switchroom 0.17.5 → 0.17.10

package/dist/auth-broker/index.js

@@ -1,5 +1,34 @@
 import { createRequire } from "node:module";
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __returnValue = (v) => v;
 function __exportSetter(name, newValue) {
@@ -14,6 +43,7 @@ var __export = (target, all) => {
       set: __exportSetter.bind(all, name)
     });
 };
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/identity.js
@@ -6931,60 +6961,99 @@ var require_public_api = __commonJS((exports) => {
   exports.stringify = stringify;
 });
 
+// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/index.js
+var require_dist = __commonJS((exports) => {
+  var composer = require_composer();
+  var Document = require_Document();
+  var Schema = require_Schema();
+  var errors = require_errors();
+  var Alias = require_Alias();
+  var identity = require_identity();
+  var Pair = require_Pair();
+  var Scalar = require_Scalar();
+  var YAMLMap = require_YAMLMap();
+  var YAMLSeq = require_YAMLSeq();
+  var cst = require_cst();
+  var lexer = require_lexer();
+  var lineCounter = require_line_counter();
+  var parser = require_parser();
+  var publicApi = require_public_api();
+  var visit = require_visit();
+  exports.Composer = composer.Composer;
+  exports.Document = Document.Document;
+  exports.Schema = Schema.Schema;
+  exports.YAMLError = errors.YAMLError;
+  exports.YAMLParseError = errors.YAMLParseError;
+  exports.YAMLWarning = errors.YAMLWarning;
+  exports.Alias = Alias.Alias;
+  exports.isAlias = identity.isAlias;
+  exports.isCollection = identity.isCollection;
+  exports.isDocument = identity.isDocument;
+  exports.isMap = identity.isMap;
+  exports.isNode = identity.isNode;
+  exports.isPair = identity.isPair;
+  exports.isScalar = identity.isScalar;
+  exports.isSeq = identity.isSeq;
+  exports.Pair = Pair.Pair;
+  exports.Scalar = Scalar.Scalar;
+  exports.YAMLMap = YAMLMap.YAMLMap;
+  exports.YAMLSeq = YAMLSeq.YAMLSeq;
+  exports.CST = cst;
+  exports.Lexer = lexer.Lexer;
+  exports.LineCounter = lineCounter.LineCounter;
+  exports.Parser = parser.Parser;
+  exports.parse = publicApi.parse;
+  exports.parseAllDocuments = publicApi.parseAllDocuments;
+  exports.parseDocument = publicApi.parseDocument;
+  exports.stringify = publicApi.stringify;
+  exports.visit = visit.visit;
+  exports.visitAsync = visit.visitAsync;
+});
+
+// src/util/atomic.ts
+import { randomBytes } from "node:crypto";
+import { closeSync, constants, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
+function atomicWriteFileSync(destPath, contents, mode = 384) {
+  const tmp = `${destPath}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
+  const buf = typeof contents === "string" ? Buffer.from(contents, "utf-8") : contents;
+  let fd = null;
+  try {
+    fd = openSync(tmp, TMP_OPEN_FLAGS, mode);
+    writeSync(fd, buf, 0, buf.length, 0);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    renameSync(tmp, destPath);
+  } catch (err) {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {}
+    }
+    try {
+      rmSync(tmp, { force: true });
+    } catch {}
+    throw err;
+  }
+}
+function atomicWriteJsonSync(destPath, value, mode = 384) {
+  atomicWriteFileSync(destPath, JSON.stringify(value, null, 2) + `
+`, mode);
+}
+var TMP_OPEN_FLAGS;
+var init_atomic = __esm(() => {
+  TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
+});
+
 // src/auth/broker/index.ts
 import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
 
 // src/config/loader.ts
+var import_yaml2 = __toESM(require_dist(), 1);
 import { readFileSync as readFileSync2, existsSync as existsSync3 } from "node:fs";
 import { homedir } from "node:os";
 import { resolve as resolve3 } from "node:path";
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/index.js
-var composer = require_composer();
-var Document = require_Document();
-var Schema = require_Schema();
-var errors = require_errors();
-var Alias = require_Alias();
-var identity = require_identity();
-var Pair = require_Pair();
-var Scalar = require_Scalar();
-var YAMLMap = require_YAMLMap();
-var YAMLSeq = require_YAMLSeq();
-var cst = require_cst();
-var lexer = require_lexer();
-var lineCounter = require_line_counter();
-var parser = require_parser();
-var publicApi = require_public_api();
-var visit = require_visit();
-var $Composer = composer.Composer;
-var $Document = Document.Document;
-var $Schema = Schema.Schema;
-var $YAMLError = errors.YAMLError;
-var $YAMLParseError = errors.YAMLParseError;
-var $YAMLWarning = errors.YAMLWarning;
-var $Alias = Alias.Alias;
-var $isAlias = identity.isAlias;
-var $isCollection = identity.isCollection;
-var $isDocument = identity.isDocument;
-var $isMap = identity.isMap;
-var $isNode = identity.isNode;
-var $isPair = identity.isPair;
-var $isScalar = identity.isScalar;
-var $isSeq = identity.isSeq;
-var $Pair = Pair.Pair;
-var $Scalar = Scalar.Scalar;
-var $YAMLMap = YAMLMap.YAMLMap;
-var $YAMLSeq = YAMLSeq.YAMLSeq;
-var $Lexer = lexer.Lexer;
-var $LineCounter = lineCounter.LineCounter;
-var $Parser = parser.Parser;
-var $parse = publicApi.parse;
-var $parseAllDocuments = publicApi.parseAllDocuments;
-var $parseDocument = publicApi.parseDocument;
-var $stringify = publicApi.stringify;
-var $visit = visit.visit;
-var $visitAsync = visit.visitAsync;
-
 // node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -11070,8 +11139,35 @@ var AgentMemorySchema = exports_external.object({
   auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
   file: exports_external.boolean().default(true).describe("Maintain a curated workspace MEMORY.md file (seeded once, " + "auto-loaded every turn). Set false for hindsight-only memory: " + "the file is not seeded or re-created, so once migrated into " + "Hindsight and deleted it stays gone. Recall + directives carry " + "the memory instead. Cascade: override (per-agent wins over default)."),
   isolation: exports_external.enum(["default", "strict"]).default("default").describe("strict = never shared cross-agent, default = eligible for reflect"),
-  bank_mission: exports_external.string().optional().describe("Bank-level mission statement used during recall to contextualize results"),
-  retain_mission: exports_external.string().optional().describe("Instructions for the fact extraction LLM during retain"),
+  bank_mission: exports_external.string().optional().describe("Bank-level mission statement used during recall to contextualize " + "results. NOTE: this is an alias for the Hindsight engine's " + "`reflect_mission` field (verified live: switchroom's bank_mission " + "lands in `config.reflect_mission`). Prefer `reflect_mission` going " + "forward; `bank_mission` is retained for back-compat. If both are " + "set, `reflect_mission` wins. Cascade: override."),
+  reflect_mission: exports_external.string().optional().describe("Mission/context steering Hindsight Reflect operations (the bank's " + "'who am I / what matters' framing applied during recall). The " + "engine-accurate name for what `bank_mission` sets. Cascade: override."),
+  retain_mission: exports_external.string().optional().describe("Instructions for the fact extraction LLM during retain. Cascade: override."),
+  mental_models: exports_external.array(exports_external.object({
+    name: exports_external.string().min(1).describe("Stable model name (identity key for idempotent ensure). Two " + "declarations with the same name in one agent are rejected."),
+    source_query: exports_external.string().min(1).max(2000).describe("The reflection query the model answers, semantically " + "refreshed from the bank's content. Capped at 2000 chars — a " + "standing reflection query, not a document; the ceiling also " + "bounds what an agent-proposed model can smuggle past the " + "operator approval card."),
+    refresh_after_consolidation: exports_external.boolean().optional().describe("Refresh this model after each consolidation. Defaults OFF — " + "refresh adds bounded background model-spend + timeout risk " + "(RFC Phase 5), so it is opt-in per model."),
+    max_tokens: exports_external.number().int().positive().max(8192).optional().describe("Cap on the synthesized model's token size. Upper-bounded at " + "8192 — a mental model is a standing summary, not a corpus; the " + "ceiling also caps what an agent-proposed model can request.")
+  })).superRefine((models, ctx) => {
+    const seen = new Set;
+    for (let i = 0;i < models.length; i++) {
+      const key = models[i].name;
+      if (seen.has(key)) {
+        ctx.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          path: [i, "name"],
+          message: `duplicate mental_models name "${key}" — model names must be ` + `unique within an agent (they are the idempotent-ensure key)`
+        });
+      }
+      seen.add(key);
+    }
+  }).optional().describe("Operator-declared, per-specialist Hindsight mental models (RFC " + "Phase 5). Named, opt-in curated reflections this agent's bank should " + "carry — e.g. a coach's 'training-plan-state' or a lawyer's " + "'open-matters'. Ensured idempotently at scaffold/reconcile: NOTHING " + "is created unless declared here (zero declarations = zero models, " + "matching post-#2447 behaviour), and no fixed identity model is " + "reintroduced — 'who the user is' stays owned by dedicated profile " + "banks (users.*.profile_bank), never a per-agent model. Per-agent " + "ONLY: intentionally not accepted at the defaults/profile tier, so a " + "model can never be fleet-seeded — each specialist opts in on its own " + "(the invariant-clean inverse of the retired blind auto-seeding)."),
+  observations_mission: exports_external.string().optional().describe("Steers what the observation-consolidation LLM synthesises from raw " + "facts (the higher-order 'what patterns matter' lens). Cascade: override."),
+  disposition: exports_external.object({
+    skepticism: exports_external.number().int().min(1).max(5).optional().describe("How much the bank doubts unverified claims (1-5; engine default 3)."),
+    literalism: exports_external.number().int().min(1).max(5).optional().describe("How literally the bank reads statements vs inferring intent (1-5; engine default 3)."),
+    empathy: exports_external.number().int().min(1).max(5).optional().describe("How much the bank weights emotional/relational context (1-5; engine default 3).")
+  }).optional().describe("Personality traits (1-5 each) steering how this bank frames recall, " + "reflect, and observation synthesis — a coach leans empathy-high, a " + "lawyer/analyst leans skepticism/literalism-high. Maps to the engine's " + "flat `disposition_skepticism`/`_literalism`/`_empathy` fields. " + "Cascade: per-key merge (an agent overrides individual traits and " + "inherits the rest, matching `recall`)."),
+  directive_capture_nudge: exports_external.boolean().optional().describe("Deterministic directive-capture nudge (issue #2848 Stage B). When " + "on (switchroom default true — Stage A measured a ~55% miss rate on " + "durable corrections), the auto-recall hook regex-detects correction " + '/ standing-rule-shaped inbound ("always/never …", "from now on …", ' + `"stop doing …", a stated preference, "that's wrong, it's …") and ` + "appends a terse advisory to the turn's context telling the model to " + "persist the rule with mcp__hindsight__create_directive if it IS " + "durable. Detection is pure regex — the model does the judgment " + "in-session and calls create_directive itself (no model callsite, no " + "silent hook-side write). Set false to disable per-agent. " + "Cascade: override (per-agent wins over default)."),
   recall: exports_external.object({
     max_memories: exports_external.number().int().min(0).optional().describe("Cap on the number of memories injected into the prompt by " + "auto-recall, regardless of token budget. Plugin default is 12. " + "0 disables the cap (all memories Hindsight returns are injected)."),
     cache_ttl_secs: exports_external.number().int().min(0).optional().describe("Per-session recall cache TTL in seconds. When > 0, identical " + "(prompt, bank) within the same session reuse the cached recall " + "result instead of round-tripping to Hindsight. 0 disables. " + "Default is 600 (10 min) for switchroom-managed agents."),
@@ -11336,6 +11432,7 @@ var profileFields = {
     auto_recall: exports_external.boolean().optional(),
     file: exports_external.boolean().optional(),
     isolation: exports_external.enum(["default", "strict"]).optional(),
+    directive_capture_nudge: exports_external.boolean().optional(),
     recall: exports_external.object({
       max_memories: exports_external.number().int().min(0).optional(),
       cache_ttl_secs: exports_external.number().int().min(0).optional(),
@@ -11591,7 +11688,7 @@ var SwitchroomConfigSchema = exports_external.object({
       name: exports_external.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/, {
         message: "Consumer name must be a path-safe slug (letters, digits, underscore, hyphen)"
       }).describe("Socket-path identity; binds at /run/switchroom/auth-broker/<name>/sock"),
-      account: exports_external.string().min(1).describe("Pinned account label for this consumer. `get-credentials` returns " + "this account's credentials; `mark-exhausted` from this consumer " + "only affects this account."),
+      account: exports_external.string().min(1).optional().describe("Optional pinned account label for this consumer. When set, " + "`get-credentials` serves this account (with automatic failover " + "while it is quota-exhausted) and `mark-exhausted` from this " + "consumer attributes to it — use a pin for quota isolation. " + "When omitted, the consumer follows the fleet `auth.active` " + "exactly like an agent: same account swaps, same failover."),
       uid: exports_external.number().int().nonnegative().optional().describe("Optional UID to chown the consumer socket to (defaults to 0 = root, " + "suitable for sibling containers running as root)."),
       mirror_dir: exports_external.string().optional().describe("Optional host-side directory path. When set, the broker actively " + "writes the consumer's effective-account `.credentials.json` mirror " + "here — in addition to serving creds on demand via `get-credentials`. " + "Use this to eliminate the pull-latency gap: without a mirror the " + "consumer only gets failover creds at its next scheduled re-fetch " + "(up to 30 min). With a mirror the broker pushes failover creds " + "immediately when it detects exhaustion (consumer-quota-sensor tick, " + "or a mark-exhausted RPC on the pinned account). The directory must " + "be accessible to the broker container (bind-mounted from the host) " + "and to the consumer container; the broker writes " + "`<mirror_dir>/.credentials.json` atomically. Chown is attempted to " + "`uid` (default 0) — swallowed when CAP_CHOWN is absent.")
     })).optional().describe("Non-agent peers that hold a broker socket (RFC H §4.8). Each gets " + "its own `/run/switchroom/auth-broker/<name>/sock` chowned to its UID. " + "Consumers cannot be admins; a consumer name that collides with an " + "agent (whether that agent has `admin: true` or not) is a config " + "error caught at schema validation."),
@@ -11687,6 +11784,7 @@ function resolveDualPath(pathStr) {
 }
 
 // src/config/overlay-loader.ts
+var import_yaml = __toESM(require_dist(), 1);
 import { existsSync as existsSync2, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, resolve as resolve2 } from "node:path";
 
@@ -11762,7 +11860,7 @@ function applyAgentOverlays(config) {
         for (const file of files) {
           try {
             const raw = readFileSync(file, "utf-8");
-            const parsed = $parse(raw);
+            const parsed = import_yaml.parse(raw);
             const doc = OverlayDocSchema.parse(parsed);
             const title = deriveOverlayTitle(raw, basename(file));
             for (const entry of doc.schedule ?? []) {
@@ -11803,7 +11901,7 @@ function applyAgentOverlays(config) {
         for (const file of skillFiles) {
           try {
             const raw = readFileSync(file, "utf-8");
-            const parsed = $parse(raw);
+            const parsed = import_yaml.parse(raw);
             const doc = OverlayDocSchema.parse(parsed);
             for (const skillName of doc.skills ?? []) {
               if (seen.has(skillName))
@@ -11979,6 +12077,11 @@ function mergeAgentConfig(defaultsIn, agentIn) {
         continue;
       if (k === "recall" && base.recall && typeof v === "object" && v !== null && !Array.isArray(v)) {
         combined[k] = { ...base.recall, ...v };
+      } else if (k === "disposition" && base.disposition && typeof v === "object" && v !== null && !Array.isArray(v)) {
+        combined[k] = {
+          ...base.disposition,
+          ...v
+        };
       } else {
         combined[k] = v;
       }
@@ -12320,7 +12423,7 @@ function loadConfig(configPath) {
   }
   let parsed;
   try {
-    parsed = $parse(raw);
+    parsed = import_yaml2.parse(raw);
   } catch (err) {
     throw new ConfigError(`Invalid YAML in ${filePath}`, [
       `  ${err.message}`
@@ -12440,8 +12543,31 @@ function isReservedAgentName(name) {
   return RESERVED_AGENT_NAMES.has(name);
 }
 
+// src/setup/hindsight.ts
+var HINDSIGHT_DEFAULT_API_PORT = 18888;
+var HINDSIGHT_DEFAULT_MCP_URL = `http://127.0.0.1:${HINDSIGHT_DEFAULT_API_PORT}/mcp/`;
+var HINDSIGHT_DEFAULT_API_BASE_URL = HINDSIGHT_DEFAULT_MCP_URL.replace(/\/mcp\/?$/, "");
+var HINDSIGHT_CONSUMER_NAME = "hindsight";
+var HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight";
+var HINDSIGHT_IMAGE = `${HINDSIGHT_IMAGE_REPO}:latest`;
+var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`;
+var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
+var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
+
 // src/memory/hindsight.ts
 var DEFAULT_RETAIN_MISSION = "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise.";
+var PROFILE_MEMORY_DEFAULTS = {
+  "health-coach": {
+    disposition: { skepticism: 2, literalism: 2, empathy: 5 },
+    observations_mission: "Synthesise the person's wellbeing patterns, motivations, and emotional " + "context — how habits, setbacks, and encouragement connect over time."
+  },
+  "executive-assistant": {
+    disposition: { skepticism: 4, literalism: 4, empathy: 3 }
+  },
+  coding: {
+    disposition: { skepticism: 4, literalism: 5, empathy: 2 }
+  }
+};
 
 // src/agents/reconcile-default-skills.ts
 var warnedMissingPool = new Set;
@@ -12657,37 +12783,8 @@ function resolveConsumerProbeIntervalMs(env) {
   return DEFAULT_CONSUMER_PROBE_INTERVAL_MS;
 }
 
-// src/util/atomic.ts
-import { randomBytes } from "node:crypto";
-import { closeSync, constants, fsyncSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
-var TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
-function atomicWriteFileSync(destPath, contents, mode = 384) {
-  const tmp = `${destPath}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
-  const buf = typeof contents === "string" ? Buffer.from(contents, "utf-8") : contents;
-  let fd = null;
-  try {
-    fd = openSync(tmp, TMP_OPEN_FLAGS, mode);
-    writeSync(fd, buf, 0, buf.length, 0);
-    fsyncSync(fd);
-    closeSync(fd);
-    fd = null;
-    renameSync(tmp, destPath);
-  } catch (err) {
-    if (fd !== null) {
-      try {
-        closeSync(fd);
-      } catch {}
-    }
-    try {
-      rmSync(tmp, { force: true });
-    } catch {}
-    throw err;
-  }
-}
-function atomicWriteJsonSync(destPath, value, mode = 384) {
-  atomicWriteFileSync(destPath, JSON.stringify(value, null, 2) + `
-`, mode);
-}
+// src/auth/broker/server.ts
+init_atomic();
 
 // src/auth/account-store.ts
 import {
@@ -13341,6 +13438,7 @@ function resolveMicrosoftClientId(configClientId) {
 }
 
 // src/auth/broker/google-storage.ts
+init_atomic();
 import { existsSync as existsSync5, mkdirSync as mkdirSync2, readdirSync as readdirSync3, readFileSync as readFileSync4, rmSync as rmSync3, statSync as statSync3 } from "node:fs";
 import { dirname, join as join2, resolve as resolve5 } from "node:path";
 function normalizeGoogleAccountForStorage(account) {
@@ -13409,6 +13507,7 @@ function listGoogleAccounts(stateDir) {
 }
 
 // src/auth/broker/microsoft-storage.ts
+init_atomic();
 import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync5, rmSync as rmSync4, statSync as statSync4 } from "node:fs";
 import { dirname as dirname2, join as join3, resolve as resolve6 } from "node:path";
 function normalizeMicrosoftAccountForStorage(account) {
@@ -13527,19 +13626,19 @@ function classify(socketPath, config) {
   return null;
 }
 function validateConsumerNames(config) {
-  const errors3 = [];
+  const errors2 = [];
   for (const c of config.consumers) {
     if (RESERVED_NAMES.has(c)) {
-      errors3.push(`consumer name '${c}' is reserved`);
+      errors2.push(`consumer name '${c}' is reserved`);
     }
     if (config.agents.includes(c)) {
-      errors3.push(`consumer name '${c}' collides with an agent name`);
+      errors2.push(`consumer name '${c}' collides with an agent name`);
     }
     if (config.adminAgents.includes(c)) {
-      errors3.push(`consumer name '${c}' is an admin agent (consumers cannot be admins)`);
+      errors2.push(`consumer name '${c}' is an admin agent (consumers cannot be admins)`);
     }
   }
-  return errors3;
+  return errors2;
 }
 
 // src/auth/broker/protocol.ts
@@ -13910,10 +14009,12 @@ class AuthBroker {
   refreshInFlight = new Set;
   consumerLastSeen = {};
   capChownWarned = false;
+  yamlActive;
   closed = false;
   constructor(config, opts = {}) {
     this.opts = opts;
     this.config = config;
+    this.yamlActive = config.auth?.active;
     this.home = opts.home;
     this.now = opts.now ?? nowMs;
     this.operatorUid = opts.operatorUid;
@@ -14040,6 +14141,8 @@ class AuthBroker {
     this.assertConfigConsistent(config);
     const prev = this.config;
     this.config = config;
+    this.yamlActive = config.auth?.active;
+    this.applyActiveOverride();
     const wanted = new Set;
     for (const name of Object.keys(config.agents ?? {})) {
       wanted.add(this.agentSocketPath(name));
@@ -14115,7 +14218,7 @@ class AuthBroker {
     const sockPath = this.operatorSocketPath();
     await this.bindListener(sockPath, operatorUid, 384, { kind: "operator" });
   }
-  async bindListener(sockPath, targetUid, sockMode, identity2) {
+  async bindListener(sockPath, targetUid, sockMode, identity) {
     const dir = dirname3(sockPath);
     if (existsSync7(dir)) {
       try {
@@ -14134,7 +14237,7 @@ class AuthBroker {
     }
     await new Promise((resolveP, rejectP) => {
       const server = net.createServer((sock) => {
-        this.handleConnection(sock, sockPath, identity2);
+        this.handleConnection(sock, sockPath, identity);
       });
       server.on("error", (err) => rejectP(err));
       server.listen(sockPath, () => {
@@ -14147,7 +14250,7 @@ class AuthBroker {
         try {
           chownSync2(dir, targetUid, targetUid);
         } catch {}
-        this.listeners.set(sockPath, { server, identity: identity2, socketPath: sockPath });
+        this.listeners.set(sockPath, { server, identity, socketPath: sockPath });
         resolveP();
       });
     });
@@ -14191,7 +14294,7 @@ class AuthBroker {
       socket.write(encodeError(reqId, "INVALID_ARGS", err.message));
       return;
     }
-    const identity2 = classify(sockPath, configToShape(this.config)) ?? boundIdentity;
+    const identity = classify(sockPath, configToShape(this.config)) ?? boundIdentity;
     try {
       switch (req.op) {
         case "get-credentials": {
@@ -14201,22 +14304,22 @@ class AuthBroker {
             break;
           }
           if (provider === "anthropic") {
-            await this.opGetCredentials(socket, reqId, identity2);
+            await this.opGetCredentials(socket, reqId, identity);
             break;
           }
           if (provider === "google") {
-            await this.opGoogleGetCredentials(socket, reqId, identity2);
+            await this.opGoogleGetCredentials(socket, reqId, identity);
             break;
           }
           if (provider === "microsoft") {
-            await this.opMicrosoftGetCredentials(socket, reqId, identity2);
+            await this.opMicrosoftGetCredentials(socket, reqId, identity);
             break;
           }
           socket.write(encodeError(reqId, "INTERNAL", `unhandled provider '${provider}' in get-credentials dispatch`));
           break;
         }
         case "list-state":
-          await this.opListState(socket, reqId, identity2);
+          await this.opListState(socket, reqId, identity);
           break;
         case "set-active": {
           const provider = req.provider ?? "anthropic";
@@ -14224,11 +14327,11 @@ class AuthBroker {
             socket.write(encodeError(reqId, "INVALID_ARGS", `set-active is Anthropic-only — Google's account-active model is per-agent via google_accounts.enabled_for[]`));
             break;
           }
-          await this.opSetActive(socket, reqId, identity2, req.account);
+          await this.opSetActive(socket, reqId, identity, req.account);
           break;
         }
         case "mark-exhausted":
-          await this.opMarkExhausted(socket, reqId, identity2, req.until);
+          await this.opMarkExhausted(socket, reqId, identity, req.until);
           break;
         case "refresh-account": {
           const provider = req.provider ?? "anthropic";
@@ -14237,7 +14340,7 @@ class AuthBroker {
             break;
           }
           if (provider === "anthropic") {
-            await this.opRefreshAccount(socket, reqId, identity2, req.account);
+            await this.opRefreshAccount(socket, reqId, identity, req.account);
             break;
           }
           socket.write(encodeError(reqId, "INVALID_ARGS", `refresh-account dispatch through provider '${provider}' storage path lands in Phase 3b.2c (vault-broker-mediated, not direct-to-disk like Anthropic)`));
@@ -14256,17 +14359,17 @@ class AuthBroker {
           }
           if (provider === "anthropic") {
             const anthropicCreds = req.credentials;
-            await this.opAddAccount(socket, reqId, identity2, req.label, anthropicCreds, req.replace ?? false);
+            await this.opAddAccount(socket, reqId, identity, req.label, anthropicCreds, req.replace ?? false);
             break;
           }
           if (provider === "google") {
             const googleCreds = req.credentials;
-            await this.opGoogleAddAccount(socket, reqId, identity2, req.label, googleCreds, req.replace ?? false);
+            await this.opGoogleAddAccount(socket, reqId, identity, req.label, googleCreds, req.replace ?? false);
             break;
           }
           if (provider === "microsoft") {
             const microsoftCreds = req.credentials;
-            await this.opMicrosoftAddAccount(socket, reqId, identity2, req.label, microsoftCreds, req.replace ?? false);
+            await this.opMicrosoftAddAccount(socket, reqId, identity, req.label, microsoftCreds, req.replace ?? false);
             break;
           }
           socket.write(encodeError(reqId, "INTERNAL", `unhandled provider '${provider}' in add-account dispatch`));
@@ -14279,69 +14382,71 @@ class AuthBroker {
             break;
           }
           if (provider === "anthropic") {
-            await this.opRmAccount(socket, reqId, identity2, req.label);
+            await this.opRmAccount(socket, reqId, identity, req.label);
             break;
           }
           if (provider === "google") {
-            await this.opGoogleRmAccount(socket, reqId, identity2, req.label);
+            await this.opGoogleRmAccount(socket, reqId, identity, req.label);
             break;
           }
           if (provider === "microsoft") {
-            await this.opMicrosoftRmAccount(socket, reqId, identity2, req.label);
+            await this.opMicrosoftRmAccount(socket, reqId, identity, req.label);
             break;
           }
           socket.write(encodeError(reqId, "INTERNAL", `unhandled provider '${provider}' in rm-account dispatch`));
           break;
         }
         case "set-override":
-          await this.opSetOverride(socket, reqId, identity2, req.agent, req.account);
+          await this.opSetOverride(socket, reqId, identity, req.agent, req.account);
           break;
         case "list-google-accounts":
-          await this.opListGoogleAccounts(socket, reqId, identity2);
+          await this.opListGoogleAccounts(socket, reqId, identity);
           break;
         case "list-microsoft-accounts":
-          await this.opListMicrosoftAccounts(socket, reqId, identity2);
+          await this.opListMicrosoftAccounts(socket, reqId, identity);
           break;
         case "probe-quota":
-          await this.opProbeQuota(socket, reqId, identity2, req.accounts, req.timeoutMs, req.forceLive);
+          await this.opProbeQuota(socket, reqId, identity, req.accounts, req.timeoutMs, req.forceLive);
           break;
         case "claim-notification":
-          this.opClaimNotification(socket, reqId, identity2, req.key, req.windowMs);
+          this.opClaimNotification(socket, reqId, identity, req.key, req.windowMs);
           break;
       }
     } catch (err) {
       socket.write(encodeError(reqId, "INTERNAL", err.message));
     }
   }
-  isAdmin(identity2) {
-    if (identity2.kind === "operator")
+  isAdmin(identity) {
+    if (identity.kind === "operator")
       return true;
-    if (identity2.kind === "agent")
-      return identity2.admin;
+    if (identity.kind === "agent")
+      return identity.admin;
     return false;
   }
   respondForbidden(socket, id, why) {
     socket.write(encodeError(id, "FORBIDDEN", why));
   }
-  callerAccount(identity2) {
+  callerAccount(identity) {
     const auth = this.config.auth;
     if (!auth)
       return null;
-    if (identity2.kind === "operator")
+    if (identity.kind === "operator")
       return auth.active ?? null;
-    if (identity2.kind === "consumer") {
-      const c = (auth.consumers ?? []).find((x) => x.name === identity2.name);
-      return c?.account ?? null;
+    if (identity.kind === "consumer") {
+      const c = (auth.consumers ?? []).find((x) => x.name === identity.name);
+      if (!c)
+        return null;
+      return c.account ?? auth.active ?? null;
     }
-    const agent = (this.config.agents ?? {})[identity2.name];
+    const agent = (this.config.agents ?? {})[identity.name];
     const override = agent?.auth?.override;
     if (override)
       return override;
     return auth.active ?? null;
   }
-  servingAccount(identity2) {
-    const account = this.callerAccount(identity2);
-    if (identity2.kind === "operator")
+  servingAccount(identity) {
+    const account = this.callerAccount(identity);
+    if (identity.kind === "operator")
       return account;
     return this.accountWithFailover(account);
   }
@@ -14433,24 +14538,24 @@ class AuthBroker {
     }
     return account;
   }
-  async opGetCredentials(socket, id, identity2) {
-    const account = this.servingAccount(identity2);
+  async opGetCredentials(socket, id, identity) {
+    const account = this.servingAccount(identity);
     if (!account) {
-      this.audit({ op: "get-credentials", identity: identity2, accountKind: "claude", ok: false, error: "no-active-account" });
+      this.audit({ op: "get-credentials", identity, accountKind: "claude", ok: false, error: "no-active-account" });
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", "no active account configured"));
       return;
     }
     const creds = readAccountCredentials(account, this.home);
     if (!creds) {
-      this.audit({ op: "get-credentials", identity: identity2, account, accountKind: "claude", ok: false, error: "missing-credentials" });
+      this.audit({ op: "get-credentials", identity, account, accountKind: "claude", ok: false, error: "missing-credentials" });
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `no credentials for account '${account}'`));
       return;
     }
     const expiresAt = creds.claudeAiOauth?.expiresAt;
-    this.audit({ op: "get-credentials", identity: identity2, account, accountKind: "claude", ok: true });
+    this.audit({ op: "get-credentials", identity, account, accountKind: "claude", ok: true });
     socket.write(encodeSuccess(id, { account, credentials: creds, expiresAt }));
   }
-  async opListState(socket, id, identity2) {
+  async opListState(socket, id, identity) {
     const auth = this.config.auth ?? {};
     const accounts = listAccounts(this.home).map((label) => {
       const creds = readAccountCredentials(label, this.home);
@@ -14475,11 +14580,11 @@ class AuthBroker {
     });
     const consumers = (auth.consumers ?? []).map((c) => ({
       name: c.name,
-      account: c.account,
+      account: c.account ?? auth.active ?? "",
       last_seen_at: this.consumerLastSeen[c.name] ?? null
     }));
-    const active_overage_serving = this.isActiveOverageServing(this.callerAccount(identity2));
-    this.audit({ op: "list-state", identity: identity2, ok: true });
+    const active_overage_serving = this.isActiveOverageServing(this.callerAccount(identity));
+    this.audit({ op: "list-state", identity, ok: true });
     socket.write(encodeSuccess(id, {
       active: auth.active ?? "",
       fallback_order: auth.fallback_order ?? [],
@@ -14489,7 +14594,7 @@ class AuthBroker {
       active_overage_serving
     }));
   }
-  async opListGoogleAccounts(socket, id, identity2) {
+  async opListGoogleAccounts(socket, id, identity) {
     const accounts = listGoogleAccounts(this.stateDir).map((account) => {
       const creds = readGoogleAccountCredentials(this.stateDir, account);
       if (!creds)
@@ -14501,10 +14606,10 @@ class AuthBroker {
         clientId: creds.googleOauth.clientId
       };
     }).filter((entry) => entry !== null).sort((a, b) => a.account.localeCompare(b.account));
-    this.audit({ op: "list-google-accounts", identity: identity2, accountKind: "google", ok: true });
+    this.audit({ op: "list-google-accounts", identity, accountKind: "google", ok: true });
     socket.write(encodeSuccess(id, { accounts }));
   }
-  async opProbeQuota(socket, id, identity2, accounts, timeoutMs, forceLive) {
+  async opProbeQuota(socket, id, identity, accounts, timeoutMs, forceLive) {
     const ttlMs = forceLive ? 0 : quotaProbeTtlMs();
     const results = await Promise.all(accounts.map(async (label) => {
       const cached = this.lastQuotaCache[label];
@@ -14521,13 +14626,13 @@ class AuthBroker {
           ok: false,
           reason: "no credentials for account in broker store"
         };
-        this.audit({ op: "probe-quota", identity: identity2, account: label, accountKind: "claude", ok: false, error: "missing-credentials" });
+        this.audit({ op: "probe-quota", identity, account: label, accountKind: "claude", ok: false, error: "missing-credentials" });
         return { label, result: result2 };
       }
       const result = await this.probeQuotaSingleFlight(label, token, timeoutMs);
       this.audit({
         op: "probe-quota",
-        identity: identity2,
+        identity,
         account: label,
         accountKind: "claude",
         ok: result.ok,
@@ -14594,10 +14699,20 @@ class AuthBroker {
         continue;
       }
       this.cacheQuotaSnapshot(label, result);
+      const active = this.config.auth?.active;
+      if (label !== active)
+        continue;
+      const decision = quotaIndicatesExhaustion(result, this.isOverageAllowed(label));
+      if (!decision.exhausted)
+        continue;
+      process.stdout.write(`auth-broker: fleet-quota-probe shows ACTIVE ${label} exhausted — proactive failover
+`);
+      this.audit({ op: "mark-exhausted", identity: { kind: "operator" }, account: label, accountKind: "claude", ok: true });
+      await this.markExhaustedAndRoll(label, decision.until ?? undefined, { kind: "operator" });
     }
   }
   async consumerQuotaProbeTick() {
-    const accounts = Array.from(new Set((this.config.auth?.consumers ?? []).map((c) => c.account)));
+    const accounts = Array.from(new Set((this.config.auth?.consumers ?? []).map((c) => c.account).filter((a) => typeof a === "string" && a.length > 0)));
     for (const label of accounts) {
       const creds = readAccountCredentials(label, this.home);
       const token = creds?.claudeAiOauth?.accessToken;
@@ -14638,14 +14753,14 @@ class AuthBroker {
       this.fanoutToAffectedConsumers(label);
     }
   }
-  async opSetActive(socket, id, identity2, account) {
-    if (!this.isAdmin(identity2)) {
-      this.audit({ op: "set-active", identity: identity2, account, accountKind: "claude", ok: false, error: "FORBIDDEN" });
+  async opSetActive(socket, id, identity, account) {
+    if (!this.isAdmin(identity)) {
+      this.audit({ op: "set-active", identity, account, accountKind: "claude", ok: false, error: "FORBIDDEN" });
       this.respondForbidden(socket, id, "set-active requires admin");
       return;
     }
     if (!accountExists(account, this.home)) {
-      this.audit({ op: "set-active", identity: identity2, account, accountKind: "claude", ok: false, error: "ACCOUNT_NOT_FOUND" });
+      this.audit({ op: "set-active", identity, account, accountKind: "claude", ok: false, error: "ACCOUNT_NOT_FOUND" });
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `account '${account}' not found`));
       return;
     }
@@ -14654,18 +14769,24 @@ class AuthBroker {
       auth: { ...this.config.auth ?? {}, active: account }
     };
     this.config = cfg;
+    this.persistActiveOverride(account);
     const fanned = this.fanoutToAffectedAgents(account);
     this.fanoutAllConsumers();
-    this.audit({ op: "set-active", identity: identity2, account, accountKind: "claude", ok: true });
+    this.audit({ op: "set-active", identity, account, accountKind: "claude", ok: true });
     socket.write(encodeSuccess(id, { active: account, fanned }));
   }
-  async opMarkExhausted(socket, id, identity2, until) {
-    const account = this.callerAccount(identity2);
+  async opMarkExhausted(socket, id, identity, until) {
+    const account = this.callerAccount(identity);
     if (!account) {
-      this.audit({ op: "mark-exhausted", identity: identity2, accountKind: "claude", ok: false, error: "no-active-account" });
+      this.audit({ op: "mark-exhausted", identity, accountKind: "claude", ok: false, error: "no-active-account" });
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", "no active account configured"));
       return;
     }
+    const { rolled, rolledTo } = await this.markExhaustedAndRoll(account, until, identity);
+    this.audit({ op: "mark-exhausted", identity, account, accountKind: "claude", ok: true });
+    socket.write(encodeSuccess(id, { account, rolled, rolledTo }));
+  }
+  async markExhaustedAndRoll(account, until, identity) {
     const now = this.now();
     const exhaustedUntil = clampMarkExpiry({
       proposedUntil: until ?? now + MARK_EXHAUSTED_DEFAULT_MS,
@@ -14678,10 +14799,28 @@ class AuthBroker {
     const rolledTo = await this.nextHealthyAccountLive(account, this.config.auth?.fallback_order ?? []);
     const rolled = this.fanoutFailoverTo(account, rolledTo);
     this.fanoutToAffectedConsumers(account);
-    this.audit({ op: "mark-exhausted", identity: identity2, account, accountKind: "claude", ok: true });
-    socket.write(encodeSuccess(id, { account, rolled, rolledTo }));
+    if (rolledTo && this.config.auth?.active === account && this.exhaustionLiveCorroborated(account)) {
+      this.config = {
+        ...this.config,
+        auth: { ...this.config.auth ?? {}, active: rolledTo }
+      };
+      this.persistActiveOverride(rolledTo);
+      this.fanoutAllConsumers();
+      this.audit({ op: "auto-promote-active", identity, account: rolledTo, accountKind: "claude", ok: true });
+      process.stdout.write(`auth-broker: auto-promoted auth.active ${account} → ${rolledTo} ` + `(${account} exhausted until ${new Date(exhaustedUntil).toISOString()}) — persisted
+`);
+    }
+    return { rolled, rolledTo };
+  }
+  exhaustionLiveCorroborated(account) {
+    const snapshot = this.lastQuotaCache[account];
+    if (!snapshot || !snapshotFresh(snapshot, this.now(), MARK_EXHAUSTED_DEFAULT_MS))
+      return false;
+    if (!snapshotWalled(snapshot))
+      return false;
+    return !overageLiftsWall(snapshot, this.isOverageAllowed(account));
   }
-  opClaimNotification(socket, id, identity2, key, windowMs) {
+  opClaimNotification(socket, id, identity, key, windowMs) {
     const now = this.now();
     const prev = this.notificationClaims[key];
     const granted = prev === undefined || now - prev >= windowMs;
@@ -14692,35 +14831,35 @@ class AuthBroker {
           delete this.notificationClaims[k];
       }
       this.persistNotificationClaims();
-      this.audit({ op: "claim-notification", identity: identity2, account: key, ok: true });
+      this.audit({ op: "claim-notification", identity, account: key, ok: true });
     }
     socket.write(encodeSuccess(id, { granted }));
   }
-  async opRefreshAccount(socket, id, identity2, account) {
-    if (!this.isAdmin(identity2)) {
-      this.audit({ op: "refresh-account", identity: identity2, account, accountKind: "claude", ok: false, error: "FORBIDDEN" });
+  async opRefreshAccount(socket, id, identity, account) {
+    if (!this.isAdmin(identity)) {
+      this.audit({ op: "refresh-account", identity, account, accountKind: "claude", ok: false, error: "FORBIDDEN" });
       this.respondForbidden(socket, id, "refresh-account requires admin");
       return;
     }
     if (!accountExists(account, this.home)) {
-      this.audit({ op: "refresh-account", identity: identity2, account, accountKind: "claude", ok: false, error: "ACCOUNT_NOT_FOUND" });
+      this.audit({ op: "refresh-account", identity, account, accountKind: "claude", ok: false, error: "ACCOUNT_NOT_FOUND" });
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `account '${account}' not found`));
       return;
     }
     const result = await this.refreshOneAccount(account, true);
     if (result.kind === "failed") {
-      this.audit({ op: "refresh-account", identity: identity2, account, accountKind: "claude", ok: false, error: result.error });
+      this.audit({ op: "refresh-account", identity, account, accountKind: "claude", ok: false, error: result.error });
       socket.write(encodeError(id, "REFRESH_FAILED", result.error));
       return;
     }
     const creds = readAccountCredentials(account, this.home);
     const expiresAt = creds?.claudeAiOauth?.expiresAt;
-    this.audit({ op: "refresh-account", identity: identity2, account, accountKind: "claude", ok: true });
+    this.audit({ op: "refresh-account", identity, account, accountKind: "claude", ok: true });
     socket.write(encodeSuccess(id, { account, expiresAt }));
   }
-  async opAddAccount(socket, id, identity2, label, credentials, replace) {
-    if (!this.isAdmin(identity2)) {
-      this.audit({ op: "add-account", identity: identity2, account: label, accountKind: "claude", ok: false, error: "FORBIDDEN" });
+  async opAddAccount(socket, id, identity, label, credentials, replace) {
+    if (!this.isAdmin(identity)) {
+      this.audit({ op: "add-account", identity, account: label, accountKind: "claude", ok: false, error: "FORBIDDEN" });
       this.respondForbidden(socket, id, "add-account requires admin");
       return;
     }
@@ -14731,7 +14870,7 @@ class AuthBroker {
       return;
     }
     if (accountExists(label, this.home) && !replace) {
-      this.audit({ op: "add-account", identity: identity2, account: label, accountKind: "claude", ok: false, error: "ACCOUNT_ALREADY_EXISTS" });
+      this.audit({ op: "add-account", identity, account: label, accountKind: "claude", ok: false, error: "ACCOUNT_ALREADY_EXISTS" });
       socket.write(encodeError(id, "ACCOUNT_ALREADY_EXISTS", `account '${label}' already exists; pass replace:true to overwrite`));
       return;
     }
@@ -14749,12 +14888,12 @@ class AuthBroker {
     this.persistShaIndex();
     this.fanoutToAffectedAgents(label);
     const expiresAt = credentials.claudeAiOauth?.expiresAt;
-    this.audit({ op: "add-account", identity: identity2, account: label, accountKind: "claude", ok: true, replace });
+    this.audit({ op: "add-account", identity, account: label, accountKind: "claude", ok: true, replace });
     socket.write(encodeSuccess(id, { label, expiresAt }));
   }
-  async opRmAccount(socket, id, identity2, label) {
-    if (!this.isAdmin(identity2)) {
-      this.audit({ op: "rm-account", identity: identity2, account: label, accountKind: "claude", ok: false, error: "FORBIDDEN" });
+  async opRmAccount(socket, id, identity, label) {
+    if (!this.isAdmin(identity)) {
+      this.audit({ op: "rm-account", identity, account: label, accountKind: "claude", ok: false, error: "FORBIDDEN" });
       this.respondForbidden(socket, id, "rm-account requires admin");
       return;
     }
@@ -14787,42 +14926,42 @@ class AuthBroker {
     this.persistQuota();
     this.persistThresholdViolations();
     this.persistLastQuotaCache();
-    this.audit({ op: "rm-account", identity: identity2, account: label, accountKind: "claude", ok: true });
+    this.audit({ op: "rm-account", identity, account: label, accountKind: "claude", ok: true });
     socket.write(encodeSuccess(id, { label }));
   }
-  async opGoogleGetCredentials(socket, id, identity2) {
-    if (identity2.kind !== "agent") {
-      socket.write(encodeError(id, "INVALID_ARGS", `Google get-credentials is per-agent only (caller kind '${identity2.kind}' not supported); use the agent's per-agent socket bind`));
+  async opGoogleGetCredentials(socket, id, identity) {
+    if (identity.kind !== "agent") {
+      socket.write(encodeError(id, "INVALID_ARGS", `Google get-credentials is per-agent only (caller kind '${identity.kind}' not supported); use the agent's per-agent socket bind`));
       return;
     }
-    const agentName = identity2.name;
+    const agentName = identity.name;
     const agent = (this.config.agents ?? {})[agentName];
     const account = agent?.google_workspace?.account;
     if (!account) {
-      this.audit({ op: "get-credentials", identity: identity2, accountKind: "google", ok: false, error: "no-google-account-configured" });
+      this.audit({ op: "get-credentials", identity, accountKind: "google", ok: false, error: "no-google-account-configured" });
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `agent '${agentName}' has no google_workspace.account configured in switchroom.yaml`));
       return;
     }
     const ga = this.config.google_accounts;
     const enabledFor = ga?.[account]?.enabled_for ?? [];
     if (!enabledFor.includes(agentName)) {
-      this.audit({ op: "get-credentials", identity: identity2, account, accountKind: "google", ok: false, error: "acl-deny" });
+      this.audit({ op: "get-credentials", identity, account, accountKind: "google", ok: false, error: "acl-deny" });
       socket.write(encodeError(id, "FORBIDDEN", `agent '${agentName}' not in google_accounts['${account}'].enabled_for[] — operator must run \`switchroom auth google enable ${account} ${agentName}\``));
       return;
     }
     const creds = readGoogleAccountCredentials(this.stateDir, account);
     if (!creds) {
-      this.audit({ op: "get-credentials", identity: identity2, account, accountKind: "google", ok: false, error: "missing-credentials" });
+      this.audit({ op: "get-credentials", identity, account, accountKind: "google", ok: false, error: "missing-credentials" });
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `no Google credentials for account '${account}' — operator must run \`switchroom auth google account add ${account}\``));
       return;
     }
     const expiresAt = creds.googleOauth?.expiresAt;
-    this.audit({ op: "get-credentials", identity: identity2, account, accountKind: "google", ok: true });
+    this.audit({ op: "get-credentials", identity, account, accountKind: "google", ok: true });
     socket.write(encodeSuccess(id, { account, credentials: creds, expiresAt }));
   }
-  async opGoogleAddAccount(socket, id, identity2, label, credentials, replace) {
-    if (!this.isAdmin(identity2)) {
-      this.audit({ op: "add-account", identity: identity2, account: label, accountKind: "google", ok: false, error: "FORBIDDEN" });
+  async opGoogleAddAccount(socket, id, identity, label, credentials, replace) {
+    if (!this.isAdmin(identity)) {
+      this.audit({ op: "add-account", identity, account: label, accountKind: "google", ok: false, error: "FORBIDDEN" });
       this.respondForbidden(socket, id, "add-account requires admin");
       return;
     }
@@ -14833,7 +14972,7 @@ class AuthBroker {
       return;
     }
     if (googleAccountExists(this.stateDir, label) && !replace) {
-      this.audit({ op: "add-account", identity: identity2, account: label, accountKind: "google", ok: false, error: "ACCOUNT_ALREADY_EXISTS" });
+      this.audit({ op: "add-account", identity, account: label, accountKind: "google", ok: false, error: "ACCOUNT_ALREADY_EXISTS" });
       socket.write(encodeError(id, "ACCOUNT_ALREADY_EXISTS", `google account '${label}' already exists; pass replace:true to overwrite`));
       return;
     }
@@ -14844,12 +14983,12 @@ class AuthBroker {
       return;
     }
     const expiresAt = credentials.googleOauth?.expiresAt;
-    this.audit({ op: "add-account", identity: identity2, account: label, accountKind: "google", ok: true, replace });
+    this.audit({ op: "add-account", identity, account: label, accountKind: "google", ok: true, replace });
     socket.write(encodeSuccess(id, { label, expiresAt }));
   }
-  async opGoogleRmAccount(socket, id, identity2, label) {
-    if (!this.isAdmin(identity2)) {
-      this.audit({ op: "rm-account", identity: identity2, account: label, accountKind: "google", ok: false, error: "FORBIDDEN" });
+  async opGoogleRmAccount(socket, id, identity, label) {
+    if (!this.isAdmin(identity)) {
+      this.audit({ op: "rm-account", identity, account: label, accountKind: "google", ok: false, error: "FORBIDDEN" });
       this.respondForbidden(socket, id, "rm-account requires admin");
       return;
     }
@@ -14875,42 +15014,42 @@ class AuthBroker {
       socket.write(encodeError(id, "INTERNAL", err.message));
       return;
     }
-    this.audit({ op: "rm-account", identity: identity2, account: label, accountKind: "google", ok: true });
+    this.audit({ op: "rm-account", identity, account: label, accountKind: "google", ok: true });
     socket.write(encodeSuccess(id, { label }));
   }
-  async opMicrosoftGetCredentials(socket, id, identity2) {
-    if (identity2.kind !== "agent") {
-      socket.write(encodeError(id, "INVALID_ARGS", `Microsoft get-credentials is per-agent only (caller kind '${identity2.kind}' not supported); use the agent's per-agent socket bind`));
+  async opMicrosoftGetCredentials(socket, id, identity) {
+    if (identity.kind !== "agent") {
+      socket.write(encodeError(id, "INVALID_ARGS", `Microsoft get-credentials is per-agent only (caller kind '${identity.kind}' not supported); use the agent's per-agent socket bind`));
       return;
     }
-    const agentName = identity2.name;
+    const agentName = identity.name;
     const agent = (this.config.agents ?? {})[agentName];
     const account = agent?.microsoft_workspace?.account;
     if (!account) {
-      this.audit({ op: "get-credentials", identity: identity2, accountKind: "microsoft", ok: false, error: "no-microsoft-account-configured" });
+      this.audit({ op: "get-credentials", identity, accountKind: "microsoft", ok: false, error: "no-microsoft-account-configured" });
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `agent '${agentName}' has no microsoft_workspace.account configured in switchroom.yaml`));
       return;
     }
     const ma = this.config.microsoft_accounts;
     const enabledFor = ma?.[account]?.enabled_for ?? [];
     if (!enabledFor.includes(agentName)) {
-      this.audit({ op: "get-credentials", identity: identity2, account, accountKind: "microsoft", ok: false, error: "acl-deny" });
+      this.audit({ op: "get-credentials", identity, account, accountKind: "microsoft", ok: false, error: "acl-deny" });
       socket.write(encodeError(id, "FORBIDDEN", `agent '${agentName}' not in microsoft_accounts['${account}'].enabled_for[] — operator must run \`switchroom auth microsoft enable ${account} ${agentName}\``));
       return;
     }
     const creds = readMicrosoftAccountCredentials(this.stateDir, account);
     if (!creds) {
-      this.audit({ op: "get-credentials", identity: identity2, account, accountKind: "microsoft", ok: false, error: "missing-credentials" });
+      this.audit({ op: "get-credentials", identity, account, accountKind: "microsoft", ok: false, error: "missing-credentials" });
       socket.write(encodeError(id, "ACCOUNT_NOT_FOUND", `no Microsoft credentials for account '${account}' — operator must run \`switchroom auth microsoft account add ${account}\``));
       return;
     }
     const expiresAt = creds.microsoftOauth?.expiresAt;
-    this.audit({ op: "get-credentials", identity: identity2, account, accountKind: "microsoft", ok: true });
+    this.audit({ op: "get-credentials", identity, account, accountKind: "microsoft", ok: true });
     socket.write(encodeSuccess(id, { account, credentials: creds, expiresAt }));
   }
-  async opMicrosoftAddAccount(socket, id, identity2, label, credentials, replace) {
-    if (!this.isAdmin(identity2)) {
-      this.audit({ op: "add-account", identity: identity2, account: label, accountKind: "microsoft", ok: false, error: "FORBIDDEN" });
+  async opMicrosoftAddAccount(socket, id, identity, label, credentials, replace) {
+    if (!this.isAdmin(identity)) {
+      this.audit({ op: "add-account", identity, account: label, accountKind: "microsoft", ok: false, error: "FORBIDDEN" });
       this.respondForbidden(socket, id, "add-account requires admin");
       return;
     }
@@ -14921,7 +15060,7 @@ class AuthBroker {
       return;
     }
     if (microsoftAccountExists(this.stateDir, label) && !replace) {
-      this.audit({ op: "add-account", identity: identity2, account: label, accountKind: "microsoft", ok: false, error: "ACCOUNT_ALREADY_EXISTS" });
+      this.audit({ op: "add-account", identity, account: label, accountKind: "microsoft", ok: false, error: "ACCOUNT_ALREADY_EXISTS" });
       socket.write(encodeError(id, "ACCOUNT_ALREADY_EXISTS", `microsoft account '${label}' already exists; pass replace:true to overwrite`));
       return;
     }
@@ -14932,12 +15071,12 @@ class AuthBroker {
       return;
     }
     const expiresAt = credentials.microsoftOauth?.expiresAt;
-    this.audit({ op: "add-account", identity: identity2, account: label, accountKind: "microsoft", ok: true, replace });
+    this.audit({ op: "add-account", identity, account: label, accountKind: "microsoft", ok: true, replace });
     socket.write(encodeSuccess(id, { label, expiresAt }));
   }
-  async opMicrosoftRmAccount(socket, id, identity2, label) {
-    if (!this.isAdmin(identity2)) {
-      this.audit({ op: "rm-account", identity: identity2, account: label, accountKind: "microsoft", ok: false, error: "FORBIDDEN" });
+  async opMicrosoftRmAccount(socket, id, identity, label) {
+    if (!this.isAdmin(identity)) {
+      this.audit({ op: "rm-account", identity, account: label, accountKind: "microsoft", ok: false, error: "FORBIDDEN" });
       this.respondForbidden(socket, id, "rm-account requires admin");
       return;
     }
@@ -14963,10 +15102,10 @@ class AuthBroker {
       socket.write(encodeError(id, "INTERNAL", err.message));
       return;
     }
-    this.audit({ op: "rm-account", identity: identity2, account: label, accountKind: "microsoft", ok: true });
+    this.audit({ op: "rm-account", identity, account: label, accountKind: "microsoft", ok: true });
     socket.write(encodeSuccess(id, { label }));
   }
-  async opListMicrosoftAccounts(socket, id, identity2) {
+  async opListMicrosoftAccounts(socket, id, identity) {
     const accounts = listMicrosoftAccounts(this.stateDir).map((account) => {
       const creds = readMicrosoftAccountCredentials(this.stateDir, account);
       if (!creds)
@@ -14979,12 +15118,12 @@ class AuthBroker {
         accountType: creds.microsoftOauth.accountType
       };
     }).filter((entry) => entry !== null).sort((a, b) => a.account.localeCompare(b.account));
-    this.audit({ op: "list-microsoft-accounts", identity: identity2, accountKind: "microsoft", ok: true });
+    this.audit({ op: "list-microsoft-accounts", identity, accountKind: "microsoft", ok: true });
     socket.write(encodeSuccess(id, { accounts }));
   }
-  async opSetOverride(socket, id, identity2, agentName, account) {
-    if (!this.isAdmin(identity2)) {
-      this.audit({ op: "set-override", identity: identity2, account: account ?? undefined, accountKind: "claude", ok: false, error: "FORBIDDEN" });
+  async opSetOverride(socket, id, identity, agentName, account) {
+    if (!this.isAdmin(identity)) {
+      this.audit({ op: "set-override", identity, account: account ?? undefined, accountKind: "claude", ok: false, error: "FORBIDDEN" });
       this.respondForbidden(socket, id, "set-override requires admin");
       return;
     }
@@ -15006,7 +15145,7 @@ class AuthBroker {
     agents[agentName] = { ...cur, auth };
     this.config = { ...this.config, agents };
     this.fanoutForAgent(agentName);
-    this.audit({ op: "set-override", identity: identity2, account: account ?? undefined, accountKind: "claude", ok: true });
+    this.audit({ op: "set-override", identity, account: account ?? undefined, accountKind: "claude", ok: true });
     socket.write(encodeSuccess(id, { agent: agentName, account }));
   }
   async refreshTick() {
@@ -15187,12 +15326,15 @@ class AuthBroker {
     for (const consumer of this.config.auth?.consumers ?? []) {
       if (!consumer.mirror_dir)
         continue;
-      const isPinned = consumer.account === label;
+      const bound = consumer.account ?? this.config.auth?.active;
+      const isPinned = bound === label;
       const effective = this.servingAccountForConsumer(consumer.name);
       const isEffective = effective === label;
       if (!isPinned && !isEffective)
         continue;
-      const toMirror = effective ?? consumer.account;
+      const toMirror = effective ?? bound;
+      if (toMirror == null)
+        continue;
       if (this.mirrorAccountToConsumer(toMirror, consumer)) {
         fanned.push(consumer.name);
       }
@@ -15216,7 +15358,7 @@ class AuthBroker {
     const c = (this.config.auth?.consumers ?? []).find((x) => x.name === name);
     if (!c)
       return null;
-    return this.accountWithFailover(c.account);
+    return this.accountWithFailover(c.account ?? this.config.auth?.active);
   }
   mirrorAccountToConsumer(label, consumer) {
     const mirrorDir = consumer.mirror_dir;
@@ -15362,6 +15504,42 @@ class AuthBroker {
     this.thresholdViolations = this.readJson("threshold-violations.json") ?? {};
     this.notificationClaims = this.readJson("notification-claims.json") ?? {};
     this.lastQuotaCache = this.readJson("last-quota.json") ?? {};
+    this.applyActiveOverride();
+  }
+  applyActiveOverride() {
+    const ov = this.readJson("active-override.json");
+    if (!ov || typeof ov.active !== "string" || ov.active.length === 0)
+      return;
+    const yamlActive = this.yamlActive ?? null;
+    if ((ov.yaml_active_at_write ?? null) !== yamlActive) {
+      process.stdout.write(`auth-broker: active-override dropped — yaml auth.active changed since the swap ` + `(${ov.yaml_active_at_write ?? "unset"} → ${yamlActive ?? "unset"}); yaml wins
+`);
+      try {
+        unlinkSync(join4(this.stateDir, "active-override.json"));
+      } catch {}
+      return;
+    }
+    if (!accountExists(ov.active, this.home)) {
+      process.stdout.write(`auth-broker: active-override ignored — account '${ov.active}' not found on disk
+`);
+      return;
+    }
+    if (ov.active === this.config.auth?.active)
+      return;
+    this.config = {
+      ...this.config,
+      auth: { ...this.config.auth ?? {}, active: ov.active }
+    };
+    process.stdout.write(`auth-broker: active-override applied — auth.active ${yamlActive ?? "unset"} → ${ov.active} ` + `(persisted swap survives restarts)
+`);
+  }
+  persistActiveOverride(active) {
+    const entry = {
+      active,
+      yaml_active_at_write: this.yamlActive ?? null,
+      updated_at: this.now()
+    };
+    atomicWriteJsonSync(join4(this.stateDir, "active-override.json"), entry, 384);
   }
   readJson(name) {
     const p = join4(this.stateDir, name);