switchroom 0.18.9 → 0.18.11

package/dist/host-control/main.js

@@ -9966,7 +9966,7 @@ var require_util = __commonJS((exports) => {
     return path;
   }
   exports.normalize = normalize;
-  function join2(aRoot, aPath) {
+  function join3(aRoot, aPath) {
     if (aRoot === "") {
       aRoot = ".";
     }
@@ -9998,7 +9998,7 @@ var require_util = __commonJS((exports) => {
     }
     return joined;
   }
-  exports.join = join2;
+  exports.join = join3;
   exports.isAbsolute = function(aPath) {
     return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
   };
@@ -10171,7 +10171,7 @@ var require_util = __commonJS((exports) => {
           parsed.path = parsed.path.substring(0, index + 1);
         }
       }
-      sourceURL = join2(urlGenerate(parsed), sourceURL);
+      sourceURL = join3(urlGenerate(parsed), sourceURL);
     }
     return normalize(sourceURL);
   }
@@ -15274,7 +15274,7 @@ var init_secretlint_source = __esm(() => {
 });
 
 // src/util/atomic.ts
-import { closeSync as closeSync2, constants, fsyncSync, openSync as openSync2, renameSync, rmSync, writeSync } from "node:fs";
+import { closeSync as closeSync2, constants, fsyncSync, openSync as openSync2, renameSync as renameSync2, rmSync, writeSync } from "node:fs";
 var TMP_OPEN_FLAGS;
 var init_atomic = __esm(() => {
   TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
@@ -17316,8 +17316,8 @@ var require_commander = __commonJS((exports2) => {
 
 // src/host-control/main.ts
 import { homedir as homedir6 } from "node:os";
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join10, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync11, readdirSync as readdirSync4 } from "node:fs";
+import { join as join11, resolve as resolve9 } from "node:path";
 
 // src/config/loader.ts
 var import_yaml2 = __toESM(require_dist(), 1);
@@ -21986,6 +21986,7 @@ var SwitchroomConfigSchema = exports_external.object({
       uid: exports_external.number().int().nonnegative().optional().describe("Optional UID to chown the consumer socket to (defaults to 0 = root, " + "suitable for sibling containers running as root)."),
       mirror_dir: exports_external.string().optional().describe("Optional host-side directory path. When set, the broker actively " + "writes the consumer's effective-account `.credentials.json` mirror " + "here — in addition to serving creds on demand via `get-credentials`. " + "Use this to eliminate the pull-latency gap: without a mirror the " + "consumer only gets failover creds at its next scheduled re-fetch " + "(up to 30 min). With a mirror the broker pushes failover creds " + "immediately when it detects exhaustion (consumer-quota-sensor tick, " + "or a mark-exhausted RPC on the pinned account). The directory must " + "be accessible to the broker container (bind-mounted from the host) " + "and to the consumer container; the broker writes " + "`<mirror_dir>/.credentials.json` atomically. Chown is attempted to " + "`uid` (default 0) — swallowed when CAP_CHOWN is absent.")
     })).optional().describe("Non-agent peers that hold a broker socket (RFC H §4.8). Each gets " + "its own `/run/switchroom/auth-broker/<name>/sock` chowned to its UID. " + "Consumers cannot be admins; a consumer name that collides with an " + "agent (whether that agent has `admin: true` or not) is a config " + "error caught at schema validation."),
+    proactive_failover_pct: exports_external.number().min(1).max(99).optional().describe("Soft-avoid threshold (percent) for proactive auth failover (#3031). " + "When set (e.g. 95), an account whose fresh 7-day utilization is at/" + "above this value — or whose 5h utilization is at/above min(pct+3, " + "98) — enters the SOFT-AVOID preference tier: the broker prefers a " + "fully-eligible fallback account on the serving path, without ever " + "blocking the account (the hard wall stays 99.5). Enter/exit uses " + "hysteresis (exit below pct-5 or on window reset) so the preference " + "does not flap between probe ticks. Accounts serving past the wall " + "via `allow_overage_accounts` are never soft-avoided. UNSET (the " + "default) disables the tier entirely — behavior is identical to a " + "fleet without this field."),
     allow_overage_accounts: exports_external.array(exports_external.string().min(1)).optional().describe("Opt-in list of account labels (bare strings matching `auth.active` / " + "`auth.fallback_order` entries) that may be served PAST the weekly " + "utilization wall when Anthropic overage billing is available for the " + "account (`overageStatus === 'allowed'`). Overage is REAL MONEY — " + "default is empty (no account gets this). An account in this list is " + "only kept eligible when its fresh quota snapshot reports " + "`overageStatus: 'allowed'` AND `overageDisabledReason` is NOT " + "'out_of_credits' (i.e. the overage credit has not been exhausted). " + "As soon as `overageDisabledReason` becomes 'out_of_credits', the " + "account is blocked immediately regardless of this flag. Overage lifts " + "ONLY the utilization wall — it cannot lift an active exhaustion mark " + "written by a real 429 (`mark-exhausted`).")
   }).optional().describe("Switchroom-auth-broker configuration (RFC H). Fleet-wide active account, " + "fallback order, admin-agent ACL, and ephemeral-consumer surface. " + "Required from the v0.8+ schema onwards; pre-v0.8 fleets are migrated " + "in-place by `switchroom apply` (see src/auth/migrate-schema.ts)."),
   drive: GoogleWorkspaceConfigSchema.describe("RFC D legacy key — use `google_workspace:` instead. Optional Google " + "Workspace onboarding configuration. When set, supplies Google OAuth " + "client credentials, the approver allowlist for `switchroom drive " + "connect`, and the optional tier knob. Env vars " + "(SWITCHROOM_GOOGLE_CLIENT_ID, SWITCHROOM_GOOGLE_CLIENT_SECRET, " + "SWITCHROOM_APPROVER_USER_ID) take precedence over this block when " + "set, preserving back-compat with the env-only flow shipped in #766."),
@@ -22796,11 +22797,391 @@ function resolveAgentsDir(config) {
   return resolveDualPath(config.switchroom.agents_dir || "~/.switchroom/agents");
 }
 
+// src/host-control/config-degraded.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, renameSync, unlinkSync, watchFile, unwatchFile, writeFileSync, mkdirSync } from "node:fs";
+import { connect } from "node:net";
+import { join } from "node:path";
+
+// src/config/release-resolve.ts
+function parseSemverTag(tag) {
+  if (!tag)
+    return null;
+  const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(tag.trim());
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function compareReleaseTags(a, b) {
+  const pa = parseSemverTag(a);
+  const pb = parseSemverTag(b);
+  if (!pa || !pb)
+    return null;
+  for (let i = 0;i < 3; i++) {
+    if (pa[i] !== pb[i])
+      return pa[i] < pb[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+// src/host-control/self-bump.ts
+var SELF_BUMP_MARKER_FILENAME = "pending-rollout.json";
+var SELF_BUMP_HELPER_CONTAINER = "switchroom-hostd-selfbump";
+var SELF_BUMP_LOG_FILENAME = "selfbump.log";
+var SELF_BUMP_MARKER_MAX_AGE_MS = 15 * 60 * 1000;
+var SEMVER_PIN_RE = /^v\d+\.\d+\.\d+$/;
+function needsSelfBump(ownVersion, pin) {
+  if (!ownVersion)
+    return false;
+  const cmp = compareReleaseTags(`v${ownVersion.trim().replace(/^v/, "")}`, `v${pin.trim().replace(/^v/, "")}`);
+  return cmp !== null && cmp < 0;
+}
+function bumpHostdComposeImageTag(yaml, pin) {
+  const re = /^(\s*image:\s*)(\S*switchroom-hostd):(\S+)\s*$/m;
+  const m = yaml.match(re);
+  if (!m)
+    return null;
+  const oldImageRef = `${m[2]}:${m[3]}`;
+  const newImageRef = `${m[2]}:${pin}`;
+  return {
+    yaml: yaml.replace(re, `$1${newImageRef}`),
+    oldImageRef,
+    newImageRef
+  };
+}
+function encodePendingRolloutMarker(m) {
+  return JSON.stringify(m, null, 2) + `
+`;
+}
+function parsePendingRolloutMarker(raw) {
+  let obj;
+  try {
+    obj = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof obj !== "object" || obj === null)
+    return null;
+  const o = obj;
+  if (o.v !== 1)
+    return null;
+  if (typeof o.request_id !== "string" || o.request_id.length === 0)
+    return null;
+  if (typeof o.pin !== "string" || !SEMVER_PIN_RE.test(o.pin))
+    return null;
+  if (typeof o.created_at !== "string" || !Number.isFinite(Date.parse(o.created_at))) {
+    return null;
+  }
+  if (typeof o.prior_hostd_version !== "string")
+    return null;
+  const caller = o.caller;
+  if (typeof caller !== "object" || caller === null)
+    return null;
+  if (caller.kind === "agent") {
+    if (typeof caller.name !== "string" || caller.name.length === 0)
+      return null;
+  } else if (caller.kind !== "operator") {
+    return null;
+  }
+  if (o.agents !== undefined) {
+    if (!Array.isArray(o.agents) || o.agents.length === 0 || !o.agents.every((a) => typeof a === "string" && /^[\w-]+$/.test(a))) {
+      return null;
+    }
+  }
+  if (o.skip_web !== undefined && typeof o.skip_web !== "boolean")
+    return null;
+  if (o.allow_downgrade !== undefined && typeof o.allow_downgrade !== "boolean") {
+    return null;
+  }
+  return {
+    v: 1,
+    request_id: o.request_id,
+    pin: o.pin,
+    ...o.agents !== undefined ? { agents: o.agents } : {},
+    ...o.skip_web !== undefined ? { skip_web: o.skip_web } : {},
+    ...o.allow_downgrade !== undefined ? { allow_downgrade: o.allow_downgrade } : {},
+    caller: caller.kind === "agent" ? { kind: "agent", name: caller.name } : { kind: "operator" },
+    created_at: o.created_at,
+    prior_hostd_version: o.prior_hostd_version
+  };
+}
+function isMarkerFresh(marker, nowMs) {
+  const created = Date.parse(marker.created_at);
+  if (!Number.isFinite(created))
+    return false;
+  return nowMs - created < SELF_BUMP_MARKER_MAX_AGE_MS;
+}
+function selfBumpHelperArgs(opts) {
+  const composePath = `${opts.hostdDirHostPath}/docker-compose.yml`;
+  const logPath = `${opts.hostdDirHostPath}/${SELF_BUMP_LOG_FILENAME}`;
+  const script = `sleep 2; ` + `echo "selfbump $(date -u) -> ${opts.targetImage}" >> "${logPath}" 2>&1; ` + `docker compose -p switchroom-hostd -f "${composePath}" pull >> "${logPath}" 2>&1 && ` + `docker compose -p switchroom-hostd -f "${composePath}" up -d >> "${logPath}" 2>&1; ` + `rc=$?; echo "selfbump done rc=$rc" >> "${logPath}" 2>&1; exit $rc`;
+  return [
+    "run",
+    "-d",
+    "--rm",
+    "--name",
+    SELF_BUMP_HELPER_CONTAINER,
+    "--label",
+    "switchroom.hostd-selfbump=true",
+    "-v",
+    "/var/run/docker.sock:/var/run/docker.sock",
+    "-v",
+    `${opts.hostdDirHostPath}:${opts.hostdDirHostPath}`,
+    "--entrypoint",
+    "/bin/sh",
+    opts.helperImage,
+    "-c",
+    script
+  ];
+}
+
+// src/host-control/config-degraded.ts
+var CONFIG_DEGRADED_MARKER_FILENAME = "config-degraded.json";
+var CONFIG_DEGRADED_RETRY_MS = 15000;
+var MAX_PRESERVED_DEGRADED_MS = 4 * 60 * 60 * 1000;
+function buildDegradedMarker(err, nowMs) {
+  return {
+    v: 1,
+    since: new Date(nowMs).toISOString(),
+    error: err.message,
+    ...err.details && err.details.length > 0 ? { details: err.details } : {}
+  };
+}
+function readDegradedSince(markerPath) {
+  try {
+    if (!existsSync4(markerPath))
+      return null;
+    const parsed = JSON.parse(readFileSync3(markerPath, "utf8"));
+    if (parsed?.v !== 1 || typeof parsed.since !== "string")
+      return null;
+    const since = Date.parse(parsed.since);
+    return Number.isFinite(since) ? since : null;
+  } catch {
+    return null;
+  }
+}
+function formatDegradedNotice(err) {
+  const details = (err.details ?? []).map((d) => d.trim()).filter(Boolean).slice(0, 6).join(`
+`);
+  return `⚠️ hostd: switchroom.yaml failed to load — running DEGRADED.
+` + `${err.message}
+` + (details ? details + `
+` : "") + `Retrying every ${Math.round(CONFIG_DEGRADED_RETRY_MS / 1000)}s and on file change. ` + "hostd's sockets are not bound yet, so fleet operations (rollouts, config " + "edits, restarts) will fail with connection errors until the config parses. " + "Fix the YAML (`switchroom config check` validates it) — no hostd restart " + "needed. A pending self-bump rollout, if any, will resume once the config " + "loads (its 15-min freshness budget is frozen while degraded, up to " + `${Math.round(MAX_PRESERVED_DEGRADED_MS / 3600000)}h).`;
+}
+function humanMins(ms) {
+  const mins = Math.max(1, Math.round(ms / 60000));
+  return mins >= 90 ? `${(mins / 60).toFixed(1)}h` : `${mins}m`;
+}
+function formatRecoveredNotice(degradedMs, pending) {
+  let tail = "";
+  if (pending?.preserved) {
+    tail = ` Pending self-bump rollout to ${pending.pin} was preserved through the ` + `outage (marker now ${humanMins(pending.ageMs)} old) and will resume now.`;
+  } else if (pending) {
+    tail = ` NOTE: pending self-bump rollout to ${pending.pin} was NOT auto-resumed — ` + `degraded for ~${humanMins(degradedMs)}, past the ` + `${Math.round(MAX_PRESERVED_DEGRADED_MS / 3600000)}h preservation cap. Its ` + `marker (${humanMins(pending.ageMs)} old) will be treated as stale; re-run ` + `the rollout if it is still wanted.`;
+  }
+  return `✅ hostd: switchroom.yaml loads again after ~${humanMins(degradedMs)} degraded — ` + `normal service resumed.` + tail;
+}
+function shiftPendingRolloutMarker(raw, degradedMs) {
+  if (degradedMs <= 0)
+    return null;
+  const marker = parsePendingRolloutMarker(raw);
+  if (!marker)
+    return null;
+  const created = Date.parse(marker.created_at);
+  if (!Number.isFinite(created))
+    return null;
+  return encodePendingRolloutMarker({
+    ...marker,
+    created_at: new Date(created + degradedMs).toISOString()
+  });
+}
+function clearStaleDegradedMarker(homeDir, log) {
+  const markerPath = join(homeDir, ".switchroom", "hostd", CONFIG_DEGRADED_MARKER_FILENAME);
+  try {
+    if (!existsSync4(markerPath))
+      return false;
+    unlinkSync(markerPath);
+    log(`config-degraded: clearing stale degraded marker from a prior crash ` + `(${markerPath}) — config loads cleanly on this boot`);
+    return true;
+  } catch (e) {
+    log(`config-degraded: could not clear stale marker ${markerPath}: ${e.message}`);
+    return false;
+  }
+}
+function postOperatorNoticeViaGateways(candidates, text, log, connectTimeoutMs = 5000) {
+  const tryOne = (c) => new Promise((resolve4) => {
+    let done = false;
+    const finish = (ok, why) => {
+      if (done)
+        return;
+      done = true;
+      if (why)
+        log(`config-degraded: gateway ${c.agent} — ${why}`);
+      try {
+        client.destroy();
+      } catch {}
+      resolve4(ok);
+    };
+    let client;
+    try {
+      client = connect({ path: c.sock });
+    } catch (e) {
+      log(`config-degraded: gateway ${c.agent} — connect threw: ${e.message}`);
+      resolve4(false);
+      return;
+    }
+    client.setTimeout(connectTimeoutMs);
+    client.on("connect", () => {
+      try {
+        client.write(JSON.stringify({
+          type: "rollout_status_post",
+          requestId: "config-degraded",
+          agentName: c.agent,
+          text
+        }) + `
+`, () => {
+          client.end();
+          finish(true);
+        });
+      } catch (e) {
+        finish(false, `write failed: ${e.message}`);
+      }
+    });
+    client.on("timeout", () => finish(false, "connect timed out"));
+    client.on("error", (e) => finish(false, `socket error: ${e.message}`));
+  });
+  return (async () => {
+    for (const c of candidates) {
+      if (await tryOne(c))
+        return c.agent;
+    }
+    if (candidates.length > 0) {
+      log("config-degraded: every candidate gateway socket failed; relying on marker file");
+    }
+    return null;
+  })();
+}
+async function waitForConfigRecovery(opts) {
+  const now = opts.nowFn ?? Date.now;
+  const retryMs = opts.retryMs ?? CONFIG_DEGRADED_RETRY_MS;
+  const hostdDir = join(opts.homeDir, ".switchroom", "hostd");
+  const degradedMarkerPath = join(hostdDir, CONFIG_DEGRADED_MARKER_FILENAME);
+  const pendingMarkerPath = join(hostdDir, SELF_BUMP_MARKER_FILENAME);
+  const persistedSince = readDegradedSince(degradedMarkerPath);
+  const enteredAt = Math.min(persistedSince ?? now(), now());
+  if (persistedSince !== null) {
+    opts.log(`config-degraded: resuming an existing degraded window (since ` + `${new Date(enteredAt).toISOString()}, persisted in ${degradedMarkerPath})`);
+  }
+  try {
+    mkdirSync(hostdDir, { recursive: true, mode: 448 });
+    writeFileSync(degradedMarkerPath + ".tmp", JSON.stringify(buildDegradedMarker(opts.initialError, enteredAt), null, 2) + `
+`, { mode: 384 });
+    renameSync(degradedMarkerPath + ".tmp", degradedMarkerPath);
+  } catch (e) {
+    opts.log(`config-degraded: could not write marker ${degradedMarkerPath}: ${e.message}`);
+  }
+  try {
+    opts.notify(formatDegradedNotice(opts.initialError));
+  } catch (e) {
+    opts.log(`config-degraded: notify threw: ${e.message}`);
+  }
+  opts.log(`config-degraded: entering degraded mode — ${opts.initialError.message}. ` + `Retrying every ${Math.round(retryMs / 1000)}s` + (opts.configPath ? ` and on change to ${opts.configPath}` : "") + `. Marker: ${degradedMarkerPath}`);
+  const config = await new Promise((resolve4, reject) => {
+    let timer = null;
+    let settled = false;
+    const cleanup = () => {
+      if (timer)
+        clearInterval(timer);
+      if (opts.configPath) {
+        try {
+          unwatchFile(opts.configPath, onFileChange);
+        } catch {}
+      }
+    };
+    const attempt = (why) => {
+      if (settled)
+        return;
+      try {
+        const cfg = opts.loadFn();
+        settled = true;
+        cleanup();
+        resolve4(cfg);
+      } catch (err) {
+        if (err instanceof ConfigError) {
+          opts.log(`config-degraded: reload attempt (${why}) still failing — ${err.message}`);
+          return;
+        }
+        settled = true;
+        cleanup();
+        reject(err);
+      }
+    };
+    const onFileChange = () => attempt("file change");
+    timer = setInterval(() => attempt("interval"), retryMs);
+    if (opts.configPath) {
+      try {
+        watchFile(opts.configPath, { interval: 5000 }, onFileChange);
+      } catch (e) {
+        opts.log(`config-degraded: could not watch ${opts.configPath}: ${e.message}`);
+      }
+    }
+  });
+  const degradedMs = Math.max(0, now() - enteredAt);
+  let pendingOutcome = null;
+  try {
+    if (existsSync4(pendingMarkerPath)) {
+      const raw = readFileSync3(pendingMarkerPath, "utf8");
+      const marker = parsePendingRolloutMarker(raw);
+      if (marker && degradedMs <= 0) {
+        pendingOutcome = {
+          pin: marker.pin,
+          ageMs: Math.max(0, now() - Date.parse(marker.created_at)),
+          preserved: true
+        };
+      } else if (marker) {
+        const withinCap = degradedMs <= MAX_PRESERVED_DEGRADED_MS;
+        const shifted = withinCap ? shiftPendingRolloutMarker(raw, degradedMs) : null;
+        if (shifted !== null) {
+          writeFileSync(pendingMarkerPath + ".tmp", shifted, { mode: 384 });
+          renameSync(pendingMarkerPath + ".tmp", pendingMarkerPath);
+          pendingOutcome = {
+            pin: marker.pin,
+            ageMs: Math.max(0, now() - (Date.parse(marker.created_at) + degradedMs)),
+            preserved: true
+          };
+          opts.log(`config-degraded: shifted pending-rollout marker (${marker.pin}) ` + `created_at by ${Math.round(degradedMs / 1000)}s so the degraded ` + `window does not count against the resume cutoff`);
+        } else {
+          pendingOutcome = {
+            pin: marker.pin,
+            ageMs: Math.max(0, now() - Date.parse(marker.created_at)),
+            preserved: false
+          };
+          if (!withinCap) {
+            opts.log(`config-degraded: NOT preserving pending-rollout marker ` + `(${marker.pin}) — degraded ${Math.round(degradedMs / 60000)}m, ` + `past the ${Math.round(MAX_PRESERVED_DEGRADED_MS / 3600000)}h ` + `preservation cap; the roll will not auto-resume`);
+          }
+        }
+      }
+    }
+  } catch (e) {
+    opts.log(`config-degraded: could not preserve pending-rollout marker: ${e.message}`);
+  }
+  try {
+    if (existsSync4(degradedMarkerPath))
+      unlinkSync(degradedMarkerPath);
+  } catch (e) {
+    opts.log(`config-degraded: could not remove marker ${degradedMarkerPath}: ${e.message}`);
+  }
+  try {
+    opts.notify(formatRecoveredNotice(degradedMs, pendingOutcome));
+  } catch (e) {
+    opts.log(`config-degraded: recovery notify threw: ${e.message}`);
+  }
+  opts.log(`config-degraded: config loads again after ${Math.round(degradedMs / 1000)}s — resuming normal boot`);
+  return config;
+}
+
 // src/agents/compose.ts
 import { createHash } from "node:crypto";
 
 // src/agents/scaffold.ts
-import { join as join4, resolve as resolve5 } from "node:path";
+import { join as join5, resolve as resolve5 } from "node:path";
 
 // src/config/timezone.ts
 var CONTAINER_DEFAULT_UTC_ZONES = new Set([
@@ -22811,7 +23192,7 @@ var CONTAINER_DEFAULT_UTC_ZONES = new Set([
 ]);
 
 // src/cli/agent-config.ts
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 
 // src/vault/broker/acl.ts
@@ -22822,12 +23203,12 @@ var WEBKITE_VAULT_KEYS = new Set([
 ]);
 
 // src/cli/agent-config.ts
-var AUDIT_ROOT = join(homedir2(), ".switchroom", "audit");
+var AUDIT_ROOT = join2(homedir2(), ".switchroom", "audit");
 
 // src/agents/profiles.ts
 var import_handlebars = __toESM(require_lib(), 1);
-import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync4, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync, realpathSync } from "node:fs";
-import { resolve as resolve4, join as join2, sep as pathSep } from "node:path";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, existsSync as existsSync5, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync as mkdirSync2, realpathSync } from "node:fs";
+import { resolve as resolve4, join as join3, sep as pathSep } from "node:path";
 var PROFILES_ROOT = resolve4(import.meta.dirname, "../../profiles");
 import_handlebars.default.registerHelper("json", (value) => {
   return new import_handlebars.default.SafeString(JSON.stringify(value, null, 2));
@@ -22836,11 +23217,11 @@ import_handlebars.default.registerHelper("isNumber", (value) => {
   return typeof value === "number" && Number.isFinite(value);
 });
 var SHARED_FRAGMENTS_DIR = resolve4(PROFILES_ROOT, "_shared");
-var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline"];
+var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
 for (const name of SHARED_FRAGMENTS) {
-  const fragPath = join2(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
-  if (existsSync4(fragPath)) {
-    import_handlebars.default.registerPartial(name, readFileSync3(fragPath, "utf-8"));
+  const fragPath = join3(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
+  if (existsSync5(fragPath)) {
+    import_handlebars.default.registerPartial(name, readFileSync4(fragPath, "utf-8"));
   }
 }
 
@@ -22928,7 +23309,7 @@ var SCRYPT_MAXMEM = 128 * 1024 * 1024;
 
 // src/vault/broker/client.ts
 import { homedir as homedir3 } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 
 // src/broker-common/peercred-path.ts
 function matchSocketName(socketPath, patterns, maxNameLen) {
@@ -23278,8 +23659,8 @@ var ResponseSchema = exports_external.union([
 ]);
 
 // src/vault/broker/client.ts
-var LEGACY_SOCKET_PATH = join3(homedir3(), ".switchroom", "vault-broker.sock");
-var OPERATOR_SOCKET_PATH = join3(homedir3(), ".switchroom", "broker-operator", "sock");
+var LEGACY_SOCKET_PATH = join4(homedir3(), ".switchroom", "vault-broker.sock");
+var OPERATOR_SOCKET_PATH = join4(homedir3(), ".switchroom", "broker-operator", "sock");
 
 // src/vault/resolver.ts
 var materializedDirs = new Set;
@@ -23316,20 +23697,20 @@ import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
 import { mkdir, chmod, chown, unlink, appendFile } from "node:fs/promises";
 import {
   readdirSync as readdirSync3,
-  existsSync as existsSync9,
-  readFileSync as readFileSync7,
-  writeFileSync as writeFileSync4,
-  renameSync as renameSync2,
-  mkdirSync as mkdirSync3,
+  existsSync as existsSync10,
+  readFileSync as readFileSync8,
+  writeFileSync as writeFileSync5,
+  renameSync as renameSync3,
+  mkdirSync as mkdirSync4,
   openSync as openSync3,
   ftruncateSync,
   writeSync as writeSync2,
   fsyncSync as fsyncSync2,
   closeSync as closeSync3,
   copyFileSync as copyFileSync2,
-  unlinkSync
+  unlinkSync as unlinkSync2
 } from "node:fs";
-import { join as join9, dirname as dirname6, resolve as resolve8 } from "node:path";
+import { join as join10, dirname as dirname6, resolve as resolve8 } from "node:path";
 import { createHash as createHash5, randomUUID as randomUUID2, randomBytes } from "node:crypto";
 
 // src/host-control/protocol.ts
@@ -28018,10 +28399,10 @@ class PostHog extends PostHogBackendClient {
 
 // src/analytics/posthog.ts
 import {
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
-  writeFileSync as writeFileSync2
+  existsSync as existsSync6,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync3
 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -28039,8 +28420,8 @@ function getDistinctId() {
     return cachedDistinctId;
   const path = resolveStatePath("analytics-id");
   try {
-    if (existsSync5(path)) {
-      const existing = readFileSync4(path, "utf-8").trim();
+    if (existsSync6(path)) {
+      const existing = readFileSync5(path, "utf-8").trim();
       if (existing) {
         cachedDistinctId = existing;
         return existing;
@@ -28050,8 +28431,8 @@ function getDistinctId() {
   const id = randomUUID();
   cachedDistinctId = id;
   try {
-    mkdirSync2(dirname2(path), { recursive: true });
-    writeFileSync2(path, id, "utf-8");
+    mkdirSync3(dirname2(path), { recursive: true });
+    writeFileSync3(path, id, "utf-8");
   } catch {}
   return id;
 }
@@ -28714,40 +29095,21 @@ var import_yaml3 = __toESM(require_dist(), 1);
 // src/cli/rollout.ts
 init_atomic();
 
-// src/config/release-resolve.ts
-function parseSemverTag(tag) {
-  if (!tag)
-    return null;
-  const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(tag.trim());
-  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
-}
-function compareReleaseTags(a, b) {
-  const pa = parseSemverTag(a);
-  const pb = parseSemverTag(b);
-  if (!pa || !pb)
-    return null;
-  for (let i = 0;i < 3; i++) {
-    if (pa[i] !== pb[i])
-      return pa[i] < pb[i] ? -1 : 1;
-  }
-  return 0;
-}
-
 // src/cli/resolve-version.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
-import { dirname as dirname4, join as join6 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
+import { dirname as dirname4, join as join7 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.18.9";
+var VERSION = "0.18.11";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 12 && dir && dir !== "/"; i++) {
-    const p = join6(dir, "package.json");
-    if (existsSync7(p)) {
+    const p = join7(dir, "package.json");
+    if (existsSync8(p)) {
       try {
-        const pkg = JSON.parse(readFileSync5(p, "utf-8"));
+        const pkg = JSON.parse(readFileSync6(p, "utf-8"));
         if (pkg?.name === "switchroom" && typeof pkg.version === "string") {
           return pkg.version;
         }
@@ -28894,6 +29256,7 @@ function parseRolloutPhaseLine(line) {
     "agent-start",
     "agent-done",
     "persist-pin",
+    "web-refresh",
     "hostd-web-deferred",
     "self-bump",
     "self-bump-done"
@@ -28931,122 +29294,11 @@ function parseRolloutResultLine(stdout) {
   return null;
 }
 
-// src/host-control/self-bump.ts
-var SELF_BUMP_MARKER_FILENAME = "pending-rollout.json";
-var SELF_BUMP_HELPER_CONTAINER = "switchroom-hostd-selfbump";
-var SELF_BUMP_LOG_FILENAME = "selfbump.log";
-var SELF_BUMP_MARKER_MAX_AGE_MS = 15 * 60 * 1000;
-var SEMVER_PIN_RE = /^v\d+\.\d+\.\d+$/;
-function needsSelfBump(ownVersion, pin) {
-  if (!ownVersion)
-    return false;
-  const cmp = compareReleaseTags(`v${ownVersion.trim().replace(/^v/, "")}`, `v${pin.trim().replace(/^v/, "")}`);
-  return cmp !== null && cmp < 0;
-}
-function bumpHostdComposeImageTag(yaml, pin) {
-  const re = /^(\s*image:\s*)(\S*switchroom-hostd):(\S+)\s*$/m;
-  const m = yaml.match(re);
-  if (!m)
-    return null;
-  const oldImageRef = `${m[2]}:${m[3]}`;
-  const newImageRef = `${m[2]}:${pin}`;
-  return {
-    yaml: yaml.replace(re, `$1${newImageRef}`),
-    oldImageRef,
-    newImageRef
-  };
-}
-function encodePendingRolloutMarker(m) {
-  return JSON.stringify(m, null, 2) + `
-`;
-}
-function parsePendingRolloutMarker(raw) {
-  let obj;
-  try {
-    obj = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (typeof obj !== "object" || obj === null)
-    return null;
-  const o = obj;
-  if (o.v !== 1)
-    return null;
-  if (typeof o.request_id !== "string" || o.request_id.length === 0)
-    return null;
-  if (typeof o.pin !== "string" || !SEMVER_PIN_RE.test(o.pin))
-    return null;
-  if (typeof o.created_at !== "string" || !Number.isFinite(Date.parse(o.created_at))) {
-    return null;
-  }
-  if (typeof o.prior_hostd_version !== "string")
-    return null;
-  const caller = o.caller;
-  if (typeof caller !== "object" || caller === null)
-    return null;
-  if (caller.kind === "agent") {
-    if (typeof caller.name !== "string" || caller.name.length === 0)
-      return null;
-  } else if (caller.kind !== "operator") {
-    return null;
-  }
-  if (o.agents !== undefined) {
-    if (!Array.isArray(o.agents) || o.agents.length === 0 || !o.agents.every((a) => typeof a === "string" && /^[\w-]+$/.test(a))) {
-      return null;
-    }
-  }
-  if (o.skip_web !== undefined && typeof o.skip_web !== "boolean")
-    return null;
-  if (o.allow_downgrade !== undefined && typeof o.allow_downgrade !== "boolean") {
-    return null;
-  }
-  return {
-    v: 1,
-    request_id: o.request_id,
-    pin: o.pin,
-    ...o.agents !== undefined ? { agents: o.agents } : {},
-    ...o.skip_web !== undefined ? { skip_web: o.skip_web } : {},
-    ...o.allow_downgrade !== undefined ? { allow_downgrade: o.allow_downgrade } : {},
-    caller: caller.kind === "agent" ? { kind: "agent", name: caller.name } : { kind: "operator" },
-    created_at: o.created_at,
-    prior_hostd_version: o.prior_hostd_version
-  };
-}
-function isMarkerFresh(marker, nowMs) {
-  const created = Date.parse(marker.created_at);
-  if (!Number.isFinite(created))
-    return false;
-  return nowMs - created < SELF_BUMP_MARKER_MAX_AGE_MS;
-}
-function selfBumpHelperArgs(opts) {
-  const composePath = `${opts.hostdDirHostPath}/docker-compose.yml`;
-  const logPath = `${opts.hostdDirHostPath}/${SELF_BUMP_LOG_FILENAME}`;
-  const script = `sleep 2; ` + `echo "selfbump $(date -u) -> ${opts.targetImage}" >> "${logPath}" 2>&1; ` + `docker compose -p switchroom-hostd -f "${composePath}" pull >> "${logPath}" 2>&1 && ` + `docker compose -p switchroom-hostd -f "${composePath}" up -d >> "${logPath}" 2>&1; ` + `rc=$?; echo "selfbump done rc=$rc" >> "${logPath}" 2>&1; exit $rc`;
-  return [
-    "run",
-    "-d",
-    "--rm",
-    "--name",
-    SELF_BUMP_HELPER_CONTAINER,
-    "--label",
-    "switchroom.hostd-selfbump=true",
-    "-v",
-    "/var/run/docker.sock:/var/run/docker.sock",
-    "-v",
-    `${opts.hostdDirHostPath}:${opts.hostdDirHostPath}`,
-    "--entrypoint",
-    "/bin/sh",
-    opts.helperImage,
-    "-c",
-    script
-  ];
-}
-
 // node_modules/.bun/commander@13.1.0/node_modules/commander/esm.mjs
 var import__3 = __toESM(require_commander(), 1);
 
 // src/cli/update.ts
-import { join as join7, dirname as dirname5, resolve as resolve7 } from "node:path";
+import { join as join8, dirname as dirname5, resolve as resolve7 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 
 // src/agents/lifecycle.ts
@@ -29143,7 +29395,7 @@ function getAllAgentStatuses(config) {
 
 // src/cli/update.ts
 init_atomic();
-var DEFAULT_COMPOSE_PATH = join7(homedir5(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH = join8(homedir5(), ".switchroom", "compose", "docker-compose.yml");
 var UPDATE_RESULT_SENTINEL = "SWITCHROOM_UPDATE_RESULT:";
 function parseUpdateResultLine(stdout) {
   const idx = stdout.lastIndexOf(UPDATE_RESULT_SENTINEL);
@@ -29166,9 +29418,9 @@ function parseUpdateResultLine(stdout) {
 
 // src/host-control/config-edit-validator.ts
 var import_yaml5 = __toESM(require_dist(), 1);
-import { mkdtempSync, writeFileSync as writeFileSync3, rmSync as rmSync2, existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync4, rmSync as rmSync2, existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join8, isAbsolute as isAbsolute2, normalize, basename as basename2 } from "node:path";
+import { join as join9, isAbsolute as isAbsolute2, normalize, basename as basename2 } from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { isDeepStrictEqual } from "node:util";
 var MAX_PATCH_BYTES = 1024 * 1024;
@@ -29281,22 +29533,22 @@ function validateShape(unifiedDiff, targetPath) {
   return null;
 }
 function applyPatch(unifiedDiff, configPath, gitBin) {
-  if (!existsSync8(configPath)) {
+  if (!existsSync9(configPath)) {
     return {
       ok: false,
       code: "E_PATCH_APPLY_FAILED",
       detail: `target config not found at ${configPath}`
     };
   }
-  const liveContent = readFileSync6(configPath, "utf8");
-  const scratchDir = mkdtempSync(join8(tmpdir(), "config-propose-edit-"));
+  const liveContent = readFileSync7(configPath, "utf8");
+  const scratchDir = mkdtempSync(join9(tmpdir(), "config-propose-edit-"));
   try {
     const targetBasename = configPath.split("/").pop() ?? "switchroom.yaml";
-    const scratchFile = join8(scratchDir, targetBasename);
-    writeFileSync3(scratchFile, liveContent);
+    const scratchFile = join9(scratchDir, targetBasename);
+    writeFileSync4(scratchFile, liveContent);
     const normalizedDiff = normalizeDiffHeadersToBasename(unifiedDiff, targetBasename);
-    const patchFile = join8(scratchDir, "proposal.patch");
-    writeFileSync3(patchFile, normalizedDiff);
+    const patchFile = join9(scratchDir, "proposal.patch");
+    writeFileSync4(patchFile, normalizedDiff);
     const bin = gitBin ?? "git";
     const baseArgs = [
       "apply",
@@ -29326,7 +29578,7 @@ function applyPatch(unifiedDiff, configPath, gitBin) {
         detail: `git apply failed: ${(real.stderr || "").trim().slice(0, 500)}`
       };
     }
-    const after = readFileSync6(scratchFile, "utf8");
+    const after = readFileSync7(scratchFile, "utf8");
     return { ok: true, after };
   } finally {
     rmSync2(scratchDir, { recursive: true, force: true });
@@ -29524,7 +29776,7 @@ function validateConfigEdit(opts) {
     return schemaErr;
   let beforeData = {};
   try {
-    const beforeRaw = existsSync8(opts.configPath) ? readFileSync6(opts.configPath, "utf8") : "";
+    const beforeRaw = existsSync9(opts.configPath) ? readFileSync7(opts.configPath, "utf8") : "";
     const beforeDoc = import_yaml5.parseDocument(beforeRaw, { merge: false, strict: false });
     beforeData = beforeDoc.toJS();
   } catch {
@@ -29770,19 +30022,21 @@ function phaseLine(s) {
     case "apply":
       return "applying — regenerating compose";
     case "canary-start":
-      return `canary — restarting ${s.agent ?? "canary agent"}`;
+      return `canary — restarting ${s.agent ? `\`${s.agent}\`` : "canary agent"}`;
     case "canary-pass":
-      return `canary passed (${s.agent ?? "canary"}) — rolling the rest`;
+      return `canary passed (${s.agent ? `\`${s.agent}\`` : "canary"}) — rolling the rest`;
     case "canary-fail":
-      return `canary failed (${s.agent ?? "canary"})`;
+      return `canary failed (${s.agent ? `\`${s.agent}\`` : "canary"})`;
     case "agent-start":
-      return `agent ${s.n ?? "?"}/${s.m ?? "?"} — restarting ${s.agent ?? ""}`.trim();
+      return `agent ${s.n ?? "?"}/${s.m ?? "?"} — restarting ${s.agent ? `\`${s.agent}\`` : ""}`.trim();
     case "agent-done":
-      return `agent ${s.n ?? "?"}/${s.m ?? "?"} — ${s.agent ?? ""} done`.trim();
+      return `agent ${s.n ?? "?"}/${s.m ?? "?"} — ${s.agent ? `\`${s.agent}\`` : ""} done`.trim();
     case "persist-pin":
       return "persisting pin";
+    case "web-refresh":
+      return "refreshing web dashboard (webd install)";
     case "hostd-web-deferred":
-      return "hostd/web refresh deferred (run host-side)";
+      return "hostd refresh deferred (run host-side)";
     case "self-bump":
       return "hostd refreshing itself to the target (brief control blip)…";
     case "self-bump-done":
@@ -29791,18 +30045,147 @@ function phaseLine(s) {
       return "starting";
   }
 }
-function renderRolloutStatus(s) {
-  const head = `Rollout → ${s.target}`;
-  const rolledCount = s.rolled?.length ?? 0;
+function formatDurationMs(ms) {
+  const totalSec = Math.max(0, Math.round(ms / 1000));
+  if (totalSec < 60)
+    return `${totalSec}s`;
+  const totalMin = Math.floor(totalSec / 60);
+  const sec = totalSec % 60;
+  if (totalMin < 60)
+    return sec > 0 ? `${totalMin}m ${sec}s` : `${totalMin}m`;
+  const hr = Math.floor(totalMin / 60);
+  const min = totalMin % 60;
+  return min > 0 ? `${hr}h ${min}m` : `${hr}h`;
+}
+function shortRequestId(id) {
+  return id.length > 16 ? id.slice(0, 16) + "…" : id;
+}
+function headerLine(s, icon) {
+  const arrow = s.fromVersion ? `\`${s.fromVersion}\` → \`${s.target}\`` : `→ \`${s.target}\``;
+  const req = s.requestId ? ` · req \`${shortRequestId(s.requestId)}\`` : "";
+  return `${icon} **Rollout** ${arrow}${req}`;
+}
+function checklistLines(s, compact) {
+  const agents = s.agents ?? [];
+  const lines = [];
+  let doneCount = 0;
+  let pendingNamed = 0;
+  for (const a of agents) {
+    const canary = a.canary ? " (canary)" : "";
+    const dur = a.durationMs !== undefined ? ` — ${formatDurationMs(a.durationMs)}` : "";
+    switch (a.status) {
+      case "done":
+        if (compact)
+          doneCount += 1;
+        else
+          lines.push(`- ✓ \`${a.name}\`${canary}${dur}`);
+        break;
+      case "running":
+        lines.push(`- ⏳ \`${a.name}\`${canary} — restarting…`);
+        break;
+      case "failed":
+        lines.push(`- ✗ \`${a.name}\`${canary} — failed${dur}`);
+        break;
+      default:
+        if (compact)
+          pendingNamed += 1;
+        else
+          lines.push(`- · \`${a.name}\`${canary}`);
+    }
+  }
+  if (doneCount > 0)
+    lines.unshift(`- ✓ ${doneCount} done`);
+  const unseen = s.m !== undefined ? Math.max(0, s.m - agents.length) : 0;
+  const pendingTotal = unseen + pendingNamed;
+  if (pendingTotal > 0 && agents.length > 0) {
+    lines.push(`- · ${pendingTotal} more pending`);
+  }
+  return lines;
+}
+function etaLine(s) {
+  if (s.m === undefined)
+    return null;
+  const done = (s.agents ?? []).filter((a) => a.status === "done" && a.durationMs !== undefined);
+  if (done.length === 0)
+    return null;
+  const remaining = s.m - done.length;
+  if (remaining <= 0)
+    return null;
+  const meanMs = done.reduce((t, a) => t + (a.durationMs ?? 0), 0) / done.length;
+  return `~${formatDurationMs(meanMs * remaining)} left (rough est.)`;
+}
+function deferredLines(target) {
+  const bare = target.trim().replace(/^v/, "");
+  return [
+    `**Deferred (still on the prior version — run host-side):**`,
+    `- \`switchroom-web\` — \`switchroom webd install --tag ${target}\``,
+    `- host operator CLI — \`sudo npm i -g switchroom@${bare}\``,
+    `- hostd template regen (only if the release changed hostd mounts/env) — \`switchroom hostd install --tag ${target}\``
+  ];
+}
+var MAX_RENDER_CHARS = 3800;
+function rolledList(rolled, compact) {
+  if (rolled.length === 0)
+    return "none";
+  if (compact)
+    return `${rolled.length} agent(s)`;
+  return rolled.map((r) => `\`${r}\``).join(", ");
+}
+function renderWith(s, compact) {
+  const rolled = s.rolled ?? [];
+  const rolledCount = rolled.length;
+  const checklist = checklistLines(s, compact);
+  const elapsedMs = s.elapsedMs ?? (s.startedAtMs !== undefined && s.nowMs !== undefined ? s.nowMs - s.startedAtMs : undefined);
   if (s.terminal === "completed") {
-    return `✅ ${head} — done. Rolled ${rolledCount} agent(s): ${(s.rolled ?? []).join(", ") || "none"}.`;
+    const parts2 = [headerLine(s, "✅")];
+    let summary = `**Done** — rolled ${rolledCount}${s.m !== undefined ? `/${s.m}` : ""} agent(s)`;
+    if (elapsedMs !== undefined)
+      summary += ` in ${formatDurationMs(elapsedMs)}`;
+    summary += compact ? "." : `: ${rolledList(rolled, compact)}.`;
+    parts2.push(summary);
+    if (checklist.length > 0)
+      parts2.push("", ...checklist);
+    if (s.deferred !== false)
+      parts2.push("", ...deferredLines(s.target));
+    return parts2.join(`
+`);
   }
   if (s.terminal === "error") {
-    const where = s.failedStep ? ` at ${s.failedStep}${s.failedAgent ? ` (${s.failedAgent} → ${s.got ?? "unreachable"})` : ""}` : "";
-    return `❌ ${head} — STOPPED${where}. ` + `Rolled before stop: ${(s.rolled ?? []).join(", ") || "none"}.`;
+    const where = s.failedStep ? ` at \`${s.failedStep}\`${s.failedAgent ? ` (\`${s.failedAgent}\` → ${s.got ?? "unreachable"})` : ""}` : "";
+    const parts2 = [headerLine(s, "❌")];
+    let summary = `**STOPPED**${where}`;
+    if (elapsedMs !== undefined)
+      summary += ` after ${formatDurationMs(elapsedMs)}`;
+    summary += `. Rolled before stop: ${rolledList(rolled, compact)}.`;
+    parts2.push(summary);
+    if (checklist.length > 0)
+      parts2.push("", ...checklist);
+    return parts2.join(`
+`);
   }
-  const progress = rolledCount > 0 ? ` · ${rolledCount} rolled` : "";
-  return `⏳ ${head} — ${phaseLine(s)}${progress}`;
+  const parts = [headerLine(s, "⏳"), `**Phase:** ${phaseLine(s)}`];
+  if (checklist.length > 0)
+    parts.push("", ...checklist);
+  const footer = [];
+  if (s.m !== undefined)
+    footer.push(`${rolledCount}/${s.m} rolled`);
+  else if (rolledCount > 0)
+    footer.push(`${rolledCount} rolled`);
+  if (elapsedMs !== undefined)
+    footer.push(`elapsed ${formatDurationMs(elapsedMs)}`);
+  const eta = etaLine(s);
+  if (eta)
+    footer.push(eta);
+  if (footer.length > 0)
+    parts.push("", footer.join(" · "));
+  return parts.join(`
+`);
+}
+function renderRolloutStatus(s) {
+  const full = renderWith(s, false);
+  if (full.length <= MAX_RENDER_CHARS)
+    return full;
+  return renderWith(s, true);
 }
 
 // src/scheduler/dispatch.ts
@@ -29887,11 +30270,11 @@ function resolveDigests(imageRefs) {
   return out;
 }
 function readCachedInstallType(bindRoot) {
-  const cacheDir = join9(bindRoot, ".switchroom");
-  const cachePath = join9(cacheDir, "install-type.json");
-  if (existsSync9(cachePath)) {
+  const cacheDir = join10(bindRoot, ".switchroom");
+  const cachePath = join10(cacheDir, "install-type.json");
+  if (existsSync10(cachePath)) {
     try {
-      const raw = readFileSync7(cachePath, "utf-8");
+      const raw = readFileSync8(cachePath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed.install_type === "string" && typeof parsed.detected_at === "string") {
         return parsed;
@@ -29908,10 +30291,10 @@ function readCachedInstallType(bindRoot) {
     source_paths: ctx.source_paths
   };
   try {
-    mkdirSync3(cacheDir, { recursive: true });
+    mkdirSync4(cacheDir, { recursive: true });
     const tmp = `${cachePath}.tmp`;
-    writeFileSync4(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
-    renameSync2(tmp, cachePath);
+    writeFileSync5(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
+    renameSync3(tmp, cachePath);
   } catch {}
   return payload;
 }
@@ -29940,7 +30323,7 @@ function writeFileInPlacePreservingInode(targetPath, content) {
   } finally {
     closeSync3(fd);
   }
-  const readBack = readFileSync7(targetPath);
+  const readBack = readFileSync8(targetPath);
   if (readBack.length !== buf.length) {
     throw new Error(`in-place write short: wrote ${buf.length} bytes but read back ${readBack.length}`);
   }
@@ -29965,7 +30348,7 @@ class HostdServer {
     this.opts = opts;
   }
   async start() {
-    const hostdDir = join9(this.opts.homeDir, ".switchroom", "hostd");
+    const hostdDir = join10(this.opts.homeDir, ".switchroom", "hostd");
     await mkdir(hostdDir, { recursive: true });
     await chmod(hostdDir, 493).catch(() => {
       return;
@@ -29980,13 +30363,13 @@ class HostdServer {
     }
     try {
       for (const name of agentNames) {
-        const dir = join9(hostdDir, name);
-        const sockPath = join9(dir, "sock");
+        const dir = join10(hostdDir, name);
+        const sockPath = join10(dir, "sock");
         await mkdir(dir, { recursive: true });
         await chmod(dir, 493).catch(() => {
           return;
         });
-        if (existsSync9(sockPath))
+        if (existsSync10(sockPath))
           await unlink(sockPath).catch(() => {
             return;
           });
@@ -30017,13 +30400,13 @@ class HostdServer {
           process.stderr.write(`hostd: SWITCHROOM_HOSTD_OPERATOR_UID='${opUidStr}' is not a positive integer; skipping operator listener
 `);
         } else {
-          const dir = join9(hostdDir, "operator");
-          const sockPath = join9(dir, "sock");
+          const dir = join10(hostdDir, "operator");
+          const sockPath = join10(dir, "sock");
           await mkdir(dir, { recursive: true });
           await chmod(dir, 493).catch(() => {
             return;
           });
-          if (existsSync9(sockPath))
+          if (existsSync10(sockPath))
             await unlink(sockPath).catch(() => {
               return;
             });
@@ -30059,11 +30442,11 @@ class HostdServer {
   }
   async reconcileOrphanedFleetMutations() {
     const path2 = this.auditLogPath();
-    if (!existsSync9(path2))
+    if (!existsSync10(path2))
       return;
     let raw;
     try {
-      raw = readFileSync7(path2, "utf-8");
+      raw = readFileSync8(path2, "utf-8");
     } catch {
       return;
     }
@@ -30393,10 +30776,10 @@ class HostdServer {
   missingApplyAssets() {
     const root = this.opts.applyAssetsRoot ?? resolve8(import.meta.dirname, "../..");
     return [
-      join9(root, "profiles"),
-      join9(root, "profiles", "default"),
-      join9(root, "vendor", "hindsight-memory")
-    ].filter((p) => !existsSync9(p));
+      join10(root, "profiles"),
+      join10(root, "profiles", "default"),
+      join10(root, "vendor", "hindsight-memory")
+    ].filter((p) => !existsSync10(p));
   }
   applyAssetPreflight(request_id, started) {
     const missing = this.missingApplyAssets();
@@ -30560,19 +30943,19 @@ class HostdServer {
     return entry;
   }
   hostdDirPath() {
-    return join9(this.opts.homeDir, ".switchroom", "hostd");
+    return join10(this.opts.homeDir, ".switchroom", "hostd");
   }
   hostdDirHostPath() {
     const hostHome = this.opts.hostHomeDir ?? process.env.SWITCHROOM_HOST_HOME?.trim() ?? this.opts.homeDir;
-    return join9(hostHome, ".switchroom", "hostd");
+    return join10(hostHome, ".switchroom", "hostd");
   }
   async beginSelfBump(req, caller, started) {
     const ownVersion = this.opts.selfVersion ?? SWITCHROOM_VERSION;
-    const composePath = join9(this.hostdDirPath(), "docker-compose.yml");
-    if (!existsSync9(composePath)) {
+    const composePath = join10(this.hostdDirPath(), "docker-compose.yml");
+    if (!existsSync10(composePath)) {
       return deniedResponse(req.request_id, `rollout: hostd's CLI (v${ownVersion}) is older than the target ` + `${req.args.pin} and needs a self-bump first, but its compose file ` + `is missing at ${composePath}. Run \`switchroom hostd install ` + `--tag ${req.args.pin}\` on the host, then re-run the roll. ` + `Nothing was changed.`, Date.now() - started);
     }
-    const before = readFileSync7(composePath, "utf8");
+    const before = readFileSync8(composePath, "utf8");
     const bumped = bumpHostdComposeImageTag(before, req.args.pin);
     if (!bumped) {
       return deniedResponse(req.request_id, `rollout: hostd needs a self-bump to ${req.args.pin} but no ` + `switchroom-hostd image line was found in ${composePath} ` + `(hand-edited compose?). Run \`switchroom hostd install --tag ` + `${req.args.pin}\` on the host, then re-run the roll. Nothing ` + `was changed.`, Date.now() - started);
@@ -30593,10 +30976,10 @@ class HostdServer {
     try {
       const baks = readdirSync3(this.hostdDirPath()).filter((f) => f.startsWith("docker-compose.yml.bak-selfbump-")).sort();
       for (const f of baks.slice(0, Math.max(0, baks.length - 4))) {
-        unlinkSync(join9(this.hostdDirPath(), f));
+        unlinkSync2(join10(this.hostdDirPath(), f));
       }
     } catch {}
-    const markerPath = join9(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+    const markerPath = join10(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
     const marker = {
       v: 1,
       request_id: req.request_id,
@@ -30609,8 +30992,8 @@ class HostdServer {
       prior_hostd_version: ownVersion
     };
     copyFileSync2(composePath, bakPath);
-    writeFileSync4(composePath, bumped.yaml, "utf8");
-    writeFileSync4(markerPath, encodePendingRolloutMarker(marker), {
+    writeFileSync5(composePath, bumped.yaml, "utf8");
+    writeFileSync5(markerPath, encodePendingRolloutMarker(marker), {
       mode: 384
     });
     const entry = {
@@ -30635,7 +31018,7 @@ class HostdServer {
     const rollbackBump = () => {
       try {
         copyFileSync2(bakPath, composePath);
-        unlinkSync(markerPath);
+        unlinkSync2(markerPath);
       } catch (e) {
         process.stderr.write(`hostd: self-bump rollback failed (compose/marker may need manual ` + `restore from ${bakPath}): ${e.message}
 `);
@@ -30678,7 +31061,7 @@ class HostdServer {
       rollbackBump();
       entry.result = "error";
       entry.finished_at = Date.now();
-      entry.error = `self-bump helper failed (container exit ${Number.isFinite(code) ? code : "unknown"}). ` + `See ${join9(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)} on the host. ` + `Compose bump rolled back. Fallback: \`switchroom hostd install ` + `--tag ${req.args.pin}\` host-side, then re-run the roll.`;
+      entry.error = `self-bump helper failed (container exit ${Number.isFinite(code) ? code : "unknown"}). ` + `See ${join10(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)} on the host. ` + `Compose bump rolled back. Fallback: \`switchroom hostd install ` + `--tag ${req.args.pin}\` host-side, then re-run the roll.`;
       if (this.fleetMutationInFlight && this.fleetMutationInFlight.request_id === entry.request_id) {
         this.fleetMutationInFlight = null;
       }
@@ -30702,15 +31085,15 @@ class HostdServer {
     };
   }
   async resumePendingSelfBumpRollout() {
-    const markerPath = join9(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
-    if (!existsSync9(markerPath))
+    const markerPath = join10(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+    if (!existsSync10(markerPath))
       return;
     let raw;
     try {
-      raw = readFileSync7(markerPath, "utf8");
+      raw = readFileSync8(markerPath, "utf8");
     } finally {
       try {
-        unlinkSync(markerPath);
+        unlinkSync2(markerPath);
       } catch {}
     }
     const marker = parsePendingRolloutMarker(raw);
@@ -30747,7 +31130,7 @@ class HostdServer {
       return;
     }
     if (needsSelfBump(ownVersion, marker.pin)) {
-      await failResume(`hostd is still on v${ownVersion} after the self-bump to ` + `${marker.pin} (helper failed? see ` + `${join9(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)}). ` + `Fallback: \`switchroom hostd install --tag ${marker.pin}\` ` + `host-side, then re-issue the rollout.`);
+      await failResume(`hostd is still on v${ownVersion} after the self-bump to ` + `${marker.pin} (helper failed? see ` + `${join10(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)}). ` + `Fallback: \`switchroom hostd install --tag ${marker.pin}\` ` + `host-side, then re-issue the rollout.`);
       return;
     }
     process.stderr.write(`hostd: resuming rollout ${marker.request_id} → ${marker.pin} after ` + `self-bump (v${marker.prior_hostd_version} → v${ownVersion})
@@ -30841,7 +31224,7 @@ class HostdServer {
     if (caller.kind === "agent" && this.opts.config.agents[caller.name]?.admin !== true) {
       let beforeContent;
       try {
-        beforeContent = readFileSync7(configPath, "utf-8");
+        beforeContent = readFileSync8(configPath, "utf-8");
       } catch {
         beforeContent = "";
       }
@@ -30945,7 +31328,7 @@ class HostdServer {
     try {
       let snapshot;
       try {
-        snapshot = readFileSync7(configPath, "utf-8");
+        snapshot = readFileSync8(configPath, "utf-8");
       } catch (e) {
         await approval.finalize({
           outcome: "reconcile_failed_rolled_back",
@@ -31197,8 +31580,8 @@ ${output.recovery.stderr}` : "";
     if (this.opts.imageRefsForDigests)
       return this.opts.imageRefsForDigests();
     try {
-      const composePath = join9(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
-      if (!existsSync9(composePath))
+      const composePath = join10(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
+      if (!existsSync10(composePath))
         return [];
       const r = spawnSync3("docker", [
         "compose",
@@ -31306,6 +31689,9 @@ ${output.recovery.stderr}` : "";
         target: entry.pin ?? "",
         rolled: entry.rolled,
         terminal: entry.result === "completed" ? "completed" : "error",
+        requestId: entry.request_id,
+        ...entry.prior_pin ? { fromVersion: entry.prior_pin } : {},
+        ...entry.finished_at !== null ? { elapsedMs: entry.finished_at - entry.started_at } : {},
         ...entry.failed_step ? { failedStep: entry.failed_step } : {},
         ...entry.failed_agent ? { failedAgent: entry.failed_agent } : {},
         ...entry.got !== undefined ? { got: entry.got } : {}
@@ -31334,10 +31720,10 @@ ${output.recovery.stderr}` : "";
   }
   rolloutRowExistsInLog(targetRequestId) {
     const path2 = this.auditLogPath();
-    if (!existsSync9(path2))
+    if (!existsSync10(path2))
       return false;
     try {
-      const raw = readFileSync7(path2, "utf-8");
+      const raw = readFileSync8(path2, "utf-8");
       return latestRolloutRowForRequest(raw, targetRequestId) !== null;
     } catch {
       return false;
@@ -31345,11 +31731,11 @@ ${output.recovery.stderr}` : "";
   }
   rolloutStatusFromLog(responseRequestId, targetRequestId, started) {
     const path2 = this.auditLogPath();
-    if (!existsSync9(path2))
+    if (!existsSync10(path2))
       return null;
     let raw;
     try {
-      raw = readFileSync7(path2, "utf-8");
+      raw = readFileSync8(path2, "utf-8");
     } catch {
       return null;
     }
@@ -31428,7 +31814,7 @@ ${output.recovery.stderr}` : "";
     }
   }
   auditLogPath() {
-    return this.opts.auditLogPath ?? join9(this.opts.homeDir, ".switchroom", "host-control-audit.log");
+    return this.opts.auditLogPath ?? join10(this.opts.homeDir, ".switchroom", "host-control-audit.log");
   }
   appendAuditRow(row) {
     const path2 = this.auditLogPath();
@@ -31681,7 +32067,7 @@ function isSafeExecArgvElement(s) {
 }
 
 // src/host-control/approval-gateway.ts
-import { connect } from "node:net";
+import { connect as connect2 } from "node:net";
 
 class SocketApprovalGateway {
   opts;
@@ -31699,7 +32085,7 @@ class SocketApprovalGateway {
       };
     }
     return await new Promise((resolve9) => {
-      const client2 = connect({ path: sockPath });
+      const client2 = connect2({ path: sockPath });
       let buffer = "";
       let resolved = false;
       const log = this.opts.log ?? (() => {});
@@ -31803,7 +32189,7 @@ class SocketApprovalGateway {
 }
 
 // src/host-control/rollout-relay.ts
-import { connect as connect2 } from "node:net";
+import { connect as connect3 } from "node:net";
 
 class SocketRolloutRelay {
   opts;
@@ -31824,7 +32210,7 @@ class SocketRolloutRelay {
       return;
     }
     try {
-      const client2 = connect2({ path: sockPath });
+      const client2 = connect3({ path: sockPath });
       client2.setTimeout(5000);
       const done = () => {
         try {
@@ -31862,7 +32248,7 @@ class SocketRolloutRelay {
 }
 
 // src/host-control/rollout-narration-relay.ts
-import { connect as connect3 } from "node:net";
+import { connect as connect4 } from "node:net";
 var DEFAULT_POST_REPLY_TIMEOUT_MS = 5000;
 
 class SocketRolloutNarrationRelay {
@@ -31896,7 +32282,7 @@ class SocketRolloutNarrationRelay {
       };
       let client2;
       try {
-        client2 = connect3({ path: sockPath });
+        client2 = connect4({ path: sockPath });
       } catch (e) {
         log(`narration post connect threw: ${e.message}`);
         resolve9(null);
@@ -31966,7 +32352,7 @@ class SocketRolloutNarrationRelay {
     if (sockPath === null)
       return;
     try {
-      const client2 = connect3({ path: sockPath });
+      const client2 = connect4({ path: sockPath });
       client2.setTimeout(5000);
       const done = () => {
         try {
@@ -32013,6 +32399,47 @@ class LogTailRolloutNarrator {
     this.relay = relay;
     this.opts = opts;
   }
+  now() {
+    return this.opts.now?.() ?? Date.now();
+  }
+  static upsertAgent(st, name, patch) {
+    const existing = st.agents.find((a) => a.name === name);
+    if (existing)
+      Object.assign(existing, patch);
+    else
+      st.agents.push({ name, status: "pending", ...patch });
+  }
+  trackAgentProgress(st, phase) {
+    const now = this.now();
+    switch (phase.phase) {
+      case "canary-start":
+      case "agent-start":
+        if (phase.agent) {
+          LogTailRolloutNarrator.upsertAgent(st, phase.agent, {
+            status: "running",
+            startedAtMs: now,
+            ...phase.phase === "canary-start" ? { canary: true } : {}
+          });
+        }
+        break;
+      case "canary-pass":
+      case "agent-done":
+      case "canary-fail": {
+        if (!phase.agent)
+          break;
+        const a = st.agents.find((x) => x.name === phase.agent);
+        const durationMs = a?.startedAtMs !== undefined ? now - a.startedAtMs : undefined;
+        LogTailRolloutNarrator.upsertAgent(st, phase.agent, {
+          status: phase.phase === "canary-fail" ? "failed" : "done",
+          ...durationMs !== undefined ? { durationMs } : {},
+          ...phase.phase !== "agent-done" ? { canary: true } : {}
+        });
+        break;
+      }
+      default:
+        break;
+    }
+  }
   static seqFor(phase) {
     switch (phase.phase) {
       case "self-bump":
@@ -32031,6 +32458,8 @@ class LogTailRolloutNarrator {
         return 2 * (phase.n ?? 1) + 0;
       case "agent-done":
         return 2 * (phase.n ?? 1) + 1;
+      case "web-refresh":
+        return Number.MAX_SAFE_INTEGER - 2;
       case "hostd-web-deferred":
         return Number.MAX_SAFE_INTEGER - 1;
       default:
@@ -32046,6 +32475,7 @@ class LogTailRolloutNarrator {
       if (seq < st.lastAppliedSeq)
         return;
       st.lastAppliedSeq = seq;
+      this.trackAgentProgress(st, phase);
       st.render = {
         ...st.render,
         target: phase.target,
@@ -32053,7 +32483,11 @@ class LogTailRolloutNarrator {
         ...phase.n !== undefined ? { n: phase.n } : {},
         ...phase.m !== undefined ? { m: phase.m } : {},
         ...phase.agent !== undefined ? { agent: phase.agent } : {},
-        rolled: entry.rolled
+        rolled: entry.rolled,
+        agents: st.agents,
+        requestId: entry.request_id,
+        ...entry.prior_pin ? { fromVersion: entry.prior_pin } : {},
+        startedAtMs: entry.started_at
       };
       this.scheduleRenderOrPost(entry.request_id);
     } catch (e) {
@@ -32063,13 +32497,29 @@ class LogTailRolloutNarrator {
   onTerminal(entry) {
     try {
       const st = this.ensureState(entry);
+      const rolled = new Set(entry.rolled ?? []);
+      for (const a of st.agents) {
+        if (entry.failed_agent && a.name === entry.failed_agent) {
+          a.status = "failed";
+        } else if (rolled.has(a.name)) {
+          a.status = "done";
+        } else if (a.status === "running") {
+          a.status = "pending";
+        }
+      }
       st.render = {
         target: entry.pin ?? st.render.target,
         rolled: entry.rolled ?? st.render.rolled,
         terminal: entry.result === "completed" ? "completed" : "error",
         ...entry.failed_step ? { failedStep: entry.failed_step } : {},
         ...entry.failed_agent ? { failedAgent: entry.failed_agent } : {},
-        ...entry.got !== undefined ? { got: entry.got } : {}
+        ...entry.got !== undefined ? { got: entry.got } : {},
+        ...st.agents.length > 0 ? { agents: st.agents } : {},
+        ...st.render.m !== undefined ? { m: st.render.m } : {},
+        requestId: entry.request_id,
+        ...entry.prior_pin ?? st.render.fromVersion ? { fromVersion: entry.prior_pin ?? st.render.fromVersion } : {},
+        elapsedMs: (entry.finished_at ?? this.now()) - entry.started_at,
+        deferred: false
       };
       st.frozen = true;
       if (st.timer) {
@@ -32094,6 +32544,7 @@ class LogTailRolloutNarrator {
         postAttempts: 0,
         postFailed: false,
         render: { target: entry.pin ?? "" },
+        agents: [],
         frozen: false,
         timer: null,
         pendingEditAfterPost: false
@@ -32132,7 +32583,7 @@ class LogTailRolloutNarrator {
       return false;
     st.posting = true;
     st.postAttempts += 1;
-    const text = renderRolloutStatus(st.render);
+    const text = renderRolloutStatus({ ...st.render, nowMs: this.now() });
     this.relay.post({ requestId, agentName: st.agentName, text }).then((mid) => {
       st.posting = false;
       if (mid === null) {
@@ -32184,7 +32635,7 @@ class LogTailRolloutNarrator {
       this.tryPost(requestId, true);
       return;
     }
-    const text = renderRolloutStatus(st.render);
+    const text = renderRolloutStatus({ ...st.render, nowMs: this.now() });
     this.relay.edit({
       requestId,
       agentName: st.agentName,
@@ -32442,8 +32893,60 @@ function makeRestart(switchroomBin) {
 
 // src/host-control/main.ts
 import { appendFile as appendFile2 } from "node:fs/promises";
+async function loadConfigResilient() {
+  try {
+    const config = loadConfig();
+    clearStaleDegradedMarker(homedir6(), (m) => process.stderr.write(`hostd: ${m}
+`));
+    return config;
+  } catch (err2) {
+    if (!(err2 instanceof ConfigError))
+      throw err2;
+    let configPath;
+    try {
+      configPath = findConfigFile();
+    } catch {
+      configPath = undefined;
+    }
+    const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join11(homedir6(), ".switchroom", "agents");
+    const listGatewayCandidates = () => {
+      const out = [];
+      try {
+        for (const name of readdirSync4(agentsDir).sort()) {
+          const sock = resolve9(agentsDir, name, "telegram", "gateway.sock");
+          if (existsSync11(sock))
+            out.push({ agent: name, sock });
+        }
+      } catch {}
+      return out;
+    };
+    const log = (m) => {
+      process.stderr.write(`hostd: ${m}
+`);
+    };
+    const notify = (text) => {
+      const candidates = listGatewayCandidates();
+      if (candidates.length === 0) {
+        log("config-degraded: no gateway socket paths found; relying on marker file");
+        return;
+      }
+      postOperatorNoticeViaGateways(candidates, text, log).then((agent) => {
+        if (agent !== null)
+          log(`config-degraded: operator DM relayed via ${agent}`);
+      });
+    };
+    return waitForConfigRecovery({
+      initialError: err2,
+      homeDir: homedir6(),
+      loadFn: () => loadConfig(),
+      configPath,
+      notify,
+      log
+    });
+  }
+}
 async function main() {
-  const config = loadConfig();
+  const config = await loadConfigResilient();
   if (config.host_control?.enabled !== true) {
     process.stderr.write(`hostd: refusing to start — host_control.enabled is not true in switchroom.yaml
 `);
@@ -32458,10 +32961,10 @@ async function main() {
 `);
     process.exit(2);
   }
-  const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join10(homedir6(), ".switchroom", "agents");
+  const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join11(homedir6(), ".switchroom", "agents");
   const resolveGatewaySocket = (agentName) => {
     const sock = resolve9(agentsDir, agentName, "telegram", "gateway.sock");
-    return existsSync10(sock) ? sock : null;
+    return existsSync11(sock) ? sock : null;
   };
   const approvalGateway = new SocketApprovalGateway({
     resolveGatewaySocket,
@@ -32504,7 +33007,7 @@ async function main() {
   let releaseWatcher = null;
   const autoRel = config.host_control?.auto_release_check;
   if (autoRel?.enabled === true) {
-    const eventsLog = join10(homedir6(), ".switchroom", "release-watcher-events.jsonl");
+    const eventsLog = join11(homedir6(), ".switchroom", "release-watcher-events.jsonl");
     releaseWatcher = new ReleaseWatcher({
       intervalMs: autoRel.interval_minutes * 60000,
       checkFn: makeReleaseCheck({