switchroom 0.18.15 → 0.18.18

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.18.15", COMMIT_SHA = "2fa611a1";
+var VERSION = "0.18.18", COMMIT_SHA = "a256b3b1";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -13818,6 +13818,19 @@ var init_schema = __esm(() => {
     approval_timeout_minutes: exports_external.number().int().nonnegative().optional().describe("Operator approval-card lifetime (minutes) for the tool-use 'Allow " + "once' card and the vault grant decision wait. After this long with " + "no operator tap, the card auto-denies (a TIMEOUT, not a denial \u2014 the " + "agent is told not to retry). Default 60. hostd-gated verbs " + "(mcp__hostd__*) keep their own longer window; the hostd " + "config-propose card is not governed by this key."),
     sub_agent_tick_interval_ms: exports_external.number().int().nonnegative().optional().describe("Heartbeat tick interval (ms) for sub-agent rendering. Forces a " + "re-render of the elapsed-time counter while sub-agents are running, " + "even during silent stretches between tool calls. Default 10000 (10 s). " + "Set to 0 to disable the elapsed-ticker path."),
     edit_budget_threshold: exports_external.number().int().nonnegative().optional().describe("Telegram API edit budget per minute before the progress-card driver " + "falls back to a slower coalesce window. When a chat accumulates more " + "than this many card edits in the trailing 60 s, the driver switches " + "to a wider coalesce interval until the rate drops back. Default 18. " + "Increase if your gateway frequently bumps the Telegram edit-rate ceiling " + "with many parallel sub-agents; decrease for a more conservative buffer."),
+    send_gate: exports_external.object({
+      enabled: exports_external.boolean().optional().describe("Master switch for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts) \u2014 the token-bucket scheduler every " + "Bot API call transits so per-surface throttles can't add up past a " + "flood ceiling. ON by default. Precedence: the operator break-glass " + "env var SWITCHROOM_TELEGRAM_SEND_GATE (0/false/off/no) ALWAYS wins " + "when explicitly set; this key only decides when that env var is " + "unset. Omit to keep the gate on."),
+      global_per_sec: exports_external.number().positive().optional().describe("Global bucket sustained rate (Bot API calls/sec across ALL chats). " + "Default 25 (headroom under Telegram's ~30/s). Must be > 0 \u2014 a zero " + "or negative rate would wedge all outbound sends. Omit to keep 25."),
+      global_burst: exports_external.number().int().positive().describe("Global bucket burst capacity. Default 4; worst-case 1s window " + "admits global_burst + global_per_sec = 29 < 30, a real margin under " + "the ceiling. Must be an integer >= 1 (a 0 capacity never admits a " + "token and wedges sends). Omit to keep 4.").optional(),
+      per_chat_per_sec: exports_external.number().positive().optional().describe("Per-chat sustained rate (calls/sec to a single chat). Default 1. " + "Must be > 0 (zero/negative wedges that chat). Omit to keep 1."),
+      per_chat_burst: exports_external.number().int().positive().optional().describe("Per-chat burst capacity. Default 3. Must be an integer >= 1 " + "(0 wedges the chat's bucket). Omit to keep 3."),
+      per_group_per_min: exports_external.number().positive().optional().describe("Per-group sustained rate (calls/min to a single group/supergroup). " + "Default 18 (headroom under Telegram's ~20/min group ceiling). Must " + "be > 0. Omit to keep 18."),
+      per_group_burst: exports_external.number().int().positive().optional().describe("Per-group burst capacity. Default 2. Must be an integer >= 1 " + "(0 wedges the group's bucket). Omit to keep 2."),
+      edit_floor_ms: exports_external.number().int().nonnegative().optional().describe("Minimum ms between successive edits of the SAME message_id " + "(last-write-wins coalescing enforces this floor). Default 1500 " + "(Telegram's ~1 edit/sec/message practical ceiling). 0 disables the " + "floor. Must be an integer >= 0. Omit to keep 1500.")
+    }).optional().describe("Tunable rate limits for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts). Every key is optional and defaults to " + "the send gate's built-in value, so omitting the whole block reproduces " + "today's exact behaviour \u2014 this is pure operator tuning, no default is " + "changed. Cascades from defaults.channels.telegram.send_gate."),
+    worker_feed: exports_external.object({
+      max_rows: exports_external.number().int().positive().optional().describe("Max live-worker rows rendered in the COMBINED worker-activity feed " + "(2+ background workers in one chat/thread coalesce into ONE message; " + "telegram-plugin/worker-activity-feed.ts) before a compact " + "'+M more working\u2026' spill line \u2014 keeps the coalesced body compact and " + "legible (and under the rich-message wire ceiling). Default 8. A " + "single-worker chat renders the full \uD83D\uDEE0 Worker card and ignores this. " + "Must be an integer >= 1. Omit to keep 8.")
+    }).optional().describe("Tuning for the coalesced worker-activity feed " + "(telegram-plugin/worker-activity-feed.ts). Cascades from " + "defaults.channels.telegram.worker_feed."),
     stickers: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Sticker aliases for the `send_sticker` MCP tool (#576). Maps a " + "short alias name (e.g. 'happy', 'thinking') to a Telegram file_id. " + "Operator-curated \u2014 capture file_ids from inbound stickers the user " + "sends and add them here. The agent calls send_sticker(chat_id, " + "alias='happy') and the gateway resolves to the file_id at send " + "time. Aliases enable persona-flavored expressiveness without " + "exposing raw file_ids in the agent prompt. Personal-assistant / " + "health-coach personas benefit; coding agents typically don't " + "configure any."),
     voice_in: exports_external.object({
       enabled: exports_external.boolean().optional().describe("Master switch for voice-message transcription."),
@@ -13843,6 +13856,9 @@ var init_schema = __esm(() => {
       window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
       max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 \u2014 a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, \u2026). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
     }).optional().describe("Inbound coalescing \u2014 how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+    litellm_notice: exports_external.object({
+      window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 \u2014 see docs/auth.md \u00a7 " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+    }).optional().describe("Debounce tuning for the litellm-local throttle notice \u2014 the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
     interrupt: exports_external.object({
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short \u2014 the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
@@ -17113,18 +17129,18 @@ function alignAgentTreeOwnershipIfRoot(name, agentDir) {
   }
   return uid;
 }
-function findAgentUnreadablePaths(candidates, agentUid) {
+function findAgentUnreadablePaths(candidates, agentUid, fs = { lstatSync, statSync: statSync3 }) {
   const bad = [];
   for (const p of candidates) {
     let ls;
     try {
-      ls = lstatSync(p);
+      ls = fs.lstatSync(p);
     } catch {
       continue;
     }
     if (ls.isSymbolicLink())
       continue;
-    const st = statSync3(p);
+    const st = fs.statSync(p);
     if (st.uid === agentUid)
       continue;
     const otherReadable = st.isDirectory() ? (st.mode & 5) === 5 : (st.mode & 4) === 4;
@@ -26683,6 +26699,37 @@ function channelsToEnv(agent) {
   if (tg.edit_budget_threshold !== undefined) {
     out.SWITCHROOM_TG_EDIT_BUDGET_THRESHOLD = String(tg.edit_budget_threshold);
   }
+  const sg = tg.send_gate;
+  if (sg) {
+    if (sg.enabled !== undefined) {
+      out.SWITCHROOM_TG_SEND_GATE_ENABLED = sg.enabled ? "1" : "0";
+    }
+    if (sg.global_per_sec !== undefined) {
+      out.SWITCHROOM_TG_SEND_GATE_GLOBAL_PER_SEC = String(sg.global_per_sec);
+    }
+    if (sg.global_burst !== undefined) {
+      out.SWITCHROOM_TG_SEND_GATE_GLOBAL_BURST = String(sg.global_burst);
+    }
+    if (sg.per_chat_per_sec !== undefined) {
+      out.SWITCHROOM_TG_SEND_GATE_PER_CHAT_PER_SEC = String(sg.per_chat_per_sec);
+    }
+    if (sg.per_chat_burst !== undefined) {
+      out.SWITCHROOM_TG_SEND_GATE_PER_CHAT_BURST = String(sg.per_chat_burst);
+    }
+    if (sg.per_group_per_min !== undefined) {
+      out.SWITCHROOM_TG_SEND_GATE_PER_GROUP_PER_MIN = String(sg.per_group_per_min);
+    }
+    if (sg.per_group_burst !== undefined) {
+      out.SWITCHROOM_TG_SEND_GATE_PER_GROUP_BURST = String(sg.per_group_burst);
+    }
+    if (sg.edit_floor_ms !== undefined) {
+      out.SWITCHROOM_TG_SEND_GATE_EDIT_FLOOR_MS = String(sg.edit_floor_ms);
+    }
+  }
+  const wf = tg?.worker_feed;
+  if (wf?.max_rows !== undefined) {
+    out.SWITCHROOM_TG_WORKER_FEED_MAX_ROWS = String(wf.max_rows);
+  }
   if (tg.clear_status_on_completion !== undefined) {
     out.SWITCHROOM_TG_CLEAR_STATUS_ON_COMPLETION = tg.clear_status_on_completion ? "1" : "0";
   }
@@ -28995,6 +29042,9 @@ function buildAccessJson2(agentConfig, telegramConfig, resolvedTopicId, userId)
   if (typeof tg?.coalesce?.max_attachments === "number") {
     access.coalesceMaxAttachments = tg.coalesce.max_attachments;
   }
+  if (typeof tg?.litellm_notice?.window_ms === "number") {
+    access.litellmNoticeWindowMs = tg.litellm_notice.window_ms;
+  }
   if (typeof tg?.interrupt?.safe_boundary === "boolean") {
     access.interruptSafeBoundary = tg.interrupt.safe_boundary;
   }
@@ -29763,6 +29813,7 @@ function generateCompose(opts) {
   const hostControlEnabled = config.host_control?.enabled !== false;
   const hostHomeForChecks = opts.homeDir ?? process.env.HOME ?? "";
   const probeHome = opts.probeHomeDir ?? hostHomeForChecks;
+  const precreateHostDirs = opts.precreateHostDirs ?? (opts.homeDir !== undefined || opts.probeHomeDir !== undefined);
   const switchroomConfigPath = resolveConfigMountSource(opts.switchroomConfigPath, homePrefix);
   const bundledSkillsPoolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
   const voiceEngine = opts.voiceEngine ?? loadHostCapabilities()?.voice.engine ?? "cloud";
@@ -29967,7 +30018,7 @@ function generateCompose(opts) {
       telemetryDisabled,
       posthogKeyOverride,
       posthogHostOverride
-    }, bundledSkillsPoolDir, hostControlEnabled, opts.operatorUid, voiceEngine);
+    }, bundledSkillsPoolDir, hostControlEnabled, opts.operatorUid, voiceEngine, precreateHostDirs);
   }
   lines.push(`volumes:`);
   for (const a of describeAgents(config, opts.litellmConfirmedAgents)) {
@@ -30001,7 +30052,7 @@ function generateCompose(opts) {
   return lines.join(`
 `);
 }
-function emitAgentService(lines, a, imageTag, buildMode, buildContext, homePrefix, hostHomeForChecks, probeHome, switchroomConfigPath, containerNamePrefix, posthog, bundledSkillsPoolDir, hostControlEnabled, operatorUid, voiceEngine) {
+function emitAgentService(lines, a, imageTag, buildMode, buildContext, homePrefix, hostHomeForChecks, probeHome, switchroomConfigPath, containerNamePrefix, posthog, bundledSkillsPoolDir, hostControlEnabled, operatorUid, voiceEngine, precreateHostDirs) {
   lines.push(`  agent-${a.name}:`);
   emitImageOrBuild(lines, "agent", imageTag, buildMode, buildContext);
   lines.push(`    container_name: ${containerNamePrefix}-${a.name}`);
@@ -30164,22 +30215,30 @@ function emitAgentService(lines, a, imageTag, buildMode, buildContext, homePrefi
   if (conditionalMountPresent(`${probeHome}/.switchroom/credentials/${a.name}`, hostHomeForChecks, probeHome)) {
     lines.push(`      - ${homePrefix}/.switchroom/credentials/${a.name}:${homePrefix}/.switchroom/credentials:ro`);
   }
-  try {
-    mkdirSync12(`${probeHome}/.switchroom/audit/${a.name}`, { recursive: true });
-  } catch {}
-  try {
-    const blockedDir = `${probeHome}/.switchroom/blocked-approvals`;
-    mkdirSync12(blockedDir, { recursive: true });
-    chmodSync3(blockedDir, 1023);
-  } catch {}
-  try {
-    mkdirSync12(`${probeHome}/.switchroom/agents/${a.name}/schedule.d`, { recursive: true });
-  } catch {}
-  lines.push(`      - ${homePrefix}/.switchroom/audit/${a.name}:${homePrefix}/.switchroom/audit/${a.name}:rw`);
-  if (conditionalMountPresent(`${probeHome}/.switchroom-config`, hostHomeForChecks, probeHome)) {
+  if (precreateHostDirs) {
     try {
-      mkdirSync12(`${probeHome}/.switchroom-config/agents/${a.name}/personal-skills`, { recursive: true });
+      mkdirSync12(`${probeHome}/.switchroom/audit/${a.name}`, { recursive: true });
     } catch {}
+  }
+  if (precreateHostDirs) {
+    try {
+      const blockedDir = `${probeHome}/.switchroom/blocked-approvals`;
+      mkdirSync12(blockedDir, { recursive: true });
+      chmodSync3(blockedDir, 1023);
+    } catch {}
+  }
+  if (precreateHostDirs) {
+    try {
+      mkdirSync12(`${probeHome}/.switchroom/agents/${a.name}/schedule.d`, { recursive: true });
+    } catch {}
+  }
+  lines.push(`      - ${homePrefix}/.switchroom/audit/${a.name}:${homePrefix}/.switchroom/audit/${a.name}:rw`);
+  if (conditionalMountPresent(`${probeHome}/.switchroom-config`, hostHomeForChecks, probeHome)) {
+    if (precreateHostDirs) {
+      try {
+        mkdirSync12(`${probeHome}/.switchroom-config/agents/${a.name}/personal-skills`, { recursive: true });
+      } catch {}
+    }
     lines.push(`      - ${homePrefix}/.switchroom-config/agents/${a.name}/personal-skills:${homePrefix}/.switchroom-config/agents/${a.name}/personal-skills:rw`);
   }
   if (existsSync18(`${probeHome}/.switchroom/bin/webkite`)) {
@@ -43707,6 +43766,74 @@ function runCredentialsMigrationChecks(config, deps = {}) {
 }
 var init_doctor_credentials_migration = () => {};
 
+// src/cli/doctor-agent-dotfile-ownership.ts
+import { existsSync as existsSync62, lstatSync as lstatSync8, statSync as statSync36 } from "node:fs";
+import { join as join61 } from "node:path";
+function agentDotfileCandidates(agentDir) {
+  return [
+    join61(agentDir, ".claude", "settings.json"),
+    join61(agentDir, ".claude.json"),
+    join61(agentDir, ".claude", ".claude.json"),
+    join61(agentDir, ".mcp.json"),
+    join61(agentDir, ".claude-cron", ".mcp.json")
+  ];
+}
+function runAgentDotfileOwnershipChecks(config, deps = {}) {
+  const results = [];
+  const agents = Object.keys(config.agents ?? {});
+  if (agents.length === 0)
+    return results;
+  const exists = deps.existsSync ?? existsSync62;
+  const scanFs = deps.scanFs ?? { lstatSync: lstatSync8, statSync: statSync36 };
+  let agentsDir = deps.agentsDir;
+  if (agentsDir === undefined) {
+    try {
+      agentsDir = resolveAgentsDir(config);
+    } catch {
+      agentsDir = undefined;
+    }
+  }
+  if (agentsDir === undefined) {
+    return [
+      {
+        name: "agent dotfile ownership",
+        status: "warn",
+        detail: "could not resolve the agents directory (no switchroom block) \u2014 skipped dotfile-ownership check"
+      }
+    ];
+  }
+  for (const name of agents) {
+    const agentDir = join61(agentsDir, name);
+    if (!exists(agentDir)) {
+      continue;
+    }
+    const isRoot = config.agents[name]?.root === true;
+    const runtimeUid = isRoot ? 0 : allocateAgentUid(name);
+    const candidates = agentDotfileCandidates(agentDir);
+    const unreadable = findAgentUnreadablePaths(candidates, runtimeUid, scanFs);
+    if (unreadable.length === 0) {
+      results.push({
+        name: `dotfile ownership: ${name}`,
+        status: "ok",
+        detail: isRoot ? `runs as uid 0 (root-tier) \u2014 dotfiles readable` : `dotfiles readable by agent uid ${runtimeUid}`
+      });
+      continue;
+    }
+    results.push({
+      name: `dotfile ownership: ${name}`,
+      status: "fail",
+      detail: `${unreadable.length} dotfile(s) not readable by the agent's runtime ` + `uid ${runtimeUid}: ${unreadable.join(", ")}. Claude Code loads no ` + `permission allowlist from an unreadable settings.json \u2192 the agent ` + `prompts the operator to approve every tool call (card storm).`,
+      fix: `sudo chown -h -R ${runtimeUid}:${runtimeUid} ${agentDir}  # then \`switchroom agent restart ${name}\``
+    });
+  }
+  return results;
+}
+var init_doctor_agent_dotfile_ownership = __esm(() => {
+  init_loader();
+  init_agent_uid();
+  init_agent_owned_tree();
+});
+
 // src/cli/doctor-inlined-secrets.ts
 import { readFileSync as fsReadFileSync } from "node:fs";
 function isSecretShapedKey(key) {
@@ -43804,7 +43931,7 @@ var init_doctor_inlined_secrets = __esm(() => {
 // src/cli/doctor-approval-attribution.ts
 import { execFileSync as execFileSync19 } from "node:child_process";
 import { readFileSync as fsReadFileSync2 } from "node:fs";
-import { join as join61 } from "node:path";
+import { join as join62 } from "node:path";
 function parseApproverSet(canonical) {
   try {
     const arr = JSON.parse(canonical);
@@ -43924,7 +44051,7 @@ function loadLiveAllowFromAccessFiles(agentNames, agentsDir, readFile2 = (p) =>
   let readAny = false;
   for (const name of agentNames) {
     try {
-      const raw = readFile2(join61(agentsDir, name, "telegram", "access.json"));
+      const raw = readFile2(join62(agentsDir, name, "telegram", "access.json"));
       const parsed = JSON.parse(raw);
       readAny = true;
       if (Array.isArray(parsed.allowFrom)) {
@@ -43957,13 +44084,13 @@ var init_doctor_approval_attribution = __esm(() => {
 // src/cli/doctor-audit-integrity.ts
 import { readFileSync as fsReadFileSync3 } from "node:fs";
 import { homedir as homedir37 } from "node:os";
-import { join as join62 } from "node:path";
+import { join as join63 } from "node:path";
 function rootWrittenLogs(home2) {
   return [
-    { label: "vault-broker", path: join62(home2, ".switchroom", "vault-audit.log") },
+    { label: "vault-broker", path: join63(home2, ".switchroom", "vault-audit.log") },
     {
       label: "hostd",
-      path: join62(home2, ".switchroom", "host-control-audit.log")
+      path: join63(home2, ".switchroom", "host-control-audit.log")
     }
   ];
 }
@@ -43972,7 +44099,7 @@ function runAuditIntegrityChecks(deps = {}) {
   const read = deps.readFileSync ?? ((p) => fsReadFileSync3(p, "utf8"));
   const readFailOpen = deps.readFailOpenState ?? readFailOpenState;
   const results = [];
-  const vaultAuditLog = join62(home2, ".switchroom", "vault-audit.log");
+  const vaultAuditLog = join63(home2, ".switchroom", "vault-audit.log");
   const failOpen = readFailOpen(failOpenStatePath(vaultAuditLog));
   if (failOpen.failOpenCount > 0) {
     const when = failOpen.lastFailureTs ? ` (last at ${failOpen.lastFailureTs})` : ``;
@@ -44045,16 +44172,16 @@ var init_doctor_audit_integrity = __esm(() => {
 });
 
 // src/cli/doctor-agent-smoke.ts
-import { existsSync as existsSync62 } from "node:fs";
+import { existsSync as existsSync63 } from "node:fs";
 import { homedir as homedir38 } from "node:os";
-import { join as join63 } from "node:path";
+import { join as join64 } from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 async function runAgentSmokeChecks(config, deps = {}) {
   if (deps.fast)
     return [];
   const home2 = deps.homeDir ?? homedir38();
-  const sock = deps.operatorSockPath ?? join63(home2, ".switchroom", "hostd", "operator", "sock");
-  if (!deps.hostdRequestImpl && !existsSync62(sock)) {
+  const sock = deps.operatorSockPath ?? join64(home2, ".switchroom", "hostd", "operator", "sock");
+  if (!deps.hostdRequestImpl && !existsSync63(sock)) {
     return [
       {
         name: "agent liveness",
@@ -44132,9 +44259,9 @@ var init_doctor_agent_smoke = __esm(() => {
 
 // src/cli/doctor-vault-broker-durability.ts
 import { execFileSync as execFileSync20 } from "node:child_process";
-import { existsSync as existsSync63, statSync as statSync36 } from "node:fs";
+import { existsSync as existsSync64, statSync as statSync37 } from "node:fs";
 import { homedir as homedir39 } from "node:os";
-import { join as join64 } from "node:path";
+import { join as join65 } from "node:path";
 function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   const statHost = opts?.statHost ?? defaultStatHost;
   const statBroker = opts?.statBroker ?? defaultStatBroker;
@@ -44156,10 +44283,10 @@ function probeBindMountInode(hostPath, brokerContainerPath, opts) {
   };
 }
 function defaultStatHost(p) {
-  if (!existsSync63(p))
+  if (!existsSync64(p))
     return null;
   try {
-    const s = statSync36(p, { bigint: true });
+    const s = statSync37(p, { bigint: true });
     return { ino: s.ino, size: Number(s.size) };
   } catch {
     return null;
@@ -44283,16 +44410,16 @@ function runVaultBrokerDurabilityChecks(_config, opts) {
     probeBrokerUnlocked(opts?.statusProbe),
     probeAutoUnlockBlob(home2),
     probeMachineIdMount(),
-    formatBindMountResult("vault-broker: vault.enc bind mount", join64(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join64(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
-    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join64(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join64(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
-    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join64(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join64(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
+    formatBindMountResult("vault-broker: vault.enc bind mount", join65(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join65(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
+    formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join65(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join65(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
+    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join65(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join65(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
     probeKernelDbDurability(home2, {
       statBroker: opts?.kernelStatBroker
     })
   ];
 }
 function probeKernelDbDurability(home2, opts) {
-  const hostDir = join64(home2, ".switchroom", "approvals");
+  const hostDir = join65(home2, ".switchroom", "approvals");
   const containerDir = "/state/approvals";
   const name = "approval-kernel: approvals bind mount (allow_always durability)";
   const kernelStat = opts?.statBroker ?? defaultKernelStatBroker;
@@ -44360,8 +44487,8 @@ function defaultKernelStatBroker(p) {
   return { kind: "ok-with-stat", ino: inoStr, size };
 }
 function probeAutoUnlockBlob(home2) {
-  const blobPath = join64(home2, ".switchroom", "vault-auto-unlock");
-  if (!existsSync63(blobPath)) {
+  const blobPath = join65(home2, ".switchroom", "vault-auto-unlock");
+  if (!existsSync64(blobPath)) {
     return {
       name: "vault-broker: auto-unlock blob",
       status: "warn",
@@ -44369,7 +44496,7 @@ function probeAutoUnlockBlob(home2) {
       fix: "Run `switchroom vault broker enable-auto-unlock` to seal the blob with the current passphrase + machine-id"
     };
   }
-  const sz = statSync36(blobPath).size;
+  const sz = statSync37(blobPath).size;
   if (sz === 0) {
     return {
       name: "vault-broker: auto-unlock blob",
@@ -44385,7 +44512,7 @@ function probeAutoUnlockBlob(home2) {
   };
 }
 function probeMachineIdMount() {
-  const hostExists = existsSync63("/etc/machine-id");
+  const hostExists = existsSync64("/etc/machine-id");
   if (!hostExists) {
     return {
       name: "vault-broker: machine-id passthrough",
@@ -44536,25 +44663,25 @@ import { Socket as Socket3 } from "node:net";
 import {
   accessSync as accessSync2,
   constants as fsConstants5,
-  existsSync as existsSync64,
-  lstatSync as lstatSync8,
+  existsSync as existsSync65,
+  lstatSync as lstatSync9,
   mkdirSync as mkdirSync33,
   readFileSync as readFileSync58,
   readdirSync as readdirSync22,
-  statSync as statSync37
+  statSync as statSync38
 } from "node:fs";
-import { dirname as dirname19, join as join65, resolve as resolve38 } from "node:path";
+import { dirname as dirname19, join as join66, resolve as resolve38 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
-  const nvmRoot = join65(process.env.HOME ?? "", ".nvm", "versions", "node");
-  if (!existsSync64(nvmRoot))
+  const nvmRoot = join66(process.env.HOME ?? "", ".nvm", "versions", "node");
+  if (!existsSync65(nvmRoot))
     return null;
   try {
     const versions = readdirSync22(nvmRoot).sort().reverse();
     for (const v of versions) {
-      const candidate = join65(nvmRoot, v, "bin", bin);
+      const candidate = join66(nvmRoot, v, "bin", bin);
       try {
-        const s = statSync37(candidate);
+        const s = statSync38(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
           return candidate;
         }
@@ -44579,7 +44706,7 @@ function whichOnPath(bin) {
   for (const dir of pathEnv.split(":")) {
     if (!dir)
       continue;
-    const candidate = join65(dir, bin);
+    const candidate = join66(dir, bin);
     if (isX(candidate))
       return candidate;
   }
@@ -44745,21 +44872,21 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
   if (envBrowsersPath && envBrowsersPath.length > 0) {
     cacheLocations.push(envBrowsersPath);
   }
-  cacheLocations.push(join65(homeDir, ".cache", "ms-playwright"));
+  cacheLocations.push(join66(homeDir, ".cache", "ms-playwright"));
   for (const cacheDir of cacheLocations) {
-    if (!existsSync64(cacheDir))
+    if (!existsSync65(cacheDir))
       continue;
     try {
       const entries = readdirSync22(cacheDir).filter((e) => e.startsWith("chromium"));
       for (const entry of entries) {
         const candidates2 = [
-          join65(cacheDir, entry, "chrome-linux64", "chrome"),
-          join65(cacheDir, entry, "chrome-linux", "chrome"),
-          join65(cacheDir, entry, "chrome-linux64", "headless_shell"),
-          join65(cacheDir, entry, "chrome-linux", "headless_shell")
+          join66(cacheDir, entry, "chrome-linux64", "chrome"),
+          join66(cacheDir, entry, "chrome-linux", "chrome"),
+          join66(cacheDir, entry, "chrome-linux64", "headless_shell"),
+          join66(cacheDir, entry, "chrome-linux", "headless_shell")
         ];
         for (const path4 of candidates2) {
-          if (existsSync64(path4))
+          if (existsSync65(path4))
             return path4;
         }
       }
@@ -44878,7 +45005,7 @@ function checkUserDeclaredMcps(name, agentConfig, config, renderedMcpServers) {
 }
 function defaultPathKind(p) {
   try {
-    const s = lstatSync8(p);
+    const s = lstatSync9(p);
     return s.isDirectory() ? "dir" : "file-or-symlink";
   } catch {
     return "absent";
@@ -44888,7 +45015,7 @@ function checkDeployMounts(opts) {
   const home2 = opts?.home ?? process.env.HOME ?? "/root";
   const { pathKind } = opts?.deps ?? DEFAULT_DEPLOY_MOUNTS_DEPS;
   const results = [];
-  const dockerComposePlugin = join65(home2, ".docker", "cli-plugins", "docker-compose");
+  const dockerComposePlugin = join66(home2, ".docker", "cli-plugins", "docker-compose");
   const pluginKind = pathKind(dockerComposePlugin);
   if (pluginKind === "dir") {
     results.push({
@@ -44926,8 +45053,8 @@ function checkDeployMounts(opts) {
 function checkLegacyState() {
   const results = [];
   const h = process.env.HOME ?? "/root";
-  const clerkDir = join65(h, LEGACY_STATE_DIR);
-  const clerkPresent = existsSync64(clerkDir);
+  const clerkDir = join66(h, LEGACY_STATE_DIR);
+  const clerkPresent = existsSync65(clerkDir);
   results.push({
     name: "legacy ~/.clerk state",
     status: clerkPresent ? "warn" : "ok",
@@ -44936,10 +45063,10 @@ function checkLegacyState() {
       fix: "Legacy state detected. Run `mv ~/.clerk ~/.switchroom` and rename " + "any top-level `clerk:` key in switchroom.yaml to `switchroom:`. " + "This back-compat shim is REMOVED in v0.13.0 \u2014 no automatic " + "migration exists."
     } : {}
   });
-  const legacySock = join65(h, ".switchroom", "vault-broker.sock");
+  const legacySock = join66(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
-    sockStat = lstatSync8(legacySock);
+    sockStat = lstatSync9(legacySock);
   } catch {}
   if (sockStat) {
     results.push({
@@ -45057,7 +45184,7 @@ function checkVault(config) {
     detail: "Approval auth: passphrase (two-factor)"
   };
   const pairsResult = checkVaultBrokerSocketPairs(config);
-  if (!existsSync64(vaultPath)) {
+  if (!existsSync65(vaultPath)) {
     return [
       postureResult,
       {
@@ -45443,7 +45570,7 @@ function tryReadHostFile(path4) {
   }
 }
 function parseEnvFile(path4) {
-  if (!existsSync64(path4))
+  if (!existsSync65(path4))
     return {};
   let content;
   try {
@@ -45502,7 +45629,7 @@ async function checkTelegram(config) {
     const plugin = agentConfig.channels?.telegram?.plugin ?? "switchroom";
     if (plugin !== "switchroom")
       continue;
-    const envPath = join65(agentsDir, name, "telegram", ".env");
+    const envPath = join66(agentsDir, name, "telegram", ".env");
     const read = tryReadHostFile(envPath);
     if (read.kind === "eacces") {
       results.push({
@@ -45554,7 +45681,7 @@ async function checkTelegram(config) {
 }
 function checkStartShStale(agentName, startShPath) {
   const label = `${agentName}: start.sh scheduler block`;
-  if (!existsSync64(startShPath)) {
+  if (!existsSync65(startShPath)) {
     return {
       name: label,
       status: "warn",
@@ -45585,10 +45712,10 @@ function checkStartShStale(agentName, startShPath) {
 }
 function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const label = `${agentName}: $HOME/.switchroom symlink (#910)`;
-  const path4 = join65(agentDir, "home", ".switchroom");
+  const path4 = join66(agentDir, "home", ".switchroom");
   let stats;
   try {
-    stats = lstatSync8(path4);
+    stats = lstatSync9(path4);
   } catch (err) {
     if (err.code === "ENOENT") {
       return {
@@ -45622,8 +45749,8 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
 }
 function checkRepoHygiene(repoRoot) {
   const results = [];
-  const exportDir = join65(repoRoot, "clerk-export");
-  if (existsSync64(exportDir)) {
+  const exportDir = join66(repoRoot, "clerk-export");
+  if (existsSync65(exportDir)) {
     results.push({
       name: "repo hygiene: clerk-export/ on disk (#1072)",
       status: "warn",
@@ -45631,8 +45758,8 @@ function checkRepoHygiene(repoRoot) {
       fix: `Run scripts/migrate-clerk-export-to-vault.sh to move the bundle ` + `into the vault, then delete the on-disk copy.`
     });
   }
-  const knownTarball = join65(repoRoot, "clerk-export-with-secrets.tar.gz");
-  if (existsSync64(knownTarball)) {
+  const knownTarball = join66(repoRoot, "clerk-export-with-secrets.tar.gz");
+  if (existsSync65(knownTarball)) {
     results.push({
       name: "repo hygiene: clerk-export-with-secrets.tar.gz on disk (#1072)",
       status: "warn",
@@ -45649,7 +45776,7 @@ function checkRepoHygiene(repoRoot) {
         results.push({
           name: `repo hygiene: ${name} on disk (#1072)`,
           status: "warn",
-          detail: `${join65(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
+          detail: `${join66(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
           fix: `Inspect, migrate any secrets into the vault, then delete the ` + `archive.`
         });
       }
@@ -45672,10 +45799,10 @@ function checkRepoHygiene(repoRoot) {
 }
 function isSwitchroomCheckout(dir) {
   try {
-    if (!existsSync64(join65(dir, ".git")))
+    if (!existsSync65(join66(dir, ".git")))
       return false;
-    const pkgPath = join65(dir, "package.json");
-    if (!existsSync64(pkgPath))
+    const pkgPath = join66(dir, "package.json");
+    if (!existsSync65(pkgPath))
       return false;
     const pkg = JSON.parse(readFileSync58(pkgPath, "utf-8"));
     return pkg.name === "switchroom";
@@ -45690,7 +45817,7 @@ function checkAgents(config, configPath) {
   const authStatuses = getAllAuthStatuses(config);
   for (const [name, agentConfig] of Object.entries(config.agents)) {
     const agentDir = resolve38(agentsDir, name);
-    if (!existsSync64(agentDir)) {
+    if (!existsSync65(agentDir)) {
       results.push({
         name: `${name}: scaffold`,
         status: "fail",
@@ -45711,7 +45838,7 @@ function checkAgents(config, configPath) {
         fix: `Rotate the bot token (e.g. via \`switchroom vault\`), then run ` + `\`switchroom agent unquarantine ${name}\` and \`switchroom agent restart ${name}\``
       });
     }
-    results.push(checkStartShStale(name, join65(agentDir, "start.sh")));
+    results.push(checkStartShStale(name, join66(agentDir, "start.sh")));
     results.push(checkLeakedHomeSwitchroom(name, agentDir));
     const status = statuses[name];
     const active = status?.active ?? "unknown";
@@ -45788,8 +45915,8 @@ function checkAgents(config, configPath) {
       }
     }
     if (agentConfig.channels?.telegram?.plugin === "switchroom") {
-      const mcpJsonPath = join65(agentDir, ".mcp.json");
-      if (!existsSync64(mcpJsonPath)) {
+      const mcpJsonPath = join66(agentDir, ".mcp.json");
+      if (!existsSync65(mcpJsonPath)) {
         results.push({
           name: `${name}: .mcp.json`,
           status: "fail",
@@ -45875,7 +46002,7 @@ function mffEnvPath(config) {
   return agent ? resolve38(home2, ".switchroom/credentials", agent, "my-family-finance/.env") : resolve38(home2, ".switchroom/credentials/my-family-finance/.env");
 }
 function mffEnvState(envPath) {
-  if (!existsSync64(envPath))
+  if (!existsSync65(envPath))
     return "absent";
   try {
     accessSync2(envPath, fsConstants5.R_OK);
@@ -45893,7 +46020,7 @@ function checkMffVaultKeyPresent(passphrase, vaultPath) {
       fix: "Export SWITCHROOM_VAULT_PASSPHRASE to enable MFF vault probes"
     };
   }
-  if (!existsSync64(vaultPath)) {
+  if (!existsSync65(vaultPath)) {
     return {
       name: "mff: vault key present",
       status: "fail",
@@ -45946,7 +46073,7 @@ function deriveEd25519PublicKeyBytes(keyMaterial) {
   }
 }
 function checkMffVaultKeyFormat(passphrase, vaultPath) {
-  if (!passphrase || !existsSync64(vaultPath)) {
+  if (!passphrase || !existsSync65(vaultPath)) {
     return {
       name: "mff: vault key format",
       status: "warn",
@@ -46090,8 +46217,8 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
     };
   }
   const credDir = dirname19(envPath);
-  const authScript = join65(credDir, "claude-auth.py");
-  if (!existsSync64(authScript)) {
+  const authScript = join66(credDir, "claude-auth.py");
+  if (!existsSync65(authScript)) {
     return {
       name: "mff: auth flow",
       status: "warn",
@@ -46397,6 +46524,10 @@ function registerDoctorCommand(program3) {
       { title: "Memory (Hindsight)", results: await checkHindsight(config) },
       { title: "Telegram", results: await checkTelegram(config) },
       { title: "Agents", results: checkAgents(config, configPath) },
+      {
+        title: "Agent dotfile ownership (#3157)",
+        results: runAgentDotfileOwnershipChecks(config)
+      },
       { title: "Credentials", results: runCredentialsMigrationChecks(config) },
       { title: "Audit integrity (WS10-F4)", results: runAuditIntegrityChecks() },
       {
@@ -46519,6 +46650,7 @@ var init_doctor = __esm(() => {
   init_doctor_notion();
   init_doctor_credentials_migration();
   init_doctor_secret_access();
+  init_doctor_agent_dotfile_ownership();
   init_doctor_inlined_secrets();
   init_doctor_approval_attribution();
   init_doctor_audit_integrity();
@@ -47110,7 +47242,7 @@ var init_fleet_defaults = __esm(() => {
 
 // src/agents/connection-health.ts
 import { mkdirSync as mkdirSync44, writeFileSync as writeFileSync27 } from "node:fs";
-import { join as join80 } from "node:path";
+import { join as join81 } from "node:path";
 async function computeAgentConnectionIssues(config, agentName, vaultAclReader) {
   const reqs = computeMcpSecretRequirements(config).filter((r) => r.agent === agentName);
   if (reqs.length === 0)
@@ -47167,8 +47299,8 @@ async function computeAgentConnectionIssues(config, agentName, vaultAclReader) {
   return issues;
 }
 function writeConnectionHealthFile(agentDir, health, deps) {
-  const dir = join80(agentDir, ".claude");
-  const path7 = join80(dir, CONNECTION_HEALTH_FILENAME);
+  const dir = join81(agentDir, ".claude");
+  const path7 = join81(dir, CONNECTION_HEALTH_FILENAME);
   (deps?.mkdir ?? ((p, o) => mkdirSync44(p, o)))(dir, { recursive: true });
   (deps?.writeFile ?? ((p, d) => writeFileSync27(p, d)))(path7, JSON.stringify(health, null, 2) + `
 `);
@@ -47191,10 +47323,10 @@ var CONNECTION_HEALTH_FILENAME = "connection-health.json";
 var init_connection_health = () => {};
 
 // src/cli/update-prompt-hook.ts
-import { existsSync as existsSync81, readFileSync as readFileSync70, writeFileSync as writeFileSync28, chmodSync as chmodSync11, mkdirSync as mkdirSync45 } from "node:fs";
-import { join as join81 } from "node:path";
+import { existsSync as existsSync82, readFileSync as readFileSync70, writeFileSync as writeFileSync28, chmodSync as chmodSync11, mkdirSync as mkdirSync45 } from "node:fs";
+import { join as join82 } from "node:path";
 function containerHookCommand() {
-  return join81(CONTAINER_AGENT_DIR, ".claude", "hooks", HOOK_FILENAME);
+  return join82(CONTAINER_AGENT_DIR, ".claude", "hooks", HOOK_FILENAME);
 }
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -47260,12 +47392,12 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join81(agentDir, ".claude", "hooks");
+  const hooksDir = join82(agentDir, ".claude", "hooks");
   mkdirSync45(hooksDir, { recursive: true });
-  const scriptPath = join81(hooksDir, HOOK_FILENAME);
+  const scriptPath = join82(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
-  const existing = existsSync81(scriptPath) ? readFileSync70(scriptPath, "utf-8") : "";
+  const existing = existsSync82(scriptPath) ? readFileSync70(scriptPath, "utf-8") : "";
   if (existing !== desired) {
     writeFileSync28(scriptPath, desired, { mode: 493 });
     chmodSync11(scriptPath, 493);
@@ -47275,8 +47407,8 @@ function installUpdatePromptHook(agentDir) {
       chmodSync11(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join81(agentDir, ".claude", "settings.json");
-  if (!existsSync81(settingsPath)) {
+  const settingsPath = join82(agentDir, ".claude", "settings.json");
+  if (!existsSync82(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
   const raw = readFileSync70(settingsPath, "utf-8");
@@ -47704,7 +47836,7 @@ __export(exports_voice_sidecar_token, {
   VOICE_SIDECAR_TOKEN_ENV: () => VOICE_SIDECAR_TOKEN_ENV
 });
 import { randomBytes as randomBytes14 } from "node:crypto";
-import { chmodSync as chmodSync12, chownSync as chownSync7, existsSync as existsSync83, mkdirSync as mkdirSync46, readFileSync as readFileSync71, rmSync as rmSync17, writeFileSync as writeFileSync29 } from "node:fs";
+import { chmodSync as chmodSync12, chownSync as chownSync7, existsSync as existsSync84, mkdirSync as mkdirSync46, readFileSync as readFileSync71, rmSync as rmSync17, writeFileSync as writeFileSync29 } from "node:fs";
 import { dirname as dirname28 } from "node:path";
 async function defaultResolveOrSeedToken(home2, writeErr) {
   const [{ getViaBrokerStructured: getViaBrokerStructured2, putViaBroker: putViaBroker2 }, { resolveOperatorVaultPassphrase }] = await Promise.all([
@@ -47739,7 +47871,7 @@ async function provisionVoiceSidecarToken(composePath, home2, ctx) {
   const envPath = composeEnvPath(composePath);
   if (engine !== "local") {
     try {
-      if (existsSync83(envPath)) {
+      if (existsSync84(envPath)) {
         const body = readFileSync71(envPath, "utf-8");
         if (body.includes(`${VOICE_SIDECAR_TOKEN_ENV}=`))
           rmSync17(envPath);
@@ -47762,7 +47894,7 @@ async function provisionVoiceSidecarToken(composePath, home2, ctx) {
     mkdirSync46(dirname28(envPath), { recursive: true });
     let body = "";
     try {
-      if (existsSync83(envPath))
+      if (existsSync84(envPath))
         body = readFileSync71(envPath, "utf-8");
     } catch {}
     const line = `${VOICE_SIDECAR_TOKEN_ENV}=${token}`;
@@ -47822,11 +47954,11 @@ __export(exports_apply, {
   DEFAULT_COMPOSE_PATH: () => DEFAULT_COMPOSE_PATH2,
   COMPOSE_PROJECT: () => COMPOSE_PROJECT2
 });
-import { accessSync as accessSync3, chownSync as chownSync8, constants as fsConstants6, copyFileSync as copyFileSync12, existsSync as existsSync84, mkdirSync as mkdirSync47, readFileSync as readFileSync72, readdirSync as readdirSync29, renameSync as renameSync18, statSync as statSync46, writeFileSync as writeFileSync30 } from "node:fs";
+import { accessSync as accessSync3, chownSync as chownSync8, constants as fsConstants6, copyFileSync as copyFileSync12, existsSync as existsSync85, mkdirSync as mkdirSync47, readFileSync as readFileSync72, readdirSync as readdirSync29, renameSync as renameSync18, statSync as statSync47, writeFileSync as writeFileSync30 } from "node:fs";
 import { mkdir as mkdir2 } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
-import { dirname as dirname29, join as join83, resolve as resolve51 } from "node:path";
+import { dirname as dirname29, join as join84, resolve as resolve51 } from "node:path";
 import { homedir as homedir49 } from "node:os";
 import { execFileSync as execFileSync27 } from "node:child_process";
 function effectiveLiteLLMEnabled(config, agentResolvedLitellm) {
@@ -47838,7 +47970,7 @@ async function resolveOperatorVaultPassphrase(home2) {
     return envPass;
   try {
     const { readAutoUnlockFile: readAutoUnlockFile2 } = await Promise.resolve().then(() => (init_auto_unlock(), exports_auto_unlock));
-    const blobPath = join83(home2, ".switchroom", "vault-auto-unlock");
+    const blobPath = join84(home2, ".switchroom", "vault-auto-unlock");
     const pass = readAutoUnlockFile2(blobPath);
     return pass && pass.length > 0 ? pass : null;
   } catch {
@@ -47926,7 +48058,7 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
   const oauthAccount = config.auth?.active;
   let pendingConfigEdits = false;
   let configText = null;
-  if (switchroomConfigPath && existsSync84(switchroomConfigPath)) {
+  if (switchroomConfigPath && existsSync85(switchroomConfigPath)) {
     try {
       configText = readFileSync72(switchroomConfigPath, "utf-8");
     } catch (err) {
@@ -48083,7 +48215,7 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
     try {
       let cfgMode = 420;
       try {
-        cfgMode = statSync46(switchroomConfigPath).mode & 511;
+        cfgMode = statSync47(switchroomConfigPath).mode & 511;
       } catch {}
       writeConfigFileSync(switchroomConfigPath, configText, cfgMode);
       writeOut(source_default.gray(`  ~ litellm: granted read-ACL on per-agent keys (updated ${switchroomConfigPath})
@@ -48151,10 +48283,10 @@ function resolveVaultBindMountDir(homeDir, ctx) {
   if (isCustomPath && ctx.customVaultPath) {
     return dirname29(ctx.customVaultPath);
   }
-  return join83(homeDir, ".switchroom", "vault");
+  return join84(homeDir, ".switchroom", "vault");
 }
 function inspectVaultBindMountDir(vaultDir) {
-  if (!existsSync84(vaultDir))
+  if (!existsSync85(vaultDir))
     return { kind: "missing" };
   const entries = readdirSync29(vaultDir);
   const unknown = [];
@@ -48182,43 +48314,43 @@ function hasVaultRefs(value) {
 async function ensureHostMountSources(config) {
   const home2 = resolveHostHomeForCompose();
   const dirs = [
-    join83(home2, ".switchroom", "approvals"),
-    join83(home2, ".switchroom", "scheduler"),
-    join83(home2, ".switchroom", "logs"),
-    join83(home2, ".switchroom", "compose"),
-    join83(home2, ".switchroom", "broker-operator")
+    join84(home2, ".switchroom", "approvals"),
+    join84(home2, ".switchroom", "scheduler"),
+    join84(home2, ".switchroom", "logs"),
+    join84(home2, ".switchroom", "compose"),
+    join84(home2, ".switchroom", "broker-operator")
   ];
   for (const name of Object.keys(config.agents)) {
-    dirs.push(join83(home2, ".switchroom", "agents", name));
-    dirs.push(join83(home2, ".switchroom", "logs", name));
-    dirs.push(join83(home2, ".claude", "projects", name));
-    dirs.push(join83(home2, ".switchroom", "audit", name));
-    if (existsSync84(join83(home2, ".switchroom-config"))) {
-      dirs.push(join83(home2, ".switchroom-config", "agents", name, "personal-skills"));
+    dirs.push(join84(home2, ".switchroom", "agents", name));
+    dirs.push(join84(home2, ".switchroom", "logs", name));
+    dirs.push(join84(home2, ".claude", "projects", name));
+    dirs.push(join84(home2, ".switchroom", "audit", name));
+    if (existsSync85(join84(home2, ".switchroom-config"))) {
+      dirs.push(join84(home2, ".switchroom-config", "agents", name, "personal-skills"));
     }
   }
   for (const dir of dirs) {
     await mkdir2(dir, { recursive: true });
   }
-  const autoUnlockPath = join83(home2, ".switchroom", "vault-auto-unlock");
-  if (!existsSync84(autoUnlockPath)) {
+  const autoUnlockPath = join84(home2, ".switchroom", "vault-auto-unlock");
+  if (!existsSync85(autoUnlockPath)) {
     writeFileSync30(autoUnlockPath, "", { mode: 384 });
   }
-  const auditLogPath = join83(home2, ".switchroom", "vault-audit.log");
-  if (!existsSync84(auditLogPath)) {
+  const auditLogPath = join84(home2, ".switchroom", "vault-audit.log");
+  if (!existsSync85(auditLogPath)) {
     writeFileSync30(auditLogPath, "", { mode: 420 });
   }
-  const grantsDbPath = join83(home2, ".switchroom", "vault-grants.db");
-  if (!existsSync84(grantsDbPath)) {
+  const grantsDbPath = join84(home2, ".switchroom", "vault-grants.db");
+  if (!existsSync85(grantsDbPath)) {
     writeFileSync30(grantsDbPath, "", { mode: 384 });
   }
-  const hostdAuditLogPath = join83(home2, ".switchroom", "host-control-audit.log");
-  if (!existsSync84(hostdAuditLogPath)) {
+  const hostdAuditLogPath = join84(home2, ".switchroom", "host-control-audit.log");
+  if (!existsSync85(hostdAuditLogPath)) {
     writeFileSync30(hostdAuditLogPath, "", { mode: 420 });
   }
   for (const name of Object.keys(config.agents)) {
-    const tokenPath = join83(home2, ".switchroom", "agents", name, ".vault-token");
-    if (!existsSync84(tokenPath)) {
+    const tokenPath = join84(home2, ".switchroom", "agents", name, ".vault-token");
+    if (!existsSync85(tokenPath)) {
       writeFileSync30(tokenPath, "", { mode: 384 });
     }
     try {
@@ -48226,16 +48358,16 @@ async function ensureHostMountSources(config) {
       chownSync8(tokenPath, uid, uid);
     } catch {}
   }
-  const fleetDir = join83(home2, ".switchroom", "fleet");
+  const fleetDir = join84(home2, ".switchroom", "fleet");
   await mkdir2(fleetDir, { recursive: true });
-  const invariantsPath = join83(fleetDir, "switchroom-invariants.md");
+  const invariantsPath = join84(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
-  const invariantsCurrent = existsSync84(invariantsPath) ? readFileSync72(invariantsPath, "utf-8") : null;
+  const invariantsCurrent = existsSync85(invariantsPath) ? readFileSync72(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
     writeFileSync30(invariantsPath, invariantsCanonical, { mode: 420 });
   }
-  const fleetClaudePath = join83(fleetDir, "CLAUDE.md");
-  if (!existsSync84(fleetClaudePath)) {
+  const fleetClaudePath = join84(fleetDir, "CLAUDE.md");
+  if (!existsSync85(fleetClaudePath)) {
     writeFileSync30(fleetClaudePath, renderFleetDefaultsClaudeMd(), {
       mode: 420
     });
@@ -48265,7 +48397,7 @@ function isInAgentContainer(vaultPresent, composeV2Present, env2 = process.env)
 function runApplyPreflight(config, opts = {}) {
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
   const detect = opts.detectComposeV2 ?? detectComposeV2;
-  const vaultMissing = hasVaultRefs(config) && !existsSync84(vaultPath);
+  const vaultMissing = hasVaultRefs(config) && !existsSync85(vaultPath);
   const composeErr = detect();
   if ((vaultMissing || composeErr) && isInAgentContainer(!vaultMissing, composeErr === null)) {
     throw new Error(IN_AGENT_CONTAINER_APPLY_MSG);
@@ -48279,7 +48411,7 @@ function runApplyPreflight(config, opts = {}) {
   detectAndReportLegacyGdriveSlots(vaultPath);
 }
 function detectAndReportLegacyGdriveSlots(vaultPath) {
-  if (!existsSync84(vaultPath))
+  if (!existsSync85(vaultPath))
     return;
   const passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
   if (!passphrase)
@@ -48320,8 +48452,8 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 }
 function writeInstallTypeCache(homeDir = homedir49()) {
   const ctx = detectInstallType();
-  const dir = join83(homeDir, ".switchroom");
-  const out = join83(dir, "install-type.json");
+  const dir = join84(homeDir, ".switchroom");
+  const out = join84(dir, "install-type.json");
   const tmp = `${out}.tmp`;
   mkdirSync47(dir, { recursive: true });
   const payload = {
@@ -48388,17 +48520,17 @@ Applying switchroom config...
       writeOut(source_default.green(`  + ${name}`) + source_default.gray(` (${agentConfig.extends ?? "default"}) \u2014 ${detail}
 `));
       try {
-        installUpdatePromptHook(join83(agentsDir, name));
+        installUpdatePromptHook(join84(agentsDir, name));
       } catch (hookErr) {
         writeOut(source_default.gray(`    (update-prompt hook install failed for ${name}: ${hookErr.message})
 `));
       }
-      await refreshAgentConnectionHealth(config, name, join83(agentsDir, name), {
+      await refreshAgentConnectionHealth(config, name, join84(agentsDir, name), {
         vaultAclReader: connHealthVaultAclReader
       });
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join83(agentsDir, name), uid, {
+        alignAgentUid(name, join84(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -48443,7 +48575,7 @@ Applying switchroom config...
     for (const name of agentNames) {
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join83(agentsDir, name), uid, {
+        alignAgentUid(name, join84(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -48781,7 +48913,7 @@ function copyExampleConfig2(name) {
     throw new Error(`Invalid example name: ${name} (must match /^[a-z0-9_-]+$/)`);
   }
   const dest = resolve51(process.cwd(), "switchroom.yaml");
-  if (existsSync84(dest)) {
+  if (existsSync85(dest)) {
     console.error(source_default.yellow("switchroom.yaml already exists \u2014 skipping example copy"));
     return;
   }
@@ -48792,7 +48924,7 @@ function copyExampleConfig2(name) {
     return;
   }
   const exampleFile = resolve51(import.meta.dirname, `../../examples/${name}.yaml`);
-  if (!existsSync84(exampleFile)) {
+  if (!existsSync85(exampleFile)) {
     throw new Error(`Example config not found: ${name}.yaml (available: ${Object.keys(EMBEDDED_EXAMPLES).join(", ")})`);
   }
   copyFileSync12(exampleFile, dest);
@@ -48803,8 +48935,8 @@ function findUnwritableAgentDirs(config, opts) {
   const targets = opts.only ? [opts.only] : Object.keys(config.agents ?? {});
   const unwritable = [];
   for (const name of targets) {
-    const startSh = join83(agentsDir, name, "start.sh");
-    if (!existsSync84(startSh))
+    const startSh = join84(agentsDir, name, "start.sh");
+    if (!existsSync85(startSh))
       continue;
     try {
       accessSync3(startSh, fsConstants6.W_OK);
@@ -49007,7 +49139,7 @@ var init_apply = __esm(() => {
     switchroom: switchroom_default,
     minimal: minimal_default
   };
-  DEFAULT_COMPOSE_PATH2 = join83(homedir49(), ".switchroom", "compose", "docker-compose.yml");
+  DEFAULT_COMPOSE_PATH2 = join84(homedir49(), ".switchroom", "compose", "docker-compose.yml");
   IN_AGENT_CONTAINER_APPLY_MSG = "`switchroom apply`'s full per-agent scaffold cannot run from inside an " + "agent container \u2014 this is a host/hostd operation by construction " + "(no vault at the container HOME, and no `docker compose` v2 plugin here).\nTo roll the fleet to a new version, drive the hostd rollout (`mcp__hostd__rollout`): it runs a `--compose-only` apply plus a per-agent restart-reconcile, and each agent refreshes its own templates " + `on restart \u2014 the roll completes without any agent running a full apply.
 ` + "A full host-side `sudo switchroom apply` is only needed for structural changes (compose regeneration / new-agent scaffolding), and is run by the operator on the host, never from inside an agent.";
   SELF_ELEVATE_PRESERVED_ENV = [
@@ -62456,7 +62588,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes16 } from "node:crypto";
-import { existsSync as existsSync93, readFileSync as readFileSync81 } from "node:fs";
+import { existsSync as existsSync94, readFileSync as readFileSync81 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -62483,7 +62615,7 @@ async function dispatchTool2(name, args) {
     return errorText2("hostd MCP: SWITCHROOM_AGENT_NAME env var is not set \u2014 cannot " + "determine which per-agent socket to talk to.");
   }
   const sockPath = selfSocketPath();
-  if (!existsSync93(sockPath)) {
+  if (!existsSync94(sockPath)) {
     return errorText2(`hostd MCP: socket not bound at ${sockPath}. The host-control ` + `daemon is either not installed (run \`switchroom hostd install\`) ` + `or this agent isn't admin-flagged in switchroom.yaml. RFC C ` + `bind-mounts the per-agent socket only when host_control.enabled ` + `is true AND the agent has admin: true.`);
   }
   let req;
@@ -62734,13 +62866,13 @@ function resolveAuditLogPath() {
   if (process.env.HOSTD_AUDIT_LOG_PATH)
     return process.env.HOSTD_AUDIT_LOG_PATH;
   const bindMounted = "/host-home/.switchroom/host-control-audit.log";
-  if (existsSync93(bindMounted))
+  if (existsSync94(bindMounted))
     return bindMounted;
   return defaultAuditLogPath2();
 }
 function getLastUpdateApplyStatus() {
   const path8 = resolveAuditLogPath();
-  if (!existsSync93(path8)) {
+  if (!existsSync94(path8)) {
     return errorText2(`get_status: audit log not found at ${path8}. No update_apply has run yet?`);
   }
   let raw;
@@ -63422,7 +63554,7 @@ __export(exports_scan, {
 import {
   readFileSync as readFileSync83,
   readdirSync as readdirSync37,
-  existsSync as existsSync96,
+  existsSync as existsSync97,
   mkdirSync as mkdirSync54,
   writeFileSync as writeFileSync36
 } from "node:fs";
@@ -63433,7 +63565,7 @@ function resolveSwitchroomBase(home2 = process.env.SWITCHROOM_HOME ?? process.en
 }
 function listAgents(base) {
   const dir = resolve56(base, "agents");
-  if (!existsSync96(dir))
+  if (!existsSync97(dir))
     return [];
   try {
     return readdirSync37(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
@@ -63462,7 +63594,7 @@ function runScan(opts = {}) {
     let gwText = "";
     let sawArtifact = false;
     try {
-      if (existsSync96(turnsPath)) {
+      if (existsSync97(turnsPath)) {
         turnsText = readFileSync83(turnsPath, "utf-8");
         sawArtifact = true;
       }
@@ -63470,7 +63602,7 @@ function runScan(opts = {}) {
       log(`fleet-health: WARN skipping ${agent} turns.jsonl unreadable: ${String(e)}`);
     }
     try {
-      if (existsSync96(gwPath)) {
+      if (existsSync97(gwPath)) {
         gwText = readFileSync83(gwPath, "utf-8");
         sawArtifact = true;
       }
@@ -63509,7 +63641,7 @@ function runScan(opts = {}) {
 function readLedgerIfPresent(base) {
   const path8 = ledgerPathForBase(base);
   try {
-    if (!existsSync96(path8))
+    if (!existsSync97(path8))
       return null;
     return JSON.parse(readFileSync83(path8, "utf-8"));
   } catch {
@@ -69654,6 +69786,36 @@ function printConsumersTable(state) {
     console.log(`  ${c.name.padEnd(10)} ${acct} ${status}`);
   }
 }
+function usageHeadroomCell(t) {
+  const noColor = (s) => s;
+  if (t == null)
+    return { plain: "no data", color: source_default.gray };
+  if (t.headroomPct == null)
+    return { plain: "unknown", color: source_default.gray };
+  const left = Math.round(t.headroomPct);
+  const peak = t.peakUtilizationPct == null ? "?" : `${Math.round(t.peakUtilizationPct)}`;
+  const base = `${left}% left (peak ${peak}%, n=${t.observations})`;
+  if (t.walled)
+    return { plain: `WALLED - ${base}`, color: source_default.red };
+  if (t.refilled)
+    return { plain: `refilled - ${base}`, color: source_default.green };
+  if (left <= 10)
+    return { plain: base, color: source_default.yellow };
+  return { plain: base, color: noColor };
+}
+function printUsageTable(state) {
+  console.log(source_default.bold("  ACCOUNT                           PREMIUM (Fable) HEADROOM                    STANDARD HEADROOM"));
+  const WIDTH = 44;
+  for (const a of state.accounts) {
+    const marker = a.label === state.active ? source_default.green("*") : " ";
+    const label = a.label.padEnd(32);
+    const premium = usageHeadroomCell(a.usage_ledger?.premium ?? null);
+    const standard = usageHeadroomCell(a.usage_ledger?.standard ?? null);
+    const premiumCol = premium.color(premium.plain.padEnd(WIDTH));
+    const standardCol = standard.color(standard.plain);
+    console.log(`  ${marker} ${label} ${premiumCol} ${standardCol}`);
+  }
+}
 function printAgentDetail(state, agent) {
   console.log();
   console.log(source_default.bold(`  ${agent.name}`));
@@ -69832,6 +69994,19 @@ function registerAuthCommand(program3) {
     printAccountsTable(state);
     console.log();
   }));
+  auth.command("usage").description("Per-account premium (Fable) + standard usage headroom, from the durable ledger").option("--json", "Output the raw per-account usage_ledger summaries as JSON").action(withConfigError(async (opts) => {
+    const state = await brokerCall((client) => client.listState());
+    if (opts.json) {
+      console.log(JSON.stringify(state.accounts.map((a) => ({ label: a.label, usage_ledger: a.usage_ledger ?? null })), null, 2));
+      return;
+    }
+    console.log();
+    printUsageTable(state);
+    console.log();
+    console.log(source_default.gray("  Premium = flagship (Fable) 7d_oi tier; standard = 5h/7d. Passive: harvested from probe headers, no extra requests."));
+    console.log(source_default.gray("  'X% left' is current (refill-aware); 'peak' is the max over retained history (~48h) and may predate the latest reset."));
+    console.log();
+  }));
   function pinAuthActiveInYaml(label, quiet = false) {
     try {
       const yamlPath = getConfigPath(program3);
@@ -83200,9 +83375,9 @@ init_source();
 init_loader();
 init_lifecycle();
 init_compose_env();
-import { cpSync as cpSync2, existsSync as existsSync65, mkdirSync as mkdirSync34, readFileSync as readFileSync59, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync39, chownSync as chownSync5 } from "node:fs";
+import { cpSync as cpSync2, existsSync as existsSync66, mkdirSync as mkdirSync34, readFileSync as readFileSync59, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync40, chownSync as chownSync5 } from "node:fs";
 import { spawnSync as spawnSync12 } from "node:child_process";
-import { join as join66, dirname as dirname20, resolve as resolve39 } from "node:path";
+import { join as join67, dirname as dirname20, resolve as resolve39 } from "node:path";
 import { homedir as homedir40 } from "node:os";
 
 // src/cli/release-yaml.ts
@@ -83228,7 +83403,7 @@ init_operator_uid();
 init_atomic();
 
 // src/cli/preflight-mounts.ts
-import { statSync as statSync38 } from "node:fs";
+import { statSync as statSync39 } from "node:fs";
 function parseHostBindSources(composeText) {
   const out = [];
   const FILE_HINT = /\.(ya?ml|db|log|toml|json|token|id)$|\/\.vault-token$|machine-id$|localtime$|vault-auto-unlock$|\/webkite$/;
@@ -83255,7 +83430,7 @@ function parseHostBindSources(composeText) {
   return out;
 }
 function validateBindSources(composeText, deps = {}) {
-  const stat = deps.stat ?? ((p) => statSync38(p));
+  const stat = deps.stat ?? ((p) => statSync39(p));
   const sources = parseHostBindSources(composeText);
   const issues = [];
   const seen = new Set;
@@ -83300,7 +83475,7 @@ function defaultPersistPin(configPath) {
     const after = setReleasePinInConfig(before, pin);
     if (after === before)
       return;
-    writeConfigFileSync(path4, after, statSync39(path4).mode & 511);
+    writeConfigFileSync(path4, after, statSync40(path4).mode & 511);
     try {
       if (typeof process.geteuid === "function" && process.geteuid() === 0) {
         const uid = resolveOperatorUid();
@@ -83310,13 +83485,13 @@ function defaultPersistPin(configPath) {
     } catch {}
   };
 }
-var DEFAULT_COMPOSE_PATH = join66(homedir40(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH = join67(homedir40(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname20(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync65(join66(dir, ".git"))) {
+    if (existsSync66(join67(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync59(join66(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync59(join67(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -83401,7 +83576,7 @@ function planUpdate(opts) {
   steps.push({
     name: "pull-images",
     description: "Pull broker / kernel / agent images from GHCR",
-    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync65(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
+    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync66(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
     run: () => {
       const r = runner("docker", [
         "compose",
@@ -83527,14 +83702,14 @@ function planUpdate(opts) {
         return;
       }
       const source = resolve39(import.meta.dirname, "../../skills");
-      const dest = join66(homedir40(), ".switchroom", "skills", "_bundled");
-      if (!existsSync65(source)) {
+      const dest = join67(homedir40(), ".switchroom", "skills", "_bundled");
+      if (!existsSync66(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
         return;
       }
       try {
-        if (existsSync65(dest)) {
+        if (existsSync66(dest)) {
           rmSync12(dest, { recursive: true, force: true });
         }
         mkdirSync34(dirname20(dest), { recursive: true });
@@ -83648,12 +83823,12 @@ function defaultStatusProbe(composePath) {
     } catch {}
     if (scriptPath) {
       try {
-        cliBuiltAt = new Date(statSync39(scriptPath).mtimeMs).toISOString();
+        cliBuiltAt = new Date(statSync40(scriptPath).mtimeMs).toISOString();
       } catch {}
       let dir = dirname20(scriptPath);
       for (let i = 0;i < 8; i++) {
-        const pkgPath = join66(dir, "package.json");
-        if (existsSync65(pkgPath)) {
+        const pkgPath = join67(dir, "package.json");
+        if (existsSync66(pkgPath)) {
           try {
             const pkg = JSON.parse(readFileSync59(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
@@ -83676,7 +83851,7 @@ function defaultStatusProbe(composePath) {
     warnings.push("could not resolve CLI version (no package.json found above the resolved script path)");
   }
   const services = [];
-  if (!existsSync65(composePath)) {
+  if (!existsSync66(composePath)) {
     warnings.push(`compose file not found at ${composePath}; service status unknown`);
     return { cliVersion, cliBuiltAt, services, warnings };
   }
@@ -83872,7 +84047,7 @@ function registerUpdateCommand(program3) {
 // src/cli/rollout.ts
 init_helpers();
 import { spawnSync as spawnSync14 } from "node:child_process";
-import { readFileSync as readFileSync60, chownSync as chownSync6, statSync as statSync40 } from "node:fs";
+import { readFileSync as readFileSync60, chownSync as chownSync6, statSync as statSync41 } from "node:fs";
 import { homedir as homedir41 } from "node:os";
 init_operator_uid();
 init_atomic();
@@ -84276,7 +84451,7 @@ function registerRolloutCommand(program3) {
         const after = setReleasePinInConfig(before, pin);
         if (after === before)
           return;
-        writeConfigFileSync(configPath, after, statSync40(configPath).mode & 511);
+        writeConfigFileSync(configPath, after, statSync41(configPath).mode & 511);
         try {
           if (typeof process.geteuid === "function" && process.geteuid() === 0) {
             const uid = resolveOperatorUid();
@@ -84350,8 +84525,8 @@ init_helpers();
 init_lifecycle();
 init_resolve_version();
 import { execSync as execSync3 } from "node:child_process";
-import { existsSync as existsSync66, readFileSync as readFileSync61 } from "node:fs";
-import { dirname as dirname21, join as join67 } from "node:path";
+import { existsSync as existsSync67, readFileSync as readFileSync61 } from "node:fs";
+import { dirname as dirname21, join as join68 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync3("claude --version 2>/dev/null", {
@@ -84401,11 +84576,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const pkgPath = join67(dir, "package.json");
-    if (existsSync66(pkgPath)) {
+    const pkgPath = join68(dir, "package.json");
+    if (existsSync67(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync61(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync66(join67(dir, ".git"))) {
+        if (pkg.name === "switchroom" && existsSync67(join68(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -84583,18 +84758,18 @@ import { resolve as resolve41 } from "node:path";
 
 // src/agents/session-retention.ts
 import {
-  existsSync as existsSync67,
+  existsSync as existsSync68,
   readdirSync as readdirSync23,
-  statSync as statSync41,
+  statSync as statSync42,
   unlinkSync as unlinkSync14
 } from "node:fs";
-import { join as join68 } from "node:path";
+import { join as join69 } from "node:path";
 var DEFAULT_SESSION_RETENTION_MAX_COUNT = 20;
 var DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS = 30;
 var MIN_KEEP = 2;
 function collectSessionJsonl(claudeConfigDir) {
-  const projects = join68(claudeConfigDir, "projects");
-  if (!existsSync67(projects))
+  const projects = join69(claudeConfigDir, "projects");
+  if (!existsSync68(projects))
     return [];
   const found = [];
   const walk2 = (dir) => {
@@ -84605,10 +84780,10 @@ function collectSessionJsonl(claudeConfigDir) {
       return;
     }
     for (const name of entries) {
-      const full = join68(dir, name);
+      const full = join69(dir, name);
       let st;
       try {
-        st = statSync41(full);
+        st = statSync42(full);
       } catch {
         continue;
       }
@@ -84725,18 +84900,18 @@ function registerHandoffCommand(program3) {
 // src/issues/store.ts
 import {
   closeSync as closeSync12,
-  existsSync as existsSync68,
+  existsSync as existsSync69,
   mkdirSync as mkdirSync35,
   openSync as openSync12,
   readdirSync as readdirSync24,
   readFileSync as readFileSync62,
   renameSync as renameSync15,
-  statSync as statSync42,
+  statSync as statSync43,
   unlinkSync as unlinkSync15,
   writeFileSync as writeFileSync19,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join69 } from "node:path";
+import { join as join70 } from "node:path";
 import { randomBytes as randomBytes12 } from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
 
@@ -85167,8 +85342,8 @@ function redactedMarker(ruleId) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path4 = join69(stateDir, ISSUES_FILE);
-  if (!existsSync68(path4))
+  const path4 = join70(stateDir, ISSUES_FILE);
+  if (!existsSync69(path4))
     return [];
   let raw;
   try {
@@ -85245,7 +85420,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve42(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync68(join69(stateDir, ISSUES_FILE)))
+  if (!existsSync69(join70(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -85263,7 +85438,7 @@ function resolve42(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync68(join69(stateDir, ISSUES_FILE)))
+  if (!existsSync69(join70(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -85281,7 +85456,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync68(join69(stateDir, ISSUES_FILE)))
+  if (!existsSync69(join70(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -85314,7 +85489,7 @@ function ensureDir(stateDir) {
   mkdirSync35(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path4 = join69(stateDir, ISSUES_FILE);
+  const path4 = join70(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path4}.tmp-${process.pid}-${randomBytes12(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -85336,9 +85511,9 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join69(stateDir, entry);
+    const tmpPath = join70(stateDir, entry);
     try {
-      const stat = statSync42(tmpPath);
+      const stat = statSync43(tmpPath);
       if (stat.mtimeMs < cutoff) {
         unlinkSync15(tmpPath);
       }
@@ -85348,7 +85523,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join69(stateDir, ISSUES_LOCK);
+  const lockPath = join70(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -85631,20 +85806,20 @@ function relTime(deltaMs) {
 
 // src/cli/deps.ts
 init_source();
-import { existsSync as existsSync71 } from "node:fs";
+import { existsSync as existsSync72 } from "node:fs";
 import { homedir as homedir44 } from "node:os";
-import { join as join72, resolve as resolve43 } from "node:path";
+import { join as join73, resolve as resolve43 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash13 } from "node:crypto";
 import {
-  existsSync as existsSync69,
+  existsSync as existsSync70,
   mkdirSync as mkdirSync36,
   readFileSync as readFileSync63,
   rmSync as rmSync13,
   writeFileSync as writeFileSync20
 } from "node:fs";
-import { dirname as dirname22, join as join70 } from "node:path";
+import { dirname as dirname22, join as join71 } from "node:path";
 import { homedir as homedir42 } from "node:os";
 import { execFileSync as execFileSync21 } from "node:child_process";
 
@@ -85657,7 +85832,7 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join70(homedir42(), ".switchroom", "deps", "python");
+  return join71(homedir42(), ".switchroom", "deps", "python");
 }
 function hashFile(path4) {
   return createHash13("sha256").update(readFileSync63(path4)).digest("hex");
@@ -85666,16 +85841,16 @@ function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultPythonCacheRoot();
   const hostPython = opts.pythonBin ?? "python3";
-  if (!existsSync69(requirementsPath)) {
+  if (!existsSync70(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join70(cacheRoot, skillName);
-  const stampPath = join70(venvDir, ".requirements.sha256");
-  const binDir = join70(venvDir, "bin");
-  const pythonBin = join70(binDir, "python");
-  const pipBin = join70(binDir, "pip");
+  const venvDir = join71(cacheRoot, skillName);
+  const stampPath = join71(venvDir, ".requirements.sha256");
+  const binDir = join71(venvDir, "bin");
+  const pythonBin = join71(binDir, "python");
+  const pipBin = join71(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
-  if (!force && existsSync69(stampPath) && existsSync69(pythonBin)) {
+  if (!force && existsSync70(stampPath) && existsSync70(pythonBin)) {
     const existingHash = readFileSync63(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
@@ -85688,7 +85863,7 @@ function ensurePythonEnv(opts) {
       };
     }
   }
-  if (existsSync69(venvDir)) {
+  if (existsSync70(venvDir)) {
     rmSync13(venvDir, { recursive: true, force: true });
   }
   mkdirSync36(dirname22(venvDir), { recursive: true });
@@ -85726,13 +85901,13 @@ function ensurePythonEnv(opts) {
 import { createHash as createHash14 } from "node:crypto";
 import {
   copyFileSync as copyFileSync10,
-  existsSync as existsSync70,
+  existsSync as existsSync71,
   mkdirSync as mkdirSync37,
   readFileSync as readFileSync64,
   rmSync as rmSync14,
   writeFileSync as writeFileSync21
 } from "node:fs";
-import { dirname as dirname23, join as join71 } from "node:path";
+import { dirname as dirname23, join as join72 } from "node:path";
 import { homedir as homedir43 } from "node:os";
 import { execFileSync as execFileSync22 } from "node:child_process";
 
@@ -85756,7 +85931,7 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join71(homedir43(), ".switchroom", "deps", "node");
+  return join72(homedir43(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
   const sourceDir = dirname23(packageJsonPath);
@@ -85765,8 +85940,8 @@ function hashDepInputs(packageJsonPath) {
 `);
   hasher.update(readFileSync64(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join71(sourceDir, lockName);
-    if (existsSync70(lockPath)) {
+    const lockPath = join72(sourceDir, lockName);
+    if (existsSync71(lockPath)) {
       hasher.update(`
 `);
       hasher.update(lockName);
@@ -85781,16 +85956,16 @@ function ensureNodeEnv(opts) {
   const { skillName, packageJsonPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultNodeCacheRoot();
   const installer = opts.installer ?? "bun";
-  if (!existsSync70(packageJsonPath)) {
+  if (!existsSync71(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
   const sourceDir = dirname23(packageJsonPath);
-  const envDir = join71(cacheRoot, skillName);
-  const stampPath = join71(envDir, ".package.sha256");
-  const nodeModulesDir = join71(envDir, "node_modules");
-  const binDir = join71(nodeModulesDir, ".bin");
+  const envDir = join72(cacheRoot, skillName);
+  const stampPath = join72(envDir, ".package.sha256");
+  const nodeModulesDir = join72(envDir, "node_modules");
+  const binDir = join72(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
-  if (!force && existsSync70(stampPath) && existsSync70(nodeModulesDir)) {
+  if (!force && existsSync71(stampPath) && existsSync71(nodeModulesDir)) {
     const existingHash = readFileSync64(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
@@ -85802,16 +85977,16 @@ function ensureNodeEnv(opts) {
       };
     }
   }
-  if (existsSync70(envDir)) {
+  if (existsSync71(envDir)) {
     rmSync14(envDir, { recursive: true, force: true });
   }
   mkdirSync37(envDir, { recursive: true });
-  copyFileSync10(packageJsonPath, join71(envDir, "package.json"));
+  copyFileSync10(packageJsonPath, join72(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join71(sourceDir, lockName);
-    if (existsSync70(lockPath)) {
-      copyFileSync10(lockPath, join71(envDir, lockName));
+    const lockPath = join72(sourceDir, lockName);
+    if (existsSync71(lockPath)) {
+      copyFileSync10(lockPath, join72(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -85846,22 +86021,22 @@ function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
   deps.command("rebuild <skill>").description("Rebuild the Python venv and/or Node node_modules cache for a skill").option("-p, --python", "Rebuild only the Python env").option("-n, --node", "Rebuild only the Node env").action(async (skill, opts) => {
     const skillsRoot = builtinSkillsRoot();
-    if (!existsSync71(skillsRoot)) {
+    if (!existsSync72(skillsRoot)) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join72(skillsRoot, skill);
-    if (!existsSync71(skillDir)) {
+    const skillDir = join73(skillsRoot, skill);
+    if (!existsSync72(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join72(skillDir, "requirements.txt");
-    const packageJsonPath = join72(skillDir, "package.json");
-    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync71(requirementsPath));
-    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync71(packageJsonPath));
+    const requirementsPath = join73(skillDir, "requirements.txt");
+    const packageJsonPath = join73(skillDir, "package.json");
+    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync72(requirementsPath));
+    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync72(packageJsonPath));
     let did = 0;
     if (wantPython) {
-      if (!existsSync71(requirementsPath)) {
+      if (!existsSync72(requirementsPath)) {
         console.error(source_default.red(`Skill "${skill}" has no requirements.txt at ${requirementsPath}`));
         process.exit(1);
       }
@@ -85885,7 +86060,7 @@ function registerDepsCommand(program3) {
       }
     }
     if (wantNode) {
-      if (!existsSync71(packageJsonPath)) {
+      if (!existsSync72(packageJsonPath)) {
         console.error(source_default.red(`Skill "${skill}" has no package.json at ${packageJsonPath}`));
         process.exit(1);
       }
@@ -85918,7 +86093,7 @@ function registerDepsCommand(program3) {
 // src/cli/workspace.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync72 } from "node:fs";
+import { existsSync as existsSync73 } from "node:fs";
 import { resolve as resolve44, sep as sep3 } from "node:path";
 import { spawnSync as spawnSync15 } from "node:child_process";
 
@@ -86695,7 +86870,7 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve44(dir, ".git");
-    if (!existsSync72(gitDir)) {
+    if (!existsSync73(gitDir)) {
       process.stdout.write(`Workspace is not a git repository. Re-run \`switchroom agent create ${agentName}\` ` + `or manually \`git init\` in ${dir} to enable versioning.
 `);
       return;
@@ -86749,7 +86924,7 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve44(dir, ".git");
-    if (!existsSync72(gitDir)) {
+    if (!existsSync73(gitDir)) {
       process.stdout.write(`Workspace is not a git repository.
 `);
       return;
@@ -86774,7 +86949,7 @@ function resolveAgentWorkspaceDirOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve44(agentsDir, agentName);
   const dir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync72(dir)) {
+  if (!existsSync73(dir)) {
     process.stderr.write(`workspace: ${dir} does not exist yet. Run \`switchroom setup\` or \`switchroom agent scaffold ${agentName}\` to seed it.
 `);
     return;
@@ -86810,8 +86985,8 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync11, existsSync as existsSync73, readFileSync as readFileSync65, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join73, resolve as resolve45 } from "node:path";
+import { copyFileSync as copyFileSync11, existsSync as existsSync74, readFileSync as readFileSync65, writeFileSync as writeFileSync22 } from "node:fs";
+import { join as join74, resolve as resolve45 } from "node:path";
 init_scaffold();
 init_profiles();
 init_schema();
@@ -86828,7 +87003,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve45(agentsDir, agentName);
   const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync73(workspaceDir)) {
+  if (!existsSync74(workspaceDir)) {
     console.error(`soul: ${workspaceDir} does not exist yet. Run \`switchroom setup\` ` + `or \`switchroom agent scaffold ${agentName}\` to seed it.`);
     process.exit(1);
   }
@@ -86837,7 +87012,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join73(workspaceDir, "SOUL.md"),
+    soulPath: join74(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -86854,7 +87029,7 @@ function registerSoulCommand(program3) {
     const t = resolveSoulTargetOrExit(program3, agentName);
     if (!t)
       return;
-    if (!existsSync73(t.soulPath)) {
+    if (!existsSync74(t.soulPath)) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
@@ -86869,7 +87044,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: profile "${t.profileName}" ships no SOUL.md.hbs \u2014 ` + `nothing to re-seed from.`);
       process.exit(1);
     }
-    const exists = existsSync73(t.soulPath);
+    const exists = existsSync74(t.soulPath);
     if (exists && !opts.yes) {
       if (!isInteractive()) {
         console.error(`soul: ${t.soulPath} already exists. Re-run with --yes to ` + `replace it (the current file is backed up to SOUL.md.bak).`);
@@ -86884,7 +87059,7 @@ function registerSoulCommand(program3) {
     let backupPath;
     if (exists) {
       backupPath = `${t.soulPath}.bak`;
-      if (existsSync73(backupPath)) {
+      if (existsSync74(backupPath)) {
         backupPath = `${t.soulPath}.bak.${Date.now()}`;
       }
       copyFileSync11(t.soulPath, backupPath);
@@ -86903,8 +87078,8 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync74, readFileSync as readFileSync66, readdirSync as readdirSync25, statSync as statSync43 } from "node:fs";
-import { resolve as resolve46, join as join74 } from "node:path";
+import { existsSync as existsSync75, readFileSync as readFileSync66, readdirSync as readdirSync25, statSync as statSync44 } from "node:fs";
+import { resolve as resolve46, join as join75 } from "node:path";
 import { createHash as createHash15 } from "node:crypto";
 init_merge();
 init_hindsight2();
@@ -86915,8 +87090,8 @@ function estimateTokens(bytes) {
   return Math.round(bytes / 3.7);
 }
 function readMcpServerNames(agentDir) {
-  const mcpPath = join74(agentDir, ".mcp.json");
-  if (!existsSync74(mcpPath))
+  const mcpPath = join75(agentDir, ".mcp.json");
+  if (!existsSync75(mcpPath))
     return [];
   try {
     const parsed = JSON.parse(readFileSync66(mcpPath, "utf-8"));
@@ -86929,8 +87104,8 @@ function sha256(content) {
   return createHash15("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join74(claudeConfigDir, "projects");
-  if (!existsSync74(projectsDir))
+  const projectsDir = join75(claudeConfigDir, "projects");
+  if (!existsSync75(projectsDir))
     return;
   try {
     const entries = readdirSync25(projectsDir, { withFileTypes: true });
@@ -86938,11 +87113,11 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join74(projectsDir, entry.name);
-      const transcriptPath = join74(projectPath, "transcript.jsonl");
-      if (!existsSync74(transcriptPath))
+      const projectPath = join75(projectsDir, entry.name);
+      const transcriptPath = join75(projectPath, "transcript.jsonl");
+      if (!existsSync75(transcriptPath))
         continue;
-      const stat3 = statSync43(transcriptPath);
+      const stat3 = statSync44(transcriptPath);
       if (!latest || stat3.mtimeMs > latest.mtime) {
         latest = { path: transcriptPath, mtime: stat3.mtimeMs };
       }
@@ -87003,16 +87178,16 @@ function registerDebugCommand(program3) {
     }
     const agentsDir = resolveAgentsDir(config);
     const agentDir = resolve46(agentsDir, agentName);
-    if (!existsSync74(agentDir)) {
+    if (!existsSync75(agentDir)) {
       console.error(`Agent directory not found: ${agentDir}`);
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join74(agentDir, ".claude");
-    const claudeMdPath = join74(agentDir, "CLAUDE.md");
-    const soulMdPath = join74(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join74(workspaceDir, "SOUL.md");
-    const handoffPath = join74(agentDir, ".handoff.md");
+    const claudeConfigDir = join75(agentDir, ".claude");
+    const claudeMdPath = join75(agentDir, "CLAUDE.md");
+    const soulMdPath = join75(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join75(workspaceDir, "SOUL.md");
+    const handoffPath = join75(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -87058,7 +87233,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Append System Prompt (per-session) ===
 `);
-    const handoffContent = existsSync74(handoffPath) ? readFileSync66(handoffPath, "utf-8") : "";
+    const handoffContent = existsSync75(handoffPath) ? readFileSync66(handoffPath, "utf-8") : "";
     if (handoffContent.trim().length > 0) {
       console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
       console.log(handoffContent);
@@ -87069,7 +87244,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
 `);
-    const claudeMdContent = existsSync74(claudeMdPath) ? readFileSync66(claudeMdPath, "utf-8") : "";
+    const claudeMdContent = existsSync75(claudeMdPath) ? readFileSync66(claudeMdPath, "utf-8") : "";
     if (claudeMdContent.trim().length > 0) {
       console.log(`(${formatBytes(claudeMdContent.length)})`);
       console.log(claudeMdContent);
@@ -87080,7 +87255,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Persona (SOUL.md) ===
 `);
-    const soulMdContent = existsSync74(soulMdPath) ? readFileSync66(soulMdPath, "utf-8") : existsSync74(workspaceSoulMdPath) ? readFileSync66(workspaceSoulMdPath, "utf-8") : "";
+    const soulMdContent = existsSync75(soulMdPath) ? readFileSync66(soulMdPath, "utf-8") : existsSync75(workspaceSoulMdPath) ? readFileSync66(workspaceSoulMdPath, "utf-8") : "";
     if (soulMdContent.trim().length > 0) {
       console.log(`(${formatBytes(soulMdContent.length)})`);
       console.log(soulMdContent);
@@ -87141,11 +87316,11 @@ function registerDebugCommand(program3) {
     const soulMdBytes = soulMdContent.length;
     const perTurnBytes = dynamicResult.concatenated.length;
     const userBytes = userMessage?.text.length ?? 0;
-    const fleetDir = join74(agentsDir, "..", "fleet");
-    const fleetInvPath = join74(fleetDir, "switchroom-invariants.md");
-    const fleetClaudePath = join74(fleetDir, "CLAUDE.md");
-    const fleetInvBytes = existsSync74(fleetInvPath) ? readFileSync66(fleetInvPath, "utf-8").length : 0;
-    const fleetClaudeBytes = existsSync74(fleetClaudePath) ? readFileSync66(fleetClaudePath, "utf-8").length : 0;
+    const fleetDir = join75(agentsDir, "..", "fleet");
+    const fleetInvPath = join75(fleetDir, "switchroom-invariants.md");
+    const fleetClaudePath = join75(fleetDir, "CLAUDE.md");
+    const fleetInvBytes = existsSync75(fleetInvPath) ? readFileSync66(fleetInvPath, "utf-8").length : 0;
+    const fleetClaudeBytes = existsSync75(fleetClaudePath) ? readFileSync66(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
     const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
     console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
@@ -87178,8 +87353,8 @@ init_source();
 
 // src/worktree/claim.ts
 import { execFileSync as execFileSync23 } from "node:child_process";
-import { closeSync as closeSync13, mkdirSync as mkdirSync39, openSync as openSync13, existsSync as existsSync76, unlinkSync as unlinkSync17 } from "node:fs";
-import { join as join76, resolve as resolve48 } from "node:path";
+import { closeSync as closeSync13, mkdirSync as mkdirSync39, openSync as openSync13, existsSync as existsSync77, unlinkSync as unlinkSync17 } from "node:fs";
+import { join as join77, resolve as resolve48 } from "node:path";
 import { homedir as homedir46 } from "node:os";
 import { randomBytes as randomBytes13 } from "node:crypto";
 
@@ -87190,16 +87365,16 @@ import {
   readFileSync as readFileSync67,
   readdirSync as readdirSync26,
   unlinkSync as unlinkSync16,
-  existsSync as existsSync75,
+  existsSync as existsSync76,
   renameSync as renameSync16
 } from "node:fs";
-import { join as join75, resolve as resolve47 } from "node:path";
+import { join as join76, resolve as resolve47 } from "node:path";
 import { homedir as homedir45 } from "node:os";
 function registryDir() {
-  return resolve47(process.env.SWITCHROOM_WORKTREE_DIR ?? join75(homedir45(), ".switchroom", "worktrees"));
+  return resolve47(process.env.SWITCHROOM_WORKTREE_DIR ?? join76(homedir45(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join75(registryDir(), `${id}.json`);
+  return join76(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
   mkdirSync38(registryDir(), { recursive: true });
@@ -87250,7 +87425,7 @@ function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
   mkdirSync39(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join76(lockDir, `.lock-${lockName}`);
+  const lockPath = join77(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -87277,7 +87452,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve48(process.env.SWITCHROOM_WORKTREE_BASE ?? join76(homedir46(), ".switchroom", "worktree-checkouts"));
+  return resolve48(process.env.SWITCHROOM_WORKTREE_BASE ?? join77(homedir46(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes13(4).toString("hex");
@@ -87299,12 +87474,12 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join76(homedir46(), p.slice(2));
+    return join77(homedir46(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
   const repoPath = resolveRepoPath(input.repo, codeRepos);
-  if (!existsSync76(repoPath)) {
+  if (!existsSync77(repoPath)) {
     throw new Error(`Repository path does not exist: ${repoPath}`);
   }
   let concurrencyCap = DEFAULT_CONCURRENCY;
@@ -87327,7 +87502,7 @@ async function claimWorktree(input, codeRepos) {
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
     mkdirSync39(baseDir, { recursive: true });
-    worktreePath = join76(baseDir, `${id}-${taskSuffix}`);
+    worktreePath = join77(baseDir, `${id}-${taskSuffix}`);
     const ambientOwner = process.env.SWITCHROOM_AGENT_NAME;
     const ownerAgent = input.ownerAgent ?? (ambientOwner != null && ambientOwner !== "" ? ambientOwner : undefined);
     const now = new Date().toISOString();
@@ -87360,7 +87535,7 @@ async function claimWorktree(input, codeRepos) {
 
 // src/worktree/release.ts
 import { execFileSync as execFileSync24 } from "node:child_process";
-import { existsSync as existsSync77 } from "node:fs";
+import { existsSync as existsSync78 } from "node:fs";
 function releaseWorktree(input) {
   const { id } = input;
   const record2 = readRecord(id);
@@ -87368,7 +87543,7 @@ function releaseWorktree(input) {
     return { released: true };
   }
   let gitSuccess = true;
-  if (existsSync77(record2.path)) {
+  if (existsSync78(record2.path)) {
     try {
       execFileSync24("git", ["worktree", "remove", "--force", record2.path], {
         cwd: record2.repo,
@@ -87407,7 +87582,7 @@ function listWorktrees() {
 
 // src/worktree/reaper.ts
 import { execFileSync as execFileSync25 } from "node:child_process";
-import { existsSync as existsSync78 } from "node:fs";
+import { existsSync as existsSync79 } from "node:fs";
 var STALE_THRESHOLD_MS = 10 * 60 * 1000;
 function reapSkipReasonText(action) {
   switch (action) {
@@ -87468,7 +87643,7 @@ function planReaper(nowMs, deps = {}) {
   const plan = [];
   for (const record2 of listRecords()) {
     const heartbeatAge = now - new Date(record2.heartbeatAt).getTime();
-    const worktreeExists = existsSync78(record2.path);
+    const worktreeExists = existsSync79(record2.path);
     if (!worktreeExists) {
       plan.push({
         record: record2,
@@ -87549,16 +87724,16 @@ function runReaper(nowMs, deps = {}) {
 // src/worktree/gc.ts
 import { execFileSync as execFileSync26 } from "node:child_process";
 import {
-  existsSync as existsSync79,
+  existsSync as existsSync80,
   readFileSync as readFileSync68,
   readdirSync as readdirSync27,
-  statSync as statSync44,
+  statSync as statSync45,
   renameSync as renameSync17,
   mkdirSync as mkdirSync40,
   rmSync as rmSync15
 } from "node:fs";
 import { homedir as homedir47 } from "node:os";
-import { join as join77, resolve as resolve49 } from "node:path";
+import { join as join78, resolve as resolve49 } from "node:path";
 function parseGitdirPointer(dotGitFileContents) {
   const m = /^gitdir:\s*(.+?)\s*$/m.exec(dotGitFileContents);
   return m ? m[1] : null;
@@ -87673,17 +87848,17 @@ function defaultPrSignal(repo, branch, exec) {
   }
 }
 function trashRoot() {
-  return resolve49(process.env.SWITCHROOM_WORKTREE_TRASH ?? join77(homedir47(), ".switchroom", "worktree-gc-trash"));
+  return resolve49(process.env.SWITCHROOM_WORKTREE_TRASH ?? join78(homedir47(), ".switchroom", "worktree-gc-trash"));
 }
 function planGc(roots, deps = {}) {
-  const exists = deps.existsSync ?? existsSync79;
+  const exists = deps.existsSync ?? existsSync80;
   const readDir = deps.readDir ?? ((p) => readdirSync27(p));
   const readFile4 = deps.readFile ?? ((p) => readFileSync68(p, "utf8"));
-  const stat3 = deps.stat ?? ((p) => statSync44(p));
+  const stat3 = deps.stat ?? ((p) => statSync45(p));
   const exec = deps.exec ?? defaultExec;
   const prSignal = deps.prSignal ?? ((repo, branch) => defaultPrSignal(repo, branch, exec));
   const stamp = deps.dateStamp ?? "undated";
-  const trash = join77(trashRoot(), stamp);
+  const trash = join78(trashRoot(), stamp);
   let claimed;
   try {
     claimed = new Set(listRecords().map((r) => resolve49(r.path)));
@@ -87719,10 +87894,10 @@ function planGc(roots, deps = {}) {
       continue;
     }
     for (const name of entries) {
-      const dir = join77(root, name);
+      const dir = join78(root, name);
       if (isEphemeralPath(dir))
         continue;
-      const dotGit = join77(dir, ".git");
+      const dotGit = join78(dir, ".git");
       if (!exists(dotGit))
         continue;
       let st;
@@ -87751,7 +87926,7 @@ function planGc(roots, deps = {}) {
       ownerRepos.add(repoRoot);
       if (exists(ptr))
         continue;
-      orphans.push({ dir, owner: repoRoot, dest: join77(trash, name) });
+      orphans.push({ dir, owner: repoRoot, dest: join78(trash, name) });
     }
   }
   const registered = [];
@@ -87855,14 +88030,14 @@ function selectPurgeTargets(entries, olderThanDays) {
   return entries.filter((e) => e.ageDays >= olderThanDays).map((e) => e.path);
 }
 function listTrashEntries(nowMs, deps = {}) {
-  const exists = deps.existsSync ?? existsSync79;
+  const exists = deps.existsSync ?? existsSync80;
   const readDir = deps.readDir ?? ((p) => readdirSync27(p));
   const root = trashRoot();
   if (!exists(root))
     return [];
   const out = [];
   for (const stamp of readDir(root)) {
-    const stampDir = join77(root, stamp);
+    const stampDir = join78(root, stamp);
     let names;
     try {
       names = readDir(stampDir);
@@ -87870,10 +88045,10 @@ function listTrashEntries(nowMs, deps = {}) {
       continue;
     }
     for (const name of names) {
-      const p = join77(stampDir, name);
+      const p = join78(stampDir, name);
       let mtimeMs = nowMs;
       try {
-        mtimeMs = statSync44(p).mtimeMs;
+        mtimeMs = statSync45(p).mtimeMs;
       } catch {}
       out.push({ path: p, ageDays: (nowMs - mtimeMs) / 86400000 });
     }
@@ -87894,7 +88069,7 @@ function purgeTrash(paths) {
   return { deleted, errors: errors2 };
 }
 function defaultRoots() {
-  return [join77(homedir47(), "code")];
+  return [join78(homedir47(), "code")];
 }
 
 // src/cli/worktree.ts
@@ -88122,7 +88297,7 @@ import {
   rmSync as rmSync16,
   writeFileSync as writeFileSync24
 } from "node:fs";
-import { join as join78 } from "node:path";
+import { join as join79 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -88312,16 +88487,16 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join78(stateBase, "google-workspace-mcp", "credentials");
+  return join79(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
   mkdirSync41(dir, { recursive: true, mode: 448 });
   chmodSync10(dir, 448);
   for (const name of readdirSync28(dir)) {
-    rmSync16(join78(dir, name), { force: true, recursive: true });
+    rmSync16(join79(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join78(dir, filename);
+  const filePath = join79(dir, filename);
   writeFileSync24(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync10(filePath, 384);
   return filePath;
@@ -88481,7 +88656,7 @@ function registerDriveMcpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn5 } from "node:child_process";
 import { writeFileSync as writeFileSync25, mkdirSync as mkdirSync42 } from "node:fs";
-import { dirname as dirname24, join as join79 } from "node:path";
+import { dirname as dirname24, join as join80 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -88521,7 +88696,7 @@ function writeRefreshHeartbeat(agentName, data) {
 function heartbeatPath(agentName) {
   const override = process.env.SWITCHROOM_M365_HEARTBEAT_DIR;
   if (override) {
-    return join79(override, `m365-launcher-${agentName}.heartbeat.json`);
+    return join80(override, `m365-launcher-${agentName}.heartbeat.json`);
   }
   return "/state/agent/m365-launcher.heartbeat.json";
 }
@@ -88753,7 +88928,7 @@ function registerM365McpLauncherCommand(program3) {
 // src/cli/notion-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
-import { existsSync as existsSync80, mkdirSync as mkdirSync43, writeFileSync as writeFileSync26 } from "node:fs";
+import { existsSync as existsSync81, mkdirSync as mkdirSync43, writeFileSync as writeFileSync26 } from "node:fs";
 import { dirname as dirname25 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
 var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
@@ -88765,7 +88940,7 @@ function buildNotionMcpArgs(opts) {
 function defaultWriteHeartbeat(path7, contents) {
   try {
     const dir = dirname25(path7);
-    if (!existsSync80(dir))
+    if (!existsSync81(dir))
       mkdirSync43(dir, { recursive: true });
     writeFileSync26(path7, contents);
   } catch {}
@@ -88877,7 +89052,7 @@ function registerNotionMcpLauncherCommand(program3) {
 
 // src/cli/deliver-file.ts
 init_client2();
-import { readFileSync as readFileSync69, statSync as statSync45 } from "node:fs";
+import { readFileSync as readFileSync69, statSync as statSync46 } from "node:fs";
 import { basename as basename11 } from "node:path";
 
 // src/delivery/onedrive.ts
@@ -89216,7 +89391,7 @@ async function defaultResolveProvider() {
 }
 async function runDeliverFile(localPath, deps = {}) {
   const agentName = safeAgentName(deps.agentName ?? process.env.SWITCHROOM_AGENT_NAME);
-  const sizeOf = deps.fileSize ?? ((p) => statSync45(p).size);
+  const sizeOf = deps.fileSize ?? ((p) => statSync46(p).size);
   const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync69(p)));
   const resolveProvider = deps.resolveProvider ?? defaultResolveProvider;
   let size;
@@ -89538,8 +89713,8 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync73, existsSync as existsSync85, readdirSync as readdirSync30 } from "node:fs";
-import { join as join84 } from "node:path";
+import { readFileSync as readFileSync73, existsSync as existsSync86, readdirSync as readdirSync30 } from "node:fs";
+import { join as join85 } from "node:path";
 import { homedir as homedir50 } from "node:os";
 
 // src/status-ask/report.ts
@@ -89861,7 +90036,7 @@ function runReport(opts) {
 function resolveSources(explicitPath) {
   if (explicitPath != null && explicitPath.trim() !== "") {
     const trimmed = explicitPath.trim();
-    if (!existsSync85(trimmed)) {
+    if (!existsSync86(trimmed)) {
       process.stderr.write(`status-ask report: ${trimmed}: file not found
 `);
       process.exit(1);
@@ -89875,9 +90050,9 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join84(homedir50(), ".switchroom", "agents");
+    agentsDir = join85(homedir50(), ".switchroom", "agents");
   }
-  if (!existsSync85(agentsDir))
+  if (!existsSync86(agentsDir))
     return [];
   const sources = [];
   let entries;
@@ -89887,8 +90062,8 @@ function resolveSources(explicitPath) {
     return [];
   }
   for (const name of entries) {
-    const path8 = join84(agentsDir, name, "runtime-metrics.jsonl");
-    if (existsSync85(path8)) {
+    const path8 = join85(agentsDir, name, "runtime-metrics.jsonl");
+    if (existsSync86(path8)) {
       sources.push({ path: path8, agent: name });
     }
   }
@@ -89918,32 +90093,32 @@ var import_yaml21 = __toESM(require_dist(), 1);
 init_paths();
 import {
   closeSync as closeSync14,
-  existsSync as existsSync86,
+  existsSync as existsSync87,
   fsyncSync as fsyncSync8,
   mkdirSync as mkdirSync48,
   openSync as openSync14,
   readdirSync as readdirSync31,
   readFileSync as readFileSync74,
   renameSync as renameSync19,
-  statSync as statSync47,
+  statSync as statSync48,
   unlinkSync as unlinkSync18,
   writeSync as writeSync10
 } from "node:fs";
-import { join as join85, resolve as resolve52 } from "node:path";
+import { join as join86, resolve as resolve52 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
   const base = opts.root ? resolve52(opts.root, agent) : resolve52(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join85(base, "schedule.d");
-  const scheduleStagingDir = join85(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join85(base, "skills.d");
-  const skillsStagingDir = join85(skillsDir, STAGING_SUBDIR);
+  const scheduleDir = join86(base, "schedule.d");
+  const scheduleStagingDir = join86(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join86(base, "skills.d");
+  const skillsStagingDir = join86(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join85(base, ".lock"),
+    lockPath: join86(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
@@ -89969,7 +90144,7 @@ function withAgentLock(paths, fn) {
       if (e.code !== "EEXIST")
         throw err;
       try {
-        const age = Date.now() - statSync47(paths.lockPath).mtimeMs;
+        const age = Date.now() - statSync48(paths.lockPath).mtimeMs;
         if (age > 30000) {
           unlinkSync18(paths.lockPath);
           continue;
@@ -89997,8 +90172,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join85(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join85(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join86(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join86(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync14(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
@@ -90014,8 +90189,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join85(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join85(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join86(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join86(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync14(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
@@ -90030,8 +90205,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join85(paths.skillsDir, `${slug}.yaml`);
-    if (!existsSync86(finalPath))
+    const finalPath = join86(paths.skillsDir, `${slug}.yaml`);
+    if (!existsSync87(finalPath))
       return false;
     unlinkSync18(finalPath);
     return true;
@@ -90039,13 +90214,13 @@ function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
 }
 function listSkillsOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync86(paths.skillsDir))
+  if (!existsSync87(paths.skillsDir))
     return [];
   const out = [];
   for (const name of readdirSync31(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join85(paths.skillsDir, name);
+    const full = join86(paths.skillsDir, name);
     try {
       const raw = readFileSync74(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -90057,8 +90232,8 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join85(paths.scheduleDir, `${slug}.yaml`);
-    if (!existsSync86(finalPath))
+    const finalPath = join86(paths.scheduleDir, `${slug}.yaml`);
+    if (!existsSync87(finalPath))
       return false;
     unlinkSync18(finalPath);
     return true;
@@ -90066,13 +90241,13 @@ function deleteOverlayEntry(agent, slug, opts = {}) {
 }
 function listOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync86(paths.scheduleDir))
+  if (!existsSync87(paths.scheduleDir))
     return [];
   const out = [];
   for (const name of readdirSync31(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join85(paths.scheduleDir, name);
+    const full = join86(paths.scheduleDir, name);
     try {
       const raw = readFileSync74(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -90294,7 +90469,7 @@ function reconcileAgentCronOnly(agent) {
 // src/cli/agent-config-pending.ts
 import {
   closeSync as closeSync15,
-  existsSync as existsSync87,
+  existsSync as existsSync88,
   fsyncSync as fsyncSync9,
   mkdirSync as mkdirSync49,
   openSync as openSync15,
@@ -90305,12 +90480,12 @@ import {
   writeFileSync as writeFileSync31,
   writeSync as writeSync11
 } from "node:fs";
-import { join as join86 } from "node:path";
+import { join as join87 } from "node:path";
 import { randomBytes as randomBytes15 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join86(paths.scheduleDir, ".pending");
+  return join87(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
@@ -90323,8 +90498,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join86(dir, `${stageId}.yaml`);
-  const metaPath = join86(dir, `${stageId}.meta.json`);
+  const yamlPath = join87(dir, `${stageId}.yaml`);
+  const metaPath = join87(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -90351,16 +90526,16 @@ function stagePendingScheduleEntry(opts) {
 }
 function listPendingScheduleEntries(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  if (!existsSync87(dir))
+  if (!existsSync88(dir))
     return [];
   const out = [];
   for (const name of readdirSync32(dir).sort()) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join86(dir, name);
-    const yamlPath = join86(dir, `${stageId}.yaml`);
-    if (!existsSync87(yamlPath))
+    const metaPath = join87(dir, name);
+    const yamlPath = join87(dir, `${stageId}.yaml`);
+    if (!existsSync88(yamlPath))
       continue;
     try {
       const meta = JSON.parse(readFileSync75(metaPath, "utf-8"));
@@ -90378,8 +90553,8 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join86(paths.scheduleDir, `${slug}.yaml`);
-  if (existsSync87(finalPath)) {
+  const finalPath = join87(paths.scheduleDir, `${slug}.yaml`);
+  if (existsSync88(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
   renameSync20(match.yamlPath, finalPath);
@@ -90401,7 +90576,7 @@ function denyPendingScheduleEntry(opts) {
 }
 
 // src/cli/agent-config-write.ts
-import { existsSync as existsSync88, readFileSync as readFileSync76 } from "node:fs";
+import { existsSync as existsSync89, readFileSync as readFileSync76 } from "node:fs";
 import { execFileSync as execFileSync28 } from "node:child_process";
 
 // src/scheduler/schedule-report.ts
@@ -90791,7 +90966,7 @@ function scheduleRemove(opts) {
   }
   let priorContent = null;
   try {
-    if (existsSync88(match.path))
+    if (existsSync89(match.path))
       priorContent = readFileSync76(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
@@ -90995,7 +91170,7 @@ function registerAgentConfigWriteCommands(program3) {
     }
     let blob;
     if (opts.jsonl) {
-      blob = existsSync88(opts.jsonl) ? readFileSync76(opts.jsonl, "utf-8") : "";
+      blob = existsSync89(opts.jsonl) ? readFileSync76(opts.jsonl, "utf-8") : "";
     } else {
       try {
         blob = execFileSync28("docker", ["exec", `switchroom-${agent}`, "cat", "/state/agent/scheduler.jsonl"], {
@@ -91027,11 +91202,11 @@ function registerAgentConfigWriteCommands(program3) {
 
 // src/cli/agent-config-skill-write.ts
 var import_yaml22 = __toESM(require_dist(), 1);
-import { existsSync as existsSync89 } from "node:fs";
+import { existsSync as existsSync90 } from "node:fs";
 init_reconcile_default_skills();
 init_agent_config();
 var import_yaml23 = __toESM(require_dist(), 1);
-import { join as join87 } from "node:path";
+import { join as join88 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -91106,8 +91281,8 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join87(poolDir, skillName);
-  if (!existsSync89(skillPath)) {
+  const skillPath = join88(poolDir, skillName);
+  if (!existsSync90(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
   const yamlText = import_yaml22.stringify({ skills: [skillName] });
@@ -91271,8 +91446,8 @@ function registerAgentConfigSkillWriteCommands(program3) {
 // src/cli/skill.ts
 import {
   closeSync as closeSync16,
-  existsSync as existsSync90,
-  lstatSync as lstatSync10,
+  existsSync as existsSync91,
+  lstatSync as lstatSync11,
   mkdirSync as mkdirSync50,
   mkdtempSync as mkdtempSync5,
   openSync as openSync16,
@@ -91281,11 +91456,11 @@ import {
   realpathSync as realpathSync7,
   renameSync as renameSync21,
   rmSync as rmSync18,
-  statSync as statSync48,
+  statSync as statSync49,
   writeFileSync as writeFileSync32
 } from "node:fs";
 import { tmpdir as tmpdir5, homedir as homedir51 } from "node:os";
-import { dirname as dirname30, join as join88, relative as relative2, resolve as resolve53 } from "node:path";
+import { dirname as dirname30, join as join89, relative as relative2, resolve as resolve53 } from "node:path";
 import { spawnSync as spawnSync16 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -91519,7 +91694,7 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join88(homedir51(), raw.slice(2));
+    return join89(homedir51(), raw.slice(2));
   }
   if (raw === "~")
     return homedir51();
@@ -91551,14 +91726,14 @@ function isTarballPath(p) {
 }
 function loadFromDir(dir) {
   const abs = realpathSync7(dir);
-  if (!statSync48(abs).isDirectory()) {
+  if (!statSync49(abs).isDirectory()) {
     fail3(`--from path is not a directory: ${dir}`);
   }
   const files = {};
   const walk2 = (sub) => {
     const entries = readdirSync33(sub, { withFileTypes: true });
     for (const ent of entries) {
-      const full = join88(sub, ent.name);
+      const full = join89(sub, ent.name);
       const rel = relative2(abs, full);
       if (ent.isSymbolicLink()) {
         fail3(`refusing to read symlink inside --from dir: ${rel}`);
@@ -91593,7 +91768,7 @@ function loadFromTarball(tarPath) {
       fail3(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
-  const staging = mkdtempSync5(join88(tmpdir5(), "skill-apply-extract-"));
+  const staging = mkdtempSync5(join89(tmpdir5(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
     const r = spawnSync16("tar", [
@@ -91679,8 +91854,8 @@ function validatePayload(name, files) {
           errors2.push(`${path8} fails \`bash -n\` syntax check: ${(r.stderr ?? "").trim()}`);
         }
       } else if (PY_SCRIPT_RE2.test(path8)) {
-        const tmp = mkdtempSync5(join88(tmpdir5(), "skill-apply-py-"));
-        const tmpPy = join88(tmp, "check.py");
+        const tmp = mkdtempSync5(join89(tmpdir5(), "skill-apply-py-"));
+        const tmpPy = join89(tmp, "check.py");
         try {
           writeFileSync32(tmpPy, content);
           const r = spawnSync16("python3", ["-m", "py_compile", tmpPy], {
@@ -91700,10 +91875,10 @@ function validatePayload(name, files) {
 function diffSummary(currentDir, files) {
   const lines = [];
   const currentFiles = {};
-  if (existsSync90(currentDir)) {
+  if (existsSync91(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync33(sub, { withFileTypes: true })) {
-        const full = join88(sub, ent.name);
+        const full = join89(sub, ent.name);
         const rel = relative2(currentDir, full);
         if (ent.isDirectory()) {
           walk2(full);
@@ -91736,13 +91911,13 @@ function diffSummary(currentDir, files) {
 `);
 }
 function writePayload(poolDir, name, files) {
-  if (!existsSync90(poolDir)) {
+  if (!existsSync91(poolDir)) {
     mkdirSync50(poolDir, { recursive: true, mode: 493 });
   }
-  const target = join88(poolDir, name);
+  const target = join89(poolDir, name);
   let targetIsSymlink = false;
   try {
-    const st = lstatSync10(target);
+    const st = lstatSync11(target);
     if (st.isSymbolicLink()) {
       targetIsSymlink = true;
     }
@@ -91750,11 +91925,11 @@ function writePayload(poolDir, name, files) {
   if (targetIsSymlink) {
     fail3(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
-  const staging = mkdtempSync5(join88(poolDir, `.skill-apply-stage-${name}-`));
+  const staging = mkdtempSync5(join89(poolDir, `.skill-apply-stage-${name}-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join88(staging, path8);
+      const full = join89(staging, path8);
       mkdirSync50(dirname30(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
@@ -91769,7 +91944,7 @@ function writePayload(poolDir, name, files) {
     }
     let targetExists = false;
     try {
-      lstatSync10(target);
+      lstatSync11(target);
       targetExists = true;
     } catch {}
     if (targetExists) {
@@ -91785,9 +91960,9 @@ function writePayload(poolDir, name, files) {
     try {
       rmSync18(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync90(oldRename)) {
+    if (oldRename && existsSync91(oldRename)) {
       try {
-        if (existsSync90(target)) {
+        if (existsSync91(target)) {
           rmSync18(target, { recursive: true, force: true });
         }
         renameSync21(oldRename, target);
@@ -91808,10 +91983,10 @@ function registerSkillCommand(program3) {
       files = loadFromStdin();
     } else {
       const fromPath = resolve53(opts.from);
-      if (!existsSync90(fromPath)) {
+      if (!existsSync91(fromPath)) {
         fail3(`--from path does not exist: ${opts.from}`);
       }
-      const st = statSync48(fromPath);
+      const st = statSync49(fromPath);
       if (st.isDirectory()) {
         files = loadFromDir(fromPath);
       } else if (isTarballPath(fromPath)) {
@@ -91832,7 +92007,7 @@ function registerSkillCommand(program3) {
     }
     const config = loadConfig();
     const poolDir = resolveSkillsPoolDir2(config.switchroom?.skills_dir);
-    const currentDir = join88(poolDir, name);
+    const currentDir = join89(poolDir, name);
     console.log(source_default.bold(`Skill: ${name}`) + source_default.gray(` (${Object.keys(files).length} files, ${sumBytes(files)} bytes)`));
     console.log(source_default.bold("Diff vs current pool content:"));
     console.log(diffSummary(currentDir, files));
@@ -91864,8 +92039,8 @@ function sumBytes(files) {
 init_esm();
 import {
   closeSync as closeSync17,
-  existsSync as existsSync91,
-  lstatSync as lstatSync11,
+  existsSync as existsSync92,
+  lstatSync as lstatSync12,
   mkdirSync as mkdirSync51,
   mkdtempSync as mkdtempSync6,
   openSync as openSync17,
@@ -91873,11 +92048,11 @@ import {
   readdirSync as readdirSync34,
   renameSync as renameSync22,
   rmSync as rmSync19,
-  statSync as statSync49,
+  statSync as statSync50,
   utimesSync,
   writeFileSync as writeFileSync33
 } from "node:fs";
-import { dirname as dirname31, join as join89, relative as relative3, resolve as resolve54 } from "node:path";
+import { dirname as dirname31, join as join90, relative as relative3, resolve as resolve54 } from "node:path";
 import { homedir as homedir52, tmpdir as tmpdir6 } from "node:os";
 import { spawnSync as spawnSync17 } from "node:child_process";
 init_helpers();
@@ -91889,15 +92064,15 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve54(override) : join89(homedir52(), ".switchroom-config");
-  if (!existsSync91(candidate))
+  const candidate = override ? resolve54(override) : join90(homedir52(), ".switchroom-config");
+  if (!existsSync92(candidate))
     return null;
-  return join89(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
+  return join90(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
   try {
-    if (!existsSync91(configSkillsRoot))
+    if (!existsSync92(configSkillsRoot))
       return;
     const now = Date.now();
     for (const ent of readdirSync34(configSkillsRoot)) {
@@ -91910,7 +92085,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync19(join89(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync19(join90(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -91919,11 +92094,11 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   const configSkillsRoot = resolveConfigSkillsDir(agent);
   if (!configSkillsRoot)
     return;
-  const dest = join89(configSkillsRoot, name);
+  const dest = join90(configSkillsRoot, name);
   try {
     if (liveSkillDir !== null) {
       try {
-        const st = lstatSync11(liveSkillDir);
+        const st = lstatSync12(liveSkillDir);
         if (st.isSymbolicLink()) {
           process.stderr.write(source_default.yellow(`warning: refusing to mirror ${liveSkillDir} \u2014 source is a symlink
 `));
@@ -91933,20 +92108,20 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     }
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
-      if (existsSync91(dest)) {
-        const trash = join89(configSkillsRoot, `.${name}-trash-${Date.now()}`);
+      if (existsSync92(dest)) {
+        const trash = join90(configSkillsRoot, `.${name}-trash-${Date.now()}`);
         renameSync22(dest, trash);
       }
       return;
     }
     mkdirSync51(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
-    const staging = mkdtempSync6(join89(configSkillsRoot, `.${name}-staging-`));
+    const staging = mkdtempSync6(join90(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
       mkdirSync51(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync34(src, { withFileTypes: true })) {
-        const s = join89(src, ent.name);
-        const d = join89(dst, ent.name);
+        const s = join90(src, ent.name);
+        const d = join90(dst, ent.name);
         if (ent.isSymbolicLink())
           continue;
         if (ent.isDirectory())
@@ -91957,8 +92132,8 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
       }
     };
     walk2(liveSkillDir, staging);
-    if (existsSync91(dest)) {
-      const prior = join89(configSkillsRoot, `.${name}-prior-${Date.now()}`);
+    if (existsSync92(dest)) {
+      const prior = join90(configSkillsRoot, `.${name}-prior-${Date.now()}`);
       renameSync22(dest, prior);
     }
     renameSync22(staging, dest);
@@ -91988,17 +92163,17 @@ function resolveAgent(opts) {
 function resolveAgentsRoot(opts) {
   if (opts.root)
     return resolve54(opts.root);
-  return join89(homedir52(), ".switchroom", "agents");
+  return join90(homedir52(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
-  return join89(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
+  return join90(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
 }
 function trashDir(agentsRoot, agent) {
-  return join89(agentsRoot, agent, ".claude", TRASH_DIRNAME);
+  return join90(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
 function countPersonalSkills(agentsRoot, agent) {
-  const skillsDir = join89(agentsRoot, agent, ".claude", "skills");
-  if (!existsSync91(skillsDir))
+  const skillsDir = join90(agentsRoot, agent, ".claude", "skills");
+  if (!existsSync92(skillsDir))
     return 0;
   let n = 0;
   for (const ent of readdirSync34(skillsDir, { withFileTypes: true })) {
@@ -92029,13 +92204,13 @@ function readStdinSync2() {
 }
 function loadFromDir2(dir) {
   const abs = resolve54(dir);
-  if (!statSync49(abs).isDirectory()) {
+  if (!statSync50(abs).isDirectory()) {
     fail4(`--from path is not a directory: ${dir}`);
   }
   const files = {};
   const walk2 = (sub) => {
     for (const ent of readdirSync34(sub, { withFileTypes: true })) {
-      const full = join89(sub, ent.name);
+      const full = join90(sub, ent.name);
       if (ent.isSymbolicLink()) {
         fail4(`refusing to read symlink in --from dir: ${relative3(abs, full)}`);
       }
@@ -92088,8 +92263,8 @@ function behavioralValidate(files) {
         errors2.push(`${path8} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
     } else if (PY_SCRIPT_RE.test(path8)) {
-      const tmp = mkdtempSync6(join89(tmpdir6(), "skill-personal-py-"));
-      const tmpPy = join89(tmp, "check.py");
+      const tmp = mkdtempSync6(join90(tmpdir6(), "skill-personal-py-"));
+      const tmpPy = join90(tmp, "check.py");
       try {
         writeFileSync33(tmpPy, content);
         const r = spawnSync17("python3", ["-m", "py_compile", tmpPy], {
@@ -92107,15 +92282,15 @@ function behavioralValidate(files) {
 }
 function sweepTrash(agentsRoot, agent) {
   const trash = trashDir(agentsRoot, agent);
-  if (!existsSync91(trash))
+  if (!existsSync92(trash))
     return;
   const now = Date.now();
   for (const ent of readdirSync34(trash, { withFileTypes: true })) {
     if (!ent.isDirectory())
       continue;
-    const entPath = join89(trash, ent.name);
+    const entPath = join90(trash, ent.name);
     try {
-      const st = statSync49(entPath);
+      const st = statSync50(entPath);
       if (now - st.mtimeMs > TRASH_TTL_MS) {
         rmSync19(entPath, { recursive: true, force: true });
       }
@@ -92125,7 +92300,7 @@ function sweepTrash(agentsRoot, agent) {
 function writePersonalSkill(targetDir, files) {
   let targetIsSymlink = false;
   try {
-    const st = lstatSync11(targetDir);
+    const st = lstatSync12(targetDir);
     if (st.isSymbolicLink()) {
       targetIsSymlink = true;
     }
@@ -92134,11 +92309,11 @@ function writePersonalSkill(targetDir, files) {
     fail4(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
   mkdirSync51(dirname31(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join89(dirname31(targetDir), `.skill-personal-stage-`));
+  const staging = mkdtempSync6(join90(dirname31(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
-      const full = join89(staging, path8);
+      const full = join90(staging, path8);
       mkdirSync51(dirname31(full), { recursive: true, mode: 493 });
       const fd = openSync17(full, "wx");
       try {
@@ -92153,7 +92328,7 @@ function writePersonalSkill(targetDir, files) {
     }
     let targetExists = false;
     try {
-      lstatSync11(targetDir);
+      lstatSync12(targetDir);
       targetExists = true;
     } catch {}
     if (targetExists) {
@@ -92169,9 +92344,9 @@ function writePersonalSkill(targetDir, files) {
     try {
       rmSync19(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync91(oldRename)) {
+    if (oldRename && existsSync92(oldRename)) {
       try {
-        if (existsSync91(targetDir)) {
+        if (existsSync92(targetDir)) {
           rmSync19(targetDir, { recursive: true, force: true });
         }
         renameSync22(oldRename, targetDir);
@@ -92188,7 +92363,7 @@ function loadValidateWrite(agentsRoot, agent, name, files, ensureNew) {
   const target = personalSkillDir(agentsRoot, agent, name);
   const exists = (() => {
     try {
-      lstatSync11(target);
+      lstatSync12(target);
       return true;
     } catch {
       return false;
@@ -92237,10 +92412,10 @@ function loadFiles(opts) {
     return loadFromStdin2();
   }
   const p = resolve54(opts.from);
-  if (!existsSync91(p)) {
+  if (!existsSync92(p)) {
     fail4(`--from path does not exist: ${opts.from}`);
   }
-  const st = statSync49(p);
+  const st = statSync50(p);
   if (st.isDirectory()) {
     return loadFromDir2(p);
   }
@@ -92285,10 +92460,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join89(homedir52(), ".switchroom", "skills");
+  return join90(homedir52(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join89(homedir52(), ".switchroom", "skills", "_bundled");
+  return join90(homedir52(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -92298,11 +92473,11 @@ function resolveCloneSource(source, opts) {
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
-  const dir = join89(root, slug);
-  if (!existsSync91(dir)) {
+  const dir = join90(root, slug);
+  if (!existsSync92(dir)) {
     fail4(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
-  const st = lstatSync11(dir);
+  const st = lstatSync12(dir);
   if (st.isSymbolicLink()) {
     fail4(`clone source ${JSON.stringify(source)} is a symlink at ${dir}; ` + `point clone at the canonical pool path instead`);
   }
@@ -92314,7 +92489,7 @@ function readSourceFiles(dir) {
   const skipped = [];
   const walk2 = (sub) => {
     for (const ent of readdirSync34(sub, { withFileTypes: true })) {
-      const full = join89(sub, ent.name);
+      const full = join90(sub, ent.name);
       if (ent.isSymbolicLink()) {
         continue;
       }
@@ -92329,7 +92504,7 @@ function readSourceFiles(dir) {
           continue;
         }
         try {
-          const st = lstatSync11(full);
+          const st = lstatSync12(full);
           if (st.size > CLONE_MAX_FILE_BYTES) {
             fail4(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
           }
@@ -92411,7 +92586,7 @@ function removePersonalAction(name, opts) {
   }
   const target = personalSkillDir(agentsRoot, agent, name);
   try {
-    const st = lstatSync11(target);
+    const st = lstatSync12(target);
     if (st.isSymbolicLink()) {
       fail4(`refusing to remove symlink at ${target}; investigate manually`);
     }
@@ -92425,7 +92600,7 @@ function removePersonalAction(name, opts) {
   const trashRoot2 = trashDir(agentsRoot, agent);
   mkdirSync51(trashRoot2, { recursive: true, mode: 493 });
   const ts = Date.now();
-  const trashTarget = join89(trashRoot2, `${name}-${ts}`);
+  const trashTarget = join90(trashRoot2, `${name}-${ts}`);
   renameSync22(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
@@ -92444,16 +92619,16 @@ function listPersonalAction(opts) {
   const agent = resolveAgent(opts);
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
-  const skillsDir = join89(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join90(agentsRoot, agent, ".claude", "skills");
   const personal = [];
-  if (existsSync91(skillsDir)) {
+  if (existsSync92(skillsDir)) {
     for (const ent of readdirSync34(skillsDir, { withFileTypes: true })) {
       if (!ent.isDirectory())
         continue;
       if (!ent.name.startsWith(PERSONAL_PREFIX))
         continue;
       const skillName = ent.name.slice(PERSONAL_PREFIX.length);
-      const skillPath = join89(skillsDir, ent.name);
+      const skillPath = join90(skillsDir, ent.name);
       let fileCount = 0;
       let totalBytes = 0;
       const walk2 = (sub) => {
@@ -92461,10 +92636,10 @@ function listPersonalAction(opts) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync49(join89(sub, e.name)).size;
+              totalBytes += statSync50(join90(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
-            walk2(join89(sub, e.name));
+            walk2(join90(sub, e.name));
           }
         }
       };
@@ -92503,11 +92678,11 @@ function registerSkillPersonalCommands(program3) {
 // src/cli/self-improve-propose-skill.ts
 import { createConnection as createConnection4 } from "node:net";
 import { homedir as homedir53 } from "node:os";
-import { join as join90 } from "node:path";
+import { join as join91 } from "node:path";
 import { readFileSync as readFileSync79 } from "node:fs";
 var IPC_CONNECT_TIMEOUT_MS = 5000;
 function gatewaySocketPath() {
-  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join90(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join90(homedir53(), ".claude", "channels", "telegram", "gateway.sock"));
+  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join91(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join91(homedir53(), ".claude", "channels", "telegram", "gateway.sock"));
 }
 function fail5(msg, code = 1) {
   console.error(msg);
@@ -92579,9 +92754,9 @@ function registerSelfImproveProposeSkillCommand(program3) {
 init_esm();
 init_helpers();
 var import_yaml25 = __toESM(require_dist(), 1);
-import { existsSync as existsSync92, readdirSync as readdirSync35, readFileSync as readFileSync80, statSync as statSync50 } from "node:fs";
+import { existsSync as existsSync93, readdirSync as readdirSync35, readFileSync as readFileSync80, statSync as statSync51 } from "node:fs";
 import { homedir as homedir54 } from "node:os";
-import { join as join91, resolve as resolve55 } from "node:path";
+import { join as join92, resolve as resolve55 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
@@ -92595,8 +92770,8 @@ function defaultBundledRoot2() {
   return resolve55(homedir54(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join91(skillDir, "SKILL.md");
-  if (!existsSync92(mdPath))
+  const mdPath = join92(skillDir, "SKILL.md");
+  if (!existsSync93(mdPath))
     return null;
   let content;
   try {
@@ -92628,9 +92803,9 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join91(skillDir, "SKILL.md");
+  const mdPath = join92(skillDir, "SKILL.md");
   try {
-    const st = statSync50(mdPath);
+    const st = statSync51(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
   } catch {
     return null;
@@ -92639,8 +92814,8 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join91(agentsRoot, agent, ".claude/skills");
-  if (!existsSync92(skillsDir))
+  const skillsDir = join92(agentsRoot, agent, ".claude/skills");
+  if (!existsSync93(skillsDir))
     return [];
   const out = [];
   let entries;
@@ -92652,9 +92827,9 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join91(skillsDir, ent);
+    const dirPath = join92(skillsDir, ent);
     try {
-      if (!statSync50(dirPath).isDirectory())
+      if (!statSync51(dirPath).isDirectory())
         continue;
     } catch {
       continue;
@@ -92678,7 +92853,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   return out;
 }
 function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
-  if (!existsSync92(sharedRoot))
+  if (!existsSync93(sharedRoot))
     return [];
   const out = [];
   let entries;
@@ -92692,9 +92867,9 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join91(sharedRoot, ent);
+    const dirPath = join92(sharedRoot, ent);
     try {
-      if (!statSync50(dirPath).isDirectory())
+      if (!statSync51(dirPath).isDirectory())
         continue;
     } catch {
       continue;
@@ -92716,7 +92891,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
   return out;
 }
 function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
-  if (!existsSync92(bundledRoot))
+  if (!existsSync93(bundledRoot))
     return [];
   const out = [];
   let entries;
@@ -92728,9 +92903,9 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join91(bundledRoot, ent);
+    const dirPath = join92(bundledRoot, ent);
     try {
-      if (!statSync50(dirPath).isDirectory())
+      if (!statSync51(dirPath).isDirectory())
         continue;
     } catch {
       continue;
@@ -92874,18 +93049,18 @@ init_source();
 init_helpers();
 init_operator_uid();
 import {
-  existsSync as existsSync94,
+  existsSync as existsSync95,
   mkdirSync as mkdirSync52,
   readdirSync as readdirSync36,
   readFileSync as readFileSync82,
   writeFileSync as writeFileSync34,
-  statSync as statSync51,
-  lstatSync as lstatSync12,
+  statSync as statSync52,
+  lstatSync as lstatSync13,
   realpathSync as realpathSync8,
   copyFileSync as copyFileSync13
 } from "node:fs";
 import { homedir as homedir55 } from "node:os";
-import { join as join92 } from "node:path";
+import { join as join93 } from "node:path";
 import { spawnSync as spawnSync20 } from "node:child_process";
 
 // src/cli/singleton-stale-cleanup.ts
@@ -93234,10 +93409,10 @@ function resolveHostdHostHome(env2 = process.env, home2 = homedir55()) {
   return resolved;
 }
 function resolveHostdSkillsTarget(hostHome) {
-  const skillsPath = join92(hostHome, ".switchroom", "skills");
+  const skillsPath = join93(hostHome, ".switchroom", "skills");
   let st;
   try {
-    st = lstatSync12(skillsPath);
+    st = lstatSync13(skillsPath);
   } catch {
     return;
   }
@@ -93251,21 +93426,21 @@ function resolveHostdSkillsTarget(hostHome) {
     console.warn(`switchroom hostd install: ~/.switchroom/skills is a symlink whose target ` + `does not resolve (dangling) \u2014 skipping the skills bind mount. Bundled ` + `skills will be unavailable to rollout/update until the symlink is fixed.`);
     return;
   }
-  if (!existsSync94(target)) {
+  if (!existsSync95(target)) {
     console.warn(`switchroom hostd install: ~/.switchroom/skills resolves to "${target}", ` + `which does not exist \u2014 skipping the skills bind mount. Bundled skills ` + `will be unavailable to rollout/update until the symlink target exists.`);
     return;
   }
   return target;
 }
 function hostdDir() {
-  return join92(homedir55(), ".switchroom", "hostd");
+  return join93(homedir55(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join92(hostdDir(), "docker-compose.yml");
+  return join93(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
-  if (!existsSync94(p))
+  if (!existsSync95(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -93363,7 +93538,7 @@ function doStatus() {
   const composeYml = hostdComposePath();
   console.log(source_default.bold("switchroom-hostd"));
   console.log("");
-  if (!existsSync94(composeYml)) {
+  if (!existsSync95(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom hostd install` to set up."));
     return;
@@ -93384,15 +93559,15 @@ function doStatus() {
   } else {
     console.log(source_default.green(`  container:  ${ps.stdout.trim()}`));
   }
-  if (existsSync94(dir)) {
+  if (existsSync95(dir)) {
     const entries = [];
     try {
       for (const name of readdirSync36(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join92(dir, name, "sock");
-        if (existsSync94(sockPath)) {
-          const st = statSync51(sockPath);
+        const sockPath = join93(dir, name, "sock");
+        if (existsSync95(sockPath)) {
+          const st = statSync52(sockPath);
           if ((st.mode & 61440) === 49152) {
             entries.push(`${name} \u2192 ${sockPath}`);
           }
@@ -93410,7 +93585,7 @@ function doStatus() {
 }
 function doUninstall() {
   const composeYml = hostdComposePath();
-  if (!existsSync94(composeYml)) {
+  if (!existsSync95(composeYml)) {
     console.log(source_default.yellow("  No hostd install detected (no compose file at this path)."));
     return;
   }
@@ -93434,7 +93609,7 @@ function registerHostdCommand(program3) {
   hostd.command("uninstall").description("Stop the hostd container. Leaves the compose file in place for re-install.").action(() => doUninstall());
   hostd.command("audit").description("Tail and filter the hostd audit log (privileged-verb call history)").option("--tail <n>", "Number of matching entries to show (default: 50)", "50").option("--agent <name>", "Filter to a specific caller agent").option("--op <verb>", "Filter to a specific hostd verb (e.g. update_apply, agent_restart)").option("--error", "Show only failed (error/denied) entries").option("--verbose", "Show the captured stderr / error tail under each failed row").option("--path <file>", "Override audit log path (for debugging)").action((opts) => {
     const logPath = opts.path ?? defaultAuditLogPath2();
-    if (!existsSync94(logPath)) {
+    if (!existsSync95(logPath)) {
       console.error(source_default.yellow(`Audit log not found at ${logPath}.`) + source_default.gray(`
 The log is created when hostd handles its first privileged-verb request.`));
       return;
@@ -93482,9 +93657,9 @@ The log is created when hostd handles its first privileged-verb request.`));
 init_source();
 init_helpers();
 init_operator_uid();
-import { chownSync as chownSync9, existsSync as existsSync95, mkdirSync as mkdirSync53, writeFileSync as writeFileSync35, copyFileSync as copyFileSync14 } from "node:fs";
+import { chownSync as chownSync9, existsSync as existsSync96, mkdirSync as mkdirSync53, writeFileSync as writeFileSync35, copyFileSync as copyFileSync14 } from "node:fs";
 import { homedir as homedir56 } from "node:os";
-import { join as join93 } from "node:path";
+import { join as join94 } from "node:path";
 import { spawnSync as spawnSync21 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
@@ -93579,14 +93754,14 @@ services:
 `;
 }
 function webdDir() {
-  return join93(homedir56(), ".switchroom", "web");
+  return join94(homedir56(), ".switchroom", "web");
 }
 function webdComposePath() {
-  return join93(webdDir(), "docker-compose.yml");
+  return join94(webdDir(), "docker-compose.yml");
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
-  if (!existsSync95(p))
+  if (!existsSync96(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -93685,7 +93860,7 @@ function doStatus2() {
   const composeYml = webdComposePath();
   console.log(source_default.bold("switchroom-web"));
   console.log("");
-  if (!existsSync95(composeYml)) {
+  if (!existsSync96(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom webd install` to set up."));
     return;
@@ -93709,7 +93884,7 @@ function doStatus2() {
 }
 function doUninstall2() {
   const composeYml = webdComposePath();
-  if (!existsSync95(composeYml)) {
+  if (!existsSync96(composeYml)) {
     console.log(source_default.yellow("  No web-service install detected (no compose file at this path)."));
     return;
   }
@@ -93739,9 +93914,9 @@ function registerWebdCommand(program3) {
 // src/cli/host-repair.ts
 init_source();
 import { homedir as homedir57 } from "node:os";
-import { join as join94 } from "node:path";
+import { join as join95 } from "node:path";
 var ARTIFACT_ALLOWLIST = {
-  dockerComposePluginDir: (home2) => join94(home2, ".docker", "cli-plugins", "docker-compose"),
+  dockerComposePluginDir: (home2) => join95(home2, ".docker", "cli-plugins", "docker-compose"),
   stateSentinel: "/state"
 };
 function isStateBogusAutoDir(probe2) {
@@ -93895,11 +94070,11 @@ function applyMountRepairs(items, deps) {
 function registerHostCommand(program3) {
   const host = program3.command("host").description("Host-level maintenance operations for switchroom");
   host.command("repair-mounts").description("Detect and remove known auto-dir artifacts left by a container-context deploy " + "(2026-06-23 outage class). Default: dry-run. Pass --yes to apply.").option("--yes", "Actually perform the removals (default is dry-run)").action(async (opts) => {
-    const { rmdirSync: rmdirSync2, rmSync: rmSync20, lstatSync: lstatSync13, readdirSync: readdirSync37 } = await import("node:fs");
+    const { rmdirSync: rmdirSync2, rmSync: rmSync20, lstatSync: lstatSync14, readdirSync: readdirSync37 } = await import("node:fs");
     const probe2 = {
       lstat(path8) {
         try {
-          return lstatSync13(path8);
+          return lstatSync14(path8);
         } catch {
           return null;
         }