switchroom 0.18.31 → 0.18.32

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.18.31", COMMIT_SHA = "486b55f9";
+var VERSION = "0.18.32", COMMIT_SHA = "de41b271";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -14247,7 +14247,8 @@ var init_schema = __esm(() => {
       llm_model: exports_external.string().optional().describe("LiteLLM model name for Hindsight's LLM ops (retain/reflect/" + "consolidation) when the top-level `litellm.enabled` carve-out is " + "on. Defaults to a cheap OpenRouter model (routed via LiteLLM's " + "model-mapped path, not the Anthropic OAuth pass-through) to keep " + "background memory-op cost off the Claude subscription quota. Set " + "to a `claude-*` model name to route it back through the OAuth " + "pass-through instead. Has no effect when litellm is disabled."),
       api_key: exports_external.string().optional().describe("API key or vault reference for embedding provider"),
       docker_service: exports_external.boolean().default(true).describe("Whether to include Hindsight in docker-compose"),
-      url: exports_external.string().url("Hindsight URL must be a valid URL (no shell-special characters)").optional().describe("Hindsight MCP endpoint URL (e.g., http://localhost:18888/mcp/). Defaults to http://localhost:8888/mcp/.")
+      url: exports_external.string().url("Hindsight URL must be a valid URL (no shell-special characters)").optional().describe("Hindsight MCP endpoint URL (e.g., http://localhost:18888/mcp/). Defaults to http://localhost:8888/mcp/."),
+      mcp_transport: exports_external.enum(["shim", "http"]).optional().describe("How agents reach Hindsight's MCP surface. Default (unset or " + "'shim'): the lazy-connect stdio proxy `switchroom " + "hindsight-mcp-shim`, which always registers at session start " + "even when the hindsight container is down and reconnects " + "per-call. 'http' is the escape hatch that restores the legacy " + "direct Streamable-HTTP entry (session-fatal if the backend is " + "down when the agent session boots).")
     }).optional()
   });
   VaultConfigSchema = exports_external.object({
@@ -14290,7 +14291,8 @@ var init_schema = __esm(() => {
     auto_release_check: AutoReleaseCheckSchema.default({}).describe("Pull-based release-triggered fleet restart (#1743). hostd polls " + "the remote release tag on a fixed interval and applies + " + "restarts the fleet (graceful) when a new release is detected. " + "Opt-in: default enabled=false.")
   });
   WebServiceConfigSchema = exports_external.object({
-    managed: exports_external.boolean().default(false).describe("Whether `switchroom update` refreshes the web-service container " + "(dashboard + GitHub-webhook receiver) via `switchroom webd " + "install`. Default: false \u2014 existing installs run the web server " + "as the legacy `switchroom-web.service` systemd unit and must not " + "be surprised by a container takeover of host loopback 127.0.0.1:" + "8080 mid-update. Set true ONLY after cutting over to the " + "container (stop+disable the systemd unit, `switchroom webd " + "install`). The container runs in its own compose project " + "(`switchroom-web`), separate from the agent fleet, with " + "network_mode: host so it keeps owning loopback:8080 for the " + "cloudflared tunnel + tailscale serve consumers.")
+    managed: exports_external.boolean().default(false).describe("Whether `switchroom update` refreshes the web-service container " + "(dashboard + GitHub-webhook receiver) via `switchroom webd " + "install`. Default: false \u2014 existing installs run the web server " + "as the legacy `switchroom-web.service` systemd unit and must not " + "be surprised by a container takeover of host loopback 127.0.0.1:" + "8080 mid-update. Set true ONLY after cutting over to the " + "container (stop+disable the systemd unit, `switchroom webd " + "install`). The container runs in its own compose project " + "(`switchroom-web`), separate from the agent fleet, with " + "network_mode: host so it keeps owning loopback:8080 for the " + "cloudflared tunnel + tailscale serve consumers."),
+    port: exports_external.number().int().min(1).max(65535).default(8080).describe("Host loopback port the web server listens on (127.0.0.1:<port>). " + "Default: 8080. Set this when another service owns 8080 on the " + "host (e.g. UniFi OS Server) \u2014 `switchroom webd install` and the " + "`switchroom update` refresh-web step both honor it, so a custom " + "port survives updates instead of being silently reverted to " + "8080 by the regenerated compose file. Remember to point the " + "host-side consumers (cloudflared tunnel, `tailscale serve`) at " + "the same port.")
   });
   FleetHealthConfigSchema = exports_external.object({
     owner_agent: exports_external.string().regex(/^[a-z0-9][a-z0-9_-]{0,50}$/, {
@@ -15959,11 +15961,24 @@ var init_hindsight = __esm(() => {
 // src/memory/hindsight.ts
 function generateHindsightMcpConfig(collection, memoryConfig) {
   const url = memoryConfig.config?.url ?? HINDSIGHT_DEFAULT_MCP_URL;
+  if (memoryConfig.config?.mcp_transport === "http") {
+    return {
+      type: "http",
+      url,
+      headers: {
+        "X-Bank-Id": collection
+      }
+    };
+  }
   return {
-    type: "http",
-    url,
-    headers: {
-      "X-Bank-Id": collection
+    type: "stdio",
+    command: HINDSIGHT_SHIM_CLI_PATH,
+    args: ["hindsight-mcp-shim"],
+    env: {
+      HINDSIGHT_MCP_URL: url,
+      HINDSIGHT_BANK_ID: collection,
+      HINDSIGHT_SHIM_CACHE_DIR: `${HINDSIGHT_SHIM_AGENT_HOME}/.hindsight-shim`,
+      HOME: HINDSIGHT_SHIM_AGENT_HOME
     }
   };
 }
@@ -16490,7 +16505,7 @@ async function addMemoryTag(apiUrl, bankId, memoryId, tag, opts) {
     return { ok: false, reason: String(err) };
   }
 }
-var DEFAULT_RETAIN_MISSION, PROFILE_MEMORY_DEFAULTS, USER_PROFILE_SOURCE_QUERY = "What are the key facts, preferences, context, and communication style about the user I talk to? Summarize what matters for making the agent feel like it knows them.", DEMOTE_FROM_RECALL_TAG = "[demote-from-recall]";
+var HINDSIGHT_SHIM_CLI_PATH = "/usr/local/bin/switchroom", HINDSIGHT_SHIM_AGENT_HOME = "/state/agent/home", DEFAULT_RETAIN_MISSION, PROFILE_MEMORY_DEFAULTS, USER_PROFILE_SOURCE_QUERY = "What are the key facts, preferences, context, and communication style about the user I talk to? Summarize what matters for making the agent feel like it knows them.", DEMOTE_FROM_RECALL_TAG = "[demote-from-recall]";
 var init_hindsight2 = __esm(() => {
   init_users();
   init_hindsight();
@@ -47789,8 +47804,8 @@ var init_fleet_defaults = __esm(() => {
 });
 
 // src/agents/connection-health.ts
-import { mkdirSync as mkdirSync45, writeFileSync as writeFileSync27 } from "node:fs";
-import { join as join81 } from "node:path";
+import { mkdirSync as mkdirSync46, writeFileSync as writeFileSync28 } from "node:fs";
+import { join as join82 } from "node:path";
 async function computeAgentConnectionIssues(config, agentName, vaultAclReader) {
   const reqs = computeMcpSecretRequirements(config).filter((r) => r.agent === agentName);
   if (reqs.length === 0)
@@ -47847,10 +47862,10 @@ async function computeAgentConnectionIssues(config, agentName, vaultAclReader) {
   return issues;
 }
 function writeConnectionHealthFile(agentDir, health, deps) {
-  const dir = join81(agentDir, ".claude");
-  const path8 = join81(dir, CONNECTION_HEALTH_FILENAME);
-  (deps?.mkdir ?? ((p, o) => mkdirSync45(p, o)))(dir, { recursive: true });
-  (deps?.writeFile ?? ((p, d) => writeFileSync27(p, d)))(path8, JSON.stringify(health, null, 2) + `
+  const dir = join82(agentDir, ".claude");
+  const path8 = join82(dir, CONNECTION_HEALTH_FILENAME);
+  (deps?.mkdir ?? ((p, o) => mkdirSync46(p, o)))(dir, { recursive: true });
+  (deps?.writeFile ?? ((p, d) => writeFileSync28(p, d)))(path8, JSON.stringify(health, null, 2) + `
 `);
 }
 async function refreshAgentConnectionHealth(config, agentName, agentDir, deps) {
@@ -47871,10 +47886,10 @@ var CONNECTION_HEALTH_FILENAME = "connection-health.json";
 var init_connection_health = () => {};
 
 // src/cli/update-prompt-hook.ts
-import { existsSync as existsSync83, readFileSync as readFileSync71, writeFileSync as writeFileSync28, chmodSync as chmodSync12, mkdirSync as mkdirSync46 } from "node:fs";
-import { join as join82 } from "node:path";
+import { existsSync as existsSync83, readFileSync as readFileSync72, writeFileSync as writeFileSync29, chmodSync as chmodSync12, mkdirSync as mkdirSync47 } from "node:fs";
+import { join as join83 } from "node:path";
 function containerHookCommand() {
-  return join82(CONTAINER_AGENT_DIR, ".claude", "hooks", HOOK_FILENAME);
+  return join83(CONTAINER_AGENT_DIR, ".claude", "hooks", HOOK_FILENAME);
 }
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -47940,14 +47955,14 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join82(agentDir, ".claude", "hooks");
-  mkdirSync46(hooksDir, { recursive: true });
-  const scriptPath = join82(hooksDir, HOOK_FILENAME);
+  const hooksDir = join83(agentDir, ".claude", "hooks");
+  mkdirSync47(hooksDir, { recursive: true });
+  const scriptPath = join83(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
-  const existing = existsSync83(scriptPath) ? readFileSync71(scriptPath, "utf-8") : "";
+  const existing = existsSync83(scriptPath) ? readFileSync72(scriptPath, "utf-8") : "";
   if (existing !== desired) {
-    writeFileSync28(scriptPath, desired, { mode: 493 });
+    writeFileSync29(scriptPath, desired, { mode: 493 });
     chmodSync12(scriptPath, 493);
     installed = true;
   } else {
@@ -47955,11 +47970,11 @@ function installUpdatePromptHook(agentDir) {
       chmodSync12(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join82(agentDir, ".claude", "settings.json");
+  const settingsPath = join83(agentDir, ".claude", "settings.json");
   if (!existsSync83(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
-  const raw = readFileSync71(settingsPath, "utf-8");
+  const raw = readFileSync72(settingsPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -47995,7 +48010,7 @@ function installUpdatePromptHook(agentDir) {
   if (mutated) {
     hooks.UserPromptSubmit = list2;
     parsed.hooks = hooks;
-    writeFileSync28(settingsPath, JSON.stringify(parsed, null, 2) + `
+    writeFileSync29(settingsPath, JSON.stringify(parsed, null, 2) + `
 `, { mode: 384 });
     installed = true;
   } else if (!alreadyCorrect) {
@@ -48004,7 +48019,7 @@ function installUpdatePromptHook(agentDir) {
     });
     hooks.UserPromptSubmit = list2;
     parsed.hooks = hooks;
-    writeFileSync28(settingsPath, JSON.stringify(parsed, null, 2) + `
+    writeFileSync29(settingsPath, JSON.stringify(parsed, null, 2) + `
 `, { mode: 384 });
     installed = true;
   }
@@ -48384,7 +48399,7 @@ __export(exports_voice_sidecar_token, {
   VOICE_SIDECAR_TOKEN_ENV: () => VOICE_SIDECAR_TOKEN_ENV
 });
 import { randomBytes as randomBytes14 } from "node:crypto";
-import { chmodSync as chmodSync13, chownSync as chownSync7, existsSync as existsSync85, mkdirSync as mkdirSync47, readFileSync as readFileSync72, rmSync as rmSync17, writeFileSync as writeFileSync29 } from "node:fs";
+import { chmodSync as chmodSync13, chownSync as chownSync7, existsSync as existsSync85, mkdirSync as mkdirSync48, readFileSync as readFileSync73, rmSync as rmSync17, writeFileSync as writeFileSync30 } from "node:fs";
 import { dirname as dirname29 } from "node:path";
 async function defaultResolveOrSeedToken(home2, writeErr) {
   const [{ getViaBrokerStructured: getViaBrokerStructured2, putViaBroker: putViaBroker2 }, { resolveOperatorVaultPassphrase }] = await Promise.all([
@@ -48420,7 +48435,7 @@ async function provisionVoiceSidecarToken(composePath, home2, ctx) {
   if (engine !== "local") {
     try {
       if (existsSync85(envPath)) {
-        const body = readFileSync72(envPath, "utf-8");
+        const body = readFileSync73(envPath, "utf-8");
         if (body.includes(`${VOICE_SIDECAR_TOKEN_ENV}=`))
           rmSync17(envPath);
       }
@@ -48439,11 +48454,11 @@ async function provisionVoiceSidecarToken(composePath, home2, ctx) {
   if (!token)
     return;
   try {
-    mkdirSync47(dirname29(envPath), { recursive: true });
+    mkdirSync48(dirname29(envPath), { recursive: true });
     let body = "";
     try {
       if (existsSync85(envPath))
-        body = readFileSync72(envPath, "utf-8");
+        body = readFileSync73(envPath, "utf-8");
     } catch {}
     const line = `${VOICE_SIDECAR_TOKEN_ENV}=${token}`;
     const keyRe = new RegExp(`^${VOICE_SIDECAR_TOKEN_ENV}=.*$`, "m");
@@ -48451,7 +48466,7 @@ async function provisionVoiceSidecarToken(composePath, home2, ctx) {
 `) ? body + `
 ` : body) + line + `
 `;
-    writeFileSync29(envPath, next, {
+    writeFileSync30(envPath, next, {
       encoding: "utf-8",
       mode: 384
     });
@@ -48502,11 +48517,11 @@ __export(exports_apply, {
   DEFAULT_COMPOSE_PATH: () => DEFAULT_COMPOSE_PATH2,
   COMPOSE_PROJECT: () => COMPOSE_PROJECT2
 });
-import { accessSync as accessSync3, chownSync as chownSync8, constants as fsConstants6, copyFileSync as copyFileSync12, existsSync as existsSync86, mkdirSync as mkdirSync48, readFileSync as readFileSync73, readdirSync as readdirSync29, renameSync as renameSync19, statSync as statSync47, writeFileSync as writeFileSync30 } from "node:fs";
+import { accessSync as accessSync3, chownSync as chownSync8, constants as fsConstants6, copyFileSync as copyFileSync12, existsSync as existsSync86, mkdirSync as mkdirSync49, readFileSync as readFileSync74, readdirSync as readdirSync29, renameSync as renameSync20, statSync as statSync47, writeFileSync as writeFileSync31 } from "node:fs";
 import { mkdir as mkdir2 } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
-import { dirname as dirname30, join as join84, resolve as resolve52 } from "node:path";
+import { dirname as dirname30, join as join85, resolve as resolve52 } from "node:path";
 import { homedir as homedir49 } from "node:os";
 import { execFileSync as execFileSync27 } from "node:child_process";
 function effectiveLiteLLMEnabled(config, agentResolvedLitellm) {
@@ -48518,7 +48533,7 @@ async function resolveOperatorVaultPassphrase(home2) {
     return envPass;
   try {
     const { readAutoUnlockFile: readAutoUnlockFile2 } = await Promise.resolve().then(() => (init_auto_unlock(), exports_auto_unlock));
-    const blobPath = join84(home2, ".switchroom", "vault-auto-unlock");
+    const blobPath = join85(home2, ".switchroom", "vault-auto-unlock");
     const pass = readAutoUnlockFile2(blobPath);
     return pass && pass.length > 0 ? pass : null;
   } catch {
@@ -48608,7 +48623,7 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
   let configText = null;
   if (switchroomConfigPath && existsSync86(switchroomConfigPath)) {
     try {
-      configText = readFileSync73(switchroomConfigPath, "utf-8");
+      configText = readFileSync74(switchroomConfigPath, "utf-8");
     } catch (err) {
       ctx.writeErr(source_default.yellow(`  ! litellm: could not read config for ACL grants (${err.message}); keys will be provisioned but agents may lack read-ACL.
 `));
@@ -48831,7 +48846,7 @@ function resolveVaultBindMountDir(homeDir, ctx) {
   if (isCustomPath && ctx.customVaultPath) {
     return dirname30(ctx.customVaultPath);
   }
-  return join84(homeDir, ".switchroom", "vault");
+  return join85(homeDir, ".switchroom", "vault");
 }
 function inspectVaultBindMountDir(vaultDir) {
   if (!existsSync86(vaultDir))
@@ -48862,60 +48877,60 @@ function hasVaultRefs(value) {
 async function ensureHostMountSources(config) {
   const home2 = resolveHostHomeForCompose();
   const dirs = [
-    join84(home2, ".switchroom", "approvals"),
-    join84(home2, ".switchroom", "scheduler"),
-    join84(home2, ".switchroom", "logs"),
-    join84(home2, ".switchroom", "compose"),
-    join84(home2, ".switchroom", "broker-operator")
+    join85(home2, ".switchroom", "approvals"),
+    join85(home2, ".switchroom", "scheduler"),
+    join85(home2, ".switchroom", "logs"),
+    join85(home2, ".switchroom", "compose"),
+    join85(home2, ".switchroom", "broker-operator")
   ];
   for (const name of Object.keys(config.agents)) {
-    dirs.push(join84(home2, ".switchroom", "agents", name));
-    dirs.push(join84(home2, ".switchroom", "logs", name));
-    dirs.push(join84(home2, ".claude", "projects", name));
-    dirs.push(join84(home2, ".switchroom", "audit", name));
-    if (existsSync86(join84(home2, ".switchroom-config"))) {
-      dirs.push(join84(home2, ".switchroom-config", "agents", name, "personal-skills"));
+    dirs.push(join85(home2, ".switchroom", "agents", name));
+    dirs.push(join85(home2, ".switchroom", "logs", name));
+    dirs.push(join85(home2, ".claude", "projects", name));
+    dirs.push(join85(home2, ".switchroom", "audit", name));
+    if (existsSync86(join85(home2, ".switchroom-config"))) {
+      dirs.push(join85(home2, ".switchroom-config", "agents", name, "personal-skills"));
     }
   }
   for (const dir of dirs) {
     await mkdir2(dir, { recursive: true });
   }
-  const autoUnlockPath = join84(home2, ".switchroom", "vault-auto-unlock");
+  const autoUnlockPath = join85(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync86(autoUnlockPath)) {
-    writeFileSync30(autoUnlockPath, "", { mode: 384 });
+    writeFileSync31(autoUnlockPath, "", { mode: 384 });
   }
-  const auditLogPath = join84(home2, ".switchroom", "vault-audit.log");
+  const auditLogPath = join85(home2, ".switchroom", "vault-audit.log");
   if (!existsSync86(auditLogPath)) {
-    writeFileSync30(auditLogPath, "", { mode: 420 });
+    writeFileSync31(auditLogPath, "", { mode: 420 });
   }
   const grantsDbDir = getGrantsDbDir(home2);
-  mkdirSync48(grantsDbDir, { recursive: true, mode: 448 });
+  mkdirSync49(grantsDbDir, { recursive: true, mode: 448 });
   migrateLegacyGrantsDbLocation(getGrantsDbPath(home2));
-  const hostdAuditLogPath = join84(home2, ".switchroom", "host-control-audit.log");
+  const hostdAuditLogPath = join85(home2, ".switchroom", "host-control-audit.log");
   if (!existsSync86(hostdAuditLogPath)) {
-    writeFileSync30(hostdAuditLogPath, "", { mode: 420 });
+    writeFileSync31(hostdAuditLogPath, "", { mode: 420 });
   }
   for (const name of Object.keys(config.agents)) {
-    const tokenPath = join84(home2, ".switchroom", "agents", name, ".vault-token");
+    const tokenPath = join85(home2, ".switchroom", "agents", name, ".vault-token");
     if (!existsSync86(tokenPath)) {
-      writeFileSync30(tokenPath, "", { mode: 384 });
+      writeFileSync31(tokenPath, "", { mode: 384 });
     }
     try {
       const uid = allocateAgentUid(name);
       chownSync8(tokenPath, uid, uid);
     } catch {}
   }
-  const fleetDir = join84(home2, ".switchroom", "fleet");
+  const fleetDir = join85(home2, ".switchroom", "fleet");
   await mkdir2(fleetDir, { recursive: true });
-  const invariantsPath = join84(fleetDir, "switchroom-invariants.md");
+  const invariantsPath = join85(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
-  const invariantsCurrent = existsSync86(invariantsPath) ? readFileSync73(invariantsPath, "utf-8") : null;
+  const invariantsCurrent = existsSync86(invariantsPath) ? readFileSync74(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
-    writeFileSync30(invariantsPath, invariantsCanonical, { mode: 420 });
+    writeFileSync31(invariantsPath, invariantsCanonical, { mode: 420 });
   }
-  const fleetClaudePath = join84(fleetDir, "CLAUDE.md");
+  const fleetClaudePath = join85(fleetDir, "CLAUDE.md");
   if (!existsSync86(fleetClaudePath)) {
-    writeFileSync30(fleetClaudePath, renderFleetDefaultsClaudeMd(), {
+    writeFileSync31(fleetClaudePath, renderFleetDefaultsClaudeMd(), {
       mode: 420
     });
   }
@@ -48999,17 +49014,17 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 }
 function writeInstallTypeCache(homeDir = homedir49()) {
   const ctx = detectInstallType();
-  const dir = join84(homeDir, ".switchroom");
-  const out = join84(dir, "install-type.json");
+  const dir = join85(homeDir, ".switchroom");
+  const out = join85(dir, "install-type.json");
   const tmp = `${out}.tmp`;
-  mkdirSync48(dir, { recursive: true });
+  mkdirSync49(dir, { recursive: true });
   const payload = {
     install_type: ctx.install_type,
     detected_at: new Date().toISOString(),
     source_paths: ctx.source_paths
   };
-  writeFileSync30(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
-  renameSync19(tmp, out);
+  writeFileSync31(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
+  renameSync20(tmp, out);
   return out;
 }
 async function runApply(config, options, deps = {}, switchroomConfigPath) {
@@ -49067,17 +49082,17 @@ Applying switchroom config...
       writeOut(source_default.green(`  + ${name}`) + source_default.gray(` (${agentConfig.extends ?? "default"}) \u2014 ${detail}
 `));
       try {
-        installUpdatePromptHook(join84(agentsDir, name));
+        installUpdatePromptHook(join85(agentsDir, name));
       } catch (hookErr) {
         writeOut(source_default.gray(`    (update-prompt hook install failed for ${name}: ${hookErr.message})
 `));
       }
-      await refreshAgentConnectionHealth(config, name, join84(agentsDir, name), {
+      await refreshAgentConnectionHealth(config, name, join85(agentsDir, name), {
         vaultAclReader: connHealthVaultAclReader
       });
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join84(agentsDir, name), uid, {
+        alignAgentUid(name, join85(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -49122,7 +49137,7 @@ Applying switchroom config...
     for (const name of agentNames) {
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join84(agentsDir, name), uid, {
+        alignAgentUid(name, join85(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -49466,7 +49481,7 @@ function copyExampleConfig2(name) {
   }
   const embedded = EMBEDDED_EXAMPLES[name];
   if (embedded !== undefined) {
-    writeFileSync30(dest, embedded, { encoding: "utf8" });
+    writeFileSync31(dest, embedded, { encoding: "utf8" });
     console.log(source_default.green(`Copied ${name}.yaml -> switchroom.yaml`));
     return;
   }
@@ -49482,7 +49497,7 @@ function findUnwritableAgentDirs(config, opts) {
   const targets = opts.only ? [opts.only] : Object.keys(config.agents ?? {});
   const unwritable = [];
   for (const name of targets) {
-    const startSh = join84(agentsDir, name, "start.sh");
+    const startSh = join85(agentsDir, name, "start.sh");
     if (!existsSync86(startSh))
       continue;
     try {
@@ -49687,7 +49702,7 @@ var init_apply = __esm(() => {
     switchroom: switchroom_default,
     minimal: minimal_default
   };
-  DEFAULT_COMPOSE_PATH2 = join84(homedir49(), ".switchroom", "compose", "docker-compose.yml");
+  DEFAULT_COMPOSE_PATH2 = join85(homedir49(), ".switchroom", "compose", "docker-compose.yml");
   IN_AGENT_CONTAINER_APPLY_MSG = "`switchroom apply`'s full per-agent scaffold cannot run from inside an " + "agent container \u2014 this is a host/hostd operation by construction " + "(no vault at the container HOME, and no `docker compose` v2 plugin here).\nTo roll the fleet to a new version, drive the hostd rollout (`mcp__hostd__rollout`): it runs a `--compose-only` apply plus a per-agent restart-reconcile, and each agent refreshes its own templates " + `on restart \u2014 the roll completes without any agent running a full apply.
 ` + "A full host-side `sudo switchroom apply` is only needed for structural changes (compose regeneration / new-agent scaffolding), and is run by the operator on the host, never from inside an agent.";
   SELF_ELEVATE_PRESERVED_ENV = [
@@ -63136,7 +63151,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes16 } from "node:crypto";
-import { existsSync as existsSync95, readFileSync as readFileSync82 } from "node:fs";
+import { existsSync as existsSync95, readFileSync as readFileSync83 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -63425,7 +63440,7 @@ function getLastUpdateApplyStatus() {
   }
   let raw;
   try {
-    raw = readFileSync82(path9, "utf-8");
+    raw = readFileSync83(path9, "utf-8");
   } catch (err2) {
     return errorText2(`get_status: failed to read audit log at ${path9}: ${err2.message}`);
   }
@@ -64115,11 +64130,11 @@ __export(exports_scan, {
   ledgerPathForBase: () => ledgerPathForBase
 });
 import {
-  readFileSync as readFileSync84,
+  readFileSync as readFileSync85,
   readdirSync as readdirSync37,
   existsSync as existsSync98,
-  mkdirSync as mkdirSync55,
-  writeFileSync as writeFileSync36
+  mkdirSync as mkdirSync56,
+  writeFileSync as writeFileSync37
 } from "node:fs";
 import { resolve as resolve57, dirname as dirname33 } from "node:path";
 import { homedir as homedir58 } from "node:os";
@@ -64158,7 +64173,7 @@ function runScan(opts = {}) {
     let sawArtifact = false;
     try {
       if (existsSync98(turnsPath)) {
-        turnsText = readFileSync84(turnsPath, "utf-8");
+        turnsText = readFileSync85(turnsPath, "utf-8");
         sawArtifact = true;
       }
     } catch (e) {
@@ -64166,7 +64181,7 @@ function runScan(opts = {}) {
     }
     try {
       if (existsSync98(gwPath)) {
-        gwText = readFileSync84(gwPath, "utf-8");
+        gwText = readFileSync85(gwPath, "utf-8");
         sawArtifact = true;
       }
     } catch (e) {
@@ -64208,7 +64223,7 @@ function readLedgerIfPresent(base) {
   try {
     if (!existsSync98(path9))
       return null;
-    return JSON.parse(readFileSync84(path9, "utf-8"));
+    return JSON.parse(readFileSync85(path9, "utf-8"));
   } catch {
     return null;
   }
@@ -64218,8 +64233,8 @@ function ledgerPathForBase(base) {
 }
 function writeLedger(base, ledger) {
   const path9 = ledgerPathForBase(base);
-  mkdirSync55(dirname33(path9), { recursive: true });
-  writeFileSync36(path9, JSON.stringify(ledger, null, 2) + `
+  mkdirSync56(dirname33(path9), { recursive: true });
+  writeFileSync37(path9, JSON.stringify(ledger, null, 2) + `
 `, "utf-8");
   return path9;
 }
@@ -89659,9 +89674,425 @@ function registerNotionMcpLauncherCommand(program3) {
   });
 }
 
+// src/cli/hindsight-mcp-shim.ts
+init_hindsight();
+import { mkdirSync as mkdirSync45, readFileSync as readFileSync70, renameSync as renameSync19, writeFileSync as writeFileSync27 } from "node:fs";
+import { tmpdir as tmpdir5 } from "node:os";
+import { join as join81 } from "node:path";
+import { createInterface as createInterface6 } from "node:readline";
+var SHIM_SUPPORTED_PROTOCOL_VERSIONS = [
+  "2025-06-18",
+  "2025-03-26",
+  "2024-11-05"
+];
+var TOOLS_LIST_TIMEOUT_MS = 3000;
+var TOOLS_CALL_TIMEOUT_MS = 120000;
+var UPSTREAM_CONNECT_TIMEOUT_MS = 3000;
+var TOOLS_CACHE_FILENAME = "hindsight-tools-list.json";
+var FALLBACK_TOOL_TABLE = {
+  cancel_operation: [["operation_id"], ["bank_id", "operation_id"]],
+  clear_memories: [[], ["bank_id", "type"]],
+  create_bank: [["bank_id"], ["bank_id", "mission", "name"]],
+  create_directive: [["content", "name"], ["bank_id", "content", "is_active", "name", "priority", "tags"]],
+  create_mental_model: [["name", "source_query"], ["bank_id", "max_tokens", "mental_model_id", "name", "source_query", "tags", "trigger_refresh_after_consolidation"]],
+  delete_bank: [[], ["bank_id"]],
+  delete_directive: [["directive_id"], ["bank_id", "directive_id"]],
+  delete_document: [["document_id"], ["bank_id", "document_id"]],
+  delete_mental_model: [["mental_model_id"], ["bank_id", "mental_model_id"]],
+  get_bank: [[], ["bank_id"]],
+  get_bank_stats: [[], ["bank_id"]],
+  get_document: [["document_id"], ["bank_id", "document_id"]],
+  get_memory: [["memory_id"], ["bank_id", "memory_id"]],
+  get_mental_model: [["mental_model_id"], ["bank_id", "detail", "mental_model_id"]],
+  get_operation: [["operation_id"], ["bank_id", "operation_id"]],
+  list_banks: [[], []],
+  list_directives: [[], ["active_only", "bank_id", "tags"]],
+  list_documents: [[], ["bank_id", "limit", "q"]],
+  list_memories: [[], ["bank_id", "limit", "offset", "q", "type"]],
+  list_mental_models: [[], ["bank_id", "detail", "tags"]],
+  list_operations: [[], ["bank_id", "limit", "status"]],
+  list_tags: [[], ["bank_id", "limit", "q"]],
+  recall: [["query"], ["bank_id", "budget", "max_tokens", "query", "query_timestamp", "tag_groups", "tags", "tags_match", "types"]],
+  reflect: [["query"], ["bank_id", "budget", "context", "max_tokens", "query", "response_schema", "tags", "tags_match"]],
+  refresh_mental_model: [["mental_model_id"], ["bank_id", "mental_model_id"]],
+  retain: [["content"], ["bank_id", "content", "context", "document_id", "metadata", "strategy", "tags", "timestamp", "update_mode"]],
+  sync_retain: [["content"], ["bank_id", "content", "context", "document_id", "metadata", "strategy", "tags", "timestamp"]],
+  update_bank: [[], ["bank_id", "config_updates", "mission", "name"]],
+  update_mental_model: [["mental_model_id"], ["bank_id", "max_tokens", "mental_model_id", "name", "source_query", "tags", "trigger_refresh_after_consolidation"]]
+};
+function buildFallbackToolsList() {
+  const tools = Object.entries(FALLBACK_TOOL_TABLE).map(([name, [required, props]]) => ({
+    name,
+    description: "Hindsight memory tool (served from the shim's static fallback " + "manifest because the backend has not been reachable yet; the " + "schema is permissive and will be replaced by the live one).",
+    inputSchema: {
+      type: "object",
+      properties: Object.fromEntries(props.map((p) => [p, {}])),
+      required
+    }
+  }));
+  return { tools };
+}
+
+class UpstreamClient {
+  opts;
+  sessionId = null;
+  protocolVersion = null;
+  nextId = 1;
+  constructor(opts) {
+    this.opts = opts;
+  }
+  get fetchImpl() {
+    return this.opts.fetchImpl ?? fetch;
+  }
+  reset() {
+    this.sessionId = null;
+    this.protocolVersion = null;
+  }
+  get connected() {
+    return this.sessionId !== null || this.protocolVersion !== null;
+  }
+  headers() {
+    const h = {
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream"
+    };
+    if (this.opts.bankId)
+      h["X-Bank-Id"] = this.opts.bankId;
+    if (this.sessionId)
+      h["mcp-session-id"] = this.sessionId;
+    if (this.protocolVersion)
+      h["mcp-protocol-version"] = this.protocolVersion;
+    return h;
+  }
+  async post(body, timeoutMs) {
+    const ctl = new AbortController;
+    const timer = setTimeout(() => ctl.abort(), timeoutMs);
+    try {
+      return await this.fetchImpl(this.opts.url, {
+        method: "POST",
+        headers: this.headers(),
+        body: JSON.stringify(body),
+        signal: ctl.signal
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async parseResponse(res, id) {
+    const ctype = res.headers.get("content-type") ?? "";
+    const text = await res.text();
+    if (ctype.includes("text/event-stream")) {
+      for (const chunk2 of text.split(/\n\n/)) {
+        const data = chunk2.split(/\n/).filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join(`
+`);
+        if (!data)
+          continue;
+        try {
+          const msg = JSON.parse(data);
+          if (msg.id === id)
+            return msg;
+        } catch {}
+      }
+      throw new Error("no matching JSON-RPC response in SSE stream");
+    }
+    return JSON.parse(text);
+  }
+  async ensureSession() {
+    if (this.protocolVersion)
+      return;
+    const timeoutMs = this.opts.connectTimeoutMs ?? UPSTREAM_CONNECT_TIMEOUT_MS;
+    const id = this.nextId++;
+    const res = await this.post({
+      jsonrpc: "2.0",
+      id,
+      method: "initialize",
+      params: {
+        protocolVersion: SHIM_SUPPORTED_PROTOCOL_VERSIONS[0],
+        capabilities: {},
+        clientInfo: { name: "switchroom-hindsight-shim", version: "1.0.0" }
+      }
+    }, timeoutMs);
+    if (!res.ok) {
+      throw new Error(`upstream initialize failed: HTTP ${res.status}`);
+    }
+    this.sessionId = res.headers.get("mcp-session-id");
+    const msg = await this.parseResponse(res, id);
+    if (msg.error) {
+      throw new Error(`upstream initialize error: ${msg.error.message}`);
+    }
+    const negotiated = msg.result?.protocolVersion;
+    this.protocolVersion = negotiated ?? SHIM_SUPPORTED_PROTOCOL_VERSIONS[0];
+    const notifRes = await this.post({ jsonrpc: "2.0", method: "notifications/initialized" }, timeoutMs);
+    if (!notifRes.ok && notifRes.status !== 405) {
+      throw new Error(`upstream initialized notification failed: HTTP ${notifRes.status}`);
+    }
+    await notifRes.text().catch(() => {
+      return;
+    });
+  }
+  async request(method, params, timeoutMs, retry = true) {
+    try {
+      await this.ensureSession();
+    } catch (err) {
+      this.reset();
+      if (retry)
+        return this.request(method, params, timeoutMs, false);
+      throw err;
+    }
+    const id = this.nextId++;
+    let res;
+    try {
+      res = await this.post({ jsonrpc: "2.0", id, method, params }, timeoutMs);
+    } catch (err) {
+      this.reset();
+      if (retry && isPreDeliveryError(err)) {
+        return this.request(method, params, timeoutMs, false);
+      }
+      throw err;
+    }
+    if (res.status === 404) {
+      this.reset();
+      await res.text().catch(() => {
+        return;
+      });
+      if (retry)
+        return this.request(method, params, timeoutMs, false);
+      throw new Error("upstream session expired (404)");
+    }
+    try {
+      if (!res.ok)
+        throw new Error(`upstream HTTP ${res.status}`);
+      return await this.parseResponse(res, id);
+    } catch (err) {
+      this.reset();
+      throw err;
+    }
+  }
+}
+function isPreDeliveryError(err) {
+  const PRE_DELIVERY_CODES = new Set([
+    "ECONNREFUSED",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "UND_ERR_CONNECT_TIMEOUT"
+  ]);
+  let cur = err;
+  for (let depth = 0;cur && depth < 5; depth++) {
+    const code = cur.code;
+    if (typeof code === "string" && PRE_DELIVERY_CODES.has(code))
+      return true;
+    const errors2 = cur.errors;
+    if (Array.isArray(errors2) && errors2.length > 0) {
+      return errors2.every((e) => isPreDeliveryError(e));
+    }
+    cur = cur.cause;
+  }
+  return false;
+}
+
+class HindsightShim {
+  opts;
+  upstream;
+  log;
+  constructor(opts) {
+    this.opts = opts;
+    this.upstream = new UpstreamClient(opts);
+    this.log = opts.logger ?? ((l) => process.stderr.write(l + `
+`));
+  }
+  get cachePath() {
+    return join81(this.opts.cacheDir, TOOLS_CACHE_FILENAME);
+  }
+  writeCache(result) {
+    try {
+      mkdirSync45(this.opts.cacheDir, { recursive: true });
+      const tmp = join81(this.opts.cacheDir, `.${TOOLS_CACHE_FILENAME}.${process.pid}.tmp`);
+      writeFileSync27(tmp, JSON.stringify(result, null, 2) + `
+`);
+      renameSync19(tmp, this.cachePath);
+    } catch (err) {
+      this.log(`[hindsight-shim] cache write failed: ${String(err)}`);
+    }
+  }
+  readCache() {
+    try {
+      const parsed = JSON.parse(readFileSync70(this.cachePath, "utf-8"));
+      if (Array.isArray(parsed.tools))
+        return parsed;
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  async handle(msg) {
+    const { id, method } = msg;
+    if (method === undefined)
+      return null;
+    if (id === undefined || id === null) {
+      if (method !== "notifications/initialized" && this.upstream.connected) {
+        this.upstream.request(method, msg.params, this.opts.connectTimeoutMs ?? UPSTREAM_CONNECT_TIMEOUT_MS, false).catch(() => {
+          return;
+        });
+      }
+      return null;
+    }
+    switch (method) {
+      case "initialize":
+        return { jsonrpc: "2.0", id, result: this.initializeResult(msg.params) };
+      case "tools/list":
+        return { jsonrpc: "2.0", id, result: await this.toolsList(msg.params) };
+      case "tools/call":
+        return { jsonrpc: "2.0", id, result: await this.toolsCall(msg.params) };
+      case "ping":
+        return { jsonrpc: "2.0", id, result: {} };
+      default:
+        return this.forward(msg);
+    }
+  }
+  initializeResult(params) {
+    const requested = params?.protocolVersion;
+    const version2 = requested && SHIM_SUPPORTED_PROTOCOL_VERSIONS.includes(requested) ? requested : SHIM_SUPPORTED_PROTOCOL_VERSIONS[0];
+    return {
+      protocolVersion: version2,
+      capabilities: { tools: { listChanged: true } },
+      serverInfo: { name: "switchroom-hindsight-shim", version: "1.0.0" }
+    };
+  }
+  staleManifestServed = false;
+  notificationSink = () => {
+    return;
+  };
+  notifyIfRecovered() {
+    if (!this.staleManifestServed)
+      return;
+    this.staleManifestServed = false;
+    this.notificationSink({
+      jsonrpc: "2.0",
+      method: "notifications/tools/list_changed"
+    });
+  }
+  async toolsList(params) {
+    try {
+      const res = await this.upstream.request("tools/list", params ?? {}, this.opts.toolsListTimeoutMs ?? TOOLS_LIST_TIMEOUT_MS);
+      if (res.error)
+        throw new Error(res.error.message);
+      const result = res.result;
+      if (Array.isArray(result?.tools)) {
+        this.writeCache(result);
+        this.staleManifestServed = false;
+        return result;
+      }
+      throw new Error("upstream tools/list returned no tools array");
+    } catch (err) {
+      this.log(`[hindsight-shim] live tools/list failed (${String(err)}); serving ` + "cached/fallback manifest");
+      this.staleManifestServed = true;
+      return this.readCache() ?? buildFallbackToolsList();
+    }
+  }
+  async toolsCall(params) {
+    try {
+      const res = await this.upstream.request("tools/call", params, this.opts.toolsCallTimeoutMs ?? TOOLS_CALL_TIMEOUT_MS);
+      this.notifyIfRecovered();
+      if (res.error) {
+        return {
+          content: [
+            { type: "text", text: `Hindsight returned an error: ${res.error.message}` }
+          ],
+          isError: true
+        };
+      }
+      return res.result;
+    } catch (err) {
+      const name = params?.name ?? "unknown";
+      this.log(`[hindsight-shim] tools/call ${name} failed after retry: ${String(err)}`);
+      return {
+        content: [
+          {
+            type: "text",
+            text: "Hindsight memory is temporarily unavailable (backend at " + `${this.opts.url} is not reachable: ${String(err)}). ` + "This is transient - the shim reconnects automatically, so " + "simply retry this tool call shortly. Do not treat memory " + "as permanently lost."
+          }
+        ],
+        isError: true
+      };
+    }
+  }
+  async forward(msg) {
+    try {
+      const res = await this.upstream.request(msg.method, msg.params, this.opts.toolsListTimeoutMs ?? TOOLS_LIST_TIMEOUT_MS);
+      return { jsonrpc: "2.0", id: msg.id, result: res.result, ...res.error ? { error: res.error } : {} };
+    } catch (err) {
+      return {
+        jsonrpc: "2.0",
+        id: msg.id,
+        error: {
+          code: -32001,
+          message: `hindsight backend unavailable: ${String(err)}`
+        }
+      };
+    }
+  }
+  async run(input, output) {
+    this.notificationSink = (msg) => output.write(JSON.stringify(msg) + `
+`);
+    const rl = createInterface6({ input, crlfDelay: Infinity });
+    const inflight = new Set;
+    rl.on("line", (line) => {
+      const trimmed = line.trim();
+      if (!trimmed)
+        return;
+      let msg;
+      try {
+        msg = JSON.parse(trimmed);
+      } catch {
+        this.log(`[hindsight-shim] dropping non-JSON stdin line`);
+        return;
+      }
+      const task = (async () => {
+        try {
+          const res = await this.handle(msg);
+          if (res)
+            output.write(JSON.stringify(res) + `
+`);
+        } catch (err) {
+          this.log(`[hindsight-shim] handler threw: ${String(err)}`);
+          if (msg.id !== undefined && msg.id !== null) {
+            output.write(JSON.stringify({
+              jsonrpc: "2.0",
+              id: msg.id,
+              error: { code: -32603, message: `shim internal error: ${String(err)}` }
+            }) + `
+`);
+          }
+        }
+      })();
+      inflight.add(task);
+      task.finally(() => inflight.delete(task));
+    });
+    await new Promise((resolve51) => rl.on("close", resolve51));
+    while (inflight.size > 0) {
+      await Promise.allSettled([...inflight]);
+    }
+  }
+}
+function resolveShimOptionsFromEnv(env2) {
+  const home2 = env2.HOME && env2.HOME !== "/" ? env2.HOME : tmpdir5();
+  return {
+    url: env2.HINDSIGHT_MCP_URL || HINDSIGHT_DEFAULT_MCP_URL,
+    bankId: env2.HINDSIGHT_BANK_ID || "",
+    cacheDir: env2.HINDSIGHT_SHIM_CACHE_DIR || join81(home2, ".hindsight-shim")
+  };
+}
+function registerHindsightMcpShimCommand(program3) {
+  program3.command("hindsight-mcp-shim", { hidden: true }).description("Internal: lazy-connect stdio MCP proxy for the Hindsight memory " + "backend. Spawned as the `hindsight` MCP command inside agents.").action(async () => {
+    const shim = new HindsightShim(resolveShimOptionsFromEnv(process.env));
+    await shim.run(process.stdin, process.stdout);
+    process.exit(0);
+  });
+}
+
 // src/cli/deliver-file.ts
 init_client2();
-import { readFileSync as readFileSync70, statSync as statSync46 } from "node:fs";
+import { readFileSync as readFileSync71, statSync as statSync46 } from "node:fs";
 import { basename as basename11 } from "node:path";
 
 // src/delivery/onedrive.ts
@@ -90001,7 +90432,7 @@ async function defaultResolveProvider() {
 async function runDeliverFile(localPath, deps = {}) {
   const agentName = safeAgentName(deps.agentName ?? process.env.SWITCHROOM_AGENT_NAME);
   const sizeOf = deps.fileSize ?? ((p) => statSync46(p).size);
-  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync70(p)));
+  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync71(p)));
   const resolveProvider = deps.resolveProvider ?? defaultResolveProvider;
   let size;
   try {
@@ -90322,8 +90753,8 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync74, existsSync as existsSync87, readdirSync as readdirSync30 } from "node:fs";
-import { join as join85 } from "node:path";
+import { readFileSync as readFileSync75, existsSync as existsSync87, readdirSync as readdirSync30 } from "node:fs";
+import { join as join86 } from "node:path";
 import { homedir as homedir50 } from "node:os";
 
 // src/status-ask/report.ts
@@ -90598,7 +91029,7 @@ function runReport(opts) {
   for (const src of sources) {
     let content;
     try {
-      content = readFileSync74(src.path, "utf-8");
+      content = readFileSync75(src.path, "utf-8");
     } catch (err) {
       process.stderr.write(`status-ask report: cannot read ${src.path}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -90659,7 +91090,7 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join85(homedir50(), ".switchroom", "agents");
+    agentsDir = join86(homedir50(), ".switchroom", "agents");
   }
   if (!existsSync87(agentsDir))
     return [];
@@ -90671,7 +91102,7 @@ function resolveSources(explicitPath) {
     return [];
   }
   for (const name of entries) {
-    const path9 = join85(agentsDir, name, "runtime-metrics.jsonl");
+    const path9 = join86(agentsDir, name, "runtime-metrics.jsonl");
     if (existsSync87(path9)) {
       sources.push({ path: path9, agent: name });
     }
@@ -90704,43 +91135,43 @@ import {
   closeSync as closeSync14,
   existsSync as existsSync88,
   fsyncSync as fsyncSync8,
-  mkdirSync as mkdirSync49,
+  mkdirSync as mkdirSync50,
   openSync as openSync14,
   readdirSync as readdirSync31,
-  readFileSync as readFileSync75,
-  renameSync as renameSync20,
+  readFileSync as readFileSync76,
+  renameSync as renameSync21,
   statSync as statSync48,
   unlinkSync as unlinkSync18,
   writeSync as writeSync10
 } from "node:fs";
-import { join as join86, resolve as resolve53 } from "node:path";
+import { join as join87, resolve as resolve53 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
   const base = opts.root ? resolve53(opts.root, agent) : resolve53(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join86(base, "schedule.d");
-  const scheduleStagingDir = join86(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join86(base, "skills.d");
-  const skillsStagingDir = join86(skillsDir, STAGING_SUBDIR);
+  const scheduleDir = join87(base, "schedule.d");
+  const scheduleStagingDir = join87(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join87(base, "skills.d");
+  const skillsStagingDir = join87(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join86(base, ".lock"),
+    lockPath: join87(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
 function ensureDirs(paths) {
-  mkdirSync49(paths.scheduleDir, { recursive: true });
-  mkdirSync49(paths.scheduleStagingDir, { recursive: true });
+  mkdirSync50(paths.scheduleDir, { recursive: true });
+  mkdirSync50(paths.scheduleStagingDir, { recursive: true });
 }
 function ensureSkillsDirs(paths) {
-  mkdirSync49(paths.skillsDir, { recursive: true });
-  mkdirSync49(paths.skillsStagingDir, { recursive: true });
+  mkdirSync50(paths.skillsDir, { recursive: true });
+  mkdirSync50(paths.skillsStagingDir, { recursive: true });
 }
 function withAgentLock(paths, fn) {
-  mkdirSync49(paths.agentRoot, { recursive: true });
+  mkdirSync50(paths.agentRoot, { recursive: true });
   const start = Date.now();
   const TIMEOUT_MS = 5000;
   let fd = null;
@@ -90781,8 +91212,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join86(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join86(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join87(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join87(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync14(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
@@ -90790,7 +91221,7 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
     } finally {
       closeSync14(fd);
     }
-    renameSync20(stagingPath, finalPath);
+    renameSync21(stagingPath, finalPath);
     return finalPath;
   });
 }
@@ -90798,8 +91229,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join86(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join86(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join87(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join87(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync14(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
@@ -90807,14 +91238,14 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
     } finally {
       closeSync14(fd);
     }
-    renameSync20(stagingPath, finalPath);
+    renameSync21(stagingPath, finalPath);
     return finalPath;
   });
 }
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join86(paths.skillsDir, `${slug}.yaml`);
+    const finalPath = join87(paths.skillsDir, `${slug}.yaml`);
     if (!existsSync88(finalPath))
       return false;
     unlinkSync18(finalPath);
@@ -90829,9 +91260,9 @@ function listSkillsOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync31(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join86(paths.skillsDir, name);
+    const full = join87(paths.skillsDir, name);
     try {
-      const raw = readFileSync75(full, "utf-8");
+      const raw = readFileSync76(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -90841,7 +91272,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join86(paths.scheduleDir, `${slug}.yaml`);
+    const finalPath = join87(paths.scheduleDir, `${slug}.yaml`);
     if (!existsSync88(finalPath))
       return false;
     unlinkSync18(finalPath);
@@ -90856,9 +91287,9 @@ function listOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync31(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join86(paths.scheduleDir, name);
+    const full = join87(paths.scheduleDir, name);
     try {
-      const raw = readFileSync75(full, "utf-8");
+      const raw = readFileSync76(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -91080,25 +91511,25 @@ import {
   closeSync as closeSync15,
   existsSync as existsSync89,
   fsyncSync as fsyncSync9,
-  mkdirSync as mkdirSync50,
+  mkdirSync as mkdirSync51,
   openSync as openSync15,
   readdirSync as readdirSync32,
-  readFileSync as readFileSync76,
-  renameSync as renameSync21,
+  readFileSync as readFileSync77,
+  renameSync as renameSync22,
   unlinkSync as unlinkSync19,
-  writeFileSync as writeFileSync31,
+  writeFileSync as writeFileSync32,
   writeSync as writeSync11
 } from "node:fs";
-import { join as join87 } from "node:path";
+import { join as join88 } from "node:path";
 import { randomBytes as randomBytes15 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join87(paths.scheduleDir, ".pending");
+  return join88(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  mkdirSync50(dir, { recursive: true });
+  mkdirSync51(dir, { recursive: true });
   return dir;
 }
 function newStageId() {
@@ -91107,8 +91538,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join87(dir, `${stageId}.yaml`);
-  const metaPath = join87(dir, `${stageId}.meta.json`);
+  const yamlPath = join88(dir, `${stageId}.yaml`);
+  const metaPath = join88(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -91127,9 +91558,9 @@ function stagePendingScheduleEntry(opts) {
     } finally {
       closeSync15(fd);
     }
-    renameSync21(yamlTmp, yamlPath);
+    renameSync22(yamlTmp, yamlPath);
   }
-  writeFileSync31(metaPath, JSON.stringify(meta, null, 2) + `
+  writeFileSync32(metaPath, JSON.stringify(meta, null, 2) + `
 `, { mode: 384 });
   return { stageId, yamlPath, metaPath };
 }
@@ -91142,12 +91573,12 @@ function listPendingScheduleEntries(agent, opts = {}) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join87(dir, name);
-    const yamlPath = join87(dir, `${stageId}.yaml`);
+    const metaPath = join88(dir, name);
+    const yamlPath = join88(dir, `${stageId}.yaml`);
     if (!existsSync89(yamlPath))
       continue;
     try {
-      const meta = JSON.parse(readFileSync76(metaPath, "utf-8"));
+      const meta = JSON.parse(readFileSync77(metaPath, "utf-8"));
       if (meta?.v !== 1 || typeof meta.stage_id !== "string")
         continue;
       out.push({ stageId: meta.stage_id, agent: meta.agent, yamlPath, metaPath, meta });
@@ -91162,11 +91593,11 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join87(paths.scheduleDir, `${slug}.yaml`);
+  const finalPath = join88(paths.scheduleDir, `${slug}.yaml`);
   if (existsSync89(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
-  renameSync21(match.yamlPath, finalPath);
+  renameSync22(match.yamlPath, finalPath);
   unlinkSync19(match.metaPath);
   return { committed: true, path: finalPath, slug };
 }
@@ -91185,7 +91616,7 @@ function denyPendingScheduleEntry(opts) {
 }
 
 // src/cli/agent-config-write.ts
-import { existsSync as existsSync90, readFileSync as readFileSync77 } from "node:fs";
+import { existsSync as existsSync90, readFileSync as readFileSync78 } from "node:fs";
 import { execFileSync as execFileSync28 } from "node:child_process";
 
 // src/scheduler/schedule-report.ts
@@ -91576,7 +92007,7 @@ function scheduleRemove(opts) {
   let priorContent = null;
   try {
     if (existsSync90(match.path))
-      priorContent = readFileSync77(match.path, "utf-8");
+      priorContent = readFileSync78(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
   const reconcileFn = opts.reconcile === undefined ? opts.root ? null : reconcileAgentCronOnly : opts.reconcile;
@@ -91779,7 +92210,7 @@ function registerAgentConfigWriteCommands(program3) {
     }
     let blob;
     if (opts.jsonl) {
-      blob = existsSync90(opts.jsonl) ? readFileSync77(opts.jsonl, "utf-8") : "";
+      blob = existsSync90(opts.jsonl) ? readFileSync78(opts.jsonl, "utf-8") : "";
     } else {
       try {
         blob = execFileSync28("docker", ["exec", `switchroom-${agent}`, "cat", "/state/agent/scheduler.jsonl"], {
@@ -91815,7 +92246,7 @@ import { existsSync as existsSync91 } from "node:fs";
 init_reconcile_default_skills();
 init_agent_config();
 var import_yaml23 = __toESM(require_dist(), 1);
-import { join as join88 } from "node:path";
+import { join as join89 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -91890,7 +92321,7 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join88(poolDir, skillName);
+  const skillPath = join89(poolDir, skillName);
   if (!existsSync91(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
@@ -92057,19 +92488,19 @@ import {
   closeSync as closeSync16,
   existsSync as existsSync92,
   lstatSync as lstatSync11,
-  mkdirSync as mkdirSync51,
+  mkdirSync as mkdirSync52,
   mkdtempSync as mkdtempSync5,
   openSync as openSync16,
-  readFileSync as readFileSync78,
+  readFileSync as readFileSync79,
   readdirSync as readdirSync33,
   realpathSync as realpathSync7,
-  renameSync as renameSync22,
+  renameSync as renameSync23,
   rmSync as rmSync18,
   statSync as statSync49,
-  writeFileSync as writeFileSync32
+  writeFileSync as writeFileSync33
 } from "node:fs";
-import { tmpdir as tmpdir5, homedir as homedir51 } from "node:os";
-import { dirname as dirname31, join as join89, relative as relative2, resolve as resolve54 } from "node:path";
+import { tmpdir as tmpdir6, homedir as homedir51 } from "node:os";
+import { dirname as dirname31, join as join90, relative as relative2, resolve as resolve54 } from "node:path";
 import { spawnSync as spawnSync16 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -92303,7 +92734,7 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join89(homedir51(), raw.slice(2));
+    return join90(homedir51(), raw.slice(2));
   }
   if (raw === "~")
     return homedir51();
@@ -92342,7 +92773,7 @@ function loadFromDir(dir) {
   const walk2 = (sub) => {
     const entries = readdirSync33(sub, { withFileTypes: true });
     for (const ent of entries) {
-      const full = join89(sub, ent.name);
+      const full = join90(sub, ent.name);
       const rel = relative2(abs, full);
       if (ent.isSymbolicLink()) {
         fail3(`refusing to read symlink inside --from dir: ${rel}`);
@@ -92352,7 +92783,7 @@ function loadFromDir(dir) {
         continue;
       }
       if (ent.isFile()) {
-        const buf = readFileSync78(full);
+        const buf = readFileSync79(full);
         files[rel.replace(/\\/g, "/")] = buf.toString("utf-8");
       }
     }
@@ -92377,7 +92808,7 @@ function loadFromTarball(tarPath) {
       fail3(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
-  const staging = mkdtempSync5(join89(tmpdir5(), "skill-apply-extract-"));
+  const staging = mkdtempSync5(join90(tmpdir6(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
     const r = spawnSync16("tar", [
@@ -92401,7 +92832,7 @@ function loadFromTarball(tarPath) {
   }
 }
 function loadSingleFile(filePath) {
-  const content = readFileSync78(filePath, "utf-8");
+  const content = readFileSync79(filePath, "utf-8");
   return { "SKILL.md": content };
 }
 function loadFromStdin() {
@@ -92463,10 +92894,10 @@ function validatePayload(name, files) {
           errors2.push(`${path9} fails \`bash -n\` syntax check: ${(r.stderr ?? "").trim()}`);
         }
       } else if (PY_SCRIPT_RE2.test(path9)) {
-        const tmp = mkdtempSync5(join89(tmpdir5(), "skill-apply-py-"));
-        const tmpPy = join89(tmp, "check.py");
+        const tmp = mkdtempSync5(join90(tmpdir6(), "skill-apply-py-"));
+        const tmpPy = join90(tmp, "check.py");
         try {
-          writeFileSync32(tmpPy, content);
+          writeFileSync33(tmpPy, content);
           const r = spawnSync16("python3", ["-m", "py_compile", tmpPy], {
             encoding: "utf-8"
           });
@@ -92487,12 +92918,12 @@ function diffSummary(currentDir, files) {
   if (existsSync92(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync33(sub, { withFileTypes: true })) {
-        const full = join89(sub, ent.name);
+        const full = join90(sub, ent.name);
         const rel = relative2(currentDir, full);
         if (ent.isDirectory()) {
           walk2(full);
         } else if (ent.isFile()) {
-          currentFiles[rel.replace(/\\/g, "/")] = readFileSync78(full, "utf-8");
+          currentFiles[rel.replace(/\\/g, "/")] = readFileSync79(full, "utf-8");
         }
       }
     };
@@ -92521,9 +92952,9 @@ function diffSummary(currentDir, files) {
 }
 function writePayload(poolDir, name, files) {
   if (!existsSync92(poolDir)) {
-    mkdirSync51(poolDir, { recursive: true, mode: 493 });
+    mkdirSync52(poolDir, { recursive: true, mode: 493 });
   }
-  const target = join89(poolDir, name);
+  const target = join90(poolDir, name);
   let targetIsSymlink = false;
   try {
     const st = lstatSync11(target);
@@ -92534,15 +92965,15 @@ function writePayload(poolDir, name, files) {
   if (targetIsSymlink) {
     fail3(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
-  const staging = mkdtempSync5(join89(poolDir, `.skill-apply-stage-${name}-`));
+  const staging = mkdtempSync5(join90(poolDir, `.skill-apply-stage-${name}-`));
   let oldRename = null;
   try {
     for (const [path9, content] of Object.entries(files)) {
-      const full = join89(staging, path9);
-      mkdirSync51(dirname31(full), { recursive: true, mode: 493 });
+      const full = join90(staging, path9);
+      mkdirSync52(dirname31(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
-        writeFileSync32(fd, content);
+        writeFileSync33(fd, content);
       } finally {
         closeSync16(fd);
       }
@@ -92558,9 +92989,9 @@ function writePayload(poolDir, name, files) {
     } catch {}
     if (targetExists) {
       oldRename = `${target}.skill-apply-old-${Date.now()}`;
-      renameSync22(target, oldRename);
+      renameSync23(target, oldRename);
     }
-    renameSync22(staging, target);
+    renameSync23(staging, target);
     if (oldRename) {
       rmSync18(oldRename, { recursive: true, force: true });
       oldRename = null;
@@ -92574,7 +93005,7 @@ function writePayload(poolDir, name, files) {
         if (existsSync92(target)) {
           rmSync18(target, { recursive: true, force: true });
         }
-        renameSync22(oldRename, target);
+        renameSync23(oldRename, target);
       } catch {}
     }
     throw err2;
@@ -92616,7 +93047,7 @@ function registerSkillCommand(program3) {
     }
     const config = loadConfig();
     const poolDir = resolveSkillsPoolDir2(config.switchroom?.skills_dir);
-    const currentDir = join89(poolDir, name);
+    const currentDir = join90(poolDir, name);
     console.log(source_default.bold(`Skill: ${name}`) + source_default.gray(` (${Object.keys(files).length} files, ${sumBytes(files)} bytes)`));
     console.log(source_default.bold("Diff vs current pool content:"));
     console.log(diffSummary(currentDir, files));
@@ -92650,19 +93081,19 @@ import {
   closeSync as closeSync17,
   existsSync as existsSync93,
   lstatSync as lstatSync12,
-  mkdirSync as mkdirSync52,
+  mkdirSync as mkdirSync53,
   mkdtempSync as mkdtempSync6,
   openSync as openSync17,
-  readFileSync as readFileSync79,
+  readFileSync as readFileSync80,
   readdirSync as readdirSync34,
-  renameSync as renameSync23,
+  renameSync as renameSync24,
   rmSync as rmSync19,
   statSync as statSync50,
   utimesSync,
-  writeFileSync as writeFileSync33
+  writeFileSync as writeFileSync34
 } from "node:fs";
-import { dirname as dirname32, join as join90, relative as relative3, resolve as resolve55 } from "node:path";
-import { homedir as homedir52, tmpdir as tmpdir6 } from "node:os";
+import { dirname as dirname32, join as join91, relative as relative3, resolve as resolve55 } from "node:path";
+import { homedir as homedir52, tmpdir as tmpdir7 } from "node:os";
 import { spawnSync as spawnSync17 } from "node:child_process";
 init_helpers();
 init_agent_config();
@@ -92673,10 +93104,10 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve55(override) : join90(homedir52(), ".switchroom-config");
+  const candidate = override ? resolve55(override) : join91(homedir52(), ".switchroom-config");
   if (!existsSync93(candidate))
     return null;
-  return join90(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
+  return join91(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
@@ -92694,7 +93125,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync19(join90(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync19(join91(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -92703,7 +93134,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   const configSkillsRoot = resolveConfigSkillsDir(agent);
   if (!configSkillsRoot)
     return;
-  const dest = join90(configSkillsRoot, name);
+  const dest = join91(configSkillsRoot, name);
   try {
     if (liveSkillDir !== null) {
       try {
@@ -92718,34 +93149,34 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
       if (existsSync93(dest)) {
-        const trash = join90(configSkillsRoot, `.${name}-trash-${Date.now()}`);
-        renameSync23(dest, trash);
+        const trash = join91(configSkillsRoot, `.${name}-trash-${Date.now()}`);
+        renameSync24(dest, trash);
       }
       return;
     }
-    mkdirSync52(configSkillsRoot, { recursive: true, mode: 493 });
+    mkdirSync53(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
-    const staging = mkdtempSync6(join90(configSkillsRoot, `.${name}-staging-`));
+    const staging = mkdtempSync6(join91(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
-      mkdirSync52(dst, { recursive: true, mode: 493 });
+      mkdirSync53(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync34(src, { withFileTypes: true })) {
-        const s = join90(src, ent.name);
-        const d = join90(dst, ent.name);
+        const s = join91(src, ent.name);
+        const d = join91(dst, ent.name);
         if (ent.isSymbolicLink())
           continue;
         if (ent.isDirectory())
           walk2(s, d);
         else if (ent.isFile()) {
-          writeFileSync33(d, readFileSync79(s));
+          writeFileSync34(d, readFileSync80(s));
         }
       }
     };
     walk2(liveSkillDir, staging);
     if (existsSync93(dest)) {
-      const prior = join90(configSkillsRoot, `.${name}-prior-${Date.now()}`);
-      renameSync23(dest, prior);
+      const prior = join91(configSkillsRoot, `.${name}-prior-${Date.now()}`);
+      renameSync24(dest, prior);
     }
-    renameSync23(staging, dest);
+    renameSync24(staging, dest);
   } catch (err2) {
     process.stderr.write(source_default.yellow(`warning: mirror to ${dest} failed (${err2.message ?? err2}); ` + `live copy still works, but this skill is not version-controlled until next successful sync.
 `));
@@ -92772,16 +93203,16 @@ function resolveAgent(opts) {
 function resolveAgentsRoot(opts) {
   if (opts.root)
     return resolve55(opts.root);
-  return join90(homedir52(), ".switchroom", "agents");
+  return join91(homedir52(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
-  return join90(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
+  return join91(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
 }
 function trashDir(agentsRoot, agent) {
-  return join90(agentsRoot, agent, ".claude", TRASH_DIRNAME);
+  return join91(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
 function countPersonalSkills(agentsRoot, agent) {
-  const skillsDir = join90(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join91(agentsRoot, agent, ".claude", "skills");
   if (!existsSync93(skillsDir))
     return 0;
   let n = 0;
@@ -92819,7 +93250,7 @@ function loadFromDir2(dir) {
   const files = {};
   const walk2 = (sub) => {
     for (const ent of readdirSync34(sub, { withFileTypes: true })) {
-      const full = join90(sub, ent.name);
+      const full = join91(sub, ent.name);
       if (ent.isSymbolicLink()) {
         fail4(`refusing to read symlink in --from dir: ${relative3(abs, full)}`);
       }
@@ -92829,7 +93260,7 @@ function loadFromDir2(dir) {
       }
       if (ent.isFile()) {
         const rel = relative3(abs, full).replace(/\\/g, "/");
-        files[rel] = readFileSync79(full, "utf-8");
+        files[rel] = readFileSync80(full, "utf-8");
       }
     }
   };
@@ -92872,10 +93303,10 @@ function behavioralValidate(files) {
         errors2.push(`${path9} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
     } else if (PY_SCRIPT_RE.test(path9)) {
-      const tmp = mkdtempSync6(join90(tmpdir6(), "skill-personal-py-"));
-      const tmpPy = join90(tmp, "check.py");
+      const tmp = mkdtempSync6(join91(tmpdir7(), "skill-personal-py-"));
+      const tmpPy = join91(tmp, "check.py");
       try {
-        writeFileSync33(tmpPy, content);
+        writeFileSync34(tmpPy, content);
         const r = spawnSync17("python3", ["-m", "py_compile", tmpPy], {
           encoding: "utf-8"
         });
@@ -92897,7 +93328,7 @@ function sweepTrash(agentsRoot, agent) {
   for (const ent of readdirSync34(trash, { withFileTypes: true })) {
     if (!ent.isDirectory())
       continue;
-    const entPath = join90(trash, ent.name);
+    const entPath = join91(trash, ent.name);
     try {
       const st = statSync50(entPath);
       if (now - st.mtimeMs > TRASH_TTL_MS) {
@@ -92917,16 +93348,16 @@ function writePersonalSkill(targetDir, files) {
   if (targetIsSymlink) {
     fail4(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
-  mkdirSync52(dirname32(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join90(dirname32(targetDir), `.skill-personal-stage-`));
+  mkdirSync53(dirname32(targetDir), { recursive: true, mode: 493 });
+  const staging = mkdtempSync6(join91(dirname32(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path9, content] of Object.entries(files)) {
-      const full = join90(staging, path9);
-      mkdirSync52(dirname32(full), { recursive: true, mode: 493 });
+      const full = join91(staging, path9);
+      mkdirSync53(dirname32(full), { recursive: true, mode: 493 });
       const fd = openSync17(full, "wx");
       try {
-        writeFileSync33(fd, content);
+        writeFileSync34(fd, content);
       } finally {
         closeSync17(fd);
       }
@@ -92942,9 +93373,9 @@ function writePersonalSkill(targetDir, files) {
     } catch {}
     if (targetExists) {
       oldRename = `${targetDir}.personal-old-${Date.now()}`;
-      renameSync23(targetDir, oldRename);
+      renameSync24(targetDir, oldRename);
     }
-    renameSync23(staging, targetDir);
+    renameSync24(staging, targetDir);
     if (oldRename) {
       rmSync19(oldRename, { recursive: true, force: true });
       oldRename = null;
@@ -92958,7 +93389,7 @@ function writePersonalSkill(targetDir, files) {
         if (existsSync93(targetDir)) {
           rmSync19(targetDir, { recursive: true, force: true });
         }
-        renameSync23(oldRename, targetDir);
+        renameSync24(oldRename, targetDir);
       } catch {}
     }
     throw err2;
@@ -93029,7 +93460,7 @@ function loadFiles(opts) {
     return loadFromDir2(p);
   }
   if (p.endsWith(".md")) {
-    return { "SKILL.md": readFileSync79(p, "utf-8") };
+    return { "SKILL.md": readFileSync80(p, "utf-8") };
   }
   fail4(`--from must be a directory or a .md file. Got: ${opts.from}`);
 }
@@ -93069,10 +93500,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join90(homedir52(), ".switchroom", "skills");
+  return join91(homedir52(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join90(homedir52(), ".switchroom", "skills", "_bundled");
+  return join91(homedir52(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -93082,7 +93513,7 @@ function resolveCloneSource(source, opts) {
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
-  const dir = join90(root, slug);
+  const dir = join91(root, slug);
   if (!existsSync93(dir)) {
     fail4(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
@@ -93098,7 +93529,7 @@ function readSourceFiles(dir) {
   const skipped = [];
   const walk2 = (sub) => {
     for (const ent of readdirSync34(sub, { withFileTypes: true })) {
-      const full = join90(sub, ent.name);
+      const full = join91(sub, ent.name);
       if (ent.isSymbolicLink()) {
         continue;
       }
@@ -93118,7 +93549,7 @@ function readSourceFiles(dir) {
             fail4(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
           }
         } catch {}
-        files[rel] = readFileSync79(full, "utf-8");
+        files[rel] = readFileSync80(full, "utf-8");
       }
     }
   };
@@ -93207,10 +93638,10 @@ function removePersonalAction(name, opts) {
     throw err2;
   }
   const trashRoot2 = trashDir(agentsRoot, agent);
-  mkdirSync52(trashRoot2, { recursive: true, mode: 493 });
+  mkdirSync53(trashRoot2, { recursive: true, mode: 493 });
   const ts = Date.now();
-  const trashTarget = join90(trashRoot2, `${name}-${ts}`);
-  renameSync23(target, trashTarget);
+  const trashTarget = join91(trashRoot2, `${name}-${ts}`);
+  renameSync24(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
   mirrorToConfigRepo(agent, name, null);
@@ -93228,7 +93659,7 @@ function listPersonalAction(opts) {
   const agent = resolveAgent(opts);
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
-  const skillsDir = join90(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join91(agentsRoot, agent, ".claude", "skills");
   const personal = [];
   if (existsSync93(skillsDir)) {
     for (const ent of readdirSync34(skillsDir, { withFileTypes: true })) {
@@ -93237,7 +93668,7 @@ function listPersonalAction(opts) {
       if (!ent.name.startsWith(PERSONAL_PREFIX))
         continue;
       const skillName = ent.name.slice(PERSONAL_PREFIX.length);
-      const skillPath = join90(skillsDir, ent.name);
+      const skillPath = join91(skillsDir, ent.name);
       let fileCount = 0;
       let totalBytes = 0;
       const walk2 = (sub) => {
@@ -93245,10 +93676,10 @@ function listPersonalAction(opts) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync50(join90(sub, e.name)).size;
+              totalBytes += statSync50(join91(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
-            walk2(join90(sub, e.name));
+            walk2(join91(sub, e.name));
           }
         }
       };
@@ -93287,11 +93718,11 @@ function registerSkillPersonalCommands(program3) {
 // src/cli/self-improve-propose-skill.ts
 import { createConnection as createConnection4 } from "node:net";
 import { homedir as homedir53 } from "node:os";
-import { join as join91 } from "node:path";
-import { readFileSync as readFileSync80 } from "node:fs";
+import { join as join92 } from "node:path";
+import { readFileSync as readFileSync81 } from "node:fs";
 var IPC_CONNECT_TIMEOUT_MS = 5000;
 function gatewaySocketPath() {
-  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join91(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join91(homedir53(), ".claude", "channels", "telegram", "gateway.sock"));
+  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join92(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join92(homedir53(), ".claude", "channels", "telegram", "gateway.sock"));
 }
 function fail5(msg, code = 1) {
   console.error(msg);
@@ -93326,7 +93757,7 @@ function registerSelfImproveProposeSkillCommand(program3) {
       fail5("agent name required (--agent or $SWITCHROOM_AGENT_NAME)");
     let draft;
     try {
-      draft = JSON.parse(readFileSync80(opts.draft, "utf-8"));
+      draft = JSON.parse(readFileSync81(opts.draft, "utf-8"));
     } catch (e) {
       fail5(`failed to read/parse --draft: ${e.message}`);
     }
@@ -93363,9 +93794,9 @@ function registerSelfImproveProposeSkillCommand(program3) {
 init_esm();
 init_helpers();
 var import_yaml25 = __toESM(require_dist(), 1);
-import { existsSync as existsSync94, readdirSync as readdirSync35, readFileSync as readFileSync81, statSync as statSync51 } from "node:fs";
+import { existsSync as existsSync94, readdirSync as readdirSync35, readFileSync as readFileSync82, statSync as statSync51 } from "node:fs";
 import { homedir as homedir54 } from "node:os";
-import { join as join92, resolve as resolve56 } from "node:path";
+import { join as join93, resolve as resolve56 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
@@ -93379,12 +93810,12 @@ function defaultBundledRoot2() {
   return resolve56(homedir54(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join92(skillDir, "SKILL.md");
+  const mdPath = join93(skillDir, "SKILL.md");
   if (!existsSync94(mdPath))
     return null;
   let content;
   try {
-    content = readFileSync81(mdPath, "utf-8");
+    content = readFileSync82(mdPath, "utf-8");
   } catch {
     return null;
   }
@@ -93412,7 +93843,7 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join92(skillDir, "SKILL.md");
+  const mdPath = join93(skillDir, "SKILL.md");
   try {
     const st = statSync51(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
@@ -93423,7 +93854,7 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join92(agentsRoot, agent, ".claude/skills");
+  const skillsDir = join93(agentsRoot, agent, ".claude/skills");
   if (!existsSync94(skillsDir))
     return [];
   const out = [];
@@ -93436,7 +93867,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join92(skillsDir, ent);
+    const dirPath = join93(skillsDir, ent);
     try {
       if (!statSync51(dirPath).isDirectory())
         continue;
@@ -93476,7 +93907,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join92(sharedRoot, ent);
+    const dirPath = join93(sharedRoot, ent);
     try {
       if (!statSync51(dirPath).isDirectory())
         continue;
@@ -93512,7 +93943,7 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join92(bundledRoot, ent);
+    const dirPath = join93(bundledRoot, ent);
     try {
       if (!statSync51(dirPath).isDirectory())
         continue;
@@ -93659,17 +94090,17 @@ init_helpers();
 init_operator_uid();
 import {
   existsSync as existsSync96,
-  mkdirSync as mkdirSync53,
+  mkdirSync as mkdirSync54,
   readdirSync as readdirSync36,
-  readFileSync as readFileSync83,
-  writeFileSync as writeFileSync34,
+  readFileSync as readFileSync84,
+  writeFileSync as writeFileSync35,
   statSync as statSync52,
   lstatSync as lstatSync13,
   realpathSync as realpathSync8,
   copyFileSync as copyFileSync13
 } from "node:fs";
 import { homedir as homedir55 } from "node:os";
-import { join as join93 } from "node:path";
+import { join as join94 } from "node:path";
 import { spawnSync as spawnSync20 } from "node:child_process";
 
 // src/cli/singleton-stale-cleanup.ts
@@ -94018,7 +94449,7 @@ function resolveHostdHostHome(env2 = process.env, home2 = homedir55()) {
   return resolved;
 }
 function resolveHostdSkillsTarget(hostHome) {
-  const skillsPath = join93(hostHome, ".switchroom", "skills");
+  const skillsPath = join94(hostHome, ".switchroom", "skills");
   let st;
   try {
     st = lstatSync13(skillsPath);
@@ -94042,10 +94473,10 @@ function resolveHostdSkillsTarget(hostHome) {
   return target;
 }
 function hostdDir() {
-  return join93(homedir55(), ".switchroom", "hostd");
+  return join94(homedir55(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join93(hostdDir(), "docker-compose.yml");
+  return join94(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
@@ -94082,7 +94513,7 @@ async function doInstall(opts, program3) {
   }
   const dir = hostdDir();
   const composePath = hostdComposePath();
-  mkdirSync53(dir, { recursive: true });
+  mkdirSync54(dir, { recursive: true });
   const imageTag = resolveHostdImageTag(opts.tag, cfg.release);
   const guard = checkDowngrade({
     container: "switchroom-hostd",
@@ -94115,7 +94546,7 @@ async function doInstall(opts, program3) {
   const bak = backupExistingCompose();
   if (bak)
     console.log(source_default.dim(`  Backed up existing compose to ${bak}`));
-  writeFileSync34(composePath, yaml, "utf8");
+  writeFileSync35(composePath, yaml, "utf8");
   console.log(source_default.green(`  \u2713 Wrote ${composePath}`));
   const adminAgents = Object.entries(cfg.agents ?? {}).filter(([, a]) => a?.admin === true).map(([name]) => name);
   console.log(source_default.dim(`    agents served (one socket each): ${allAgents.length === 0 ? "(none)" : allAgents.join(", ")}`));
@@ -94174,7 +94605,7 @@ function doStatus() {
       for (const name of readdirSync36(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join93(dir, name, "sock");
+        const sockPath = join94(dir, name, "sock");
         if (existsSync96(sockPath)) {
           const st = statSync52(sockPath);
           if ((st.mode & 61440) === 49152) {
@@ -94223,7 +94654,7 @@ function registerHostdCommand(program3) {
 The log is created when hostd handles its first privileged-verb request.`));
       return;
     }
-    const raw = readFileSync83(logPath, "utf-8");
+    const raw = readFileSync84(logPath, "utf-8");
     const limit = Math.max(1, parseInt(opts.tail ?? "50", 10) || 50);
     const filters = {
       agent: opts.agent,
@@ -94266,9 +94697,9 @@ The log is created when hostd handles its first privileged-verb request.`));
 init_source();
 init_helpers();
 init_operator_uid();
-import { chownSync as chownSync9, existsSync as existsSync97, mkdirSync as mkdirSync54, writeFileSync as writeFileSync35, copyFileSync as copyFileSync14 } from "node:fs";
+import { chownSync as chownSync9, existsSync as existsSync97, mkdirSync as mkdirSync55, writeFileSync as writeFileSync36, copyFileSync as copyFileSync14 } from "node:fs";
 import { homedir as homedir56 } from "node:os";
-import { join as join94 } from "node:path";
+import { join as join95 } from "node:path";
 import { spawnSync as spawnSync21 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
@@ -94287,7 +94718,7 @@ function resolveWebHostHome(env2 = process.env, home2 = homedir56()) {
 }
 var WEB_COMPOSE_PROJECT = "switchroom-web";
 function renderWebComposeFile(opts) {
-  const { hostHome, imageTag, operatorUid } = opts;
+  const { hostHome, imageTag, operatorUid, port } = opts;
   return `# AUTO-GENERATED by \`switchroom webd install\` \u2014 do not hand-edit.
 # Edits land at \`switchroom webd install\` time; backed up to
 # docker-compose.yml.bak-<ts> on overwrite.
@@ -94302,13 +94733,18 @@ services:
     image: ghcr.io/switchroom/switchroom-web:${imageTag}
     container_name: switchroom-web
     restart: always
-    # The server MUST own host loopback 127.0.0.1:8080 \u2014 the cloudflared
+    # The server MUST own host loopback 127.0.0.1:${port} \u2014 the cloudflared
     # tunnel (GitHub webhooks) and \`tailscale serve\` (dashboard) both
     # reach it there, and the dashboard CSRF gate trusts the
     # Tailscale-User-Login header only when the request arrives on
     # loopback (PR #1380). Host networking makes the container's
     # 127.0.0.1 the host loopback, so both keep working unchanged.
     network_mode: host
+    # Listen port comes from \`web_service.port\` in switchroom.yaml
+    # (default 8080) \u2014 overriding the image CMD here is what lets a
+    # custom port survive \`switchroom update\`'s compose regeneration.
+    # Point cloudflared / tailscale serve at the same port if changed.
+    command: ["switchroom", "web", "--port", "${port}", "--bind", "127.0.0.1"]
     # The webhook.sock forward is peercred-gated by each agent's gateway
     # to {agent uid, SWITCHROOM_WEBHOOK_RECEIVER_UID = operator uid}.
     # Run as any other uid \u2192 every forward is 503'd. Operator uid also
@@ -94363,10 +94799,10 @@ services:
 `;
 }
 function webdDir() {
-  return join94(homedir56(), ".switchroom", "web");
+  return join95(homedir56(), ".switchroom", "web");
 }
 function webdComposePath() {
-  return join94(webdDir(), "docker-compose.yml");
+  return join95(webdDir(), "docker-compose.yml");
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
@@ -94395,9 +94831,10 @@ async function doInstall2(opts, program3) {
   }
   const dir = webdDir();
   const composePath = webdComposePath();
-  mkdirSync54(dir, { recursive: true });
+  mkdirSync55(dir, { recursive: true });
   const cfg = getConfig(program3);
   const imageTag = resolveWebImageTag(opts.tag, cfg.release);
+  const port = cfg.web_service?.port ?? 8080;
   const guard = checkDowngrade({
     container: "switchroom-web",
     targetTag: imageTag,
@@ -94417,7 +94854,8 @@ async function doInstall2(opts, program3) {
   const yaml = renderWebComposeFile({
     hostHome,
     imageTag,
-    operatorUid
+    operatorUid,
+    port
   });
   if (opts.dryRun) {
     console.log(source_default.dim(`# Would write: ${composePath}`));
@@ -94428,7 +94866,7 @@ async function doInstall2(opts, program3) {
   const bak = backupExistingCompose2();
   if (bak)
     console.log(source_default.dim(`  Backed up existing compose to ${bak}`));
-  writeFileSync35(composePath, yaml, "utf8");
+  writeFileSync36(composePath, yaml, "utf8");
   try {
     if (typeof process.geteuid === "function" && process.geteuid() === 0) {
       chownSync9(dir, operatorUid, operatorUid);
@@ -94438,7 +94876,7 @@ async function doInstall2(opts, program3) {
     }
   } catch {}
   console.log(source_default.green(`  \u2713 Wrote ${composePath}`));
-  console.log(source_default.dim(`    running as uid ${operatorUid} (operator), network_mode: host`));
+  console.log(source_default.dim(`    running as uid ${operatorUid} (operator), network_mode: host, listening on 127.0.0.1:${port}`));
   console.log(source_default.dim(`    Pulling ghcr.io/switchroom/switchroom-web:${imageTag}\u2026`));
   const pull = runDocker2(["compose", "-p", WEB_COMPOSE_PROJECT, "-f", composePath, "pull"]);
   if (!pull.ok) {
@@ -94461,7 +94899,8 @@ ${up.stderr}`));
   console.log(source_default.dim(`    Logs: docker logs switchroom-web --tail 50`));
   console.log(source_default.dim(`    Verify: switchroom webd status`));
   console.log(source_default.yellow(`    NOTE: the switchroom-web.service systemd unit (if still installed) also
-` + `    binds 127.0.0.1:8080. Stop it before this container can claim the port:
+` + `    binds 127.0.0.1:8080. Stop it before this container can claim the port
+` + `    (the container listens on 127.0.0.1:${port}, from web_service.port):
 ` + `        systemctl --user stop switchroom-web.service
 ` + `        systemctl --user disable switchroom-web.service`));
 }
@@ -94523,9 +94962,9 @@ function registerWebdCommand(program3) {
 // src/cli/host-repair.ts
 init_source();
 import { homedir as homedir57 } from "node:os";
-import { join as join95 } from "node:path";
+import { join as join96 } from "node:path";
 var ARTIFACT_ALLOWLIST = {
-  dockerComposePluginDir: (home2) => join95(home2, ".docker", "cli-plugins", "docker-compose"),
+  dockerComposePluginDir: (home2) => join96(home2, ".docker", "cli-plugins", "docker-compose"),
   stateSentinel: "/state"
 };
 function isStateBogusAutoDir(probe2) {
@@ -95016,6 +95455,7 @@ registerDriveCommand(program3);
 registerDriveMcpLauncherCommand(program3);
 registerM365McpLauncherCommand(program3);
 registerNotionMcpLauncherCommand(program3);
+registerHindsightMcpShimCommand(program3);
 registerDeliverFileCommand(program3);
 registerNotionCommand(program3);
 registerApplyCommand(program3);