switchroom 0.18.3 → 0.18.7

package/dist/cli/switchroom.js

@@ -13741,6 +13741,7 @@ var init_schema = __esm(() => {
     max_turns_in_briefing: exports_external.number().int().positive().optional().describe("Cap on recent user/assistant turn pairs fed to the summarizer."),
     resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
     resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale."),
+    boot_resume: exports_external.enum(["always", "in-flight", "never"]).optional().describe("How the gateway auto-resumes a turn that was IN FLIGHT when the " + "agent restarted. 'in-flight' (default) resumes genuinely " + "interrupted work even after a deliberate/operator restart \u2014 a " + "sanctioned restart landing mid-turn no longer silently drops the " + "work. 'always' forces resume unconditionally (same as the " + "SWITCHROOM_BOOT_RESUME_ALWAYS=1 escape hatch). 'never' is the " + "quota-saving posture: don't auto-replay work across a clean " + "restart \u2014 but the user is STILL sent a passive notice of what was " + "in flight (silence is never used). Independent of the at-most-once " + "resume ledger and the bounded resume-chain loop-guard, which always " + "apply. Threaded to the gateway as SWITCHROOM_BOOT_RESUME."),
     session_retention_max_count: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): keep at most this many " + "newest session transcripts under .claude/projects; older ones " + "past both this count and the age bound are pruned by the Stop " + "hook. The newest sessions (and the handoff source) are always " + "kept. Default 20; set 0 to disable the count bound."),
     session_retention_max_age_days: exports_external.number().int().nonnegative().optional().describe("Session-JSONL retention (issue #2792): prune session transcripts " + "older than this many days (a file is deleted only when it is BOTH " + "over the count bound and older than this). Default 30; set 0 to " + "disable the age bound.")
   }).optional();
@@ -14205,7 +14206,8 @@ var init_schema = __esm(() => {
   UserSchema = exports_external.object({
     name: exports_external.string().optional().describe("Display name for the user."),
     telegram_ids: exports_external.array(exports_external.string()).min(1).describe("Telegram username(s) and/or numeric user id(s) identifying this user " + "(a leading @ is optional). Matched against the message sender for " + "per-speaker memory routing."),
-    profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`).")
+    profile_bank: exports_external.string().describe("Hindsight bank holding this user's memory profile (author via " + "`switchroom memory profile add <bank> ...`)."),
+    person_id: exports_external.string().optional().describe("Free-text display name projected into the inbound `<channel>` " + 'tag\'s `user` attribute (e.g. "Lisa") so an agent can greet by ' + "name instead of only seeing the raw Telegram id/username. NOT a " + "stable identity system \u2014 just a label. Resolution is boot-time-only " + "(no hot-reload; a config change needs an agent restart) and " + "chat-scoped (a resolved name is only shown in a chat/group the " + "person is actually a member of, per that chat's access.json " + "membership \u2014 never broadcast into every chat the agent operates " + "in). Keep this broadly safe to show, the same discipline as " + "picking a `profile_bank` name: there is no automated enforcement " + "that a `person_id` stays safe if a group's membership changes " + "later \u2014 see docs/configuration.md.")
   });
   SwitchroomConfigSchema = exports_external.object({
     switchroom: exports_external.object({
@@ -15177,6 +15179,16 @@ function resolveUsers(config, agentName) {
   ]);
   return { senderBanks, additionalBanks };
 }
+function resolvePersonEntries(config) {
+  const users = config.users ?? {};
+  const entries = [];
+  for (const [key, u] of Object.entries(users)) {
+    if (!u.person_id)
+      continue;
+    entries.push({ key, person_id: u.person_id, telegram_ids: u.telegram_ids });
+  }
+  return entries;
+}
 var init_users = __esm(() => {
   init_merge();
 });
@@ -26933,6 +26945,7 @@ ${baseAppend}` : TELEGRAM_FORMATTING_FLOOR_CARD;
     handoffEnabled: agentConfig.session_continuity?.enabled !== false,
     resumeMode: agentConfig.session_continuity?.resume_mode ?? "handoff",
     resumeMaxBytes: agentConfig.session_continuity?.resume_max_bytes ?? 2000000,
+    bootResumeMode: agentConfig.session_continuity?.boot_resume ?? "in-flight",
     resumeModeHasContinuePath: (() => {
       const mode = agentConfig.session_continuity?.resume_mode ?? "handoff";
       return mode === "auto" || mode === "continue";
@@ -27360,6 +27373,7 @@ This file is auto-maintained. Do not edit manually.
   }, created, skipped, 384);
   writeIfMissing(join10(agentDir, "telegram", "access.json"), () => buildAccessJson2(agentConfig, telegramConfig, topicId, userId), created, skipped, 384);
   reconcileConfiguredGroup(join10(agentDir, "telegram", "access.json"), agentConfig, telegramConfig);
+  writeFileSyncIfChanged(join10(agentDir, "telegram", "people.json"), buildPeopleJson(switchroomConfig), 384);
   if (agentConfig.subagents) {
     const agentsDir2 = join10(agentDir, ".claude", "agents");
     mkdirSync10(agentsDir2, { recursive: true });
@@ -28034,7 +28048,8 @@ ${baseAppend}` : TELEGRAM_FORMATTING_FLOOR_CARD;
       sessionMaxTurns: agentConfig.session?.max_turns,
       handoffEnabled: agentConfig.session_continuity?.enabled !== false,
       resumeMode: agentConfig.session_continuity?.resume_mode ?? "handoff",
-      resumeMaxBytes: agentConfig.session_continuity?.resume_max_bytes ?? 2000000
+      resumeMaxBytes: agentConfig.session_continuity?.resume_max_bytes ?? 2000000,
+      bootResumeMode: agentConfig.session_continuity?.boot_resume ?? "in-flight"
     };
     const beforeStartSh = existsSync15(startShPath) ? readFileSync13(startShPath, "utf-8") : "";
     const afterStartSh = renderTemplate(join10(basePath, "start.sh.hbs"), startShContext);
@@ -28582,6 +28597,11 @@ function reconcileConfiguredGroup(accessPath, agentConfig, telegramConfig) {
   renameSync4(tmp, accessPath);
   console.log(source_default.green(`  registered supergroup ${forumChatId} in access.json ` + `(responds to all topics; requireMention=false)`));
 }
+function buildPeopleJson(switchroomConfig) {
+  const entries = switchroomConfig ? resolvePersonEntries(switchroomConfig) : [];
+  return JSON.stringify({ entries }, null, 2) + `
+`;
+}
 function buildAccessJson2(agentConfig, telegramConfig, resolvedTopicId, userId) {
   const allowFrom = userId ? [String(userId)] : [];
   if (allowFrom.length === 0) {
@@ -30030,7 +30050,25 @@ import { chownSync as chownSync2 } from "node:fs";
 import { mkdir, readFile, writeFile, rename, copyFile } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
 import { basename as basename4, dirname as dirname6, join as join13 } from "node:path";
-async function resolveLiteLLMConfirmedAgents(config) {
+function agentHadLiteLLMRouting(composeContent, agentName) {
+  const lines = composeContent.split(`
+`);
+  const header = `  agent-${agentName}:`;
+  let i = lines.indexOf(header);
+  if (i < 0)
+    return false;
+  for (i = i + 1;i < lines.length; i++) {
+    const line = lines[i];
+    if (/^ {2}\S/.test(line))
+      break;
+    if (/^\S/.test(line))
+      break;
+    if (/^\s+SWITCHROOM_LITELLM:\s*"1"\s*$/.test(line))
+      return true;
+  }
+  return false;
+}
+async function resolveLiteLLMConfirmedAgents(config, previousCompose, deps) {
   const confirmed = new Set;
   const topEnabled = config.litellm?.enabled ?? false;
   const optedIn = [];
@@ -30045,16 +30083,52 @@ async function resolveLiteLLMConfirmedAgents(config) {
   }
   if (optedIn.length === 0)
     return confirmed;
-  try {
-    const { getViaBrokerStructured: getViaBrokerStructured2 } = await Promise.resolve().then(() => (init_client(), exports_client));
-    for (const name of optedIn) {
-      try {
-        const r = await getViaBrokerStructured2(`litellm/${name}/api-key`);
-        if (r.kind === "ok")
-          confirmed.add(name);
-      } catch {}
+  let getKey = deps?.getKey ?? null;
+  if (!getKey) {
+    try {
+      ({ getViaBrokerStructured: getKey } = await Promise.resolve().then(() => (init_client(), exports_client)));
+    } catch {
+      getKey = null;
     }
-  } catch {}
+  }
+  const unreachableAgents = [];
+  for (const name of optedIn) {
+    if (!getKey) {
+      unreachableAgents.push(name);
+      continue;
+    }
+    try {
+      const r = await getKey(`litellm/${name}/api-key`);
+      if (r.kind === "ok") {
+        confirmed.add(name);
+      } else if (r.kind === "unreachable") {
+        unreachableAgents.push(name);
+      } else if (r.kind === "denied" && r.code !== "DENIED") {
+        unreachableAgents.push(name);
+      }
+    } catch {
+      unreachableAgents.push(name);
+    }
+  }
+  if (unreachableAgents.length > 0) {
+    const preserved = [];
+    const couldNotPreserve = [];
+    for (const name of unreachableAgents) {
+      if (previousCompose && agentHadLiteLLMRouting(previousCompose, name)) {
+        confirmed.add(name);
+        preserved.push(name);
+      } else {
+        couldNotPreserve.push(name);
+      }
+    }
+    console.warn(`switchroom: vault-broker unreachable or unable to answer (locked/internal) while resolving LiteLLM key status for ${unreachableAgents.length} opted-in agent(s): ${unreachableAgents.join(", ")}. Refusing to silently strip proxy routing (that would boot them on untracked direct OAuth). Re-run \`switchroom apply\` once the broker is back to reconcile.`);
+    if (preserved.length > 0) {
+      console.warn(`switchroom: PRESERVED existing proxy routing from the on-disk compose for: ${preserved.join(", ")}.`);
+    }
+    if (couldNotPreserve.length > 0) {
+      console.warn(`switchroom: no prior routing verdict on disk for: ${couldNotPreserve.join(", ")} ` + `\u2014 leaving them unrouted (they were not previously routed).`);
+    }
+  }
   return confirmed;
 }
 function resolveHostSwitchroomConfigPath(rawPath) {
@@ -30092,7 +30166,13 @@ async function computeComposeContent(opts) {
   const imageTag = resolveImageTag(release);
   const operatorUid = resolveOperatorUid();
   const resolvedConfigPath = opts.switchroomConfigPath !== undefined ? resolveHostSwitchroomConfigPath(opts.switchroomConfigPath) : undefined;
-  const litellmConfirmedAgents = await resolveLiteLLMConfirmedAgents(opts.config);
+  let previous = null;
+  try {
+    previous = await readFile(opts.composePath, "utf8");
+  } catch {
+    previous = null;
+  }
+  const litellmConfirmedAgents = await resolveLiteLLMConfirmedAgents(opts.config, previous);
   const content = generateCompose({
     config: opts.config,
     imageTag,
@@ -30104,12 +30184,6 @@ async function computeComposeContent(opts) {
     switchroomConfigPath: resolvedConfigPath,
     operatorUid
   });
-  let previous = null;
-  try {
-    previous = await readFile(opts.composePath, "utf8");
-  } catch {
-    previous = null;
-  }
   const previousImageTag = previous ? AGENT_IMAGE_TAG_RE.exec(previous)?.[1] ?? null : null;
   return { content, imageTag, previous, previousImageTag };
 }
@@ -35505,7 +35579,7 @@ function formatForCli(entries, opts = {}) {
 var init_audit_reader = () => {};
 
 // node_modules/.bun/posthog-node@5.29.2/node_modules/posthog-node/dist/extensions/error-tracking/modifiers/module.node.mjs
-import { dirname as dirname12, posix, sep as sep2 } from "path";
+import { dirname as dirname13, posix, sep as sep2 } from "path";
 function createModulerModifier() {
   const getModuleFromFileName = createGetModuleFromFilename();
   return async (frames) => {
@@ -35514,7 +35588,7 @@ function createModulerModifier() {
     return frames;
   };
 }
-function createGetModuleFromFilename(basePath = process.argv[1] ? dirname12(process.argv[1]) : process.cwd(), isWindows = sep2 === "\\") {
+function createGetModuleFromFilename(basePath = process.argv[1] ? dirname13(process.argv[1]) : process.cwd(), isWindows = sep2 === "\\") {
   const normalizedBase = isWindows ? normalizeWindowsPath(basePath) : basePath;
   return (filename) => {
     if (!filename)
@@ -40130,7 +40204,7 @@ import {
   readFileSync as readFileSync43,
   writeFileSync as writeFileSync23
 } from "node:fs";
-import { dirname as dirname13 } from "node:path";
+import { dirname as dirname14 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function telemetryDisabled() {
   const v = process.env.SWITCHROOM_TELEMETRY_DISABLED;
@@ -40152,7 +40226,7 @@ function getDistinctId() {
   const id = randomUUID3();
   cachedDistinctId = id;
   try {
-    mkdirSync26(dirname13(path4), { recursive: true });
+    mkdirSync26(dirname14(path4), { recursive: true });
     writeFileSync23(path4, id, "utf-8");
   } catch {}
   return id;
@@ -40399,7 +40473,7 @@ import {
   readFileSync as readFileSync52,
   readdirSync as readdirSync19
 } from "node:fs";
-import { dirname as dirname16, join as join50 } from "node:path";
+import { dirname as dirname17, join as join50 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
 function locateManifestPath() {
   let dir = import.meta.dirname;
@@ -40407,7 +40481,7 @@ function locateManifestPath() {
     const candidate = join50(dir, "dependencies.json");
     if (existsSync57(candidate))
       return candidate;
-    dir = dirname16(dir);
+    dir = dirname17(dir);
   }
   return null;
 }
@@ -43578,7 +43652,7 @@ import {
   readdirSync as readdirSync21,
   statSync as statSync26
 } from "node:fs";
-import { dirname as dirname17, join as join62, resolve as resolve37 } from "node:path";
+import { dirname as dirname18, join as join62, resolve as resolve37 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
   const nvmRoot = join62(process.env.HOME ?? "", ".nvm", "versions", "node");
@@ -45060,7 +45134,7 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
       detail: "skipped (MFF_API_URL not set)"
     };
   }
-  const credDir = dirname17(envPath);
+  const credDir = dirname18(envPath);
   const authScript = join62(credDir, "claude-auth.py");
   if (!existsSync62(authScript)) {
     return {
@@ -48866,6 +48940,7 @@ var init_install_detect = () => {};
 // src/litellm/provision.ts
 var exports_provision = {};
 __export(exports_provision, {
+  validateKey: () => validateKey,
   ensureTeam: () => ensureTeam,
   ensureKey: () => ensureKey,
   LiteLLMProvisionError: () => LiteLLMProvisionError
@@ -48887,6 +48962,12 @@ function looksLikeAlreadyExists(status, body) {
     return true;
   return false;
 }
+function looksLikeUnknownKey(status, body) {
+  if (status !== 400 && status !== 401 && status !== 403 && status !== 404)
+    return false;
+  const t = body.toLowerCase();
+  return t.includes("not found") || t.includes("does not exist") || t.includes("no such key") || t.includes("no key found");
+}
 async function ensureTeam(baseUrl, masterKey, teamName, fetchFn = fetch) {
   const url = `${normalizeBase(baseUrl)}/team/new`;
   let resp;
@@ -48906,7 +48987,7 @@ async function ensureTeam(baseUrl, masterKey, teamName, fetchFn = fetch) {
     return;
   throw new LiteLLMProvisionError(`LiteLLM /team/new returned ${resp.status}`, resp.status, body);
 }
-async function ensureKey(opts, fetchFn = fetch) {
+async function generateKeyOnce(opts, fetchFn) {
   const url = `${normalizeBase(opts.baseUrl)}/key/generate`;
   const payload = {
     key_alias: opts.alias
@@ -48926,23 +49007,129 @@ async function ensureKey(opts, fetchFn = fetch) {
       body: JSON.stringify(payload)
     });
   } catch (err) {
-    throw new LiteLLMProvisionError(`LiteLLM /key/generate request failed: ${err.message}`);
+    return {
+      kind: "error",
+      error: new LiteLLMProvisionError(`LiteLLM /key/generate request failed: ${err.message}`)
+    };
   }
   if (!resp.ok) {
     const body = await safeText(resp);
-    throw new LiteLLMProvisionError(`LiteLLM /key/generate returned ${resp.status}`, resp.status, body);
+    if (looksLikeAlreadyExists(resp.status, body)) {
+      return { kind: "duplicate-alias", status: resp.status, body };
+    }
+    return {
+      kind: "error",
+      error: new LiteLLMProvisionError(`LiteLLM /key/generate returned ${resp.status}`, resp.status, body)
+    };
   }
   let json;
   try {
     json = await resp.json();
   } catch (err) {
-    throw new LiteLLMProvisionError(`LiteLLM /key/generate returned non-JSON body: ${err.message}`, resp.status);
+    return {
+      kind: "error",
+      error: new LiteLLMProvisionError(`LiteLLM /key/generate returned non-JSON body: ${err.message}`, resp.status)
+    };
   }
   const key = json?.key;
   if (typeof key !== "string" || key.length === 0) {
-    throw new LiteLLMProvisionError(`LiteLLM /key/generate response missing a "key" field`, resp.status, JSON.stringify(json));
+    return {
+      kind: "error",
+      error: new LiteLLMProvisionError(`LiteLLM /key/generate response missing a "key" field`, resp.status, JSON.stringify(json))
+    };
   }
-  return { key };
+  return { kind: "ok", key };
+}
+async function resolveTokensForAlias(baseUrl, masterKey, alias, fetchFn) {
+  const url = `${normalizeBase(baseUrl)}/key/list?key_alias=${encodeURIComponent(alias)}` + `&return_full_object=true&include_team_keys=true`;
+  let resp;
+  try {
+    resp = await fetchFn(url, { method: "GET", headers: authHeaders3(masterKey) });
+  } catch {
+    return [];
+  }
+  if (!resp.ok)
+    return [];
+  let json;
+  try {
+    json = await resp.json();
+  } catch {
+    return [];
+  }
+  const keys = json?.keys;
+  if (!Array.isArray(keys))
+    return [];
+  const tokens = [];
+  for (const k of keys) {
+    if (typeof k === "string" && k.length > 0)
+      tokens.push(k);
+    else if (k && typeof k === "object") {
+      const tok = k.token;
+      const raw = k.key;
+      if (typeof tok === "string" && tok.length > 0)
+        tokens.push(tok);
+      else if (typeof raw === "string" && raw.length > 0)
+        tokens.push(raw);
+    }
+  }
+  return tokens;
+}
+async function deleteOrphanedAlias(opts, fetchFn, log) {
+  const tokens = await resolveTokensForAlias(opts.baseUrl, opts.masterKey, opts.alias, fetchFn);
+  const body = { key_aliases: [opts.alias] };
+  if (tokens.length > 0)
+    body.keys = tokens;
+  const manual = `Manual remediation: delete the key with alias '${opts.alias}' in the LiteLLM ` + `admin UI, or run ` + `\`curl -X POST "${normalizeBase(opts.baseUrl)}/key/delete" -H "Authorization: Bearer <master-key>" ` + `-H "content-type: application/json" -d '{"key_aliases":["${opts.alias}"]}'\`, ` + `then re-run \`switchroom apply\`.`;
+  const url = `${normalizeBase(opts.baseUrl)}/key/delete`;
+  let resp;
+  try {
+    resp = await fetchFn(url, {
+      method: "POST",
+      headers: authHeaders3(opts.masterKey),
+      body: JSON.stringify(body)
+    });
+  } catch (err) {
+    throw new LiteLLMProvisionError(`LiteLLM /key/delete request failed while recovering orphaned alias ` + `'${opts.alias}': ${err.message}. ${manual}`);
+  }
+  if (!resp.ok) {
+    const errBody = await safeText(resp);
+    throw new LiteLLMProvisionError(`LiteLLM /key/delete returned ${resp.status} while recovering orphaned ` + `alias '${opts.alias}'. ${manual}`, resp.status, errBody);
+  }
+  log(`litellm: deleted orphaned key(s) for alias '${opts.alias}'` + (tokens.length > 0 ? ` (${tokens.length} token(s) resolved)` : "") + ` \u2014 regenerating`);
+}
+async function ensureKey(opts, fetchFn = fetch) {
+  const log = opts.log ?? (() => {});
+  const first = await generateKeyOnce(opts, fetchFn);
+  if (first.kind === "ok")
+    return { key: first.key };
+  if (first.kind === "error")
+    throw first.error;
+  log(`litellm: key_alias '${opts.alias}' already exists in LiteLLM but the vault ` + `has no recoverable key (orphaned by a prior failed provision) \u2014 ` + `self-healing: deleting the orphan and regenerating`);
+  await deleteOrphanedAlias(opts, fetchFn, log);
+  const second = await generateKeyOnce(opts, fetchFn);
+  if (second.kind === "ok") {
+    log(`litellm: regenerated key for alias '${opts.alias}' after orphan recovery`);
+    return { key: second.key };
+  }
+  if (second.kind === "duplicate-alias") {
+    throw new LiteLLMProvisionError(`LiteLLM /key/generate still reports alias '${opts.alias}' already exists ` + `after deleting the orphan \u2014 the delete did not take effect. Manual ` + `remediation: remove the key with alias '${opts.alias}' via the LiteLLM ` + `admin UI (or POST /key/delete {"key_aliases":["${opts.alias}"]}) then ` + `re-run \`switchroom apply\`.`, second.status, second.body);
+  }
+  throw second.error;
+}
+async function validateKey(opts, fetchFn = fetch) {
+  const url = `${normalizeBase(opts.baseUrl)}/key/info?key=${encodeURIComponent(opts.key)}`;
+  let resp;
+  try {
+    resp = await fetchFn(url, { method: "GET", headers: authHeaders3(opts.masterKey) });
+  } catch (err) {
+    return { kind: "unreachable", detail: err.message };
+  }
+  if (resp.ok)
+    return { kind: "valid" };
+  const body = await safeText(resp);
+  if (looksLikeUnknownKey(resp.status, body))
+    return { kind: "unknown" };
+  return { kind: "unreachable", detail: `HTTP ${resp.status}: ${body.slice(0, 200)}` };
 }
 async function safeText(resp) {
   try {
@@ -48983,7 +49170,7 @@ __export(exports_voice_sidecar_token, {
 });
 import { randomBytes as randomBytes14 } from "node:crypto";
 import { chmodSync as chmodSync11, chownSync as chownSync7, existsSync as existsSync81, mkdirSync as mkdirSync45, readFileSync as readFileSync68, rmSync as rmSync17, writeFileSync as writeFileSync37 } from "node:fs";
-import { dirname as dirname26 } from "node:path";
+import { dirname as dirname27 } from "node:path";
 async function defaultResolveOrSeedToken(home2, writeErr) {
   const [{ getViaBrokerStructured: getViaBrokerStructured2, putViaBroker: putViaBroker2 }, { resolveOperatorVaultPassphrase }] = await Promise.all([
     Promise.resolve().then(() => (init_client(), exports_client)),
@@ -49037,7 +49224,7 @@ async function provisionVoiceSidecarToken(composePath, home2, ctx) {
   if (!token)
     return;
   try {
-    mkdirSync45(dirname26(envPath), { recursive: true });
+    mkdirSync45(dirname27(envPath), { recursive: true });
     let body = "";
     try {
       if (existsSync81(envPath))
@@ -49099,11 +49286,11 @@ __export(exports_apply, {
   DEFAULT_COMPOSE_PATH: () => DEFAULT_COMPOSE_PATH2,
   COMPOSE_PROJECT: () => COMPOSE_PROJECT2
 });
-import { accessSync as accessSync3, chownSync as chownSync8, constants as fsConstants6, copyFileSync as copyFileSync11, existsSync as existsSync82, mkdirSync as mkdirSync46, readFileSync as readFileSync69, readdirSync as readdirSync28, renameSync as renameSync18, writeFileSync as writeFileSync38 } from "node:fs";
+import { accessSync as accessSync3, chownSync as chownSync8, constants as fsConstants6, copyFileSync as copyFileSync12, existsSync as existsSync82, mkdirSync as mkdirSync46, readFileSync as readFileSync69, readdirSync as readdirSync28, renameSync as renameSync18, writeFileSync as writeFileSync38 } from "node:fs";
 import { mkdir as mkdir2 } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
-import { dirname as dirname27, join as join80, resolve as resolve50 } from "node:path";
+import { dirname as dirname28, join as join80, resolve as resolve50 } from "node:path";
 import { homedir as homedir47 } from "node:os";
 import { execFileSync as execFileSync25 } from "node:child_process";
 function effectiveLiteLLMEnabled(config, agentResolvedLitellm) {
@@ -49137,7 +49324,7 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
   const needsHindsight = config.litellm?.enabled === true && config.memory?.backend === "hindsight";
   if (optedIn.length === 0 && !needsHindsight)
     return;
-  const [{ getViaBrokerStructured: getViaBrokerStructured2, putViaBroker: putViaBroker2 }, { ensureTeam: ensureTeam2, ensureKey: ensureKey2 }, { addAgentSecret: addAgentSecret2 }] = await Promise.all([
+  const [{ getViaBrokerStructured: getViaBrokerStructured2, putViaBroker: putViaBroker2 }, { ensureTeam: ensureTeam2, ensureKey: ensureKey2, validateKey: validateKey2 }, { addAgentSecret: addAgentSecret2 }] = await Promise.all([
     Promise.resolve().then(() => (init_client(), exports_client)),
     Promise.resolve().then(() => (init_provision(), exports_provision)),
     Promise.resolve().then(() => (init_telegram_yaml(), exports_telegram_yaml))
@@ -49159,7 +49346,21 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
         unprovisionedNew.push(name);
       }
     }
-    const hindsightPending = needsHindsight;
+    let hindsightPending = false;
+    if (needsHindsight) {
+      const h = await getViaBrokerStructured3("litellm/hindsight/api-key");
+      if (h.kind === "ok") {
+        hindsightPending = false;
+        writeOut(source_default.gray(`  ~ litellm/hindsight: key already provisioned (skipped) \u2014 unaffected by missing passphrase.
+`));
+      } else if (h.kind === "unreachable") {
+        hindsightPending = false;
+        ctx.writeErr(source_default.yellow(`  ! litellm/hindsight: vault-broker unreachable \u2014 could not verify the ` + `service key; it keeps its previous state.
+`));
+      } else {
+        hindsightPending = true;
+      }
+    }
     if (alreadyProvisioned.length > 0) {
       writeOut(source_default.gray(`  ~ litellm: ${alreadyProvisioned.length} agent(s) already provisioned (${alreadyProvisioned.join(", ")}) \u2014 unaffected by missing passphrase.
 `));
@@ -49210,43 +49411,62 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
         continue;
       }
       const vaultKey = `litellm/${name}/api-key`;
+      const alias = `agent:${name}`;
       const existing = await getViaBrokerStructured2(vaultKey);
-      if (existing.kind === "ok") {
-        writeOut(source_default.gray(`  ~ litellm/${name}: key already provisioned (skipped)
-`));
-        if (configText !== null) {
-          const after = addAgentSecret2(configText, name, vaultKey);
-          if (after !== configText) {
-            configText = after;
-            pendingConfigEdits = true;
-          }
-        }
-        continue;
-      }
       if (existing.kind === "unreachable") {
         ctx.writeErr(source_default.yellow(`  ! litellm/${name}: vault-broker unreachable (${existing.msg ?? "no detail"}) \u2014 ` + `skipping key provisioning; agent keeps its previous routing env.
 `));
         continue;
       }
       let masterKey = adminKeyRef;
+      let masterKeyErr = null;
       if (isVaultReference(adminKeyRef)) {
         const refKey = parseVaultReference(adminKeyRef);
         const resolved = await getViaBrokerStructured2(refKey);
         if (resolved.kind !== "ok") {
-          failures.push({
-            agent: name,
-            message: `litellm: admin_key vault ref '${adminKeyRef}' did not resolve (${resolved.kind}${"msg" in resolved && resolved.msg ? `: ${resolved.msg}` : ""}).`
-          });
-          continue;
+          masterKey = null;
+          masterKeyErr = `litellm: admin_key vault ref '${adminKeyRef}' did not resolve (${resolved.kind}${"msg" in resolved && resolved.msg ? `: ${resolved.msg}` : ""}).`;
+        } else if (resolved.entry.kind !== "string") {
+          masterKey = null;
+          masterKeyErr = `litellm: admin_key vault ref '${adminKeyRef}' is not a string secret.`;
+        } else {
+          masterKey = resolved.entry.value;
         }
-        if (resolved.entry.kind !== "string") {
-          failures.push({
-            agent: name,
-            message: `litellm: admin_key vault ref '${adminKeyRef}' is not a string secret.`
-          });
+      }
+      if (existing.kind === "ok") {
+        const storedKey = existing.entry.kind === "string" ? existing.entry.value : null;
+        let driftReprovision = false;
+        if (storedKey && masterKey) {
+          const validation = await validateKey2({ baseUrl, masterKey, key: storedKey });
+          if (validation.kind === "unknown") {
+            driftReprovision = true;
+            ctx.writeErr(source_default.yellow(`  ! litellm/${name}: stored virtual key not recognized by the proxy ` + `(DB drift) \u2014 re-provisioning a fresh key.
+`));
+          } else if (validation.kind === "unreachable") {
+            ctx.writeErr(source_default.yellow(`  ! litellm/${name}: proxy unreachable during key validation (${validation.detail}) \u2014 keeping the stored key unverified.
+`));
+          } else {
+            writeOut(source_default.gray(`  ~ litellm/${name}: key already provisioned + validated (skipped)
+`));
+          }
+        } else {
+          writeOut(source_default.gray(`  ~ litellm/${name}: key already provisioned (skipped)
+`));
+        }
+        if (!driftReprovision) {
+          if (configText !== null) {
+            const after = addAgentSecret2(configText, name, vaultKey);
+            if (after !== configText) {
+              configText = after;
+              pendingConfigEdits = true;
+            }
+          }
           continue;
         }
-        masterKey = resolved.entry.value;
+      }
+      if (!masterKey) {
+        failures.push({ agent: name, message: masterKeyErr ?? `litellm: admin_key unresolved` });
+        continue;
       }
       await ensureTeam2(baseUrl, masterKey, team);
       const metadata = {
@@ -49264,9 +49484,11 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
       const { key } = await ensureKey2({
         baseUrl,
         masterKey,
-        alias: `agent:${name}`,
+        alias,
         team,
-        metadata
+        metadata,
+        log: (m) => ctx.writeErr(source_default.gray(`  ~ litellm/${name}: ${m}
+`))
       });
       const put = await putViaBroker2(vaultKey, { kind: "string", value: key }, { passphrase });
       if (put.kind !== "ok") {
@@ -49328,7 +49550,9 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
             masterKey,
             alias: "service:hindsight",
             team,
-            metadata: { service: "hindsight", env: "fleet", ...oauthAccount ? { oauth_account: oauthAccount } : {} }
+            metadata: { service: "hindsight", env: "fleet", ...oauthAccount ? { oauth_account: oauthAccount } : {} },
+            log: (m) => ctx.writeErr(source_default.gray(`  ~ litellm/hindsight: ${m}
+`))
           });
           const put = await putViaBroker2(hindsightVaultKey, { kind: "string", value: key }, { passphrase });
           if (put.kind === "ok") {
@@ -49348,7 +49572,7 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
 function resolveVaultBindMountDir(homeDir, ctx) {
   const isCustomPath = ctx.migrationKind === "custom-path-skipped";
   if (isCustomPath && ctx.customVaultPath) {
-    return dirname27(ctx.customVaultPath);
+    return dirname28(ctx.customVaultPath);
   }
   return join80(homeDir, ".switchroom", "vault");
 }
@@ -50003,7 +50227,7 @@ function copyExampleConfig2(name) {
   if (!existsSync82(exampleFile)) {
     throw new Error(`Example config not found: ${name}.yaml (available: ${Object.keys(EMBEDDED_EXAMPLES).join(", ")})`);
   }
-  copyFileSync11(exampleFile, dest);
+  copyFileSync12(exampleFile, dest);
   console.log(source_default.green(`Copied ${name}.yaml -> switchroom.yaml`));
 }
 function findUnwritableAgentDirs(config, opts) {
@@ -64550,7 +64774,7 @@ import {
   mkdirSync as mkdirSync53,
   writeFileSync as writeFileSync44
 } from "node:fs";
-import { resolve as resolve55, dirname as dirname30 } from "node:path";
+import { resolve as resolve55, dirname as dirname31 } from "node:path";
 import { homedir as homedir56 } from "node:os";
 function resolveSwitchroomBase(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir56()) {
   return resolve55(home2, ".switchroom");
@@ -64641,11 +64865,11 @@ function readLedgerIfPresent(base) {
   }
 }
 function ledgerPathForBase(base) {
-  return fleetHealthLedgerPath(dirname30(base));
+  return fleetHealthLedgerPath(dirname31(base));
 }
 function writeLedger(base, ledger) {
   const path8 = ledgerPathForBase(base);
-  mkdirSync53(dirname30(path8), { recursive: true });
+  mkdirSync53(dirname31(path8), { recursive: true });
   writeFileSync44(path8, JSON.stringify(ledger, null, 2) + `
 `, "utf-8");
   return path8;
@@ -64665,8 +64889,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.18.3";
-var COMMIT_SHA = "dbd8b112";
+var VERSION = "0.18.7";
+var COMMIT_SHA = "21478348";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
@@ -71499,7 +71723,7 @@ init_acl();
 init_protocol();
 import * as net3 from "node:net";
 import { mkdirSync as mkdirSync24, chmodSync as chmodSync7, chownSync as chownSync4, existsSync as existsSync41, readFileSync as readFileSync34, readdirSync as readdirSync17, statSync as statSync21, unlinkSync as unlinkSync10, writeFileSync as writeFileSync18, renameSync as renameSync13 } from "node:fs";
-import { dirname as dirname11, resolve as resolve28, basename as basename7 } from "node:path";
+import { dirname as dirname12, resolve as resolve28, basename as basename7 } from "node:path";
 import * as os4 from "node:os";
 import * as path3 from "node:path";
 
@@ -71592,10 +71816,38 @@ function rotateAuditLog(logPath, maxFiles) {
       return;
     }
   }
+  const snapshotPath = `${logPath}.1`;
   try {
-    fs2.renameSync(logPath, `${logPath}.1`);
+    fs2.copyFileSync(logPath, snapshotPath);
   } catch (err) {
-    process.stderr.write(`[vault-audit] ERROR: could not rotate active audit log ${logPath}: ${err.message}
+    process.stderr.write(`[vault-audit] ERROR: could not snapshot active audit log ${logPath} \u2192 ${snapshotPath}: ${err.message}
+`);
+    return;
+  }
+  try {
+    const fd = fs2.openSync(snapshotPath, "r");
+    try {
+      fs2.fsyncSync(fd);
+    } finally {
+      fs2.closeSync(fd);
+    }
+  } catch (err) {
+    process.stderr.write(`[vault-audit] ERROR: could not fsync audit snapshot ${snapshotPath}; leaving active log intact to avoid data loss: ${err.message}
+`);
+    return;
+  }
+  try {
+    const dirFd = fs2.openSync(path.dirname(snapshotPath), "r");
+    try {
+      fs2.fsyncSync(dirFd);
+    } finally {
+      fs2.closeSync(dirFd);
+    }
+  } catch {}
+  try {
+    fs2.truncateSync(logPath, 0);
+  } catch (err) {
+    process.stderr.write(`[vault-audit] ERROR: could not truncate active audit log ${logPath}: ${err.message}
 `);
   }
 }
@@ -74004,7 +74256,7 @@ class VaultBroker {
       this.passphrase = this.testOpts._testPassphrase;
     }
     process.umask(63);
-    const parentDir = dirname11(this.socketPath);
+    const parentDir = dirname12(this.socketPath);
     mkdirSync24(parentDir, { recursive: true, mode: 448 });
     try {
       chmodSync7(parentDir, 448);
@@ -75485,15 +75737,15 @@ class VaultBroker {
   }
 }
 function detectVaultLayoutDrift(vaultPath) {
-  const dir = dirname11(vaultPath);
+  const dir = dirname12(vaultPath);
   if (basename7(dir) !== "vault")
     return;
   if (basename7(vaultPath) !== "vault.enc")
     return;
-  const switchroomDir = dirname11(dir);
+  const switchroomDir = dirname12(dir);
   if (basename7(switchroomDir) !== ".switchroom")
     return;
-  const home2 = dirname11(switchroomDir);
+  const home2 = dirname12(switchroomDir);
   const result = inspectVaultLayout(home2);
   if (result.kind === "divergent") {
     throw new VaultError(`Vault layout divergence detected at boot: ${result.details.oldPath} and ${result.details.newPath} are both regular files with different content. An older switchroom CLI may have written to the legacy path after migration ran. Run \`switchroom apply\` from the host to surface the recovery recipe (state E refusal with literal \`mv\` commands). See docs/operators/state-e-recovery.md.`);
@@ -76525,7 +76777,7 @@ import {
   appendFileSync as appendFileSync3,
   closeSync as closeSync10,
   existsSync as existsSync45,
-  fsyncSync as fsyncSync6,
+  fsyncSync as fsyncSync7,
   mkdirSync as mkdirSync25,
   openSync as openSync10,
   readdirSync as readdirSync18,
@@ -76672,7 +76924,7 @@ function backupVault(opts) {
   const fd = openSync10(tmpPath, "wx", 384);
   try {
     writeSync7(fd, src);
-    fsyncSync6(fd);
+    fsyncSync7(fd);
   } finally {
     closeSync10(fd);
   }
@@ -76703,7 +76955,7 @@ function backupVault(opts) {
   try {
     const dirFd = openSync10(opts.destDir, "r");
     try {
-      fsyncSync6(dirFd);
+      fsyncSync7(dirFd);
     } finally {
       closeSync10(dirFd);
     }
@@ -76719,7 +76971,7 @@ function backupVault(opts) {
     try {
       const dirFd = openSync10(opts.destDir, "r");
       try {
-        fsyncSync6(dirFd);
+        fsyncSync7(dirFd);
       } finally {
         closeSync10(dirFd);
       }
@@ -78889,7 +79141,7 @@ import {
   writeSync as writeSync8,
   constants as fsConstants3
 } from "node:fs";
-import { resolve as resolve32, extname, join as join49, relative, dirname as dirname14 } from "node:path";
+import { resolve as resolve32, extname, join as join49, relative, dirname as dirname15 } from "node:path";
 import { homedir as homedir27 } from "node:os";
 import { timingSafeEqual as timingSafeEqual3, randomBytes as randomBytes11 } from "node:crypto";
 
@@ -79509,7 +79761,8 @@ var SUBAGENTS_SCHEMA_SQL = `
     status            TEXT    NOT NULL,
     result_summary    TEXT,
     jsonl_agent_id    TEXT,
-    parent_agent_id   TEXT
+    parent_agent_id   TEXT,
+    model             TEXT
   );
   CREATE INDEX IF NOT EXISTS subagents_turn      ON subagents(parent_turn_key);
   CREATE INDEX IF NOT EXISTS subagents_status    ON subagents(status);
@@ -79525,6 +79778,10 @@ function applySubagentsSchema(db) {
   if (!hasParentAgentId) {
     db.exec("ALTER TABLE subagents ADD COLUMN parent_agent_id TEXT");
   }
+  const hasModel = cols.some((c) => c.name === "model");
+  if (!hasModel) {
+    db.exec("ALTER TABLE subagents ADD COLUMN model TEXT");
+  }
   db.exec("CREATE INDEX IF NOT EXISTS subagents_jsonl_id ON subagents(jsonl_agent_id)");
 }
 function mapSubagentRow(row) {
@@ -79541,7 +79798,8 @@ function mapSubagentRow(row) {
     status: row.status,
     result_summary: row.result_summary,
     jsonl_agent_id: row.jsonl_agent_id,
-    parent_agent_id: row.parent_agent_id ?? null
+    parent_agent_id: row.parent_agent_id ?? null,
+    model: row.model ?? null
   };
 }
 function listSubagents(db, opts = {}) {
@@ -82165,7 +82423,7 @@ function resolveWebToken() {
       return existing;
   }
   const token = randomBytes11(32).toString("hex");
-  mkdirSync30(dirname14(tokenPath), { recursive: true, mode: 448 });
+  mkdirSync30(dirname15(tokenPath), { recursive: true, mode: 448 });
   try {
     const fd = openSync11(tokenPath, fsConstants3.O_WRONLY | fsConstants3.O_CREAT | fsConstants3.O_EXCL, 384);
     try {
@@ -82923,8 +83181,8 @@ Starting Switchroom dashboard...
 init_source();
 init_loader();
 init_scaffold();
-import { existsSync as existsSync56, copyFileSync as copyFileSync8, readFileSync as readFileSync51, writeFileSync as writeFileSync26, mkdirSync as mkdirSync31 } from "node:fs";
-import { resolve as resolve33, dirname as dirname15 } from "node:path";
+import { existsSync as existsSync56, copyFileSync as copyFileSync9, readFileSync as readFileSync51, writeFileSync as writeFileSync26, mkdirSync as mkdirSync31 } from "node:fs";
+import { resolve as resolve33, dirname as dirname16 } from "node:path";
 init_state();
 init_vault();
 init_manager();
@@ -83229,8 +83487,8 @@ async function copyExampleConfig(nonInteractive) {
   if (!existsSync56(srcFile)) {
     throw new ConfigError(`Example config not found: ${choice}.yaml`);
   }
-  mkdirSync31(dirname15(destFile), { recursive: true });
-  copyFileSync8(srcFile, destFile);
+  mkdirSync31(dirname16(destFile), { recursive: true });
+  copyFileSync9(srcFile, destFile);
   console.log(source_default.green(`  Copied ${choice}.yaml -> ${destFile}`));
   console.log(source_default.yellow(`  Edit ${destFile} to customize, then re-run switchroom setup.`));
   await writeDetectedTimezone(destFile, nonInteractive);
@@ -84012,7 +84270,7 @@ init_lifecycle();
 init_compose_env();
 import { cpSync as cpSync2, existsSync as existsSync63, mkdirSync as mkdirSync33, readFileSync as readFileSync56, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync28, chownSync as chownSync5 } from "node:fs";
 import { spawnSync as spawnSync12 } from "node:child_process";
-import { join as join63, dirname as dirname18, resolve as resolve38 } from "node:path";
+import { join as join63, dirname as dirname19, resolve as resolve38 } from "node:path";
 import { homedir as homedir38 } from "node:os";
 
 // src/cli/release-yaml.ts
@@ -84121,7 +84379,7 @@ function defaultPersistPin(configPath) {
 }
 var DEFAULT_COMPOSE_PATH = join63(homedir38(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
-  let dir = dirname18(scriptPath);
+  let dir = dirname19(scriptPath);
   for (let i = 0;i < 12; i++) {
     if (existsSync63(join63(dir, ".git"))) {
       try {
@@ -84130,7 +84388,7 @@ function runningFromSwitchroomCheckout(scriptPath) {
           return true;
       } catch {}
     }
-    const parent = dirname18(dir);
+    const parent = dirname19(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -84346,7 +84604,7 @@ function planUpdate(opts) {
         if (existsSync63(dest)) {
           rmSync12(dest, { recursive: true, force: true });
         }
-        mkdirSync33(dirname18(dest), { recursive: true });
+        mkdirSync33(dirname19(dest), { recursive: true });
         cpSync2(source, dest, { recursive: true, dereference: false });
       } catch (err) {
         throw new Error(`sync-bundled-skills failed: ${err.message}`);
@@ -84459,7 +84717,7 @@ function defaultStatusProbe(composePath) {
       try {
         cliBuiltAt = new Date(statSync28(scriptPath).mtimeMs).toISOString();
       } catch {}
-      let dir = dirname18(scriptPath);
+      let dir = dirname19(scriptPath);
       for (let i = 0;i < 8; i++) {
         const pkgPath = join63(dir, "package.json");
         if (existsSync63(pkgPath)) {
@@ -84472,7 +84730,7 @@ function defaultStatusProbe(composePath) {
           }
           break;
         }
-        const parent = dirname18(dir);
+        const parent = dirname19(dir);
         if (parent === dir)
           break;
         dir = parent;
@@ -85103,7 +85361,7 @@ init_helpers();
 init_lifecycle();
 import { execSync as execSync4 } from "node:child_process";
 import { existsSync as existsSync64, readFileSync as readFileSync58 } from "node:fs";
-import { dirname as dirname19, join as join64 } from "node:path";
+import { dirname as dirname20, join as join64 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync4("claude --version 2>/dev/null", {
@@ -85162,7 +85420,7 @@ function locateSwitchroomInstallDir() {
         }
       } catch {}
     }
-    dir = dirname19(dir);
+    dir = dirname20(dir);
   }
   return null;
 }
@@ -86363,7 +86621,7 @@ import {
   rmSync as rmSync13,
   writeFileSync as writeFileSync28
 } from "node:fs";
-import { dirname as dirname20, join as join67 } from "node:path";
+import { dirname as dirname21, join as join67 } from "node:path";
 import { homedir as homedir40 } from "node:os";
 import { execFileSync as execFileSync19 } from "node:child_process";
 
@@ -86410,7 +86668,7 @@ function ensurePythonEnv(opts) {
   if (existsSync67(venvDir)) {
     rmSync13(venvDir, { recursive: true, force: true });
   }
-  mkdirSync35(dirname20(venvDir), { recursive: true });
+  mkdirSync35(dirname21(venvDir), { recursive: true });
   try {
     execFileSync19(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
   } catch (err) {
@@ -86444,14 +86702,14 @@ function ensurePythonEnv(opts) {
 // src/deps/node.ts
 import { createHash as createHash13 } from "node:crypto";
 import {
-  copyFileSync as copyFileSync9,
+  copyFileSync as copyFileSync10,
   existsSync as existsSync68,
   mkdirSync as mkdirSync36,
   readFileSync as readFileSync61,
   rmSync as rmSync14,
   writeFileSync as writeFileSync29
 } from "node:fs";
-import { dirname as dirname21, join as join68 } from "node:path";
+import { dirname as dirname22, join as join68 } from "node:path";
 import { homedir as homedir41 } from "node:os";
 import { execFileSync as execFileSync20 } from "node:child_process";
 
@@ -86478,7 +86736,7 @@ function defaultNodeCacheRoot() {
   return join68(homedir41(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
-  const sourceDir = dirname21(packageJsonPath);
+  const sourceDir = dirname22(packageJsonPath);
   const hasher = createHash13("sha256");
   hasher.update(`package.json
 `);
@@ -86503,7 +86761,7 @@ function ensureNodeEnv(opts) {
   if (!existsSync68(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
-  const sourceDir = dirname21(packageJsonPath);
+  const sourceDir = dirname22(packageJsonPath);
   const envDir = join68(cacheRoot, skillName);
   const stampPath = join68(envDir, ".package.sha256");
   const nodeModulesDir = join68(envDir, "node_modules");
@@ -86525,12 +86783,12 @@ function ensureNodeEnv(opts) {
     rmSync14(envDir, { recursive: true, force: true });
   }
   mkdirSync36(envDir, { recursive: true });
-  copyFileSync9(packageJsonPath, join68(envDir, "package.json"));
+  copyFileSync10(packageJsonPath, join68(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
     const lockPath = join68(sourceDir, lockName);
     if (existsSync68(lockPath)) {
-      copyFileSync9(lockPath, join68(envDir, lockName));
+      copyFileSync10(lockPath, join68(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -87529,7 +87787,7 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync10, existsSync as existsSync71, readFileSync as readFileSync62, writeFileSync as writeFileSync30 } from "node:fs";
+import { copyFileSync as copyFileSync11, existsSync as existsSync71, readFileSync as readFileSync62, writeFileSync as writeFileSync30 } from "node:fs";
 import { join as join70, resolve as resolve44 } from "node:path";
 init_scaffold();
 init_profiles();
@@ -87606,7 +87864,7 @@ function registerSoulCommand(program3) {
       if (existsSync71(backupPath)) {
         backupPath = `${t.soulPath}.bak.${Date.now()}`;
       }
-      copyFileSync10(t.soulPath, backupPath);
+      copyFileSync11(t.soulPath, backupPath);
     }
     writeFileSync30(t.soulPath, content, "utf-8");
     if (backupPath) {
@@ -89092,7 +89350,7 @@ function registerDriveMcpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn5 } from "node:child_process";
 import { writeFileSync as writeFileSync33, mkdirSync as mkdirSync41 } from "node:fs";
-import { dirname as dirname22, join as join76 } from "node:path";
+import { dirname as dirname23, join as join76 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -89117,7 +89375,7 @@ function computeRefreshDelayMs(expiresAt, now, leadMs = DEFAULT_REFRESH_LEAD_MS)
 function writeRefreshHeartbeat(agentName, data) {
   const path7 = heartbeatPath(agentName);
   try {
-    mkdirSync41(dirname22(path7), { recursive: true });
+    mkdirSync41(dirname23(path7), { recursive: true });
     writeFileSync33(path7, JSON.stringify(data, null, 2), { mode: 420 });
   } catch {}
 }
@@ -89310,7 +89568,7 @@ function registerM365McpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
 import { existsSync as existsSync78, mkdirSync as mkdirSync42, writeFileSync as writeFileSync34 } from "node:fs";
-import { dirname as dirname23 } from "node:path";
+import { dirname as dirname24 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
 var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
 var DEFAULT_VAULT_KEY = "notion/integration-token";
@@ -89320,7 +89578,7 @@ function buildNotionMcpArgs(opts) {
 }
 function defaultWriteHeartbeat(path7, contents) {
   try {
-    const dir = dirname23(path7);
+    const dir = dirname24(path7);
     if (!existsSync78(dir))
       mkdirSync42(dir, { recursive: true });
     writeFileSync34(path7, contents);
@@ -90475,7 +90733,7 @@ init_paths();
 import {
   closeSync as closeSync14,
   existsSync as existsSync84,
-  fsyncSync as fsyncSync7,
+  fsyncSync as fsyncSync8,
   mkdirSync as mkdirSync47,
   openSync as openSync14,
   readdirSync as readdirSync30,
@@ -90558,7 +90816,7 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
     const fd = openSync14(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
-      fsyncSync7(fd);
+      fsyncSync8(fd);
     } finally {
       closeSync14(fd);
     }
@@ -90575,7 +90833,7 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
     const fd = openSync14(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
-      fsyncSync7(fd);
+      fsyncSync8(fd);
     } finally {
       closeSync14(fd);
     }
@@ -90782,7 +91040,7 @@ function reconcileAgentCronOnly(agent) {
 import {
   closeSync as closeSync15,
   existsSync as existsSync85,
-  fsyncSync as fsyncSync8,
+  fsyncSync as fsyncSync9,
   mkdirSync as mkdirSync48,
   openSync as openSync15,
   readdirSync as readdirSync31,
@@ -90826,7 +91084,7 @@ function stagePendingScheduleEntry(opts) {
     const fd = openSync15(yamlTmp, "w", 384);
     try {
       writeSync11(fd, opts.yamlText);
-      fsyncSync8(fd);
+      fsyncSync9(fd);
     } finally {
       closeSync15(fd);
     }
@@ -91794,7 +92052,7 @@ import {
   writeFileSync as writeFileSync40
 } from "node:fs";
 import { tmpdir as tmpdir5, homedir as homedir49 } from "node:os";
-import { dirname as dirname28, join as join85, relative as relative2, resolve as resolve52 } from "node:path";
+import { dirname as dirname29, join as join85, relative as relative2, resolve as resolve52 } from "node:path";
 import { spawnSync as spawnSync15 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -92264,7 +92522,7 @@ function writePayload(poolDir, name, files) {
   try {
     for (const [path8, content] of Object.entries(files)) {
       const full = join85(staging, path8);
-      mkdirSync49(dirname28(full), { recursive: true, mode: 493 });
+      mkdirSync49(dirname29(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
         writeFileSync40(fd, content);
@@ -92386,7 +92644,7 @@ import {
   utimesSync,
   writeFileSync as writeFileSync41
 } from "node:fs";
-import { dirname as dirname29, join as join86, relative as relative3, resolve as resolve53 } from "node:path";
+import { dirname as dirname30, join as join86, relative as relative3, resolve as resolve53 } from "node:path";
 import { homedir as homedir50, tmpdir as tmpdir6 } from "node:os";
 import { spawnSync as spawnSync16 } from "node:child_process";
 init_helpers();
@@ -92639,13 +92897,13 @@ function writePersonalSkill(targetDir, files) {
   if (targetIsSymlink) {
     fail4(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
-  mkdirSync50(dirname29(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join86(dirname29(targetDir), `.skill-personal-stage-`));
+  mkdirSync50(dirname30(targetDir), { recursive: true, mode: 493 });
+  const staging = mkdtempSync6(join86(dirname30(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path8, content] of Object.entries(files)) {
       const full = join86(staging, path8);
-      mkdirSync50(dirname29(full), { recursive: true, mode: 493 });
+      mkdirSync50(dirname30(full), { recursive: true, mode: 493 });
       const fd = openSync17(full, "wx");
       try {
         writeFileSync41(fd, content);
@@ -93388,7 +93646,7 @@ import {
   statSync as statSync39,
   lstatSync as lstatSync11,
   realpathSync as realpathSync8,
-  copyFileSync as copyFileSync12
+  copyFileSync as copyFileSync13
 } from "node:fs";
 import { homedir as homedir53 } from "node:os";
 import { join as join89 } from "node:path";
@@ -93659,7 +93917,7 @@ function backupExistingCompose() {
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
-  copyFileSync12(p, bak);
+  copyFileSync13(p, bak);
   return bak;
 }
 function runDocker(args) {
@@ -93872,7 +94130,7 @@ The log is created when hostd handles its first privileged-verb request.`));
 init_source();
 init_helpers();
 init_operator_uid();
-import { existsSync as existsSync93, mkdirSync as mkdirSync52, writeFileSync as writeFileSync43, copyFileSync as copyFileSync13 } from "node:fs";
+import { existsSync as existsSync93, mkdirSync as mkdirSync52, writeFileSync as writeFileSync43, copyFileSync as copyFileSync14 } from "node:fs";
 import { homedir as homedir54 } from "node:os";
 import { join as join90 } from "node:path";
 import { spawnSync as spawnSync21 } from "node:child_process";
@@ -93970,7 +94228,7 @@ function backupExistingCompose2() {
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
-  copyFileSync13(p, bak);
+  copyFileSync14(p, bak);
   return bak;
 }
 function runDocker2(args) {