package.json");
+    if (existsSync61(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync55(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync60(join63(dir, ".git"))) {
+        const pkg = JSON.parse(readFileSync56(pkgPath, "utf-8"));
+        if (pkg.name === "switchroom" && existsSync61(join64(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -80179,7 +80610,7 @@ function registerRestartCommand(program3) {
         }
         const didRestart = res.restarted || !graceful;
         if (didRestart) {
-          const agentDir = resolve36(agentsDir, name);
+          const agentDir = resolve37(agentsDir, name);
           const converged = waitForAuthConverge(name, agentDir);
           if (!converged) {
             console.log(source_default.yellow(`  ${name}: agent is up but auth status didn't converge in 30s \u2014 check logs`));
@@ -80260,7 +80691,7 @@ Dependency manifest`));
 // src/cli/handoff.ts
 init_helpers();
 init_loader();
-import { resolve as resolve37 } from "node:path";
+import { resolve as resolve38 } from "node:path";
 function registerHandoffCommand(program3) {
   program3.command("handoff <agent>", { hidden: true }).description("Build the agent's session handoff sidecars \u2014 a transcript-tail " + "briefing (.handoff.md) and topic line (.handoff-topic). " + "[internal \u2014 used by the Stop hook]").option("--max-turns <n>", "Max turns kept in the handoff transcript tail", String(DEFAULT_MAX_TURNS)).action(withConfigError(async (agentName, opts) => {
     let agentConfig;
@@ -80274,7 +80705,7 @@ function registerHandoffCommand(program3) {
         return;
       }
       const agentsDir = resolveAgentsDir(config);
-      agentDir = resolve37(agentsDir, agentName);
+      agentDir = resolve38(agentsDir, agentName);
     } catch (err) {
       if (!(err instanceof ConfigError))
         throw err;
@@ -80289,7 +80720,7 @@ function registerHandoffCommand(program3) {
 `);
       return;
     }
-    const claudeConfigDir = resolve37(agentDir, ".claude");
+    const claudeConfigDir = resolve38(agentDir, ".claude");
     const jsonl = findLatestSessionJsonl(claudeConfigDir);
     if (!jsonl) {
       process.stderr.write(`handoff: no session JSONL under ${claudeConfigDir}/projects; skipping
@@ -80312,18 +80743,18 @@ function registerHandoffCommand(program3) {
 // src/issues/store.ts
 import {
   closeSync as closeSync11,
-  existsSync as existsSync61,
+  existsSync as existsSync62,
   mkdirSync as mkdirSync33,
   openSync as openSync11,
   readdirSync as readdirSync22,
-  readFileSync as readFileSync56,
+  readFileSync as readFileSync57,
   renameSync as renameSync12,
   statSync as statSync29,
   unlinkSync as unlinkSync11,
   writeFileSync as writeFileSync28,
   writeSync as writeSync7
 } from "node:fs";
-import { join as join64 } from "node:path";
+import { join as join65 } from "node:path";
 import { randomBytes as randomBytes12 } from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
 
@@ -80721,12 +81152,12 @@ function redactedMarker(ruleId) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path4 = join64(stateDir, ISSUES_FILE);
-  if (!existsSync61(path4))
+  const path4 = join65(stateDir, ISSUES_FILE);
+  if (!existsSync62(path4))
     return [];
   let raw;
   try {
-    raw = readFileSync56(path4, "utf-8");
+    raw = readFileSync57(path4, "utf-8");
   } catch {
     return [];
   }
@@ -80798,8 +81229,8 @@ function record(stateDir, input, nowFn = Date.now) {
     return result;
   });
 }
-function resolve38(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync61(join64(stateDir, ISSUES_FILE)))
+function resolve39(stateDir, fingerprint, nowFn = Date.now) {
+  if (!existsSync62(join65(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -80817,7 +81248,7 @@ function resolve38(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync61(join64(stateDir, ISSUES_FILE)))
+  if (!existsSync62(join65(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -80835,7 +81266,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync61(join64(stateDir, ISSUES_FILE)))
+  if (!existsSync62(join65(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -80868,7 +81299,7 @@ function ensureDir(stateDir) {
   mkdirSync33(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path4 = join64(stateDir, ISSUES_FILE);
+  const path4 = join65(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path4}.tmp-${process.pid}-${randomBytes12(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -80890,7 +81321,7 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join64(stateDir, entry);
+    const tmpPath = join65(stateDir, entry);
     try {
       const stat = statSync29(tmpPath);
       if (stat.mtimeMs < cutoff) {
@@ -80902,7 +81333,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join64(stateDir, ISSUES_LOCK);
+  const lockPath = join65(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -80937,7 +81368,7 @@ function withLock(stateDir, fn) {
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync56(lockPath, "utf-8").trim();
+    pidStr = readFileSync57(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
@@ -81086,11 +81517,11 @@ function registerIssuesCommand(program3) {
       const stateDir = resolveStateDir2(opts);
       let flipped;
       if (opts.source && opts.code) {
-        flipped = resolve38(stateDir, computeFingerprint(opts.source, opts.code));
+        flipped = resolve39(stateDir, computeFingerprint(opts.source, opts.code));
       } else if (opts.source && !fingerprint) {
         flipped = resolveAllBySource(stateDir, opts.source);
       } else if (fingerprint) {
-        flipped = resolve38(stateDir, fingerprint);
+        flipped = resolve39(stateDir, fingerprint);
       } else {
         process.stderr.write(`issues resolve: need either <fingerprint>, --source, or --source + --code
 `);
@@ -81185,20 +81616,20 @@ function relTime(deltaMs) {
 
 // src/cli/deps.ts
 init_source();
-import { existsSync as existsSync64 } from "node:fs";
+import { existsSync as existsSync65 } from "node:fs";
 import { homedir as homedir41 } from "node:os";
-import { join as join67, resolve as resolve39 } from "node:path";
+import { join as join68, resolve as resolve40 } from "node:path";
 
 // src/deps/python.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 import {
-  existsSync as existsSync62,
+  existsSync as existsSync63,
   mkdirSync as mkdirSync34,
-  readFileSync as readFileSync57,
+  readFileSync as readFileSync58,
   rmSync as rmSync13,
   writeFileSync as writeFileSync29
 } from "node:fs";
-import { dirname as dirname18, join as join65 } from "node:path";
+import { dirname as dirname18, join as join66 } from "node:path";
 import { homedir as homedir39 } from "node:os";
 import { execFileSync as execFileSync19 } from "node:child_process";
 
@@ -81211,26 +81642,26 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join65(homedir39(), ".switchroom", "deps", "python");
+  return join66(homedir39(), ".switchroom", "deps", "python");
 }
 function hashFile(path4) {
-  return createHash11("sha256").update(readFileSync57(path4)).digest("hex");
+  return createHash12("sha256").update(readFileSync58(path4)).digest("hex");
 }
 function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultPythonCacheRoot();
   const hostPython = opts.pythonBin ?? "python3";
-  if (!existsSync62(requirementsPath)) {
+  if (!existsSync63(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join65(cacheRoot, skillName);
-  const stampPath = join65(venvDir, ".requirements.sha256");
-  const binDir = join65(venvDir, "bin");
-  const pythonBin = join65(binDir, "python");
-  const pipBin = join65(binDir, "pip");
+  const venvDir = join66(cacheRoot, skillName);
+  const stampPath = join66(venvDir, ".requirements.sha256");
+  const binDir = join66(venvDir, "bin");
+  const pythonBin = join66(binDir, "python");
+  const pipBin = join66(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
-  if (!force && existsSync62(stampPath) && existsSync62(pythonBin)) {
-    const existingHash = readFileSync57(stampPath, "utf8").trim();
+  if (!force && existsSync63(stampPath) && existsSync63(pythonBin)) {
+    const existingHash = readFileSync58(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -81242,7 +81673,7 @@ function ensurePythonEnv(opts) {
       };
     }
   }
-  if (existsSync62(venvDir)) {
+  if (existsSync63(venvDir)) {
     rmSync13(venvDir, { recursive: true, force: true });
   }
   mkdirSync34(dirname18(venvDir), { recursive: true });
@@ -81277,16 +81708,16 @@ function ensurePythonEnv(opts) {
 }
 
 // src/deps/node.ts
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 import {
   copyFileSync as copyFileSync9,
-  existsSync as existsSync63,
+  existsSync as existsSync64,
   mkdirSync as mkdirSync35,
-  readFileSync as readFileSync58,
+  readFileSync as readFileSync59,
   rmSync as rmSync14,
   writeFileSync as writeFileSync30
 } from "node:fs";
-import { dirname as dirname19, join as join66 } from "node:path";
+import { dirname as dirname19, join as join67 } from "node:path";
 import { homedir as homedir40 } from "node:os";
 import { execFileSync as execFileSync20 } from "node:child_process";
 
@@ -81310,23 +81741,23 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join66(homedir40(), ".switchroom", "deps", "node");
+  return join67(homedir40(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
   const sourceDir = dirname19(packageJsonPath);
-  const hasher = createHash12("sha256");
+  const hasher = createHash13("sha256");
   hasher.update(`package.json
 `);
-  hasher.update(readFileSync58(packageJsonPath));
+  hasher.update(readFileSync59(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join66(sourceDir, lockName);
-    if (existsSync63(lockPath)) {
+    const lockPath = join67(sourceDir, lockName);
+    if (existsSync64(lockPath)) {
       hasher.update(`
 `);
       hasher.update(lockName);
       hasher.update(`
 `);
-      hasher.update(readFileSync58(lockPath));
+      hasher.update(readFileSync59(lockPath));
     }
   }
   return hasher.digest("hex");
@@ -81335,17 +81766,17 @@ function ensureNodeEnv(opts) {
   const { skillName, packageJsonPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultNodeCacheRoot();
   const installer = opts.installer ?? "bun";
-  if (!existsSync63(packageJsonPath)) {
+  if (!existsSync64(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
   const sourceDir = dirname19(packageJsonPath);
-  const envDir = join66(cacheRoot, skillName);
-  const stampPath = join66(envDir, ".package.sha256");
-  const nodeModulesDir = join66(envDir, "node_modules");
-  const binDir = join66(nodeModulesDir, ".bin");
+  const envDir = join67(cacheRoot, skillName);
+  const stampPath = join67(envDir, ".package.sha256");
+  const nodeModulesDir = join67(envDir, "node_modules");
+  const binDir = join67(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
-  if (!force && existsSync63(stampPath) && existsSync63(nodeModulesDir)) {
-    const existingHash = readFileSync58(stampPath, "utf8").trim();
+  if (!force && existsSync64(stampPath) && existsSync64(nodeModulesDir)) {
+    const existingHash = readFileSync59(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -81356,16 +81787,16 @@ function ensureNodeEnv(opts) {
       };
     }
   }
-  if (existsSync63(envDir)) {
+  if (existsSync64(envDir)) {
     rmSync14(envDir, { recursive: true, force: true });
   }
   mkdirSync35(envDir, { recursive: true });
-  copyFileSync9(packageJsonPath, join66(envDir, "package.json"));
+  copyFileSync9(packageJsonPath, join67(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join66(sourceDir, lockName);
-    if (existsSync63(lockPath)) {
-      copyFileSync9(lockPath, join66(envDir, lockName));
+    const lockPath = join67(sourceDir, lockName);
+    if (existsSync64(lockPath)) {
+      copyFileSync9(lockPath, join67(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -81394,28 +81825,28 @@ function ensureNodeEnv(opts) {
 
 // src/cli/deps.ts
 function builtinSkillsRoot() {
-  return resolve39(homedir41(), ".switchroom/skills/_bundled");
+  return resolve40(homedir41(), ".switchroom/skills/_bundled");
 }
 function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
   deps.command("rebuild <skill>").description("Rebuild the Python venv and/or Node node_modules cache for a skill").option("-p, --python", "Rebuild only the Python env").option("-n, --node", "Rebuild only the Node env").action(async (skill, opts) => {
     const skillsRoot = builtinSkillsRoot();
-    if (!existsSync64(skillsRoot)) {
+    if (!existsSync65(skillsRoot)) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join67(skillsRoot, skill);
-    if (!existsSync64(skillDir)) {
+    const skillDir = join68(skillsRoot, skill);
+    if (!existsSync65(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join67(skillDir, "requirements.txt");
-    const packageJsonPath = join67(skillDir, "package.json");
-    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync64(requirementsPath));
-    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync64(packageJsonPath));
+    const requirementsPath = join68(skillDir, "requirements.txt");
+    const packageJsonPath = join68(skillDir, "package.json");
+    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync65(requirementsPath));
+    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync65(packageJsonPath));
     let did = 0;
     if (wantPython) {
-      if (!existsSync64(requirementsPath)) {
+      if (!existsSync65(requirementsPath)) {
         console.error(source_default.red(`Skill "${skill}" has no requirements.txt at ${requirementsPath}`));
         process.exit(1);
       }
@@ -81439,7 +81870,7 @@ function registerDepsCommand(program3) {
       }
     }
     if (wantNode) {
-      if (!existsSync64(packageJsonPath)) {
+      if (!existsSync65(packageJsonPath)) {
         console.error(source_default.red(`Skill "${skill}" has no package.json at ${packageJsonPath}`));
         process.exit(1);
       }
@@ -81472,8 +81903,8 @@ function registerDepsCommand(program3) {
 // src/cli/workspace.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync65 } from "node:fs";
-import { resolve as resolve40, sep as sep3 } from "node:path";
+import { existsSync as existsSync66 } from "node:fs";
+import { resolve as resolve41, sep as sep3 } from "node:path";
 import { spawnSync as spawnSync13 } from "node:child_process";
 
 // src/agents/workspace.ts
@@ -82179,8 +82610,8 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const resolvedWorkspace = resolve40(dir);
-    const target = resolve40(resolvedWorkspace, file ?? "AGENTS.md");
+    const resolvedWorkspace = resolve41(dir);
+    const target = resolve41(resolvedWorkspace, file ?? "AGENTS.md");
     if (!isInsideWorkspace(resolvedWorkspace, target)) {
       process.stderr.write(`workspace edit: refusing path traversal outside workspace dir (${target})
 `);
@@ -82248,8 +82679,8 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const gitDir = resolve40(dir, ".git");
-    if (!existsSync65(gitDir)) {
+    const gitDir = resolve41(dir, ".git");
+    if (!existsSync66(gitDir)) {
       process.stdout.write(`Workspace is not a git repository. Re-run \`switchroom agent create ${agentName}\` ` + `or manually \`git init\` in ${dir} to enable versioning.
 `);
       return;
@@ -82302,8 +82733,8 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const gitDir = resolve40(dir, ".git");
-    if (!existsSync65(gitDir)) {
+    const gitDir = resolve41(dir, ".git");
+    if (!existsSync66(gitDir)) {
       process.stdout.write(`Workspace is not a git repository.
 `);
       return;
@@ -82326,9 +82757,9 @@ function resolveAgentWorkspaceDirOrExit(program3, agentName) {
     return;
   }
   const agentsDir = resolveAgentsDir(config);
-  const agentDir = resolve40(agentsDir, agentName);
+  const agentDir = resolve41(agentsDir, agentName);
   const dir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync65(dir)) {
+  if (!existsSync66(dir)) {
     process.stderr.write(`workspace: ${dir} does not exist yet. Run \`switchroom setup\` or \`switchroom agent scaffold ${agentName}\` to seed it.
 `);
     return;
@@ -82364,8 +82795,8 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync10, existsSync as existsSync66, readFileSync as readFileSync59, writeFileSync as writeFileSync31 } from "node:fs";
-import { join as join68, resolve as resolve41 } from "node:path";
+import { copyFileSync as copyFileSync10, existsSync as existsSync67, readFileSync as readFileSync60, writeFileSync as writeFileSync31 } from "node:fs";
+import { join as join69, resolve as resolve42 } from "node:path";
 init_schema();
 function resolveSoulTargetOrExit(program3, agentName) {
   const config = getConfig(program3);
@@ -82378,9 +82809,9 @@ function resolveSoulTargetOrExit(program3, agentName) {
   const profileName = merged.extends ?? DEFAULT_PROFILE;
   const profilePath = getProfilePath(profileName);
   const agentsDir = resolveAgentsDir(config);
-  const agentDir = resolve41(agentsDir, agentName);
+  const agentDir = resolve42(agentsDir, agentName);
   const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync66(workspaceDir)) {
+  if (!existsSync67(workspaceDir)) {
     console.error(`soul: ${workspaceDir} does not exist yet. Run \`switchroom setup\` ` + `or \`switchroom agent scaffold ${agentName}\` to seed it.`);
     process.exit(1);
   }
@@ -82389,7 +82820,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join68(workspaceDir, "SOUL.md"),
+    soulPath: join69(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -82406,11 +82837,11 @@ function registerSoulCommand(program3) {
     const t = resolveSoulTargetOrExit(program3, agentName);
     if (!t)
       return;
-    if (!existsSync66(t.soulPath)) {
+    if (!existsSync67(t.soulPath)) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
-    process.stdout.write(readFileSync59(t.soulPath, "utf-8"));
+    process.stdout.write(readFileSync60(t.soulPath, "utf-8"));
   }));
   cmd.command("reset <agent>").description("Re-seed SOUL.md from the agent's current profile " + "(backs the existing file up to SOUL.md.bak first)").option("-y, --yes", "Skip the confirmation prompt").action(withConfigError(async (agentName, opts) => {
     const t = resolveSoulTargetOrExit(program3, agentName);
@@ -82421,7 +82852,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: profile "${t.profileName}" ships no SOUL.md.hbs \u2014 ` + `nothing to re-seed from.`);
       process.exit(1);
     }
-    const exists = existsSync66(t.soulPath);
+    const exists = existsSync67(t.soulPath);
     if (exists && !opts.yes) {
       if (!isInteractive()) {
         console.error(`soul: ${t.soulPath} already exists. Re-run with --yes to ` + `replace it (the current file is backed up to SOUL.md.bak).`);
@@ -82436,7 +82867,7 @@ function registerSoulCommand(program3) {
     let backupPath;
     if (exists) {
       backupPath = `${t.soulPath}.bak`;
-      if (existsSync66(backupPath)) {
+      if (existsSync67(backupPath)) {
         backupPath = `${t.soulPath}.bak.${Date.now()}`;
       }
       copyFileSync10(t.soulPath, backupPath);
@@ -82455,9 +82886,9 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync67, readFileSync as readFileSync60, readdirSync as readdirSync23, statSync as statSync30 } from "node:fs";
-import { resolve as resolve42, join as join69 } from "node:path";
-import { createHash as createHash13 } from "node:crypto";
+import { existsSync as existsSync68, readFileSync as readFileSync61, readdirSync as readdirSync23, statSync as statSync30 } from "node:fs";
+import { resolve as resolve43, join as join70 } from "node:path";
+import { createHash as createHash14 } from "node:crypto";
 init_merge();
 init_hindsight();
 function formatBytes(bytes) {
@@ -82467,22 +82898,22 @@ function estimateTokens(bytes) {
   return Math.round(bytes / 3.7);
 }
 function readMcpServerNames(agentDir) {
-  const mcpPath = join69(agentDir, ".mcp.json");
-  if (!existsSync67(mcpPath))
+  const mcpPath = join70(agentDir, ".mcp.json");
+  if (!existsSync68(mcpPath))
     return [];
   try {
-    const parsed = JSON.parse(readFileSync60(mcpPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync61(mcpPath, "utf-8"));
     return Object.keys(parsed.mcpServers ?? {});
   } catch {
     return null;
   }
 }
 function sha256(content) {
-  return createHash13("sha256").update(content).digest("hex").slice(0, 16);
+  return createHash14("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join69(claudeConfigDir, "projects");
-  if (!existsSync67(projectsDir))
+  const projectsDir = join70(claudeConfigDir, "projects");
+  if (!existsSync68(projectsDir))
     return;
   try {
     const entries = readdirSync23(projectsDir, { withFileTypes: true });
@@ -82490,9 +82921,9 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join69(projectsDir, entry.name);
-      const transcriptPath = join69(projectPath, "transcript.jsonl");
-      if (!existsSync67(transcriptPath))
+      const projectPath = join70(projectsDir, entry.name);
+      const transcriptPath = join70(projectPath, "transcript.jsonl");
+      if (!existsSync68(transcriptPath))
         continue;
       const stat3 = statSync30(transcriptPath);
       if (!latest || stat3.mtimeMs > latest.mtime) {
@@ -82506,7 +82937,7 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
 }
 function extractLatestUserMessage(transcriptPath) {
   try {
-    const content = readFileSync60(transcriptPath, "utf-8");
+    const content = readFileSync61(transcriptPath, "utf-8");
     const lines = content.trim().split(`
 `).filter(Boolean);
     for (let i = lines.length - 1;i >= 0; i--) {
@@ -82554,17 +82985,17 @@ function registerDebugCommand(program3) {
       process.exit(1);
     }
     const agentsDir = resolveAgentsDir(config);
-    const agentDir = resolve42(agentsDir, agentName);
-    if (!existsSync67(agentDir)) {
+    const agentDir = resolve43(agentsDir, agentName);
+    if (!existsSync68(agentDir)) {
       console.error(`Agent directory not found: ${agentDir}`);
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join69(agentDir, ".claude");
-    const claudeMdPath = join69(agentDir, "CLAUDE.md");
-    const soulMdPath = join69(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join69(workspaceDir, "SOUL.md");
-    const handoffPath = join69(agentDir, ".handoff.md");
+    const claudeConfigDir = join70(agentDir, ".claude");
+    const claudeMdPath = join70(agentDir, "CLAUDE.md");
+    const soulMdPath = join70(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join70(workspaceDir, "SOUL.md");
+    const handoffPath = join70(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -82610,7 +83041,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Append System Prompt (per-session) ===
 `);
-    const handoffContent = existsSync67(handoffPath) ? readFileSync60(handoffPath, "utf-8") : "";
+    const handoffContent = existsSync68(handoffPath) ? readFileSync61(handoffPath, "utf-8") : "";
     if (handoffContent.trim().length > 0) {
       console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
       console.log(handoffContent);
@@ -82621,7 +83052,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
 `);
-    const claudeMdContent = existsSync67(claudeMdPath) ? readFileSync60(claudeMdPath, "utf-8") : "";
+    const claudeMdContent = existsSync68(claudeMdPath) ? readFileSync61(claudeMdPath, "utf-8") : "";
     if (claudeMdContent.trim().length > 0) {
       console.log(`(${formatBytes(claudeMdContent.length)})`);
       console.log(claudeMdContent);
@@ -82632,7 +83063,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Persona (SOUL.md) ===
 `);
-    const soulMdContent = existsSync67(soulMdPath) ? readFileSync60(soulMdPath, "utf-8") : existsSync67(workspaceSoulMdPath) ? readFileSync60(workspaceSoulMdPath, "utf-8") : "";
+    const soulMdContent = existsSync68(soulMdPath) ? readFileSync61(soulMdPath, "utf-8") : existsSync68(workspaceSoulMdPath) ? readFileSync61(workspaceSoulMdPath, "utf-8") : "";
     if (soulMdContent.trim().length > 0) {
       console.log(`(${formatBytes(soulMdContent.length)})`);
       console.log(soulMdContent);
@@ -82693,11 +83124,11 @@ function registerDebugCommand(program3) {
     const soulMdBytes = soulMdContent.length;
     const perTurnBytes = dynamicResult.concatenated.length;
     const userBytes = userMessage?.text.length ?? 0;
-    const fleetDir = join69(agentsDir, "..", "fleet");
-    const fleetInvPath = join69(fleetDir, "switchroom-invariants.md");
-    const fleetClaudePath = join69(fleetDir, "CLAUDE.md");
-    const fleetInvBytes = existsSync67(fleetInvPath) ? readFileSync60(fleetInvPath, "utf-8").length : 0;
-    const fleetClaudeBytes = existsSync67(fleetClaudePath) ? readFileSync60(fleetClaudePath, "utf-8").length : 0;
+    const fleetDir = join70(agentsDir, "..", "fleet");
+    const fleetInvPath = join70(fleetDir, "switchroom-invariants.md");
+    const fleetClaudePath = join70(fleetDir, "CLAUDE.md");
+    const fleetInvBytes = existsSync68(fleetInvPath) ? readFileSync61(fleetInvPath, "utf-8").length : 0;
+    const fleetClaudeBytes = existsSync68(fleetClaudePath) ? readFileSync61(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
     const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
     console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
@@ -82730,8 +83161,8 @@ init_source();
 
 // src/worktree/claim.ts
 import { execFileSync as execFileSync21 } from "node:child_process";
-import { closeSync as closeSync12, mkdirSync as mkdirSync37, openSync as openSync12, existsSync as existsSync69, unlinkSync as unlinkSync13 } from "node:fs";
-import { join as join71, resolve as resolve44 } from "node:path";
+import { closeSync as closeSync12, mkdirSync as mkdirSync37, openSync as openSync12, existsSync as existsSync70, unlinkSync as unlinkSync13 } from "node:fs";
+import { join as join72, resolve as resolve45 } from "node:path";
 import { homedir as homedir43 } from "node:os";
 import { randomBytes as randomBytes13 } from "node:crypto";
 
@@ -82739,19 +83170,19 @@ import { randomBytes as randomBytes13 } from "node:crypto";
 import {
   mkdirSync as mkdirSync36,
   writeFileSync as writeFileSync32,
-  readFileSync as readFileSync61,
+  readFileSync as readFileSync62,
   readdirSync as readdirSync24,
   unlinkSync as unlinkSync12,
-  existsSync as existsSync68,
+  existsSync as existsSync69,
   renameSync as renameSync13
 } from "node:fs";
-import { join as join70, resolve as resolve43 } from "node:path";
+import { join as join71, resolve as resolve44 } from "node:path";
 import { homedir as homedir42 } from "node:os";
 function registryDir() {
-  return resolve43(process.env.SWITCHROOM_WORKTREE_DIR ?? join70(homedir42(), ".switchroom", "worktrees"));
+  return resolve44(process.env.SWITCHROOM_WORKTREE_DIR ?? join71(homedir42(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join70(registryDir(), `${id}.json`);
+  return join71(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
   mkdirSync36(registryDir(), { recursive: true });
@@ -82767,7 +83198,7 @@ function writeRecord(record2) {
 function readRecord(id) {
   const path7 = recordPath(id);
   try {
-    const raw = readFileSync61(path7, "utf8");
+    const raw = readFileSync62(path7, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -82802,7 +83233,7 @@ function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
   mkdirSync37(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join71(lockDir, `.lock-${lockName}`);
+  const lockPath = join72(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -82829,7 +83260,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve44(process.env.SWITCHROOM_WORKTREE_BASE ?? join71(homedir43(), ".switchroom", "worktree-checkouts"));
+  return resolve45(process.env.SWITCHROOM_WORKTREE_BASE ?? join72(homedir43(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes13(4).toString("hex");
@@ -82851,12 +83282,12 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join71(homedir43(), p.slice(2));
+    return join72(homedir43(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
   const repoPath = resolveRepoPath(input.repo, codeRepos);
-  if (!existsSync69(repoPath)) {
+  if (!existsSync70(repoPath)) {
     throw new Error(`Repository path does not exist: ${repoPath}`);
   }
   let concurrencyCap = DEFAULT_CONCURRENCY;
@@ -82879,7 +83310,7 @@ async function claimWorktree(input, codeRepos) {
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
     mkdirSync37(baseDir, { recursive: true });
-    worktreePath = join71(baseDir, `${id}-${taskSuffix}`);
+    worktreePath = join72(baseDir, `${id}-${taskSuffix}`);
     const now = new Date().toISOString();
     const record2 = {
       id,
@@ -82910,7 +83341,7 @@ async function claimWorktree(input, codeRepos) {
 
 // src/worktree/release.ts
 import { execFileSync as execFileSync22 } from "node:child_process";
-import { existsSync as existsSync70 } from "node:fs";
+import { existsSync as existsSync71 } from "node:fs";
 function releaseWorktree(input) {
   const { id } = input;
   const record2 = readRecord(id);
@@ -82918,7 +83349,7 @@ function releaseWorktree(input) {
     return { released: true };
   }
   let gitSuccess = true;
-  if (existsSync70(record2.path)) {
+  if (existsSync71(record2.path)) {
     try {
       execFileSync22("git", ["worktree", "remove", "--force", record2.path], {
         cwd: record2.repo,
@@ -82957,7 +83388,7 @@ function listWorktrees() {
 
 // src/worktree/reaper.ts
 import { execFileSync as execFileSync23 } from "node:child_process";
-import { existsSync as existsSync71 } from "node:fs";
+import { existsSync as existsSync72 } from "node:fs";
 var STALE_THRESHOLD_MS = 10 * 60 * 1000;
 function isPathInUse(path7) {
   try {
@@ -82984,7 +83415,7 @@ function hasUncommittedChanges(repoPath, worktreePath) {
 function reapRecord(record2) {
   const { id, path: path7, repo, branch, ownerAgent } = record2;
   let warning = null;
-  if (existsSync71(path7)) {
+  if (existsSync72(path7)) {
     if (hasUncommittedChanges(repo, path7)) {
       warning = `[worktree-reaper] Reaped worktree with uncommitted changes: ` + `id=${id} branch=${branch} agent=${ownerAgent ?? "unknown"} path=${path7}`;
     }
@@ -83005,7 +83436,7 @@ function runReaper(nowMs) {
   const warnings = [];
   for (const record2 of records) {
     const heartbeatAge = now - new Date(record2.heartbeatAt).getTime();
-    const worktreeExists = existsSync71(record2.path);
+    const worktreeExists = existsSync72(record2.path);
     if (!worktreeExists) {
       deleteRecord(record2.id);
       reaped.push(record2.id);
@@ -83025,8 +83456,8 @@ function runReaper(nowMs) {
 // src/worktree/gc.ts
 import { execFileSync as execFileSync24 } from "node:child_process";
 import {
-  existsSync as existsSync72,
-  readFileSync as readFileSync62,
+  existsSync as existsSync73,
+  readFileSync as readFileSync63,
   readdirSync as readdirSync25,
   statSync as statSync31,
   renameSync as renameSync14,
@@ -83034,7 +83465,7 @@ import {
   rmSync as rmSync15
 } from "node:fs";
 import { homedir as homedir44 } from "node:os";
-import { join as join72, resolve as resolve45 } from "node:path";
+import { join as join73, resolve as resolve46 } from "node:path";
 function parseGitdirPointer(dotGitFileContents) {
   const m = /^gitdir:\s*(.+?)\s*$/m.exec(dotGitFileContents);
   return m ? m[1] : null;
@@ -83109,7 +83540,7 @@ function looksLikeAgentWorktree(path7, branch) {
   return false;
 }
 function isEphemeralPath(path7) {
-  const p = resolve45(path7);
+  const p = resolve46(path7);
   for (const root of ["/tmp", "/host", "/state"]) {
     if (p === root || p.startsWith(root + "/"))
       return true;
@@ -83149,20 +83580,20 @@ function defaultPrSignal(repo, branch, exec) {
   }
 }
 function trashRoot() {
-  return resolve45(process.env.SWITCHROOM_WORKTREE_TRASH ?? join72(homedir44(), ".switchroom", "worktree-gc-trash"));
+  return resolve46(process.env.SWITCHROOM_WORKTREE_TRASH ?? join73(homedir44(), ".switchroom", "worktree-gc-trash"));
 }
 function planGc(roots, deps = {}) {
-  const exists = deps.existsSync ?? existsSync72;
+  const exists = deps.existsSync ?? existsSync73;
   const readDir = deps.readDir ?? ((p) => readdirSync25(p));
-  const readFile4 = deps.readFile ?? ((p) => readFileSync62(p, "utf8"));
+  const readFile4 = deps.readFile ?? ((p) => readFileSync63(p, "utf8"));
   const stat3 = deps.stat ?? ((p) => statSync31(p));
   const exec = deps.exec ?? defaultExec;
   const prSignal = deps.prSignal ?? ((repo, branch) => defaultPrSignal(repo, branch, exec));
   const stamp = deps.dateStamp ?? "undated";
-  const trash = join72(trashRoot(), stamp);
+  const trash = join73(trashRoot(), stamp);
   let claimed;
   try {
-    claimed = new Set(listRecords().map((r) => resolve45(r.path)));
+    claimed = new Set(listRecords().map((r) => resolve46(r.path)));
   } catch {
     claimed = new Set;
   }
@@ -83195,10 +83626,10 @@ function planGc(roots, deps = {}) {
       continue;
     }
     for (const name of entries) {
-      const dir = join72(root, name);
+      const dir = join73(root, name);
       if (isEphemeralPath(dir))
         continue;
-      const dotGit = join72(dir, ".git");
+      const dotGit = join73(dir, ".git");
       if (!exists(dotGit))
         continue;
       let st;
@@ -83227,7 +83658,7 @@ function planGc(roots, deps = {}) {
       ownerRepos.add(repoRoot);
       if (exists(ptr))
         continue;
-      orphans.push({ dir, owner: repoRoot, dest: join72(trash, name) });
+      orphans.push({ dir, owner: repoRoot, dest: join73(trash, name) });
     }
   }
   const registered = [];
@@ -83240,8 +83671,8 @@ function planGc(roots, deps = {}) {
       continue;
     }
     for (const wt of parseWorktreeList(porcelain)) {
-      const wtPath = resolve45(wt.path);
-      const isMain = wtPath === resolve45(repo);
+      const wtPath = resolve46(wt.path);
+      const isMain = wtPath === resolve46(repo);
       const claimedWt = claimed.has(wtPath);
       const agentWt = looksLikeAgentWorktree(wt.path, wt.branch);
       const ephemeral = isEphemeralPath(wt.path);
@@ -83331,14 +83762,14 @@ function selectPurgeTargets(entries, olderThanDays) {
   return entries.filter((e) => e.ageDays >= olderThanDays).map((e) => e.path);
 }
 function listTrashEntries(nowMs, deps = {}) {
-  const exists = deps.existsSync ?? existsSync72;
+  const exists = deps.existsSync ?? existsSync73;
   const readDir = deps.readDir ?? ((p) => readdirSync25(p));
   const root = trashRoot();
   if (!exists(root))
     return [];
   const out = [];
   for (const stamp of readDir(root)) {
-    const stampDir = join72(root, stamp);
+    const stampDir = join73(root, stamp);
     let names;
     try {
       names = readDir(stampDir);
@@ -83346,7 +83777,7 @@ function listTrashEntries(nowMs, deps = {}) {
       continue;
     }
     for (const name of names) {
-      const p = join72(stampDir, name);
+      const p = join73(stampDir, name);
       let mtimeMs = nowMs;
       try {
         mtimeMs = statSync31(p).mtimeMs;
@@ -83370,7 +83801,7 @@ function purgeTrash(paths) {
   return { deleted, errors: errors2 };
 }
 function defaultRoots() {
-  return [join72(homedir44(), "code")];
+  return [join73(homedir44(), "code")];
 }
 
 // src/cli/worktree.ts
@@ -83564,7 +83995,7 @@ import {
   rmSync as rmSync16,
   writeFileSync as writeFileSync33
 } from "node:fs";
-import { join as join73 } from "node:path";
+import { join as join74 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -83754,16 +84185,16 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join73(stateBase, "google-workspace-mcp", "credentials");
+  return join74(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
   mkdirSync39(dir, { recursive: true, mode: 448 });
   chmodSync9(dir, 448);
   for (const name of readdirSync26(dir)) {
-    rmSync16(join73(dir, name), { force: true, recursive: true });
+    rmSync16(join74(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join73(dir, filename);
+  const filePath = join74(dir, filename);
   writeFileSync33(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync9(filePath, 384);
   return filePath;
@@ -83923,7 +84354,7 @@ function registerDriveMcpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn5 } from "node:child_process";
 import { writeFileSync as writeFileSync34, mkdirSync as mkdirSync40 } from "node:fs";
-import { dirname as dirname20, join as join74 } from "node:path";
+import { dirname as dirname20, join as join75 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -83955,7 +84386,7 @@ function writeRefreshHeartbeat(agentName, data) {
 function heartbeatPath(agentName) {
   const override = process.env.SWITCHROOM_M365_HEARTBEAT_DIR;
   if (override) {
-    return join74(override, `m365-launcher-${agentName}.heartbeat.json`);
+    return join75(override, `m365-launcher-${agentName}.heartbeat.json`);
   }
   return "/state/agent/m365-launcher.heartbeat.json";
 }
@@ -83979,20 +84410,20 @@ function wireStdio(child) {
 async function killChild(child, gracefulMs = 3000) {
   if (child.exitCode !== null || child.signalCode !== null)
     return;
-  return new Promise((resolve46) => {
+  return new Promise((resolve47) => {
     let killTimer = null;
     const onExit = () => {
       if (killTimer) {
         clearTimeout(killTimer);
         killTimer = null;
       }
-      resolve46();
+      resolve47();
     };
     child.once("exit", onExit);
     try {
       child.kill("SIGTERM");
     } catch {
-      resolve46();
+      resolve47();
       return;
     }
     killTimer = setTimeout(() => {
@@ -84106,8 +84537,8 @@ async function runMs365McpLauncher(opts, rt) {
   };
   process.on("SIGINT", onSignal);
   process.on("SIGTERM", onSignal);
-  return new Promise((resolve46) => {
-    resolveLauncher = resolve46;
+  return new Promise((resolve47) => {
+    resolveLauncher = resolve47;
   });
 }
 function registerM365McpLauncherCommand(program3) {
@@ -84140,7 +84571,7 @@ function registerM365McpLauncherCommand(program3) {
 // src/cli/notion-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
-import { existsSync as existsSync73, mkdirSync as mkdirSync41, writeFileSync as writeFileSync35 } from "node:fs";
+import { existsSync as existsSync74, mkdirSync as mkdirSync41, writeFileSync as writeFileSync35 } from "node:fs";
 import { dirname as dirname21 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
 var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
@@ -84152,7 +84583,7 @@ function buildNotionMcpArgs(opts) {
 function defaultWriteHeartbeat(path7, contents) {
   try {
     const dir = dirname21(path7);
-    if (!existsSync73(dir))
+    if (!existsSync74(dir))
       mkdirSync41(dir, { recursive: true });
     writeFileSync35(path7, contents);
   } catch {}
@@ -84209,23 +84640,23 @@ async function runNotionMcpLauncher(opts, runtime) {
   };
   process.on("SIGTERM", () => forward("SIGTERM"));
   process.on("SIGINT", () => forward("SIGINT"));
-  const exitCode = await new Promise((resolve46) => {
+  const exitCode = await new Promise((resolve47) => {
     child.once("exit", (code, signal) => {
       clearTimer(heartbeatHandle);
       if (typeof code === "number") {
-        resolve46(code);
+        resolve47(code);
       } else if (signal) {
         const sigCode = { SIGTERM: 15, SIGINT: 2, SIGKILL: 9 }[signal] ?? 1;
-        resolve46(128 + sigCode);
+        resolve47(128 + sigCode);
       } else {
-        resolve46(1);
+        resolve47(1);
       }
     });
     child.once("error", (err) => {
       clearTimer(heartbeatHandle);
       process.stderr.write(`notion-mcp-launcher: child spawn error: ${err.message}
 `);
-      resolve46(1);
+      resolve47(1);
     });
   });
   return exitCode;
@@ -84264,7 +84695,7 @@ function registerNotionMcpLauncherCommand(program3) {
 
 // src/cli/deliver-file.ts
 init_client2();
-import { readFileSync as readFileSync63, statSync as statSync32 } from "node:fs";
+import { readFileSync as readFileSync64, statSync as statSync32 } from "node:fs";
 import { basename as basename10 } from "node:path";
 
 // src/delivery/onedrive.ts
@@ -84604,7 +85035,7 @@ async function defaultResolveProvider() {
 async function runDeliverFile(localPath, deps = {}) {
   const agentName = safeAgentName(deps.agentName ?? process.env.SWITCHROOM_AGENT_NAME);
   const sizeOf = deps.fileSize ?? ((p) => statSync32(p).size);
-  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync63(p)));
+  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync64(p)));
   const resolveProvider = deps.resolveProvider ?? defaultResolveProvider;
   let size;
   try {
@@ -84894,7 +85325,7 @@ async function fetchToken(vaultKey) {
 
 // src/cli/apply.ts
 init_source();
-import { accessSync as accessSync3, chownSync as chownSync7, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync76, mkdirSync as mkdirSync44, readFileSync as readFileSync65, readdirSync as readdirSync27, renameSync as renameSync15, writeFileSync as writeFileSync38 } from "node:fs";
+import { accessSync as accessSync3, chownSync as chownSync7, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync77, mkdirSync as mkdirSync44, readFileSync as readFileSync66, readdirSync as readdirSync27, renameSync as renameSync15, writeFileSync as writeFileSync38 } from "node:fs";
 import { mkdir as mkdir2 } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
@@ -85286,7 +85717,7 @@ agents:
 // src/cli/apply.ts
 init_resolver();
 init_merge();
-import { dirname as dirname24, join as join78, resolve as resolve47 } from "node:path";
+import { dirname as dirname24, join as join79, resolve as resolve48 } from "node:path";
 import { homedir as homedir46 } from "node:os";
 import { execFileSync as execFileSync25 } from "node:child_process";
 init_vault();
@@ -85295,7 +85726,7 @@ init_loader();
 
 // src/agents/connection-health.ts
 import { mkdirSync as mkdirSync42, writeFileSync as writeFileSync36 } from "node:fs";
-import { join as join75 } from "node:path";
+import { join as join76 } from "node:path";
 var CONNECTION_HEALTH_FILENAME = "connection-health.json";
 async function computeAgentConnectionIssues(config, agentName, vaultAclReader) {
   const reqs = computeMcpSecretRequirements(config).filter((r) => r.agent === agentName);
@@ -85353,8 +85784,8 @@ async function computeAgentConnectionIssues(config, agentName, vaultAclReader) {
   return issues;
 }
 function writeConnectionHealthFile(agentDir, health, deps) {
-  const dir = join75(agentDir, ".claude");
-  const path7 = join75(dir, CONNECTION_HEALTH_FILENAME);
+  const dir = join76(agentDir, ".claude");
+  const path7 = join76(dir, CONNECTION_HEALTH_FILENAME);
   (deps?.mkdir ?? ((p, o) => mkdirSync42(p, o)))(dir, { recursive: true });
   (deps?.writeFile ?? ((p, d) => writeFileSync36(p, d)))(path7, JSON.stringify(health, null, 2) + `
 `);
@@ -85375,12 +85806,12 @@ async function refreshAgentConnectionHealth(config, agentName, agentDir, deps) {
 }
 
 // src/cli/update-prompt-hook.ts
-import { existsSync as existsSync74, readFileSync as readFileSync64, writeFileSync as writeFileSync37, chmodSync as chmodSync10, mkdirSync as mkdirSync43 } from "node:fs";
-import { join as join76 } from "node:path";
+import { existsSync as existsSync75, readFileSync as readFileSync65, writeFileSync as writeFileSync37, chmodSync as chmodSync10, mkdirSync as mkdirSync43 } from "node:fs";
+import { join as join77 } from "node:path";
 var HOOK_FILENAME = "update-card-on-prompt.sh";
 var CONTAINER_AGENT_DIR = "/state/agent";
 function containerHookCommand() {
-  return join76(CONTAINER_AGENT_DIR, ".claude", "hooks", HOOK_FILENAME);
+  return join77(CONTAINER_AGENT_DIR, ".claude", "hooks", HOOK_FILENAME);
 }
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -85446,12 +85877,12 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join76(agentDir, ".claude", "hooks");
+  const hooksDir = join77(agentDir, ".claude", "hooks");
   mkdirSync43(hooksDir, { recursive: true });
-  const scriptPath = join76(hooksDir, HOOK_FILENAME);
+  const scriptPath = join77(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
-  const existing = existsSync74(scriptPath) ? readFileSync64(scriptPath, "utf-8") : "";
+  const existing = existsSync75(scriptPath) ? readFileSync65(scriptPath, "utf-8") : "";
   if (existing !== desired) {
     writeFileSync37(scriptPath, desired, { mode: 493 });
     chmodSync10(scriptPath, 493);
@@ -85461,11 +85892,11 @@ function installUpdatePromptHook(agentDir) {
       chmodSync10(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join76(agentDir, ".claude", "settings.json");
-  if (!existsSync74(settingsPath)) {
+  const settingsPath = join77(agentDir, ".claude", "settings.json");
+  if (!existsSync75(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
-  const raw = readFileSync64(settingsPath, "utf-8");
+  const raw = readFileSync65(settingsPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -85575,7 +86006,7 @@ var EMBEDDED_EXAMPLES = {
   switchroom: switchroom_default,
   minimal: minimal_default
 };
-var DEFAULT_COMPOSE_PATH2 = join78(homedir46(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH2 = join79(homedir46(), ".switchroom", "compose", "docker-compose.yml");
 var COMPOSE_PROJECT2 = "switchroom";
 function effectiveLiteLLMEnabled(config, agentResolvedLitellm) {
   return agentResolvedLitellm?.enabled ?? config.litellm?.enabled ?? false;
@@ -85586,7 +86017,7 @@ async function resolveOperatorVaultPassphrase(home2) {
     return envPass;
   try {
     const { readAutoUnlockFile: readAutoUnlockFile2 } = await Promise.resolve().then(() => (init_auto_unlock(), exports_auto_unlock));
-    const blobPath = join78(home2, ".switchroom", "vault-auto-unlock");
+    const blobPath = join79(home2, ".switchroom", "vault-auto-unlock");
     const pass = readAutoUnlockFile2(blobPath);
     return pass && pass.length > 0 ? pass : null;
   } catch {
@@ -85633,9 +86064,9 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
   const oauthAccount = config.auth?.active;
   let pendingConfigEdits = false;
   let configText = null;
-  if (switchroomConfigPath && existsSync76(switchroomConfigPath)) {
+  if (switchroomConfigPath && existsSync77(switchroomConfigPath)) {
     try {
-      configText = readFileSync65(switchroomConfigPath, "utf-8");
+      configText = readFileSync66(switchroomConfigPath, "utf-8");
     } catch (err) {
       ctx.writeErr(source_default.yellow(`  ! litellm: could not read config for ACL grants (${err.message}); keys will be provisioned but agents may lack read-ACL.
 `));
@@ -85798,10 +86229,10 @@ function resolveVaultBindMountDir(homeDir, ctx) {
   if (isCustomPath && ctx.customVaultPath) {
     return dirname24(ctx.customVaultPath);
   }
-  return join78(homeDir, ".switchroom", "vault");
+  return join79(homeDir, ".switchroom", "vault");
 }
 function inspectVaultBindMountDir(vaultDir) {
-  if (!existsSync76(vaultDir))
+  if (!existsSync77(vaultDir))
     return { kind: "missing" };
   const entries = readdirSync27(vaultDir);
   const unknown = [];
@@ -85829,43 +86260,43 @@ function hasVaultRefs(value) {
 async function ensureHostMountSources(config) {
   const home2 = resolveHostHomeForCompose();
   const dirs = [
-    join78(home2, ".switchroom", "approvals"),
-    join78(home2, ".switchroom", "scheduler"),
-    join78(home2, ".switchroom", "logs"),
-    join78(home2, ".switchroom", "compose"),
-    join78(home2, ".switchroom", "broker-operator")
+    join79(home2, ".switchroom", "approvals"),
+    join79(home2, ".switchroom", "scheduler"),
+    join79(home2, ".switchroom", "logs"),
+    join79(home2, ".switchroom", "compose"),
+    join79(home2, ".switchroom", "broker-operator")
   ];
   for (const name of Object.keys(config.agents)) {
-    dirs.push(join78(home2, ".switchroom", "agents", name));
-    dirs.push(join78(home2, ".switchroom", "logs", name));
-    dirs.push(join78(home2, ".claude", "projects", name));
-    dirs.push(join78(home2, ".switchroom", "audit", name));
-    if (existsSync76(join78(home2, ".switchroom-config"))) {
-      dirs.push(join78(home2, ".switchroom-config", "agents", name, "personal-skills"));
+    dirs.push(join79(home2, ".switchroom", "agents", name));
+    dirs.push(join79(home2, ".switchroom", "logs", name));
+    dirs.push(join79(home2, ".claude", "projects", name));
+    dirs.push(join79(home2, ".switchroom", "audit", name));
+    if (existsSync77(join79(home2, ".switchroom-config"))) {
+      dirs.push(join79(home2, ".switchroom-config", "agents", name, "personal-skills"));
     }
   }
   for (const dir of dirs) {
     await mkdir2(dir, { recursive: true });
   }
-  const autoUnlockPath = join78(home2, ".switchroom", "vault-auto-unlock");
-  if (!existsSync76(autoUnlockPath)) {
+  const autoUnlockPath = join79(home2, ".switchroom", "vault-auto-unlock");
+  if (!existsSync77(autoUnlockPath)) {
     writeFileSync38(autoUnlockPath, "", { mode: 384 });
   }
-  const auditLogPath = join78(home2, ".switchroom", "vault-audit.log");
-  if (!existsSync76(auditLogPath)) {
+  const auditLogPath = join79(home2, ".switchroom", "vault-audit.log");
+  if (!existsSync77(auditLogPath)) {
     writeFileSync38(auditLogPath, "", { mode: 420 });
   }
-  const grantsDbPath = join78(home2, ".switchroom", "vault-grants.db");
-  if (!existsSync76(grantsDbPath)) {
+  const grantsDbPath = join79(home2, ".switchroom", "vault-grants.db");
+  if (!existsSync77(grantsDbPath)) {
     writeFileSync38(grantsDbPath, "", { mode: 384 });
   }
-  const hostdAuditLogPath = join78(home2, ".switchroom", "host-control-audit.log");
-  if (!existsSync76(hostdAuditLogPath)) {
+  const hostdAuditLogPath = join79(home2, ".switchroom", "host-control-audit.log");
+  if (!existsSync77(hostdAuditLogPath)) {
     writeFileSync38(hostdAuditLogPath, "", { mode: 420 });
   }
   for (const name of Object.keys(config.agents)) {
-    const tokenPath = join78(home2, ".switchroom", "agents", name, ".vault-token");
-    if (!existsSync76(tokenPath)) {
+    const tokenPath = join79(home2, ".switchroom", "agents", name, ".vault-token");
+    if (!existsSync77(tokenPath)) {
       writeFileSync38(tokenPath, "", { mode: 384 });
     }
     try {
@@ -85873,16 +86304,16 @@ async function ensureHostMountSources(config) {
       chownSync7(tokenPath, uid, uid);
     } catch {}
   }
-  const fleetDir = join78(home2, ".switchroom", "fleet");
+  const fleetDir = join79(home2, ".switchroom", "fleet");
   await mkdir2(fleetDir, { recursive: true });
-  const invariantsPath = join78(fleetDir, "switchroom-invariants.md");
+  const invariantsPath = join79(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
-  const invariantsCurrent = existsSync76(invariantsPath) ? readFileSync65(invariantsPath, "utf-8") : null;
+  const invariantsCurrent = existsSync77(invariantsPath) ? readFileSync66(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
     writeFileSync38(invariantsPath, invariantsCanonical, { mode: 420 });
   }
-  const fleetClaudePath = join78(fleetDir, "CLAUDE.md");
-  if (!existsSync76(fleetClaudePath)) {
+  const fleetClaudePath = join79(fleetDir, "CLAUDE.md");
+  if (!existsSync77(fleetClaudePath)) {
     writeFileSync38(fleetClaudePath, [
       "# Switchroom fleet defaults",
       "",
@@ -85914,7 +86345,7 @@ ${out.trim()}`;
 }
 function runApplyPreflight(config, opts = {}) {
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (hasVaultRefs(config) && !existsSync76(vaultPath)) {
+  if (hasVaultRefs(config) && !existsSync77(vaultPath)) {
     throw new Error(`Config references vault keys (vault:<name>) but ${vaultPath} is missing. Run \`switchroom setup\` first to initialise the vault.`);
   }
   const detect = opts.detectComposeV2 ?? detectComposeV2;
@@ -85925,7 +86356,7 @@ function runApplyPreflight(config, opts = {}) {
   detectAndReportLegacyGdriveSlots(vaultPath);
 }
 function detectAndReportLegacyGdriveSlots(vaultPath) {
-  if (!existsSync76(vaultPath))
+  if (!existsSync77(vaultPath))
     return;
   const passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
   if (!passphrase)
@@ -85966,8 +86397,8 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 }
 function writeInstallTypeCache(homeDir = homedir46()) {
   const ctx = detectInstallType();
-  const dir = join78(homeDir, ".switchroom");
-  const out = join78(dir, "install-type.json");
+  const dir = join79(homeDir, ".switchroom");
+  const out = join79(dir, "install-type.json");
   const tmp = `${out}.tmp`;
   mkdirSync44(dir, { recursive: true });
   const payload = {
@@ -86034,17 +86465,17 @@ Applying switchroom config...
       writeOut(source_default.green(`  + ${name}`) + source_default.gray(` (${agentConfig.extends ?? "default"}) \u2014 ${detail}
 `));
       try {
-        installUpdatePromptHook(join78(agentsDir, name));
+        installUpdatePromptHook(join79(agentsDir, name));
       } catch (hookErr) {
         writeOut(source_default.gray(`    (update-prompt hook install failed for ${name}: ${hookErr.message})
 `));
       }
-      await refreshAgentConnectionHealth(config, name, join78(agentsDir, name), {
+      await refreshAgentConnectionHealth(config, name, join79(agentsDir, name), {
         vaultAclReader: connHealthVaultAclReader
       });
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join78(agentsDir, name), uid, {
+        alignAgentUid(name, join79(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -86089,7 +86520,7 @@ Applying switchroom config...
     for (const name of agentNames) {
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join78(agentsDir, name), uid, {
+        alignAgentUid(name, join79(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -86230,8 +86661,8 @@ function copyExampleConfig2(name) {
   if (!/^[a-z0-9_-]+$/.test(name)) {
     throw new Error(`Invalid example name: ${name} (must match /^[a-z0-9_-]+$/)`);
   }
-  const dest = resolve47(process.cwd(), "switchroom.yaml");
-  if (existsSync76(dest)) {
+  const dest = resolve48(process.cwd(), "switchroom.yaml");
+  if (existsSync77(dest)) {
     console.error(source_default.yellow("switchroom.yaml already exists \u2014 skipping example copy"));
     return;
   }
@@ -86241,8 +86672,8 @@ function copyExampleConfig2(name) {
     console.log(source_default.green(`Copied ${name}.yaml -> switchroom.yaml`));
     return;
   }
-  const exampleFile = resolve47(import.meta.dirname, `../../examples/${name}.yaml`);
-  if (!existsSync76(exampleFile)) {
+  const exampleFile = resolve48(import.meta.dirname, `../../examples/${name}.yaml`);
+  if (!existsSync77(exampleFile)) {
     throw new Error(`Example config not found: ${name}.yaml (available: ${Object.keys(EMBEDDED_EXAMPLES).join(", ")})`);
   }
   copyFileSync11(exampleFile, dest);
@@ -86253,8 +86684,8 @@ function findUnwritableAgentDirs(config, opts) {
   const targets = opts.only ? [opts.only] : Object.keys(config.agents ?? {});
   const unwritable = [];
   for (const name of targets) {
-    const startSh = join78(agentsDir, name, "start.sh");
-    if (!existsSync76(startSh))
+    const startSh = join79(agentsDir, name, "start.sh");
+    if (!existsSync77(startSh))
       continue;
     try {
       accessSync3(startSh, fsConstants6.W_OK);
@@ -86450,8 +86881,8 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync66, existsSync as existsSync77, readdirSync as readdirSync28 } from "node:fs";
-import { join as join79 } from "node:path";
+import { readFileSync as readFileSync67, existsSync as existsSync78, readdirSync as readdirSync28 } from "node:fs";
+import { join as join80 } from "node:path";
 import { homedir as homedir47 } from "node:os";
 
 // src/status-ask/report.ts
@@ -86726,7 +87157,7 @@ function runReport(opts) {
   for (const src of sources) {
     let content;
     try {
-      content = readFileSync66(src.path, "utf-8");
+      content = readFileSync67(src.path, "utf-8");
     } catch (err) {
       process.stderr.write(`status-ask report: cannot read ${src.path}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -86773,7 +87204,7 @@ function runReport(opts) {
 function resolveSources(explicitPath) {
   if (explicitPath != null && explicitPath.trim() !== "") {
     const trimmed = explicitPath.trim();
-    if (!existsSync77(trimmed)) {
+    if (!existsSync78(trimmed)) {
       process.stderr.write(`status-ask report: ${trimmed}: file not found
 `);
       process.exit(1);
@@ -86787,9 +87218,9 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join79(homedir47(), ".switchroom", "agents");
+    agentsDir = join80(homedir47(), ".switchroom", "agents");
   }
-  if (!existsSync77(agentsDir))
+  if (!existsSync78(agentsDir))
     return [];
   const sources = [];
   let entries;
@@ -86799,8 +87230,8 @@ function resolveSources(explicitPath) {
     return [];
   }
   for (const name of entries) {
-    const path8 = join79(agentsDir, name, "runtime-metrics.jsonl");
-    if (existsSync77(path8)) {
+    const path8 = join80(agentsDir, name, "runtime-metrics.jsonl");
+    if (existsSync78(path8)) {
       sources.push({ path: path8, agent: name });
     }
   }
@@ -86826,32 +87257,32 @@ var import_yaml21 = __toESM(require_dist(), 1);
 init_paths();
 import {
   closeSync as closeSync13,
-  existsSync as existsSync78,
+  existsSync as existsSync79,
   fsyncSync as fsyncSync6,
   mkdirSync as mkdirSync45,
   openSync as openSync13,
   readdirSync as readdirSync29,
-  readFileSync as readFileSync67,
+  readFileSync as readFileSync68,
   renameSync as renameSync16,
   statSync as statSync33,
   unlinkSync as unlinkSync14,
   writeSync as writeSync8
 } from "node:fs";
-import { join as join80, resolve as resolve48 } from "node:path";
+import { join as join81, resolve as resolve49 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
-  const base = opts.root ? resolve48(opts.root, agent) : resolve48(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join80(base, "schedule.d");
-  const scheduleStagingDir = join80(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join80(base, "skills.d");
-  const skillsStagingDir = join80(skillsDir, STAGING_SUBDIR);
+  const base = opts.root ? resolve49(opts.root, agent) : resolve49(resolveDualPath(`~/.switchroom/agents/${agent}`));
+  const scheduleDir = join81(base, "schedule.d");
+  const scheduleStagingDir = join81(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join81(base, "skills.d");
+  const skillsStagingDir = join81(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join80(base, ".lock"),
+    lockPath: join81(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
@@ -86905,8 +87336,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join80(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join80(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join81(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join81(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -86922,8 +87353,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join80(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join80(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join81(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join81(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync13(stagingPath, "w", 384);
     try {
       writeSync8(fd, yamlText);
@@ -86938,8 +87369,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join80(paths.skillsDir, `${slug}.yaml`);
-    if (!existsSync78(finalPath))
+    const finalPath = join81(paths.skillsDir, `${slug}.yaml`);
+    if (!existsSync79(finalPath))
       return false;
     unlinkSync14(finalPath);
     return true;
@@ -86947,15 +87378,15 @@ function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
 }
 function listSkillsOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync78(paths.skillsDir))
+  if (!existsSync79(paths.skillsDir))
     return [];
   const out = [];
   for (const name of readdirSync29(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join80(paths.skillsDir, name);
+    const full = join81(paths.skillsDir, name);
     try {
-      const raw = readFileSync67(full, "utf-8");
+      const raw = readFileSync68(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -86965,8 +87396,8 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join80(paths.scheduleDir, `${slug}.yaml`);
-    if (!existsSync78(finalPath))
+    const finalPath = join81(paths.scheduleDir, `${slug}.yaml`);
+    if (!existsSync79(finalPath))
       return false;
     unlinkSync14(finalPath);
     return true;
@@ -86974,15 +87405,15 @@ function deleteOverlayEntry(agent, slug, opts = {}) {
 }
 function listOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync78(paths.scheduleDir))
+  if (!existsSync79(paths.scheduleDir))
     return [];
   const out = [];
   for (const name of readdirSync29(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join80(paths.scheduleDir, name);
+    const full = join81(paths.scheduleDir, name);
     try {
-      const raw = readFileSync67(full, "utf-8");
+      const raw = readFileSync68(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -87125,23 +87556,23 @@ function reconcileAgentCronOnly(agent) {
 // src/cli/agent-config-pending.ts
 import {
   closeSync as closeSync14,
-  existsSync as existsSync79,
+  existsSync as existsSync80,
   fsyncSync as fsyncSync7,
   mkdirSync as mkdirSync46,
   openSync as openSync14,
   readdirSync as readdirSync30,
-  readFileSync as readFileSync68,
+  readFileSync as readFileSync69,
   renameSync as renameSync17,
   unlinkSync as unlinkSync15,
   writeFileSync as writeFileSync39,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join81 } from "node:path";
+import { join as join82 } from "node:path";
 import { randomBytes as randomBytes14 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join81(paths.scheduleDir, ".pending");
+  return join82(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
@@ -87154,8 +87585,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join81(dir, `${stageId}.yaml`);
-  const metaPath = join81(dir, `${stageId}.meta.json`);
+  const yamlPath = join82(dir, `${stageId}.yaml`);
+  const metaPath = join82(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -87182,19 +87613,19 @@ function stagePendingScheduleEntry(opts) {
 }
 function listPendingScheduleEntries(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  if (!existsSync79(dir))
+  if (!existsSync80(dir))
     return [];
   const out = [];
   for (const name of readdirSync30(dir).sort()) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join81(dir, name);
-    const yamlPath = join81(dir, `${stageId}.yaml`);
-    if (!existsSync79(yamlPath))
+    const metaPath = join82(dir, name);
+    const yamlPath = join82(dir, `${stageId}.yaml`);
+    if (!existsSync80(yamlPath))
       continue;
     try {
-      const meta = JSON.parse(readFileSync68(metaPath, "utf-8"));
+      const meta = JSON.parse(readFileSync69(metaPath, "utf-8"));
       if (meta?.v !== 1 || typeof meta.stage_id !== "string")
         continue;
       out.push({ stageId: meta.stage_id, agent: meta.agent, yamlPath, metaPath, meta });
@@ -87209,8 +87640,8 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join81(paths.scheduleDir, `${slug}.yaml`);
-  if (existsSync79(finalPath)) {
+  const finalPath = join82(paths.scheduleDir, `${slug}.yaml`);
+  if (existsSync80(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
   renameSync17(match.yamlPath, finalPath);
@@ -87232,7 +87663,7 @@ function denyPendingScheduleEntry(opts) {
 }
 
 // src/cli/agent-config-write.ts
-import { existsSync as existsSync80, readFileSync as readFileSync69 } from "node:fs";
+import { existsSync as existsSync81, readFileSync as readFileSync70 } from "node:fs";
 import { execFileSync as execFileSync26 } from "node:child_process";
 
 // src/scheduler/schedule-report.ts
@@ -87603,8 +88034,8 @@ function scheduleRemove(opts) {
   }
   let priorContent = null;
   try {
-    if (existsSync80(match.path))
-      priorContent = readFileSync69(match.path, "utf-8");
+    if (existsSync81(match.path))
+      priorContent = readFileSync70(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
   const reconcileFn = opts.reconcile === undefined ? opts.root ? null : reconcileAgentCronOnly : opts.reconcile;
@@ -87807,7 +88238,7 @@ function registerAgentConfigWriteCommands(program3) {
     }
     let blob;
     if (opts.jsonl) {
-      blob = existsSync80(opts.jsonl) ? readFileSync69(opts.jsonl, "utf-8") : "";
+      blob = existsSync81(opts.jsonl) ? readFileSync70(opts.jsonl, "utf-8") : "";
     } else {
       try {
         blob = execFileSync26("docker", ["exec", `switchroom-${agent}`, "cat", "/state/agent/scheduler.jsonl"], {
@@ -87839,10 +88270,10 @@ function registerAgentConfigWriteCommands(program3) {
 
 // src/cli/agent-config-skill-write.ts
 var import_yaml22 = __toESM(require_dist(), 1);
-import { existsSync as existsSync81 } from "node:fs";
+import { existsSync as existsSync82 } from "node:fs";
 init_reconcile_default_skills();
 var import_yaml23 = __toESM(require_dist(), 1);
-import { join as join82 } from "node:path";
+import { join as join83 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -87917,8 +88348,8 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join82(poolDir, skillName);
-  if (!existsSync81(skillPath)) {
+  const skillPath = join83(poolDir, skillName);
+  if (!existsSync82(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
   const yamlText = import_yaml22.stringify({ skills: [skillName] });
@@ -88082,12 +88513,12 @@ function registerAgentConfigSkillWriteCommands(program3) {
 // src/cli/skill.ts
 import {
   closeSync as closeSync15,
-  existsSync as existsSync82,
+  existsSync as existsSync83,
   lstatSync as lstatSync9,
   mkdirSync as mkdirSync47,
   mkdtempSync as mkdtempSync5,
   openSync as openSync15,
-  readFileSync as readFileSync70,
+  readFileSync as readFileSync71,
   readdirSync as readdirSync31,
   realpathSync as realpathSync7,
   renameSync as renameSync18,
@@ -88096,7 +88527,7 @@ import {
   writeFileSync as writeFileSync40
 } from "node:fs";
 import { tmpdir as tmpdir5, homedir as homedir48 } from "node:os";
-import { dirname as dirname25, join as join83, relative as relative2, resolve as resolve49 } from "node:path";
+import { dirname as dirname25, join as join84, relative as relative2, resolve as resolve50 } from "node:path";
 import { spawnSync as spawnSync14 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -88290,11 +88721,11 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join83(homedir48(), raw.slice(2));
+    return join84(homedir48(), raw.slice(2));
   }
   if (raw === "~")
     return homedir48();
-  return resolve49(raw);
+  return resolve50(raw);
 }
 function readStdinSync() {
   const chunks = [];
@@ -88329,7 +88760,7 @@ function loadFromDir(dir) {
   const walk2 = (sub) => {
     const entries = readdirSync31(sub, { withFileTypes: true });
     for (const ent of entries) {
-      const full = join83(sub, ent.name);
+      const full = join84(sub, ent.name);
       const rel = relative2(abs, full);
       if (ent.isSymbolicLink()) {
         fail3(`refusing to read symlink inside --from dir: ${rel}`);
@@ -88339,7 +88770,7 @@ function loadFromDir(dir) {
         continue;
       }
       if (ent.isFile()) {
-        const buf = readFileSync70(full);
+        const buf = readFileSync71(full);
         files[rel.replace(/\\/g, "/")] = buf.toString("utf-8");
       }
     }
@@ -88364,7 +88795,7 @@ function loadFromTarball(tarPath) {
       fail3(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
-  const staging = mkdtempSync5(join83(tmpdir5(), "skill-apply-extract-"));
+  const staging = mkdtempSync5(join84(tmpdir5(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
     const r = spawnSync14("tar", [
@@ -88388,7 +88819,7 @@ function loadFromTarball(tarPath) {
   }
 }
 function loadSingleFile(filePath) {
-  const content = readFileSync70(filePath, "utf-8");
+  const content = readFileSync71(filePath, "utf-8");
   return { "SKILL.md": content };
 }
 function loadFromStdin() {
@@ -88450,8 +88881,8 @@ function validatePayload(name, files) {
           errors2.push(`${path8} fails \`bash -n\` syntax check: ${(r.stderr ?? "").trim()}`);
         }
       } else if (PY_SCRIPT_RE2.test(path8)) {
-        const tmp = mkdtempSync5(join83(tmpdir5(), "skill-apply-py-"));
-        const tmpPy = join83(tmp, "check.py");
+        const tmp = mkdtempSync5(join84(tmpdir5(), "skill-apply-py-"));
+        const tmpPy = join84(tmp, "check.py");
         try {
           writeFileSync40(tmpPy, content);
           const r = spawnSync14("python3", ["-m", "py_compile", tmpPy], {
@@ -88471,15 +88902,15 @@ function validatePayload(name, files) {
 function diffSummary(currentDir, files) {
   const lines = [];
   const currentFiles = {};
-  if (existsSync82(currentDir)) {
+  if (existsSync83(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync31(sub, { withFileTypes: true })) {
-        const full = join83(sub, ent.name);
+        const full = join84(sub, ent.name);
         const rel = relative2(currentDir, full);
         if (ent.isDirectory()) {
           walk2(full);
         } else if (ent.isFile()) {
-          currentFiles[rel.replace(/\\/g, "/")] = readFileSync70(full, "utf-8");
+          currentFiles[rel.replace(/\\/g, "/")] = readFileSync71(full, "utf-8");
         }
       }
     };
@@ -88507,10 +88938,10 @@ function diffSummary(currentDir, files) {
 `);
 }
 function writePayload(poolDir, name, files) {
-  if (!existsSync82(poolDir)) {
+  if (!existsSync83(poolDir)) {
     mkdirSync47(poolDir, { recursive: true, mode: 493 });
   }
-  const target = join83(poolDir, name);
+  const target = join84(poolDir, name);
   let targetIsSymlink = false;
   try {
     const st = lstatSync9(target);
@@ -88521,11 +88952,11 @@ function writePayload(poolDir, name, files) {
   if (targetIsSymlink) {
     fail3(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
-  const staging = mkdtempSync5(join83(poolDir, `.skill-apply-stage-${name}-`));
+  const staging = mkdtempSync5(join84(poolDir, `.skill-apply-stage-${name}-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join83(staging, path8);
+      const full = join84(staging, path8);
       mkdirSync47(dirname25(full), { recursive: true, mode: 493 });
       const fd = openSync15(full, "wx");
       try {
@@ -88556,9 +88987,9 @@ function writePayload(poolDir, name, files) {
     try {
       rmSync17(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync82(oldRename)) {
+    if (oldRename && existsSync83(oldRename)) {
       try {
-        if (existsSync82(target)) {
+        if (existsSync83(target)) {
           rmSync17(target, { recursive: true, force: true });
         }
         renameSync18(oldRename, target);
@@ -88578,8 +89009,8 @@ function registerSkillCommand(program3) {
     if (opts.from === undefined) {
       files = loadFromStdin();
     } else {
-      const fromPath = resolve49(opts.from);
-      if (!existsSync82(fromPath)) {
+      const fromPath = resolve50(opts.from);
+      if (!existsSync83(fromPath)) {
         fail3(`--from path does not exist: ${opts.from}`);
       }
       const st = statSync34(fromPath);
@@ -88603,7 +89034,7 @@ function registerSkillCommand(program3) {
     }
     const config = loadConfig();
     const poolDir = resolveSkillsPoolDir2(config.switchroom?.skills_dir);
-    const currentDir = join83(poolDir, name);
+    const currentDir = join84(poolDir, name);
     console.log(source_default.bold(`Skill: ${name}`) + source_default.gray(` (${Object.keys(files).length} files, ${sumBytes(files)} bytes)`));
     console.log(source_default.bold("Diff vs current pool content:"));
     console.log(diffSummary(currentDir, files));
@@ -88634,12 +89065,12 @@ function sumBytes(files) {
 // src/cli/skill-personal.ts
 import {
   closeSync as closeSync16,
-  existsSync as existsSync83,
+  existsSync as existsSync84,
   lstatSync as lstatSync10,
   mkdirSync as mkdirSync48,
   mkdtempSync as mkdtempSync6,
   openSync as openSync16,
-  readFileSync as readFileSync71,
+  readFileSync as readFileSync72,
   readdirSync as readdirSync32,
   renameSync as renameSync19,
   rmSync as rmSync18,
@@ -88647,7 +89078,7 @@ import {
   utimesSync,
   writeFileSync as writeFileSync41
 } from "node:fs";
-import { dirname as dirname26, join as join84, relative as relative3, resolve as resolve50 } from "node:path";
+import { dirname as dirname26, join as join85, relative as relative3, resolve as resolve51 } from "node:path";
 import { homedir as homedir49, tmpdir as tmpdir6 } from "node:os";
 import { spawnSync as spawnSync15 } from "node:child_process";
 init_helpers();
@@ -88658,15 +89089,15 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve50(override) : join84(homedir49(), ".switchroom-config");
-  if (!existsSync83(candidate))
+  const candidate = override ? resolve51(override) : join85(homedir49(), ".switchroom-config");
+  if (!existsSync84(candidate))
     return null;
-  return join84(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
+  return join85(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
   try {
-    if (!existsSync83(configSkillsRoot))
+    if (!existsSync84(configSkillsRoot))
       return;
     const now = Date.now();
     for (const ent of readdirSync32(configSkillsRoot)) {
@@ -88679,7 +89110,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync18(join84(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync18(join85(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -88688,7 +89119,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   const configSkillsRoot = resolveConfigSkillsDir(agent);
   if (!configSkillsRoot)
     return;
-  const dest = join84(configSkillsRoot, name);
+  const dest = join85(configSkillsRoot, name);
   try {
     if (liveSkillDir !== null) {
       try {
@@ -88702,32 +89133,32 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     }
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
-      if (existsSync83(dest)) {
-        const trash = join84(configSkillsRoot, `.${name}-trash-${Date.now()}`);
+      if (existsSync84(dest)) {
+        const trash = join85(configSkillsRoot, `.${name}-trash-${Date.now()}`);
         renameSync19(dest, trash);
       }
       return;
     }
     mkdirSync48(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
-    const staging = mkdtempSync6(join84(configSkillsRoot, `.${name}-staging-`));
+    const staging = mkdtempSync6(join85(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
       mkdirSync48(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync32(src, { withFileTypes: true })) {
-        const s = join84(src, ent.name);
-        const d = join84(dst, ent.name);
+        const s = join85(src, ent.name);
+        const d = join85(dst, ent.name);
         if (ent.isSymbolicLink())
           continue;
         if (ent.isDirectory())
           walk2(s, d);
         else if (ent.isFile()) {
-          writeFileSync41(d, readFileSync71(s));
+          writeFileSync41(d, readFileSync72(s));
         }
       }
     };
     walk2(liveSkillDir, staging);
-    if (existsSync83(dest)) {
-      const prior = join84(configSkillsRoot, `.${name}-prior-${Date.now()}`);
+    if (existsSync84(dest)) {
+      const prior = join85(configSkillsRoot, `.${name}-prior-${Date.now()}`);
       renameSync19(dest, prior);
     }
     renameSync19(staging, dest);
@@ -88753,14 +89184,14 @@ function resolveAgent(opts) {
 }
 function resolveAgentsRoot(opts) {
   if (opts.root)
-    return resolve50(opts.root);
-  return join84(homedir49(), ".switchroom", "agents");
+    return resolve51(opts.root);
+  return join85(homedir49(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
-  return join84(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
+  return join85(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
 }
 function trashDir(agentsRoot, agent) {
-  return join84(agentsRoot, agent, ".claude", TRASH_DIRNAME);
+  return join85(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
 function readStdinSync2() {
   const chunks = [];
@@ -88783,14 +89214,14 @@ function readStdinSync2() {
   return Buffer.concat(chunks).toString("utf-8");
 }
 function loadFromDir2(dir) {
-  const abs = resolve50(dir);
+  const abs = resolve51(dir);
   if (!statSync35(abs).isDirectory()) {
     fail4(`--from path is not a directory: ${dir}`);
   }
   const files = {};
   const walk2 = (sub) => {
     for (const ent of readdirSync32(sub, { withFileTypes: true })) {
-      const full = join84(sub, ent.name);
+      const full = join85(sub, ent.name);
       if (ent.isSymbolicLink()) {
         fail4(`refusing to read symlink in --from dir: ${relative3(abs, full)}`);
       }
@@ -88800,7 +89231,7 @@ function loadFromDir2(dir) {
       }
       if (ent.isFile()) {
         const rel = relative3(abs, full).replace(/\\/g, "/");
-        files[rel] = readFileSync71(full, "utf-8");
+        files[rel] = readFileSync72(full, "utf-8");
       }
     }
   };
@@ -88843,8 +89274,8 @@ function behavioralValidate(files) {
         errors2.push(`${path8} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
     } else if (PY_SCRIPT_RE.test(path8)) {
-      const tmp = mkdtempSync6(join84(tmpdir6(), "skill-personal-py-"));
-      const tmpPy = join84(tmp, "check.py");
+      const tmp = mkdtempSync6(join85(tmpdir6(), "skill-personal-py-"));
+      const tmpPy = join85(tmp, "check.py");
       try {
         writeFileSync41(tmpPy, content);
         const r = spawnSync15("python3", ["-m", "py_compile", tmpPy], {
@@ -88862,13 +89293,13 @@ function behavioralValidate(files) {
 }
 function sweepTrash(agentsRoot, agent) {
   const trash = trashDir(agentsRoot, agent);
-  if (!existsSync83(trash))
+  if (!existsSync84(trash))
     return;
   const now = Date.now();
   for (const ent of readdirSync32(trash, { withFileTypes: true })) {
     if (!ent.isDirectory())
       continue;
-    const entPath = join84(trash, ent.name);
+    const entPath = join85(trash, ent.name);
     try {
       const st = statSync35(entPath);
       if (now - st.mtimeMs > TRASH_TTL_MS) {
@@ -88889,11 +89320,11 @@ function writePersonalSkill(targetDir, files) {
     fail4(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
   mkdirSync48(dirname26(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join84(dirname26(targetDir), `.skill-personal-stage-`));
+  const staging = mkdtempSync6(join85(dirname26(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join84(staging, path8);
+      const full = join85(staging, path8);
       mkdirSync48(dirname26(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
@@ -88924,9 +89355,9 @@ function writePersonalSkill(targetDir, files) {
     try {
       rmSync18(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync83(oldRename)) {
+    if (oldRename && existsSync84(oldRename)) {
       try {
-        if (existsSync83(targetDir)) {
+        if (existsSync84(targetDir)) {
           rmSync18(targetDir, { recursive: true, force: true });
         }
         renameSync19(oldRename, targetDir);
@@ -88977,8 +89408,8 @@ function loadFiles(opts) {
   if (opts.from === undefined) {
     return loadFromStdin2();
   }
-  const p = resolve50(opts.from);
-  if (!existsSync83(p)) {
+  const p = resolve51(opts.from);
+  if (!existsSync84(p)) {
     fail4(`--from path does not exist: ${opts.from}`);
   }
   const st = statSync35(p);
@@ -88986,7 +89417,7 @@ function loadFiles(opts) {
     return loadFromDir2(p);
   }
   if (p.endsWith(".md")) {
-    return { "SKILL.md": readFileSync71(p, "utf-8") };
+    return { "SKILL.md": readFileSync72(p, "utf-8") };
   }
   fail4(`--from must be a directory or a .md file. Got: ${opts.from}`);
 }
@@ -89026,10 +89457,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join84(homedir49(), ".switchroom", "skills");
+  return join85(homedir49(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join84(homedir49(), ".switchroom", "skills", "_bundled");
+  return join85(homedir49(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -89039,8 +89470,8 @@ function resolveCloneSource(source, opts) {
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
-  const dir = join84(root, slug);
-  if (!existsSync83(dir)) {
+  const dir = join85(root, slug);
+  if (!existsSync84(dir)) {
     fail4(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
   const st = lstatSync10(dir);
@@ -89055,7 +89486,7 @@ function readSourceFiles(dir) {
   const skipped = [];
   const walk2 = (sub) => {
     for (const ent of readdirSync32(sub, { withFileTypes: true })) {
-      const full = join84(sub, ent.name);
+      const full = join85(sub, ent.name);
       if (ent.isSymbolicLink()) {
         continue;
       }
@@ -89075,7 +89506,7 @@ function readSourceFiles(dir) {
             fail4(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
           }
         } catch {}
-        files[rel] = readFileSync71(full, "utf-8");
+        files[rel] = readFileSync72(full, "utf-8");
       }
     }
   };
@@ -89166,7 +89597,7 @@ function removePersonalAction(name, opts) {
   const trashRoot2 = trashDir(agentsRoot, agent);
   mkdirSync48(trashRoot2, { recursive: true, mode: 493 });
   const ts = Date.now();
-  const trashTarget = join84(trashRoot2, `${name}-${ts}`);
+  const trashTarget = join85(trashRoot2, `${name}-${ts}`);
   renameSync19(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
@@ -89185,16 +89616,16 @@ function listPersonalAction(opts) {
   const agent = resolveAgent(opts);
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
-  const skillsDir = join84(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join85(agentsRoot, agent, ".claude", "skills");
   const personal = [];
-  if (existsSync83(skillsDir)) {
+  if (existsSync84(skillsDir)) {
     for (const ent of readdirSync32(skillsDir, { withFileTypes: true })) {
       if (!ent.isDirectory())
         continue;
       if (!ent.name.startsWith(PERSONAL_PREFIX))
         continue;
       const skillName = ent.name.slice(PERSONAL_PREFIX.length);
-      const skillPath = join84(skillsDir, ent.name);
+      const skillPath = join85(skillsDir, ent.name);
       let fileCount = 0;
       let totalBytes = 0;
       const walk2 = (sub) => {
@@ -89202,10 +89633,10 @@ function listPersonalAction(opts) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync35(join84(sub, e.name)).size;
+              totalBytes += statSync35(join85(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
-            walk2(join84(sub, e.name));
+            walk2(join85(sub, e.name));
           }
         }
       };
@@ -89244,28 +89675,28 @@ function registerSkillPersonalCommands(program3) {
 // src/cli/skill-search.ts
 init_helpers();
 var import_yaml25 = __toESM(require_dist(), 1);
-import { existsSync as existsSync84, readdirSync as readdirSync33, readFileSync as readFileSync72, statSync as statSync36 } from "node:fs";
+import { existsSync as existsSync85, readdirSync as readdirSync33, readFileSync as readFileSync73, statSync as statSync36 } from "node:fs";
 import { homedir as homedir50 } from "node:os";
-import { join as join85, resolve as resolve51 } from "node:path";
+import { join as join86, resolve as resolve52 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
 function defaultAgentsRoot() {
-  return resolve51(homedir50(), ".switchroom/agents");
+  return resolve52(homedir50(), ".switchroom/agents");
 }
 function defaultSharedRoot2() {
-  return resolve51(homedir50(), ".switchroom/skills");
+  return resolve52(homedir50(), ".switchroom/skills");
 }
 function defaultBundledRoot2() {
-  return resolve51(homedir50(), ".switchroom/skills/_bundled");
+  return resolve52(homedir50(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join85(skillDir, "SKILL.md");
-  if (!existsSync84(mdPath))
+  const mdPath = join86(skillDir, "SKILL.md");
+  if (!existsSync85(mdPath))
     return null;
   let content;
   try {
-    content = readFileSync72(mdPath, "utf-8");
+    content = readFileSync73(mdPath, "utf-8");
   } catch {
     return null;
   }
@@ -89293,7 +89724,7 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join85(skillDir, "SKILL.md");
+  const mdPath = join86(skillDir, "SKILL.md");
   try {
     const st = statSync36(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
@@ -89304,8 +89735,8 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join85(agentsRoot, agent, ".claude/skills");
-  if (!existsSync84(skillsDir))
+  const skillsDir = join86(agentsRoot, agent, ".claude/skills");
+  if (!existsSync85(skillsDir))
     return [];
   const out = [];
   let entries;
@@ -89317,7 +89748,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join85(skillsDir, ent);
+    const dirPath = join86(skillsDir, ent);
     try {
       if (!statSync36(dirPath).isDirectory())
         continue;
@@ -89343,7 +89774,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   return out;
 }
 function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
-  if (!existsSync84(sharedRoot))
+  if (!existsSync85(sharedRoot))
     return [];
   const out = [];
   let entries;
@@ -89357,7 +89788,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join85(sharedRoot, ent);
+    const dirPath = join86(sharedRoot, ent);
     try {
       if (!statSync36(dirPath).isDirectory())
         continue;
@@ -89381,7 +89812,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
   return out;
 }
 function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
-  if (!existsSync84(bundledRoot))
+  if (!existsSync85(bundledRoot))
     return [];
   const out = [];
   let entries;
@@ -89393,7 +89824,7 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join85(bundledRoot, ent);
+    const dirPath = join86(bundledRoot, ent);
     try {
       if (!statSync36(dirPath).isDirectory())
         continue;
@@ -89537,9 +89968,9 @@ function registerHostdMcpCommand(program3) {
 // src/cli/hostd.ts
 init_source();
 init_helpers();
-import { existsSync as existsSync86, mkdirSync as mkdirSync49, readdirSync as readdirSync34, readFileSync as readFileSync74, writeFileSync as writeFileSync42, statSync as statSync37, copyFileSync as copyFileSync12 } from "node:fs";
+import { existsSync as existsSync87, mkdirSync as mkdirSync49, readdirSync as readdirSync34, readFileSync as readFileSync75, writeFileSync as writeFileSync42, statSync as statSync37, copyFileSync as copyFileSync12 } from "node:fs";
 import { homedir as homedir51 } from "node:os";
-import { join as join86 } from "node:path";
+import { join as join87 } from "node:path";
 import { spawnSync as spawnSync19 } from "node:child_process";
 
 // src/cli/deploy-version-guard.ts
@@ -89753,14 +90184,14 @@ function resolveHostdHostHome(env2 = process.env, home2 = homedir51()) {
   return resolved;
 }
 function hostdDir() {
-  return join86(homedir51(), ".switchroom", "hostd");
+  return join87(homedir51(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join86(hostdDir(), "docker-compose.yml");
+  return join87(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
-  if (!existsSync86(p))
+  if (!existsSync87(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -89856,7 +90287,7 @@ function doStatus() {
   const composeYml = hostdComposePath();
   console.log(source_default.bold("switchroom-hostd"));
   console.log("");
-  if (!existsSync86(composeYml)) {
+  if (!existsSync87(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom hostd install` to set up."));
     return;
@@ -89877,14 +90308,14 @@ function doStatus() {
   } else {
     console.log(source_default.green(`  container:  ${ps.stdout.trim()}`));
   }
-  if (existsSync86(dir)) {
+  if (existsSync87(dir)) {
     const entries = [];
     try {
       for (const name of readdirSync34(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join86(dir, name, "sock");
-        if (existsSync86(sockPath)) {
+        const sockPath = join87(dir, name, "sock");
+        if (existsSync87(sockPath)) {
           const st = statSync37(sockPath);
           if ((st.mode & 61440) === 49152) {
             entries.push(`${name} \u2192 ${sockPath}`);
@@ -89903,7 +90334,7 @@ function doStatus() {
 }
 function doUninstall() {
   const composeYml = hostdComposePath();
-  if (!existsSync86(composeYml)) {
+  if (!existsSync87(composeYml)) {
     console.log(source_default.yellow("  No hostd install detected (no compose file at this path)."));
     return;
   }
@@ -89927,12 +90358,12 @@ function registerHostdCommand(program3) {
   hostd.command("uninstall").description("Stop the hostd container. Leaves the compose file in place for re-install.").action(() => doUninstall());
   hostd.command("audit").description("Tail and filter the hostd audit log (privileged-verb call history)").option("--tail <n>", "Number of matching entries to show (default: 50)", "50").option("--agent <name>", "Filter to a specific caller agent").option("--op <verb>", "Filter to a specific hostd verb (e.g. update_apply, agent_restart)").option("--error", "Show only failed (error/denied) entries").option("--verbose", "Show the captured stderr / error tail under each failed row").option("--path <file>", "Override audit log path (for debugging)").action((opts) => {
     const logPath = opts.path ?? defaultAuditLogPath2();
-    if (!existsSync86(logPath)) {
+    if (!existsSync87(logPath)) {
       console.error(source_default.yellow(`Audit log not found at ${logPath}.`) + source_default.gray(`
 The log is created when hostd handles its first privileged-verb request.`));
       return;
     }
-    const raw = readFileSync74(logPath, "utf-8");
+    const raw = readFileSync75(logPath, "utf-8");
     const limit = Math.max(1, parseInt(opts.tail ?? "50", 10) || 50);
     const filters = {
       agent: opts.agent,
@@ -89974,9 +90405,9 @@ The log is created when hostd handles its first privileged-verb request.`));
 // src/cli/webd.ts
 init_source();
 init_helpers();
-import { existsSync as existsSync87, mkdirSync as mkdirSync50, writeFileSync as writeFileSync43, copyFileSync as copyFileSync13 } from "node:fs";
+import { existsSync as existsSync88, mkdirSync as mkdirSync50, writeFileSync as writeFileSync43, copyFileSync as copyFileSync13 } from "node:fs";
 import { homedir as homedir52 } from "node:os";
-import { join as join87 } from "node:path";
+import { join as join88 } from "node:path";
 import { spawnSync as spawnSync20 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
@@ -90061,14 +90492,14 @@ services:
 `;
 }
 function webdDir() {
-  return join87(homedir52(), ".switchroom", "web");
+  return join88(homedir52(), ".switchroom", "web");
 }
 function webdComposePath() {
-  return join87(webdDir(), "docker-compose.yml");
+  return join88(webdDir(), "docker-compose.yml");
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
-  if (!existsSync87(p))
+  if (!existsSync88(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -90152,7 +90583,7 @@ function doStatus2() {
   const composeYml = webdComposePath();
   console.log(source_default.bold("switchroom-web"));
   console.log("");
-  if (!existsSync87(composeYml)) {
+  if (!existsSync88(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom webd install` to set up."));
     return;
@@ -90176,7 +90607,7 @@ function doStatus2() {
 }
 function doUninstall2() {
   const composeYml = webdComposePath();
-  if (!existsSync87(composeYml)) {
+  if (!existsSync88(composeYml)) {
     console.log(source_default.yellow("  No web-service install detected (no compose file at this path)."));
     return;
   }
@@ -90206,9 +90637,9 @@ function registerWebdCommand(program3) {
 // src/cli/host-repair.ts
 init_source();
 import { homedir as homedir53 } from "node:os";
-import { join as join88 } from "node:path";
+import { join as join89 } from "node:path";
 var ARTIFACT_ALLOWLIST = {
-  dockerComposePluginDir: (home2) => join88(home2, ".docker", "cli-plugins", "docker-compose"),
+  dockerComposePluginDir: (home2) => join89(home2, ".docker", "cli-plugins", "docker-compose"),
   stateSentinel: "/state"
 };
 function isStateBogusAutoDir(probe2) {