switchroom 0.19.28 → 0.19.30

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.19.28", COMMIT_SHA = "d9a5f4ae";
+var VERSION = "0.19.30", COMMIT_SHA = "efe8e2a7";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -13571,13 +13571,46 @@ var init_zod = __esm(() => {
   init_external();
 });
 
+// src/memory/observation-scopes.ts
+function isObservationScope(value) {
+  return typeof value === "string" && OBSERVATION_SCOPES.includes(value);
+}
+function observationScopesHint() {
+  return OBSERVATION_SCOPES.join(", ");
+}
+function classifyObservationScope(raw) {
+  if (raw === undefined)
+    return { kind: "unset" };
+  const value = raw.trim();
+  if (!value)
+    return { kind: "unset" };
+  if (!isObservationScope(value))
+    return { kind: "invalid", raw };
+  return { kind: "set", scope: value };
+}
+function resolveObservationScope(configured, env2 = process.env) {
+  if (configured !== undefined)
+    return classifyObservationScope(configured);
+  return classifyObservationScope(env2[OBSERVATION_SCOPES_ENV]);
+}
+var OBSERVATION_SCOPES, OBSERVATION_SCOPES_ENV = "HINDSIGHT_OBSERVATION_SCOPES";
+var init_observation_scopes = __esm(() => {
+  OBSERVATION_SCOPES = [
+    "per_tag",
+    "combined",
+    "all_combinations",
+    "shared"
+  ];
+});
+
 // src/config/schema.ts
 function isValidTimezone(value) {
   return TIMEZONE_REGEX.test(value);
 }
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, DEFAULT_PROFILE = "default", AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, DEFAULT_PROFILE = "default", AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
+  init_observation_scopes();
   CodeRepoEntrySchema = exports_external.object({
     name: exports_external.string().describe("Short alias used when claiming (e.g. 'switchroom')"),
     source: exports_external.string().describe("Absolute or home-relative path to the repo (e.g. ~/code/switchroom)"),
@@ -13689,6 +13722,7 @@ var init_schema = __esm(() => {
     allow: exports_external.array(exports_external.string()).default([]).describe("Allowed tools (use ['all'] for unrestricted)"),
     deny: exports_external.array(exports_external.string()).default([]).describe("Denied tools (overrides allow)")
   }).optional();
+  ObservationScopesSchema = exports_external.enum(OBSERVATION_SCOPES).optional().describe("Per-row observation scope stamped on every memory this agent " + `retains. "shared" makes Hindsight's consolidation write the ` + "resulting observations into ONE global untagged scope instead of a " + "scope per tag \u2014 what several agents pooling one bank need so their " + "observations actually merge rather than sitting in parallel " + "per-tag silos. OMITTED BY DEFAULT: unset means the field never goes " + "on the wire and the engine's own default stands, which is the " + "shipped behaviour. Applies to every retain path (Stop hook, " + "sidechain, boot reconcile, queue drain, backfill, session-handoff " + "mirror) and is carried on the queued payload, so a retain that fails " + "now and drains later still lands in this scope. Accepted values: " + `${OBSERVATION_SCOPES.join(", ")}. ` + "Cascade: override (per-agent wins over default).");
   AgentMemorySchema = exports_external.object({
     collection: exports_external.string().describe("Hindsight collection name for this agent"),
     auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
@@ -13723,6 +13757,7 @@ var init_schema = __esm(() => {
       empathy: exports_external.number().int().min(1).max(5).optional().describe("How much the bank weights emotional/relational context (1-5; engine default 3).")
     }).optional().describe("Personality traits (1-5 each) steering how this bank frames recall, " + "reflect, and observation synthesis \u2014 a coach leans empathy-high, a " + "lawyer/analyst leans skepticism/literalism-high. Maps to the engine's " + "flat `disposition_skepticism`/`_literalism`/`_empathy` fields. " + "Cascade: per-key merge (an agent overrides individual traits and " + "inherits the rest, matching `recall`)."),
     directive_capture_nudge: exports_external.boolean().optional().describe("Deterministic directive-capture nudge (issue #2848 Stage B). When " + "on (switchroom default true \u2014 Stage A measured a ~55% miss rate on " + "durable corrections), the auto-recall hook regex-detects correction " + '/ standing-rule-shaped inbound ("always/never \u2026", "from now on \u2026", ' + `"stop doing \u2026", a stated preference, "that's wrong, it's \u2026") and ` + "appends a terse advisory to the turn's context telling the model to " + "persist the rule with mcp__hindsight__create_directive if it IS " + "durable. Detection is pure regex \u2014 the model does the judgment " + "in-session and calls create_directive itself (no model callsite, no " + "silent hook-side write). Set false to disable per-agent. " + "Cascade: override (per-agent wins over default)."),
+    observation_scopes: ObservationScopesSchema,
     recall: exports_external.object({
       max_memories: exports_external.number().int().min(0).optional().describe("Cap on the number of memories injected into the prompt by " + "auto-recall, regardless of token budget. Plugin default is 12. " + "0 disables the cap (all memories Hindsight returns are injected)."),
       cache_ttl_secs: exports_external.number().int().min(0).optional().describe("Per-session recall cache TTL in seconds. When > 0, identical " + "(prompt, bank) within the same session reuse the cached recall " + "result instead of round-tripping to Hindsight. 0 disables. " + "Default is 600 (10 min) for switchroom-managed agents."),
@@ -13988,7 +14023,7 @@ var init_schema = __esm(() => {
       reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent \u2192 uses global."),
       consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent \u2192 global.")
     }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
-    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_MAX_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS \u2014 switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY \u2014 a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP \u2014 the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS \u2014 only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS \u2014 the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_MAX_SLOTS reserves out of; " + "unset means upstream's own default), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS \u2014 a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED \u2014 a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
+    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_MAX_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS \u2014 switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY \u2014 a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP \u2014 the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS \u2014 only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS \u2014 the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_MAX_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_MAX_SLOTS \u2014 the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS \u2014 a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED \u2014 a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
   });
   MicrosoftWorkspaceConfigSchema = exports_external.object({
     microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL \u2014 omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
@@ -14121,6 +14156,7 @@ var init_schema = __esm(() => {
       file: exports_external.boolean().optional(),
       isolation: exports_external.enum(["default", "strict"]).optional(),
       directive_capture_nudge: exports_external.boolean().optional(),
+      observation_scopes: ObservationScopesSchema,
       recall: exports_external.object({
         max_memories: exports_external.number().int().min(0).optional(),
         cache_ttl_secs: exports_external.number().int().min(0).optional(),
@@ -15922,7 +15958,8 @@ var init_hindsight_perf_defaults = __esm(() => {
     "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY",
     "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP",
     "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS",
-    "HINDSIGHT_API_WORKER_MAX_SLOTS"
+    "HINDSIGHT_API_WORKER_MAX_SLOTS",
+    "HINDSIGHT_API_WORKER_RETAIN_MAX_SLOTS"
   ]);
   HINDSIGHT_PERF_ENV_KEYS = new Set([
     ...[
@@ -28867,6 +28904,7 @@ function buildWorkspaceContext(args) {
     hindsightRecallTypes,
     hindsightRecallSkipTrivial,
     hindsightDirectiveCaptureNudge,
+    hindsightObservationScopes,
     hindsightTopicAliasesJson,
     hindsightSenderBanksJson,
     hindsightTopicFilterMode
@@ -28920,6 +28958,7 @@ function buildWorkspaceContext(args) {
     hindsightRecallTypes,
     hindsightRecallSkipTrivial,
     hindsightDirectiveCaptureNudge,
+    hindsightObservationScopesQ: hindsightObservationScopes ? shellSingleQuote(hindsightObservationScopes) : undefined,
     hindsightTopicAliasesJsonQ: hindsightTopicAliasesJson ? shellSingleQuote(hindsightTopicAliasesJson) : undefined,
     hindsightSenderBanksJsonQ: hindsightSenderBanksJson ? shellSingleQuote(hindsightSenderBanksJson) : undefined,
     hindsightTopicFilterMode,
@@ -29184,6 +29223,7 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
   const hindsightRecallTypes = agentConfig.memory?.recall?.types?.length ? agentConfig.memory.recall.types.join(",") : undefined;
   const hindsightRecallSkipTrivial = agentConfig.memory?.recall?.skip_trivial === undefined ? undefined : String(agentConfig.memory.recall.skip_trivial);
   const hindsightDirectiveCaptureNudge = agentConfig.memory?.directive_capture_nudge === undefined ? undefined : String(agentConfig.memory.directive_capture_nudge);
+  const hindsightObservationScopes = agentConfig.memory?.observation_scopes;
   const topicAliases = agentConfig.channels?.telegram?.topic_aliases;
   const hindsightTopicAliasesJson = topicAliases && Object.keys(topicAliases).length > 0 ? JSON.stringify(topicAliases) : undefined;
   const senderBanks = switchroomConfig ? resolveUsers(switchroomConfig, name).senderBanks : agentConfig.memory?.recall?.sender_banks ?? {};
@@ -29219,6 +29259,7 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
     hindsightRecallTypes,
     hindsightRecallSkipTrivial,
     hindsightDirectiveCaptureNudge,
+    hindsightObservationScopes,
     hindsightTopicAliasesJson,
     hindsightSenderBanksJson,
     hindsightTopicFilterMode
@@ -30163,6 +30204,7 @@ function reconcileAgentInner(name, agentConfigRaw, agentsDir, telegramConfig, sw
   const hindsightRecallTypes = agentConfig.memory?.recall?.types?.length ? agentConfig.memory.recall.types.join(",") : undefined;
   const hindsightRecallSkipTrivial = agentConfig.memory?.recall?.skip_trivial === undefined ? undefined : String(agentConfig.memory.recall.skip_trivial);
   const hindsightDirectiveCaptureNudge = agentConfig.memory?.directive_capture_nudge === undefined ? undefined : String(agentConfig.memory.directive_capture_nudge);
+  const hindsightObservationScopes = agentConfig.memory?.observation_scopes;
   const topicAliases = agentConfig.channels?.telegram?.topic_aliases;
   const hindsightTopicAliasesJson = topicAliases && Object.keys(topicAliases).length > 0 ? JSON.stringify(topicAliases) : undefined;
   const senderBanks = switchroomConfig ? resolveUsers(switchroomConfig, name).senderBanks : agentConfig.memory?.recall?.sender_banks ?? {};
@@ -30211,6 +30253,7 @@ function reconcileAgentInner(name, agentConfigRaw, agentsDir, telegramConfig, sw
       hindsightRecallTypes,
       hindsightRecallSkipTrivial,
       hindsightDirectiveCaptureNudge,
+      hindsightObservationScopesQ: hindsightObservationScopes ? shellSingleQuote(hindsightObservationScopes) : undefined,
       hindsightTopicAliasesJsonQ: hindsightTopicAliasesJson ? shellSingleQuote(hindsightTopicAliasesJson) : undefined,
       hindsightSenderBanksJsonQ: hindsightSenderBanksJson ? shellSingleQuote(hindsightSenderBanksJson) : undefined,
       hindsightTopicFilterMode,
@@ -30633,6 +30676,7 @@ ${body}
       hindsightRecallTypes,
       hindsightRecallSkipTrivial,
       hindsightDirectiveCaptureNudge,
+      hindsightObservationScopes,
       hindsightTopicAliasesJson,
       hindsightSenderBanksJson,
       hindsightTopicFilterMode
@@ -50816,6 +50860,209 @@ var init_doctor_drift = __esm(() => {
   init_write_compose();
 });
 
+// src/cli/component-versions.ts
+function versionFromImageRef(ref) {
+  const at = ref.indexOf("@");
+  const withoutDigest = at >= 0 ? ref.slice(0, at) : ref;
+  const slash = withoutDigest.lastIndexOf("/");
+  const colon = withoutDigest.indexOf(":", slash + 1);
+  if (colon < 0) {
+    return { version: null, detail: `image ref has no tag (${ref})` };
+  }
+  const tag = withoutDigest.slice(colon + 1);
+  if (SEMVER_TAG_RE.test(tag))
+    return { version: tag };
+  return { version: null, detail: `non-semver tag "${tag}"` };
+}
+function isSwitchroomReleaseImage(_name, imageRef) {
+  return /\/switchroom-[a-z0-9-]+(:|@|$)/.test(imageRef);
+}
+function collectContainerComponents(exec) {
+  const r = exec("docker", [
+    "ps",
+    "--filter",
+    "name=switchroom-",
+    "--format",
+    "{{.Names}}\t{{.Image}}"
+  ]);
+  if (r.status !== 0)
+    return [];
+  const out = [];
+  for (const line of r.stdout.split(`
+`)) {
+    const [name, imageRef] = line.trim().split("\t");
+    if (!name || !imageRef)
+      continue;
+    if (!isSwitchroomReleaseImage(name, imageRef))
+      continue;
+    const { version: version2, detail } = versionFromImageRef(imageRef);
+    out.push({
+      name,
+      kind: "container",
+      version: version2,
+      imageRef,
+      ...detail ? { detail } : {}
+    });
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+function normalizeSemverTag(v) {
+  if (!v)
+    return null;
+  const tag = `v${v.trim().replace(/^v/, "")}`;
+  return SEMVER_TAG_RE.test(tag) ? tag : null;
+}
+function resolveDriftTarget(components, releasePin) {
+  const pin = normalizeSemverTag(releasePin);
+  if (pin)
+    return { target: pin, targetSource: "release.pin" };
+  let highest = null;
+  for (const c of components) {
+    if (!c.version)
+      continue;
+    if (highest === null) {
+      highest = c.version;
+      continue;
+    }
+    const cmp = compareReleaseTags(c.version, highest);
+    if (cmp !== null && cmp > 0)
+      highest = c.version;
+  }
+  return highest ? { target: highest, targetSource: "highest-deployed" } : { target: null, targetSource: "none" };
+}
+function detectComponentDrift(components, releasePin) {
+  const { target, targetSource } = resolveDriftTarget(components, releasePin);
+  const report = {
+    target,
+    targetSource,
+    behind: [],
+    ahead: [],
+    current: [],
+    unknown: []
+  };
+  for (const c of components) {
+    if (!c.version || !target) {
+      report.unknown.push(c);
+      continue;
+    }
+    const cmp = compareReleaseTags(c.version, target);
+    if (cmp === null)
+      report.unknown.push(c);
+    else if (cmp < 0)
+      report.behind.push(c);
+    else if (cmp > 0)
+      report.ahead.push(c);
+    else
+      report.current.push(c);
+  }
+  return report;
+}
+function collectComponents(cliVersion, exec) {
+  const cli = {
+    name: "cli (host)",
+    kind: "cli",
+    version: normalizeSemverTag(cliVersion),
+    ...normalizeSemverTag(cliVersion) ? {} : { detail: `unparseable CLI version "${cliVersion}"` }
+  };
+  return [cli, ...collectContainerComponents(exec)];
+}
+function formatComponentDrift(report) {
+  const lines = [];
+  if (!report.target) {
+    lines.push("Component versions: no comparable version found (no release.pin and no semver-tagged component).");
+  } else {
+    const src = report.targetSource === "release.pin" ? "release.pin" : "highest deployed version (no release.pin set)";
+    lines.push(`Component versions \u2014 target ${report.target} (from ${src}):`);
+  }
+  for (const c of report.behind) {
+    lines.push(`  BEHIND   ${c.name} \u2014 ${c.version} (target ${report.target})`);
+  }
+  for (const c of report.ahead) {
+    lines.push(`  ahead    ${c.name} \u2014 ${c.version}`);
+  }
+  for (const c of report.unknown) {
+    lines.push(`  unknown  ${c.name} \u2014 ${c.detail ?? "version not readable"}`);
+  }
+  for (const c of report.current) {
+    lines.push(`  ok       ${c.name} \u2014 ${c.version}`);
+  }
+  return lines.join(`
+`);
+}
+var SEMVER_TAG_RE;
+var init_component_versions = __esm(() => {
+  SEMVER_TAG_RE = /^v\d+\.\d+\.\d+$/;
+});
+
+// src/cli/doctor-component-versions.ts
+import { spawnSync as spawnSync12 } from "node:child_process";
+function fixFor(c, target) {
+  if (c.kind === "cli") {
+    return `switchroom update  (self-updates the host CLI to ${target} first, then everything else)`;
+  }
+  if (c.name === "switchroom-web") {
+    return `switchroom webd install --tag ${target}  (run host-side: webd install fails inside hostd when the hostd compose predates SWITCHROOM_HOSTD_OPERATOR_UID)`;
+  }
+  if (c.name === "switchroom-hindsight-autoheal" || c.name === "switchroom-hostd") {
+    return `switchroom hostd install --tag ${target}  (regenerates the hostd compose project \u2014 both hostd and the autoheal sidecar)`;
+  }
+  return `switchroom update`;
+}
+function runComponentVersionChecks(config, opts = {}) {
+  const exec = opts.exec ?? defaultExec2;
+  const components = collectComponents(opts.cliVersion ?? SWITCHROOM_VERSION, exec);
+  const report = detectComponentDrift(components, config.release?.pin);
+  if (!report.target) {
+    return [
+      {
+        name: "component versions",
+        status: "skip",
+        detail: "no release.pin set and no semver-tagged switchroom container running \u2014 nothing to compare."
+      }
+    ];
+  }
+  const results = [];
+  const src = report.targetSource === "release.pin" ? `release.pin ${report.target}` : `${report.target} (highest deployed \u2014 no release.pin set)`;
+  if (report.behind.length === 0) {
+    results.push({
+      name: "component versions",
+      status: "ok",
+      detail: `all ${report.current.length} comparable component(s) on ${src}`
+    });
+  }
+  for (const c of report.behind) {
+    results.push({
+      name: `component behind: ${c.name}`,
+      status: "warn",
+      detail: `on ${c.version}, expected ${report.target} (${src})`,
+      fix: fixFor(c, report.target)
+    });
+  }
+  for (const c of report.ahead) {
+    results.push({
+      name: `component ahead: ${c.name}`,
+      status: "warn",
+      detail: `on ${c.version}, ahead of ${src} \u2014 a roll may be mid-flight, or release.pin is stale`
+    });
+  }
+  for (const c of report.unknown) {
+    results.push({
+      name: `component version unknown: ${c.name}`,
+      status: "skip",
+      detail: c.detail ?? "version not readable"
+    });
+  }
+  return results;
+}
+var defaultExec2 = (cmd, args) => {
+  const r = spawnSync12(cmd, args, { encoding: "utf-8", timeout: 1e4 });
+  return { status: r.status ?? 1, stdout: r.stdout ?? "" };
+};
+var init_doctor_component_versions = __esm(() => {
+  init_resolve_version();
+  init_component_versions();
+});
+
 // src/cli/doctor-scaffold-wiring.ts
 import { join as join70, resolve as resolve43 } from "node:path";
 function readJson2(d, path7) {
@@ -52570,7 +52817,7 @@ var init_doctor_fix_session_model = __esm(() => {
 });
 
 // src/cli/doctor-claude-cli.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
+import { spawnSync as spawnSync13 } from "node:child_process";
 import { existsSync as existsSync76, readFileSync as readFileSync70 } from "node:fs";
 import { dirname as dirname30, join as join80 } from "node:path";
 function parseClaudeCliVersion(raw) {
@@ -52635,7 +52882,7 @@ function parseClaudeCliProbeOutput(r) {
   return { state: "read", bin, raw };
 }
 function probeAgentClaudeCli(agentName) {
-  const r = spawnSync12("docker", ["exec", `switchroom-${agentName}`, "sh", "-c", buildClaudeCliProbeScript()], { stdio: "pipe", timeout: 3000 });
+  const r = spawnSync13("docker", ["exec", `switchroom-${agentName}`, "sh", "-c", buildClaudeCliProbeScript()], { stdio: "pipe", timeout: 3000 });
   return parseClaudeCliProbeOutput(r);
 }
 function assessClaudeCliFloor(input) {
@@ -52758,7 +53005,7 @@ __export(exports_doctor, {
   PENDING_RETAINS_EVICTION_WINDOW_DAYS: () => PENDING_RETAINS_EVICTION_WINDOW_DAYS,
   MFF_VAULT_KEY: () => MFF_VAULT_KEY
 });
-import { spawnSync as spawnSync13 } from "node:child_process";
+import { spawnSync as spawnSync14 } from "node:child_process";
 import { Socket as Socket3 } from "node:net";
 import {
   accessSync as accessSync3,
@@ -52904,7 +53151,7 @@ function readVersion(bin, parser) {
   const path7 = which(bin);
   if (!path7)
     return null;
-  const proc = spawnSync13(path7, ["--version"], {
+  const proc = spawnSync14(path7, ["--version"], {
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (proc.error || proc.status !== 0)
@@ -53196,7 +53443,7 @@ function probeVaultBrokerSocketPair(agentName) {
   const dataPath = `/run/switchroom/broker/${agentName}/sock`;
   const unlockPath = `/run/switchroom/broker/${agentName}/unlock`;
   const script = `D=0; U=0; ` + `test -S '${dataPath}' && D=1; ` + `test -S '${unlockPath}' && U=1; ` + `echo "D=$D U=$U"`;
-  const r = spawnSync13("docker", ["exec", "switchroom-vault-broker", "sh", "-c", script], { stdio: "pipe", timeout: 3000 });
+  const r = spawnSync14("docker", ["exec", "switchroom-vault-broker", "sh", "-c", script], { stdio: "pipe", timeout: 3000 });
   if (r.error || r.status === null)
     return "unreachable";
   if (r.status !== 0) {
@@ -53446,7 +53693,7 @@ function checkHindsightConsumer(config, opts) {
 }
 function probeAuthBrokerSocket(consumerName) {
   const containerPath = `/run/switchroom/auth-broker/${consumerName}/sock`;
-  const r = spawnSync13("docker", ["exec", "switchroom-auth-broker", "test", "-S", containerPath], { stdio: "pipe", timeout: 3000 });
+  const r = spawnSync14("docker", ["exec", "switchroom-auth-broker", "test", "-S", containerPath], { stdio: "pipe", timeout: 3000 });
   if (r.error || r.status === null)
     return "unreachable";
   if (r.status === 0)
@@ -53697,7 +53944,7 @@ async function checkHindsight(config) {
 function probePendingRetainsQueue(agentName) {
   const base = "/state/agent/home/.hindsight";
   const script = buildPendingRetainsProbeScript(base);
-  const r = spawnSync13("docker", ["exec", `switchroom-${agentName}`, "sh", "-c", script], { stdio: "pipe", timeout: 3000 });
+  const r = spawnSync14("docker", ["exec", `switchroom-${agentName}`, "sh", "-c", script], { stdio: "pipe", timeout: 3000 });
   return parsePendingRetainsProbeOutput(r);
 }
 function buildPendingRetainsProbeScript(base, now = Date.now()) {
@@ -54564,7 +54811,7 @@ async function checkMffAuthFlow(envPath = mffEnvPath(), timeoutMs = 8000) {
   const python3 = which("python3") ?? "python3";
   let token;
   try {
-    const result = spawnSync13(python3, [authScript, "--quiet"], {
+    const result = spawnSync14(python3, [authScript, "--quiet"], {
       timeout: timeoutMs,
       encoding: "utf-8",
       env: { ...process.env, ...env2 }
@@ -54993,6 +55240,22 @@ function registerDoctorCommand(program3) {
         })
       },
       { title: "Cron Session", results: runCronSessionChecks(config) },
+      {
+        title: "Component versions (#3919)",
+        results: (() => {
+          try {
+            return runComponentVersionChecks(config);
+          } catch (err) {
+            return [
+              {
+                name: "component versions",
+                status: "skip",
+                detail: `not checkable: ${err?.message ?? String(err)}`
+              }
+            ];
+          }
+        })()
+      },
       {
         title: "Generated-surface drift (KEN-130)",
         results: await runGeneratedSurfaceDriftChecks(config, configPath, {
@@ -55080,6 +55343,7 @@ var init_doctor = __esm(() => {
   init_doctor_cron_session();
   init_doctor_flood_pressure();
   init_doctor_drift();
+  init_doctor_component_versions();
   init_doctor_microsoft();
   init_doctor_notion();
   init_doctor_credentials_migration();
@@ -68028,9 +68292,9 @@ __export(exports_server, {
   dispatchTool: () => dispatchTool,
   TOOLS: () => TOOLS
 });
-import { spawnSync as spawnSync20 } from "node:child_process";
+import { spawnSync as spawnSync22 } from "node:child_process";
 function execCli(args, stdin) {
-  const r = spawnSync20(CLI_BIN, args, {
+  const r = spawnSync22(CLI_BIN, args, {
     encoding: "utf-8",
     env: process.env,
     timeout: 15000,
@@ -68539,7 +68803,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes16 } from "node:crypto";
-import { existsSync as existsSync104 } from "node:fs";
+import { existsSync as existsSync105 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -68566,7 +68830,7 @@ async function dispatchTool2(name, args) {
     return errorText2("hostd MCP: SWITCHROOM_AGENT_NAME env var is not set \u2014 cannot " + "determine which per-agent socket to talk to.");
   }
   const sockPath = selfSocketPath();
-  if (!existsSync104(sockPath)) {
+  if (!existsSync105(sockPath)) {
     return errorText2(`hostd MCP: socket not bound at ${sockPath}. The host-control ` + `daemon is either not installed (run \`switchroom hostd install\`) ` + `or this agent isn't admin-flagged in switchroom.yaml. RFC C ` + `bind-mounts the per-agent socket only when host_control.enabled ` + `is true AND the agent has admin: true.`);
   }
   let req;
@@ -68817,13 +69081,13 @@ function resolveAuditLogPath() {
   if (process.env.HOSTD_AUDIT_LOG_PATH)
     return process.env.HOSTD_AUDIT_LOG_PATH;
   const bindMounted = "/host-home/.switchroom/host-control-audit.log";
-  if (existsSync104(bindMounted))
+  if (existsSync105(bindMounted))
     return bindMounted;
   return defaultAuditLogPath2();
 }
 function getLastUpdateApplyStatus() {
   const path10 = resolveAuditLogPath();
-  if (!existsSync104(path10)) {
+  if (!existsSync105(path10)) {
     return errorText2(`get_status: audit log not found at ${path10}. No update_apply has run yet?`);
   }
   let raw;
@@ -69542,11 +69806,11 @@ var init_test_agents = __esm(() => {
 });
 
 // src/litellm/header-passthrough-guard.ts
-import { existsSync as existsSync107, readdirSync as readdirSync41 } from "node:fs";
+import { existsSync as existsSync108, readdirSync as readdirSync41 } from "node:fs";
 function discoverLiveLitellmConfigPath(opts) {
   const servicesDir = opts?.servicesDir ?? COOLIFY_SERVICES_DIR;
   const readdir2 = opts?.readdirFn ?? ((p) => readdirSync41(p));
-  const exists = opts?.existsFn ?? existsSync107;
+  const exists = opts?.existsFn ?? existsSync108;
   let entries;
   try {
     entries = readdir2(servicesDir);
@@ -69636,7 +69900,7 @@ var init_header_passthrough_guard = __esm(() => {
 });
 
 // src/fleet-health/litellm-config-sensor.ts
-import { readFileSync as readFileSync96, existsSync as existsSync108 } from "node:fs";
+import { readFileSync as readFileSync96, existsSync as existsSync109 } from "node:fs";
 function resolveLitellmConfigPath(explicit, discoverFn = () => discoverLiveLitellmConfigPath()) {
   if (explicit)
     return explicit;
@@ -69647,7 +69911,7 @@ function resolveLitellmConfigPath(explicit, discoverFn = () => discoverLiveLitel
 }
 function scanLitellmConfig(opts = {}) {
   const path10 = resolveLitellmConfigPath(opts.path, opts.discoverFn);
-  const exists = opts.existsFn ?? existsSync108;
+  const exists = opts.existsFn ?? existsSync109;
   const read = opts.readFn ?? ((p) => readFileSync96(p, "utf-8"));
   const log = opts.log ?? (() => {});
   const nowIso = opts.nowIso ?? new Date().toISOString();
@@ -69725,18 +69989,18 @@ __export(exports_scan, {
 import {
   readFileSync as readFileSync97,
   readdirSync as readdirSync42,
-  existsSync as existsSync109,
-  mkdirSync as mkdirSync62,
+  existsSync as existsSync110,
+  mkdirSync as mkdirSync63,
   writeFileSync as writeFileSync46
 } from "node:fs";
-import { resolve as resolve61, dirname as dirname41 } from "node:path";
+import { resolve as resolve61, dirname as dirname42 } from "node:path";
 import { homedir as homedir60 } from "node:os";
 function resolveSwitchroomBase(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir60()) {
   return resolve61(home2, ".switchroom");
 }
 function listAgents(base) {
   const dir = resolve61(base, "agents");
-  if (!existsSync109(dir))
+  if (!existsSync110(dir))
     return [];
   try {
     return readdirSync42(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
@@ -69765,7 +70029,7 @@ function runScan(opts = {}) {
     let gwText = "";
     let sawArtifact = false;
     try {
-      if (existsSync109(turnsPath)) {
+      if (existsSync110(turnsPath)) {
         turnsText = readFileSync97(turnsPath, "utf-8");
         sawArtifact = true;
       }
@@ -69773,7 +70037,7 @@ function runScan(opts = {}) {
       log(`fleet-health: WARN skipping ${agent} turns.jsonl unreadable: ${String(e)}`);
     }
     try {
-      if (existsSync109(gwPath)) {
+      if (existsSync110(gwPath)) {
         gwText = readFileSync97(gwPath, "utf-8");
         sawArtifact = true;
       }
@@ -69816,7 +70080,7 @@ function runScan(opts = {}) {
 function readLedgerIfPresent(base) {
   const path10 = ledgerPathForBase(base);
   try {
-    if (!existsSync109(path10))
+    if (!existsSync110(path10))
       return null;
     return JSON.parse(readFileSync97(path10, "utf-8"));
   } catch {
@@ -69824,11 +70088,11 @@ function readLedgerIfPresent(base) {
   }
 }
 function ledgerPathForBase(base) {
-  return fleetHealthLedgerPath(dirname41(base));
+  return fleetHealthLedgerPath(dirname42(base));
 }
 function writeLedger(base, ledger) {
   const path10 = ledgerPathForBase(base);
-  mkdirSync62(dirname41(path10), { recursive: true });
+  mkdirSync63(dirname42(path10), { recursive: true });
   writeFileSync46(path10, JSON.stringify(ledger, null, 2) + `
 `, "utf-8");
   return path10;
@@ -70195,8 +70459,10 @@ import { join as join19 } from "node:path";
 import { execFileSync as execFileSync11 } from "node:child_process";
 
 // src/agents/handoff-summarizer.ts
+init_observation_scopes();
 import { readFileSync as readFileSync19, writeFileSync as writeFileSync9, renameSync as renameSync7, mkdirSync as mkdirSync16, existsSync as existsSync23, statSync as statSync11, readdirSync as readdirSync10 } from "node:fs";
 import { join as join18 } from "node:path";
+var HANDOFF_STATUS_MIRROR_SKIPPED = "mirror-skipped-invalid-scope";
 var DEFAULT_MAX_TURNS = 50;
 var TOPIC_MAX_CHARS = 117;
 var TURN_TEXT_MAX_CHARS = 1200;
@@ -70355,8 +70621,8 @@ async function buildHandoff(opts) {
 `);
     return "write-error";
   }
-  await mirrorToHindsight(briefing, opts).catch(() => {});
-  return "ok";
+  const mirrored = await mirrorToHindsight(briefing, opts).catch(() => true);
+  return mirrored ? "ok" : HANDOFF_STATUS_MIRROR_SKIPPED;
 }
 function errMsg(err) {
   if (err && typeof err === "object" && "message" in err) {
@@ -70368,15 +70634,22 @@ async function mirrorToHindsight(briefing, opts) {
   const url = opts.hindsightUrl ?? process.env.HINDSIGHT_API_URL;
   const bankId = opts.hindsightBankId ?? process.env.HINDSIGHT_BANK_ID ?? "default";
   if (!url)
-    return;
+    return true;
   const fetchFn = opts.fetch ?? fetch;
   const endpoint = `${url.replace(/\/$/, "")}/v1/default/banks/${encodeURIComponent(bankId)}/memories`;
+  const scope = resolveObservationScope(opts.observationScopes, opts.env ?? process.env);
+  if (scope.kind === "invalid") {
+    process.stderr.write(`handoff: hindsight mirror SKIPPED \u2014 observation scope ` + `${JSON.stringify(scope.raw)} is not valid ` + `(accepted: ${observationScopesHint()}). Fix ` + `memory.observation_scopes in switchroom.yaml (or the ` + `${OBSERVATION_SCOPES_ENV} export), then \`switchroom apply\` and ` + `restart the agent. The on-disk handoff sidecars were written ` + `normally; only the recallable Hindsight copy was skipped.
+`);
+    return false;
+  }
   const body = {
     items: [
       {
         content: briefing,
         document_id: "session_handoff",
-        tags: ["session_handoff", opts.agentName]
+        tags: ["session_handoff", opts.agentName],
+        ...scope.kind === "set" ? { observation_scopes: scope.scope } : {}
       }
     ],
     async: true
@@ -70391,6 +70664,7 @@ async function mirrorToHindsight(briefing, opts) {
     process.stderr.write(`handoff: hindsight mirror failed \u2014 ${errMsg(err)}
 `);
   }
+  return true;
 }
 function findLatestSessionJsonl(claudeConfigDir) {
   const projects = join18(claudeConfigDir, "projects");
@@ -90529,9 +90803,9 @@ init_source();
 init_loader();
 init_lifecycle();
 init_compose_env();
-import { existsSync as existsSync79, mkdirSync as mkdirSync44, readFileSync as readFileSync73, realpathSync as realpathSync6, statSync as statSync45, chownSync as chownSync8 } from "node:fs";
-import { spawnSync as spawnSync14 } from "node:child_process";
-import { join as join83, dirname as dirname32, resolve as resolve45 } from "node:path";
+import { existsSync as existsSync80, mkdirSync as mkdirSync45, readFileSync as readFileSync73, realpathSync as realpathSync6, statSync as statSync45, chownSync as chownSync8 } from "node:fs";
+import { spawnSync as spawnSync16 } from "node:child_process";
+import { join as join83, dirname as dirname33, resolve as resolve45 } from "node:path";
 import { homedir as homedir43 } from "node:os";
 
 // src/cli/release-yaml.ts
@@ -90779,6 +91053,286 @@ function syncBundledSkills(opts) {
 
 // src/cli/update.ts
 init_resolve_version();
+
+// src/cli/self-update.ts
+var SELF_UPDATE_ENV_SENTINEL = "SWITCHROOM_SELF_UPDATED";
+var VERSION_STORE_DIRNAME = ".switchroom-versions";
+var GITHUB_LATEST_RELEASE_URL = "https://api.github.com/repos/switchroom/switchroom/releases/latest";
+function detectInstallKind(p) {
+  if (p.inContainer) {
+    return {
+      kind: "container",
+      reason: "running inside a switchroom container \u2014 the CLI here comes from the " + "container image and is updated by pulling a new image, not by " + "replacing a file. Nothing to self-update."
+    };
+  }
+  if (p.bundleDir.startsWith("/$bunfs")) {
+    if (!p.execPath) {
+      return {
+        kind: "unknown",
+        reason: "compiled binary but process.execPath is empty \u2014 cannot locate the " + "file to replace. Re-run install.sh to upgrade."
+      };
+    }
+    return {
+      kind: "static-binary",
+      binaryPath: p.execPath,
+      reason: `published static binary at ${p.execPath}`
+    };
+  }
+  if (/[/\\]node_modules[/\\]switchroom[/\\]/.test(p.scriptPath)) {
+    return {
+      kind: "npm-global",
+      reason: "installed via npm \u2014 self-update does not manage npm installs. " + "Upgrade with `npm i -g switchroom@latest`."
+    };
+  }
+  if (isSwitchroomSourceCheckoutPath(p.scriptPath)) {
+    return {
+      kind: "source-checkout",
+      reason: "running from a switchroom source checkout \u2014 self-update would clobber " + "your working tree. Upgrade with `git pull && bun install && npm run build`."
+    };
+  }
+  return {
+    kind: "unknown",
+    reason: `could not identify how switchroom was installed (running from ` + `"${p.scriptPath}"). Not touching it. Upgrade with the method you used ` + `to install, or re-run install.sh.`
+  };
+}
+function isSwitchroomSourceCheckoutPath(scriptPath) {
+  return /[/\\](src|dist)[/\\]cli[/\\]switchroom(\.js|\.ts)?$/.test(scriptPath);
+}
+function releaseAssetName(platform, arch) {
+  const os6 = platform === "linux" ? "linux" : platform === "darwin" ? "macos" : null;
+  const cpu = arch === "x64" ? "amd64" : arch === "arm64" ? "arm64" : null;
+  if (!os6 || !cpu)
+    return null;
+  return `switchroom-${os6}-${cpu}`;
+}
+function parseLatestReleaseTag(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed?.draft === true)
+      return null;
+    const tag = parsed?.tag_name;
+    if (typeof tag !== "string" || !/^v\d+\.\d+\.\d+$/.test(tag))
+      return null;
+    return tag;
+  } catch {
+    return null;
+  }
+}
+function expectedChecksum(checksumsText, asset) {
+  for (const line of checksumsText.split(`
+`)) {
+    const idx = line.indexOf(`  ${asset}`);
+    if (idx <= 0)
+      continue;
+    if (line.slice(idx + 2).trim() !== asset)
+      continue;
+    const hash2 = line.slice(0, idx).trim();
+    if (/^[0-9a-f]{64}$/i.test(hash2))
+      return hash2.toLowerCase();
+  }
+  return null;
+}
+function planSelfUpdate(opts) {
+  const { detection, currentVersion, latestTag } = opts;
+  if (detection.kind !== "static-binary" || !detection.binaryPath) {
+    return { action: "skip", reason: detection.reason };
+  }
+  if (!latestTag) {
+    return {
+      action: "skip",
+      reason: "could not resolve the latest published release from GitHub " + "(offline, rate-limited, or the API changed shape) \u2014 leaving the CLI as-is."
+    };
+  }
+  const current = `v${currentVersion.trim().replace(/^v/, "")}`;
+  const cmp = compareReleaseTags(current, latestTag);
+  if (cmp === null) {
+    return {
+      action: "skip",
+      reason: `local CLI version "${currentVersion}" is not a comparable semver \u2014 ` + `refusing to guess whether ${latestTag} is an upgrade.`
+    };
+  }
+  if (cmp >= 0)
+    return { action: "current", version: current };
+  return {
+    action: "update",
+    from: current,
+    to: latestTag,
+    binaryPath: detection.binaryPath
+  };
+}
+function versionStorePath(installDir, version2, sep4 = "/") {
+  return `${installDir}${sep4}${VERSION_STORE_DIRNAME}${sep4}switchroom-${version2.replace(/^v/, "")}`;
+}
+function rollbackHint(installDir, previousVersion) {
+  return `Rollback: cp ${versionStorePath(installDir, previousVersion)} ` + `${installDir}/switchroom`;
+}
+function alreadySelfUpdated(env2) {
+  return env2[SELF_UPDATE_ENV_SENTINEL] === "1";
+}
+async function fetchLatestReleaseTag(io) {
+  try {
+    return parseLatestReleaseTag(await io.httpGetText(GITHUB_LATEST_RELEASE_URL));
+  } catch {
+    return null;
+  }
+}
+async function performSelfUpdate(opts) {
+  const { plan, assetName, io } = opts;
+  const log = opts.log ?? (() => {});
+  const installDir = io.dirname(plan.binaryPath);
+  const store = `${installDir}/${VERSION_STORE_DIRNAME}`;
+  const base = `https://github.com/switchroom/switchroom/releases/download/${plan.to}`;
+  const staged = versionStorePath(installDir, plan.to);
+  const tmp = `${staged}.download`;
+  io.mkdirp(store);
+  io.remove(tmp);
+  log(`downloading ${assetName} ${plan.to}`);
+  try {
+    await io.httpDownload(`${base}/${assetName}`, tmp);
+  } catch (err) {
+    io.remove(tmp);
+    throw new Error(`self-update: download of ${base}/${assetName} failed (${err.message}). ` + `The installed CLI is unchanged.`);
+  }
+  let checksums;
+  try {
+    checksums = await io.httpGetText(`${base}/switchroom-checksums.txt`);
+  } catch (err) {
+    io.remove(tmp);
+    throw new Error(`self-update: could not fetch switchroom-checksums.txt for ${plan.to} ` + `(${err.message}) \u2014 refusing to install an unverified binary. ` + `The installed CLI is unchanged.`);
+  }
+  const expected = expectedChecksum(checksums, assetName);
+  if (!expected) {
+    io.remove(tmp);
+    throw new Error(`self-update: release ${plan.to} has no checksum entry for ${assetName} \u2014 ` + `refusing to install an unverified binary. The installed CLI is unchanged.`);
+  }
+  const actual = io.sha256File(tmp).toLowerCase();
+  if (actual !== expected) {
+    io.remove(tmp);
+    throw new Error(`self-update: SHA256 mismatch for ${assetName} (expected ${expected}, got ${actual}) \u2014 ` + `refusing to install. The installed CLI is unchanged.`);
+  }
+  io.chmodExec(tmp);
+  const proved = io.probeBinaryVersion(tmp);
+  if (!proved) {
+    io.remove(tmp);
+    throw new Error(`self-update: the downloaded ${plan.to} binary did not run cleanly on this host ` + `(\`switchroom version\` failed) \u2014 refusing to install it. The installed CLI is unchanged.`);
+  }
+  const previousArchive = versionStorePath(installDir, plan.from);
+  try {
+    if (!io.exists(previousArchive))
+      io.copyFile(plan.binaryPath, previousArchive);
+  } catch (err) {
+    io.remove(tmp);
+    throw new Error(`self-update: could not archive the current binary to ${previousArchive} ` + `(${err.message}) \u2014 refusing to swap without a rollback copy. ` + `The installed CLI is unchanged.`);
+  }
+  io.rename(tmp, staged);
+  io.copyFile(staged, `${plan.binaryPath}.new`);
+  io.chmodExec(`${plan.binaryPath}.new`);
+  io.rename(`${plan.binaryPath}.new`, plan.binaryPath);
+  log(rollbackHint(installDir, plan.from));
+  return {
+    replaced: true,
+    newVersion: plan.to,
+    binaryPath: plan.binaryPath,
+    message: `host CLI ${plan.from} \u2192 ${plan.to} (verified sha256, ran clean). ` + rollbackHint(installDir, plan.from)
+  };
+}
+
+// src/cli/self-update-io.ts
+import { createHash as createHash16 } from "node:crypto";
+import {
+  chmodSync as chmodSync15,
+  closeSync as closeSync15,
+  copyFileSync as copyFileSync11,
+  createWriteStream,
+  existsSync as existsSync79,
+  mkdirSync as mkdirSync44,
+  openSync as openSync15,
+  readSync as readSync5,
+  renameSync as renameSync19,
+  rmSync as rmSync14
+} from "node:fs";
+import { dirname as dirname32 } from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { spawnSync as spawnSync15 } from "node:child_process";
+var HTTP_TIMEOUT_MS = 60000;
+function defaultSelfUpdateIO() {
+  return {
+    async httpGetText(url) {
+      const res = await fetch(url, {
+        headers: { "user-agent": "switchroom-cli-self-update" },
+        signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+      });
+      if (!res.ok)
+        throw new Error(`HTTP ${res.status} for ${url}`);
+      return await res.text();
+    },
+    async httpDownload(url, dest) {
+      const res = await fetch(url, {
+        headers: { "user-agent": "switchroom-cli-self-update" },
+        redirect: "follow",
+        signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+      });
+      if (!res.ok)
+        throw new Error(`HTTP ${res.status} for ${url}`);
+      if (!res.body)
+        throw new Error(`empty response body for ${url}`);
+      await pipeline(Readable.fromWeb(res.body), createWriteStream(dest));
+    },
+    sha256File(path7) {
+      const hash2 = createHash16("sha256");
+      const fd = openSync15(path7, "r");
+      try {
+        const buf = Buffer.allocUnsafe(1 << 20);
+        for (;; ) {
+          const n = readSync5(fd, buf, 0, buf.length, null);
+          if (n <= 0)
+            break;
+          hash2.update(buf.subarray(0, n));
+        }
+      } finally {
+        closeSync15(fd);
+      }
+      return hash2.digest("hex");
+    },
+    probeBinaryVersion(path7) {
+      const r = spawnSync15(path7, ["version"], {
+        encoding: "utf-8",
+        timeout: 30000,
+        env: { ...process.env, SWITCHROOM_SELF_UPDATED: "" }
+      });
+      if (r.status !== 0)
+        return null;
+      const out = `${r.stdout ?? ""}`.trim();
+      const m = out.match(/\d+\.\d+\.\d+/);
+      return m ? m[0] : null;
+    },
+    mkdirp(dir) {
+      mkdirSync44(dir, { recursive: true });
+    },
+    copyFile(src, dest) {
+      copyFileSync11(src, dest);
+    },
+    chmodExec(path7) {
+      chmodSync15(path7, 493);
+    },
+    rename(src, dest) {
+      renameSync19(src, dest);
+    },
+    remove(path7) {
+      rmSync14(path7, { force: true });
+    },
+    exists(path7) {
+      return existsSync79(path7);
+    },
+    dirname(path7) {
+      return dirname32(path7);
+    }
+  };
+}
+
+// src/cli/update.ts
+init_component_versions();
 function defaultPersistPin(configPath) {
   return (pin) => {
     const path7 = configPath ?? findConfigFile();
@@ -90798,16 +91352,16 @@ function defaultPersistPin(configPath) {
 }
 var DEFAULT_COMPOSE_PATH2 = join83(homedir43(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
-  let dir = dirname32(scriptPath);
+  let dir = dirname33(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync79(join83(dir, ".git"))) {
+    if (existsSync80(join83(dir, ".git"))) {
       try {
         const pkg = JSON.parse(readFileSync73(join83(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
     }
-    const parent = dirname32(dir);
+    const parent = dirname33(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -90852,6 +91406,61 @@ function planUpdate(opts) {
   const scriptPath = opts.scriptPath ?? process.argv[1] ?? "";
   const steps = [];
   const hostdContext = typeof opts.hostdContext === "boolean" ? opts.hostdContext : isHostdContext();
+  steps.push({
+    name: "self-update-cli",
+    description: "Replace the host operator CLI binary with the latest published release (checksum-verified, run-proved, atomic swap + versioned rollback copy), then re-exec the new binary for the remaining steps",
+    skipReason: opts.skipSelfUpdate ? "--skip-self-update flag set" : alreadySelfUpdated(process.env) ? "already re-exec'd from a freshly installed binary in this run" : undefined,
+    run: async () => {
+      const say = opts.stdout ?? ((t) => process.stdout.write(t));
+      const io = opts.selfUpdateIO ?? defaultSelfUpdateIO();
+      const detection = detectInstallKind(opts.installProbe ?? {
+        bundleDir: import.meta.dirname,
+        execPath: process.execPath,
+        scriptPath,
+        inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync80("/.dockerenv")
+      });
+      if (detection.kind !== "static-binary") {
+        say(source_default.gray(`  host CLI not self-updated: ${detection.reason}
+`));
+        return;
+      }
+      const latestTag = opts.latestReleaseTagFn ? await opts.latestReleaseTagFn() : await fetchLatestReleaseTag(io);
+      const plan = planSelfUpdate({
+        detection,
+        currentVersion: SWITCHROOM_VERSION,
+        latestTag
+      });
+      if (plan.action === "skip") {
+        say(source_default.gray(`  host CLI not self-updated: ${plan.reason}
+`));
+        return;
+      }
+      if (plan.action === "current") {
+        say(source_default.gray(`  host CLI already on ${plan.version}
+`));
+        return;
+      }
+      const asset = releaseAssetName(process.platform, process.arch);
+      if (!asset) {
+        say(source_default.gray(`  host CLI not self-updated: no published binary for ${process.platform}/${process.arch}
+`));
+        return;
+      }
+      const result = await performSelfUpdate({
+        plan,
+        assetName: asset,
+        io,
+        log: (s) => say(source_default.gray(`  ${s}
+`))
+      });
+      if (result.replaced && opts.selfUpdateSink) {
+        opts.selfUpdateSink.replacedWith = result.newVersion;
+        opts.selfUpdateSink.binaryPath = result.binaryPath;
+      }
+      say(source_default.green(`  ${result.message}
+`));
+    }
+  });
   if (opts.pin) {
     const pin = opts.pin;
     const persist = opts.persistPinFn ?? defaultPersistPin(opts.configPath);
@@ -90887,7 +91496,7 @@ function planUpdate(opts) {
   steps.push({
     name: "pull-images",
     description: "Pull broker / kernel / agent images from GHCR",
-    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync79(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
+    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync80(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
     run: () => {
       const r = runner("docker", [
         "compose",
@@ -91014,13 +91623,13 @@ function planUpdate(opts) {
       }
       const source = resolve45(import.meta.dirname, "../../skills");
       const dest = join83(homedir43(), ".switchroom", "skills", "_bundled");
-      if (!existsSync79(source)) {
+      if (!existsSync80(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
         return;
       }
       try {
-        mkdirSync44(dirname32(dest), { recursive: true });
+        mkdirSync45(dirname33(dest), { recursive: true });
         const r = syncBundledSkills({
           source,
           dest,
@@ -91046,10 +91655,10 @@ function planUpdate(opts) {
       if (opts.syncBundledSkillsFn)
         return;
       const dest = join83(homedir43(), ".switchroom", "skills", "_bundled");
-      if (!existsSync79(dest)) {
+      if (!existsSync80(dest)) {
         return;
       }
-      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync79(join83(dest, key)));
+      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync80(join83(dest, key)));
       if (missing.length > 0) {
         throw new Error(`verify-bundled-skills: builtin default skill(s) missing from the pool after sync: ` + `${missing.join(", ")}. These ship in the CLI package and must exist in ${dest}. ` + `This is a broken sync or a packaging regression \u2014 the pool is not converged.`);
       }
@@ -91118,7 +91727,7 @@ function planUpdate(opts) {
   return steps;
 }
 function defaultRunner2(cmd, args) {
-  const r = spawnSync14(cmd, args, { stdio: "inherit" });
+  const r = spawnSync16(cmd, args, { stdio: "inherit" });
   return { status: r.status ?? 1 };
 }
 function writeMarkerInPreferredLocation(agent, reason, runner) {
@@ -91161,10 +91770,10 @@ function defaultStatusProbe(composePath) {
       try {
         cliBuiltAt = new Date(statSync45(scriptPath).mtimeMs).toISOString();
       } catch {}
-      let dir = dirname32(scriptPath);
+      let dir = dirname33(scriptPath);
       for (let i = 0;i < 8; i++) {
         const pkgPath = join83(dir, "package.json");
-        if (existsSync79(pkgPath)) {
+        if (existsSync80(pkgPath)) {
           try {
             const pkg = JSON.parse(readFileSync73(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
@@ -91174,7 +91783,7 @@ function defaultStatusProbe(composePath) {
           }
           break;
         }
-        const parent = dirname32(dir);
+        const parent = dirname33(dir);
         if (parent === dir)
           break;
         dir = parent;
@@ -91187,13 +91796,13 @@ function defaultStatusProbe(composePath) {
     warnings.push("could not resolve CLI version (no package.json found above the resolved script path)");
   }
   const services = [];
-  if (!existsSync79(composePath)) {
+  if (!existsSync80(composePath)) {
     warnings.push(`compose file not found at ${composePath}; service status unknown`);
     return { cliVersion, cliBuiltAt, services, warnings };
   }
   let serviceList = [];
   try {
-    const r = spawnSync14("docker", ["compose", "-p", "switchroom", "-f", composePath, "config", "--services"], { encoding: "utf-8", timeout: 1e4 });
+    const r = spawnSync16("docker", ["compose", "-p", "switchroom", "-f", composePath, "config", "--services"], { encoding: "utf-8", timeout: 1e4 });
     if (r.status !== 0) {
       warnings.push(`docker compose config --services failed: ${r.stderr?.trim() ?? r.error?.message ?? "unknown"}`);
       return { cliVersion, cliBuiltAt, services, warnings };
@@ -91210,7 +91819,7 @@ function defaultStatusProbe(composePath) {
     let containerCreatedAt = null;
     let status = "<unknown>";
     try {
-      const r = spawnSync14("docker", ["inspect", "-f", "{{.Config.Image}}|{{.Created}}|{{.State.Status}}", containerName2], { encoding: "utf-8", timeout: 5000 });
+      const r = spawnSync16("docker", ["inspect", "-f", "{{.Config.Image}}|{{.Created}}|{{.State.Status}}", containerName2], { encoding: "utf-8", timeout: 5000 });
       if (r.status === 0) {
         const [img, created, st] = r.stdout.trim().split("|");
         image = img ?? null;
@@ -91226,7 +91835,7 @@ function defaultStatusProbe(composePath) {
     let imagePulledAt = null;
     if (image) {
       try {
-        const r = spawnSync14("docker", ["image", "inspect", "-f", "{{.Id}}|{{.Created}}|{{.Metadata.LastTagTime}}", image], { encoding: "utf-8", timeout: 5000 });
+        const r = spawnSync16("docker", ["image", "inspect", "-f", "{{.Id}}|{{.Created}}|{{.Metadata.LastTagTime}}", image], { encoding: "utf-8", timeout: 5000 });
         if (r.status === 0) {
           const [id, created, lastTag] = r.stdout.trim().split("|");
           imageDigestShort = id?.replace(/^sha256:/, "").slice(0, 12) ?? null;
@@ -91290,6 +91899,47 @@ function formatStatusReport(rep) {
   return lines.join(`
 `);
 }
+function buildReexecArgs(opts) {
+  const args = ["update", "--skip-self-update"];
+  if (opts.skipImages)
+    args.push("--skip-images");
+  if (opts.channel)
+    args.push("--channel", opts.channel);
+  if (opts.pin)
+    args.push("--pin", opts.pin);
+  return args;
+}
+function defaultReexec(binaryPath, args) {
+  const r = spawnSync16(binaryPath, args, {
+    stdio: "inherit",
+    env: { ...process.env, [SELF_UPDATE_ENV_SENTINEL]: "1" }
+  });
+  return { status: r.status ?? 1 };
+}
+function renderDriftPreamble(opts) {
+  try {
+    const exec = opts.componentExec ?? ((cmd, args) => {
+      const r = spawnSync16(cmd, args, { encoding: "utf-8", timeout: 1e4 });
+      return { status: r.status ?? 1, stdout: r.stdout ?? "" };
+    });
+    let pin;
+    try {
+      pin = loadConfig().release?.pin ?? undefined;
+    } catch {
+      pin = undefined;
+    }
+    const report = detectComponentDrift(collectComponents(SWITCHROOM_VERSION, exec), pin);
+    const body = formatComponentDrift(report);
+    return report.behind.length > 0 ? `${body}
+
+${report.behind.length} component(s) BEHIND ${report.target} \u2014 this update targets them.
+` : `${body}
+`;
+  } catch (err) {
+    return `Component versions: not checkable (${err.message})
+`;
+  }
+}
 async function runUpdate(opts) {
   const stdout = opts.stdout ?? ((s) => process.stdout.write(s));
   const stderr = opts.stderr ?? ((s) => process.stderr.write(s));
@@ -91319,11 +91969,14 @@ async function runUpdate(opts) {
       return 2;
     }
   }
-  const steps = planUpdate(opts);
+  const selfUpdateSink = opts.selfUpdateSink ?? {};
+  const steps = planUpdate({ ...opts, selfUpdateSink });
   if (opts.check) {
     stdout(source_default.bold(`switchroom update --check (dry-run)
 
 `));
+    stdout(renderDriftPreamble(opts) + `
+`);
     for (const step of steps) {
       const status = step.skipReason ? source_default.gray(`[skip] ${step.skipReason}`) : source_default.green("[run]");
       stdout(`  ${status} ${step.name} \u2014 ${step.description}
@@ -91343,7 +91996,15 @@ Dry-run only; nothing was changed. Re-run without --check to apply.
     stdout(source_default.bold(`\u25b8 ${step.name}
 `));
     try {
-      step.run();
+      await step.run();
+      if (step.name === "self-update-cli" && selfUpdateSink.binaryPath) {
+        const reexec = opts.reexecFn ?? defaultReexec;
+        stdout(source_default.bold(`
+\u25b8 re-exec ${selfUpdateSink.binaryPath} (${selfUpdateSink.replacedWith}) for the remaining steps
+`));
+        const r = reexec(selfUpdateSink.binaryPath, buildReexecArgs(opts));
+        return r.status;
+      }
     } catch (err) {
       stderr(source_default.red(`\u2717 ${step.name} failed: ${err.message}
 `));
@@ -91366,7 +92027,7 @@ Dry-run only; nothing was changed. Re-run without --check to apply.
   return 0;
 }
 function registerUpdateCommand(program3) {
-  program3.command("update").description("Update switchroom on this host: pull images, refresh scaffolds, recreate containers. Wraps the full `pull && apply && up -d` flow.").option("--check", "Dry-run: print the steps that would execute, exit 0.").option("--skip-images", "Skip the docker image pull (offline mode).").option("--rebuild", "Source-checkout / maintainer only: git pull + bun install + npm run build before applying. REFUSED on a published install \u2014 use `npm i -g switchroom@latest && switchroom update` there.").option("--status", "Read-only snapshot: report local CLI version, image digest + pull time, container creation time per service. Does NOT invoke any update steps. Wired by Telegram /upgrade-status (#927).").option("--json", "Output as JSON (currently only honored under --status; other modes ignore).").addOption(new Option("--channel <c>", "Override the resolved release block for this update run: follow the named channel (dev|rc|latest). Mutually exclusive with --pin.").choices(["dev", "rc", "latest"]).conflicts("pin")).addOption(new Option("--pin <p>", "Override the resolved release block for this update run: pin to a specific build (sha-<7-40 hex> or v<semver>). Mutually exclusive with --channel.").conflicts("channel")).option("--force", "[legacy v0.6 no-op]").option("--no-restart", "[legacy v0.6 no-op]").option("--resume <file>", "[legacy v0.6 no-op]").option("--phase <phase>", "[legacy v0.6 no-op]").action(async (opts) => {
+  program3.command("update").description("Update EVERY switchroom component on this host \u2014 the operator CLI itself (first), images, scaffolds, the hostd / web / hindsight singletons, and the agent fleet. Wraps the full `self-update && pull && apply && up -d` flow.").option("--check", "Dry-run: print the steps that would execute, exit 0.").option("--skip-images", "Skip the docker image pull (offline mode).").option("--skip-self-update", "Do NOT replace the host operator CLI binary. By default `update` updates every switchroom component INCLUDING itself (and does it first, because `apply` renders scaffolds from templates shipped inside the CLI).").option("--rebuild", "Source-checkout / maintainer only: git pull + bun install + npm run build before applying. REFUSED on a published install \u2014 use `npm i -g switchroom@latest && switchroom update` there.").option("--status", "Read-only snapshot: report local CLI version, image digest + pull time, container creation time per service. Does NOT invoke any update steps. Wired by Telegram /upgrade-status (#927).").option("--json", "Output as JSON (currently only honored under --status; other modes ignore).").addOption(new Option("--channel <c>", "Override the resolved release block for this update run: follow the named channel (dev|rc|latest). Mutually exclusive with --pin.").choices(["dev", "rc", "latest"]).conflicts("pin")).addOption(new Option("--pin <p>", "Override the resolved release block for this update run: pin to a specific build (sha-<7-40 hex> or v<semver>). Mutually exclusive with --channel.").conflicts("channel")).option("--force", "[legacy v0.6 no-op]").option("--no-restart", "[legacy v0.6 no-op]").option("--resume <file>", "[legacy v0.6 no-op]").option("--phase <phase>", "[legacy v0.6 no-op]").action(async (opts) => {
     if (opts.pin && !/^(sha-[0-9a-f]{7,40}|v\d+\.\d+\.\d+)$/.test(opts.pin)) {
       console.error(source_default.red(`--pin "${opts.pin}" is invalid. Expected sha-<7-40 hex> or v<semver>.`));
       process.exit(2);
@@ -91382,23 +92043,23 @@ function registerUpdateCommand(program3) {
 
 // src/cli/rollout.ts
 init_helpers();
-import { spawnSync as spawnSync16 } from "node:child_process";
+import { spawnSync as spawnSync18 } from "node:child_process";
 import { readFileSync as readFileSync75, chownSync as chownSync9, statSync as statSync47 } from "node:fs";
 import { homedir as homedir45 } from "node:os";
 
 // src/cli/rollout-pin-journal.ts
 import {
-  existsSync as existsSync80,
+  existsSync as existsSync81,
   readFileSync as readFileSync74,
   writeFileSync as writeFileSync31,
-  renameSync as renameSync19,
+  renameSync as renameSync20,
   unlinkSync as unlinkSync15,
   statSync as statSync46,
-  mkdirSync as mkdirSync45
+  mkdirSync as mkdirSync46
 } from "node:fs";
 import { homedir as homedir44 } from "node:os";
-import { createHash as createHash16 } from "node:crypto";
-import { join as join84, basename as basename9, resolve as resolve46, dirname as dirname33 } from "node:path";
+import { createHash as createHash17 } from "node:crypto";
+import { join as join84, basename as basename9, resolve as resolve46, dirname as dirname34 } from "node:path";
 init_flock();
 var PIN_JOURNAL_MAX_AGE_MS = 15 * 60 * 1000;
 var STATE_DIR_NAME = ".switchroom";
@@ -91407,7 +92068,7 @@ function pinJournalDir(configPath) {
   if (override && override.trim().length > 0)
     return override.trim();
   if (configPath) {
-    const dir = dirname33(resolve46(configPath));
+    const dir = dirname34(resolve46(configPath));
     if (basename9(dir) === STATE_DIR_NAME)
       return dir;
   }
@@ -91415,7 +92076,7 @@ function pinJournalDir(configPath) {
 }
 function pinJournalPath(configPath) {
   const abs = resolve46(configPath);
-  const key = createHash16("sha256").update(abs).digest("hex").slice(0, 12);
+  const key = createHash17("sha256").update(abs).digest("hex").slice(0, 12);
   return join84(pinJournalDir(abs), `.rollout-pin-journal.${basename9(abs)}.${key}.json`);
 }
 function isPidAlive(pid) {
@@ -91452,7 +92113,7 @@ function readPinJournal(configPath, warn = (m) => process.stderr.write(m)) {
   try {
     raw = readFileSync74(p, "utf8");
   } catch (e) {
-    if (existsSync80(p)) {
+    if (existsSync81(p)) {
       warn(`\u26a0\ufe0f  rollout pin journal: ${p} exists but could not be read ` + `(${e.message}). A provisional \`release.pin\` may be ` + `uncommitted \u2014 verify it host-side before the next reconcile.
 `);
     }
@@ -91512,10 +92173,10 @@ function beginPinPersist(configPath, pin, opts = {}) {
     pid: process.pid,
     at: new Date().toISOString()
   };
-  mkdirSync45(dirname33(p), { recursive: true });
+  mkdirSync46(dirname34(p), { recursive: true });
   const tmp = `${p}.${process.pid}.tmp`;
   writeFileSync31(tmp, JSON.stringify(journal), { encoding: "utf8", mode: 384 });
-  renameSync19(tmp, p);
+  renameSync20(tmp, p);
   return journal;
 }
 function commitPinPersist(configPath) {
@@ -91524,7 +92185,7 @@ function commitPinPersist(configPath) {
     unlinkSync15(p);
     return null;
   } catch (e) {
-    if (!existsSync80(p))
+    if (!existsSync81(p))
       return null;
     return `rollout pin journal: FAILED to clear ${p} after a SUCCESSFUL roll ` + `(${e.message}). Delete it host-side \u2014 while it exists, ` + `recovery may revert a proven \`release.pin\`.`;
   }
@@ -91602,10 +92263,10 @@ init_audit_reader();
 init_hindsight();
 
 // src/cli/deploy-version-guard.ts
-import { spawnSync as spawnSync15 } from "node:child_process";
+import { spawnSync as spawnSync17 } from "node:child_process";
 var DOCKER_INSPECT_TIMEOUT_MS = 60 * 1000;
 var defaultRunner3 = (args) => {
-  const r = spawnSync15("docker", args, {
+  const r = spawnSync17("docker", args, {
     encoding: "utf8",
     timeout: DOCKER_INSPECT_TIMEOUT_MS,
     killSignal: "SIGKILL"
@@ -91979,7 +92640,7 @@ function isSpawnTimeout(r, killSignal) {
 var ROLLOUT_KILL_SIGNAL = "SIGKILL";
 function createRolloutDeps(params) {
   const { configPath, scriptPath, hostdCtx } = params;
-  const spawn6 = params.spawn ?? spawnSync16;
+  const spawn6 = params.spawn ?? spawnSync18;
   const warn = params.warn ?? ((line) => process.stderr.write(line));
   const dockerRun = (args) => {
     let r;
@@ -92233,8 +92894,8 @@ init_helpers();
 init_lifecycle();
 init_resolve_version();
 import { execSync as execSync3 } from "node:child_process";
-import { existsSync as existsSync81, readFileSync as readFileSync76 } from "node:fs";
-import { dirname as dirname34, join as join85 } from "node:path";
+import { existsSync as existsSync82, readFileSync as readFileSync76 } from "node:fs";
+import { dirname as dirname35, join as join85 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync3("claude --version 2>/dev/null", {
@@ -92285,15 +92946,15 @@ function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
     const pkgPath = join85(dir, "package.json");
-    if (existsSync81(pkgPath)) {
+    if (existsSync82(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync76(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync81(join85(dir, ".git"))) {
+        if (pkg.name === "switchroom" && existsSync82(join85(dir, ".git"))) {
           return dir;
         }
       } catch {}
     }
-    dir = dirname34(dir);
+    dir = dirname35(dir);
   }
   return null;
 }
@@ -92463,10 +93124,11 @@ Dependency manifest`));
 init_helpers();
 init_loader();
 import { resolve as resolve48 } from "node:path";
+init_merge();
 
 // src/agents/session-retention.ts
 import {
-  existsSync as existsSync82,
+  existsSync as existsSync83,
   readdirSync as readdirSync28,
   statSync as statSync48,
   unlinkSync as unlinkSync16
@@ -92477,7 +93139,7 @@ var DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS = 30;
 var MIN_KEEP = 2;
 function collectSessionJsonl(claudeConfigDir) {
   const projects = join86(claudeConfigDir, "projects");
-  if (!existsSync82(projects))
+  if (!existsSync83(projects))
     return [];
   const found = [];
   const walk2 = (dir) => {
@@ -92554,12 +93216,13 @@ function registerHandoffCommand(program3) {
     let agentDir;
     try {
       const config = getConfig(program3);
-      agentConfig = config.agents[agentName];
-      if (!agentConfig) {
+      const rawAgent = config.agents[agentName];
+      if (!rawAgent) {
         process.stderr.write(`handoff: agent "${agentName}" not defined in switchroom.yaml
 `);
         return;
       }
+      agentConfig = resolveAgentConfig(config.defaults, config.profiles, rawAgent);
       const agentsDir = resolveAgentsDir(config);
       agentDir = resolve48(agentsDir, agentName);
     } catch (err) {
@@ -92589,10 +93252,14 @@ function registerHandoffCommand(program3) {
       jsonlPath: jsonl,
       agentDir,
       agentName,
-      maxTurns: cappedMaxTurns
+      maxTurns: cappedMaxTurns,
+      observationScopes: agentConfig?.memory?.observation_scopes
     });
     process.stderr.write(`handoff: ${status}
 `);
+    if (status === HANDOFF_STATUS_MIRROR_SKIPPED) {
+      process.exitCode = 1;
+    }
     const retention = pruneSessionJsonl(claudeConfigDir, {
       maxCount: continuity?.session_retention_max_count ?? DEFAULT_SESSION_RETENTION_MAX_COUNT,
       maxAgeDays: continuity?.session_retention_max_age_days ?? DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS,
@@ -92607,13 +93274,13 @@ function registerHandoffCommand(program3) {
 
 // src/issues/store.ts
 import {
-  closeSync as closeSync15,
-  existsSync as existsSync83,
-  mkdirSync as mkdirSync46,
-  openSync as openSync15,
+  closeSync as closeSync16,
+  existsSync as existsSync84,
+  mkdirSync as mkdirSync47,
+  openSync as openSync16,
   readdirSync as readdirSync29,
   readFileSync as readFileSync77,
-  renameSync as renameSync20,
+  renameSync as renameSync21,
   statSync as statSync49,
   unlinkSync as unlinkSync17,
   writeFileSync as writeFileSync32,
@@ -93051,7 +93718,7 @@ var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
   const path7 = join87(stateDir, ISSUES_FILE);
-  if (!existsSync83(path7))
+  if (!existsSync84(path7))
     return [];
   let raw;
   try {
@@ -93128,7 +93795,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve49(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync83(join87(stateDir, ISSUES_FILE)))
+  if (!existsSync84(join87(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -93146,7 +93813,7 @@ function resolve49(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync83(join87(stateDir, ISSUES_FILE)))
+  if (!existsSync84(join87(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -93164,7 +93831,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync83(join87(stateDir, ISSUES_FILE)))
+  if (!existsSync84(join87(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -93194,7 +93861,7 @@ function prune(stateDir, opts = {}) {
   });
 }
 function ensureDir(stateDir) {
-  mkdirSync46(stateDir, { recursive: true });
+  mkdirSync47(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
   const path7 = join87(stateDir, ISSUES_FILE);
@@ -93204,7 +93871,7 @@ function writeAll(stateDir, events) {
 `) + `
 `;
   writeFileSync32(tmp, body, "utf-8");
-  renameSync20(tmp, path7);
+  renameSync21(tmp, path7);
 }
 var ORPHAN_TMP_TTL_MS = 60000;
 var TMP_PREFIX = `${ISSUES_FILE}.tmp-`;
@@ -93236,7 +93903,7 @@ function withLock(stateDir, fn) {
   let fd = null;
   while (fd === null) {
     try {
-      fd = openSync15(lockPath, "wx");
+      fd = openSync16(lockPath, "wx");
       try {
         writeSync9(fd, String(process.pid));
       } catch {}
@@ -93256,7 +93923,7 @@ function withLock(stateDir, fn) {
     return fn();
   } finally {
     try {
-      closeSync15(fd);
+      closeSync16(fd);
     } catch {}
     try {
       unlinkSync17(lockPath);
@@ -93514,20 +94181,20 @@ function relTime(deltaMs) {
 
 // src/cli/deps.ts
 init_source();
-import { existsSync as existsSync86 } from "node:fs";
+import { existsSync as existsSync87 } from "node:fs";
 import { homedir as homedir48 } from "node:os";
 import { join as join90, resolve as resolve50 } from "node:path";
 
 // src/deps/python.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 import {
-  existsSync as existsSync84,
-  mkdirSync as mkdirSync47,
+  existsSync as existsSync85,
+  mkdirSync as mkdirSync48,
   readFileSync as readFileSync78,
-  rmSync as rmSync14,
+  rmSync as rmSync15,
   writeFileSync as writeFileSync33
 } from "node:fs";
-import { dirname as dirname35, join as join88 } from "node:path";
+import { dirname as dirname36, join as join88 } from "node:path";
 import { homedir as homedir46 } from "node:os";
 import { execFileSync as execFileSync24 } from "node:child_process";
 
@@ -93543,13 +94210,13 @@ function defaultPythonCacheRoot() {
   return join88(homedir46(), ".switchroom", "deps", "python");
 }
 function hashFile(path7) {
-  return createHash17("sha256").update(readFileSync78(path7)).digest("hex");
+  return createHash18("sha256").update(readFileSync78(path7)).digest("hex");
 }
 function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultPythonCacheRoot();
   const hostPython = opts.pythonBin ?? "python3";
-  if (!existsSync84(requirementsPath)) {
+  if (!existsSync85(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
   const venvDir = join88(cacheRoot, skillName);
@@ -93558,7 +94225,7 @@ function ensurePythonEnv(opts) {
   const pythonBin = join88(binDir, "python");
   const pipBin = join88(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
-  if (!force && existsSync84(stampPath) && existsSync84(pythonBin)) {
+  if (!force && existsSync85(stampPath) && existsSync85(pythonBin)) {
     const existingHash = readFileSync78(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
@@ -93571,10 +94238,10 @@ function ensurePythonEnv(opts) {
       };
     }
   }
-  if (existsSync84(venvDir)) {
-    rmSync14(venvDir, { recursive: true, force: true });
+  if (existsSync85(venvDir)) {
+    rmSync15(venvDir, { recursive: true, force: true });
   }
-  mkdirSync47(dirname35(venvDir), { recursive: true });
+  mkdirSync48(dirname36(venvDir), { recursive: true });
   try {
     execFileSync24(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
   } catch (err) {
@@ -93606,16 +94273,16 @@ function ensurePythonEnv(opts) {
 }
 
 // src/deps/node.ts
-import { createHash as createHash18 } from "node:crypto";
+import { createHash as createHash19 } from "node:crypto";
 import {
-  copyFileSync as copyFileSync11,
-  existsSync as existsSync85,
-  mkdirSync as mkdirSync48,
+  copyFileSync as copyFileSync12,
+  existsSync as existsSync86,
+  mkdirSync as mkdirSync49,
   readFileSync as readFileSync79,
-  rmSync as rmSync15,
+  rmSync as rmSync16,
   writeFileSync as writeFileSync34
 } from "node:fs";
-import { dirname as dirname36, join as join89 } from "node:path";
+import { dirname as dirname37, join as join89 } from "node:path";
 import { homedir as homedir47 } from "node:os";
 import { execFileSync as execFileSync25 } from "node:child_process";
 
@@ -93642,14 +94309,14 @@ function defaultNodeCacheRoot() {
   return join89(homedir47(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
-  const sourceDir = dirname36(packageJsonPath);
-  const hasher = createHash18("sha256");
+  const sourceDir = dirname37(packageJsonPath);
+  const hasher = createHash19("sha256");
   hasher.update(`package.json
 `);
   hasher.update(readFileSync79(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
     const lockPath = join89(sourceDir, lockName);
-    if (existsSync85(lockPath)) {
+    if (existsSync86(lockPath)) {
       hasher.update(`
 `);
       hasher.update(lockName);
@@ -93664,16 +94331,16 @@ function ensureNodeEnv(opts) {
   const { skillName, packageJsonPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultNodeCacheRoot();
   const installer = opts.installer ?? "bun";
-  if (!existsSync85(packageJsonPath)) {
+  if (!existsSync86(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
-  const sourceDir = dirname36(packageJsonPath);
+  const sourceDir = dirname37(packageJsonPath);
   const envDir = join89(cacheRoot, skillName);
   const stampPath = join89(envDir, ".package.sha256");
   const nodeModulesDir = join89(envDir, "node_modules");
   const binDir = join89(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
-  if (!force && existsSync85(stampPath) && existsSync85(nodeModulesDir)) {
+  if (!force && existsSync86(stampPath) && existsSync86(nodeModulesDir)) {
     const existingHash = readFileSync79(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
@@ -93685,16 +94352,16 @@ function ensureNodeEnv(opts) {
       };
     }
   }
-  if (existsSync85(envDir)) {
-    rmSync15(envDir, { recursive: true, force: true });
+  if (existsSync86(envDir)) {
+    rmSync16(envDir, { recursive: true, force: true });
   }
-  mkdirSync48(envDir, { recursive: true });
-  copyFileSync11(packageJsonPath, join89(envDir, "package.json"));
+  mkdirSync49(envDir, { recursive: true });
+  copyFileSync12(packageJsonPath, join89(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
     const lockPath = join89(sourceDir, lockName);
-    if (existsSync85(lockPath)) {
-      copyFileSync11(lockPath, join89(envDir, lockName));
+    if (existsSync86(lockPath)) {
+      copyFileSync12(lockPath, join89(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -93729,22 +94396,22 @@ function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
   deps.command("rebuild <skill>").description("Rebuild the Python venv and/or Node node_modules cache for a skill").option("-p, --python", "Rebuild only the Python env").option("-n, --node", "Rebuild only the Node env").action(async (skill, opts) => {
     const skillsRoot = builtinSkillsRoot();
-    if (!existsSync86(skillsRoot)) {
+    if (!existsSync87(skillsRoot)) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
     const skillDir = join90(skillsRoot, skill);
-    if (!existsSync86(skillDir)) {
+    if (!existsSync87(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
     const requirementsPath = join90(skillDir, "requirements.txt");
     const packageJsonPath = join90(skillDir, "package.json");
-    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync86(requirementsPath));
-    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync86(packageJsonPath));
+    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync87(requirementsPath));
+    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync87(packageJsonPath));
     let did = 0;
     if (wantPython) {
-      if (!existsSync86(requirementsPath)) {
+      if (!existsSync87(requirementsPath)) {
         console.error(source_default.red(`Skill "${skill}" has no requirements.txt at ${requirementsPath}`));
         process.exit(1);
       }
@@ -93768,7 +94435,7 @@ function registerDepsCommand(program3) {
       }
     }
     if (wantNode) {
-      if (!existsSync86(packageJsonPath)) {
+      if (!existsSync87(packageJsonPath)) {
         console.error(source_default.red(`Skill "${skill}" has no package.json at ${packageJsonPath}`));
         process.exit(1);
       }
@@ -93801,9 +94468,9 @@ function registerDepsCommand(program3) {
 // src/cli/workspace.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync87 } from "node:fs";
+import { existsSync as existsSync88 } from "node:fs";
 import { resolve as resolve51, sep as sep4 } from "node:path";
-import { spawnSync as spawnSync17 } from "node:child_process";
+import { spawnSync as spawnSync19 } from "node:child_process";
 
 // src/agents/workspace.ts
 import { readFile as readFile2, stat } from "node:fs/promises";
@@ -94516,7 +95183,7 @@ function registerWorkspaceCommand(program3) {
       process.exit(1);
     }
     const editor = process.env["EDITOR"] ?? process.env["VISUAL"] ?? "vi";
-    const child = spawnSync17(editor, [target], { stdio: "inherit" });
+    const child = spawnSync19(editor, [target], { stdio: "inherit" });
     if (child.status !== 0 && child.status !== null) {
       process.exit(child.status);
     }
@@ -94578,12 +95245,12 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve51(dir, ".git");
-    if (!existsSync87(gitDir)) {
+    if (!existsSync88(gitDir)) {
       process.stdout.write(`Workspace is not a git repository. Re-run \`switchroom agent create ${agentName}\` ` + `or manually \`git init\` in ${dir} to enable versioning.
 `);
       return;
     }
-    const statusResult = spawnSync17("git", ["status", "--short"], {
+    const statusResult = spawnSync19("git", ["status", "--short"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -94598,7 +95265,7 @@ function registerWorkspaceCommand(program3) {
       return;
     }
     const message = opts.message || `checkpoint: ${new Date().toISOString()}`;
-    const addResult = spawnSync17("git", ["add", "-A"], {
+    const addResult = spawnSync19("git", ["add", "-A"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -94607,7 +95274,7 @@ function registerWorkspaceCommand(program3) {
 `);
       process.exit(1);
     }
-    const commitResult = spawnSync17("git", ["commit", "-m", message], {
+    const commitResult = spawnSync19("git", ["commit", "-m", message], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -94616,7 +95283,7 @@ function registerWorkspaceCommand(program3) {
 `);
       process.exit(1);
     }
-    const shaResult = spawnSync17("git", ["rev-parse", "--short", "HEAD"], {
+    const shaResult = spawnSync19("git", ["rev-parse", "--short", "HEAD"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -94632,12 +95299,12 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve51(dir, ".git");
-    if (!existsSync87(gitDir)) {
+    if (!existsSync88(gitDir)) {
       process.stdout.write(`Workspace is not a git repository.
 `);
       return;
     }
-    const child = spawnSync17("git", ["status", "--short"], {
+    const child = spawnSync19("git", ["status", "--short"], {
       cwd: dir,
       stdio: "inherit"
     });
@@ -94657,7 +95324,7 @@ function resolveAgentWorkspaceDirOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve51(agentsDir, agentName);
   const dir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync87(dir)) {
+  if (!existsSync88(dir)) {
     process.stderr.write(`workspace: ${dir} does not exist yet. Run \`switchroom setup\` or \`switchroom agent scaffold ${agentName}\` to seed it.
 `);
     return;
@@ -94693,7 +95360,7 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync12, existsSync as existsSync88, readFileSync as readFileSync80, writeFileSync as writeFileSync35 } from "node:fs";
+import { copyFileSync as copyFileSync13, existsSync as existsSync89, readFileSync as readFileSync80, writeFileSync as writeFileSync35 } from "node:fs";
 import { join as join91, resolve as resolve52 } from "node:path";
 init_scaffold();
 init_profiles();
@@ -94711,7 +95378,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve52(agentsDir, agentName);
   const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync88(workspaceDir)) {
+  if (!existsSync89(workspaceDir)) {
     console.error(`soul: ${workspaceDir} does not exist yet. Run \`switchroom setup\` ` + `or \`switchroom agent scaffold ${agentName}\` to seed it.`);
     process.exit(1);
   }
@@ -94737,7 +95404,7 @@ function registerSoulCommand(program3) {
     const t = resolveSoulTargetOrExit(program3, agentName);
     if (!t)
       return;
-    if (!existsSync88(t.soulPath)) {
+    if (!existsSync89(t.soulPath)) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
@@ -94752,7 +95419,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: profile "${t.profileName}" ships no SOUL.md.hbs \u2014 ` + `nothing to re-seed from.`);
       process.exit(1);
     }
-    const exists = existsSync88(t.soulPath);
+    const exists = existsSync89(t.soulPath);
     if (exists && !opts.yes) {
       if (!isInteractive()) {
         console.error(`soul: ${t.soulPath} already exists. Re-run with --yes to ` + `replace it (the current file is backed up to SOUL.md.bak).`);
@@ -94767,10 +95434,10 @@ function registerSoulCommand(program3) {
     let backupPath;
     if (exists) {
       backupPath = `${t.soulPath}.bak`;
-      if (existsSync88(backupPath)) {
+      if (existsSync89(backupPath)) {
         backupPath = `${t.soulPath}.bak.${Date.now()}`;
       }
-      copyFileSync12(t.soulPath, backupPath);
+      copyFileSync13(t.soulPath, backupPath);
     }
     writeFileSync35(t.soulPath, content, "utf-8");
     if (backupPath) {
@@ -94786,9 +95453,9 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync89, readFileSync as readFileSync81, readdirSync as readdirSync30, statSync as statSync50 } from "node:fs";
+import { existsSync as existsSync90, readFileSync as readFileSync81, readdirSync as readdirSync30, statSync as statSync50 } from "node:fs";
 import { resolve as resolve53, join as join92 } from "node:path";
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 init_merge();
 init_hindsight2();
 function formatBytes(bytes) {
@@ -94799,7 +95466,7 @@ function estimateTokens(bytes) {
 }
 function readMcpServerNames(agentDir) {
   const mcpPath = join92(agentDir, ".mcp.json");
-  if (!existsSync89(mcpPath))
+  if (!existsSync90(mcpPath))
     return [];
   try {
     const parsed = JSON.parse(readFileSync81(mcpPath, "utf-8"));
@@ -94809,11 +95476,11 @@ function readMcpServerNames(agentDir) {
   }
 }
 function sha256(content) {
-  return createHash19("sha256").update(content).digest("hex").slice(0, 16);
+  return createHash20("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
   const projectsDir = join92(claudeConfigDir, "projects");
-  if (!existsSync89(projectsDir))
+  if (!existsSync90(projectsDir))
     return;
   try {
     const entries = readdirSync30(projectsDir, { withFileTypes: true });
@@ -94823,7 +95490,7 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
         continue;
       const projectPath = join92(projectsDir, entry.name);
       const transcriptPath = join92(projectPath, "transcript.jsonl");
-      if (!existsSync89(transcriptPath))
+      if (!existsSync90(transcriptPath))
         continue;
       const stat3 = statSync50(transcriptPath);
       if (!latest || stat3.mtimeMs > latest.mtime) {
@@ -94886,7 +95553,7 @@ function registerDebugCommand(program3) {
     }
     const agentsDir = resolveAgentsDir(config);
     const agentDir = resolve53(agentsDir, agentName);
-    if (!existsSync89(agentDir)) {
+    if (!existsSync90(agentDir)) {
       console.error(`Agent directory not found: ${agentDir}`);
       process.exit(1);
     }
@@ -94941,7 +95608,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Append System Prompt (per-session) ===
 `);
-    const handoffContent = existsSync89(handoffPath) ? readFileSync81(handoffPath, "utf-8") : "";
+    const handoffContent = existsSync90(handoffPath) ? readFileSync81(handoffPath, "utf-8") : "";
     if (handoffContent.trim().length > 0) {
       console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
       console.log(handoffContent);
@@ -94952,7 +95619,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
 `);
-    const claudeMdContent = existsSync89(claudeMdPath) ? readFileSync81(claudeMdPath, "utf-8") : "";
+    const claudeMdContent = existsSync90(claudeMdPath) ? readFileSync81(claudeMdPath, "utf-8") : "";
     if (claudeMdContent.trim().length > 0) {
       console.log(`(${formatBytes(claudeMdContent.length)})`);
       console.log(claudeMdContent);
@@ -94963,7 +95630,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Persona (SOUL.md) ===
 `);
-    const soulMdContent = existsSync89(soulMdPath) ? readFileSync81(soulMdPath, "utf-8") : existsSync89(workspaceSoulMdPath) ? readFileSync81(workspaceSoulMdPath, "utf-8") : "";
+    const soulMdContent = existsSync90(soulMdPath) ? readFileSync81(soulMdPath, "utf-8") : existsSync90(workspaceSoulMdPath) ? readFileSync81(workspaceSoulMdPath, "utf-8") : "";
     if (soulMdContent.trim().length > 0) {
       console.log(`(${formatBytes(soulMdContent.length)})`);
       console.log(soulMdContent);
@@ -95027,8 +95694,8 @@ function registerDebugCommand(program3) {
     const fleetDir = join92(agentsDir, "..", "fleet");
     const fleetInvPath = join92(fleetDir, "switchroom-invariants.md");
     const fleetClaudePath = join92(fleetDir, "CLAUDE.md");
-    const fleetInvBytes = existsSync89(fleetInvPath) ? readFileSync81(fleetInvPath, "utf-8").length : 0;
-    const fleetClaudeBytes = existsSync89(fleetClaudePath) ? readFileSync81(fleetClaudePath, "utf-8").length : 0;
+    const fleetInvBytes = existsSync90(fleetInvPath) ? readFileSync81(fleetInvPath, "utf-8").length : 0;
+    const fleetClaudeBytes = existsSync90(fleetClaudePath) ? readFileSync81(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
     const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
     console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
@@ -95061,20 +95728,20 @@ init_source();
 
 // src/worktree/claim.ts
 import { execFileSync as execFileSync26 } from "node:child_process";
-import { closeSync as closeSync16, mkdirSync as mkdirSync50, openSync as openSync16, existsSync as existsSync91, unlinkSync as unlinkSync19 } from "node:fs";
+import { closeSync as closeSync17, mkdirSync as mkdirSync51, openSync as openSync17, existsSync as existsSync92, unlinkSync as unlinkSync19 } from "node:fs";
 import { join as join94, resolve as resolve55 } from "node:path";
 import { homedir as homedir50 } from "node:os";
 import { randomBytes as randomBytes14 } from "node:crypto";
 
 // src/worktree/registry.ts
 import {
-  mkdirSync as mkdirSync49,
+  mkdirSync as mkdirSync50,
   writeFileSync as writeFileSync36,
   readFileSync as readFileSync82,
   readdirSync as readdirSync31,
   unlinkSync as unlinkSync18,
-  existsSync as existsSync90,
-  renameSync as renameSync21
+  existsSync as existsSync91,
+  renameSync as renameSync22
 } from "node:fs";
 import { join as join93, resolve as resolve54 } from "node:path";
 import { homedir as homedir49 } from "node:os";
@@ -95085,7 +95752,7 @@ function recordPath(id) {
   return join93(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
-  mkdirSync49(registryDir(), { recursive: true });
+  mkdirSync50(registryDir(), { recursive: true });
 }
 function writeRecord(record2) {
   ensureDir2();
@@ -95093,7 +95760,7 @@ function writeRecord(record2) {
   const tmp = `${target}.tmp${process.pid}`;
   writeFileSync36(tmp, JSON.stringify(record2, null, 2) + `
 `, { mode: 384 });
-  renameSync21(tmp, target);
+  renameSync22(tmp, target);
 }
 function readRecord(id) {
   const path10 = recordPath(id);
@@ -95131,14 +95798,14 @@ function countByRepo(repoPath) {
 // src/worktree/claim.ts
 function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
-  mkdirSync50(lockDir, { recursive: true });
+  mkdirSync51(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
   const lockPath = join94(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
     try {
-      fd = openSync16(lockPath, "wx");
+      fd = openSync17(lockPath, "wx");
     } catch (err) {
       if (err.code !== "EEXIST")
         throw err;
@@ -95151,7 +95818,7 @@ function acquireRepoLock(repoPath) {
   }
   return () => {
     try {
-      closeSync16(fd);
+      closeSync17(fd);
     } catch {}
     try {
       unlinkSync19(lockPath);
@@ -95187,7 +95854,7 @@ function expandHome(p) {
 }
 async function claimWorktree(input, codeRepos) {
   const repoPath = resolveRepoPath(input.repo, codeRepos);
-  if (!existsSync91(repoPath)) {
+  if (!existsSync92(repoPath)) {
     throw new Error(`Repository path does not exist: ${repoPath}`);
   }
   let concurrencyCap = DEFAULT_CONCURRENCY;
@@ -95209,7 +95876,7 @@ async function claimWorktree(input, codeRepos) {
     const taskSuffix = input.taskName ? sanitizeTaskName(input.taskName) : "task";
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
-    mkdirSync50(baseDir, { recursive: true });
+    mkdirSync51(baseDir, { recursive: true });
     worktreePath = join94(baseDir, `${id}-${taskSuffix}`);
     const ambientOwner = process.env.SWITCHROOM_AGENT_NAME;
     const ownerAgent = input.ownerAgent ?? (ambientOwner != null && ambientOwner !== "" ? ambientOwner : undefined);
@@ -95243,7 +95910,7 @@ async function claimWorktree(input, codeRepos) {
 
 // src/worktree/release.ts
 import { execFileSync as execFileSync27 } from "node:child_process";
-import { existsSync as existsSync92 } from "node:fs";
+import { existsSync as existsSync93 } from "node:fs";
 function releaseWorktree(input) {
   const { id } = input;
   const record2 = readRecord(id);
@@ -95251,7 +95918,7 @@ function releaseWorktree(input) {
     return { released: true };
   }
   let gitSuccess = true;
-  if (existsSync92(record2.path)) {
+  if (existsSync93(record2.path)) {
     try {
       execFileSync27("git", ["worktree", "remove", "--force", record2.path], {
         cwd: record2.repo,
@@ -95290,7 +95957,7 @@ function listWorktrees() {
 
 // src/worktree/reaper.ts
 import { execFileSync as execFileSync28 } from "node:child_process";
-import { existsSync as existsSync93 } from "node:fs";
+import { existsSync as existsSync94 } from "node:fs";
 var STALE_THRESHOLD_MS = 10 * 60 * 1000;
 function reapSkipReasonText(action) {
   switch (action) {
@@ -95351,7 +96018,7 @@ function planReaper(nowMs, deps = {}) {
   const plan = [];
   for (const record2 of listRecords()) {
     const heartbeatAge = now - new Date(record2.heartbeatAt).getTime();
-    const worktreeExists = existsSync93(record2.path);
+    const worktreeExists = existsSync94(record2.path);
     if (!worktreeExists) {
       plan.push({
         record: record2,
@@ -95432,13 +96099,13 @@ function runReaper(nowMs, deps = {}) {
 // src/worktree/gc.ts
 import { execFileSync as execFileSync29 } from "node:child_process";
 import {
-  existsSync as existsSync94,
+  existsSync as existsSync95,
   readFileSync as readFileSync83,
   readdirSync as readdirSync32,
   statSync as statSync51,
-  renameSync as renameSync22,
-  mkdirSync as mkdirSync51,
-  rmSync as rmSync16
+  renameSync as renameSync23,
+  mkdirSync as mkdirSync52,
+  rmSync as rmSync17
 } from "node:fs";
 import { homedir as homedir51 } from "node:os";
 import { join as join95, resolve as resolve56 } from "node:path";
@@ -95523,7 +96190,7 @@ function isEphemeralPath(path10) {
   }
   return false;
 }
-var defaultExec2 = (file, args, cwd) => execFileSync29(file, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).toString();
+var defaultExec3 = (file, args, cwd) => execFileSync29(file, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).toString();
 function defaultPrSignal(repo, branch, exec) {
   try {
     const out = exec("gh", [
@@ -95559,11 +96226,11 @@ function trashRoot() {
   return resolve56(process.env.SWITCHROOM_WORKTREE_TRASH ?? join95(homedir51(), ".switchroom", "worktree-gc-trash"));
 }
 function planGc(roots, deps = {}) {
-  const exists = deps.existsSync ?? existsSync94;
+  const exists = deps.existsSync ?? existsSync95;
   const readDir = deps.readDir ?? ((p) => readdirSync32(p));
   const readFile4 = deps.readFile ?? ((p) => readFileSync83(p, "utf8"));
   const stat3 = deps.stat ?? ((p) => statSync51(p));
-  const exec = deps.exec ?? defaultExec2;
+  const exec = deps.exec ?? defaultExec3;
   const prSignal = deps.prSignal ?? ((repo, branch) => defaultPrSignal(repo, branch, exec));
   const stamp = deps.dateStamp ?? "undated";
   const trash = join95(trashRoot(), stamp);
@@ -95688,11 +96355,11 @@ function planGc(roots, deps = {}) {
   };
 }
 function applyGc(plan, deps = {}) {
-  const exec = deps.exec ?? defaultExec2;
-  const mkdirp = deps.mkdirp ?? ((p) => void mkdirSync51(p, { recursive: true }));
+  const exec = deps.exec ?? defaultExec3;
+  const mkdirp = deps.mkdirp ?? ((p) => void mkdirSync52(p, { recursive: true }));
   const move = deps.move ?? ((src, dest) => {
     try {
-      renameSync22(src, dest);
+      renameSync23(src, dest);
     } catch {
       exec("mv", [src, dest]);
     }
@@ -95738,7 +96405,7 @@ function selectPurgeTargets(entries, olderThanDays) {
   return entries.filter((e) => e.ageDays >= olderThanDays).map((e) => e.path);
 }
 function listTrashEntries(nowMs, deps = {}) {
-  const exists = deps.existsSync ?? existsSync94;
+  const exists = deps.existsSync ?? existsSync95;
   const readDir = deps.readDir ?? ((p) => readdirSync32(p));
   const root = trashRoot();
   if (!exists(root))
@@ -95768,7 +96435,7 @@ function purgeTrash(paths) {
   const errors2 = [];
   for (const p of paths) {
     try {
-      rmSync16(p, { recursive: true, force: true });
+      rmSync17(p, { recursive: true, force: true });
       deleted.push(p);
     } catch (e) {
       errors2.push(`${p}: ${e.message}`);
@@ -95999,10 +96666,10 @@ init_drive();
 // src/cli/drive-mcp-launcher.ts
 init_scaffold_integration();
 import {
-  chmodSync as chmodSync15,
-  mkdirSync as mkdirSync52,
+  chmodSync as chmodSync16,
+  mkdirSync as mkdirSync53,
   readdirSync as readdirSync33,
-  rmSync as rmSync17,
+  rmSync as rmSync18,
   writeFileSync as writeFileSync37
 } from "node:fs";
 import { join as join96 } from "node:path";
@@ -96198,15 +96865,15 @@ function resolveCredentialsDir(env2) {
   return join96(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
-  mkdirSync52(dir, { recursive: true, mode: 448 });
-  chmodSync15(dir, 448);
+  mkdirSync53(dir, { recursive: true, mode: 448 });
+  chmodSync16(dir, 448);
   for (const name of readdirSync33(dir)) {
-    rmSync17(join96(dir, name), { force: true, recursive: true });
+    rmSync18(join96(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
   const filePath = join96(dir, filename);
   writeFileSync37(filePath, JSON.stringify(seed), { mode: 384 });
-  chmodSync15(filePath, 384);
+  chmodSync16(filePath, 384);
   return filePath;
 }
 async function fetchBrokerGoogleCreds() {
@@ -96363,8 +97030,8 @@ function registerDriveMcpLauncherCommand(program3) {
 // src/cli/m365-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
-import { writeFileSync as writeFileSync38, mkdirSync as mkdirSync53 } from "node:fs";
-import { dirname as dirname37, join as join97 } from "node:path";
+import { writeFileSync as writeFileSync38, mkdirSync as mkdirSync54 } from "node:fs";
+import { dirname as dirname38, join as join97 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -96400,7 +97067,7 @@ function computeRefreshDelayMs(expiresAt, now, leadMs = DEFAULT_REFRESH_LEAD_MS)
 function writeRefreshHeartbeat(agentName, data, account) {
   const path10 = heartbeatPath(agentName, account);
   try {
-    mkdirSync53(dirname37(path10), { recursive: true });
+    mkdirSync54(dirname38(path10), { recursive: true });
     writeFileSync38(path10, JSON.stringify(data, null, 2), { mode: 420 });
   } catch {}
 }
@@ -96641,8 +97308,8 @@ function registerM365McpLauncherCommand(program3) {
 // src/cli/notion-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn7 } from "node:child_process";
-import { existsSync as existsSync95, mkdirSync as mkdirSync54, writeFileSync as writeFileSync39 } from "node:fs";
-import { dirname as dirname38 } from "node:path";
+import { existsSync as existsSync96, mkdirSync as mkdirSync55, writeFileSync as writeFileSync39 } from "node:fs";
+import { dirname as dirname39 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
 var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
 var DEFAULT_VAULT_KEY = "notion/integration-token";
@@ -96652,9 +97319,9 @@ function buildNotionMcpArgs(opts) {
 }
 function defaultWriteHeartbeat(path10, contents) {
   try {
-    const dir = dirname38(path10);
-    if (!existsSync95(dir))
-      mkdirSync54(dir, { recursive: true });
+    const dir = dirname39(path10);
+    if (!existsSync96(dir))
+      mkdirSync55(dir, { recursive: true });
     writeFileSync39(path10, contents);
   } catch {}
 }
@@ -96765,7 +97432,7 @@ function registerNotionMcpLauncherCommand(program3) {
 
 // src/cli/hindsight-mcp-shim.ts
 init_hindsight();
-import { mkdirSync as mkdirSync55, readFileSync as readFileSync84, renameSync as renameSync23, writeFileSync as writeFileSync40 } from "node:fs";
+import { mkdirSync as mkdirSync56, readFileSync as readFileSync84, renameSync as renameSync24, writeFileSync as writeFileSync40 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { join as join98 } from "node:path";
 import { createInterface as createInterface6 } from "node:readline";
@@ -96997,11 +97664,11 @@ class HindsightShim {
   }
   writeCache(result) {
     try {
-      mkdirSync55(this.opts.cacheDir, { recursive: true });
+      mkdirSync56(this.opts.cacheDir, { recursive: true });
       const tmp = join98(this.opts.cacheDir, `.${TOOLS_CACHE_FILENAME}.${process.pid}.tmp`);
       writeFileSync40(tmp, JSON.stringify(result, null, 2) + `
 `);
-      renameSync23(tmp, this.cachePath);
+      renameSync24(tmp, this.cachePath);
     } catch (err) {
       this.log(`[hindsight-shim] cache write failed: ${String(err)}`);
     }
@@ -97845,7 +98512,7 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync86, existsSync as existsSync96, readdirSync as readdirSync34 } from "node:fs";
+import { readFileSync as readFileSync86, existsSync as existsSync97, readdirSync as readdirSync34 } from "node:fs";
 import { join as join99 } from "node:path";
 import { homedir as homedir52 } from "node:os";
 
@@ -98168,7 +98835,7 @@ function runReport(opts) {
 function resolveSources(explicitPath) {
   if (explicitPath != null && explicitPath.trim() !== "") {
     const trimmed = explicitPath.trim();
-    if (!existsSync96(trimmed)) {
+    if (!existsSync97(trimmed)) {
       process.stderr.write(`status-ask report: ${trimmed}: file not found
 `);
       process.exit(1);
@@ -98184,7 +98851,7 @@ function resolveSources(explicitPath) {
   } catch {
     agentsDir = join99(homedir52(), ".switchroom", "agents");
   }
-  if (!existsSync96(agentsDir))
+  if (!existsSync97(agentsDir))
     return [];
   const sources = [];
   let entries;
@@ -98195,7 +98862,7 @@ function resolveSources(explicitPath) {
   }
   for (const name of entries) {
     const path10 = join99(agentsDir, name, "runtime-metrics.jsonl");
-    if (existsSync96(path10)) {
+    if (existsSync97(path10)) {
       sources.push({ path: path10, agent: name });
     }
   }
@@ -98224,14 +98891,14 @@ var import_yaml21 = __toESM(require_dist(), 1);
 // src/config/overlay-writer.ts
 init_paths();
 import {
-  closeSync as closeSync17,
-  existsSync as existsSync97,
+  closeSync as closeSync18,
+  existsSync as existsSync98,
   fsyncSync as fsyncSync8,
-  mkdirSync as mkdirSync56,
-  openSync as openSync17,
+  mkdirSync as mkdirSync57,
+  openSync as openSync18,
   readdirSync as readdirSync35,
   readFileSync as readFileSync87,
-  renameSync as renameSync24,
+  renameSync as renameSync25,
   statSync as statSync53,
   unlinkSync as unlinkSync20,
   writeSync as writeSync10
@@ -98255,21 +98922,21 @@ function overlayPathsFor(agent, opts = {}) {
   };
 }
 function ensureDirs(paths) {
-  mkdirSync56(paths.scheduleDir, { recursive: true });
-  mkdirSync56(paths.scheduleStagingDir, { recursive: true });
+  mkdirSync57(paths.scheduleDir, { recursive: true });
+  mkdirSync57(paths.scheduleStagingDir, { recursive: true });
 }
 function ensureSkillsDirs(paths) {
-  mkdirSync56(paths.skillsDir, { recursive: true });
-  mkdirSync56(paths.skillsStagingDir, { recursive: true });
+  mkdirSync57(paths.skillsDir, { recursive: true });
+  mkdirSync57(paths.skillsStagingDir, { recursive: true });
 }
 function withAgentLock(paths, fn) {
-  mkdirSync56(paths.agentRoot, { recursive: true });
+  mkdirSync57(paths.agentRoot, { recursive: true });
   const start = Date.now();
   const TIMEOUT_MS = 5000;
   let fd = null;
   while (Date.now() - start < TIMEOUT_MS) {
     try {
-      fd = openSync17(paths.lockPath, "wx");
+      fd = openSync18(paths.lockPath, "wx");
       break;
     } catch (err) {
       const e = err;
@@ -98293,7 +98960,7 @@ function withAgentLock(paths, fn) {
     return fn();
   } finally {
     try {
-      closeSync17(fd);
+      closeSync18(fd);
     } catch {}
     try {
       unlinkSync20(paths.lockPath);
@@ -98306,14 +98973,14 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
     ensureDirs(paths);
     const stagingPath = join100(paths.scheduleStagingDir, `${slug}.yaml`);
     const finalPath = join100(paths.scheduleDir, `${slug}.yaml`);
-    const fd = openSync17(stagingPath, "w", 384);
+    const fd = openSync18(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
       fsyncSync8(fd);
     } finally {
-      closeSync17(fd);
+      closeSync18(fd);
     }
-    renameSync24(stagingPath, finalPath);
+    renameSync25(stagingPath, finalPath);
     return finalPath;
   });
 }
@@ -98323,14 +98990,14 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
     ensureSkillsDirs(paths);
     const stagingPath = join100(paths.skillsStagingDir, `${slug}.yaml`);
     const finalPath = join100(paths.skillsDir, `${slug}.yaml`);
-    const fd = openSync17(stagingPath, "w", 384);
+    const fd = openSync18(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
       fsyncSync8(fd);
     } finally {
-      closeSync17(fd);
+      closeSync18(fd);
     }
-    renameSync24(stagingPath, finalPath);
+    renameSync25(stagingPath, finalPath);
     return finalPath;
   });
 }
@@ -98338,7 +99005,7 @@ function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     const finalPath = join100(paths.skillsDir, `${slug}.yaml`);
-    if (!existsSync97(finalPath))
+    if (!existsSync98(finalPath))
       return false;
     unlinkSync20(finalPath);
     return true;
@@ -98346,7 +99013,7 @@ function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
 }
 function listSkillsOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync97(paths.skillsDir))
+  if (!existsSync98(paths.skillsDir))
     return [];
   const out = [];
   for (const name of readdirSync35(paths.skillsDir)) {
@@ -98365,7 +99032,7 @@ function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     const finalPath = join100(paths.scheduleDir, `${slug}.yaml`);
-    if (!existsSync97(finalPath))
+    if (!existsSync98(finalPath))
       return false;
     unlinkSync20(finalPath);
     return true;
@@ -98373,7 +99040,7 @@ function deleteOverlayEntry(agent, slug, opts = {}) {
 }
 function listOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync97(paths.scheduleDir))
+  if (!existsSync98(paths.scheduleDir))
     return [];
   const out = [];
   for (const name of readdirSync35(paths.scheduleDir)) {
@@ -98600,14 +99267,14 @@ function reconcileAgentCronOnly(agent) {
 
 // src/cli/agent-config-pending.ts
 import {
-  closeSync as closeSync18,
-  existsSync as existsSync98,
+  closeSync as closeSync19,
+  existsSync as existsSync99,
   fsyncSync as fsyncSync9,
-  mkdirSync as mkdirSync57,
-  openSync as openSync18,
+  mkdirSync as mkdirSync58,
+  openSync as openSync19,
   readdirSync as readdirSync36,
   readFileSync as readFileSync88,
-  renameSync as renameSync25,
+  renameSync as renameSync26,
   unlinkSync as unlinkSync21,
   writeFileSync as writeFileSync41,
   writeSync as writeSync11
@@ -98621,7 +99288,7 @@ function pendingDir(agent, opts = {}) {
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  mkdirSync57(dir, { recursive: true });
+  mkdirSync58(dir, { recursive: true });
   return dir;
 }
 function newStageId() {
@@ -98643,14 +99310,14 @@ function stagePendingScheduleEntry(opts) {
   };
   const yamlTmp = `${yamlPath}.tmp-${process.pid}`;
   {
-    const fd = openSync18(yamlTmp, "w", 384);
+    const fd = openSync19(yamlTmp, "w", 384);
     try {
       writeSync11(fd, opts.yamlText);
       fsyncSync9(fd);
     } finally {
-      closeSync18(fd);
+      closeSync19(fd);
     }
-    renameSync25(yamlTmp, yamlPath);
+    renameSync26(yamlTmp, yamlPath);
   }
   writeFileSync41(metaPath, JSON.stringify(meta, null, 2) + `
 `, { mode: 384 });
@@ -98658,7 +99325,7 @@ function stagePendingScheduleEntry(opts) {
 }
 function listPendingScheduleEntries(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  if (!existsSync98(dir))
+  if (!existsSync99(dir))
     return [];
   const out = [];
   for (const name of readdirSync36(dir).sort()) {
@@ -98667,7 +99334,7 @@ function listPendingScheduleEntries(agent, opts = {}) {
     const stageId = name.slice(0, -".meta.json".length);
     const metaPath = join101(dir, name);
     const yamlPath = join101(dir, `${stageId}.yaml`);
-    if (!existsSync98(yamlPath))
+    if (!existsSync99(yamlPath))
       continue;
     try {
       const meta = JSON.parse(readFileSync88(metaPath, "utf-8"));
@@ -98686,10 +99353,10 @@ function commitPendingScheduleEntry(opts) {
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
   const finalPath = join101(paths.scheduleDir, `${slug}.yaml`);
-  if (existsSync98(finalPath)) {
+  if (existsSync99(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
-  renameSync25(match.yamlPath, finalPath);
+  renameSync26(match.yamlPath, finalPath);
   unlinkSync21(match.metaPath);
   return { committed: true, path: finalPath, slug };
 }
@@ -98708,7 +99375,7 @@ function denyPendingScheduleEntry(opts) {
 }
 
 // src/cli/agent-config-write.ts
-import { existsSync as existsSync99, readFileSync as readFileSync89 } from "node:fs";
+import { existsSync as existsSync100, readFileSync as readFileSync89 } from "node:fs";
 import { execFileSync as execFileSync30 } from "node:child_process";
 
 // src/scheduler/schedule-report.ts
@@ -99098,7 +99765,7 @@ function scheduleRemove(opts) {
   }
   let priorContent = null;
   try {
-    if (existsSync99(match.path))
+    if (existsSync100(match.path))
       priorContent = readFileSync89(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
@@ -99302,7 +99969,7 @@ function registerAgentConfigWriteCommands(program3) {
     }
     let blob;
     if (opts.jsonl) {
-      blob = existsSync99(opts.jsonl) ? readFileSync89(opts.jsonl, "utf-8") : "";
+      blob = existsSync100(opts.jsonl) ? readFileSync89(opts.jsonl, "utf-8") : "";
     } else {
       try {
         blob = execFileSync30("docker", ["exec", `switchroom-${agent}`, "cat", "/state/agent/scheduler.jsonl"], {
@@ -99334,7 +100001,7 @@ function registerAgentConfigWriteCommands(program3) {
 
 // src/cli/agent-config-skill-write.ts
 var import_yaml22 = __toESM(require_dist(), 1);
-import { existsSync as existsSync100 } from "node:fs";
+import { existsSync as existsSync101 } from "node:fs";
 init_reconcile_default_skills();
 init_agent_config();
 var import_yaml23 = __toESM(require_dist(), 1);
@@ -99414,7 +100081,7 @@ function skillInstall(opts) {
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
   const skillPath = join102(poolDir, skillName);
-  if (!existsSync100(skillPath)) {
+  if (!existsSync101(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
   const yamlText = import_yaml22.stringify({ skills: [skillName] });
@@ -99577,23 +100244,23 @@ function registerAgentConfigSkillWriteCommands(program3) {
 
 // src/cli/skill.ts
 import {
-  closeSync as closeSync19,
-  existsSync as existsSync101,
+  closeSync as closeSync20,
+  existsSync as existsSync102,
   lstatSync as lstatSync12,
-  mkdirSync as mkdirSync58,
+  mkdirSync as mkdirSync59,
   mkdtempSync as mkdtempSync5,
-  openSync as openSync19,
+  openSync as openSync20,
   readFileSync as readFileSync90,
   readdirSync as readdirSync37,
   realpathSync as realpathSync7,
-  renameSync as renameSync26,
-  rmSync as rmSync18,
+  renameSync as renameSync27,
+  rmSync as rmSync19,
   statSync as statSync54,
   writeFileSync as writeFileSync42
 } from "node:fs";
 import { tmpdir as tmpdir6, homedir as homedir53 } from "node:os";
-import { dirname as dirname39, join as join103, relative as relative4, resolve as resolve58 } from "node:path";
-import { spawnSync as spawnSync18 } from "node:child_process";
+import { dirname as dirname40, join as join103, relative as relative4, resolve as resolve58 } from "node:path";
+import { spawnSync as spawnSync20 } from "node:child_process";
 
 // src/cli/skill-common.ts
 var import_yaml24 = __toESM(require_dist(), 1);
@@ -99886,7 +100553,7 @@ function loadFromDir(dir) {
 function loadFromTarball(tarPath) {
   const isGz = tarPath.endsWith(".gz") || tarPath.endsWith(".tgz");
   const listFlags = isGz ? ["-tzf"] : ["-tf"];
-  const list2 = spawnSync18("tar", [...listFlags, tarPath], {
+  const list2 = spawnSync20("tar", [...listFlags, tarPath], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -99903,7 +100570,7 @@ function loadFromTarball(tarPath) {
   const staging = mkdtempSync5(join103(tmpdir6(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
-    const r = spawnSync18("tar", [
+    const r = spawnSync20("tar", [
       ...flags,
       tarPath,
       "-C",
@@ -99919,7 +100586,7 @@ function loadFromTarball(tarPath) {
     return loadFromDir(staging);
   } finally {
     try {
-      rmSync18(staging, { recursive: true, force: true });
+      rmSync19(staging, { recursive: true, force: true });
     } catch {}
   }
 }
@@ -99978,7 +100645,7 @@ function validatePayload(name, files) {
   if (errors2.length === 0) {
     for (const [path10, content] of Object.entries(files)) {
       if (SH_SCRIPT_RE2.test(path10)) {
-        const r = spawnSync18("bash", ["-n"], {
+        const r = spawnSync20("bash", ["-n"], {
           input: content,
           encoding: "utf-8"
         });
@@ -99990,14 +100657,14 @@ function validatePayload(name, files) {
         const tmpPy = join103(tmp, "check.py");
         try {
           writeFileSync42(tmpPy, content);
-          const r = spawnSync18("python3", ["-m", "py_compile", tmpPy], {
+          const r = spawnSync20("python3", ["-m", "py_compile", tmpPy], {
             encoding: "utf-8"
           });
           if (r.status !== 0) {
             errors2.push(`${path10} fails \`python3 -m py_compile\` syntax check: ${(r.stderr ?? "").trim()}`);
           }
         } finally {
-          rmSync18(tmp, { recursive: true, force: true });
+          rmSync19(tmp, { recursive: true, force: true });
         }
       }
     }
@@ -100007,7 +100674,7 @@ function validatePayload(name, files) {
 function diffSummary(currentDir, files) {
   const lines = [];
   const currentFiles = {};
-  if (existsSync101(currentDir)) {
+  if (existsSync102(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync37(sub, { withFileTypes: true })) {
         const full = join103(sub, ent.name);
@@ -100043,8 +100710,8 @@ function diffSummary(currentDir, files) {
 `);
 }
 function writePayload(poolDir, name, files) {
-  if (!existsSync101(poolDir)) {
-    mkdirSync58(poolDir, { recursive: true, mode: 493 });
+  if (!existsSync102(poolDir)) {
+    mkdirSync59(poolDir, { recursive: true, mode: 493 });
   }
   const target = join103(poolDir, name);
   let targetIsSymlink = false;
@@ -100062,12 +100729,12 @@ function writePayload(poolDir, name, files) {
   try {
     for (const [path10, content] of Object.entries(files)) {
       const full = join103(staging, path10);
-      mkdirSync58(dirname39(full), { recursive: true, mode: 493 });
-      const fd = openSync19(full, "wx");
+      mkdirSync59(dirname40(full), { recursive: true, mode: 493 });
+      const fd = openSync20(full, "wx");
       try {
         writeFileSync42(fd, content);
       } finally {
-        closeSync19(fd);
+        closeSync20(fd);
       }
       if (SH_SCRIPT_RE2.test(path10) || PY_SCRIPT_RE2.test(path10)) {
         const fs7 = __require("node:fs");
@@ -100081,23 +100748,23 @@ function writePayload(poolDir, name, files) {
     } catch {}
     if (targetExists) {
       oldRename = `${target}.skill-apply-old-${Date.now()}`;
-      renameSync26(target, oldRename);
+      renameSync27(target, oldRename);
     }
-    renameSync26(staging, target);
+    renameSync27(staging, target);
     if (oldRename) {
-      rmSync18(oldRename, { recursive: true, force: true });
+      rmSync19(oldRename, { recursive: true, force: true });
       oldRename = null;
     }
   } catch (err2) {
     try {
-      rmSync18(staging, { recursive: true, force: true });
+      rmSync19(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync101(oldRename)) {
+    if (oldRename && existsSync102(oldRename)) {
       try {
-        if (existsSync101(target)) {
-          rmSync18(target, { recursive: true, force: true });
+        if (existsSync102(target)) {
+          rmSync19(target, { recursive: true, force: true });
         }
-        renameSync26(oldRename, target);
+        renameSync27(oldRename, target);
       } catch {}
     }
     throw err2;
@@ -100115,7 +100782,7 @@ function registerSkillCommand(program3) {
       files = loadFromStdin();
     } else {
       const fromPath = resolve58(opts.from);
-      if (!existsSync101(fromPath)) {
+      if (!existsSync102(fromPath)) {
         fail4(`--from path does not exist: ${opts.from}`);
       }
       const st = statSync54(fromPath);
@@ -100153,7 +100820,7 @@ function registerSkillCommand(program3) {
 \u2713 Wrote ${name} to ${currentDir}`));
     const applyBin = process.argv[1] ?? "switchroom";
     console.log(source_default.gray(`Running \`switchroom apply --non-interactive\`...`));
-    const r = spawnSync18(process.argv0, [applyBin, "apply", "--non-interactive"], { stdio: "inherit" });
+    const r = spawnSync20(process.argv0, [applyBin, "apply", "--non-interactive"], { stdio: "inherit" });
     if (r.status !== 0) {
       console.error(source_default.yellow(`(warning: \`switchroom apply\` exited ${r.status} \u2014 skill is ` + `in the pool but symlinks may not be refreshed. Re-run manually.)`));
     }
@@ -100170,23 +100837,23 @@ function sumBytes(files) {
 // src/cli/skill-personal.ts
 init_esm();
 import {
-  closeSync as closeSync20,
-  existsSync as existsSync102,
+  closeSync as closeSync21,
+  existsSync as existsSync103,
   lstatSync as lstatSync13,
-  mkdirSync as mkdirSync59,
+  mkdirSync as mkdirSync60,
   mkdtempSync as mkdtempSync6,
-  openSync as openSync20,
+  openSync as openSync21,
   readFileSync as readFileSync91,
   readdirSync as readdirSync38,
-  renameSync as renameSync27,
-  rmSync as rmSync19,
+  renameSync as renameSync28,
+  rmSync as rmSync20,
   statSync as statSync55,
   utimesSync,
   writeFileSync as writeFileSync43
 } from "node:fs";
-import { dirname as dirname40, join as join104, relative as relative5, resolve as resolve59 } from "node:path";
+import { dirname as dirname41, join as join104, relative as relative5, resolve as resolve59 } from "node:path";
 import { homedir as homedir54, tmpdir as tmpdir7 } from "node:os";
-import { spawnSync as spawnSync19 } from "node:child_process";
+import { spawnSync as spawnSync21 } from "node:child_process";
 init_helpers();
 init_agent_config();
 init_source();
@@ -100197,14 +100864,14 @@ var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
   const candidate = override ? resolve59(override) : join104(homedir54(), ".switchroom-config");
-  if (!existsSync102(candidate))
+  if (!existsSync103(candidate))
     return null;
   return join104(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
   try {
-    if (!existsSync102(configSkillsRoot))
+    if (!existsSync103(configSkillsRoot))
       return;
     const now = Date.now();
     for (const ent of readdirSync38(configSkillsRoot)) {
@@ -100217,7 +100884,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync19(join104(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync20(join104(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -100240,17 +100907,17 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     }
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
-      if (existsSync102(dest)) {
+      if (existsSync103(dest)) {
         const trash = join104(configSkillsRoot, `.${name}-trash-${Date.now()}`);
-        renameSync27(dest, trash);
+        renameSync28(dest, trash);
       }
       return;
     }
-    mkdirSync59(configSkillsRoot, { recursive: true, mode: 493 });
+    mkdirSync60(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
     const staging = mkdtempSync6(join104(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
-      mkdirSync59(dst, { recursive: true, mode: 493 });
+      mkdirSync60(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync38(src, { withFileTypes: true })) {
         const s = join104(src, ent.name);
         const d = join104(dst, ent.name);
@@ -100264,11 +100931,11 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
       }
     };
     walk2(liveSkillDir, staging);
-    if (existsSync102(dest)) {
+    if (existsSync103(dest)) {
       const prior = join104(configSkillsRoot, `.${name}-prior-${Date.now()}`);
-      renameSync27(dest, prior);
+      renameSync28(dest, prior);
     }
-    renameSync27(staging, dest);
+    renameSync28(staging, dest);
   } catch (err2) {
     process.stderr.write(source_default.yellow(`warning: mirror to ${dest} failed (${err2.message ?? err2}); ` + `live copy still works, but this skill is not version-controlled until next successful sync.
 `));
@@ -100305,7 +100972,7 @@ function trashDir(agentsRoot, agent) {
 }
 function countPersonalSkills(agentsRoot, agent) {
   const skillsDir = join104(agentsRoot, agent, ".claude", "skills");
-  if (!existsSync102(skillsDir))
+  if (!existsSync103(skillsDir))
     return 0;
   let n = 0;
   for (const ent of readdirSync38(skillsDir, { withFileTypes: true })) {
@@ -100390,7 +101057,7 @@ function behavioralValidate(files) {
   const errors2 = [];
   for (const [path10, content] of Object.entries(files)) {
     if (SH_SCRIPT_RE.test(path10)) {
-      const r = spawnSync19("bash", ["-n"], { input: content, encoding: "utf-8" });
+      const r = spawnSync21("bash", ["-n"], { input: content, encoding: "utf-8" });
       if (r.status !== 0) {
         errors2.push(`${path10} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
@@ -100399,14 +101066,14 @@ function behavioralValidate(files) {
       const tmpPy = join104(tmp, "check.py");
       try {
         writeFileSync43(tmpPy, content);
-        const r = spawnSync19("python3", ["-m", "py_compile", tmpPy], {
+        const r = spawnSync21("python3", ["-m", "py_compile", tmpPy], {
           encoding: "utf-8"
         });
         if (r.status !== 0) {
           errors2.push(`${path10} fails \`python3 -m py_compile\`: ${(r.stderr ?? "").trim()}`);
         }
       } finally {
-        rmSync19(tmp, { recursive: true, force: true });
+        rmSync20(tmp, { recursive: true, force: true });
       }
     }
   }
@@ -100414,7 +101081,7 @@ function behavioralValidate(files) {
 }
 function sweepTrash(agentsRoot, agent) {
   const trash = trashDir(agentsRoot, agent);
-  if (!existsSync102(trash))
+  if (!existsSync103(trash))
     return;
   const now = Date.now();
   for (const ent of readdirSync38(trash, { withFileTypes: true })) {
@@ -100424,7 +101091,7 @@ function sweepTrash(agentsRoot, agent) {
     try {
       const st = statSync55(entPath);
       if (now - st.mtimeMs > TRASH_TTL_MS) {
-        rmSync19(entPath, { recursive: true, force: true });
+        rmSync20(entPath, { recursive: true, force: true });
       }
     } catch {}
   }
@@ -100440,18 +101107,18 @@ function writePersonalSkill(targetDir, files) {
   if (targetIsSymlink) {
     fail5(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
-  mkdirSync59(dirname40(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join104(dirname40(targetDir), `.skill-personal-stage-`));
+  mkdirSync60(dirname41(targetDir), { recursive: true, mode: 493 });
+  const staging = mkdtempSync6(join104(dirname41(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path10, content] of Object.entries(files)) {
       const full = join104(staging, path10);
-      mkdirSync59(dirname40(full), { recursive: true, mode: 493 });
-      const fd = openSync20(full, "wx");
+      mkdirSync60(dirname41(full), { recursive: true, mode: 493 });
+      const fd = openSync21(full, "wx");
       try {
         writeFileSync43(fd, content);
       } finally {
-        closeSync20(fd);
+        closeSync21(fd);
       }
       if (SH_SCRIPT_RE.test(path10) || PY_SCRIPT_RE.test(path10)) {
         const fs7 = __require("node:fs");
@@ -100465,23 +101132,23 @@ function writePersonalSkill(targetDir, files) {
     } catch {}
     if (targetExists) {
       oldRename = `${targetDir}.personal-old-${Date.now()}`;
-      renameSync27(targetDir, oldRename);
+      renameSync28(targetDir, oldRename);
     }
-    renameSync27(staging, targetDir);
+    renameSync28(staging, targetDir);
     if (oldRename) {
-      rmSync19(oldRename, { recursive: true, force: true });
+      rmSync20(oldRename, { recursive: true, force: true });
       oldRename = null;
     }
   } catch (err2) {
     try {
-      rmSync19(staging, { recursive: true, force: true });
+      rmSync20(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync102(oldRename)) {
+    if (oldRename && existsSync103(oldRename)) {
       try {
-        if (existsSync102(targetDir)) {
-          rmSync19(targetDir, { recursive: true, force: true });
+        if (existsSync103(targetDir)) {
+          rmSync20(targetDir, { recursive: true, force: true });
         }
-        renameSync27(oldRename, targetDir);
+        renameSync28(oldRename, targetDir);
       } catch {}
     }
     throw err2;
@@ -100544,7 +101211,7 @@ function loadFiles(opts) {
     return loadFromStdin2();
   }
   const p = resolve59(opts.from);
-  if (!existsSync102(p)) {
+  if (!existsSync103(p)) {
     fail5(`--from path does not exist: ${opts.from}`);
   }
   const st = statSync55(p);
@@ -100606,7 +101273,7 @@ function resolveCloneSource(source, opts) {
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
   const dir = join104(root, slug);
-  if (!existsSync102(dir)) {
+  if (!existsSync103(dir)) {
     fail5(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
   const st = lstatSync13(dir);
@@ -100730,10 +101397,10 @@ function removePersonalAction(name, opts) {
     throw err2;
   }
   const trashRoot2 = trashDir(agentsRoot, agent);
-  mkdirSync59(trashRoot2, { recursive: true, mode: 493 });
+  mkdirSync60(trashRoot2, { recursive: true, mode: 493 });
   const ts = Date.now();
   const trashTarget = join104(trashRoot2, `${name}-${ts}`);
-  renameSync27(target, trashTarget);
+  renameSync28(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
   mirrorToConfigRepo(agent, name, null);
@@ -100753,7 +101420,7 @@ function listPersonalAction(opts) {
   sweepTrash(agentsRoot, agent);
   const skillsDir = join104(agentsRoot, agent, ".claude", "skills");
   const personal = [];
-  if (existsSync102(skillsDir)) {
+  if (existsSync103(skillsDir)) {
     for (const ent of readdirSync38(skillsDir, { withFileTypes: true })) {
       if (!ent.isDirectory())
         continue;
@@ -100886,7 +101553,7 @@ function registerSelfImproveProposeSkillCommand(program3) {
 init_esm();
 init_helpers();
 var import_yaml25 = __toESM(require_dist(), 1);
-import { existsSync as existsSync103, readdirSync as readdirSync39, readFileSync as readFileSync93, statSync as statSync56 } from "node:fs";
+import { existsSync as existsSync104, readdirSync as readdirSync39, readFileSync as readFileSync93, statSync as statSync56 } from "node:fs";
 import { homedir as homedir56 } from "node:os";
 import { join as join106, resolve as resolve60 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
@@ -100903,7 +101570,7 @@ function defaultBundledRoot2() {
 }
 function readSkillFrontmatter(skillDir) {
   const mdPath = join106(skillDir, "SKILL.md");
-  if (!existsSync103(mdPath))
+  if (!existsSync104(mdPath))
     return null;
   let content;
   try {
@@ -100947,7 +101614,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
   const skillsDir = join106(agentsRoot, agent, ".claude/skills");
-  if (!existsSync103(skillsDir))
+  if (!existsSync104(skillsDir))
     return [];
   const out = [];
   let entries;
@@ -100985,7 +101652,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   return out;
 }
 function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
-  if (!existsSync103(sharedRoot))
+  if (!existsSync104(sharedRoot))
     return [];
   const out = [];
   let entries;
@@ -101023,7 +101690,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
   return out;
 }
 function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
-  if (!existsSync103(bundledRoot))
+  if (!existsSync104(bundledRoot))
     return [];
   const out = [];
   let entries;
@@ -101181,24 +101848,24 @@ init_source();
 init_helpers();
 init_operator_uid();
 import {
-  existsSync as existsSync105,
-  mkdirSync as mkdirSync60,
+  existsSync as existsSync106,
+  mkdirSync as mkdirSync61,
   readdirSync as readdirSync40,
   writeFileSync as writeFileSync44,
   statSync as statSync57,
   lstatSync as lstatSync14,
   realpathSync as realpathSync8,
-  copyFileSync as copyFileSync13
+  copyFileSync as copyFileSync14
 } from "node:fs";
 import { homedir as homedir57 } from "node:os";
 import { join as join107 } from "node:path";
-import { spawnSync as spawnSync22 } from "node:child_process";
+import { spawnSync as spawnSync24 } from "node:child_process";
 
 // src/cli/singleton-stale-cleanup.ts
-import { spawnSync as spawnSync21 } from "node:child_process";
+import { spawnSync as spawnSync23 } from "node:child_process";
 function makeDockerRunner() {
   return (args) => {
-    const r = spawnSync21("docker", args, { encoding: "utf8" });
+    const r = spawnSync23("docker", args, { encoding: "utf8" });
     return {
       ok: r.status === 0,
       stdout: r.stdout ?? "",
@@ -101557,7 +102224,7 @@ function resolveHostdSkillsTarget(hostHome) {
     console.warn(`switchroom hostd install: ~/.switchroom/skills is a symlink whose target ` + `does not resolve (dangling) \u2014 skipping the skills bind mount. Bundled ` + `skills will be unavailable to rollout/update until the symlink is fixed.`);
     return;
   }
-  if (!existsSync105(target)) {
+  if (!existsSync106(target)) {
     console.warn(`switchroom hostd install: ~/.switchroom/skills resolves to "${target}", ` + `which does not exist \u2014 skipping the skills bind mount. Bundled skills ` + `will be unavailable to rollout/update until the symlink target exists.`);
     return;
   }
@@ -101571,15 +102238,15 @@ function hostdComposePath() {
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
-  if (!existsSync105(p))
+  if (!existsSync106(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
-  copyFileSync13(p, bak);
+  copyFileSync14(p, bak);
   return bak;
 }
 function runDocker(args) {
-  const r = spawnSync22("docker", args, { encoding: "utf8" });
+  const r = spawnSync24("docker", args, { encoding: "utf8" });
   return {
     ok: r.status === 0,
     stdout: r.stdout ?? "",
@@ -101604,7 +102271,7 @@ async function doInstall(opts, program3) {
   }
   const dir = hostdDir();
   const composePath = hostdComposePath();
-  mkdirSync60(dir, { recursive: true });
+  mkdirSync61(dir, { recursive: true });
   const imageTag = resolveHostdImageTag(opts.tag, cfg.release);
   const guard = checkDowngrade({
     container: "switchroom-hostd",
@@ -101669,7 +102336,7 @@ function doStatus() {
   const composeYml = hostdComposePath();
   console.log(source_default.bold("switchroom-hostd"));
   console.log("");
-  if (!existsSync105(composeYml)) {
+  if (!existsSync106(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom hostd install` to set up."));
     return;
@@ -101690,14 +102357,14 @@ function doStatus() {
   } else {
     console.log(source_default.green(`  container:  ${ps.stdout.trim()}`));
   }
-  if (existsSync105(dir)) {
+  if (existsSync106(dir)) {
     const entries = [];
     try {
       for (const name of readdirSync40(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
         const sockPath = join107(dir, name, "sock");
-        if (existsSync105(sockPath)) {
+        if (existsSync106(sockPath)) {
           const st = statSync57(sockPath);
           if ((st.mode & 61440) === 49152) {
             entries.push(`${name} \u2192 ${sockPath}`);
@@ -101716,7 +102383,7 @@ function doStatus() {
 }
 function doUninstall() {
   const composeYml = hostdComposePath();
-  if (!existsSync105(composeYml)) {
+  if (!existsSync106(composeYml)) {
     console.log(source_default.yellow("  No hostd install detected (no compose file at this path)."));
     return;
   }
@@ -101740,7 +102407,7 @@ function registerHostdCommand(program3) {
   hostd.command("uninstall").description("Stop the hostd container. Leaves the compose file in place for re-install.").action(() => doUninstall());
   hostd.command("audit").description("Tail and filter the hostd audit log (privileged-verb call history)").option("--tail <n>", "Number of matching entries to show (default: 50)", "50").option("--agent <name>", "Filter to a specific caller agent").option("--op <verb>", "Filter to a specific hostd verb (e.g. update_apply, agent_restart)").option("--error", "Show only failed (error/denied) entries").option("--verbose", "Show the captured stderr / error tail under each failed row").option("--path <file>", "Override audit log path (for debugging)").action((opts) => {
     const logPath = opts.path ?? defaultAuditLogPath2();
-    if (!existsSync105(logPath)) {
+    if (!existsSync106(logPath)) {
       console.error(source_default.yellow(`Audit log not found at ${logPath}.`) + source_default.gray(`
 The log is created when hostd handles its first privileged-verb request.`));
       return;
@@ -101788,10 +102455,10 @@ The log is created when hostd handles its first privileged-verb request.`));
 init_source();
 init_helpers();
 init_operator_uid();
-import { chownSync as chownSync10, existsSync as existsSync106, mkdirSync as mkdirSync61, writeFileSync as writeFileSync45, copyFileSync as copyFileSync14 } from "node:fs";
+import { chownSync as chownSync10, existsSync as existsSync107, mkdirSync as mkdirSync62, writeFileSync as writeFileSync45, copyFileSync as copyFileSync15 } from "node:fs";
 import { homedir as homedir58 } from "node:os";
 import { join as join108 } from "node:path";
-import { spawnSync as spawnSync23 } from "node:child_process";
+import { spawnSync as spawnSync25 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
     return explicitTag;
@@ -101897,15 +102564,15 @@ function webdComposePath() {
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
-  if (!existsSync106(p))
+  if (!existsSync107(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
-  copyFileSync14(p, bak);
+  copyFileSync15(p, bak);
   return bak;
 }
 function runDocker2(args) {
-  const r = spawnSync23("docker", args, { encoding: "utf8" });
+  const r = spawnSync25("docker", args, { encoding: "utf8" });
   return {
     ok: r.status === 0,
     stdout: r.stdout ?? "",
@@ -101922,7 +102589,7 @@ async function doInstall2(opts, program3) {
   }
   const dir = webdDir();
   const composePath = webdComposePath();
-  mkdirSync61(dir, { recursive: true });
+  mkdirSync62(dir, { recursive: true });
   const cfg = getConfig(program3);
   const imageTag = resolveWebImageTag(opts.tag, cfg.release);
   const port = cfg.web_service?.port ?? 8080;
@@ -101999,7 +102666,7 @@ function doStatus2() {
   const composeYml = webdComposePath();
   console.log(source_default.bold("switchroom-web"));
   console.log("");
-  if (!existsSync106(composeYml)) {
+  if (!existsSync107(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom webd install` to set up."));
     return;
@@ -102023,7 +102690,7 @@ function doStatus2() {
 }
 function doUninstall2() {
   const composeYml = webdComposePath();
-  if (!existsSync106(composeYml)) {
+  if (!existsSync107(composeYml)) {
     console.log(source_default.yellow("  No web-service install detected (no compose file at this path)."));
     return;
   }
@@ -102209,7 +102876,7 @@ function applyMountRepairs(items, deps) {
 function registerHostCommand(program3) {
   const host = program3.command("host").description("Host-level maintenance operations for switchroom");
   host.command("repair-mounts").description("Detect and remove known auto-dir artifacts left by a container-context deploy " + "(2026-06-23 outage class). Default: dry-run. Pass --yes to apply.").option("--yes", "Actually perform the removals (default is dry-run)").action(async (opts) => {
-    const { rmdirSync: rmdirSync2, rmSync: rmSync20, lstatSync: lstatSync15, readdirSync: readdirSync41 } = await import("node:fs");
+    const { rmdirSync: rmdirSync2, rmSync: rmSync21, lstatSync: lstatSync15, readdirSync: readdirSync41 } = await import("node:fs");
     const probe2 = {
       lstat(path10) {
         try {
@@ -102268,7 +102935,7 @@ ${safeItems.length} item(s) would be removed. Run with --yes to apply.`));
         rmdirSync2(path10);
       },
       rmRf(path10) {
-        rmSync20(path10, { recursive: true, force: true });
+        rmSync21(path10, { recursive: true, force: true });
       }
     };
     const results = applyMountRepairs(safeItems, applyDeps);
@@ -102298,13 +102965,13 @@ init_helpers();
 init_scan();
 
 // src/fleet-health/gh-sync.ts
-import { spawnSync as spawnSync24 } from "node:child_process";
+import { spawnSync as spawnSync26 } from "node:child_process";
 var LABEL = "fleet-health";
 function defaultGhDeps(log) {
   return {
     log,
     run: (args) => {
-      const r = spawnSync24("gh", args, { encoding: "utf-8" });
+      const r = spawnSync26("gh", args, { encoding: "utf-8" });
       return {
         ok: r.status === 0,
         stdout: (r.stdout ?? "").trim(),
@@ -102509,7 +103176,7 @@ function printDeepDiveBrief(targets) {
 
 // src/cli/hindsight-watch.ts
 init_source();
-import { existsSync as existsSync111, readdirSync as readdirSync45 } from "node:fs";
+import { existsSync as existsSync112, readdirSync as readdirSync45 } from "node:fs";
 import { homedir as homedir62 } from "node:os";
 import { join as join111, resolve as resolve63 } from "node:path";
 
@@ -102579,7 +103246,7 @@ function postOperatorNoticeViaGateways(candidates, text, log, connectTimeoutMs =
 init_install_cron();
 
 // src/hindsight-watch/probe.ts
-import { spawnSync as spawnSync25 } from "node:child_process";
+import { spawnSync as spawnSync27 } from "node:child_process";
 import { readFileSync as readFileSync98, readdirSync as readdirSync44, statSync as statSync59 } from "node:fs";
 import { homedir as homedir61 } from "node:os";
 import { resolve as resolve62 } from "node:path";
@@ -102708,7 +103375,7 @@ function readLlmSignals(series) {
 }
 
 // src/hindsight-watch/recall-log.ts
-import { closeSync as closeSync21, existsSync as existsSync110, openSync as openSync21, readdirSync as readdirSync43, readSync as readSync5, statSync as statSync58 } from "node:fs";
+import { closeSync as closeSync22, existsSync as existsSync111, openSync as openSync22, readdirSync as readdirSync43, readSync as readSync6, statSync as statSync58 } from "node:fs";
 import { join as join110 } from "node:path";
 var RECALL_WINDOW_ROWS = 200;
 var RECALL_MAX_TAIL_BYTES = 1024 * 1024;
@@ -102717,7 +103384,7 @@ function recallLogPath2(agentDir) {
   return join110(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
 }
 function readRecallLogTail2(path10, windowRows = RECALL_WINDOW_ROWS) {
-  if (!existsSync110(path10))
+  if (!existsSync111(path10))
     return [];
   let text;
   let truncatedHead = false;
@@ -102728,10 +103395,10 @@ function readRecallLogTail2(path10, windowRows = RECALL_WINDOW_ROWS) {
     truncatedHead = start > 0;
     const length = size - start;
     const buf = Buffer.alloc(length);
-    fd = openSync21(path10, "r");
+    fd = openSync22(path10, "r");
     let read = 0;
     while (read < length) {
-      const n = readSync5(fd, buf, read, length - read, start + read);
+      const n = readSync6(fd, buf, read, length - read, start + read);
       if (n <= 0)
         break;
       read += n;
@@ -102742,7 +103409,7 @@ function readRecallLogTail2(path10, windowRows = RECALL_WINDOW_ROWS) {
   } finally {
     if (fd !== undefined) {
       try {
-        closeSync21(fd);
+        closeSync22(fd);
       } catch {}
     }
   }
@@ -102929,7 +103596,7 @@ async function probeMetrics(url = DEFAULT_METRICS_URL, fetchImpl = fetch) {
   }
 }
 var defaultRunner4 = (cmd, args) => {
-  const r = spawnSync25(cmd, args, { stdio: "pipe", timeout: 1e4, encoding: "utf8" });
+  const r = spawnSync27(cmd, args, { stdio: "pipe", timeout: 1e4, encoding: "utf8" });
   if (r.error)
     return { status: null, stdout: "", stderr: r.error.message };
   return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
@@ -103749,7 +104416,7 @@ async function notifyOperator(agentsDir, text, log) {
   try {
     for (const name of readdirSync45(agentsDir).sort()) {
       const sock = resolve63(agentsDir, name, "telegram", "gateway.sock");
-      if (existsSync111(sock))
+      if (existsSync112(sock))
         candidates.push({ agent: name, sock });
     }
   } catch (e) {
@@ -103765,13 +104432,13 @@ async function notifyOperator(agentsDir, text, log) {
 
 // src/cli/openrouter-watch.ts
 init_source();
-import { existsSync as existsSync113, readdirSync as readdirSync46 } from "node:fs";
+import { existsSync as existsSync114, readdirSync as readdirSync46 } from "node:fs";
 import { homedir as homedir64 } from "node:os";
 import { join as join112, resolve as resolve65 } from "node:path";
 
 // src/openrouter/install-cron.ts
-import { existsSync as existsSync112, mkdirSync as mkdirSync63, readFileSync as readFileSync99, renameSync as renameSync28, writeFileSync as writeFileSync47 } from "node:fs";
-import { dirname as dirname42 } from "node:path";
+import { existsSync as existsSync113, mkdirSync as mkdirSync64, readFileSync as readFileSync99, renameSync as renameSync29, writeFileSync as writeFileSync47 } from "node:fs";
+import { dirname as dirname43 } from "node:path";
 var CRON_PATH2 = "/etc/cron.d/openrouter-watch";
 var CRON_SCHEDULE2 = "17 * * * *";
 var CRON_LOG_PATH2 = "/var/log/openrouter-watch.log";
@@ -103788,23 +104455,23 @@ function renderCron2(opts) {
 function installCron2(opts) {
   const path10 = opts.path ?? CRON_PATH2;
   const content = renderCron2(opts);
-  if (existsSync112(path10)) {
+  if (existsSync113(path10)) {
     try {
       if (readFileSync99(path10, "utf8") === content) {
         return { status: "unchanged", path: path10, content };
       }
     } catch {}
   }
-  mkdirSync63(dirname42(path10), { recursive: true });
+  mkdirSync64(dirname43(path10), { recursive: true });
   const tmp = `${path10}.${process.pid}.tmp`;
   writeFileSync47(tmp, content, { mode: 420 });
-  renameSync28(tmp, path10);
+  renameSync29(tmp, path10);
   return { status: "installed", path: path10, content };
 }
 // src/openrouter/state.ts
-import { mkdirSync as mkdirSync64, readFileSync as readFileSync100, renameSync as renameSync29, writeFileSync as writeFileSync48 } from "node:fs";
+import { mkdirSync as mkdirSync65, readFileSync as readFileSync100, renameSync as renameSync30, writeFileSync as writeFileSync48 } from "node:fs";
 import { homedir as homedir63 } from "node:os";
-import { dirname as dirname43, resolve as resolve64 } from "node:path";
+import { dirname as dirname44, resolve as resolve64 } from "node:path";
 function defaultStatePath3(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir63()) {
   return resolve64(home2, ".switchroom", "openrouter-watch", "state.json");
 }
@@ -103831,12 +104498,12 @@ function loadState2(path10) {
   return out;
 }
 function saveState2(path10, state) {
-  mkdirSync64(dirname43(path10), { recursive: true, mode: 448 });
+  mkdirSync65(dirname44(path10), { recursive: true, mode: 448 });
   const tmp = `${path10}.${process.pid}.tmp`;
   const payload = { v: 1, ...state };
   writeFileSync48(tmp, JSON.stringify(payload, null, 2) + `
 `, { mode: 384 });
-  renameSync29(tmp, path10);
+  renameSync30(tmp, path10);
 }
 
 // src/openrouter/watch.ts
@@ -104021,7 +104688,7 @@ async function notifyOperator2(agentsDir, text, log) {
   try {
     for (const name of readdirSync46(agentsDir).sort()) {
       const sock = resolve65(agentsDir, name, "telegram", "gateway.sock");
-      if (existsSync113(sock))
+      if (existsSync114(sock))
         candidates.push({ agent: name, sock });
     }
   } catch (e) {