switchroom 0.19.1 → 0.19.3

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.19.1", COMMIT_SHA = "370b7c4b";
+var VERSION = "0.19.3", COMMIT_SHA = "41896be4";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -15452,14 +15452,27 @@ __export(exports_atomic, {
   atomicWriteFileSync: () => atomicWriteFileSync
 });
 import { randomBytes } from "node:crypto";
-import { closeSync as closeSync2, constants, fsyncSync, openSync as openSync2, renameSync, rmSync, writeSync } from "node:fs";
-function atomicWriteFileSync(destPath, contents, mode = 384) {
+import { closeSync as closeSync2, constants, fchmodSync, fchownSync, fsyncSync, openSync as openSync2, renameSync, rmSync, writeSync } from "node:fs";
+function atomicWriteFileSync(destPath, contents, modeOrOpts = 384) {
+  const opts = typeof modeOrOpts === "number" ? { mode: modeOrOpts } : modeOrOpts;
+  const mode = opts.mode ?? 384;
   const tmp = `${destPath}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
   const buf = typeof contents === "string" ? Buffer.from(contents, "utf-8") : contents;
   let fd = null;
   try {
     fd = openSync2(tmp, TMP_OPEN_FLAGS, mode);
     writeSync(fd, buf, 0, buf.length, 0);
+    fchmodSync(fd, mode);
+    if (opts.uid !== undefined) {
+      try {
+        fchownSync(fd, opts.uid, opts.gid ?? opts.uid);
+      } catch (chownErr) {
+        if (opts.onChownError)
+          opts.onChownError(chownErr);
+        else
+          throw chownErr;
+      }
+    }
     fsyncSync(fd);
     closeSync2(fd);
     fd = null;
@@ -15655,6 +15668,53 @@ function resolveHindsightLlm(llm, litellm) {
   const model = llm?.model?.trim() || (litellm ? litellm.model ?? HINDSIGHT_DEFAULT_LITELLM_MODEL : HINDSIGHT_DEFAULT_MODEL);
   return { provider, model };
 }
+function isLoopbackHttpUrl(url) {
+  try {
+    const u = new URL(url.includes("://") ? url : `http://${url}`);
+    const h = (u.hostname || "").toLowerCase();
+    return h === "localhost" || h === "127.0.0.1" || h === "::1";
+  } catch {
+    return false;
+  }
+}
+function collectHindsightLlmBaseUrls(llm, litellm) {
+  const out = [];
+  const seen = new Set;
+  const push = (raw) => {
+    const v = raw?.trim();
+    if (!v || seen.has(v))
+      return;
+    seen.add(v);
+    out.push(v);
+  };
+  push(litellm?.baseUrl);
+  for (const [k, v] of resolveHindsightPerOpLlm(llm)) {
+    if (k.endsWith("_BASE_URL"))
+      push(v);
+  }
+  return out;
+}
+function hindsightNeedsHostNetwork(llm, litellm) {
+  if (litellm?.baseUrl?.trim())
+    return true;
+  return collectHindsightLlmBaseUrls(llm).some(isLoopbackHttpUrl);
+}
+function pickHindsightLiteLlmProbeUrl(llm, litellm) {
+  return collectHindsightLlmBaseUrls(llm, litellm)[0];
+}
+function buildLiteLlmAwareHealthPy(apiPort, litellmBaseUrl) {
+  let host = "127.0.0.1";
+  let port = "80";
+  try {
+    const u = new URL(litellmBaseUrl.includes("://") ? litellmBaseUrl : `http://${litellmBaseUrl}`);
+    host = u.hostname || host;
+    port = u.port || (u.protocol === "https:" ? "443" : "80");
+  } catch {}
+  return `import socket,urllib.request,sys;` + `r=urllib.request.urlopen('http://localhost:${apiPort}/health',timeout=4);` + `(r.getcode()==200) or sys.exit(1);` + `s=socket.create_connection(('${host}',${Number(port)}),2);s.close()`;
+}
+function buildLiteLlmAwareHealthCmd(apiPort, litellmBaseUrl) {
+  return `python3 -c "${buildLiteLlmAwareHealthPy(apiPort, litellmBaseUrl)}"`;
+}
 function startHindsight(ports, litellm, imageTag, llm, mirrorDir) {
   const apiPort = ports?.apiPort ?? HINDSIGHT_DEFAULT_API_PORT;
   const uiPort = ports?.uiPort ?? HINDSIGHT_DEFAULT_UI_PORT;
@@ -15687,7 +15747,9 @@ function startHindsight(ports, litellm, imageTag, llm, mirrorDir) {
     "-e",
     `HINDSIGHT_API_CONSOLIDATION_LLM_PARALLELISM=${HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM}`,
     "-e",
-    `HINDSIGHT_API_CONSOLIDATION_MAX_MEMORIES_PER_ROUND=${HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND}`
+    `HINDSIGHT_API_CONSOLIDATION_MAX_MEMORIES_PER_ROUND=${HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND}`,
+    "-e",
+    `HINDSIGHT_API_WORKER_ID=${HINDSIGHT_DEFAULT_WORKER_ID}`
   ];
   if (llmProvider === "claude-code") {
     envArgs.push("-e", `ANTHROPIC_MODEL=${llmModel}`);
@@ -15710,8 +15772,15 @@ x-litellm-tags: service:hindsight`);
     `--memory-reservation=${HINDSIGHT_DEFAULT_MEM_RESERVATION}`,
     `--pids-limit=${HINDSIGHT_DEFAULT_PIDS_LIMIT}`,
     `--shm-size=${HINDSIGHT_DEFAULT_SHM_SIZE}`,
-    "--health-cmd",
-    litellm ? `python3 -c 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:${apiPort}/health",timeout=4).getcode()==200 else 1)'` : HINDSIGHT_HEALTHCHECK_CMD,
+    ...(() => {
+      const hostNet = hindsightNeedsHostNetwork(llm, litellm);
+      const healthApiPort = hostNet ? apiPort : 8888;
+      const probe = pickHindsightLiteLlmProbeUrl(llm, litellm);
+      return [
+        "--health-cmd",
+        probe ? buildLiteLlmAwareHealthCmd(healthApiPort, probe) : HINDSIGHT_HEALTHCHECK_CMD
+      ];
+    })(),
     "--health-interval",
     "30s",
     "--health-timeout",
@@ -15721,8 +15790,11 @@ x-litellm-tags: service:hindsight`);
     "--health-start-period",
     "60s"
   ];
-  if (litellm) {
+  if (hindsightNeedsHostNetwork(llm, litellm)) {
     args.push("--network", "host");
+    if (!litellm) {
+      envArgs.push("-e", `HINDSIGHT_API_PORT=${apiPort}`, "-e", `HINDSIGHT_CP_DATAPLANE_API_URL=http://localhost:${apiPort}`);
+    }
   } else {
     args.push("-p", `127.0.0.1:${apiPort}:8888`, "-p", `127.0.0.1:${uiPort}:9999`);
   }
@@ -15744,13 +15816,40 @@ x-litellm-tags: service:hindsight`);
   }
   execFileSync("docker", args, { stdio: "pipe" });
 }
-function stopHindsight() {
+function listHindsightDataVolumeMounts(exec = (cmd, args) => execFileSync(cmd, args, { stdio: "pipe", encoding: "utf-8" })) {
   try {
-    execFileSync("docker", ["stop", "switchroom-hindsight"], { stdio: "pipe" });
-  } catch {}
-  try {
-    execFileSync("docker", ["rm", "switchroom-hindsight"], { stdio: "pipe" });
-  } catch {}
+    const out = exec("docker", [
+      "ps",
+      "-a",
+      "--filter",
+      `volume=${HINDSIGHT_DATA_VOLUME}`,
+      "--format",
+      "{{.Names}}"
+    ]);
+    return out.split(`
+`).map((l) => l.trim()).filter((n) => n.length > 0);
+  } catch {
+    return [];
+  }
+}
+function stopHindsight(exec = (cmd, args) => {
+  execFileSync(cmd, args, { stdio: "pipe" });
+}, listMounts = () => listHindsightDataVolumeMounts()) {
+  const names = new Set([HINDSIGHT_DEFAULT_WORKER_ID, ...listMounts()]);
+  for (const name of names) {
+    if (name !== HINDSIGHT_DEFAULT_WORKER_ID) {
+      console.error(`stopHindsight: removing hindsight data-volume twin ${name} (not the canonical ${HINDSIGHT_DEFAULT_WORKER_ID})`);
+    }
+    try {
+      exec("docker", ["update", "--restart=no", name]);
+    } catch {}
+    try {
+      exec("docker", ["stop", name]);
+    } catch {}
+    try {
+      exec("docker", ["rm", "-f", name]);
+    } catch {}
+  }
 }
 function pullHindsightImage(imageTag) {
   execFileSync("docker", ["pull", hindsightImageRef(imageTag)], { stdio: "inherit" });
@@ -15808,17 +15907,30 @@ function getHindsightStatus() {
     return null;
   }
 }
-function generateHindsightComposeSnippet(llm, mirrorDir) {
-  const { provider: llmProvider, model: llmModel } = resolveHindsightLlm(llm);
+function generateHindsightComposeSnippet(llm, mirrorDir, litellm) {
+  const { provider: llmProvider, model: llmModel } = resolveHindsightLlm(llm, litellm);
   const perOpLlm = resolveHindsightPerOpLlm(llm);
+  const hostNetwork = hindsightNeedsHostNetwork(llm, litellm);
+  const apiPort = HINDSIGHT_DEFAULT_API_PORT;
+  const internalApiPort = hostNetwork ? apiPort : 8888;
+  const probeUrl = pickHindsightLiteLlmProbeUrl(llm, litellm);
+  const healthPy = probeUrl ? buildLiteLlmAwareHealthPy(internalApiPort, probeUrl) : HINDSIGHT_HEALTHCHECK_PY;
   const environment = [
     `      - HINDSIGHT_API_MAX_OBSERVATIONS_PER_SCOPE=${HINDSIGHT_DEFAULT_MAX_OBSERVATIONS_PER_SCOPE}`,
     `      - HINDSIGHT_API_LLM_PROVIDER=${llmProvider}`,
     `      - HINDSIGHT_API_LLM_MODEL=${llmModel}`,
     ...perOpLlm.map(([k, v]) => `      - ${k}=${v}`),
     ...llmProvider === "claude-code" ? [`      - ANTHROPIC_MODEL=${llmModel}`] : [],
-    `      - HINDSIGHT_CP_DATAPLANE_API_URL=http://localhost:8888`
+    ...hostNetwork ? [
+      `      - HINDSIGHT_API_PORT=${apiPort}`,
+      `      - HINDSIGHT_CP_DATAPLANE_API_URL=http://localhost:${apiPort}`
+    ] : [`      - HINDSIGHT_CP_DATAPLANE_API_URL=http://localhost:8888`]
   ];
+  if (litellm?.baseUrl?.trim() && litellm.apiKey?.trim()) {
+    const litellmRoot = litellm.baseUrl.replace(/\/+$/, "");
+    const anthropicBaseUrl = isClaudeModel(llmModel) ? `${litellmRoot}/anthropic` : litellmRoot;
+    environment.push(`      - ANTHROPIC_BASE_URL=${anthropicBaseUrl}`, `      - ANTHROPIC_CUSTOM_HEADERS=x-litellm-api-key: Bearer ${litellm.apiKey}\\nx-litellm-customer-id: hindsight\\nx-litellm-tags: service:hindsight`);
+  }
   const initService = mirrorDir ? [
     "  switchroom-hindsight-creds-init:",
     `    image: ${HINDSIGHT_IMAGE}`,
@@ -15835,6 +15947,13 @@ function generateHindsightComposeSnippet(llm, mirrorDir) {
     "      switchroom-hindsight-creds-init:",
     "        condition: service_completed_successfully"
   ] : [];
+  const networkOrPorts = hostNetwork ? [
+    "    network_mode: host"
+  ] : [
+    "    ports:",
+    `      - "127.0.0.1:${HINDSIGHT_DEFAULT_API_PORT}:8888"`,
+    '      - "127.0.0.1:19999:9999"'
+  ];
   return [
     "services:",
     ...initService,
@@ -15842,9 +15961,7 @@ function generateHindsightComposeSnippet(llm, mirrorDir) {
     `    image: ${HINDSIGHT_IMAGE}`,
     "    container_name: switchroom-hindsight",
     ...dependsOn,
-    "    ports:",
-    `      - "127.0.0.1:${HINDSIGHT_DEFAULT_API_PORT}:8888"`,
-    '      - "127.0.0.1:19999:9999"',
+    ...networkOrPorts,
     "    environment:",
     ...environment,
     `      - HINDSIGHT_API_MCP_STATELESS=${HINDSIGHT_DEFAULT_MCP_STATELESS}`,
@@ -15857,12 +15974,13 @@ function generateHindsightComposeSnippet(llm, mirrorDir) {
     `      - HINDSIGHT_API_WORKER_CONSOLIDATION_MAX_SLOTS=${HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_SLOTS}`,
     `      - HINDSIGHT_API_CONSOLIDATION_LLM_PARALLELISM=${HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM}`,
     `      - HINDSIGHT_API_CONSOLIDATION_MAX_MEMORIES_PER_ROUND=${HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND}`,
+    `      - HINDSIGHT_API_WORKER_ID=${HINDSIGHT_DEFAULT_WORKER_ID}`,
     `    mem_limit: ${HINDSIGHT_DEFAULT_MEM_LIMIT}`,
     `    mem_reservation: ${HINDSIGHT_DEFAULT_MEM_RESERVATION}`,
     `    pids_limit: ${HINDSIGHT_DEFAULT_PIDS_LIMIT}`,
     `    shm_size: ${HINDSIGHT_DEFAULT_SHM_SIZE}`,
     "    healthcheck:",
-    `      test: ${JSON.stringify(["CMD", "python3", "-c", HINDSIGHT_HEALTHCHECK_PY])}`,
+    `      test: ${JSON.stringify(["CMD", "python3", "-c", healthPy])}`,
     "      interval: 30s",
     "      timeout: 5s",
     "      retries: 3",
@@ -15946,7 +16064,7 @@ async function ensureHindsightConsumer(configPath, account, uid = HINDSIGHT_DEFA
   atomicWriteFileSync2(configPath, tail, mode);
   return { added: true, reason: "added" };
 }
-var HINDSIGHT_DEFAULT_API_PORT = 18888, HINDSIGHT_DEFAULT_UI_PORT = 9999, HINDSIGHT_DEFAULT_MCP_URL, HINDSIGHT_DEFAULT_API_BASE_URL, HINDSIGHT_DEFAULT_MAX_OBSERVATIONS_PER_SCOPE = 1000, HINDSIGHT_CONSUMER_NAME = "hindsight", HINDSIGHT_DEFAULT_UID = 11000, HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight", HINDSIGHT_IMAGE, HINDSIGHT_DEFAULT_MODEL = "claude-sonnet-5", HINDSIGHT_DEFAULT_LITELLM_MODEL = "openrouter/google/gemini-3.1-flash-lite", HINDSIGHT_DEFAULT_MCP_STATELESS = true, HINDSIGHT_BROKER_SOCK_VOLUME, HINDSIGHT_CREDS_MIRROR_VOLUME, HINDSIGHT_CRED_DIR = "/run/claude-creds", HINDSIGHT_DEFAULT_RERANKER_BUCKET_BATCHING = "true", HINDSIGHT_DEFAULT_RERANKER_MAX_CANDIDATES = 150, HINDSIGHT_DEFAULT_RERANKER_LOCAL_MAX_CONCURRENT = 4, HINDSIGHT_DEFAULT_RECALL_MAX_CONCURRENT = 8, HINDSIGHT_DEFAULT_REFLECT_WALL_TIMEOUT_S = 600, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_BATCH_SIZE = 12, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_SLOTS = 1, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM = 2, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND = 100, HINDSIGHT_DEFAULT_MEM_LIMIT = "8g", HINDSIGHT_DEFAULT_MEM_RESERVATION = "4g", HINDSIGHT_DEFAULT_PIDS_LIMIT = 1000, HINDSIGHT_DEFAULT_SHM_SIZE = "2g", HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)', HINDSIGHT_HEALTHCHECK_CMD, HINDSIGHT_LLM_OPS;
+var HINDSIGHT_DEFAULT_API_PORT = 18888, HINDSIGHT_DEFAULT_UI_PORT = 9999, HINDSIGHT_DEFAULT_MCP_URL, HINDSIGHT_DEFAULT_API_BASE_URL, HINDSIGHT_DEFAULT_MAX_OBSERVATIONS_PER_SCOPE = 1000, HINDSIGHT_CONSUMER_NAME = "hindsight", HINDSIGHT_DEFAULT_WORKER_ID = "switchroom-hindsight", HINDSIGHT_DATA_VOLUME = "switchroom-hindsight-data", HINDSIGHT_DEFAULT_UID = 11000, HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight", HINDSIGHT_IMAGE, HINDSIGHT_DEFAULT_MODEL = "claude-sonnet-5", HINDSIGHT_DEFAULT_LITELLM_MODEL = "openrouter/google/gemini-3.1-flash-lite", HINDSIGHT_DEFAULT_MCP_STATELESS = true, HINDSIGHT_BROKER_SOCK_VOLUME, HINDSIGHT_CREDS_MIRROR_VOLUME, HINDSIGHT_CRED_DIR = "/run/claude-creds", HINDSIGHT_DEFAULT_RERANKER_BUCKET_BATCHING = "true", HINDSIGHT_DEFAULT_RERANKER_MAX_CANDIDATES = 150, HINDSIGHT_DEFAULT_RERANKER_LOCAL_MAX_CONCURRENT = 4, HINDSIGHT_DEFAULT_RECALL_MAX_CONCURRENT = 8, HINDSIGHT_DEFAULT_REFLECT_WALL_TIMEOUT_S = 600, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_BATCH_SIZE = 12, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_SLOTS = 1, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM = 2, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND = 100, HINDSIGHT_DEFAULT_MEM_LIMIT = "8g", HINDSIGHT_DEFAULT_MEM_RESERVATION = "4g", HINDSIGHT_DEFAULT_PIDS_LIMIT = 1000, HINDSIGHT_DEFAULT_SHM_SIZE = "2g", HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)', HINDSIGHT_HEALTHCHECK_CMD, HINDSIGHT_LLM_OPS;
 var init_hindsight = __esm(() => {
   init_model_command();
   HINDSIGHT_DEFAULT_MCP_URL = `http://127.0.0.1:${HINDSIGHT_DEFAULT_API_PORT}/mcp/`;
@@ -16509,7 +16627,7 @@ var HINDSIGHT_SHIM_CLI_PATH = "/usr/local/bin/switchroom", HINDSIGHT_SHIM_AGENT_
 var init_hindsight2 = __esm(() => {
   init_users();
   init_hindsight();
-  DEFAULT_RETAIN_MISSION = "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise.";
+  DEFAULT_RETAIN_MISSION = "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise, " + "including in-flight workflow/process narration (a sub-task started, " + "paused, or is still running) \u2014 only retain the outcome once a task " + "actually completes or a decision is made.";
   PROFILE_MEMORY_DEFAULTS = {
     "health-coach": {
       disposition: { skepticism: 2, literalism: 2, empathy: 5 },
@@ -26989,6 +27107,7 @@ function renderHindsightSettingsOverrides(raw, additionalBanks, retainConfig) {
   settings.recallTypes = ["world", "experience", "observation"];
   settings.recallSkipTrivial = true;
   settings.directiveCaptureNudge = true;
+  settings.recallTagWeights = { sidechain: 0.8 };
   if (additionalBanks.length > 0) {
     settings.recallAdditionalBanks = [...additionalBanks];
   }
@@ -29763,6 +29882,7 @@ function describeAgents(config, litellmConfirmedAgents) {
         smallFastModel: resolved.litellm?.small_fast_model ?? config.litellm?.small_fast_model ?? "claude-haiku-4-5-20251001"
       },
       model: resolveMainModel(resolved.model),
+      tmuxSupervisor: resolved.experimental?.legacy_pty !== true,
       timezone: resolveTimezone(config, resolved, {
         onUtcFallback: () => {
           console.warn(`  \u26a0 timezone: no explicit timezone set and server detection resolved to UTC ` + `for agent "${name}" \u2014 cron schedules and the per-turn time hint will ` + `run in UTC. Add \`switchroom.timezone: "Region/City"\` (e.g. ` + `"Australia/Melbourne") to switchroom.yaml to silence this warning.`);
@@ -30033,11 +30153,25 @@ function generateCompose(opts) {
     lines.push(`      SWITCHROOM_CONFIG: /state/config/switchroom.yaml`);
   }
   lines.push(`      SWITCHROOM_AUTH_BROKER_STATE_DIR: /state/auth-broker`);
+  let authBrokerNeedsHostGateway = false;
+  {
+    const llBase = config.litellm?.base_url;
+    if (typeof llBase === "string" && llBase.trim()) {
+      const raw = llBase.trim().replace(/\/+$/, "");
+      const bridged = raw.replace(/^http:\/\/127\.0\.0\.1(?=[:/]|$)/i, "http://host.docker.internal").replace(/^http:\/\/localhost(?=[:/]|$)/i, "http://host.docker.internal").replace(/^https:\/\/127\.0\.0\.1(?=[:/]|$)/i, "https://host.docker.internal").replace(/^https:\/\/localhost(?=[:/]|$)/i, "https://host.docker.internal");
+      lines.push(`      SWITCHROOM_LITELLM_BASE: ${JSON.stringify(bridged)}`);
+      authBrokerNeedsHostGateway = true;
+    }
+  }
   lines.push(`      SWITCHROOM_ACCOUNTS_DIR: /state/accounts`);
   lines.push(`      SWITCHROOM_AGENTS_DIR: /state/agents`);
   if (opts.operatorUid !== undefined) {
     lines.push(`      SWITCHROOM_AUTH_BROKER_OPERATOR_UID: "${opts.operatorUid}"`);
   }
+  if (authBrokerNeedsHostGateway) {
+    lines.push(`    extra_hosts:`);
+    lines.push(`      - "host.docker.internal:host-gateway"`);
+  }
   lines.push(`    volumes:`);
   for (const a of describeAgents(config, opts.litellmConfirmedAgents)) {
     lines.push(`      - auth-broker-${a.name}-sock:/run/switchroom/auth-broker/${a.name}`);
@@ -30211,6 +30345,7 @@ function emitAgentService(lines, a, imageTag, buildMode, buildContext, homePrefi
     env2.ANTHROPIC_SMALL_FAST_MODEL = a.litellm.smallFastModel;
   }
   env2.SWITCHROOM_VOICE_ENGINE = voiceEngine;
+  env2.SWITCHROOM_TMUX_SUPERVISOR = a.tmuxSupervisor ? "1" : "0";
   for (const [k, v] of Object.entries(a.userEnv)) {
     if (env2[k] === undefined)
       env2[k] = v;
@@ -32692,7 +32827,7 @@ function decodeResponse2(line) {
   }
   return ResponseSchema2.parse(parsed);
 }
-var MAX_FRAME_BYTES2, PROTOCOL_VERSION = 1, ProviderNameSchema, GetCredentialsRequestSchema, ListStateRequestSchema, SetActiveRequestSchema, MarkExhaustedRequestSchema, MarkThrottledRequestSchema, RefreshAccountRequestSchema, AnthropicCredentialsSchema, GoogleCredentialsSchema, MicrosoftCredentialsSchema, ProviderCredentialsSchema, AddAccountRequestSchema, RmAccountRequestSchema, SetOverrideRequestSchema, ListGoogleAccountsRequestSchema, ListMicrosoftAccountsRequestSchema, ProbeQuotaRequestSchema, ClaimNotificationRequestSchema, RequestSchema2, GetCredentialsDataSchema, AccountStateSchema, AgentStateSchema, ConsumerStateSchema, ListStateDataSchema, SetActiveDataSchema, MarkExhaustedDataSchema, MarkThrottledDataSchema, RefreshAccountDataSchema, AddAccountDataSchema, RmAccountDataSchema, SetOverrideDataSchema, ClaimNotificationDataSchema, GoogleAccountStateSchema, ListGoogleAccountsDataSchema, MicrosoftAccountStateSchema, ListMicrosoftAccountsDataSchema, ErrorBodySchema, SuccessResponseSchema, ErrorResponseSchema2, ResponseSchema2;
+var MAX_FRAME_BYTES2, PROTOCOL_VERSION = 1, ProviderNameSchema, GetCredentialsRequestSchema, ListStateRequestSchema, SetActiveRequestSchema, MarkExhaustedRequestSchema, MarkThrottledRequestSchema, RefreshAccountRequestSchema, AnthropicCredentialsSchema, GoogleCredentialsSchema, MicrosoftCredentialsSchema, ProviderCredentialsSchema, AddAccountRequestSchema, RmAccountRequestSchema, SetOverrideRequestSchema, ListGoogleAccountsRequestSchema, ListMicrosoftAccountsRequestSchema, ProbeQuotaRequestSchema, ClaimNotificationRequestSchema, GetExternalSpendRequestSchema, RequestSchema2, GetCredentialsDataSchema, AccountStateSchema, AgentStateSchema, ConsumerStateSchema, ListStateDataSchema, SetActiveDataSchema, MarkExhaustedDataSchema, MarkThrottledDataSchema, RefreshAccountDataSchema, AddAccountDataSchema, RmAccountDataSchema, SetOverrideDataSchema, ClaimNotificationDataSchema, GetExternalSpendDataSchema, GoogleAccountStateSchema, ListGoogleAccountsDataSchema, MicrosoftAccountStateSchema, ListMicrosoftAccountsDataSchema, ErrorBodySchema, SuccessResponseSchema, ErrorResponseSchema2, ResponseSchema2;
 var init_protocol2 = __esm(() => {
   init_zod();
   MAX_FRAME_BYTES2 = 64 * 1024;
@@ -32823,6 +32958,12 @@ var init_protocol2 = __esm(() => {
     key: exports_external.string().min(1).max(512),
     windowMs: exports_external.number().int().positive().max(86400000)
   });
+  GetExternalSpendRequestSchema = exports_external.object({
+    v: exports_external.literal(PROTOCOL_VERSION),
+    op: exports_external.literal("get-external-spend"),
+    id: exports_external.string().min(1),
+    forceLive: exports_external.boolean().optional()
+  });
   RequestSchema2 = exports_external.discriminatedUnion("op", [
     GetCredentialsRequestSchema,
     ListStateRequestSchema,
@@ -32836,7 +32977,8 @@ var init_protocol2 = __esm(() => {
     ListGoogleAccountsRequestSchema,
     ListMicrosoftAccountsRequestSchema,
     ProbeQuotaRequestSchema,
-    ClaimNotificationRequestSchema
+    ClaimNotificationRequestSchema,
+    GetExternalSpendRequestSchema
   ]);
   GetCredentialsDataSchema = exports_external.object({
     account: exports_external.string(),
@@ -32847,6 +32989,8 @@ var init_protocol2 = __esm(() => {
     label: exports_external.string(),
     expiresAt: exports_external.number().optional(),
     exhausted: exports_external.boolean(),
+    in_service: exports_external.boolean().optional(),
+    entitlement_blocked: exports_external.boolean().optional(),
     exhausted_until: exports_external.number().optional(),
     throttled_until: exports_external.number().optional(),
     threshold_violations: exports_external.number().int().nonnegative().optional(),
@@ -32903,6 +33047,18 @@ var init_protocol2 = __esm(() => {
   ClaimNotificationDataSchema = exports_external.object({
     granted: exports_external.boolean()
   });
+  GetExternalSpendDataSchema = exports_external.object({
+    available: exports_external.boolean(),
+    day24hUsd: exports_external.number().optional(),
+    day7dUsd: exports_external.number().optional(),
+    top: exports_external.array(exports_external.object({
+      label: exports_external.string(),
+      usd: exports_external.number()
+    })).optional(),
+    capturedAtMs: exports_external.number().int().nonnegative().optional(),
+    served: exports_external.enum(["live", "cache"]).optional(),
+    reason: exports_external.string().optional()
+  });
   GoogleAccountStateSchema = exports_external.object({
     account: exports_external.string(),
     expiresAt: exports_external.number(),
@@ -33073,6 +33229,15 @@ class AuthBrokerClient {
     }
     return parsed;
   }
+  async getExternalSpend(forceLive) {
+    const data = await this.send({
+      v: PROTOCOL_VERSION,
+      id: randomUUID(),
+      op: "get-external-spend",
+      ...forceLive ? { forceLive: true } : {}
+    });
+    return data;
+  }
   async setActive(account) {
     const data = await this.send({
       v: PROTOCOL_VERSION,
@@ -36497,7 +36662,8 @@ async function inspectBankHealth(mcpUrl, bankId, opts) {
     pendingOperations: 0,
     newestDocumentAt: null,
     unextractedDocuments: [],
-    mentalModels: []
+    mentalModels: [],
+    activeDirectiveCount: null
   };
   const stats = await getJson(`${base}/v1/default/banks/${bank}/stats`, opts);
   if (!stats.ok)
@@ -36508,6 +36674,8 @@ async function inspectBankHealth(mcpUrl, bankId, opts) {
   const models = await getJson(`${base}/v1/default/banks/${bank}/mental-models`, opts);
   if (!models.ok)
     return { ...empty, reason: models.reason };
+  const directives = await getJson(`${base}/v1/default/banks/${bank}/directives?active_only=true`, opts);
+  const activeDirectiveCount = directives.ok && Array.isArray(directives.data.items) ? directives.data.items.length : null;
   const docItems = docs.data.items ?? [];
   let newestDocumentAt = null;
   const unextracted = [];
@@ -36534,6 +36702,7 @@ async function inspectBankHealth(mcpUrl, bankId, opts) {
     pendingOperations: stats.data.pending_operations ?? 0,
     newestDocumentAt,
     unextractedDocuments: unextracted,
+    activeDirectiveCount,
     mentalModels: (models.data.items ?? []).filter((m) => typeof m?.id === "string" && typeof m?.name === "string").map((m) => {
       const { basedOnCounts, totalSourceFacts, derivedFromModelIds } = summarizeBasedOn(m.reflect_response);
       return {
@@ -41862,6 +42031,29 @@ var init_hindsight_tools = __esm(() => {
 
 // src/cli/doctor-memory.ts
 import { execFileSync as execFileSync18 } from "node:child_process";
+function classifyDirectiveCount(count, bankLabel) {
+  if (count === null)
+    return null;
+  const name = `${bankLabel} directives`;
+  if (count > MAX_DIRECTIVES) {
+    const truncated = count - MAX_DIRECTIVES;
+    return {
+      name,
+      status: "fail",
+      detail: `${count} active directives \u2014 exceeds MAX_DIRECTIVES=${MAX_DIRECTIVES}, so the ` + `${truncated} lowest-priority directive(s) are SILENTLY truncated from the ` + `<active_directives> recall block and never reach the agent`,
+      fix: "Retire or merge stale directives so the active count is at or below " + `${MAX_DIRECTIVES} (deletes stay operator-approved). The mental-model-curator ` + "skill's directive merge/retire pass is the durable path."
+    };
+  }
+  if (count > DIRECTIVE_WARN_THRESHOLD) {
+    return {
+      name,
+      status: "warn",
+      detail: `${count} active directives \u2014 approaching the MAX_DIRECTIVES=${MAX_DIRECTIVES} cap ` + `above which the recall block silently truncates the overflow`,
+      fix: "Prune or merge low-value directives before the count crosses " + `${MAX_DIRECTIVES}. Review with \`switchroom memory --directives <bank>\`.`
+    };
+  }
+  return null;
+}
 function classifyShmSize(bytes) {
   const mib = Math.round(bytes / 1024 / 1024);
   if (bytes < MIN_HINDSIGHT_SHM_BYTES) {
@@ -41964,9 +42156,124 @@ function classifyAutohealStatus(logs) {
   }
   return { name: "hindsight autoheal", status: "ok", detail: "no auto-restarts" };
 }
+function classifyLlmVerification(logs) {
+  const latestFailed = new Map;
+  const failDetail = new Map;
+  let sawAny = false;
+  for (const line of logs.split(`
+`)) {
+    const fail3 = line.match(/LLM connection verification failed for '([^']+)' config:\s*(.*?)(?:\.\s*Server will start|$)/);
+    if (fail3) {
+      sawAny = true;
+      const cfg = fail3[1];
+      latestFailed.set(cfg, true);
+      failDetail.set(cfg, (fail3[2] ?? "").trim());
+      continue;
+    }
+    if (/connection verified successfully/.test(line) || /LLM verification passed/.test(line)) {
+      sawAny = true;
+      latestFailed.set("default", false);
+    }
+  }
+  if (!sawAny)
+    return null;
+  const failedConfigs = [...latestFailed.entries()].filter(([, failed]) => failed).map(([cfg]) => cfg);
+  if (failedConfigs.length === 0) {
+    return {
+      name: "hindsight LLM verification",
+      status: "ok",
+      detail: "boot LLM connection verified"
+    };
+  }
+  const named = failedConfigs.map((cfg) => {
+    const err = failDetail.get(cfg);
+    return err ? `'${cfg}' (${err})` : `'${cfg}'`;
+  }).join(", ");
+  return {
+    name: "hindsight LLM verification",
+    status: "fail",
+    detail: `boot LLM connection verification FAILED for config(s): ${named} \u2014 ` + `hindsight is serving but every LLM-dependent op (retain/reflect/` + `consolidation extraction) for that config will fail silently until the ` + `provider is reachable`,
+    fix: "Almost always a model-name drift: the pinned `hindsight.llm.*.model` no " + "longer exists in the LiteLLM proxy's model_list (run `switchroom doctor` " + "\u2014 the LiteLLM model-routing check names the exact missing model), or the " + "provider is down. Fix the model reference (or the proxy), then " + "`switchroom memory --restart` so hindsight re-verifies."
+  };
+}
+function classifyHindsightDataVolumeMounts(names) {
+  const uniq = [...new Set(names.filter(Boolean))];
+  if (uniq.length === 0) {
+    return {
+      name: "hindsight data-volume exclusive",
+      status: "ok",
+      detail: "no container currently mounts the live data volume"
+    };
+  }
+  const twins = uniq.filter((n) => n !== HINDSIGHT_DEFAULT_WORKER_ID);
+  if (uniq.length === 1 && uniq[0] === HINDSIGHT_DEFAULT_WORKER_ID) {
+    return {
+      name: "hindsight data-volume exclusive",
+      status: "ok",
+      detail: `only ${HINDSIGHT_DEFAULT_WORKER_ID} mounts ${HINDSIGHT_DATA_VOLUME}`
+    };
+  }
+  if (twins.length > 0) {
+    return {
+      name: "hindsight data-volume exclusive",
+      status: "fail",
+      detail: `multiple containers mount ${HINDSIGHT_DATA_VOLUME}: [${uniq.join(", ")}] \u2014 ` + `dual postmasters corrupt the embedded PG checkpoint`,
+      fix: "`switchroom memory --restart` (stopHindsight now disables restart + removes " + "every volume twin), or manually `docker update --restart=no <twin> && " + "docker rm -f <twin>` before starting the live container."
+    };
+  }
+  return {
+    name: "hindsight data-volume exclusive",
+    status: "warn",
+    detail: `unexpected volume mount set: [${uniq.join(", ")}]`
+  };
+}
+function classifyHindsightNetworkMode(networkMode, litellmConfigured) {
+  if (!litellmConfigured) {
+    return {
+      name: "hindsight network mode",
+      status: "ok",
+      detail: networkMode ? `${networkMode} (LiteLLM not configured)` : "unknown (LiteLLM not configured)"
+    };
+  }
+  const mode = (networkMode ?? "").trim() || "unknown";
+  if (mode === "host") {
+    return {
+      name: "hindsight network mode",
+      status: "ok",
+      detail: "host \u2014 LiteLLM 127.0.0.1 reachable"
+    };
+  }
+  return {
+    name: "hindsight network mode",
+    status: "fail",
+    detail: `NetworkMode=${mode} while LiteLLM routing is configured \u2014 retains will die with ` + `"Connection error" to 127.0.0.1:4010 while /health stays green`,
+    fix: "`switchroom memory --restart` so startHindsight recreates with --network host. " + "Do not `docker start` a bridge/mis-networked container."
+  };
+}
+function classifyLiteLlmReachability(reachable, endpoint) {
+  if (reachable === null)
+    return null;
+  if (reachable) {
+    return {
+      name: "hindsight LiteLLM reachability",
+      status: "ok",
+      detail: `TCP ok to ${endpoint}`
+    };
+  }
+  return {
+    name: "hindsight LiteLLM reachability",
+    status: "fail",
+    detail: `cannot TCP-connect to ${endpoint} \u2014 hindsight LLM ops will fail`,
+    fix: "Start/fix the LiteLLM proxy (host :4010), then `switchroom memory --restart` " + "if hindsight was started while it was down."
+  };
+}
 function checkHindsightContainerHealth(opts) {
   const name = opts?.containerName ?? "switchroom-hindsight";
-  const exec = opts?.exec ?? ((cmd, args) => execFileSync18(cmd, args, { stdio: ["ignore", "pipe", "ignore"], timeout: 8000 }).toString());
+  const exec = opts?.exec ?? ((cmd, args) => execFileSync18(cmd, args, {
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 8000,
+    maxBuffer: 16 * 1024 * 1024
+  }).toString());
   const results = [];
   let shmRaw;
   try {
@@ -41978,6 +42285,29 @@ function checkHindsightContainerHealth(opts) {
   if (Number.isFinite(shmBytes) && shmBytes > 0) {
     results.push(classifyShmSize(shmBytes));
   }
+  try {
+    const startedAt = exec("docker", [
+      "inspect",
+      name,
+      "--format",
+      "{{.State.StartedAt}}"
+    ]).trim();
+    const startMs = Date.parse(startedAt);
+    if (Number.isFinite(startMs)) {
+      const untilIso = new Date(startMs + 10 * 60000).toISOString();
+      const bootLogs = exec("docker", [
+        "logs",
+        "--since",
+        startedAt,
+        "--until",
+        untilIso,
+        name
+      ]);
+      const verifyRow = classifyLlmVerification(bootLogs);
+      if (verifyRow)
+        results.push(verifyRow);
+    }
+  } catch {}
   try {
     const logs = exec("docker", ["logs", "--since", "10m", name]);
     results.push(classifyExtractionLogs(logs));
@@ -41986,6 +42316,69 @@ function checkHindsightContainerHealth(opts) {
     const autohealLogs = exec("docker", ["logs", "--since", "1h", "switchroom-hindsight-autoheal"]);
     results.push(classifyAutohealStatus(autohealLogs));
   } catch {}
+  try {
+    const mounts = listHindsightDataVolumeMounts(exec);
+    results.push(classifyHindsightDataVolumeMounts(mounts));
+  } catch {}
+  try {
+    const netMode = exec("docker", [
+      "inspect",
+      name,
+      "--format",
+      "{{.HostConfig.NetworkMode}}"
+    ]).trim();
+    const envBlob = exec("docker", [
+      "inspect",
+      name,
+      "--format",
+      "{{range .Config.Env}}{{println .}}{{end}}"
+    ]);
+    const perOpBasePresent = /HINDSIGHT_API_(RETAIN|REFLECT|CONSOLIDATION)_LLM_BASE_URL=/.test(envBlob);
+    const anthropicBaseMatch = envBlob.match(/(?:^|\n)ANTHROPIC_BASE_URL=(\S+)/);
+    const anthropicLooksLikeLiteLlm = (() => {
+      const raw = anthropicBaseMatch?.[1]?.trim();
+      if (!raw)
+        return false;
+      try {
+        const u = new URL(raw.includes("://") ? raw : `http://${raw}`);
+        const port = u.port || (u.protocol === "https:" ? "443" : "80");
+        const path5 = (u.pathname || "").replace(/\/+$/, "");
+        if (port === "4010")
+          return true;
+        if (/\/anthropic$/i.test(path5))
+          return true;
+        if (/litellm/i.test(u.hostname || ""))
+          return true;
+        return false;
+      } catch {
+        return false;
+      }
+    })();
+    const litellmConfigured = perOpBasePresent || anthropicLooksLikeLiteLlm;
+    results.push(classifyHindsightNetworkMode(netMode, litellmConfigured));
+    if (litellmConfigured) {
+      const m = envBlob.match(/HINDSIGHT_API_RETAIN_LLM_BASE_URL=(\S+)/) ?? envBlob.match(/HINDSIGHT_API_REFLECT_LLM_BASE_URL=(\S+)/) ?? envBlob.match(/HINDSIGHT_API_CONSOLIDATION_LLM_BASE_URL=(\S+)/) ?? (anthropicLooksLikeLiteLlm ? anthropicBaseMatch : null);
+      let endpoint = "127.0.0.1:4010";
+      if (m) {
+        try {
+          const u = new URL(m[1].includes("://") ? m[1] : `http://${m[1]}`);
+          endpoint = `${u.hostname || "127.0.0.1"}:${u.port || "80"}`;
+        } catch {}
+      }
+      const [host, portStr] = endpoint.split(":");
+      const port = Number(portStr) || 80;
+      let reachable = null;
+      try {
+        exec("bash", ["-c", `echo > /dev/tcp/${host}/${port}`]);
+        reachable = true;
+      } catch {
+        reachable = false;
+      }
+      const row = classifyLiteLlmReachability(reachable, endpoint);
+      if (row)
+        results.push(row);
+    }
+  } catch {}
   return results;
 }
 function classifyHindsightHealthProbe(status, port) {
@@ -42073,12 +42466,145 @@ function classifyToolContract(advertised) {
   }
   return results;
 }
-var MIN_HINDSIGHT_SHM_BYTES, CONSOLIDATION_BACKLOG_WARN = 25, CONSOLIDATION_BACKLOG_FAIL = 200;
+var MIN_HINDSIGHT_SHM_BYTES, MAX_DIRECTIVES = 15, DIRECTIVE_WARN_THRESHOLD = 12, CONSOLIDATION_BACKLOG_WARN = 25, CONSOLIDATION_BACKLOG_FAIL = 200;
 var init_doctor_memory = __esm(() => {
   init_hindsight_tools();
+  init_hindsight();
   MIN_HINDSIGHT_SHM_BYTES = 1024 * 1024 * 1024;
 });
 
+// src/litellm/model-validation.ts
+function isExplicitLitellmRoute(model) {
+  return model.includes("/");
+}
+function collectReferencedModels(config) {
+  const refs = [];
+  const litellmEnabled = config.litellm?.enabled === true;
+  if (!litellmEnabled)
+    return refs;
+  const llm = config.hindsight?.llm;
+  if (llm) {
+    const push = (model, consumer) => {
+      if (model)
+        refs.push({ model, consumer });
+    };
+    push(llm.model, "hindsight.llm.model (global)");
+    push(llm.retain?.model, "hindsight.llm.retain");
+    push(llm.reflect?.model, "hindsight.llm.reflect");
+    push(llm.consolidation?.model, "hindsight.llm.consolidation");
+  }
+  for (const [name, agent] of Object.entries(config.agents ?? {})) {
+    if (!agent)
+      continue;
+    const agentRoutes = agent.litellm?.enabled !== false;
+    if (!agentRoutes)
+      continue;
+    if (agent.model && isExplicitLitellmRoute(agent.model)) {
+      refs.push({ model: agent.model, consumer: `agents.${name}.model` });
+    }
+    if (agent.fallback_model && isExplicitLitellmRoute(agent.fallback_model)) {
+      refs.push({ model: agent.fallback_model, consumer: `agents.${name}.fallback_model` });
+    }
+  }
+  return refs;
+}
+function validateModelReferences(refs, proxyModels) {
+  const missing = new Map;
+  for (const { model, consumer } of refs) {
+    if (proxyModels.has(model))
+      continue;
+    const list = missing.get(model);
+    if (list) {
+      if (!list.includes(consumer))
+        list.push(consumer);
+    } else {
+      missing.set(model, [consumer]);
+    }
+  }
+  return [...missing.entries()].map(([model, consumers]) => ({ model, consumers }));
+}
+async function fetchProxyModels(baseUrl, apiKey, fetchFn = fetch, timeoutMs = 8000) {
+  const url = `${baseUrl.replace(/\/+$/, "")}/v1/models`;
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchFn(url, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}` },
+      ...{ signal: controller.signal }
+    });
+    if (!res.ok) {
+      return { kind: "unreachable", msg: `proxy returned HTTP ${res.status} for ${url}` };
+    }
+    const body = await res.json();
+    const data = body?.data;
+    if (!Array.isArray(data)) {
+      return { kind: "unreachable", msg: `proxy ${url} response had no model \`data\` array` };
+    }
+    const models = data.map((m) => m?.id).filter((id) => typeof id === "string");
+    return { kind: "ok", models };
+  } catch (err) {
+    return { kind: "unreachable", msg: err.message ?? String(err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function classifyModelReferences(missing, refCount) {
+  if (missing.length === 0) {
+    return {
+      name: "litellm model routing",
+      status: "ok",
+      detail: `all ${refCount} referenced model(s) present in the proxy model_list`
+    };
+  }
+  const detail = missing.map((m) => `\`${m.model}\` (referenced by ${m.consumers.join(", ")})`).join("; ");
+  return {
+    name: "litellm model routing",
+    status: "fail",
+    detail: `${missing.length} model reference(s) NOT in the LiteLLM proxy model_list: ` + `${detail} \u2014 every LLM call from that consumer will 400 ("Invalid model ` + `name") until the proxy lists it or the reference is corrected`,
+    fix: "Either add the missing model group back to the LiteLLM proxy config " + "(the operator-maintained `litellm-config.yaml` `model_list`) and redeploy " + "the proxy, or repoint the consumer at a model the proxy DOES route " + "(`switchroom doctor` lists them via the proxy `/v1/models`). For " + "hindsight, then `switchroom memory --restart` so it re-verifies."
+  };
+}
+async function runLitellmModelChecks(config, opts) {
+  const refs = collectReferencedModels(config);
+  if (refs.length === 0)
+    return [];
+  const litellm = config.litellm;
+  const baseUrl = litellm?.base_url;
+  const adminKeyRef = litellm?.admin_key;
+  if (!baseUrl || !adminKeyRef) {
+    return [
+      {
+        name: "litellm model routing",
+        status: "warn",
+        detail: `${refs.length} model reference(s) to validate but litellm ` + `${!baseUrl ? "base_url" : "admin_key"} is unresolved \u2014 cannot query ` + `the proxy model_list`
+      }
+    ];
+  }
+  const apiKey = opts.resolveSecret(adminKeyRef);
+  if (!apiKey) {
+    return [
+      {
+        name: "litellm model routing",
+        status: "warn",
+        detail: `could not resolve the litellm admin_key (\`${adminKeyRef}\`) to query ` + `the proxy model_list \u2014 ${refs.length} model reference(s) left unverified`
+      }
+    ];
+  }
+  const probe2 = await fetchProxyModels(baseUrl, apiKey, opts.fetchFn);
+  if (probe2.kind === "unreachable") {
+    return [
+      {
+        name: "litellm model routing",
+        status: "warn",
+        detail: `LiteLLM proxy unreachable (${probe2.msg}) \u2014 ${refs.length} model ` + `reference(s) left unverified; not failing on an environment limitation`
+      }
+    ];
+  }
+  const missing = validateModelReferences(refs, new Set(probe2.models));
+  return [classifyModelReferences(missing, refs.length)];
+}
+
 // src/cli/doctor-docker.ts
 import { readFileSync as readFileSync56 } from "node:fs";
 import { spawnSync as spawnSync8 } from "node:child_process";
@@ -45264,6 +45790,69 @@ var init_doctor_timezone = __esm(() => {
   init_timezone();
 });
 
+// src/cli/doctor-fix-session-model.ts
+import { join as join67 } from "node:path";
+function describeReconcileChanges(changes) {
+  if (changes.length === 0)
+    return "Reconcile rewrote no other files.";
+  const MAX_LISTED = 6;
+  const listed = changes.slice(0, MAX_LISTED).join(", ");
+  const more = changes.length > MAX_LISTED ? ` (+${changes.length - MAX_LISTED} more)` : "";
+  return `Full per-agent reconcile applied \u2014 rewrote ${changes.length} managed file(s): ` + listed + more;
+}
+function fixSessionModelCarrierDrift(config, deps) {
+  const agentsDir = resolveAgentsDir(config);
+  const results = [];
+  for (const name of Object.keys(config.agents ?? {})) {
+    const startShPath = join67(agentsDir, name, "start.sh");
+    const label = `${name}: start.sh /model session carrier (--fix)`;
+    const pre = deps.check(name, startShPath);
+    if (pre.status === "ok") {
+      results.push({
+        name: label,
+        status: "ok",
+        detail: "rev5 carrier already present \u2014 nothing to fix"
+      });
+      continue;
+    }
+    if (pre.status === "skip") {
+      results.push({ ...pre, name: label });
+      continue;
+    }
+    let reconcileChanges;
+    try {
+      reconcileChanges = deps.reconcile(name).changes;
+    } catch (err) {
+      results.push({
+        name: label,
+        status: "fail",
+        detail: `drift detected (${pre.detail ?? "carrier check failed"}) but reconcile failed: ${err.message}`,
+        fix: "Fix the reconcile error, or run `switchroom apply` manually."
+      });
+      continue;
+    }
+    const post = deps.check(name, startShPath);
+    if (post.status === "ok") {
+      results.push({
+        name: label,
+        status: "ok",
+        detail: "healed: start.sh regenerated with the rev5 `.session-model` carrier \u2014 takes effect on the agent's next restart. " + describeReconcileChanges(reconcileChanges)
+      });
+    } else {
+      results.push({
+        name: label,
+        status: "fail",
+        detail: `regenerated start.sh still fails the carrier check: ${post.detail ?? post.status} \u2014 the installed template may be stale`,
+        fix: "Update switchroom (the bundled profiles/_base/start.sh.hbs must carry the rev5 carrier), then re-run `switchroom doctor --fix`."
+      });
+    }
+  }
+  return results;
+}
+var init_doctor_fix_session_model = __esm(() => {
+  init_loader();
+});
+
 // src/cli/doctor.ts
 var exports_doctor = {};
 __export(exports_doctor, {
@@ -45289,6 +45878,7 @@ __export(exports_doctor, {
   checkTelegram: () => checkTelegram,
   checkTcp: () => checkTcp,
   checkStartShStale: () => checkStartShStale,
+  checkStartShSessionModelCarrier: () => checkStartShSessionModelCarrier,
   checkSkillsPrerequisites: () => checkSkillsPrerequisites,
   checkRepoHygiene: () => checkRepoHygiene,
   checkPendingRetainsQueues: () => checkPendingRetainsQueues,
@@ -45322,16 +45912,16 @@ import {
   readdirSync as readdirSync23,
   statSync as statSync38
 } from "node:fs";
-import { dirname as dirname20, join as join67, resolve as resolve39 } from "node:path";
+import { dirname as dirname20, join as join68, resolve as resolve39 } from "node:path";
 import { createPublicKey, createPrivateKey } from "node:crypto";
 function findInNvm(bin) {
-  const nvmRoot = join67(process.env.HOME ?? "", ".nvm", "versions", "node");
+  const nvmRoot = join68(process.env.HOME ?? "", ".nvm", "versions", "node");
   if (!existsSync66(nvmRoot))
     return null;
   try {
     const versions = readdirSync23(nvmRoot).sort().reverse();
     for (const v of versions) {
-      const candidate = join67(nvmRoot, v, "bin", bin);
+      const candidate = join68(nvmRoot, v, "bin", bin);
       try {
         const s = statSync38(candidate);
         if (s.isFile() || s.isSymbolicLink()) {
@@ -45358,7 +45948,7 @@ function whichOnPath(bin) {
   for (const dir of pathEnv.split(":")) {
     if (!dir)
       continue;
-    const candidate = join67(dir, bin);
+    const candidate = join68(dir, bin);
     if (isX(candidate))
       return candidate;
   }
@@ -45524,7 +46114,7 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
   if (envBrowsersPath && envBrowsersPath.length > 0) {
     cacheLocations.push(envBrowsersPath);
   }
-  cacheLocations.push(join67(homeDir, ".cache", "ms-playwright"));
+  cacheLocations.push(join68(homeDir, ".cache", "ms-playwright"));
   for (const cacheDir of cacheLocations) {
     if (!existsSync66(cacheDir))
       continue;
@@ -45532,10 +46122,10 @@ function findChromium(homeDir = process.env.HOME ?? "", envBrowsersPath = proces
       const entries = readdirSync23(cacheDir).filter((e) => e.startsWith("chromium"));
       for (const entry of entries) {
         const candidates2 = [
-          join67(cacheDir, entry, "chrome-linux64", "chrome"),
-          join67(cacheDir, entry, "chrome-linux", "chrome"),
-          join67(cacheDir, entry, "chrome-linux64", "headless_shell"),
-          join67(cacheDir, entry, "chrome-linux", "headless_shell")
+          join68(cacheDir, entry, "chrome-linux64", "chrome"),
+          join68(cacheDir, entry, "chrome-linux", "chrome"),
+          join68(cacheDir, entry, "chrome-linux64", "headless_shell"),
+          join68(cacheDir, entry, "chrome-linux", "headless_shell")
         ];
         for (const path5 of candidates2) {
           if (existsSync66(path5))
@@ -45667,7 +46257,7 @@ function checkDeployMounts(opts) {
   const home2 = opts?.home ?? process.env.HOME ?? "/root";
   const { pathKind } = opts?.deps ?? DEFAULT_DEPLOY_MOUNTS_DEPS;
   const results = [];
-  const dockerComposePlugin = join67(home2, ".docker", "cli-plugins", "docker-compose");
+  const dockerComposePlugin = join68(home2, ".docker", "cli-plugins", "docker-compose");
   const pluginKind = pathKind(dockerComposePlugin);
   if (pluginKind === "dir") {
     results.push({
@@ -45705,7 +46295,7 @@ function checkDeployMounts(opts) {
 function checkLegacyState() {
   const results = [];
   const h = process.env.HOME ?? "/root";
-  const clerkDir = join67(h, LEGACY_STATE_DIR);
+  const clerkDir = join68(h, LEGACY_STATE_DIR);
   const clerkPresent = existsSync66(clerkDir);
   results.push({
     name: "legacy ~/.clerk state",
@@ -45715,7 +46305,7 @@ function checkLegacyState() {
       fix: "Legacy state detected. Run `mv ~/.clerk ~/.switchroom` and rename " + "any top-level `clerk:` key in switchroom.yaml to `switchroom:`. " + "This back-compat shim is REMOVED in v0.13.0 \u2014 no automatic " + "migration exists."
     } : {}
   });
-  const legacySock = join67(h, ".switchroom", "vault-broker.sock");
+  const legacySock = join68(h, ".switchroom", "vault-broker.sock");
   let sockStat = null;
   try {
     sockStat = lstatSync9(legacySock);
@@ -45979,6 +46569,9 @@ async function checkBankIngestHealth(config, url, opts) {
       });
       continue;
     }
+    const directiveRow = classifyDirectiveCount(h.activeDirectiveCount, label);
+    if (directiveRow)
+      results.push(directiveRow);
     if (h.totalDocuments === 0) {
       results.push({
         name: label,
@@ -46281,7 +46874,7 @@ async function checkTelegram(config) {
     const plugin = agentConfig.channels?.telegram?.plugin ?? "switchroom";
     if (plugin !== "switchroom")
       continue;
-    const envPath = join67(agentsDir, name, "telegram", ".env");
+    const envPath = join68(agentsDir, name, "telegram", ".env");
     const read = tryReadHostFile(envPath);
     if (read.kind === "eacces") {
       results.push({
@@ -46362,9 +46955,56 @@ function checkStartShStale(agentName, startShPath) {
   }
   return { name: label, status: "ok", detail: "supervisor block present" };
 }
+function checkStartShSessionModelCarrier(agentName, startShPath) {
+  const label = `${agentName}: start.sh /model session carrier`;
+  if (!existsSync66(startShPath)) {
+    return {
+      name: label,
+      status: "warn",
+      detail: `${startShPath} not found`,
+      fix: `Run \`switchroom doctor --fix\` (or \`switchroom apply\`) to scaffold start.sh (rev5 \`.session-model\` carrier).`
+    };
+  }
+  let content;
+  try {
+    content = readFileSync59(startShPath, "utf-8");
+  } catch (err) {
+    return {
+      name: label,
+      status: "skip",
+      detail: `unreadable from host (${err.message}) \u2014 agent-UID-owned; the session-model carrier block can't be checked from the operator UID`,
+      fix: `Verify in-agent: docker exec switchroom-${agentName} sh -c 'grep -E "\\[ -f .*\\.session-model\\" \\]" /state/agent/start.sh && echo ok'`
+    };
+  }
+  const fileTestPaths = [...content.matchAll(/\[\s*-f\s+([^\]]+?)\s*\]/g)].map((m) => m[1].replace(/["']/g, "").trim());
+  const hasBareSessionModelTest = fileTestPaths.some((p) => /(?:^|\/)\.session-model$/.test(p));
+  const hasJsonCarrierParse = /configuredDefaultAtWrite/.test(content) || /session-model-boot-attempts/.test(content);
+  if (hasBareSessionModelTest && hasJsonCarrierParse) {
+    return {
+      name: label,
+      status: "ok",
+      detail: "rev5 `.session-model` consume-once carrier present"
+    };
+  }
+  if (hasBareSessionModelTest && !hasJsonCarrierParse) {
+    return {
+      name: label,
+      status: "fail",
+      detail: "start.sh tests `.session-model` but lacks rev5 JSON apply (`configuredDefaultAtWrite` / boot-attempts) \u2014 /model switches may not stick",
+      fix: "Run `switchroom doctor --fix` (or `switchroom apply`) to regenerate start.sh from profiles/_base/start.sh.hbs (rev5 carrier). Takes effect on the next agent restart (no need to bounce until release)."
+    };
+  }
+  const legacyOnly = /\.session-model-override/.test(content) && !hasBareSessionModelTest;
+  return {
+    name: label,
+    status: "fail",
+    detail: legacyOnly ? "start.sh only reads legacy `.session-model-override`; gateway writes rev5 `.session-model` \u2014 Telegram /model relaunches boot the yaml pin (silent miss)" : "start.sh missing rev5 `.session-model` carrier file test \u2014 Telegram /model cannot apply session overrides across relaunch",
+    fix: "Run `switchroom doctor --fix` (or `switchroom apply`) to regenerate start.sh from the latest template (rev5 `.session-model` carrier). The rewrite is on disk immediately; session switches apply on the next agent restart/release bounce."
+  };
+}
 function checkLeakedHomeSwitchroom(agentName, agentDir) {
   const label = `${agentName}: $HOME/.switchroom symlink (#910)`;
-  const path5 = join67(agentDir, "home", ".switchroom");
+  const path5 = join68(agentDir, "home", ".switchroom");
   let stats;
   try {
     stats = lstatSync9(path5);
@@ -46401,7 +47041,7 @@ function checkLeakedHomeSwitchroom(agentName, agentDir) {
 }
 function checkRepoHygiene(repoRoot) {
   const results = [];
-  const exportDir = join67(repoRoot, "clerk-export");
+  const exportDir = join68(repoRoot, "clerk-export");
   if (existsSync66(exportDir)) {
     results.push({
       name: "repo hygiene: clerk-export/ on disk (#1072)",
@@ -46410,7 +47050,7 @@ function checkRepoHygiene(repoRoot) {
       fix: `Run scripts/migrate-clerk-export-to-vault.sh to move the bundle ` + `into the vault, then delete the on-disk copy.`
     });
   }
-  const knownTarball = join67(repoRoot, "clerk-export-with-secrets.tar.gz");
+  const knownTarball = join68(repoRoot, "clerk-export-with-secrets.tar.gz");
   if (existsSync66(knownTarball)) {
     results.push({
       name: "repo hygiene: clerk-export-with-secrets.tar.gz on disk (#1072)",
@@ -46428,7 +47068,7 @@ function checkRepoHygiene(repoRoot) {
         results.push({
           name: `repo hygiene: ${name} on disk (#1072)`,
           status: "warn",
-          detail: `${join67(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
+          detail: `${join68(repoRoot, name)} matches the *-with-secrets*.tar.gz ` + `pattern. Likely contains real credentials.`,
           fix: `Inspect, migrate any secrets into the vault, then delete the ` + `archive.`
         });
       }
@@ -46451,9 +47091,9 @@ function checkRepoHygiene(repoRoot) {
 }
 function isSwitchroomCheckout(dir) {
   try {
-    if (!existsSync66(join67(dir, ".git")))
+    if (!existsSync66(join68(dir, ".git")))
       return false;
-    const pkgPath = join67(dir, "package.json");
+    const pkgPath = join68(dir, "package.json");
     if (!existsSync66(pkgPath))
       return false;
     const pkg = JSON.parse(readFileSync59(pkgPath, "utf-8"));
@@ -46490,7 +47130,8 @@ function checkAgents(config, configPath) {
         fix: `Rotate the bot token (e.g. via \`switchroom vault\`), then run ` + `\`switchroom agent unquarantine ${name}\` and \`switchroom agent restart ${name}\``
       });
     }
-    results.push(checkStartShStale(name, join67(agentDir, "start.sh")));
+    results.push(checkStartShStale(name, join68(agentDir, "start.sh")));
+    results.push(checkStartShSessionModelCarrier(name, join68(agentDir, "start.sh")));
     results.push(checkLeakedHomeSwitchroom(name, agentDir));
     const status = statuses[name];
     const active = status?.active ?? "unknown";
@@ -46567,7 +47208,7 @@ function checkAgents(config, configPath) {
       }
     }
     if (agentConfig.channels?.telegram?.plugin === "switchroom") {
-      const mcpJsonPath = join67(agentDir, ".mcp.json");
+      const mcpJsonPath = join68(agentDir, ".mcp.json");
       if (!existsSync66(mcpJsonPath)) {
         results.push({
           name: `${name}: .mcp.json`,
@@ -46869,7 +47510,7 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
     };
   }
   const credDir = dirname20(envPath);
-  const authScript = join67(credDir, "claude-auth.py");
+  const authScript = join68(credDir, "claude-auth.py");
   if (!existsSync66(authScript)) {
     return {
       name: "mff: auth flow",
@@ -47086,7 +47727,7 @@ function runDockerSection(config) {
   });
 }
 function registerDoctorCommand(program3) {
-  program3.command("doctor").description("Diagnose Switchroom's setup: deps, vault, memory, agents, MCP wireup").option("--json", "Output as JSON").option("--skill <name>", "Run probes for a specific skill only (e.g. mff)").option("--fast", "Skip in-agent (hostd) liveness probes \u2014 offline/quick; the host-unverifiable rows stay `skip`").action(withConfigError(async (opts) => {
+  program3.command("doctor").description("Diagnose Switchroom's setup: deps, vault, memory, agents, MCP wireup").option("--json", "Output as JSON").option("--skill <name>", "Run probes for a specific skill only (e.g. mff)").option("--fast", "Skip in-agent (hostd) liveness probes \u2014 offline/quick; the host-unverifiable rows stay `skip`").option("--fix", "Auto-remediate rev5 /model `.session-model` carrier drift by running the FULL per-agent reconcile for each drifted agent (start.sh + all switchroom-managed files, same as `switchroom apply` for that agent; staged switchroom.yaml edits land too \u2014 files rewritten are listed in the result row). Takes effect on the agent's next restart").action(withConfigError(async (opts) => {
     try {
       getConfigPath(program3);
     } catch (_e) {
@@ -47155,7 +47796,23 @@ function registerDoctorCommand(program3) {
         return { kind: "unreachable", msg: err.message };
       }
     };
+    const fixSections = opts.fix ? [
+      {
+        title: "Auto-remediation (--fix)",
+        results: fixSessionModelCarrierDrift(config, {
+          check: checkStartShSessionModelCarrier,
+          reconcile: (name) => {
+            const agentConfig = config.agents?.[name];
+            if (!agentConfig)
+              throw new Error(`agent ${name} not in config`);
+            const result = reconcileAgent(name, agentConfig, resolveAgentsDir(config), config.telegram, config, configPath, { preserveClaudeMd: true });
+            return { changes: result.changes };
+          }
+        })
+      }
+    ] : [];
     const sections = [
+      ...fixSections,
       { title: "Dependencies", results: checkDependencies() },
       { title: "Skills Prerequisites", results: checkSkillsPrerequisites() },
       { title: "Manifest Drift", results: await checkManifestDrift() },
@@ -47174,6 +47831,22 @@ function registerDoctorCommand(program3) {
       },
       { title: "Vault access", results: await runSecretAccessChecks(config) },
       { title: "Memory (Hindsight)", results: await checkHindsight(config) },
+      {
+        title: "LiteLLM model routing (#3407)",
+        results: await runLitellmModelChecks(config, {
+          resolveSecret: (ref) => {
+            if (!isVaultReference(ref))
+              return ref;
+            if (!passphrase || !existsSync66(vaultPath))
+              return null;
+            try {
+              return getStringSecret(passphrase, vaultPath, parseVaultReference(ref));
+            } catch {
+              return null;
+            }
+          }
+        })
+      },
       { title: "Telegram", results: await checkTelegram(config) },
       { title: "Agents", results: checkAgents(config, configPath) },
       {
@@ -47286,12 +47959,14 @@ var init_doctor = __esm(() => {
   init_helpers();
   init_lifecycle();
   init_quarantine();
+  init_scaffold();
   init_manager();
   init_accounts();
   init_manifest();
   init_hindsight2();
   init_hindsight();
   init_doctor_memory();
+  init_resolver();
   init_doctor_docker();
   init_doctor_auth_broker();
   init_doctor_hostd();
@@ -47309,6 +47984,7 @@ var init_doctor = __esm(() => {
   init_doctor_agent_smoke();
   init_doctor_vault_broker_durability();
   init_doctor_timezone();
+  init_doctor_fix_session_model();
   DEFAULT_DEPLOY_MOUNTS_DEPS = { pathKind: defaultPathKind };
   MANIFEST_WARN_ONLY = new Set([
     "@playwright/mcp",
@@ -47894,7 +48570,7 @@ var init_fleet_defaults = __esm(() => {
 
 // src/agents/connection-health.ts
 import { mkdirSync as mkdirSync46, writeFileSync as writeFileSync28 } from "node:fs";
-import { join as join83 } from "node:path";
+import { join as join84 } from "node:path";
 async function computeAgentConnectionIssues(config, agentName, vaultAclReader) {
   const reqs = computeMcpSecretRequirements(config).filter((r) => r.agent === agentName);
   if (reqs.length === 0)
@@ -47951,8 +48627,8 @@ async function computeAgentConnectionIssues(config, agentName, vaultAclReader) {
   return issues;
 }
 function writeConnectionHealthFile(agentDir, health, deps) {
-  const dir = join83(agentDir, ".claude");
-  const path8 = join83(dir, CONNECTION_HEALTH_FILENAME);
+  const dir = join84(agentDir, ".claude");
+  const path8 = join84(dir, CONNECTION_HEALTH_FILENAME);
   (deps?.mkdir ?? ((p, o) => mkdirSync46(p, o)))(dir, { recursive: true });
   (deps?.writeFile ?? ((p, d) => writeFileSync28(p, d)))(path8, JSON.stringify(health, null, 2) + `
 `);
@@ -47976,9 +48652,9 @@ var init_connection_health = () => {};
 
 // src/cli/update-prompt-hook.ts
 import { existsSync as existsSync83, readFileSync as readFileSync72, writeFileSync as writeFileSync29, chmodSync as chmodSync12, mkdirSync as mkdirSync47 } from "node:fs";
-import { join as join84 } from "node:path";
+import { join as join85 } from "node:path";
 function containerHookCommand() {
-  return join84(CONTAINER_AGENT_DIR, ".claude", "hooks", HOOK_FILENAME);
+  return join85(CONTAINER_AGENT_DIR, ".claude", "hooks", HOOK_FILENAME);
 }
 function updatePromptHookScript() {
   return `#!/bin/bash
@@ -48044,9 +48720,9 @@ exit 0
 `;
 }
 function installUpdatePromptHook(agentDir) {
-  const hooksDir = join84(agentDir, ".claude", "hooks");
+  const hooksDir = join85(agentDir, ".claude", "hooks");
   mkdirSync47(hooksDir, { recursive: true });
-  const scriptPath = join84(hooksDir, HOOK_FILENAME);
+  const scriptPath = join85(hooksDir, HOOK_FILENAME);
   const desired = updatePromptHookScript();
   let installed = false;
   const existing = existsSync83(scriptPath) ? readFileSync72(scriptPath, "utf-8") : "";
@@ -48059,7 +48735,7 @@ function installUpdatePromptHook(agentDir) {
       chmodSync12(scriptPath, 493);
     } catch {}
   }
-  const settingsPath = join84(agentDir, ".claude", "settings.json");
+  const settingsPath = join85(agentDir, ".claude", "settings.json");
   if (!existsSync83(settingsPath)) {
     return { scriptPath, settingsPath, installed };
   }
@@ -48117,6 +48793,10 @@ function installUpdatePromptHook(agentDir) {
 var HOOK_FILENAME = "update-card-on-prompt.sh", CONTAINER_AGENT_DIR = "/state/agent";
 var init_update_prompt_hook = () => {};
 
+// src/litellm/external-spend.ts
+var LITELLM_MASTER_KEY_STATE_BASENAME = "litellm-master-key";
+var init_external_spend = () => {};
+
 // src/cli/install-detect.ts
 import * as fs5 from "node:fs";
 import * as path8 from "node:path";
@@ -48594,6 +49274,7 @@ __export(exports_apply, {
   provisionLiteLLMKeys: () => provisionLiteLLMKeys,
   probeVaultProvisioning: () => probeVaultProvisioning,
   parseComposeServiceNames: () => parseComposeServiceNames,
+  materializeLitellmMasterKeyForBroker: () => materializeLitellmMasterKeyForBroker,
   isInAgentContainer: () => isInAgentContainer,
   inspectVaultBindMountDir: () => inspectVaultBindMountDir,
   formatScaffoldFailureResolution: () => formatScaffoldFailureResolution,
@@ -48606,11 +49287,11 @@ __export(exports_apply, {
   DEFAULT_COMPOSE_PATH: () => DEFAULT_COMPOSE_PATH2,
   COMPOSE_PROJECT: () => COMPOSE_PROJECT2
 });
-import { accessSync as accessSync3, chownSync as chownSync8, constants as fsConstants6, copyFileSync as copyFileSync12, existsSync as existsSync86, mkdirSync as mkdirSync49, readFileSync as readFileSync74, readdirSync as readdirSync30, renameSync as renameSync20, statSync as statSync47, writeFileSync as writeFileSync31 } from "node:fs";
+import { accessSync as accessSync3, chmodSync as chmodSync14, chownSync as chownSync8, constants as fsConstants6, copyFileSync as copyFileSync12, existsSync as existsSync86, mkdirSync as mkdirSync49, readFileSync as readFileSync74, readdirSync as readdirSync30, renameSync as renameSync20, statSync as statSync47, writeFileSync as writeFileSync31 } from "node:fs";
 import { mkdir as mkdir2 } from "node:fs/promises";
 import { spawnSync as childSpawnSync } from "node:child_process";
 import readline from "node:readline";
-import { dirname as dirname30, join as join86, resolve as resolve52 } from "node:path";
+import { dirname as dirname30, join as join87, resolve as resolve52 } from "node:path";
 import { homedir as homedir49 } from "node:os";
 import { execFileSync as execFileSync27 } from "node:child_process";
 function effectiveLiteLLMEnabled(config, agentResolvedLitellm) {
@@ -48622,13 +49303,28 @@ async function resolveOperatorVaultPassphrase(home2) {
     return envPass;
   try {
     const { readAutoUnlockFile: readAutoUnlockFile2 } = await Promise.resolve().then(() => (init_auto_unlock(), exports_auto_unlock));
-    const blobPath = join86(home2, ".switchroom", "vault-auto-unlock");
+    const blobPath = join87(home2, ".switchroom", "vault-auto-unlock");
     const pass = readAutoUnlockFile2(blobPath);
     return pass && pass.length > 0 ? pass : null;
   } catch {
     return null;
   }
 }
+function materializeLitellmMasterKeyForBroker(masterKey, home2 = process.env.HOME ?? "/root") {
+  try {
+    const stateDir = join87(home2, ".switchroom", "state", "auth-broker");
+    mkdirSync49(stateDir, { recursive: true, mode: 448 });
+    const path9 = join87(stateDir, LITELLM_MASTER_KEY_STATE_BASENAME);
+    writeFileSync31(path9, masterKey.trim() + `
+`, { mode: 384 });
+    try {
+      chmodSync14(path9, 384);
+    } catch {}
+    return { ok: true, path: path9 };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+}
 async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ctx) {
   const { writeOut, failures } = ctx;
   const optedIn = [];
@@ -48644,6 +49340,7 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
   const needsHindsight = config.litellm?.enabled === true && config.memory?.backend === "hindsight";
   if (optedIn.length === 0 && !needsHindsight)
     return;
+  let brokerKeyMaterialized = false;
   const [{ getViaBrokerStructured: getViaBrokerStructured2, putViaBroker: putViaBroker2 }, { ensureTeam: ensureTeam2, ensureKey: ensureKey2, validateKey: validateKey2, bindKeyToTeam: bindKeyToTeam2 }, { addAgentSecret: addAgentSecret2 }] = await Promise.all([
     Promise.resolve().then(() => (init_client(), exports_client)),
     Promise.resolve().then(() => (init_provision(), exports_provision)),
@@ -48753,6 +49450,14 @@ async function provisionLiteLLMKeys(config, agentNames, switchroomConfigPath, ct
           masterKey = resolved.entry.value;
         }
       }
+      if (masterKey && !brokerKeyMaterialized) {
+        const mat = materializeLitellmMasterKeyForBroker(masterKey, ctx.home ?? homedir49());
+        brokerKeyMaterialized = true;
+        if (!mat.ok) {
+          ctx.writeErr(source_default.yellow(`  ! litellm: could not materialize master key for auth-broker external-spend (${mat.error})
+`));
+        }
+      }
       if (existing.kind === "ok") {
         const storedKey = existing.entry.kind === "string" ? existing.entry.value : null;
         let driftReprovision = false;
@@ -48935,7 +49640,7 @@ function resolveVaultBindMountDir(homeDir, ctx) {
   if (isCustomPath && ctx.customVaultPath) {
     return dirname30(ctx.customVaultPath);
   }
-  return join86(homeDir, ".switchroom", "vault");
+  return join87(homeDir, ".switchroom", "vault");
 }
 function inspectVaultBindMountDir(vaultDir) {
   if (!existsSync86(vaultDir))
@@ -48966,41 +49671,41 @@ function hasVaultRefs(value) {
 async function ensureHostMountSources(config) {
   const home2 = resolveHostHomeForCompose();
   const dirs = [
-    join86(home2, ".switchroom", "approvals"),
-    join86(home2, ".switchroom", "scheduler"),
-    join86(home2, ".switchroom", "logs"),
-    join86(home2, ".switchroom", "compose"),
-    join86(home2, ".switchroom", "broker-operator")
+    join87(home2, ".switchroom", "approvals"),
+    join87(home2, ".switchroom", "scheduler"),
+    join87(home2, ".switchroom", "logs"),
+    join87(home2, ".switchroom", "compose"),
+    join87(home2, ".switchroom", "broker-operator")
   ];
   for (const name of Object.keys(config.agents)) {
-    dirs.push(join86(home2, ".switchroom", "agents", name));
-    dirs.push(join86(home2, ".switchroom", "logs", name));
-    dirs.push(join86(home2, ".claude", "projects", name));
-    dirs.push(join86(home2, ".switchroom", "audit", name));
-    if (existsSync86(join86(home2, ".switchroom-config"))) {
-      dirs.push(join86(home2, ".switchroom-config", "agents", name, "personal-skills"));
+    dirs.push(join87(home2, ".switchroom", "agents", name));
+    dirs.push(join87(home2, ".switchroom", "logs", name));
+    dirs.push(join87(home2, ".claude", "projects", name));
+    dirs.push(join87(home2, ".switchroom", "audit", name));
+    if (existsSync86(join87(home2, ".switchroom-config"))) {
+      dirs.push(join87(home2, ".switchroom-config", "agents", name, "personal-skills"));
     }
   }
   for (const dir of dirs) {
     await mkdir2(dir, { recursive: true });
   }
-  const autoUnlockPath = join86(home2, ".switchroom", "vault-auto-unlock");
+  const autoUnlockPath = join87(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync86(autoUnlockPath)) {
     writeFileSync31(autoUnlockPath, "", { mode: 384 });
   }
-  const auditLogPath = join86(home2, ".switchroom", "vault-audit.log");
+  const auditLogPath = join87(home2, ".switchroom", "vault-audit.log");
   if (!existsSync86(auditLogPath)) {
     writeFileSync31(auditLogPath, "", { mode: 420 });
   }
   const grantsDbDir = getGrantsDbDir(home2);
   mkdirSync49(grantsDbDir, { recursive: true, mode: 448 });
   migrateLegacyGrantsDbLocation(getGrantsDbPath(home2));
-  const hostdAuditLogPath = join86(home2, ".switchroom", "host-control-audit.log");
+  const hostdAuditLogPath = join87(home2, ".switchroom", "host-control-audit.log");
   if (!existsSync86(hostdAuditLogPath)) {
     writeFileSync31(hostdAuditLogPath, "", { mode: 420 });
   }
   for (const name of Object.keys(config.agents)) {
-    const tokenPath = join86(home2, ".switchroom", "agents", name, ".vault-token");
+    const tokenPath = join87(home2, ".switchroom", "agents", name, ".vault-token");
     if (!existsSync86(tokenPath)) {
       writeFileSync31(tokenPath, "", { mode: 384 });
     }
@@ -49009,15 +49714,15 @@ async function ensureHostMountSources(config) {
       chownSync8(tokenPath, uid, uid);
     } catch {}
   }
-  const fleetDir = join86(home2, ".switchroom", "fleet");
+  const fleetDir = join87(home2, ".switchroom", "fleet");
   await mkdir2(fleetDir, { recursive: true });
-  const invariantsPath = join86(fleetDir, "switchroom-invariants.md");
+  const invariantsPath = join87(fleetDir, "switchroom-invariants.md");
   const invariantsCanonical = renderFleetInvariants();
   const invariantsCurrent = existsSync86(invariantsPath) ? readFileSync74(invariantsPath, "utf-8") : null;
   if (invariantsCurrent !== invariantsCanonical) {
     writeFileSync31(invariantsPath, invariantsCanonical, { mode: 420 });
   }
-  const fleetClaudePath = join86(fleetDir, "CLAUDE.md");
+  const fleetClaudePath = join87(fleetDir, "CLAUDE.md");
   if (!existsSync86(fleetClaudePath)) {
     writeFileSync31(fleetClaudePath, renderFleetDefaultsClaudeMd(), {
       mode: 420
@@ -49103,8 +49808,8 @@ function detectAndReportLegacyGdriveSlots(vaultPath) {
 }
 function writeInstallTypeCache(homeDir = homedir49()) {
   const ctx = detectInstallType();
-  const dir = join86(homeDir, ".switchroom");
-  const out = join86(dir, "install-type.json");
+  const dir = join87(homeDir, ".switchroom");
+  const out = join87(dir, "install-type.json");
   const tmp = `${out}.tmp`;
   mkdirSync49(dir, { recursive: true });
   const payload = {
@@ -49171,17 +49876,17 @@ Applying switchroom config...
       writeOut(source_default.green(`  + ${name}`) + source_default.gray(` (${agentConfig.extends ?? "default"}) \u2014 ${detail}
 `));
       try {
-        installUpdatePromptHook(join86(agentsDir, name));
+        installUpdatePromptHook(join87(agentsDir, name));
       } catch (hookErr) {
         writeOut(source_default.gray(`    (update-prompt hook install failed for ${name}: ${hookErr.message})
 `));
       }
-      await refreshAgentConnectionHealth(config, name, join86(agentsDir, name), {
+      await refreshAgentConnectionHealth(config, name, join87(agentsDir, name), {
         vaultAclReader: connHealthVaultAclReader
       });
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join86(agentsDir, name), uid, {
+        alignAgentUid(name, join87(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -49226,7 +49931,7 @@ Applying switchroom config...
     for (const name of agentNames) {
       try {
         const uid = allocateAgentUid(name);
-        alignAgentUid(name, join86(agentsDir, name), uid, {
+        alignAgentUid(name, join87(agentsDir, name), uid, {
           confirm: !options.nonInteractive,
           writeOut
         });
@@ -49586,7 +50291,7 @@ function findUnwritableAgentDirs(config, opts) {
   const targets = opts.only ? [opts.only] : Object.keys(config.agents ?? {});
   const unwritable = [];
   for (const name of targets) {
-    const startSh = join86(agentsDir, name, "start.sh");
+    const startSh = join87(agentsDir, name, "start.sh");
     if (!existsSync86(startSh))
       continue;
     try {
@@ -49782,6 +50487,7 @@ var init_apply = __esm(() => {
   init_connection_health();
   init_update_prompt_hook();
   init_compose();
+  init_external_spend();
   init_write_compose();
   init_profiles();
   init_install_detect();
@@ -49791,7 +50497,7 @@ var init_apply = __esm(() => {
     switchroom: switchroom_default,
     minimal: minimal_default
   };
-  DEFAULT_COMPOSE_PATH2 = join86(homedir49(), ".switchroom", "compose", "docker-compose.yml");
+  DEFAULT_COMPOSE_PATH2 = join87(homedir49(), ".switchroom", "compose", "docker-compose.yml");
   IN_AGENT_CONTAINER_APPLY_MSG = "`switchroom apply`'s full per-agent scaffold cannot run from inside an " + "agent container \u2014 this is a host/hostd operation by construction " + "(no vault at the container HOME, and no `docker compose` v2 plugin here).\nTo roll the fleet to a new version, drive the hostd rollout (`mcp__hostd__rollout`): it runs a `--compose-only` apply plus a per-agent restart-reconcile, and each agent refreshes its own templates " + `on restart \u2014 the roll completes without any agent running a full apply.
 ` + "A full host-side `sudo switchroom apply` is only needed for structural changes (compose regeneration / new-agent scaffolding), and is run by the operator on the host, never from inside an agent.";
   SELF_ELEVATE_PRESERVED_ENV = [
@@ -64018,6 +64724,12 @@ var init_mapping = __esm(() => {
       severity: 1,
       job_spec: "feel-like-a-colleague",
       signature: "represent:obligation-escalation"
+    },
+    "litellm-header-passthrough-misconfig": {
+      failure_mode: "constraint-violation",
+      severity: 3,
+      job_spec: "keep-my-subscription-honest",
+      signature: "litellm-header-passthrough:oauth-leak-scope"
     }
   };
   ALL_JOB_SPECS = [
@@ -64208,6 +64920,122 @@ var init_test_agents = __esm(() => {
   ];
 });
 
+// src/litellm/header-passthrough-guard.ts
+function isClaudeAllowlistedGroup(name) {
+  if (name.endsWith("-openrouter"))
+    return false;
+  return name.startsWith("claude-") || name === "sonnet" || name === "fable";
+}
+function flagTruthy(v) {
+  return v === true || v === "true";
+}
+function* iterGroups(mgs) {
+  if (!mgs || typeof mgs !== "object")
+    return;
+  if (Array.isArray(mgs)) {
+    for (const entry of mgs) {
+      if (!entry || typeof entry !== "object")
+        continue;
+      const e = entry;
+      const name = typeof e.model_group === "string" && e.model_group || typeof e.group_name === "string" && e.group_name || typeof e.model_name === "string" && e.model_name || null;
+      if (name)
+        yield [name, e];
+    }
+    return;
+  }
+  for (const [name, settings] of Object.entries(mgs)) {
+    if (settings && typeof settings === "object") {
+      yield [name, settings];
+    }
+  }
+}
+function detectHeaderMisconfig(parsed) {
+  const violations = [];
+  if (!parsed || typeof parsed !== "object")
+    return violations;
+  const root = parsed;
+  const ls = root.litellm_settings;
+  if (ls && typeof ls === "object" && flagTruthy(ls[FORWARD_HEADERS_FLAG])) {
+    violations.push({
+      scope: "global",
+      detail: `${FORWARD_HEADERS_FLAG}: true under litellm_settings \u2014 the GLOBAL ` + `master switch forwards the subscription OAuth Authorization header ` + `to EVERY upstream (OpenRouter/OpenAI included). Scope it to Claude ` + `groups only.`
+    });
+  }
+  for (const [group, settings] of iterGroups(root.model_group_settings)) {
+    if (flagTruthy(settings[FORWARD_HEADERS_FLAG]) && !isClaudeAllowlistedGroup(group)) {
+      violations.push({
+        scope: "model_group",
+        group,
+        detail: `${FORWARD_HEADERS_FLAG}: true on non-Claude group '${group}' \u2014 ` + `forwards the subscription OAuth Authorization header to a ` + `non-subscription upstream. Remove it from this group.`
+      });
+    }
+  }
+  return violations;
+}
+function parseLitellmConfig(text) {
+  try {
+    return import_yaml26.parse(text);
+  } catch {
+    return null;
+  }
+}
+var import_yaml26, FORWARD_HEADERS_FLAG = "forward_client_headers_to_llm_api", DEFAULT_LITELLM_CONFIG_PATH = "/data/coolify/services/vhz4jc1tzvk6gdql8jueiwq4/litellm-config.yaml";
+var init_header_passthrough_guard = __esm(() => {
+  import_yaml26 = __toESM(require_dist(), 1);
+});
+
+// src/fleet-health/litellm-config-sensor.ts
+import { readFileSync as readFileSync85, existsSync as existsSync98 } from "node:fs";
+function resolveLitellmConfigPath(explicit) {
+  return explicit ?? process.env.LITELLM_CONFIG_PATH ?? DEFAULT_LITELLM_CONFIG_PATH;
+}
+function scanLitellmConfig(opts = {}) {
+  const path9 = resolveLitellmConfigPath(opts.path);
+  const exists = opts.existsFn ?? existsSync98;
+  const read = opts.readFn ?? ((p) => readFileSync85(p, "utf-8"));
+  const log = opts.log ?? (() => {});
+  const nowIso = opts.nowIso ?? new Date().toISOString();
+  if (!exists(path9)) {
+    log(`fleet-health: litellm-config sensor SKIPPED \u2014 config file absent at ${path9} ` + `(set LITELLM_CONFIG_PATH if it moved; hermetic CI/dev expected to skip)`);
+    return { status: "skipped", path: path9, findings: [] };
+  }
+  let text;
+  try {
+    text = read(path9);
+  } catch (e) {
+    log(`fleet-health: litellm-config sensor SKIPPED \u2014 ${path9} unreadable: ${String(e)}`);
+    return { status: "skipped", path: path9, findings: [] };
+  }
+  const parsed = parseLitellmConfig(text);
+  if (parsed == null) {
+    log(`fleet-health: litellm-config sensor SKIPPED \u2014 ${path9} unparseable YAML`);
+    return { status: "skipped", path: path9, findings: [] };
+  }
+  const violations = detectHeaderMisconfig(parsed);
+  if (violations.length === 0) {
+    log(`fleet-health: litellm-config sensor OK \u2014 header passthrough correctly scoped (${path9})`);
+    return { status: "ok", path: path9, findings: [] };
+  }
+  const findings = violations.map((v, i) => {
+    const where = v.scope === "global" ? "litellm_settings (global)" : `group '${v.group}'`;
+    return {
+      signal: "litellm-header-passthrough-misconfig",
+      agent: LITELLM_PROXY_PSEUDO_AGENT,
+      turn_id: `litellm-config:${v.scope}:${v.group ?? "global"}`,
+      log_pointer: `${path9}: ${where} \u2014 ${v.detail}`,
+      ts: nowIso
+    };
+  });
+  for (const f of findings) {
+    log(`fleet-health: litellm-config sensor VIOLATION \u2014 ${f.log_pointer}`);
+  }
+  return { status: "violation", path: path9, findings };
+}
+var LITELLM_PROXY_PSEUDO_AGENT = "litellm-proxy";
+var init_litellm_config_sensor = __esm(() => {
+  init_header_passthrough_guard();
+});
+
 // src/fleet-health/scan.ts
 var exports_scan = {};
 __export(exports_scan, {
@@ -64219,9 +65047,9 @@ __export(exports_scan, {
   ledgerPathForBase: () => ledgerPathForBase
 });
 import {
-  readFileSync as readFileSync85,
+  readFileSync as readFileSync86,
   readdirSync as readdirSync38,
-  existsSync as existsSync98,
+  existsSync as existsSync99,
   mkdirSync as mkdirSync56,
   writeFileSync as writeFileSync37
 } from "node:fs";
@@ -64232,7 +65060,7 @@ function resolveSwitchroomBase(home2 = process.env.SWITCHROOM_HOME ?? process.en
 }
 function listAgents(base) {
   const dir = resolve57(base, "agents");
-  if (!existsSync98(dir))
+  if (!existsSync99(dir))
     return [];
   try {
     return readdirSync38(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
@@ -64261,16 +65089,16 @@ function runScan(opts = {}) {
     let gwText = "";
     let sawArtifact = false;
     try {
-      if (existsSync98(turnsPath)) {
-        turnsText = readFileSync85(turnsPath, "utf-8");
+      if (existsSync99(turnsPath)) {
+        turnsText = readFileSync86(turnsPath, "utf-8");
         sawArtifact = true;
       }
     } catch (e) {
       log(`fleet-health: WARN skipping ${agent} turns.jsonl unreadable: ${String(e)}`);
     }
     try {
-      if (existsSync98(gwPath)) {
-        gwText = readFileSync85(gwPath, "utf-8");
+      if (existsSync99(gwPath)) {
+        gwText = readFileSync86(gwPath, "utf-8");
         sawArtifact = true;
       }
     } catch (e) {
@@ -64292,6 +65120,8 @@ function runScan(opts = {}) {
       skipped.push(agent);
     }
   }
+  const litellm = scanLitellmConfig({ path: opts.litellmConfigPath, log });
+  findings.push(...litellm.findings);
   const prior = readLedgerIfPresent(base);
   const ledger = buildLedger(findings, {
     ownerAgent: opts.ownerAgent,
@@ -64310,9 +65140,9 @@ function runScan(opts = {}) {
 function readLedgerIfPresent(base) {
   const path9 = ledgerPathForBase(base);
   try {
-    if (!existsSync98(path9))
+    if (!existsSync99(path9))
       return null;
-    return JSON.parse(readFileSync85(path9, "utf-8"));
+    return JSON.parse(readFileSync86(path9, "utf-8"));
   } catch {
     return null;
   }
@@ -64332,6 +65162,7 @@ var init_scan = __esm(() => {
   init_detect();
   init_ledger();
   init_test_agents();
+  init_litellm_config_sensor();
 });
 
 // src/cli/index.ts
@@ -70086,6 +70917,10 @@ function isThin(d) {
 }
 function classifyState(args) {
   const { exhausted, exhaustedUntil, window, now } = args;
+  if (args.entitlementBlocked === true)
+    return "org-disabled";
+  if (args.inService === false)
+    return "retired";
   if (window.probeThin)
     return "unprobed";
   const norm = refillNormalizedUtils({
@@ -70130,17 +70965,30 @@ function buildScheduleRows(state, probe, now) {
     const exhaustedUntil = typeof a.exhausted_until === "number" ? new Date(a.exhausted_until) : null;
     const exhausted = a.exhausted && (exhaustedUntil?.getTime() ?? 0) > now.getTime();
     const rank = state.fallback_order.indexOf(a.label);
+    const isActive = a.label === state.active;
+    const inService = isActive ? true : a.in_service !== false;
+    const entitlementBlocked = isActive ? false : a.entitlement_blocked === true;
     return {
       label: a.label,
-      isActive: a.label === state.active,
+      isActive,
       fallbackRank: rank === -1 ? null : rank + 1,
+      inService,
+      entitlementBlocked,
       window,
       exhausted,
       exhaustedUntil,
-      state: classifyState({ exhausted, exhaustedUntil, window, now })
+      state: classifyState({
+        exhausted,
+        exhaustedUntil,
+        window,
+        now,
+        inService,
+        entitlementBlocked
+      })
     };
   });
-  const key = (r) => r.isActive ? -1 : r.fallbackRank ?? 9999;
+  const outOfService = (r) => !r.inService || r.entitlementBlocked;
+  const key = (r) => outOfService(r) ? 1e5 : r.isActive ? -1 : r.fallbackRank ?? 9999;
   return rows.sort((a, b) => key(a) - key(b) || a.label.localeCompare(b.label));
 }
 var EM_DASH = "\u2014";
@@ -70193,6 +71041,10 @@ function formatWeeklyCell(w, now, tz) {
   return `${pct} \u00b7 ${formatResetDay(w.weeklyResetAt, tz)} (${rel})`;
 }
 function poolLabel(row) {
+  if (row.entitlementBlocked)
+    return "disabled";
+  if (!row.inService)
+    return "retired";
   if (row.isActive)
     return row.fallbackRank ? `active #${row.fallbackRank}` : "active";
   if (row.fallbackRank)
@@ -70204,6 +71056,10 @@ function formatStateCell(row, now) {
   const rel = horizon ? ` \u00b7 ${formatDuration(horizon.getTime() - now.getTime())}` : "";
   const overageNote = row.window.overageServeBlocking && row.window.overageReason ? ` (overage off: ${row.window.overageReason})` : row.window.overageServeBlocking ? " (overage off)" : "";
   switch (row.state) {
+    case "org-disabled":
+      return "DISABLED (org)";
+    case "retired":
+      return "retired";
     case "quota-exhausted":
       return `quota-exhausted${rel}`;
     case "healthy":
@@ -70225,10 +71081,16 @@ function pad3(s, n) {
   return s.padEnd(n);
 }
 function glyphFor(row, color) {
-  const g = row.isActive ? "\u25cf" : row.exhausted ? "!" : row.state === "unprobed" ? "\u00b7" : "\u2713";
+  const g = row.isActive ? "\u25cf" : row.state === "org-disabled" ? "\u2298" : row.state === "retired" ? "\u2205" : row.exhausted ? "!" : row.state === "unprobed" ? "\u00b7" : "\u2713";
   if (!color)
     return g;
-  return row.isActive ? source_default.green(g) : row.exhausted ? source_default.red(g) : source_default.gray(g);
+  if (row.isActive)
+    return source_default.green(g);
+  if (row.state === "org-disabled")
+    return source_default.red(g);
+  if (row.state === "retired")
+    return source_default.gray(g);
+  return row.exhausted ? source_default.red(g) : source_default.gray(g);
 }
 function colorState(text, state, color) {
   if (!color)
@@ -70236,6 +71098,7 @@ function colorState(text, state, color) {
   switch (state) {
     case "healthy":
       return source_default.green(text);
+    case "org-disabled":
     case "weekly-walled":
       return source_default.red(text);
     case "quota-exhausted":
@@ -70449,8 +71312,11 @@ function formatQuotaUtilCell(a, now = Date.now()) {
 function printAccountsTable(state) {
   console.log(source_default.bold("  ACCOUNT                           STATUS       EXPIRES    QUOTA 5h\u00b77d          QUOTA-RESET"));
   for (const a of state.accounts) {
-    const marker = a.label === state.active ? source_default.green("\u25cf") : a.exhausted ? source_default.red("!") : source_default.gray("\u2713");
-    const status = a.label === state.active ? source_default.green("active   ") : a.exhausted ? source_default.red("exhausted") : "available";
+    const isActive = a.label === state.active;
+    const orgBlocked = a.entitlement_blocked === true;
+    const retired = a.in_service === false;
+    const marker = isActive ? source_default.green("\u25cf") : orgBlocked ? source_default.red("\u2298") : retired ? source_default.gray("\u2205") : a.exhausted ? source_default.red("!") : source_default.gray("\u2713");
+    const status = isActive ? source_default.green("active   ") : orgBlocked ? source_default.red("DISABLED ") : retired ? source_default.gray("retired  ") : a.exhausted ? source_default.red("exhausted") : "available";
     const label = a.label.padEnd(32);
     const exp = formatExpiry2(a.expiresAt).padEnd(10);
     const util3 = formatQuotaUtilCell(a).padEnd(20);
@@ -70499,8 +71365,16 @@ function printUsageTable(state) {
   console.log(source_default.bold("  ACCOUNT                           PREMIUM (Fable) HEADROOM                    STANDARD HEADROOM"));
   const WIDTH = 44;
   for (const a of state.accounts) {
-    const marker = a.label === state.active ? source_default.green("*") : " ";
+    const isActive = a.label === state.active;
+    const orgBlocked = a.entitlement_blocked === true;
+    const retired = a.in_service === false;
+    const marker = isActive ? source_default.green("*") : orgBlocked ? source_default.red("\u2298") : retired ? source_default.gray("\u2205") : " ";
     const label = a.label.padEnd(32);
+    if (orgBlocked || retired) {
+      const note = orgBlocked ? source_default.red("DISABLED (org) \u2014 no fleet routing") : source_default.gray("retired \u2014 removed from fleet rotation");
+      console.log(`  ${marker} ${label} ${note}`);
+      continue;
+    }
     const premium = usageHeadroomCell(a.usage_ledger?.premium ?? null);
     const standard = usageHeadroomCell(a.usage_ledger?.standard ?? null);
     const premiumCol = premium.color(premium.plain.padEnd(WIDTH));
@@ -78331,7 +79205,7 @@ Cross-agent reflection plan
     }
     console.log();
   }));
-  memory.command("setup").description("Manage the Hindsight Docker container").option("--stop", "Stop and remove the Hindsight container").option("--status", "Show Hindsight container status").option("--recreate", "Pull the latest image and recreate the container (reusing its current port). Used by `switchroom update` to keep the hindsight singleton current.").option("--tag <version>", "Pin the hindsight image tag to pull + run (e.g. v0.15.18), overriding the " + "default floating `:latest`. Threaded through by `switchroom rollout` so a " + "version-pinned roll recreates hindsight on the SAME tag as the rest of the " + "fleet. Omit for `:latest` (the standalone default).").option("--provider <provider>", "LLM provider (ollama, openai, anthropic)").action(async (opts) => {
+  memory.command("setup").description("Manage the Hindsight Docker container").option("--stop", "Stop and remove the Hindsight container").option("--status", "Show Hindsight container status").option("--recreate", "Pull the latest image and recreate the container (reusing its current port). Used by `switchroom update` to keep the hindsight singleton current. Also required after any `hindsight.llm` model/provider config change \u2014 env is only re-derived on recreate, a plain docker restart is not enough (see docs/operators/hindsight-model-change.md).").option("--tag <version>", "Pin the hindsight image tag to pull + run (e.g. v0.15.18), overriding the " + "default floating `:latest`. Threaded through by `switchroom rollout` so a " + "version-pinned roll recreates hindsight on the SAME tag as the rest of the " + "fleet. Omit for `:latest` (the standalone default).").option("--provider <provider>", "LLM provider (ollama, openai, anthropic)").action(async (opts) => {
     if (opts.status) {
       if (!isDockerAvailable()) {
         console.log(source_default.red("  Docker is not available."));
@@ -84110,7 +84984,7 @@ init_lifecycle();
 init_compose_env();
 import { cpSync as cpSync2, existsSync as existsSync67, mkdirSync as mkdirSync35, readFileSync as readFileSync60, realpathSync as realpathSync6, rmSync as rmSync12, statSync as statSync40, chownSync as chownSync5 } from "node:fs";
 import { spawnSync as spawnSync12 } from "node:child_process";
-import { join as join68, dirname as dirname21, resolve as resolve40 } from "node:path";
+import { join as join69, dirname as dirname21, resolve as resolve40 } from "node:path";
 import { homedir as homedir40 } from "node:os";
 
 // src/cli/release-yaml.ts
@@ -84218,13 +85092,13 @@ function defaultPersistPin(configPath) {
     } catch {}
   };
 }
-var DEFAULT_COMPOSE_PATH = join68(homedir40(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH = join69(homedir40(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname21(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync67(join68(dir, ".git"))) {
+    if (existsSync67(join69(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync60(join68(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync60(join69(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -84435,7 +85309,7 @@ function planUpdate(opts) {
         return;
       }
       const source = resolve40(import.meta.dirname, "../../skills");
-      const dest = join68(homedir40(), ".switchroom", "skills", "_bundled");
+      const dest = join69(homedir40(), ".switchroom", "skills", "_bundled");
       if (!existsSync67(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
@@ -84560,7 +85434,7 @@ function defaultStatusProbe(composePath) {
       } catch {}
       let dir = dirname21(scriptPath);
       for (let i = 0;i < 8; i++) {
-        const pkgPath = join68(dir, "package.json");
+        const pkgPath = join69(dir, "package.json");
         if (existsSync67(pkgPath)) {
           try {
             const pkg = JSON.parse(readFileSync60(pkgPath, "utf-8"));
@@ -85263,7 +86137,7 @@ init_lifecycle();
 init_resolve_version();
 import { execSync as execSync3 } from "node:child_process";
 import { existsSync as existsSync68, readFileSync as readFileSync62 } from "node:fs";
-import { dirname as dirname22, join as join69 } from "node:path";
+import { dirname as dirname22, join as join70 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync3("claude --version 2>/dev/null", {
@@ -85313,11 +86187,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
-    const pkgPath = join69(dir, "package.json");
+    const pkgPath = join70(dir, "package.json");
     if (existsSync68(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync62(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync68(join69(dir, ".git"))) {
+        if (pkg.name === "switchroom" && existsSync68(join70(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -85500,12 +86374,12 @@ import {
   statSync as statSync42,
   unlinkSync as unlinkSync14
 } from "node:fs";
-import { join as join70 } from "node:path";
+import { join as join71 } from "node:path";
 var DEFAULT_SESSION_RETENTION_MAX_COUNT = 20;
 var DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS = 30;
 var MIN_KEEP = 2;
 function collectSessionJsonl(claudeConfigDir) {
-  const projects = join70(claudeConfigDir, "projects");
+  const projects = join71(claudeConfigDir, "projects");
   if (!existsSync69(projects))
     return [];
   const found = [];
@@ -85517,7 +86391,7 @@ function collectSessionJsonl(claudeConfigDir) {
       return;
     }
     for (const name of entries) {
-      const full = join70(dir, name);
+      const full = join71(dir, name);
       let st;
       try {
         st = statSync42(full);
@@ -85648,7 +86522,7 @@ import {
   writeFileSync as writeFileSync19,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join71 } from "node:path";
+import { join as join72 } from "node:path";
 import { randomBytes as randomBytes12 } from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
 
@@ -86079,7 +86953,7 @@ function redactedMarker(ruleId) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path5 = join71(stateDir, ISSUES_FILE);
+  const path5 = join72(stateDir, ISSUES_FILE);
   if (!existsSync70(path5))
     return [];
   let raw;
@@ -86157,7 +87031,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve43(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync70(join71(stateDir, ISSUES_FILE)))
+  if (!existsSync70(join72(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -86175,7 +87049,7 @@ function resolve43(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync70(join71(stateDir, ISSUES_FILE)))
+  if (!existsSync70(join72(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -86193,7 +87067,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync70(join71(stateDir, ISSUES_FILE)))
+  if (!existsSync70(join72(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -86226,7 +87100,7 @@ function ensureDir(stateDir) {
   mkdirSync36(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path5 = join71(stateDir, ISSUES_FILE);
+  const path5 = join72(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path5}.tmp-${process.pid}-${randomBytes12(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -86248,7 +87122,7 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join71(stateDir, entry);
+    const tmpPath = join72(stateDir, entry);
     try {
       const stat = statSync43(tmpPath);
       if (stat.mtimeMs < cutoff) {
@@ -86260,7 +87134,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join71(stateDir, ISSUES_LOCK);
+  const lockPath = join72(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -86545,7 +87419,7 @@ function relTime(deltaMs) {
 init_source();
 import { existsSync as existsSync73 } from "node:fs";
 import { homedir as homedir44 } from "node:os";
-import { join as join74, resolve as resolve44 } from "node:path";
+import { join as join75, resolve as resolve44 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash13 } from "node:crypto";
@@ -86556,7 +87430,7 @@ import {
   rmSync as rmSync13,
   writeFileSync as writeFileSync20
 } from "node:fs";
-import { dirname as dirname23, join as join72 } from "node:path";
+import { dirname as dirname23, join as join73 } from "node:path";
 import { homedir as homedir42 } from "node:os";
 import { execFileSync as execFileSync21 } from "node:child_process";
 
@@ -86569,7 +87443,7 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join72(homedir42(), ".switchroom", "deps", "python");
+  return join73(homedir42(), ".switchroom", "deps", "python");
 }
 function hashFile(path5) {
   return createHash13("sha256").update(readFileSync64(path5)).digest("hex");
@@ -86581,11 +87455,11 @@ function ensurePythonEnv(opts) {
   if (!existsSync71(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join72(cacheRoot, skillName);
-  const stampPath = join72(venvDir, ".requirements.sha256");
-  const binDir = join72(venvDir, "bin");
-  const pythonBin = join72(binDir, "python");
-  const pipBin = join72(binDir, "pip");
+  const venvDir = join73(cacheRoot, skillName);
+  const stampPath = join73(venvDir, ".requirements.sha256");
+  const binDir = join73(venvDir, "bin");
+  const pythonBin = join73(binDir, "python");
+  const pipBin = join73(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
   if (!force && existsSync71(stampPath) && existsSync71(pythonBin)) {
     const existingHash = readFileSync64(stampPath, "utf8").trim();
@@ -86644,7 +87518,7 @@ import {
   rmSync as rmSync14,
   writeFileSync as writeFileSync21
 } from "node:fs";
-import { dirname as dirname24, join as join73 } from "node:path";
+import { dirname as dirname24, join as join74 } from "node:path";
 import { homedir as homedir43 } from "node:os";
 import { execFileSync as execFileSync22 } from "node:child_process";
 
@@ -86668,7 +87542,7 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join73(homedir43(), ".switchroom", "deps", "node");
+  return join74(homedir43(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
   const sourceDir = dirname24(packageJsonPath);
@@ -86677,7 +87551,7 @@ function hashDepInputs(packageJsonPath) {
 `);
   hasher.update(readFileSync65(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join73(sourceDir, lockName);
+    const lockPath = join74(sourceDir, lockName);
     if (existsSync72(lockPath)) {
       hasher.update(`
 `);
@@ -86697,10 +87571,10 @@ function ensureNodeEnv(opts) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
   const sourceDir = dirname24(packageJsonPath);
-  const envDir = join73(cacheRoot, skillName);
-  const stampPath = join73(envDir, ".package.sha256");
-  const nodeModulesDir = join73(envDir, "node_modules");
-  const binDir = join73(nodeModulesDir, ".bin");
+  const envDir = join74(cacheRoot, skillName);
+  const stampPath = join74(envDir, ".package.sha256");
+  const nodeModulesDir = join74(envDir, "node_modules");
+  const binDir = join74(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
   if (!force && existsSync72(stampPath) && existsSync72(nodeModulesDir)) {
     const existingHash = readFileSync65(stampPath, "utf8").trim();
@@ -86718,12 +87592,12 @@ function ensureNodeEnv(opts) {
     rmSync14(envDir, { recursive: true, force: true });
   }
   mkdirSync38(envDir, { recursive: true });
-  copyFileSync10(packageJsonPath, join73(envDir, "package.json"));
+  copyFileSync10(packageJsonPath, join74(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join73(sourceDir, lockName);
+    const lockPath = join74(sourceDir, lockName);
     if (existsSync72(lockPath)) {
-      copyFileSync10(lockPath, join73(envDir, lockName));
+      copyFileSync10(lockPath, join74(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -86762,13 +87636,13 @@ function registerDepsCommand(program3) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join74(skillsRoot, skill);
+    const skillDir = join75(skillsRoot, skill);
     if (!existsSync73(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join74(skillDir, "requirements.txt");
-    const packageJsonPath = join74(skillDir, "package.json");
+    const requirementsPath = join75(skillDir, "requirements.txt");
+    const packageJsonPath = join75(skillDir, "package.json");
     const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync73(requirementsPath));
     const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync73(packageJsonPath));
     let did = 0;
@@ -87723,7 +88597,7 @@ init_helpers();
 init_loader();
 init_merge();
 import { copyFileSync as copyFileSync11, existsSync as existsSync75, readFileSync as readFileSync66, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join75, resolve as resolve46 } from "node:path";
+import { join as join76, resolve as resolve46 } from "node:path";
 init_scaffold();
 init_profiles();
 init_schema();
@@ -87749,7 +88623,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join75(workspaceDir, "SOUL.md"),
+    soulPath: join76(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -87816,7 +88690,7 @@ function registerSoulCommand(program3) {
 init_helpers();
 init_loader();
 import { existsSync as existsSync76, readFileSync as readFileSync67, readdirSync as readdirSync26, statSync as statSync44 } from "node:fs";
-import { resolve as resolve47, join as join76 } from "node:path";
+import { resolve as resolve47, join as join77 } from "node:path";
 import { createHash as createHash15 } from "node:crypto";
 init_merge();
 init_hindsight2();
@@ -87827,7 +88701,7 @@ function estimateTokens(bytes) {
   return Math.round(bytes / 3.7);
 }
 function readMcpServerNames(agentDir) {
-  const mcpPath = join76(agentDir, ".mcp.json");
+  const mcpPath = join77(agentDir, ".mcp.json");
   if (!existsSync76(mcpPath))
     return [];
   try {
@@ -87841,7 +88715,7 @@ function sha256(content) {
   return createHash15("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join76(claudeConfigDir, "projects");
+  const projectsDir = join77(claudeConfigDir, "projects");
   if (!existsSync76(projectsDir))
     return;
   try {
@@ -87850,8 +88724,8 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join76(projectsDir, entry.name);
-      const transcriptPath = join76(projectPath, "transcript.jsonl");
+      const projectPath = join77(projectsDir, entry.name);
+      const transcriptPath = join77(projectPath, "transcript.jsonl");
       if (!existsSync76(transcriptPath))
         continue;
       const stat3 = statSync44(transcriptPath);
@@ -87920,11 +88794,11 @@ function registerDebugCommand(program3) {
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join76(agentDir, ".claude");
-    const claudeMdPath = join76(agentDir, "CLAUDE.md");
-    const soulMdPath = join76(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join76(workspaceDir, "SOUL.md");
-    const handoffPath = join76(agentDir, ".handoff.md");
+    const claudeConfigDir = join77(agentDir, ".claude");
+    const claudeMdPath = join77(agentDir, "CLAUDE.md");
+    const soulMdPath = join77(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join77(workspaceDir, "SOUL.md");
+    const handoffPath = join77(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -88053,9 +88927,9 @@ function registerDebugCommand(program3) {
     const soulMdBytes = soulMdContent.length;
     const perTurnBytes = dynamicResult.concatenated.length;
     const userBytes = userMessage?.text.length ?? 0;
-    const fleetDir = join76(agentsDir, "..", "fleet");
-    const fleetInvPath = join76(fleetDir, "switchroom-invariants.md");
-    const fleetClaudePath = join76(fleetDir, "CLAUDE.md");
+    const fleetDir = join77(agentsDir, "..", "fleet");
+    const fleetInvPath = join77(fleetDir, "switchroom-invariants.md");
+    const fleetClaudePath = join77(fleetDir, "CLAUDE.md");
     const fleetInvBytes = existsSync76(fleetInvPath) ? readFileSync67(fleetInvPath, "utf-8").length : 0;
     const fleetClaudeBytes = existsSync76(fleetClaudePath) ? readFileSync67(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
@@ -88091,7 +88965,7 @@ init_source();
 // src/worktree/claim.ts
 import { execFileSync as execFileSync23 } from "node:child_process";
 import { closeSync as closeSync13, mkdirSync as mkdirSync40, openSync as openSync13, existsSync as existsSync78, unlinkSync as unlinkSync17 } from "node:fs";
-import { join as join78, resolve as resolve49 } from "node:path";
+import { join as join79, resolve as resolve49 } from "node:path";
 import { homedir as homedir46 } from "node:os";
 import { randomBytes as randomBytes13 } from "node:crypto";
 
@@ -88105,13 +88979,13 @@ import {
   existsSync as existsSync77,
   renameSync as renameSync17
 } from "node:fs";
-import { join as join77, resolve as resolve48 } from "node:path";
+import { join as join78, resolve as resolve48 } from "node:path";
 import { homedir as homedir45 } from "node:os";
 function registryDir() {
-  return resolve48(process.env.SWITCHROOM_WORKTREE_DIR ?? join77(homedir45(), ".switchroom", "worktrees"));
+  return resolve48(process.env.SWITCHROOM_WORKTREE_DIR ?? join78(homedir45(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join77(registryDir(), `${id}.json`);
+  return join78(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
   mkdirSync39(registryDir(), { recursive: true });
@@ -88162,7 +89036,7 @@ function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
   mkdirSync40(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join78(lockDir, `.lock-${lockName}`);
+  const lockPath = join79(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -88189,7 +89063,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve49(process.env.SWITCHROOM_WORKTREE_BASE ?? join78(homedir46(), ".switchroom", "worktree-checkouts"));
+  return resolve49(process.env.SWITCHROOM_WORKTREE_BASE ?? join79(homedir46(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes13(4).toString("hex");
@@ -88211,7 +89085,7 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join78(homedir46(), p.slice(2));
+    return join79(homedir46(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
@@ -88239,7 +89113,7 @@ async function claimWorktree(input, codeRepos) {
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
     mkdirSync40(baseDir, { recursive: true });
-    worktreePath = join78(baseDir, `${id}-${taskSuffix}`);
+    worktreePath = join79(baseDir, `${id}-${taskSuffix}`);
     const ambientOwner = process.env.SWITCHROOM_AGENT_NAME;
     const ownerAgent = input.ownerAgent ?? (ambientOwner != null && ambientOwner !== "" ? ambientOwner : undefined);
     const now = new Date().toISOString();
@@ -88470,7 +89344,7 @@ import {
   rmSync as rmSync15
 } from "node:fs";
 import { homedir as homedir47 } from "node:os";
-import { join as join79, resolve as resolve50 } from "node:path";
+import { join as join80, resolve as resolve50 } from "node:path";
 function parseGitdirPointer(dotGitFileContents) {
   const m = /^gitdir:\s*(.+?)\s*$/m.exec(dotGitFileContents);
   return m ? m[1] : null;
@@ -88585,7 +89459,7 @@ function defaultPrSignal(repo, branch, exec) {
   }
 }
 function trashRoot() {
-  return resolve50(process.env.SWITCHROOM_WORKTREE_TRASH ?? join79(homedir47(), ".switchroom", "worktree-gc-trash"));
+  return resolve50(process.env.SWITCHROOM_WORKTREE_TRASH ?? join80(homedir47(), ".switchroom", "worktree-gc-trash"));
 }
 function planGc(roots, deps = {}) {
   const exists = deps.existsSync ?? existsSync81;
@@ -88595,7 +89469,7 @@ function planGc(roots, deps = {}) {
   const exec = deps.exec ?? defaultExec;
   const prSignal = deps.prSignal ?? ((repo, branch) => defaultPrSignal(repo, branch, exec));
   const stamp = deps.dateStamp ?? "undated";
-  const trash = join79(trashRoot(), stamp);
+  const trash = join80(trashRoot(), stamp);
   let claimed;
   try {
     claimed = new Set(listRecords().map((r) => resolve50(r.path)));
@@ -88631,10 +89505,10 @@ function planGc(roots, deps = {}) {
       continue;
     }
     for (const name of entries) {
-      const dir = join79(root, name);
+      const dir = join80(root, name);
       if (isEphemeralPath(dir))
         continue;
-      const dotGit = join79(dir, ".git");
+      const dotGit = join80(dir, ".git");
       if (!exists(dotGit))
         continue;
       let st;
@@ -88663,7 +89537,7 @@ function planGc(roots, deps = {}) {
       ownerRepos.add(repoRoot);
       if (exists(ptr))
         continue;
-      orphans.push({ dir, owner: repoRoot, dest: join79(trash, name) });
+      orphans.push({ dir, owner: repoRoot, dest: join80(trash, name) });
     }
   }
   const registered = [];
@@ -88774,7 +89648,7 @@ function listTrashEntries(nowMs, deps = {}) {
     return [];
   const out = [];
   for (const stamp of readDir(root)) {
-    const stampDir = join79(root, stamp);
+    const stampDir = join80(root, stamp);
     let names;
     try {
       names = readDir(stampDir);
@@ -88782,7 +89656,7 @@ function listTrashEntries(nowMs, deps = {}) {
       continue;
     }
     for (const name of names) {
-      const p = join79(stampDir, name);
+      const p = join80(stampDir, name);
       let mtimeMs = nowMs;
       try {
         mtimeMs = statSync45(p).mtimeMs;
@@ -88806,7 +89680,7 @@ function purgeTrash(paths) {
   return { deleted, errors: errors2 };
 }
 function defaultRoots() {
-  return [join79(homedir47(), "code")];
+  return [join80(homedir47(), "code")];
 }
 
 // src/cli/worktree.ts
@@ -89034,7 +89908,7 @@ import {
   rmSync as rmSync16,
   writeFileSync as writeFileSync24
 } from "node:fs";
-import { join as join80 } from "node:path";
+import { join as join81 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -89224,16 +90098,16 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join80(stateBase, "google-workspace-mcp", "credentials");
+  return join81(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
   mkdirSync42(dir, { recursive: true, mode: 448 });
   chmodSync11(dir, 448);
   for (const name of readdirSync29(dir)) {
-    rmSync16(join80(dir, name), { force: true, recursive: true });
+    rmSync16(join81(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join80(dir, filename);
+  const filePath = join81(dir, filename);
   writeFileSync24(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync11(filePath, 384);
   return filePath;
@@ -89393,7 +90267,7 @@ function registerDriveMcpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn5 } from "node:child_process";
 import { writeFileSync as writeFileSync25, mkdirSync as mkdirSync43 } from "node:fs";
-import { dirname as dirname25, join as join81 } from "node:path";
+import { dirname as dirname25, join as join82 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -89438,7 +90312,7 @@ function heartbeatPath(agentName, account) {
   const override = process.env.SWITCHROOM_M365_HEARTBEAT_DIR;
   if (override) {
     const base = slug ? `m365-launcher-${agentName}-${slug}` : `m365-launcher-${agentName}`;
-    return join81(override, `${base}.heartbeat.json`);
+    return join82(override, `${base}.heartbeat.json`);
   }
   return slug ? `/state/agent/m365-launcher-${slug}.heartbeat.json` : "/state/agent/m365-launcher.heartbeat.json";
 }
@@ -89796,7 +90670,7 @@ function registerNotionMcpLauncherCommand(program3) {
 init_hindsight();
 import { mkdirSync as mkdirSync45, readFileSync as readFileSync70, renameSync as renameSync19, writeFileSync as writeFileSync27 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join82 } from "node:path";
+import { join as join83 } from "node:path";
 import { createInterface as createInterface6 } from "node:readline";
 var SHIM_SUPPORTED_PROTOCOL_VERSIONS = [
   "2025-06-18",
@@ -90019,12 +90893,12 @@ class HindsightShim {
 `));
   }
   get cachePath() {
-    return join82(this.opts.cacheDir, TOOLS_CACHE_FILENAME);
+    return join83(this.opts.cacheDir, TOOLS_CACHE_FILENAME);
   }
   writeCache(result) {
     try {
       mkdirSync45(this.opts.cacheDir, { recursive: true });
-      const tmp = join82(this.opts.cacheDir, `.${TOOLS_CACHE_FILENAME}.${process.pid}.tmp`);
+      const tmp = join83(this.opts.cacheDir, `.${TOOLS_CACHE_FILENAME}.${process.pid}.tmp`);
       writeFileSync27(tmp, JSON.stringify(result, null, 2) + `
 `);
       renameSync19(tmp, this.cachePath);
@@ -90197,7 +91071,7 @@ function resolveShimOptionsFromEnv(env2) {
   return {
     url: env2.HINDSIGHT_MCP_URL || HINDSIGHT_DEFAULT_MCP_URL,
     bankId: env2.HINDSIGHT_BANK_ID || "",
-    cacheDir: env2.HINDSIGHT_SHIM_CACHE_DIR || join82(home2, ".hindsight-shim")
+    cacheDir: env2.HINDSIGHT_SHIM_CACHE_DIR || join83(home2, ".hindsight-shim")
   };
 }
 function registerHindsightMcpShimCommand(program3) {
@@ -90872,7 +91746,7 @@ function runRedactStdin() {
 
 // src/cli/status-ask.ts
 import { readFileSync as readFileSync75, existsSync as existsSync87, readdirSync as readdirSync31 } from "node:fs";
-import { join as join87 } from "node:path";
+import { join as join88 } from "node:path";
 import { homedir as homedir50 } from "node:os";
 
 // src/status-ask/report.ts
@@ -91208,7 +92082,7 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join87(homedir50(), ".switchroom", "agents");
+    agentsDir = join88(homedir50(), ".switchroom", "agents");
   }
   if (!existsSync87(agentsDir))
     return [];
@@ -91220,7 +92094,7 @@ function resolveSources(explicitPath) {
     return [];
   }
   for (const name of entries) {
-    const path9 = join87(agentsDir, name, "runtime-metrics.jsonl");
+    const path9 = join88(agentsDir, name, "runtime-metrics.jsonl");
     if (existsSync87(path9)) {
       sources.push({ path: path9, agent: name });
     }
@@ -91262,21 +92136,21 @@ import {
   unlinkSync as unlinkSync18,
   writeSync as writeSync10
 } from "node:fs";
-import { join as join88, resolve as resolve53 } from "node:path";
+import { join as join89, resolve as resolve53 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
   const base = opts.root ? resolve53(opts.root, agent) : resolve53(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join88(base, "schedule.d");
-  const scheduleStagingDir = join88(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join88(base, "skills.d");
-  const skillsStagingDir = join88(skillsDir, STAGING_SUBDIR);
+  const scheduleDir = join89(base, "schedule.d");
+  const scheduleStagingDir = join89(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join89(base, "skills.d");
+  const skillsStagingDir = join89(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join88(base, ".lock"),
+    lockPath: join89(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
@@ -91330,8 +92204,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join88(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join88(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join89(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join89(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync14(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
@@ -91347,8 +92221,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join88(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join88(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join89(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join89(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync14(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
@@ -91363,7 +92237,7 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join88(paths.skillsDir, `${slug}.yaml`);
+    const finalPath = join89(paths.skillsDir, `${slug}.yaml`);
     if (!existsSync88(finalPath))
       return false;
     unlinkSync18(finalPath);
@@ -91378,7 +92252,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync32(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join88(paths.skillsDir, name);
+    const full = join89(paths.skillsDir, name);
     try {
       const raw = readFileSync76(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -91390,7 +92264,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join88(paths.scheduleDir, `${slug}.yaml`);
+    const finalPath = join89(paths.scheduleDir, `${slug}.yaml`);
     if (!existsSync88(finalPath))
       return false;
     unlinkSync18(finalPath);
@@ -91405,7 +92279,7 @@ function listOverlayEntries(agent, opts = {}) {
   for (const name of readdirSync32(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join88(paths.scheduleDir, name);
+    const full = join89(paths.scheduleDir, name);
     try {
       const raw = readFileSync76(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -91638,12 +92512,12 @@ import {
   writeFileSync as writeFileSync32,
   writeSync as writeSync11
 } from "node:fs";
-import { join as join89 } from "node:path";
+import { join as join90 } from "node:path";
 import { randomBytes as randomBytes15 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join89(paths.scheduleDir, ".pending");
+  return join90(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
@@ -91656,8 +92530,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join89(dir, `${stageId}.yaml`);
-  const metaPath = join89(dir, `${stageId}.meta.json`);
+  const yamlPath = join90(dir, `${stageId}.yaml`);
+  const metaPath = join90(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -91691,8 +92565,8 @@ function listPendingScheduleEntries(agent, opts = {}) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join89(dir, name);
-    const yamlPath = join89(dir, `${stageId}.yaml`);
+    const metaPath = join90(dir, name);
+    const yamlPath = join90(dir, `${stageId}.yaml`);
     if (!existsSync89(yamlPath))
       continue;
     try {
@@ -91711,7 +92585,7 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join89(paths.scheduleDir, `${slug}.yaml`);
+  const finalPath = join90(paths.scheduleDir, `${slug}.yaml`);
   if (existsSync89(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
@@ -92364,7 +93238,7 @@ import { existsSync as existsSync91 } from "node:fs";
 init_reconcile_default_skills();
 init_agent_config();
 var import_yaml23 = __toESM(require_dist(), 1);
-import { join as join90 } from "node:path";
+import { join as join91 } from "node:path";
 var MAX_SKILLS_PER_AGENT = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -92439,7 +93313,7 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join90(poolDir, skillName);
+  const skillPath = join91(poolDir, skillName);
   if (!existsSync91(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
@@ -92618,7 +93492,7 @@ import {
   writeFileSync as writeFileSync33
 } from "node:fs";
 import { tmpdir as tmpdir6, homedir as homedir51 } from "node:os";
-import { dirname as dirname31, join as join91, relative as relative2, resolve as resolve54 } from "node:path";
+import { dirname as dirname31, join as join92, relative as relative2, resolve as resolve54 } from "node:path";
 import { spawnSync as spawnSync16 } from "node:child_process";
 
 // src/cli/skill-common.ts
@@ -92852,7 +93726,7 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join91(homedir51(), raw.slice(2));
+    return join92(homedir51(), raw.slice(2));
   }
   if (raw === "~")
     return homedir51();
@@ -92891,7 +93765,7 @@ function loadFromDir(dir) {
   const walk2 = (sub) => {
     const entries = readdirSync34(sub, { withFileTypes: true });
     for (const ent of entries) {
-      const full = join91(sub, ent.name);
+      const full = join92(sub, ent.name);
       const rel = relative2(abs, full);
       if (ent.isSymbolicLink()) {
         fail3(`refusing to read symlink inside --from dir: ${rel}`);
@@ -92926,7 +93800,7 @@ function loadFromTarball(tarPath) {
       fail3(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
-  const staging = mkdtempSync5(join91(tmpdir6(), "skill-apply-extract-"));
+  const staging = mkdtempSync5(join92(tmpdir6(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
     const r = spawnSync16("tar", [
@@ -93012,8 +93886,8 @@ function validatePayload(name, files) {
           errors2.push(`${path9} fails \`bash -n\` syntax check: ${(r.stderr ?? "").trim()}`);
         }
       } else if (PY_SCRIPT_RE2.test(path9)) {
-        const tmp = mkdtempSync5(join91(tmpdir6(), "skill-apply-py-"));
-        const tmpPy = join91(tmp, "check.py");
+        const tmp = mkdtempSync5(join92(tmpdir6(), "skill-apply-py-"));
+        const tmpPy = join92(tmp, "check.py");
         try {
           writeFileSync33(tmpPy, content);
           const r = spawnSync16("python3", ["-m", "py_compile", tmpPy], {
@@ -93036,7 +93910,7 @@ function diffSummary(currentDir, files) {
   if (existsSync92(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync34(sub, { withFileTypes: true })) {
-        const full = join91(sub, ent.name);
+        const full = join92(sub, ent.name);
         const rel = relative2(currentDir, full);
         if (ent.isDirectory()) {
           walk2(full);
@@ -93072,7 +93946,7 @@ function writePayload(poolDir, name, files) {
   if (!existsSync92(poolDir)) {
     mkdirSync52(poolDir, { recursive: true, mode: 493 });
   }
-  const target = join91(poolDir, name);
+  const target = join92(poolDir, name);
   let targetIsSymlink = false;
   try {
     const st = lstatSync11(target);
@@ -93083,11 +93957,11 @@ function writePayload(poolDir, name, files) {
   if (targetIsSymlink) {
     fail3(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
-  const staging = mkdtempSync5(join91(poolDir, `.skill-apply-stage-${name}-`));
+  const staging = mkdtempSync5(join92(poolDir, `.skill-apply-stage-${name}-`));
   let oldRename = null;
   try {
     for (const [path9, content] of Object.entries(files)) {
-      const full = join91(staging, path9);
+      const full = join92(staging, path9);
       mkdirSync52(dirname31(full), { recursive: true, mode: 493 });
       const fd = openSync16(full, "wx");
       try {
@@ -93165,7 +94039,7 @@ function registerSkillCommand(program3) {
     }
     const config = loadConfig();
     const poolDir = resolveSkillsPoolDir2(config.switchroom?.skills_dir);
-    const currentDir = join91(poolDir, name);
+    const currentDir = join92(poolDir, name);
     console.log(source_default.bold(`Skill: ${name}`) + source_default.gray(` (${Object.keys(files).length} files, ${sumBytes(files)} bytes)`));
     console.log(source_default.bold("Diff vs current pool content:"));
     console.log(diffSummary(currentDir, files));
@@ -93210,7 +94084,7 @@ import {
   utimesSync,
   writeFileSync as writeFileSync34
 } from "node:fs";
-import { dirname as dirname32, join as join92, relative as relative3, resolve as resolve55 } from "node:path";
+import { dirname as dirname32, join as join93, relative as relative3, resolve as resolve55 } from "node:path";
 import { homedir as homedir52, tmpdir as tmpdir7 } from "node:os";
 import { spawnSync as spawnSync17 } from "node:child_process";
 init_helpers();
@@ -93222,10 +94096,10 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve55(override) : join92(homedir52(), ".switchroom-config");
+  const candidate = override ? resolve55(override) : join93(homedir52(), ".switchroom-config");
   if (!existsSync93(candidate))
     return null;
-  return join92(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
+  return join93(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
@@ -93243,7 +94117,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync19(join92(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync19(join93(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -93252,7 +94126,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   const configSkillsRoot = resolveConfigSkillsDir(agent);
   if (!configSkillsRoot)
     return;
-  const dest = join92(configSkillsRoot, name);
+  const dest = join93(configSkillsRoot, name);
   try {
     if (liveSkillDir !== null) {
       try {
@@ -93267,19 +94141,19 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
       if (existsSync93(dest)) {
-        const trash = join92(configSkillsRoot, `.${name}-trash-${Date.now()}`);
+        const trash = join93(configSkillsRoot, `.${name}-trash-${Date.now()}`);
         renameSync24(dest, trash);
       }
       return;
     }
     mkdirSync53(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
-    const staging = mkdtempSync6(join92(configSkillsRoot, `.${name}-staging-`));
+    const staging = mkdtempSync6(join93(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
       mkdirSync53(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync35(src, { withFileTypes: true })) {
-        const s = join92(src, ent.name);
-        const d = join92(dst, ent.name);
+        const s = join93(src, ent.name);
+        const d = join93(dst, ent.name);
         if (ent.isSymbolicLink())
           continue;
         if (ent.isDirectory())
@@ -93291,7 +94165,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     };
     walk2(liveSkillDir, staging);
     if (existsSync93(dest)) {
-      const prior = join92(configSkillsRoot, `.${name}-prior-${Date.now()}`);
+      const prior = join93(configSkillsRoot, `.${name}-prior-${Date.now()}`);
       renameSync24(dest, prior);
     }
     renameSync24(staging, dest);
@@ -93321,16 +94195,16 @@ function resolveAgent(opts) {
 function resolveAgentsRoot(opts) {
   if (opts.root)
     return resolve55(opts.root);
-  return join92(homedir52(), ".switchroom", "agents");
+  return join93(homedir52(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
-  return join92(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
+  return join93(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
 }
 function trashDir(agentsRoot, agent) {
-  return join92(agentsRoot, agent, ".claude", TRASH_DIRNAME);
+  return join93(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
 function countPersonalSkills(agentsRoot, agent) {
-  const skillsDir = join92(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join93(agentsRoot, agent, ".claude", "skills");
   if (!existsSync93(skillsDir))
     return 0;
   let n = 0;
@@ -93368,7 +94242,7 @@ function loadFromDir2(dir) {
   const files = {};
   const walk2 = (sub) => {
     for (const ent of readdirSync35(sub, { withFileTypes: true })) {
-      const full = join92(sub, ent.name);
+      const full = join93(sub, ent.name);
       if (ent.isSymbolicLink()) {
         fail4(`refusing to read symlink in --from dir: ${relative3(abs, full)}`);
       }
@@ -93421,8 +94295,8 @@ function behavioralValidate(files) {
         errors2.push(`${path9} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
     } else if (PY_SCRIPT_RE.test(path9)) {
-      const tmp = mkdtempSync6(join92(tmpdir7(), "skill-personal-py-"));
-      const tmpPy = join92(tmp, "check.py");
+      const tmp = mkdtempSync6(join93(tmpdir7(), "skill-personal-py-"));
+      const tmpPy = join93(tmp, "check.py");
       try {
         writeFileSync34(tmpPy, content);
         const r = spawnSync17("python3", ["-m", "py_compile", tmpPy], {
@@ -93446,7 +94320,7 @@ function sweepTrash(agentsRoot, agent) {
   for (const ent of readdirSync35(trash, { withFileTypes: true })) {
     if (!ent.isDirectory())
       continue;
-    const entPath = join92(trash, ent.name);
+    const entPath = join93(trash, ent.name);
     try {
       const st = statSync50(entPath);
       if (now - st.mtimeMs > TRASH_TTL_MS) {
@@ -93467,11 +94341,11 @@ function writePersonalSkill(targetDir, files) {
     fail4(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
   mkdirSync53(dirname32(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join92(dirname32(targetDir), `.skill-personal-stage-`));
+  const staging = mkdtempSync6(join93(dirname32(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path9, content] of Object.entries(files)) {
-      const full = join92(staging, path9);
+      const full = join93(staging, path9);
       mkdirSync53(dirname32(full), { recursive: true, mode: 493 });
       const fd = openSync17(full, "wx");
       try {
@@ -93618,10 +94492,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join92(homedir52(), ".switchroom", "skills");
+  return join93(homedir52(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join92(homedir52(), ".switchroom", "skills", "_bundled");
+  return join93(homedir52(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -93631,7 +94505,7 @@ function resolveCloneSource(source, opts) {
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
-  const dir = join92(root, slug);
+  const dir = join93(root, slug);
   if (!existsSync93(dir)) {
     fail4(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
@@ -93647,7 +94521,7 @@ function readSourceFiles(dir) {
   const skipped = [];
   const walk2 = (sub) => {
     for (const ent of readdirSync35(sub, { withFileTypes: true })) {
-      const full = join92(sub, ent.name);
+      const full = join93(sub, ent.name);
       if (ent.isSymbolicLink()) {
         continue;
       }
@@ -93758,7 +94632,7 @@ function removePersonalAction(name, opts) {
   const trashRoot2 = trashDir(agentsRoot, agent);
   mkdirSync53(trashRoot2, { recursive: true, mode: 493 });
   const ts = Date.now();
-  const trashTarget = join92(trashRoot2, `${name}-${ts}`);
+  const trashTarget = join93(trashRoot2, `${name}-${ts}`);
   renameSync24(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
@@ -93777,7 +94651,7 @@ function listPersonalAction(opts) {
   const agent = resolveAgent(opts);
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
-  const skillsDir = join92(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join93(agentsRoot, agent, ".claude", "skills");
   const personal = [];
   if (existsSync93(skillsDir)) {
     for (const ent of readdirSync35(skillsDir, { withFileTypes: true })) {
@@ -93786,7 +94660,7 @@ function listPersonalAction(opts) {
       if (!ent.name.startsWith(PERSONAL_PREFIX))
         continue;
       const skillName = ent.name.slice(PERSONAL_PREFIX.length);
-      const skillPath = join92(skillsDir, ent.name);
+      const skillPath = join93(skillsDir, ent.name);
       let fileCount = 0;
       let totalBytes = 0;
       const walk2 = (sub) => {
@@ -93794,10 +94668,10 @@ function listPersonalAction(opts) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync50(join92(sub, e.name)).size;
+              totalBytes += statSync50(join93(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
-            walk2(join92(sub, e.name));
+            walk2(join93(sub, e.name));
           }
         }
       };
@@ -93836,11 +94710,11 @@ function registerSkillPersonalCommands(program3) {
 // src/cli/self-improve-propose-skill.ts
 import { createConnection as createConnection4 } from "node:net";
 import { homedir as homedir53 } from "node:os";
-import { join as join93 } from "node:path";
+import { join as join94 } from "node:path";
 import { readFileSync as readFileSync81 } from "node:fs";
 var IPC_CONNECT_TIMEOUT_MS = 5000;
 function gatewaySocketPath() {
-  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join93(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join93(homedir53(), ".claude", "channels", "telegram", "gateway.sock"));
+  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join94(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join94(homedir53(), ".claude", "channels", "telegram", "gateway.sock"));
 }
 function fail5(msg, code = 1) {
   console.error(msg);
@@ -93914,7 +94788,7 @@ init_helpers();
 var import_yaml25 = __toESM(require_dist(), 1);
 import { existsSync as existsSync94, readdirSync as readdirSync36, readFileSync as readFileSync82, statSync as statSync51 } from "node:fs";
 import { homedir as homedir54 } from "node:os";
-import { join as join94, resolve as resolve56 } from "node:path";
+import { join as join95, resolve as resolve56 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
@@ -93928,7 +94802,7 @@ function defaultBundledRoot2() {
   return resolve56(homedir54(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join94(skillDir, "SKILL.md");
+  const mdPath = join95(skillDir, "SKILL.md");
   if (!existsSync94(mdPath))
     return null;
   let content;
@@ -93961,7 +94835,7 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join94(skillDir, "SKILL.md");
+  const mdPath = join95(skillDir, "SKILL.md");
   try {
     const st = statSync51(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
@@ -93972,7 +94846,7 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join94(agentsRoot, agent, ".claude/skills");
+  const skillsDir = join95(agentsRoot, agent, ".claude/skills");
   if (!existsSync94(skillsDir))
     return [];
   const out = [];
@@ -93985,7 +94859,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join94(skillsDir, ent);
+    const dirPath = join95(skillsDir, ent);
     try {
       if (!statSync51(dirPath).isDirectory())
         continue;
@@ -94025,7 +94899,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join94(sharedRoot, ent);
+    const dirPath = join95(sharedRoot, ent);
     try {
       if (!statSync51(dirPath).isDirectory())
         continue;
@@ -94061,7 +94935,7 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join94(bundledRoot, ent);
+    const dirPath = join95(bundledRoot, ent);
     try {
       if (!statSync51(dirPath).isDirectory())
         continue;
@@ -94218,7 +95092,7 @@ import {
   copyFileSync as copyFileSync13
 } from "node:fs";
 import { homedir as homedir55 } from "node:os";
-import { join as join95 } from "node:path";
+import { join as join96 } from "node:path";
 import { spawnSync as spawnSync20 } from "node:child_process";
 
 // src/cli/singleton-stale-cleanup.ts
@@ -94567,7 +95441,7 @@ function resolveHostdHostHome(env2 = process.env, home2 = homedir55()) {
   return resolved;
 }
 function resolveHostdSkillsTarget(hostHome) {
-  const skillsPath = join95(hostHome, ".switchroom", "skills");
+  const skillsPath = join96(hostHome, ".switchroom", "skills");
   let st;
   try {
     st = lstatSync13(skillsPath);
@@ -94591,10 +95465,10 @@ function resolveHostdSkillsTarget(hostHome) {
   return target;
 }
 function hostdDir() {
-  return join95(homedir55(), ".switchroom", "hostd");
+  return join96(homedir55(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join95(hostdDir(), "docker-compose.yml");
+  return join96(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
@@ -94723,7 +95597,7 @@ function doStatus() {
       for (const name of readdirSync37(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join95(dir, name, "sock");
+        const sockPath = join96(dir, name, "sock");
         if (existsSync96(sockPath)) {
           const st = statSync52(sockPath);
           if ((st.mode & 61440) === 49152) {
@@ -94817,7 +95691,7 @@ init_helpers();
 init_operator_uid();
 import { chownSync as chownSync9, existsSync as existsSync97, mkdirSync as mkdirSync55, writeFileSync as writeFileSync36, copyFileSync as copyFileSync14 } from "node:fs";
 import { homedir as homedir56 } from "node:os";
-import { join as join96 } from "node:path";
+import { join as join97 } from "node:path";
 import { spawnSync as spawnSync21 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
@@ -94917,10 +95791,10 @@ services:
 `;
 }
 function webdDir() {
-  return join96(homedir56(), ".switchroom", "web");
+  return join97(homedir56(), ".switchroom", "web");
 }
 function webdComposePath() {
-  return join96(webdDir(), "docker-compose.yml");
+  return join97(webdDir(), "docker-compose.yml");
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
@@ -95080,9 +95954,9 @@ function registerWebdCommand(program3) {
 // src/cli/host-repair.ts
 init_source();
 import { homedir as homedir57 } from "node:os";
-import { join as join97 } from "node:path";
+import { join as join98 } from "node:path";
 var ARTIFACT_ALLOWLIST = {
-  dockerComposePluginDir: (home2) => join97(home2, ".docker", "cli-plugins", "docker-compose"),
+  dockerComposePluginDir: (home2) => join98(home2, ".docker", "cli-plugins", "docker-compose"),
   stateSentinel: "/state"
 };
 function isStateBogusAutoDir(probe2) {