switchroom 0.18.14 → 0.18.17

package/dist/vault/broker/server.js

@@ -4281,6 +4281,9 @@ var init_schema = __esm(() => {
       window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
       max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 — a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, …). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
     }).optional().describe("Inbound coalescing — how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+    litellm_notice: exports_external.object({
+      window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 — see docs/auth.md § " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+    }).optional().describe("Debounce tuning for the litellm-local throttle notice — the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
     interrupt: exports_external.object({
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
@@ -12179,7 +12182,7 @@ var init_overlay_schema = __esm(() => {
 });
 
 // src/config/overlay-loader.ts
-import { existsSync as existsSync2, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync } from "node:fs";
 import { basename, resolve as resolve2 } from "node:path";
 function deriveOverlayTitle(raw, fileName) {
   const titleFromComment = raw.match(/^#[^\S\n]*name:[^\S\n]*(\S.*?)[^\S\n]*$/m)?.[1];
@@ -12243,7 +12246,7 @@ function applyAgentOverlays(config) {
         const merged = [...agentCfg.schedule ?? []];
         for (const file of files) {
           try {
-            const raw = readFileSync(file, "utf-8");
+            const raw = readFileSync2(file, "utf-8");
             const parsed = import_yaml.parse(raw);
             const doc = OverlayDocSchema.parse(parsed);
             const title = deriveOverlayTitle(raw, basename(file));
@@ -12284,7 +12287,7 @@ function applyAgentOverlays(config) {
         const seen = new Set(merged);
         for (const file of skillFiles) {
           try {
-            const raw = readFileSync(file, "utf-8");
+            const raw = readFileSync2(file, "utf-8");
             const parsed = import_yaml.parse(raw);
             const doc = OverlayDocSchema.parse(parsed);
             for (const skillName of doc.skills ?? []) {
@@ -12359,7 +12362,7 @@ __export(exports_loader, {
   findConfigFile: () => findConfigFile,
   ConfigError: () => ConfigError
 });
-import { readFileSync as readFileSync2, existsSync as existsSync3 } from "node:fs";
+import { readFileSync as readFileSync3, existsSync as existsSync3 } from "node:fs";
 import { homedir } from "node:os";
 import { resolve as resolve3 } from "node:path";
 function formatZodErrors(error) {
@@ -12439,7 +12442,7 @@ function loadConfig(configPath) {
   }
   let raw;
   try {
-    raw = readFileSync2(filePath, "utf-8");
+    raw = readFileSync3(filePath, "utf-8");
   } catch (err) {
     throw new ConfigError(`Failed to read config file: ${filePath}`, [
       `  ${err.message}`
@@ -18096,249 +18099,597 @@ import * as net from "node:net";
 import { mkdirSync as mkdirSync6, chmodSync as chmodSync4, chownSync, existsSync as existsSync11, readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync6, unlinkSync as unlinkSync6, writeFileSync as writeFileSync3, renameSync as renameSync7 } from "node:fs";
 
 // src/agents/compose.ts
-import { createHash } from "node:crypto";
 init_schema();
 
 // src/agents/scaffold.ts
 import { join as join4, resolve as resolve6 } from "node:path";
 init_atomic();
-init_schema();
-
-// src/config/users.ts
-init_merge();
-
-// src/agents/scaffold.ts
-init_merge();
-
-// src/config/timezone.ts
-var CONTAINER_DEFAULT_UTC_ZONES = new Set([
-  "UTC",
-  "Etc/UTC",
-  "Etc/Universal",
-  "Universal"
-]);
 
-// src/cli/agent-config.ts
-import { join } from "node:path";
-import { homedir as homedir2 } from "node:os";
-
-// src/cli/helpers.ts
-init_loader();
+// src/agents/agent-uid.ts
+import { createHash } from "node:crypto";
 
-// src/cli/agent-config.ts
-init_loader();
-init_merge();
+// src/vault/broker/peercred.ts
+import { execFileSync } from "node:child_process";
+import { readFileSync, readlinkSync, fstatSync } from "node:fs";
 
-// src/config/google-workspace-acl.ts
-function shouldEmitGdriveMcp(agentName, agentGoogleAccount, googleAccounts) {
-  if (!agentGoogleAccount)
-    return false;
-  const account = agentGoogleAccount.trim().toLowerCase();
-  if (account.length === 0)
-    return false;
-  const acctEntry = googleAccounts?.[account];
-  if (!acctEntry)
-    return false;
-  const enabledFor = acctEntry.enabled_for ?? [];
-  return enabledFor.includes(agentName);
-}
-function vaultRefKey(value) {
-  if (typeof value !== "string" || !value.startsWith("vault:"))
+// src/vault/broker/peercred-ffi.ts
+function getPeerCred(fd) {
+  if (process.platform !== "linux")
+    return null;
+  try {
+    const ffi = __require("bun:ffi");
+    const { dlopen, FFIType, ptr } = ffi;
+    const SOL_SOCKET = 1;
+    const SO_PEERCRED = 17;
+    const UCRED_SIZE = 12;
+    const cache = getPeerCred;
+    const lib = cache._lib ?? (() => {
+      const candidates = ["libc.so.6", "libc.so"];
+      const symbolSpec = {
+        getsockopt: {
+          args: [FFIType.i32, FFIType.i32, FFIType.i32, FFIType.ptr, FFIType.ptr],
+          returns: FFIType.i32
+        }
+      };
+      const errors2 = [];
+      for (const name of candidates) {
+        try {
+          const opened = dlopen(name, symbolSpec);
+          cache._lib = opened;
+          return opened;
+        } catch (e) {
+          errors2.push(`${name}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+      }
+      process.stderr.write(`[vault-broker] peercred-ffi: dlopen failed for all libc candidates ` + `(${errors2.join("; ")}); falling back to ss-parsing.
+`);
+      throw new Error("no libc candidate could be opened");
+    })();
+    const credBuf = new ArrayBuffer(UCRED_SIZE);
+    const lenBuf = new Uint32Array(1);
+    lenBuf[0] = UCRED_SIZE;
+    const rc = lib.symbols.getsockopt(fd, SOL_SOCKET, SO_PEERCRED, ptr(credBuf), ptr(lenBuf.buffer));
+    if (rc !== 0)
+      return null;
+    if (lenBuf[0] !== UCRED_SIZE)
+      return null;
+    const view = new DataView(credBuf);
+    return {
+      pid: view.getInt32(0, true),
+      uid: view.getInt32(4, true),
+      gid: view.getInt32(8, true)
+    };
+  } catch {
     return null;
-  const key = value.slice("vault:".length).split("#")[0];
-  return key.length > 0 ? key : null;
-}
-function isGoogleClientCredentialKeyForAgent(config, agentName, key) {
-  if (!agentName || !key)
-    return false;
-  const agentConfig = config.agents?.[agentName];
-  if (!agentConfig)
-    return false;
-  if (agentConfig.mcp_servers?.["gdrive"] === false) {
-    return false;
-  }
-  const account = agentConfig.google_workspace?.account;
-  if (!shouldEmitGdriveMcp(agentName, account, config.google_accounts)) {
-    return false;
   }
-  const gw = config.google_workspace;
-  if (!gw)
-    return false;
-  for (const ref of [gw.google_client_id, gw.google_client_secret]) {
-    if (vaultRefKey(ref) === key)
-      return true;
+}
+
+// src/broker-common/peercred-path.ts
+function matchSocketName(socketPath, patterns, maxNameLen) {
+  if (typeof socketPath !== "string" || socketPath.length === 0)
+    return null;
+  let name = null;
+  for (const re of patterns) {
+    const m = socketPath.match(re);
+    if (m && typeof m[1] === "string") {
+      name = m[1];
+      break;
+    }
   }
-  return false;
+  if (name === null || name.length === 0)
+    return null;
+  if (maxNameLen !== undefined && name.length > maxNameLen)
+    return null;
+  return name;
+}
+function parseSocketIdentity(socketPath, spec) {
+  const name = matchSocketName(socketPath, spec.patterns, spec.maxNameLen);
+  if (name === null)
+    return null;
+  const operatorName = spec.operatorName ?? "operator";
+  if (name === operatorName)
+    return { kind: "operator" };
+  if (spec.reservedNames.has(name))
+    return null;
+  return { kind: "agent", name };
 }
 
-// src/vault/broker/acl.ts
-var WEBKITE_VAULT_KEYS = new Set([
-  "webkite/cloudflare-account-id",
-  "webkite/cloudflare-api-token",
-  "webkite/firecrawl-api-key"
-]);
-function isWebkiteCredentialKeyForAgent(agentConfig, key) {
-  if (!WEBKITE_VAULT_KEYS.has(key))
-    return false;
-  if ((agentConfig?.mcp_servers ?? {})["webkite"] === false)
-    return false;
-  return true;
+// src/vault/broker/peercred.ts
+var SOCKET_PATH_AGENT_RE = /^\/run\/switchroom\/broker\/([a-zA-Z0-9][a-zA-Z0-9_-]*)\.sock$/;
+var SOCKET_PATH_AGENT_SUBDIR_RE = /^\/run\/switchroom\/broker\/([a-zA-Z0-9][a-zA-Z0-9_-]*)\/sock$/;
+var RESERVED_AGENT_NAMES = new Set(["operator", "hostd"]);
+function socketPathToIdentity(socketPath) {
+  return parseSocketIdentity(socketPath, {
+    patterns: [SOCKET_PATH_AGENT_RE, SOCKET_PATH_AGENT_SUBDIR_RE],
+    reservedNames: RESERVED_AGENT_NAMES
+  });
 }
-function checkEntryScope(scope, agentSlug) {
-  if (scope === undefined || scope === null) {
-    return { allow: true };
+function socketPathToAgent(socketPath) {
+  const identity = socketPathToIdentity(socketPath);
+  return identity?.kind === "agent" ? identity.name : null;
+}
+function isReservedAgentName(name) {
+  return RESERVED_AGENT_NAMES.has(name);
+}
+function unlockSocketFor(dataSocketPath) {
+  if (dataSocketPath.endsWith("/sock")) {
+    return dataSocketPath.slice(0, -"/sock".length) + "/unlock";
   }
-  const deny = scope.deny ?? [];
-  const allow = scope.allow ?? [];
-  if (agentSlug !== null && deny.includes(agentSlug)) {
-    return {
-      allow: false,
-      reason: `agent '${agentSlug}' is in the entry's deny list (scope-deny)`
-    };
+  return dataSocketPath.replace(/\.sock$/, ".unlock.sock");
+}
+function parseSsRows(output) {
+  const rows = [];
+  const lines = output.split(`
+`);
+  for (const line of lines) {
+    if (!line.trim() || line.startsWith("Netid"))
+      continue;
+    const tokens = line.split(/\s+/).filter((t) => t.length > 0);
+    if (tokens.length < 8)
+      continue;
+    const localAddr = tokens[4];
+    const localInode = tokens[5];
+    const peerAddr = tokens[6];
+    const peerInode = tokens[7];
+    const usersToken = tokens.slice(8).join(" ");
+    const m = usersToken.match(/users:\(\(".*?",pid=(\d+),fd=\d+\)\)/);
+    const pid = m ? parseInt(m[1], 10) : null;
+    rows.push({ localAddr, localInode, peerAddr, peerInode, pid });
   }
-  if (allow.length > 0) {
-    if (agentSlug === null || !allow.includes(agentSlug)) {
-      return {
-        allow: false,
-        reason: agentSlug === null ? "caller agent slug could not be determined; entry has a non-empty allow list (scope-allow)" : `agent '${agentSlug}' is not in the entry's allow list (scope-allow)`
-      };
+  return rows;
+}
+function findClientPids(rows, socketPath) {
+  const pids = [];
+  for (const serverRow of rows) {
+    if (serverRow.localAddr !== socketPath)
+      continue;
+    for (const clientRow of rows) {
+      if (clientRow.localAddr !== "*")
+        continue;
+      if (clientRow.localInode !== serverRow.peerInode)
+        continue;
+      if (clientRow.pid === null)
+        continue;
+      pids.push(clientRow.pid);
+      break;
     }
   }
-  return { allow: true };
+  return pids;
 }
-function checkAclByAgent(config, agentName, key) {
-  if (!agentName) {
-    return { allow: false, reason: "agent name unresolved" };
-  }
-  const agentConfig = config.agents?.[agentName];
-  if (!agentConfig) {
-    return { allow: false, reason: `agent '${agentName}' not found in config` };
-  }
-  const googleSlot = parseGoogleAccountSlotKey(key);
-  if (googleSlot !== null) {
-    return checkGoogleAccountAcl(config, agentName, googleSlot.account, key);
+function findClientPidByServerInode(rows, socketPath, serverInode) {
+  const serverInodeStr = String(serverInode);
+  for (const serverRow of rows) {
+    if (serverRow.localAddr !== socketPath)
+      continue;
+    if (serverRow.localInode !== serverInodeStr)
+      continue;
+    for (const clientRow of rows) {
+      if (clientRow.localAddr !== "*")
+        continue;
+      if (clientRow.localInode !== serverRow.peerInode)
+        continue;
+      if (clientRow.pid === null)
+        continue;
+      return clientRow.pid;
+    }
+    return null;
   }
-  if (isGoogleClientCredentialKeyForAgent(config, agentName, key)) {
-    return { allow: true };
+  return null;
+}
+function readUid(pid) {
+  try {
+    const status = readFileSync(`/proc/${pid}/status`, "utf8");
+    const m = status.match(/^Uid:\s+(\d+)/m);
+    if (!m)
+      return null;
+    return parseInt(m[1], 10);
+  } catch {
+    return null;
   }
-  if (isWebkiteCredentialKeyForAgent(agentConfig, key)) {
-    return { allow: true };
+}
+function readExe(pid) {
+  try {
+    return readlinkSync(`/proc/${pid}/exe`);
+  } catch {
+    return null;
   }
-  const agentBot = agentConfig.bot_token;
-  const botRef = agentBot && agentBot.length > 0 ? agentBot : config.telegram?.bot_token;
-  if (typeof botRef === "string" && botRef.startsWith("vault:")) {
-    const botKey = botRef.slice("vault:".length).split("#")[0];
-    if (botKey.length > 0 && botKey === key) {
-      return { allow: true };
+}
+function readSystemdUnit(pid) {
+  try {
+    const content = readFileSync(`/proc/${pid}/cgroup`, "utf8");
+    const lines = content.split(`
+`);
+    for (const line of lines) {
+      if (!line.trim())
+        continue;
+      const parts = line.split(":");
+      if (parts.length < 3)
+        continue;
+      const controller = parts[1];
+      const isV2 = parts[0] === "0" && controller === "";
+      const isV1Systemd = controller === "name=systemd";
+      if (!isV2 && !isV1Systemd)
+        continue;
+      const cgroupPath = parts.slice(2).join(":");
+      const segments = cgroupPath.split("/");
+      const lastSegment = segments[segments.length - 1];
+      if (!lastSegment)
+        continue;
+      if (/^switchroom-[a-zA-Z0-9_-]+(-cron-\d+)?\.service$/.test(lastSegment)) {
+        return lastSegment;
+      }
     }
+    return null;
+  } catch {
+    return null;
   }
-  const cfgWithProfiles = config;
-  const profileName = agentConfig.extends;
-  const profileMcp = profileName != null && profileName.length > 0 ? cfgWithProfiles.profiles?.[profileName]?.mcp_servers ?? {} : {};
-  const effectiveMcp = {
-    ...cfgWithProfiles.defaults?.mcp_servers ?? {},
-    ...profileMcp,
-    ...agentConfig.mcp_servers ?? {}
-  };
-  for (const mcpEntry of Object.values(effectiveMcp)) {
-    if (!mcpEntry || typeof mcpEntry !== "object")
-      continue;
-    const declared = mcpEntry.secrets;
-    if (Array.isArray(declared) && declared.includes(key)) {
-      return { allow: true };
-    }
+}
+function verifySystemdUnit(unitName, runner) {
+  let raw;
+  try {
+    const out = runner("systemctl", [
+      "--user",
+      "show",
+      unitName,
+      "--property=LoadState,ActiveState"
+    ], { timeout: 500, encoding: "utf8" });
+    raw = typeof out === "string" ? out : out.toString("utf8");
+  } catch {
+    return false;
   }
-  const cfgSecrets = config;
-  const profileSecrets = profileName != null && profileName.length > 0 ? cfgSecrets.profiles?.[profileName]?.secrets : undefined;
-  const standingSecrets = [
-    ...Array.isArray(cfgSecrets.defaults?.secrets) ? cfgSecrets.defaults.secrets : [],
-    ...Array.isArray(profileSecrets) ? profileSecrets : [],
-    ...Array.isArray(agentConfig.secrets) ? agentConfig.secrets : []
-  ];
-  if (standingSecrets.includes(key)) {
-    return { allow: true };
+  const props = {};
+  for (const line of raw.split(`
+`)) {
+    const m = line.match(/^([A-Za-z]+)=(.*)$/);
+    if (m)
+      props[m[1]] = m[2];
   }
-  const schedule = agentConfig.schedule ?? [];
-  if (schedule.length === 0) {
-    return {
-      allow: false,
-      reason: `agent '${agentName}' has no schedule entries declaring 'secrets', no mcp_servers.*.secrets[], and no agents.${agentName}.secrets[] standing grant declaring '${key}'; nothing is broker-accessible`
-    };
+  if (props.LoadState !== "loaded")
+    return false;
+  if (props.ActiveState !== "active" && props.ActiveState !== "activating") {
+    return false;
   }
-  for (const entry of schedule) {
-    const allowed = entry?.secrets ?? [];
-    if (allowed.includes(key)) {
-      return { allow: true };
-    }
+  return true;
+}
+function readFdInode(fd) {
+  try {
+    const stat = fstatSync(fd);
+    return stat.ino;
+  } catch {
+    return null;
   }
-  return {
-    allow: false,
-    reason: `key '${key}' not in ACL for agent '${agentName}'`
-  };
 }
-function parseGoogleAccountSlotKey(key) {
-  const match = key.match(/^google:([^:]+):([a-z_]+)$/);
-  if (!match)
+function fdFromSocket(socket) {
+  const handle = socket._handle;
+  if (!handle || typeof handle.fd !== "number" || handle.fd < 0)
     return null;
-  return { account: match[1], field: match[2] };
+  return handle.fd;
 }
-function checkGoogleAccountAcl(config, agentName, account, key) {
-  const accounts = config.google_accounts ?? {};
-  const accountKey = account.toLowerCase();
-  const accountEntry = accounts[accountKey] ?? accounts[account];
-  if (!accountEntry) {
-    return {
-      allow: false,
-      reason: `google_accounts['${account}'] not configured (key '${key}')`
-    };
+function identify(socketPath, socket, execFileSyncOverride) {
+  if (process.platform !== "linux") {
+    return null;
   }
-  const enabled = accountEntry.enabled_for ?? [];
-  if (enabled.length === 0) {
-    return {
-      allow: false,
-      reason: `google_accounts['${account}'].enabled_for is empty (key '${key}')`
-    };
+  const runner = execFileSyncOverride ?? execFileSync;
+  let pid = null;
+  if (socket !== undefined) {
+    const fd = fdFromSocket(socket);
+    if (fd !== null) {
+      const cred = getPeerCred(fd);
+      if (cred !== null)
+        pid = cred.pid;
+    }
   }
-  if (!enabled.includes(agentName)) {
-    return {
-      allow: false,
-      reason: `agent '${agentName}' not in google_accounts['${account}'].enabled_for (key '${key}')`
-    };
+  if (pid === null) {
+    let ssOutput;
+    try {
+      const raw = runner("ss", ["-xpn"], {
+        timeout: 200,
+        encoding: "utf8"
+      });
+      ssOutput = typeof raw === "string" ? raw : raw.toString("utf8");
+    } catch {
+      return null;
+    }
+    const rows = parseSsRows(ssOutput);
+    let serverInode = null;
+    if (socket !== undefined) {
+      const fd = fdFromSocket(socket);
+      if (fd !== null)
+        serverInode = readFdInode(fd);
+    }
+    if (serverInode !== null) {
+      pid = findClientPidByServerInode(rows, socketPath, serverInode);
+    } else {
+      const clientPids = findClientPids(rows, socketPath);
+      if (clientPids.length === 0)
+        return null;
+      if (clientPids.length > 1) {
+        process.stderr.write(`[vault-broker] peercred: ${clientPids.length} connected peers found for ${socketPath}; ` + `using pid=${clientPids[0]}. ` + `Multiple simultaneous connections reduce identification accuracy. ` + `(This warning means identify() was called without a socket arg — likely a stale call site.)
+`);
+      }
+      pid = clientPids[0];
+    }
   }
-  return { allow: true };
+  if (pid === null)
+    return null;
+  const uid = readUid(pid);
+  if (uid === null) {
+    return null;
+  }
+  const brokerUid = typeof process.getuid === "function" ? process.getuid() : null;
+  if (brokerUid !== null && uid !== brokerUid) {
+    process.stderr.write(`[vault-broker] peercred: UID mismatch — caller uid=${uid}, broker uid=${brokerUid}; denying
+`);
+    return null;
+  }
+  const exe = readExe(pid);
+  if (exe === null) {
+    return null;
+  }
+  const cgroupClaim = readSystemdUnit(pid);
+  let systemdUnit = null;
+  if (cgroupClaim !== null) {
+    if (verifySystemdUnit(cgroupClaim, runner)) {
+      systemdUnit = cgroupClaim;
+    } else {
+      process.stderr.write(`[vault-broker] peercred: cgroup claims unit=${cgroupClaim} but systemd-user does not report it as loaded+running; treating caller as unidentified
+`);
+    }
+  }
+  return { uid, pid, exe, systemdUnit };
 }
 
-// src/scheduler/cron-introspect.ts
-init_overlay_loader();
-
-// src/cli/agent-config.ts
-var AUDIT_ROOT = join(homedir2(), ".switchroom", "audit");
-
-// src/agents/profiles.ts
-var import_handlebars = __toESM(require_lib(), 1);
-import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync4, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync, realpathSync } from "node:fs";
-import { resolve as resolve4, join as join2, sep as pathSep } from "node:path";
-var PROFILES_ROOT = resolve4(import.meta.dirname, "../../profiles");
-import_handlebars.default.registerHelper("json", (value) => {
-  return new import_handlebars.default.SafeString(JSON.stringify(value, null, 2));
-});
-import_handlebars.default.registerHelper("isNumber", (value) => {
-  return typeof value === "number" && Number.isFinite(value);
-});
-var SHARED_FRAGMENTS_DIR = resolve4(PROFILES_ROOT, "_shared");
-var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
-for (const name of SHARED_FRAGMENTS) {
-  const fragPath = join2(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
-  if (existsSync4(fragPath)) {
-    import_handlebars.default.registerPartial(name, readFileSync3(fragPath, "utf-8"));
+// src/agents/agent-uid.ts
+var AGENT_UID_MIN = 10001;
+var AGENT_UID_MAX = 10999;
+function allocateAgentUid(name) {
+  if (isReservedAgentName(name)) {
+    throw new Error(`agent name '${name}' is reserved by switchroom for another identity kind ` + `(see vault/broker/peercred.ts:RESERVED_AGENT_NAMES). Pick a different name.`);
   }
+  const hash = createHash("sha256").update(name).digest();
+  const u32 = hash.readUInt32BE(0);
+  const range = AGENT_UID_MAX - AGENT_UID_MIN + 1;
+  return AGENT_UID_MIN + u32 % range;
 }
 
-// src/agents/pane-lock.ts
-var tails = new Map;
+// src/agents/scaffold.ts
+init_schema();
 
-// src/agents/inject.ts
-var INJECT_COMMANDS = new Map([
+// src/config/users.ts
+init_merge();
+
+// src/agents/scaffold.ts
+init_merge();
+
+// src/config/timezone.ts
+var CONTAINER_DEFAULT_UTC_ZONES = new Set([
+  "UTC",
+  "Etc/UTC",
+  "Etc/Universal",
+  "Universal"
+]);
+
+// src/cli/agent-config.ts
+import { join } from "node:path";
+import { homedir as homedir2 } from "node:os";
+
+// src/cli/helpers.ts
+init_loader();
+
+// src/cli/agent-config.ts
+init_loader();
+init_merge();
+
+// src/config/google-workspace-acl.ts
+function shouldEmitGdriveMcp(agentName, agentGoogleAccount, googleAccounts) {
+  if (!agentGoogleAccount)
+    return false;
+  const account = agentGoogleAccount.trim().toLowerCase();
+  if (account.length === 0)
+    return false;
+  const acctEntry = googleAccounts?.[account];
+  if (!acctEntry)
+    return false;
+  const enabledFor = acctEntry.enabled_for ?? [];
+  return enabledFor.includes(agentName);
+}
+function vaultRefKey(value) {
+  if (typeof value !== "string" || !value.startsWith("vault:"))
+    return null;
+  const key = value.slice("vault:".length).split("#")[0];
+  return key.length > 0 ? key : null;
+}
+function isGoogleClientCredentialKeyForAgent(config, agentName, key) {
+  if (!agentName || !key)
+    return false;
+  const agentConfig = config.agents?.[agentName];
+  if (!agentConfig)
+    return false;
+  if (agentConfig.mcp_servers?.["gdrive"] === false) {
+    return false;
+  }
+  const account = agentConfig.google_workspace?.account;
+  if (!shouldEmitGdriveMcp(agentName, account, config.google_accounts)) {
+    return false;
+  }
+  const gw = config.google_workspace;
+  if (!gw)
+    return false;
+  for (const ref of [gw.google_client_id, gw.google_client_secret]) {
+    if (vaultRefKey(ref) === key)
+      return true;
+  }
+  return false;
+}
+
+// src/vault/broker/acl.ts
+var WEBKITE_VAULT_KEYS = new Set([
+  "webkite/cloudflare-account-id",
+  "webkite/cloudflare-api-token",
+  "webkite/firecrawl-api-key"
+]);
+function isWebkiteCredentialKeyForAgent(agentConfig, key) {
+  if (!WEBKITE_VAULT_KEYS.has(key))
+    return false;
+  if ((agentConfig?.mcp_servers ?? {})["webkite"] === false)
+    return false;
+  return true;
+}
+function checkEntryScope(scope, agentSlug) {
+  if (scope === undefined || scope === null) {
+    return { allow: true };
+  }
+  const deny = scope.deny ?? [];
+  const allow = scope.allow ?? [];
+  if (agentSlug !== null && deny.includes(agentSlug)) {
+    return {
+      allow: false,
+      reason: `agent '${agentSlug}' is in the entry's deny list (scope-deny)`
+    };
+  }
+  if (allow.length > 0) {
+    if (agentSlug === null || !allow.includes(agentSlug)) {
+      return {
+        allow: false,
+        reason: agentSlug === null ? "caller agent slug could not be determined; entry has a non-empty allow list (scope-allow)" : `agent '${agentSlug}' is not in the entry's allow list (scope-allow)`
+      };
+    }
+  }
+  return { allow: true };
+}
+function checkAclByAgent(config, agentName, key) {
+  if (!agentName) {
+    return { allow: false, reason: "agent name unresolved" };
+  }
+  const agentConfig = config.agents?.[agentName];
+  if (!agentConfig) {
+    return { allow: false, reason: `agent '${agentName}' not found in config` };
+  }
+  const googleSlot = parseGoogleAccountSlotKey(key);
+  if (googleSlot !== null) {
+    return checkGoogleAccountAcl(config, agentName, googleSlot.account, key);
+  }
+  if (isGoogleClientCredentialKeyForAgent(config, agentName, key)) {
+    return { allow: true };
+  }
+  if (isWebkiteCredentialKeyForAgent(agentConfig, key)) {
+    return { allow: true };
+  }
+  const agentBot = agentConfig.bot_token;
+  const botRef = agentBot && agentBot.length > 0 ? agentBot : config.telegram?.bot_token;
+  if (typeof botRef === "string" && botRef.startsWith("vault:")) {
+    const botKey = botRef.slice("vault:".length).split("#")[0];
+    if (botKey.length > 0 && botKey === key) {
+      return { allow: true };
+    }
+  }
+  const cfgWithProfiles = config;
+  const profileName = agentConfig.extends;
+  const profileMcp = profileName != null && profileName.length > 0 ? cfgWithProfiles.profiles?.[profileName]?.mcp_servers ?? {} : {};
+  const effectiveMcp = {
+    ...cfgWithProfiles.defaults?.mcp_servers ?? {},
+    ...profileMcp,
+    ...agentConfig.mcp_servers ?? {}
+  };
+  for (const mcpEntry of Object.values(effectiveMcp)) {
+    if (!mcpEntry || typeof mcpEntry !== "object")
+      continue;
+    const declared = mcpEntry.secrets;
+    if (Array.isArray(declared) && declared.includes(key)) {
+      return { allow: true };
+    }
+  }
+  const cfgSecrets = config;
+  const profileSecrets = profileName != null && profileName.length > 0 ? cfgSecrets.profiles?.[profileName]?.secrets : undefined;
+  const standingSecrets = [
+    ...Array.isArray(cfgSecrets.defaults?.secrets) ? cfgSecrets.defaults.secrets : [],
+    ...Array.isArray(profileSecrets) ? profileSecrets : [],
+    ...Array.isArray(agentConfig.secrets) ? agentConfig.secrets : []
+  ];
+  if (standingSecrets.includes(key)) {
+    return { allow: true };
+  }
+  const schedule = agentConfig.schedule ?? [];
+  if (schedule.length === 0) {
+    return {
+      allow: false,
+      reason: `agent '${agentName}' has no schedule entries declaring 'secrets', no mcp_servers.*.secrets[], and no agents.${agentName}.secrets[] standing grant declaring '${key}'; nothing is broker-accessible`
+    };
+  }
+  for (const entry of schedule) {
+    const allowed = entry?.secrets ?? [];
+    if (allowed.includes(key)) {
+      return { allow: true };
+    }
+  }
+  return {
+    allow: false,
+    reason: `key '${key}' not in ACL for agent '${agentName}'`
+  };
+}
+function parseGoogleAccountSlotKey(key) {
+  const match = key.match(/^google:([^:]+):([a-z_]+)$/);
+  if (!match)
+    return null;
+  return { account: match[1], field: match[2] };
+}
+function checkGoogleAccountAcl(config, agentName, account, key) {
+  const accounts = config.google_accounts ?? {};
+  const accountKey = account.toLowerCase();
+  const accountEntry = accounts[accountKey] ?? accounts[account];
+  if (!accountEntry) {
+    return {
+      allow: false,
+      reason: `google_accounts['${account}'] not configured (key '${key}')`
+    };
+  }
+  const enabled = accountEntry.enabled_for ?? [];
+  if (enabled.length === 0) {
+    return {
+      allow: false,
+      reason: `google_accounts['${account}'].enabled_for is empty (key '${key}')`
+    };
+  }
+  if (!enabled.includes(agentName)) {
+    return {
+      allow: false,
+      reason: `agent '${agentName}' not in google_accounts['${account}'].enabled_for (key '${key}')`
+    };
+  }
+  return { allow: true };
+}
+
+// src/scheduler/cron-introspect.ts
+init_overlay_loader();
+
+// src/cli/agent-config.ts
+var AUDIT_ROOT = join(homedir2(), ".switchroom", "audit");
+
+// src/agents/profiles.ts
+var import_handlebars = __toESM(require_lib(), 1);
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync, realpathSync } from "node:fs";
+import { resolve as resolve4, join as join2, sep as pathSep } from "node:path";
+var PROFILES_ROOT = resolve4(import.meta.dirname, "../../profiles");
+import_handlebars.default.registerHelper("json", (value) => {
+  return new import_handlebars.default.SafeString(JSON.stringify(value, null, 2));
+});
+import_handlebars.default.registerHelper("isNumber", (value) => {
+  return typeof value === "number" && Number.isFinite(value);
+});
+var SHARED_FRAGMENTS_DIR = resolve4(PROFILES_ROOT, "_shared");
+var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
+for (const name of SHARED_FRAGMENTS) {
+  const fragPath = join2(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
+  if (existsSync4(fragPath)) {
+    import_handlebars.default.registerPartial(name, readFileSync4(fragPath, "utf-8"));
+  }
+}
+
+// src/agents/pane-lock.ts
+var tails = new Map;
+
+// src/agents/inject.ts
+var INJECT_COMMANDS = new Map([
   ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true, argsAllowed: false }],
   ["/status", { description: "Show session status", expectsOutput: true, dialog: true, argsAllowed: false }],
   ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true, argsAllowed: false }],
@@ -18430,7 +18781,7 @@ init_loader();
 // src/vault/vault.ts
 import { randomBytes, scryptSync, createCipheriv, createDecipheriv } from "node:crypto";
 import {
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   writeSync as writeSync3,
   existsSync as existsSync6,
   renameSync as renameSync2,
@@ -18452,7 +18803,7 @@ import {
   writeSync as writeSync2,
   fsyncSync as fsyncSync2,
   unlinkSync,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   readdirSync as readdirSync3,
   rmdirSync,
   statSync as statSync3,
@@ -18464,7 +18815,7 @@ function lockPathFor(vaultPath) {
 }
 function readLockHolder(lockPath) {
   try {
-    const raw = readFileSync4(lockPath, "utf8");
+    const raw = readFileSync5(lockPath, "utf8");
     const lines = raw.split(`
 `);
     const pid = Number.parseInt(lines[0] ?? "", 10);
@@ -18516,8 +18867,8 @@ function pidStartTimeMs(pid) {
   if (process.platform !== "linux")
     return null;
   try {
-    const statLine = readFileSync4(`/proc/${pid}/stat`, "utf8");
-    const procStat = readFileSync4("/proc/stat", "utf8");
+    const statLine = readFileSync5(`/proc/${pid}/stat`, "utf8");
+    const procStat = readFileSync5("/proc/stat", "utf8");
     return parseProcStartTimeMs(statLine, procStat, Date.now());
   } catch {
     return null;
@@ -18702,479 +19053,146 @@ function atomicWriteFileSync(path, data, mode) {
     try {
       if (existsSync6(tmp))
         unlinkSync2(tmp);
-    } catch {}
-    throw err;
-  }
-}
-
-class VaultError extends Error {
-  cause;
-  constructor(message, options) {
-    super(message);
-    this.name = "VaultError";
-    if (options?.cause !== undefined)
-      this.cause = options.cause;
-  }
-}
-var LEGACY_SCRYPT_N = 16384;
-function deriveKey(passphrase, salt, params = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }) {
-  return scryptSync(passphrase, salt, 32, {
-    N: params.N,
-    r: params.r,
-    p: params.p,
-    maxmem: SCRYPT_MAXMEM
-  });
-}
-function encrypt(key, plaintext) {
-  const iv = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return {
-    iv: iv.toString("hex"),
-    data: encrypted.toString("hex"),
-    tag: tag.toString("hex")
-  };
-}
-function decrypt(key, iv, data, tag) {
-  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"));
-  decipher.setAuthTag(Buffer.from(tag, "hex"));
-  const decrypted = Buffer.concat([
-    decipher.update(Buffer.from(data, "hex")),
-    decipher.final()
-  ]);
-  return decrypted.toString("utf8");
-}
-function normalizeEntry(raw) {
-  if (typeof raw === "string") {
-    return { kind: "string", value: raw };
-  }
-  return raw;
-}
-function normalizeSecrets(raw) {
-  const out = {};
-  for (const [k, v] of Object.entries(raw)) {
-    out[k] = normalizeEntry(v);
-  }
-  return out;
-}
-function openVault(passphrase, vaultPath) {
-  if (!existsSync6(vaultPath)) {
-    throw new VaultError(`Vault file not found: ${vaultPath}`);
-  }
-  let vaultFile;
-  try {
-    vaultFile = JSON.parse(readFileSync5(vaultPath, "utf8"));
-  } catch {
-    throw new VaultError(`Failed to read vault file: ${vaultPath}`);
-  }
-  const salt = Buffer.from(vaultFile.salt, "hex");
-  const kdfParams = vaultFile.kdf ?? { N: LEGACY_SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
-  const key = deriveKey(passphrase, salt, kdfParams);
-  let plaintext;
-  try {
-    plaintext = decrypt(key, vaultFile.iv, vaultFile.data, vaultFile.tag);
-  } catch {
-    throw new VaultError("Failed to decrypt vault. Wrong passphrase?");
-  }
-  let vaultData;
-  try {
-    vaultData = JSON.parse(plaintext);
-  } catch {
-    throw new VaultError("Vault data is corrupted");
-  }
-  return normalizeSecrets(vaultData.secrets ?? {});
-}
-function saveVault(passphrase, vaultPath, secrets) {
-  if (!existsSync6(vaultPath)) {
-    throw new VaultError(`Vault file not found: ${vaultPath}`);
-  }
-  let releaseLock = null;
-  try {
-    releaseLock = acquireLock(vaultPath, { budgetMs: SAVE_VAULT_LOCK_RETRY_MS }).release;
-  } catch (err) {
-    if (err instanceof VaultBusyError) {
-      throw new VaultError(err.message, { cause: err });
-    }
-    throw err;
-  }
-  try {
-    let vaultFile;
-    try {
-      vaultFile = JSON.parse(readFileSync5(vaultPath, "utf8"));
-    } catch {
-      throw new VaultError(`Failed to read vault file: ${vaultPath}`);
-    }
-    const salt = Buffer.from(vaultFile.salt, "hex");
-    const key = deriveKey(passphrase, salt, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
-    vaultFile.kdf = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
-    const vaultData = { secrets };
-    const { iv, data, tag } = encrypt(key, JSON.stringify(vaultData));
-    vaultFile.iv = iv;
-    vaultFile.data = data;
-    vaultFile.tag = tag;
-    atomicWriteFileSync(vaultPath, JSON.stringify(vaultFile, null, 2), 384);
-  } finally {
-    if (releaseLock !== null) {
-      try {
-        releaseLock();
-      } catch {}
-    }
-  }
-}
-function acquireVaultLock(vaultPath) {
-  try {
-    return acquireLock(vaultPath, { budgetMs: SAVE_VAULT_LOCK_RETRY_MS }).release;
-  } catch (err) {
-    if (err instanceof VaultBusyError) {
-      throw new VaultError(err.message, { cause: err });
-    }
-    throw err;
-  }
-}
-
-// src/vault/resolver.ts
-init_loader();
-
-// src/vault/broker/client.ts
-import { homedir as homedir3 } from "node:os";
-import { join as join3 } from "node:path";
-
-// src/vault/broker/protocol.ts
-init_zod();
-
-// src/vault/broker/peercred.ts
-import { execFileSync } from "node:child_process";
-import { readFileSync as readFileSync6, readlinkSync, fstatSync } from "node:fs";
-
-// src/vault/broker/peercred-ffi.ts
-function getPeerCred(fd) {
-  if (process.platform !== "linux")
-    return null;
-  try {
-    const ffi = __require("bun:ffi");
-    const { dlopen, FFIType, ptr } = ffi;
-    const SOL_SOCKET = 1;
-    const SO_PEERCRED = 17;
-    const UCRED_SIZE = 12;
-    const cache = getPeerCred;
-    const lib = cache._lib ?? (() => {
-      const candidates = ["libc.so.6", "libc.so"];
-      const symbolSpec = {
-        getsockopt: {
-          args: [FFIType.i32, FFIType.i32, FFIType.i32, FFIType.ptr, FFIType.ptr],
-          returns: FFIType.i32
-        }
-      };
-      const errors2 = [];
-      for (const name of candidates) {
-        try {
-          const opened = dlopen(name, symbolSpec);
-          cache._lib = opened;
-          return opened;
-        } catch (e) {
-          errors2.push(`${name}: ${e instanceof Error ? e.message : String(e)}`);
-        }
-      }
-      process.stderr.write(`[vault-broker] peercred-ffi: dlopen failed for all libc candidates ` + `(${errors2.join("; ")}); falling back to ss-parsing.
-`);
-      throw new Error("no libc candidate could be opened");
-    })();
-    const credBuf = new ArrayBuffer(UCRED_SIZE);
-    const lenBuf = new Uint32Array(1);
-    lenBuf[0] = UCRED_SIZE;
-    const rc = lib.symbols.getsockopt(fd, SOL_SOCKET, SO_PEERCRED, ptr(credBuf), ptr(lenBuf.buffer));
-    if (rc !== 0)
-      return null;
-    if (lenBuf[0] !== UCRED_SIZE)
-      return null;
-    const view = new DataView(credBuf);
-    return {
-      pid: view.getInt32(0, true),
-      uid: view.getInt32(4, true),
-      gid: view.getInt32(8, true)
-    };
-  } catch {
-    return null;
-  }
-}
-
-// src/broker-common/peercred-path.ts
-function matchSocketName(socketPath, patterns, maxNameLen) {
-  if (typeof socketPath !== "string" || socketPath.length === 0)
-    return null;
-  let name = null;
-  for (const re of patterns) {
-    const m = socketPath.match(re);
-    if (m && typeof m[1] === "string") {
-      name = m[1];
-      break;
-    }
-  }
-  if (name === null || name.length === 0)
-    return null;
-  if (maxNameLen !== undefined && name.length > maxNameLen)
-    return null;
-  return name;
-}
-function parseSocketIdentity(socketPath, spec) {
-  const name = matchSocketName(socketPath, spec.patterns, spec.maxNameLen);
-  if (name === null)
-    return null;
-  const operatorName = spec.operatorName ?? "operator";
-  if (name === operatorName)
-    return { kind: "operator" };
-  if (spec.reservedNames.has(name))
-    return null;
-  return { kind: "agent", name };
-}
-
-// src/vault/broker/peercred.ts
-var SOCKET_PATH_AGENT_RE = /^\/run\/switchroom\/broker\/([a-zA-Z0-9][a-zA-Z0-9_-]*)\.sock$/;
-var SOCKET_PATH_AGENT_SUBDIR_RE = /^\/run\/switchroom\/broker\/([a-zA-Z0-9][a-zA-Z0-9_-]*)\/sock$/;
-var RESERVED_AGENT_NAMES = new Set(["operator", "hostd"]);
-function socketPathToIdentity(socketPath) {
-  return parseSocketIdentity(socketPath, {
-    patterns: [SOCKET_PATH_AGENT_RE, SOCKET_PATH_AGENT_SUBDIR_RE],
-    reservedNames: RESERVED_AGENT_NAMES
-  });
-}
-function socketPathToAgent(socketPath) {
-  const identity = socketPathToIdentity(socketPath);
-  return identity?.kind === "agent" ? identity.name : null;
-}
-function isReservedAgentName(name) {
-  return RESERVED_AGENT_NAMES.has(name);
-}
-function unlockSocketFor(dataSocketPath) {
-  if (dataSocketPath.endsWith("/sock")) {
-    return dataSocketPath.slice(0, -"/sock".length) + "/unlock";
-  }
-  return dataSocketPath.replace(/\.sock$/, ".unlock.sock");
-}
-function parseSsRows(output) {
-  const rows = [];
-  const lines = output.split(`
-`);
-  for (const line of lines) {
-    if (!line.trim() || line.startsWith("Netid"))
-      continue;
-    const tokens = line.split(/\s+/).filter((t) => t.length > 0);
-    if (tokens.length < 8)
-      continue;
-    const localAddr = tokens[4];
-    const localInode = tokens[5];
-    const peerAddr = tokens[6];
-    const peerInode = tokens[7];
-    const usersToken = tokens.slice(8).join(" ");
-    const m = usersToken.match(/users:\(\(".*?",pid=(\d+),fd=\d+\)\)/);
-    const pid = m ? parseInt(m[1], 10) : null;
-    rows.push({ localAddr, localInode, peerAddr, peerInode, pid });
-  }
-  return rows;
-}
-function findClientPids(rows, socketPath) {
-  const pids = [];
-  for (const serverRow of rows) {
-    if (serverRow.localAddr !== socketPath)
-      continue;
-    for (const clientRow of rows) {
-      if (clientRow.localAddr !== "*")
-        continue;
-      if (clientRow.localInode !== serverRow.peerInode)
-        continue;
-      if (clientRow.pid === null)
-        continue;
-      pids.push(clientRow.pid);
-      break;
-    }
-  }
-  return pids;
-}
-function findClientPidByServerInode(rows, socketPath, serverInode) {
-  const serverInodeStr = String(serverInode);
-  for (const serverRow of rows) {
-    if (serverRow.localAddr !== socketPath)
-      continue;
-    if (serverRow.localInode !== serverInodeStr)
-      continue;
-    for (const clientRow of rows) {
-      if (clientRow.localAddr !== "*")
-        continue;
-      if (clientRow.localInode !== serverRow.peerInode)
-        continue;
-      if (clientRow.pid === null)
-        continue;
-      return clientRow.pid;
-    }
-    return null;
+    } catch {}
+    throw err;
   }
-  return null;
 }
-function readUid(pid) {
-  try {
-    const status = readFileSync6(`/proc/${pid}/status`, "utf8");
-    const m = status.match(/^Uid:\s+(\d+)/m);
-    if (!m)
-      return null;
-    return parseInt(m[1], 10);
-  } catch {
-    return null;
+
+class VaultError extends Error {
+  cause;
+  constructor(message, options) {
+    super(message);
+    this.name = "VaultError";
+    if (options?.cause !== undefined)
+      this.cause = options.cause;
   }
 }
-function readExe(pid) {
-  try {
-    return readlinkSync(`/proc/${pid}/exe`);
-  } catch {
-    return null;
+var LEGACY_SCRYPT_N = 16384;
+function deriveKey(passphrase, salt, params = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }) {
+  return scryptSync(passphrase, salt, 32, {
+    N: params.N,
+    r: params.r,
+    p: params.p,
+    maxmem: SCRYPT_MAXMEM
+  });
+}
+function encrypt(key, plaintext) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    iv: iv.toString("hex"),
+    data: encrypted.toString("hex"),
+    tag: tag.toString("hex")
+  };
+}
+function decrypt(key, iv, data, tag) {
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"));
+  decipher.setAuthTag(Buffer.from(tag, "hex"));
+  const decrypted = Buffer.concat([
+    decipher.update(Buffer.from(data, "hex")),
+    decipher.final()
+  ]);
+  return decrypted.toString("utf8");
+}
+function normalizeEntry(raw) {
+  if (typeof raw === "string") {
+    return { kind: "string", value: raw };
   }
+  return raw;
 }
-function readSystemdUnit(pid) {
-  try {
-    const content = readFileSync6(`/proc/${pid}/cgroup`, "utf8");
-    const lines = content.split(`
-`);
-    for (const line of lines) {
-      if (!line.trim())
-        continue;
-      const parts = line.split(":");
-      if (parts.length < 3)
-        continue;
-      const controller = parts[1];
-      const isV2 = parts[0] === "0" && controller === "";
-      const isV1Systemd = controller === "name=systemd";
-      if (!isV2 && !isV1Systemd)
-        continue;
-      const cgroupPath = parts.slice(2).join(":");
-      const segments = cgroupPath.split("/");
-      const lastSegment = segments[segments.length - 1];
-      if (!lastSegment)
-        continue;
-      if (/^switchroom-[a-zA-Z0-9_-]+(-cron-\d+)?\.service$/.test(lastSegment)) {
-        return lastSegment;
-      }
-    }
-    return null;
-  } catch {
-    return null;
+function normalizeSecrets(raw) {
+  const out = {};
+  for (const [k, v] of Object.entries(raw)) {
+    out[k] = normalizeEntry(v);
   }
+  return out;
 }
-function verifySystemdUnit(unitName, runner) {
-  let raw;
+function openVault(passphrase, vaultPath) {
+  if (!existsSync6(vaultPath)) {
+    throw new VaultError(`Vault file not found: ${vaultPath}`);
+  }
+  let vaultFile;
   try {
-    const out = runner("systemctl", [
-      "--user",
-      "show",
-      unitName,
-      "--property=LoadState,ActiveState"
-    ], { timeout: 500, encoding: "utf8" });
-    raw = typeof out === "string" ? out : out.toString("utf8");
+    vaultFile = JSON.parse(readFileSync6(vaultPath, "utf8"));
   } catch {
-    return false;
-  }
-  const props = {};
-  for (const line of raw.split(`
-`)) {
-    const m = line.match(/^([A-Za-z]+)=(.*)$/);
-    if (m)
-      props[m[1]] = m[2];
+    throw new VaultError(`Failed to read vault file: ${vaultPath}`);
   }
-  if (props.LoadState !== "loaded")
-    return false;
-  if (props.ActiveState !== "active" && props.ActiveState !== "activating") {
-    return false;
+  const salt = Buffer.from(vaultFile.salt, "hex");
+  const kdfParams = vaultFile.kdf ?? { N: LEGACY_SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
+  const key = deriveKey(passphrase, salt, kdfParams);
+  let plaintext;
+  try {
+    plaintext = decrypt(key, vaultFile.iv, vaultFile.data, vaultFile.tag);
+  } catch {
+    throw new VaultError("Failed to decrypt vault. Wrong passphrase?");
   }
-  return true;
-}
-function readFdInode(fd) {
+  let vaultData;
   try {
-    const stat = fstatSync(fd);
-    return stat.ino;
+    vaultData = JSON.parse(plaintext);
   } catch {
-    return null;
+    throw new VaultError("Vault data is corrupted");
   }
+  return normalizeSecrets(vaultData.secrets ?? {});
 }
-function fdFromSocket(socket) {
-  const handle = socket._handle;
-  if (!handle || typeof handle.fd !== "number" || handle.fd < 0)
-    return null;
-  return handle.fd;
-}
-function identify(socketPath, socket, execFileSyncOverride) {
-  if (process.platform !== "linux") {
-    return null;
+function saveVault(passphrase, vaultPath, secrets) {
+  if (!existsSync6(vaultPath)) {
+    throw new VaultError(`Vault file not found: ${vaultPath}`);
   }
-  const runner = execFileSyncOverride ?? execFileSync;
-  let pid = null;
-  if (socket !== undefined) {
-    const fd = fdFromSocket(socket);
-    if (fd !== null) {
-      const cred = getPeerCred(fd);
-      if (cred !== null)
-        pid = cred.pid;
+  let releaseLock = null;
+  try {
+    releaseLock = acquireLock(vaultPath, { budgetMs: SAVE_VAULT_LOCK_RETRY_MS }).release;
+  } catch (err) {
+    if (err instanceof VaultBusyError) {
+      throw new VaultError(err.message, { cause: err });
     }
+    throw err;
   }
-  if (pid === null) {
-    let ssOutput;
+  try {
+    let vaultFile;
     try {
-      const raw = runner("ss", ["-xpn"], {
-        timeout: 200,
-        encoding: "utf8"
-      });
-      ssOutput = typeof raw === "string" ? raw : raw.toString("utf8");
+      vaultFile = JSON.parse(readFileSync6(vaultPath, "utf8"));
     } catch {
-      return null;
-    }
-    const rows = parseSsRows(ssOutput);
-    let serverInode = null;
-    if (socket !== undefined) {
-      const fd = fdFromSocket(socket);
-      if (fd !== null)
-        serverInode = readFdInode(fd);
+      throw new VaultError(`Failed to read vault file: ${vaultPath}`);
     }
-    if (serverInode !== null) {
-      pid = findClientPidByServerInode(rows, socketPath, serverInode);
-    } else {
-      const clientPids = findClientPids(rows, socketPath);
-      if (clientPids.length === 0)
-        return null;
-      if (clientPids.length > 1) {
-        process.stderr.write(`[vault-broker] peercred: ${clientPids.length} connected peers found for ${socketPath}; ` + `using pid=${clientPids[0]}. ` + `Multiple simultaneous connections reduce identification accuracy. ` + `(This warning means identify() was called without a socket arg — likely a stale call site.)
-`);
-      }
-      pid = clientPids[0];
+    const salt = Buffer.from(vaultFile.salt, "hex");
+    const key = deriveKey(passphrase, salt, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+    vaultFile.kdf = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
+    const vaultData = { secrets };
+    const { iv, data, tag } = encrypt(key, JSON.stringify(vaultData));
+    vaultFile.iv = iv;
+    vaultFile.data = data;
+    vaultFile.tag = tag;
+    atomicWriteFileSync(vaultPath, JSON.stringify(vaultFile, null, 2), 384);
+  } finally {
+    if (releaseLock !== null) {
+      try {
+        releaseLock();
+      } catch {}
     }
   }
-  if (pid === null)
-    return null;
-  const uid = readUid(pid);
-  if (uid === null) {
-    return null;
-  }
-  const brokerUid = typeof process.getuid === "function" ? process.getuid() : null;
-  if (brokerUid !== null && uid !== brokerUid) {
-    process.stderr.write(`[vault-broker] peercred: UID mismatch — caller uid=${uid}, broker uid=${brokerUid}; denying
-`);
-    return null;
-  }
-  const exe = readExe(pid);
-  if (exe === null) {
-    return null;
-  }
-  const cgroupClaim = readSystemdUnit(pid);
-  let systemdUnit = null;
-  if (cgroupClaim !== null) {
-    if (verifySystemdUnit(cgroupClaim, runner)) {
-      systemdUnit = cgroupClaim;
-    } else {
-      process.stderr.write(`[vault-broker] peercred: cgroup claims unit=${cgroupClaim} but systemd-user does not report it as loaded+running; treating caller as unidentified
-`);
+}
+function acquireVaultLock(vaultPath) {
+  try {
+    return acquireLock(vaultPath, { budgetMs: SAVE_VAULT_LOCK_RETRY_MS }).release;
+  } catch (err) {
+    if (err instanceof VaultBusyError) {
+      throw new VaultError(err.message, { cause: err });
     }
+    throw err;
   }
-  return { uid, pid, exe, systemdUnit };
 }
 
+// src/vault/resolver.ts
+init_loader();
+
+// src/vault/broker/client.ts
+import { homedir as homedir3 } from "node:os";
+import { join as join3 } from "node:path";
+
 // src/vault/broker/protocol.ts
+init_zod();
 var MAX_FRAME_BYTES = 64 * 1024;
 var AgentNameSchema = exports_external.string().min(1).max(64, "agent name max 64 chars").regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/, "agent name must be kebab-case ASCII (alnum + _- only, first char alnum)").refine((s) => !isReservedAgentName(s), {
   message: "agent name is reserved"
@@ -19562,17 +19580,6 @@ init_merge();
 init_paths();
 
 // src/agents/compose.ts
-var AGENT_UID_MIN = 10001;
-var AGENT_UID_MAX = 10999;
-function allocateAgentUid(name) {
-  if (isReservedAgentName(name)) {
-    throw new Error(`agent name '${name}' is reserved by switchroom for another identity kind ` + `(see vault/broker/peercred.ts:RESERVED_AGENT_NAMES). Pick a different name.`);
-  }
-  const hash = createHash("sha256").update(name).digest();
-  const u32 = hash.readUInt32BE(0);
-  const range = AGENT_UID_MAX - AGENT_UID_MIN + 1;
-  return AGENT_UID_MIN + u32 % range;
-}
 var BIND_MOUNT_EXACT_SOURCE_DENY = new Set(["/var/run/docker.sock"]);
 
 // src/vault/broker/server.ts