switchroom 0.19.33 → 0.19.35

package/dist/vault/broker/server.js

@@ -4432,6 +4432,7 @@ var init_schema = __esm(() => {
   }).describe("Per-operation LLM override. Every field optional; an unset field (or " + "an omitted op block) inherits the global `hindsight.llm.*`, which is " + "already the engine's fallback — switchroom emits only the vars set.");
   HindsightConfigSchema = exports_external.object({
     gpu: exports_external.boolean().optional().describe("Force GPU passthrough for the hindsight container on (`true`) or off " + "(`false`), overriding host autodetection in BOTH directions. Absent " + "(the default) → autodetect from the persisted host-capabilities " + "verdict (`~/.switchroom/host-capabilities.json`), which enables " + "`--gpus all` only when that file proves BOTH a GPU and the nvidia " + "container toolkit. Set `true` when that verdict is wrong or unreadable " + "and you know the host has a working toolkit — switchroom cannot verify " + "it for you, and `docker run --gpus all` hard-fails container create on " + "a host without one. Set `false` to pin the container to CPU on a GPU " + "host. This is also the declarative opt-out for the recreate-time GPU " + "drop guard (`switchroom memory setup --recreate` refuses to silently " + "turn a GPU container into a CPU one). `--gpu`/`--no-gpu` on `memory " + "setup` override this for a single run."),
+    cp_access_key: exports_external.string().min(1).optional().describe("Access key for the hindsight control-plane DASHBOARD (upstream " + "`HINDSIGHT_CP_ACCESS_KEY`, port 9999). Literal or — strongly preferred " + "— a `vault:` reference such as `vault:hindsight_cp_access_key`, read " + "through the broker at container-launch time. This is the ONLY thing " + "that arms the dashboard's login: upstream's middleware short-circuits " + "to `next()` when the var is unset, so an unset key means the dashboard " + "has no authentication at all, not weak authentication. Because of that, " + "leaving it unset is FAIL-CLOSED: switchroom pins " + "`HINDSIGHT_CP_HOSTNAME=127.0.0.1` so the loginless dashboard is " + "reachable only from the host, and warns. Set this to serve the " + "dashboard on the LAN/tailnet."),
     llm: exports_external.object({
       provider: exports_external.string().min(1).optional().describe("Hindsight LLM provider (upstream `HINDSIGHT_API_LLM_PROVIDER`). " + "Defaults to `claude-code` (subscription-honest, broker-fed OAuth). " + "Any litellm-routable provider the upstream image supports is valid. " + "Serves as the GLOBAL default for every op absent a per-op override."),
       model: exports_external.string().min(1).optional().describe("Hindsight LLM model (upstream `HINDSIGHT_API_LLM_MODEL`). Defaults " + "to HINDSIGHT_DEFAULT_MODEL. Any model your LiteLLM proxy can route " + "is valid, e.g. `openrouter/z-ai/glm-5.2` when routing through the " + "fleet proxy. With provider=claude-code this value is ALSO exported " + "as `ANTHROPIC_MODEL` to the claude subprocess. Serves as the GLOBAL " + "default for every op absent a per-op override."),
@@ -4961,108 +4962,440 @@ var init_atomic = __esm(() => {
   TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
 });
 
-// src/config/merge.ts
-function dedupe(items) {
-  const seen = new Set;
-  const out = [];
-  for (const item of items) {
-    if (seen.has(item))
-      continue;
-    seen.add(item);
-    out.push(item);
+// src/vault/broker/peercred-ffi.ts
+function getPeerCred(fd) {
+  if (process.platform !== "linux")
+    return null;
+  try {
+    const ffi = __require("bun:ffi");
+    const { dlopen, FFIType, ptr } = ffi;
+    const SOL_SOCKET = 1;
+    const SO_PEERCRED = 17;
+    const UCRED_SIZE = 12;
+    const cache = getPeerCred;
+    const lib = cache._lib ?? (() => {
+      const candidates = ["libc.so.6", "libc.so"];
+      const symbolSpec = {
+        getsockopt: {
+          args: [FFIType.i32, FFIType.i32, FFIType.i32, FFIType.ptr, FFIType.ptr],
+          returns: FFIType.i32
+        }
+      };
+      const errors2 = [];
+      for (const name of candidates) {
+        try {
+          const opened = dlopen(name, symbolSpec);
+          cache._lib = opened;
+          return opened;
+        } catch (e) {
+          errors2.push(`${name}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+      }
+      process.stderr.write(`[vault-broker] peercred-ffi: dlopen failed for all libc candidates ` + `(${errors2.join("; ")}); falling back to ss-parsing.
+`);
+      throw new Error("no libc candidate could be opened");
+    })();
+    const credBuf = new ArrayBuffer(UCRED_SIZE);
+    const lenBuf = new Uint32Array(1);
+    lenBuf[0] = UCRED_SIZE;
+    const rc = lib.symbols.getsockopt(fd, SOL_SOCKET, SO_PEERCRED, ptr(credBuf), ptr(lenBuf.buffer));
+    if (rc !== 0)
+      return null;
+    if (lenBuf[0] !== UCRED_SIZE)
+      return null;
+    const view = new DataView(credBuf);
+    return {
+      pid: view.getInt32(0, true),
+      uid: view.getInt32(4, true),
+      gid: view.getInt32(8, true)
+    };
+  } catch {
+    return null;
   }
-  return out;
 }
-function deepMergeJson(base, override) {
-  if (override === undefined)
-    return base;
-  if (base === undefined)
-    return override;
-  if (typeof base !== "object" || base === null || Array.isArray(base) || typeof override !== "object" || override === null || Array.isArray(override)) {
-    return override;
-  }
-  const out = { ...base };
-  for (const [k, v] of Object.entries(override)) {
-    if (k === "__proto__" || k === "constructor" || k === "prototype")
-      continue;
-    out[k] = deepMergeJson(out[k], v);
+
+// src/broker-common/peercred-path.ts
+function matchSocketName(socketPath, patterns, maxNameLen) {
+  if (typeof socketPath !== "string" || socketPath.length === 0)
+    return null;
+  let name = null;
+  for (const re of patterns) {
+    const m = socketPath.match(re);
+    if (m && typeof m[1] === "string") {
+      name = m[1];
+      break;
+    }
   }
-  return out;
+  if (name === null || name.length === 0)
+    return null;
+  if (maxNameLen !== undefined && name.length > maxNameLen)
+    return null;
+  return name;
 }
-function resolveAgentConfig(defaults, profiles, agent) {
-  if (!mergeAgentConfig.suppressDeprecationLogs && !mergeAgentConfig.notifiedWorkerIsolationMove && defaults?.subagents?.worker?.isolation === "worktree") {
-    mergeAgentConfig.notifiedWorkerIsolationMove = true;
-    console.warn("[switchroom] NOTICE: defaults.subagents.worker.isolation moved to the " + "`coding` profile in switchroom 0.6.6 (#682). Agents extending coding " + "still get worktree-isolated workers; other agents would have hard-failed " + "the first time they delegated. See CHANGELOG.");
-  }
-  const name = agent.extends;
-  const profile = name && profiles ? profiles[name] : undefined;
-  if (!profile) {
-    return mergeAgentConfig(defaults, agent);
-  }
-  const { extends: _unused, ...profileWithoutExtends } = profile;
-  const layered = mergeAgentConfig(defaults, profileWithoutExtends);
-  return mergeAgentConfig(layered, agent);
+function parseSocketIdentity(socketPath, spec) {
+  const name = matchSocketName(socketPath, spec.patterns, spec.maxNameLen);
+  if (name === null)
+    return null;
+  const operatorName = spec.operatorName ?? "operator";
+  if (name === operatorName)
+    return { kind: "operator" };
+  if (spec.reservedNames.has(name))
+    return null;
+  return { kind: "agent", name };
 }
-function foldDeprecatedTelegramFields(config) {
-  const c = config;
-  const root = c;
-  const deprecations = [];
-  const hasRoot = root.voice_in !== undefined || root.telegraph !== undefined || root.webhook_sources !== undefined;
-  if (!hasRoot)
-    return { config: c, deprecations };
-  const channels = { ...c.channels ?? {} };
-  const tg = { ...channels.telegram ?? {} };
-  if (root.voice_in !== undefined) {
-    if (tg.voice_in === undefined)
-      tg.voice_in = root.voice_in;
-    deprecations.push("voice_in at the agent root is deprecated; move under channels.telegram.voice_in (#596).");
-  }
-  if (root.telegraph !== undefined) {
-    if (tg.telegraph === undefined)
-      tg.telegraph = root.telegraph;
-    deprecations.push("telegraph at the agent root is deprecated; move under channels.telegram.telegraph (#596).");
+
+// src/vault/broker/peercred.ts
+import { execFileSync } from "node:child_process";
+import { readFileSync, readlinkSync, fstatSync } from "node:fs";
+function socketPathToIdentity(socketPath) {
+  return parseSocketIdentity(socketPath, {
+    patterns: [SOCKET_PATH_AGENT_RE, SOCKET_PATH_AGENT_SUBDIR_RE],
+    reservedNames: RESERVED_AGENT_NAMES
+  });
+}
+function socketPathToAgent(socketPath) {
+  const identity = socketPathToIdentity(socketPath);
+  return identity?.kind === "agent" ? identity.name : null;
+}
+function isReservedAgentName(name) {
+  return RESERVED_AGENT_NAMES.has(name);
+}
+function unlockSocketFor(dataSocketPath) {
+  if (dataSocketPath.endsWith("/sock")) {
+    return dataSocketPath.slice(0, -"/sock".length) + "/unlock";
   }
-  if (root.webhook_sources !== undefined) {
-    if (tg.webhook_sources === undefined)
-      tg.webhook_sources = root.webhook_sources;
-    deprecations.push("webhook_sources at the agent root is deprecated; move under channels.telegram.webhook_sources (#596).");
+  return dataSocketPath.replace(/\.sock$/, ".unlock.sock");
+}
+function parseSsRows(output) {
+  const rows = [];
+  const lines = output.split(`
+`);
+  for (const line of lines) {
+    if (!line.trim() || line.startsWith("Netid"))
+      continue;
+    const tokens = line.split(/\s+/).filter((t) => t.length > 0);
+    if (tokens.length < 8)
+      continue;
+    const localAddr = tokens[4];
+    const localInode = tokens[5];
+    const peerAddr = tokens[6];
+    const peerInode = tokens[7];
+    const usersToken = tokens.slice(8).join(" ");
+    const m = usersToken.match(/users:\(\(".*?",pid=(\d+),fd=\d+\)\)/);
+    const pid = m ? parseInt(m[1], 10) : null;
+    rows.push({ localAddr, localInode, peerAddr, peerInode, pid });
   }
-  channels.telegram = tg;
-  const { voice_in: _vi, telegraph: _tg, webhook_sources: _ws, ...rest } = root;
-  return {
-    config: { ...rest, channels },
-    deprecations
-  };
+  return rows;
 }
-function mergeAgentConfig(defaultsIn, agentIn) {
-  const { config: agent, deprecations: agentDeprecations } = foldDeprecatedTelegramFields(agentIn);
-  const defaultsMigration = defaultsIn ? foldDeprecatedTelegramFields(defaultsIn) : null;
-  const defaults = defaultsMigration?.config;
-  const allDeprecations = [
-    ...agentDeprecations,
-    ...defaultsMigration?.deprecations ?? []
-  ];
-  if (allDeprecations.length > 0 && !mergeAgentConfig.suppressDeprecationLogs) {
-    for (const msg of allDeprecations) {
-      console.warn(`[switchroom] DEPRECATION: ${msg}`);
+function findClientPids(rows, socketPath) {
+  const pids = [];
+  for (const serverRow of rows) {
+    if (serverRow.localAddr !== socketPath)
+      continue;
+    for (const clientRow of rows) {
+      if (clientRow.localAddr !== "*")
+        continue;
+      if (clientRow.localInode !== serverRow.peerInode)
+        continue;
+      if (clientRow.pid === null)
+        continue;
+      pids.push(clientRow.pid);
+      break;
     }
   }
-  if (!defaults)
-    return agent;
-  const merged = { ...agent };
-  if (defaults.bot_token !== undefined && merged.bot_token === undefined) {
-    merged.bot_token = defaults.bot_token;
-  }
-  if (defaults.timezone !== undefined && merged.timezone === undefined) {
-    merged.timezone = defaults.timezone;
+  return pids;
+}
+function findClientPidByServerInode(rows, socketPath, serverInode) {
+  const serverInodeStr = String(serverInode);
+  for (const serverRow of rows) {
+    if (serverRow.localAddr !== socketPath)
+      continue;
+    if (serverRow.localInode !== serverInodeStr)
+      continue;
+    for (const clientRow of rows) {
+      if (clientRow.localAddr !== "*")
+        continue;
+      if (clientRow.localInode !== serverRow.peerInode)
+        continue;
+      if (clientRow.pid === null)
+        continue;
+      return clientRow.pid;
+    }
+    return null;
   }
-  if (defaults.model !== undefined && merged.model === undefined) {
-    merged.model = defaults.model;
+  return null;
+}
+function readUid(pid) {
+  try {
+    const status = readFileSync(`/proc/${pid}/status`, "utf8");
+    const m = status.match(/^Uid:\s+(\d+)/m);
+    if (!m)
+      return null;
+    return parseInt(m[1], 10);
+  } catch {
+    return null;
   }
-  if (defaults.dangerous_mode !== undefined && merged.dangerous_mode === undefined) {
-    merged.dangerous_mode = defaults.dangerous_mode;
+}
+function readExe(pid) {
+  try {
+    return readlinkSync(`/proc/${pid}/exe`);
+  } catch {
+    return null;
   }
-  if (defaults.network_isolation !== undefined && merged.network_isolation === undefined) {
+}
+function readSystemdUnit(pid) {
+  try {
+    const content = readFileSync(`/proc/${pid}/cgroup`, "utf8");
+    const lines = content.split(`
+`);
+    for (const line of lines) {
+      if (!line.trim())
+        continue;
+      const parts = line.split(":");
+      if (parts.length < 3)
+        continue;
+      const controller = parts[1];
+      const isV2 = parts[0] === "0" && controller === "";
+      const isV1Systemd = controller === "name=systemd";
+      if (!isV2 && !isV1Systemd)
+        continue;
+      const cgroupPath = parts.slice(2).join(":");
+      const segments = cgroupPath.split("/");
+      const lastSegment = segments[segments.length - 1];
+      if (!lastSegment)
+        continue;
+      if (/^switchroom-[a-zA-Z0-9_-]+(-cron-\d+)?\.service$/.test(lastSegment)) {
+        return lastSegment;
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function verifySystemdUnit(unitName, runner) {
+  let raw;
+  try {
+    const out = runner("systemctl", [
+      "--user",
+      "show",
+      unitName,
+      "--property=LoadState,ActiveState"
+    ], { timeout: 500, encoding: "utf8" });
+    raw = typeof out === "string" ? out : out.toString("utf8");
+  } catch {
+    return false;
+  }
+  const props = {};
+  for (const line of raw.split(`
+`)) {
+    const m = line.match(/^([A-Za-z]+)=(.*)$/);
+    if (m)
+      props[m[1]] = m[2];
+  }
+  if (props.LoadState !== "loaded")
+    return false;
+  if (props.ActiveState !== "active" && props.ActiveState !== "activating") {
+    return false;
+  }
+  return true;
+}
+function readFdInode(fd) {
+  try {
+    const stat = fstatSync(fd);
+    return stat.ino;
+  } catch {
+    return null;
+  }
+}
+function fdFromSocket(socket) {
+  const handle = socket._handle;
+  if (!handle || typeof handle.fd !== "number" || handle.fd < 0)
+    return null;
+  return handle.fd;
+}
+function identify(socketPath, socket, execFileSyncOverride) {
+  if (process.platform !== "linux") {
+    return null;
+  }
+  const runner = execFileSyncOverride ?? execFileSync;
+  let pid = null;
+  if (socket !== undefined) {
+    const fd = fdFromSocket(socket);
+    if (fd !== null) {
+      const cred = getPeerCred(fd);
+      if (cred !== null)
+        pid = cred.pid;
+    }
+  }
+  if (pid === null) {
+    let ssOutput;
+    try {
+      const raw = runner("ss", ["-xpn"], {
+        timeout: 200,
+        encoding: "utf8"
+      });
+      ssOutput = typeof raw === "string" ? raw : raw.toString("utf8");
+    } catch {
+      return null;
+    }
+    const rows = parseSsRows(ssOutput);
+    let serverInode = null;
+    if (socket !== undefined) {
+      const fd = fdFromSocket(socket);
+      if (fd !== null)
+        serverInode = readFdInode(fd);
+    }
+    if (serverInode !== null) {
+      pid = findClientPidByServerInode(rows, socketPath, serverInode);
+    } else {
+      const clientPids = findClientPids(rows, socketPath);
+      if (clientPids.length === 0)
+        return null;
+      if (clientPids.length > 1) {
+        process.stderr.write(`[vault-broker] peercred: ${clientPids.length} connected peers found for ${socketPath}; ` + `using pid=${clientPids[0]}. ` + `Multiple simultaneous connections reduce identification accuracy. ` + `(This warning means identify() was called without a socket arg — likely a stale call site.)
+`);
+      }
+      pid = clientPids[0];
+    }
+  }
+  if (pid === null)
+    return null;
+  const uid = readUid(pid);
+  if (uid === null) {
+    return null;
+  }
+  const brokerUid = typeof process.getuid === "function" ? process.getuid() : null;
+  if (brokerUid !== null && uid !== brokerUid) {
+    process.stderr.write(`[vault-broker] peercred: UID mismatch — caller uid=${uid}, broker uid=${brokerUid}; denying
+`);
+    return null;
+  }
+  const exe = readExe(pid);
+  if (exe === null) {
+    return null;
+  }
+  const cgroupClaim = readSystemdUnit(pid);
+  let systemdUnit = null;
+  if (cgroupClaim !== null) {
+    if (verifySystemdUnit(cgroupClaim, runner)) {
+      systemdUnit = cgroupClaim;
+    } else {
+      process.stderr.write(`[vault-broker] peercred: cgroup claims unit=${cgroupClaim} but systemd-user does not report it as loaded+running; treating caller as unidentified
+`);
+    }
+  }
+  return { uid, pid, exe, systemdUnit };
+}
+var SOCKET_PATH_AGENT_RE, SOCKET_PATH_AGENT_SUBDIR_RE, RESERVED_AGENT_NAMES;
+var init_peercred = __esm(() => {
+  SOCKET_PATH_AGENT_RE = /^\/run\/switchroom\/broker\/([a-zA-Z0-9][a-zA-Z0-9_-]*)\.sock$/;
+  SOCKET_PATH_AGENT_SUBDIR_RE = /^\/run\/switchroom\/broker\/([a-zA-Z0-9][a-zA-Z0-9_-]*)\/sock$/;
+  RESERVED_AGENT_NAMES = new Set(["operator", "hostd"]);
+});
+
+// src/config/merge.ts
+function dedupe(items) {
+  const seen = new Set;
+  const out = [];
+  for (const item of items) {
+    if (seen.has(item))
+      continue;
+    seen.add(item);
+    out.push(item);
+  }
+  return out;
+}
+function deepMergeJson(base, override) {
+  if (override === undefined)
+    return base;
+  if (base === undefined)
+    return override;
+  if (typeof base !== "object" || base === null || Array.isArray(base) || typeof override !== "object" || override === null || Array.isArray(override)) {
+    return override;
+  }
+  const out = { ...base };
+  for (const [k, v] of Object.entries(override)) {
+    if (k === "__proto__" || k === "constructor" || k === "prototype")
+      continue;
+    out[k] = deepMergeJson(out[k], v);
+  }
+  return out;
+}
+function resolveAgentConfig(defaults, profiles, agent) {
+  if (!mergeAgentConfig.suppressDeprecationLogs && !mergeAgentConfig.notifiedWorkerIsolationMove && defaults?.subagents?.worker?.isolation === "worktree") {
+    mergeAgentConfig.notifiedWorkerIsolationMove = true;
+    console.warn("[switchroom] NOTICE: defaults.subagents.worker.isolation moved to the " + "`coding` profile in switchroom 0.6.6 (#682). Agents extending coding " + "still get worktree-isolated workers; other agents would have hard-failed " + "the first time they delegated. See CHANGELOG.");
+  }
+  const name = agent.extends;
+  const profile = name && profiles ? profiles[name] : undefined;
+  if (!profile) {
+    return mergeAgentConfig(defaults, agent);
+  }
+  const { extends: _unused, ...profileWithoutExtends } = profile;
+  const layered = mergeAgentConfig(defaults, profileWithoutExtends);
+  return mergeAgentConfig(layered, agent);
+}
+function foldDeprecatedTelegramFields(config) {
+  const c = config;
+  const root = c;
+  const deprecations = [];
+  const hasRoot = root.voice_in !== undefined || root.telegraph !== undefined || root.webhook_sources !== undefined;
+  if (!hasRoot)
+    return { config: c, deprecations };
+  const channels = { ...c.channels ?? {} };
+  const tg = { ...channels.telegram ?? {} };
+  if (root.voice_in !== undefined) {
+    if (tg.voice_in === undefined)
+      tg.voice_in = root.voice_in;
+    deprecations.push("voice_in at the agent root is deprecated; move under channels.telegram.voice_in (#596).");
+  }
+  if (root.telegraph !== undefined) {
+    if (tg.telegraph === undefined)
+      tg.telegraph = root.telegraph;
+    deprecations.push("telegraph at the agent root is deprecated; move under channels.telegram.telegraph (#596).");
+  }
+  if (root.webhook_sources !== undefined) {
+    if (tg.webhook_sources === undefined)
+      tg.webhook_sources = root.webhook_sources;
+    deprecations.push("webhook_sources at the agent root is deprecated; move under channels.telegram.webhook_sources (#596).");
+  }
+  channels.telegram = tg;
+  const { voice_in: _vi, telegraph: _tg, webhook_sources: _ws, ...rest } = root;
+  return {
+    config: { ...rest, channels },
+    deprecations
+  };
+}
+function mergeAgentConfig(defaultsIn, agentIn) {
+  const { config: agent, deprecations: agentDeprecations } = foldDeprecatedTelegramFields(agentIn);
+  const defaultsMigration = defaultsIn ? foldDeprecatedTelegramFields(defaultsIn) : null;
+  const defaults = defaultsMigration?.config;
+  const allDeprecations = [
+    ...agentDeprecations,
+    ...defaultsMigration?.deprecations ?? []
+  ];
+  if (allDeprecations.length > 0 && !mergeAgentConfig.suppressDeprecationLogs) {
+    for (const msg of allDeprecations) {
+      console.warn(`[switchroom] DEPRECATION: ${msg}`);
+    }
+  }
+  if (!defaults)
+    return agent;
+  const merged = { ...agent };
+  if (defaults.bot_token !== undefined && merged.bot_token === undefined) {
+    merged.bot_token = defaults.bot_token;
+  }
+  if (defaults.timezone !== undefined && merged.timezone === undefined) {
+    merged.timezone = defaults.timezone;
+  }
+  if (defaults.model !== undefined && merged.model === undefined) {
+    merged.model = defaults.model;
+  }
+  if (defaults.dangerous_mode !== undefined && merged.dangerous_mode === undefined) {
+    merged.dangerous_mode = defaults.dangerous_mode;
+  }
+  if (defaults.network_isolation !== undefined && merged.network_isolation === undefined) {
     merged.network_isolation = defaults.network_isolation;
   }
   if (defaults.thinking_effort !== undefined && merged.thinking_effort === undefined) {
@@ -18310,617 +18643,1070 @@ var require_lib = __commonJS((exports, module) => {
   }
 });
 
-// src/vault/broker/server.ts
-import * as net from "node:net";
-import { mkdirSync as mkdirSync8, chmodSync as chmodSync5, chownSync as chownSync2, existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync5, statSync as statSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync5 } from "node:fs";
-
-// src/agents/compose.ts
-init_schema();
-
-// src/agents/scaffold.ts
-import { dirname as dirname2, isAbsolute, join as join4, relative, resolve as resolve6 } from "node:path";
-init_atomic();
-
-// src/agents/agent-uid.ts
-import { createHash } from "node:crypto";
-
-// src/vault/broker/peercred.ts
-import { execFileSync } from "node:child_process";
-import { readFileSync, readlinkSync, fstatSync } from "node:fs";
-
-// src/vault/broker/peercred-ffi.ts
-function getPeerCred(fd) {
-  if (process.platform !== "linux")
-    return null;
+// src/vault/flock.ts
+import {
+  existsSync as existsSync5,
+  openSync as openSync2,
+  closeSync as closeSync2,
+  writeSync as writeSync2,
+  fsyncSync as fsyncSync2,
+  unlinkSync,
+  readFileSync as readFileSync5,
+  readdirSync as readdirSync3,
+  rmdirSync,
+  statSync as statSync3,
+  constants as fsConstants
+} from "node:fs";
+function lockPathFor(vaultPath) {
+  return `${vaultPath}.lock`;
+}
+function readLockHolder(lockPath) {
   try {
-    const ffi = __require("bun:ffi");
-    const { dlopen, FFIType, ptr } = ffi;
-    const SOL_SOCKET = 1;
-    const SO_PEERCRED = 17;
-    const UCRED_SIZE = 12;
-    const cache = getPeerCred;
-    const lib = cache._lib ?? (() => {
-      const candidates = ["libc.so.6", "libc.so"];
-      const symbolSpec = {
-        getsockopt: {
-          args: [FFIType.i32, FFIType.i32, FFIType.i32, FFIType.ptr, FFIType.ptr],
-          returns: FFIType.i32
-        }
-      };
-      const errors2 = [];
-      for (const name of candidates) {
-        try {
-          const opened = dlopen(name, symbolSpec);
-          cache._lib = opened;
-          return opened;
-        } catch (e) {
-          errors2.push(`${name}: ${e instanceof Error ? e.message : String(e)}`);
-        }
-      }
-      process.stderr.write(`[vault-broker] peercred-ffi: dlopen failed for all libc candidates ` + `(${errors2.join("; ")}); falling back to ss-parsing.
+    const raw = readFileSync5(lockPath, "utf8");
+    const lines = raw.split(`
 `);
-      throw new Error("no libc candidate could be opened");
-    })();
-    const credBuf = new ArrayBuffer(UCRED_SIZE);
-    const lenBuf = new Uint32Array(1);
-    lenBuf[0] = UCRED_SIZE;
-    const rc = lib.symbols.getsockopt(fd, SOL_SOCKET, SO_PEERCRED, ptr(credBuf), ptr(lenBuf.buffer));
-    if (rc !== 0)
+    const pid = Number.parseInt(lines[0] ?? "", 10);
+    const acquiredAtMs = Number.parseInt(lines[1] ?? "", 10);
+    if (!Number.isFinite(pid) || pid <= 0)
       return null;
-    if (lenBuf[0] !== UCRED_SIZE)
+    if (!Number.isFinite(acquiredAtMs) || acquiredAtMs <= 0)
       return null;
-    const view = new DataView(credBuf);
-    return {
-      pid: view.getInt32(0, true),
-      uid: view.getInt32(4, true),
-      gid: view.getInt32(8, true)
-    };
+    return { pid, acquiredAtMs, argv0: lines[2] ?? "" };
   } catch {
     return null;
   }
 }
-
-// src/broker-common/peercred-path.ts
-function matchSocketName(socketPath, patterns, maxNameLen) {
-  if (typeof socketPath !== "string" || socketPath.length === 0)
-    return null;
-  let name = null;
-  for (const re of patterns) {
-    const m = socketPath.match(re);
-    if (m && typeof m[1] === "string") {
-      name = m[1];
-      break;
-    }
+function pidIsLive(pid) {
+  if (process.platform === "linux") {
+    return existsSync5(`/proc/${pid}`);
   }
-  if (name === null || name.length === 0)
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function parseProcStartTimeMs(statLine, procStat, now) {
+  const tailStart = statLine.lastIndexOf(")");
+  if (tailStart < 0)
     return null;
-  if (maxNameLen !== undefined && name.length > maxNameLen)
+  const tokens = statLine.slice(tailStart + 1).trim().split(/\s+/);
+  const starttimeTicks = Number.parseInt(tokens[19] ?? "", 10);
+  if (!Number.isFinite(starttimeTicks))
     return null;
-  return name;
-}
-function parseSocketIdentity(socketPath, spec) {
-  const name = matchSocketName(socketPath, spec.patterns, spec.maxNameLen);
-  if (name === null)
+  const btimeMatch = procStat.match(/^btime\s+(\d+)/m);
+  if (!btimeMatch)
     return null;
-  const operatorName = spec.operatorName ?? "operator";
-  if (name === operatorName)
-    return { kind: "operator" };
-  if (spec.reservedNames.has(name))
+  const bootEpochSec = Number.parseInt(btimeMatch[1], 10);
+  if (!Number.isFinite(bootEpochSec))
     return null;
-  return { kind: "agent", name };
-}
-
-// src/vault/broker/peercred.ts
-var SOCKET_PATH_AGENT_RE = /^\/run\/switchroom\/broker\/([a-zA-Z0-9][a-zA-Z0-9_-]*)\.sock$/;
-var SOCKET_PATH_AGENT_SUBDIR_RE = /^\/run\/switchroom\/broker\/([a-zA-Z0-9][a-zA-Z0-9_-]*)\/sock$/;
-var RESERVED_AGENT_NAMES = new Set(["operator", "hostd"]);
-function socketPathToIdentity(socketPath) {
-  return parseSocketIdentity(socketPath, {
-    patterns: [SOCKET_PATH_AGENT_RE, SOCKET_PATH_AGENT_SUBDIR_RE],
-    reservedNames: RESERVED_AGENT_NAMES
-  });
-}
-function socketPathToAgent(socketPath) {
-  const identity = socketPathToIdentity(socketPath);
-  return identity?.kind === "agent" ? identity.name : null;
-}
-function isReservedAgentName(name) {
-  return RESERVED_AGENT_NAMES.has(name);
-}
-function unlockSocketFor(dataSocketPath) {
-  if (dataSocketPath.endsWith("/sock")) {
-    return dataSocketPath.slice(0, -"/sock".length) + "/unlock";
-  }
-  return dataSocketPath.replace(/\.sock$/, ".unlock.sock");
-}
-function parseSsRows(output) {
-  const rows = [];
-  const lines = output.split(`
-`);
-  for (const line of lines) {
-    if (!line.trim() || line.startsWith("Netid"))
-      continue;
-    const tokens = line.split(/\s+/).filter((t) => t.length > 0);
-    if (tokens.length < 8)
-      continue;
-    const localAddr = tokens[4];
-    const localInode = tokens[5];
-    const peerAddr = tokens[6];
-    const peerInode = tokens[7];
-    const usersToken = tokens.slice(8).join(" ");
-    const m = usersToken.match(/users:\(\(".*?",pid=(\d+),fd=\d+\)\)/);
-    const pid = m ? parseInt(m[1], 10) : null;
-    rows.push({ localAddr, localInode, peerAddr, peerInode, pid });
-  }
-  return rows;
-}
-function findClientPids(rows, socketPath) {
-  const pids = [];
-  for (const serverRow of rows) {
-    if (serverRow.localAddr !== socketPath)
-      continue;
-    for (const clientRow of rows) {
-      if (clientRow.localAddr !== "*")
-        continue;
-      if (clientRow.localInode !== serverRow.peerInode)
-        continue;
-      if (clientRow.pid === null)
-        continue;
-      pids.push(clientRow.pid);
-      break;
-    }
-  }
-  return pids;
-}
-function findClientPidByServerInode(rows, socketPath, serverInode) {
-  const serverInodeStr = String(serverInode);
-  for (const serverRow of rows) {
-    if (serverRow.localAddr !== socketPath)
-      continue;
-    if (serverRow.localInode !== serverInodeStr)
-      continue;
-    for (const clientRow of rows) {
-      if (clientRow.localAddr !== "*")
-        continue;
-      if (clientRow.localInode !== serverRow.peerInode)
-        continue;
-      if (clientRow.pid === null)
-        continue;
-      return clientRow.pid;
-    }
+  const USER_HZ = 100;
+  const startEpochMs = bootEpochSec * 1000 + starttimeTicks / USER_HZ * 1000;
+  const bootEpochMs = bootEpochSec * 1000;
+  const SLOP_MS = 5000;
+  if (startEpochMs < bootEpochMs - SLOP_MS || startEpochMs > now + SLOP_MS) {
     return null;
   }
-  return null;
+  return Math.floor(startEpochMs);
 }
-function readUid(pid) {
+function pidStartTimeMs(pid) {
+  if (process.platform !== "linux")
+    return null;
   try {
-    const status = readFileSync(`/proc/${pid}/status`, "utf8");
-    const m = status.match(/^Uid:\s+(\d+)/m);
-    if (!m)
-      return null;
-    return parseInt(m[1], 10);
+    const statLine = readFileSync5(`/proc/${pid}/stat`, "utf8");
+    const procStat = readFileSync5("/proc/stat", "utf8");
+    return parseProcStartTimeMs(statLine, procStat, Date.now());
   } catch {
     return null;
   }
 }
-function readExe(pid) {
+function pidIsOriginalHolder(holder) {
+  const startMs = pidStartTimeMs(holder.pid);
+  if (startMs === null)
+    return true;
+  return startMs <= holder.acquiredAtMs + 100;
+}
+function lockFileMtimeIsOlderThan(lockPath, budgetMs) {
   try {
-    return readlinkSync(`/proc/${pid}/exe`);
+    const s = statSync3(lockPath);
+    const threshold = Math.max(STALE_MTIME_FLOOR_MS, budgetMs * 2);
+    return Date.now() - s.mtimeMs > threshold;
   } catch {
-    return null;
+    return false;
   }
 }
-function readSystemdUnit(pid) {
+function clearStaleSentinelDir(lockPath) {
   try {
-    const content = readFileSync(`/proc/${pid}/cgroup`, "utf8");
-    const lines = content.split(`
-`);
-    for (const line of lines) {
-      if (!line.trim())
-        continue;
-      const parts = line.split(":");
-      if (parts.length < 3)
-        continue;
-      const controller = parts[1];
-      const isV2 = parts[0] === "0" && controller === "";
-      const isV1Systemd = controller === "name=systemd";
-      if (!isV2 && !isV1Systemd)
-        continue;
-      const cgroupPath = parts.slice(2).join(":");
-      const segments = cgroupPath.split("/");
-      const lastSegment = segments[segments.length - 1];
-      if (!lastSegment)
-        continue;
-      if (/^switchroom-[a-zA-Z0-9_-]+(-cron-\d+)?\.service$/.test(lastSegment)) {
-        return lastSegment;
-      }
+    if (!existsSync5(lockPath))
+      return true;
+    const s = statSync3(lockPath);
+    if (!s.isDirectory())
+      return true;
+    const now = Date.now();
+    for (const entry of readdirSync3(lockPath)) {
+      try {
+        const childStat = statSync3(`${lockPath}/${entry}`);
+        if (now - childStat.mtimeMs < SENTINEL_DIR_RECENT_WRITE_MS) {
+          return false;
+        }
+      } catch {}
     }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function verifySystemdUnit(unitName, runner) {
-  let raw;
-  try {
-    const out = runner("systemctl", [
-      "--user",
-      "show",
-      unitName,
-      "--property=LoadState,ActiveState"
-    ], { timeout: 500, encoding: "utf8" });
-    raw = typeof out === "string" ? out : out.toString("utf8");
+    for (const entry of readdirSync3(lockPath)) {
+      try {
+        unlinkSync(`${lockPath}/${entry}`);
+      } catch {}
+    }
+    rmdirSync(lockPath);
+    return true;
   } catch {
     return false;
   }
-  const props = {};
-  for (const line of raw.split(`
-`)) {
-    const m = line.match(/^([A-Za-z]+)=(.*)$/);
-    if (m)
-      props[m[1]] = m[2];
-  }
-  if (props.LoadState !== "loaded")
-    return false;
-  if (props.ActiveState !== "active" && props.ActiveState !== "activating") {
-    return false;
-  }
-  return true;
-}
-function readFdInode(fd) {
-  try {
-    const stat = fstatSync(fd);
-    return stat.ino;
-  } catch {
-    return null;
-  }
-}
-function fdFromSocket(socket) {
-  const handle = socket._handle;
-  if (!handle || typeof handle.fd !== "number" || handle.fd < 0)
-    return null;
-  return handle.fd;
 }
-function identify(socketPath, socket, execFileSyncOverride) {
-  if (process.platform !== "linux") {
-    return null;
-  }
-  const runner = execFileSyncOverride ?? execFileSync;
-  let pid = null;
-  if (socket !== undefined) {
-    const fd = fdFromSocket(socket);
-    if (fd !== null) {
-      const cred = getPeerCred(fd);
-      if (cred !== null)
-        pid = cred.pid;
+function acquireLock(vaultPath, options = {}) {
+  const budgetMs = options.budgetMs ?? DEFAULT_LOCK_RETRY_MS;
+  const lockPath = lockPathFor(vaultPath);
+  const deadline = Date.now() + budgetMs;
+  const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
+  while (true) {
+    let fd = null;
+    try {
+      fd = openSync2(lockPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
+    } catch (err) {
+      const code = err?.code ?? "";
+      if (code === "EEXIST") {
+        let isDir = false;
+        try {
+          isDir = statSync3(lockPath).isDirectory();
+        } catch {}
+        if (isDir) {
+          if (clearStaleSentinelDir(lockPath))
+            continue;
+        }
+        const holder = readLockHolder(lockPath);
+        const isDeadPid = holder !== null && !pidIsLive(holder.pid);
+        const isReusedPid = holder !== null && pidIsLive(holder.pid) && !pidIsOriginalHolder(holder);
+        const isUnparseableAndOld = holder === null && lockFileMtimeIsOlderThan(lockPath, budgetMs);
+        if (isDeadPid || isReusedPid || isUnparseableAndOld) {
+          try {
+            unlinkSync(lockPath);
+          } catch {}
+          continue;
+        }
+        if (Date.now() >= deadline) {
+          throw makeBusyError(vaultPath, lockPath, holder, budgetMs);
+        }
+        Atomics.wait(sleepBuf, 0, 0, 100);
+        continue;
+      } else {
+        throw err;
+      }
     }
-  }
-  if (pid === null) {
-    let ssOutput;
     try {
-      const raw = runner("ss", ["-xpn"], {
-        timeout: 200,
-        encoding: "utf8"
-      });
-      ssOutput = typeof raw === "string" ? raw : raw.toString("utf8");
+      const meta = `${process.pid}
+${Date.now()}
+${process.argv[1] ?? ""}
+`;
+      writeSync2(fd, meta);
+      fsyncSync2(fd);
     } catch {
-      return null;
-    }
-    const rows = parseSsRows(ssOutput);
-    let serverInode = null;
-    if (socket !== undefined) {
-      const fd = fdFromSocket(socket);
-      if (fd !== null)
-        serverInode = readFdInode(fd);
+      try {
+        closeSync2(fd);
+      } catch {}
+      try {
+        unlinkSync(lockPath);
+      } catch {}
+      throw new Error(`vault flock: failed to write holder metadata to ${lockPath}`);
     }
-    if (serverInode !== null) {
-      pid = findClientPidByServerInode(rows, socketPath, serverInode);
-    } else {
-      const clientPids = findClientPids(rows, socketPath);
-      if (clientPids.length === 0)
-        return null;
-      if (clientPids.length > 1) {
-        process.stderr.write(`[vault-broker] peercred: ${clientPids.length} connected peers found for ${socketPath}; ` + `using pid=${clientPids[0]}. ` + `Multiple simultaneous connections reduce identification accuracy. ` + `(This warning means identify() was called without a socket arg — likely a stale call site.)
-`);
+    const ownedFd = fd;
+    return {
+      release: () => {
+        try {
+          closeSync2(ownedFd);
+        } catch {}
+        try {
+          unlinkSync(lockPath);
+        } catch {}
       }
-      pid = clientPids[0];
-    }
-  }
-  if (pid === null)
-    return null;
-  const uid = readUid(pid);
-  if (uid === null) {
-    return null;
-  }
-  const brokerUid = typeof process.getuid === "function" ? process.getuid() : null;
-  if (brokerUid !== null && uid !== brokerUid) {
-    process.stderr.write(`[vault-broker] peercred: UID mismatch — caller uid=${uid}, broker uid=${brokerUid}; denying
-`);
-    return null;
-  }
-  const exe = readExe(pid);
-  if (exe === null) {
-    return null;
-  }
-  const cgroupClaim = readSystemdUnit(pid);
-  let systemdUnit = null;
-  if (cgroupClaim !== null) {
-    if (verifySystemdUnit(cgroupClaim, runner)) {
-      systemdUnit = cgroupClaim;
-    } else {
-      process.stderr.write(`[vault-broker] peercred: cgroup claims unit=${cgroupClaim} but systemd-user does not report it as loaded+running; treating caller as unidentified
-`);
-    }
+    };
   }
-  return { uid, pid, exe, systemdUnit };
 }
-
-// src/agents/agent-uid.ts
-var AGENT_UID_MIN = 10001;
-var AGENT_UID_MAX = 10999;
-function allocateAgentUid(name) {
-  if (isReservedAgentName(name)) {
-    throw new Error(`agent name '${name}' is reserved by switchroom for another identity kind ` + `(see vault/broker/peercred.ts:RESERVED_AGENT_NAMES). Pick a different name.`);
-  }
-  const hash = createHash("sha256").update(name).digest();
-  const u32 = hash.readUInt32BE(0);
-  const range = AGENT_UID_MAX - AGENT_UID_MIN + 1;
-  return AGENT_UID_MIN + u32 % range;
+function makeBusyError(vaultPath, lockPath, holder, budgetMs) {
+  const holderPid = holder?.pid ?? null;
+  const heldForMs = holder ? Date.now() - holder.acquiredAtMs : null;
+  const holderClause = holder ? `held by pid ${holder.pid} (acquired ${Math.round((heldForMs ?? 0) / 1000)}s ago)` : "held by another writer (holder PID unreadable — lock file empty or unparseable)";
+  return new VaultBusyError(`vault busy: ${holderClause} at ${lockPath} (retried for ${budgetMs}ms). ` + `Try again in a moment. If the holder process is gone, the next acquirer ` + `will clear the stale lock automatically.`, { vaultPath, lockPath, holderPid, heldForMs, budgetMs });
 }
+var DEFAULT_LOCK_RETRY_MS = 5000, STALE_MTIME_FLOOR_MS = 1e4, SENTINEL_DIR_RECENT_WRITE_MS = 60000, VaultBusyError;
+var init_flock = __esm(() => {
+  VaultBusyError = class VaultBusyError extends Error {
+    vaultPath;
+    lockPath;
+    holderPid;
+    heldForMs;
+    budgetMs;
+    constructor(message, fields) {
+      super(message);
+      this.name = "VaultBusyError";
+      this.vaultPath = fields.vaultPath;
+      this.lockPath = fields.lockPath;
+      this.holderPid = fields.holderPid;
+      this.heldForMs = fields.heldForMs;
+      this.budgetMs = fields.budgetMs;
+    }
+  };
+});
 
-// src/setup/hindsight-recall-tunables.ts
-var RECALL_DEADLINE_HEADROOM_SECONDS = 2;
-var MIN_RECALL_HOOK_TIMEOUT_SECONDS = RECALL_DEADLINE_HEADROOM_SECONDS + 1;
-
-// src/agents/scaffold.ts
-init_schema();
-
-// src/config/users.ts
-init_merge();
-
-// src/agents/scaffold.ts
-init_merge();
-init_timezone();
-
-// src/cli/agent-config.ts
-import { join } from "node:path";
-import { homedir as homedir2 } from "node:os";
-
-// src/cli/helpers.ts
-init_loader();
-
-// src/cli/agent-config.ts
-init_loader();
-init_merge();
-
-// src/config/google-workspace-acl.ts
-function shouldEmitGdriveMcp(agentName, agentGoogleAccount, googleAccounts) {
-  if (!agentGoogleAccount)
-    return false;
-  const account = agentGoogleAccount.trim().toLowerCase();
-  if (account.length === 0)
-    return false;
-  const acctEntry = googleAccounts?.[account];
-  if (!acctEntry)
-    return false;
-  const enabledFor = acctEntry.enabled_for ?? [];
-  return enabledFor.includes(agentName);
-}
-function vaultRefKey(value) {
-  if (typeof value !== "string" || !value.startsWith("vault:"))
-    return null;
-  const key = value.slice("vault:".length).split("#")[0];
-  return key.length > 0 ? key : null;
-}
-function isGoogleClientCredentialKeyForAgent(config, agentName, key) {
-  if (!agentName || !key)
-    return false;
-  const agentConfig = config.agents?.[agentName];
-  if (!agentConfig)
-    return false;
-  if (agentConfig.mcp_servers?.["gdrive"] === false) {
-    return false;
-  }
-  const account = agentConfig.google_workspace?.account;
-  if (!shouldEmitGdriveMcp(agentName, account, config.google_accounts)) {
-    return false;
-  }
-  const gw = config.google_workspace;
-  if (!gw)
-    return false;
-  for (const ref of [gw.google_client_id, gw.google_client_secret]) {
-    if (vaultRefKey(ref) === key)
-      return true;
+// src/vault/vault.ts
+import { randomBytes, scryptSync, createCipheriv, createDecipheriv } from "node:crypto";
+import {
+  readFileSync as readFileSync6,
+  writeSync as writeSync3,
+  existsSync as existsSync6,
+  renameSync as renameSync2,
+  mkdirSync as mkdirSync2,
+  unlinkSync as unlinkSync2,
+  fsyncSync as fsyncSync3,
+  openSync as openSync3,
+  closeSync as closeSync3,
+  lstatSync,
+  realpathSync as realpathSync2
+} from "node:fs";
+import { dirname, basename as basename2, resolve as resolve5 } from "node:path";
+function atomicWriteFileSync(path, data, mode) {
+  let effectivePath = path;
+  try {
+    if (existsSync6(path) && lstatSync(path).isSymbolicLink()) {
+      effectivePath = realpathSync2(path);
+    }
+  } catch {}
+  const dir = dirname(resolve5(effectivePath));
+  const tmp = resolve5(dir, `.${basename2(effectivePath)}.${process.pid}.${Date.now()}.tmp`);
+  try {
+    const fd = openSync3(tmp, "wx", mode);
+    try {
+      writeSync3(fd, data);
+      fsyncSync3(fd);
+    } finally {
+      closeSync3(fd);
+    }
+    renameSync2(tmp, effectivePath);
+    try {
+      const dirFd = openSync3(dir, "r");
+      try {
+        fsyncSync3(dirFd);
+      } finally {
+        closeSync3(dirFd);
+      }
+    } catch {}
+  } catch (err) {
+    try {
+      if (existsSync6(tmp))
+        unlinkSync2(tmp);
+    } catch {}
+    throw err;
   }
-  return false;
 }
-
-// src/vault/broker/acl.ts
-var WEBKITE_VAULT_KEYS = new Set([
-  "webkite/cloudflare-account-id",
-  "webkite/cloudflare-api-token",
-  "webkite/firecrawl-api-key"
-]);
-function isWebkiteCredentialKeyForAgent(agentConfig, key) {
-  if (!WEBKITE_VAULT_KEYS.has(key))
-    return false;
-  if ((agentConfig?.mcp_servers ?? {})["webkite"] === false)
-    return false;
-  return true;
+function deriveKey(passphrase, salt, params = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }) {
+  return scryptSync(passphrase, salt, 32, {
+    N: params.N,
+    r: params.r,
+    p: params.p,
+    maxmem: SCRYPT_MAXMEM
+  });
 }
-function checkEntryScope(scope, agentSlug) {
-  if (scope === undefined || scope === null) {
-    return { allow: true };
-  }
-  const deny = scope.deny ?? [];
-  const allow = scope.allow ?? [];
-  if (agentSlug !== null && deny.includes(agentSlug)) {
-    return {
-      allow: false,
-      reason: `agent '${agentSlug}' is in the entry's deny list (scope-deny)`
-    };
+function encrypt(key, plaintext) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    iv: iv.toString("hex"),
+    data: encrypted.toString("hex"),
+    tag: tag.toString("hex")
+  };
+}
+function decrypt(key, iv, data, tag) {
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"));
+  decipher.setAuthTag(Buffer.from(tag, "hex"));
+  const decrypted = Buffer.concat([
+    decipher.update(Buffer.from(data, "hex")),
+    decipher.final()
+  ]);
+  return decrypted.toString("utf8");
+}
+function normalizeEntry(raw) {
+  if (typeof raw === "string") {
+    return { kind: "string", value: raw };
   }
-  if (allow.length > 0) {
-    if (agentSlug === null || !allow.includes(agentSlug)) {
-      return {
-        allow: false,
-        reason: agentSlug === null ? "caller agent slug could not be determined; entry has a non-empty allow list (scope-allow)" : `agent '${agentSlug}' is not in the entry's allow list (scope-allow)`
-      };
-    }
+  return raw;
+}
+function normalizeSecrets(raw) {
+  const out = {};
+  for (const [k, v] of Object.entries(raw)) {
+    out[k] = normalizeEntry(v);
   }
-  return { allow: true };
+  return out;
 }
-function checkAclByAgent(config, agentName, key) {
-  if (!agentName) {
-    return { allow: false, reason: "agent name unresolved" };
+function openVault(passphrase, vaultPath) {
+  if (!existsSync6(vaultPath)) {
+    throw new VaultError(`Vault file not found: ${vaultPath}`);
   }
-  const agentConfig = config.agents?.[agentName];
-  if (!agentConfig) {
-    return { allow: false, reason: `agent '${agentName}' not found in config` };
+  let vaultFile;
+  try {
+    vaultFile = JSON.parse(readFileSync6(vaultPath, "utf8"));
+  } catch {
+    throw new VaultError(`Failed to read vault file: ${vaultPath}`);
   }
-  const googleSlot = parseGoogleAccountSlotKey(key);
-  if (googleSlot !== null) {
-    return checkGoogleAccountAcl(config, agentName, googleSlot.account, key);
+  const salt = Buffer.from(vaultFile.salt, "hex");
+  const kdfParams = vaultFile.kdf ?? { N: LEGACY_SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
+  const key = deriveKey(passphrase, salt, kdfParams);
+  let plaintext;
+  try {
+    plaintext = decrypt(key, vaultFile.iv, vaultFile.data, vaultFile.tag);
+  } catch {
+    throw new VaultError("Failed to decrypt vault. Wrong passphrase?");
   }
-  if (isGoogleClientCredentialKeyForAgent(config, agentName, key)) {
-    return { allow: true };
+  let vaultData;
+  try {
+    vaultData = JSON.parse(plaintext);
+  } catch {
+    throw new VaultError("Vault data is corrupted");
   }
-  if (isWebkiteCredentialKeyForAgent(agentConfig, key)) {
-    return { allow: true };
+  return normalizeSecrets(vaultData.secrets ?? {});
+}
+function saveVault(passphrase, vaultPath, secrets) {
+  if (!existsSync6(vaultPath)) {
+    throw new VaultError(`Vault file not found: ${vaultPath}`);
   }
-  const agentBot = agentConfig.bot_token;
-  const botRef = agentBot && agentBot.length > 0 ? agentBot : config.telegram?.bot_token;
-  if (typeof botRef === "string" && botRef.startsWith("vault:")) {
-    const botKey = botRef.slice("vault:".length).split("#")[0];
-    if (botKey.length > 0 && botKey === key) {
-      return { allow: true };
+  let releaseLock = null;
+  try {
+    releaseLock = acquireLock(vaultPath, { budgetMs: SAVE_VAULT_LOCK_RETRY_MS }).release;
+  } catch (err) {
+    if (err instanceof VaultBusyError) {
+      throw new VaultError(err.message, { cause: err });
     }
+    throw err;
   }
-  const cfgWithProfiles = config;
-  const profileName = agentConfig.extends;
-  const profileMcp = profileName != null && profileName.length > 0 ? cfgWithProfiles.profiles?.[profileName]?.mcp_servers ?? {} : {};
-  const effectiveMcp = {
-    ...cfgWithProfiles.defaults?.mcp_servers ?? {},
-    ...profileMcp,
-    ...agentConfig.mcp_servers ?? {}
-  };
-  for (const mcpEntry of Object.values(effectiveMcp)) {
-    if (!mcpEntry || typeof mcpEntry !== "object")
-      continue;
-    const declared = mcpEntry.secrets;
-    if (Array.isArray(declared) && declared.includes(key)) {
-      return { allow: true };
+  try {
+    let vaultFile;
+    try {
+      vaultFile = JSON.parse(readFileSync6(vaultPath, "utf8"));
+    } catch {
+      throw new VaultError(`Failed to read vault file: ${vaultPath}`);
+    }
+    const salt = Buffer.from(vaultFile.salt, "hex");
+    const key = deriveKey(passphrase, salt, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+    vaultFile.kdf = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
+    const vaultData = { secrets };
+    const { iv, data, tag } = encrypt(key, JSON.stringify(vaultData));
+    vaultFile.iv = iv;
+    vaultFile.data = data;
+    vaultFile.tag = tag;
+    atomicWriteFileSync(vaultPath, JSON.stringify(vaultFile, null, 2), 384);
+  } finally {
+    if (releaseLock !== null) {
+      try {
+        releaseLock();
+      } catch {}
     }
   }
-  const cfgSecrets = config;
-  const profileSecrets = profileName != null && profileName.length > 0 ? cfgSecrets.profiles?.[profileName]?.secrets : undefined;
-  const standingSecrets = [
-    ...Array.isArray(cfgSecrets.defaults?.secrets) ? cfgSecrets.defaults.secrets : [],
-    ...Array.isArray(profileSecrets) ? profileSecrets : [],
-    ...Array.isArray(agentConfig.secrets) ? agentConfig.secrets : []
-  ];
-  if (standingSecrets.includes(key)) {
-    return { allow: true };
-  }
-  const schedule = agentConfig.schedule ?? [];
-  if (schedule.length === 0) {
-    return {
-      allow: false,
-      reason: `agent '${agentName}' has no schedule entries declaring 'secrets', no mcp_servers.*.secrets[], and no agents.${agentName}.secrets[] standing grant declaring '${key}'; nothing is broker-accessible`
-    };
-  }
-  for (const entry of schedule) {
-    const allowed = entry?.secrets ?? [];
-    if (allowed.includes(key)) {
-      return { allow: true };
+}
+function acquireVaultLock(vaultPath) {
+  try {
+    return acquireLock(vaultPath, { budgetMs: SAVE_VAULT_LOCK_RETRY_MS }).release;
+  } catch (err) {
+    if (err instanceof VaultBusyError) {
+      throw new VaultError(err.message, { cause: err });
     }
+    throw err;
   }
-  return {
-    allow: false,
-    reason: `key '${key}' not in ACL for agent '${agentName}'`
-  };
 }
-function parseGoogleAccountSlotKey(key) {
-  const match = key.match(/^google:([^:]+):([a-z_]+)$/);
-  if (!match)
-    return null;
-  return { account: match[1], field: match[2] };
+var KNOWN_VAULT_ARTIFACT_NAMES, SAVE_VAULT_LOCK_RETRY_MS, SCRYPT_N = 32768, SCRYPT_R = 8, SCRYPT_P = 1, SCRYPT_MAXMEM, VaultError, LEGACY_SCRYPT_N = 16384;
+var init_vault = __esm(() => {
+  init_flock();
+  KNOWN_VAULT_ARTIFACT_NAMES = new Set([
+    "vault.enc",
+    "vault.enc.bak",
+    "vault.enc.tmp",
+    "vault.enc.lock",
+    ".vault.enc.symlink-tmp"
+  ]);
+  SAVE_VAULT_LOCK_RETRY_MS = DEFAULT_LOCK_RETRY_MS;
+  SCRYPT_MAXMEM = 128 * 1024 * 1024;
+  VaultError = class VaultError extends Error {
+    cause;
+    constructor(message, options) {
+      super(message);
+      this.name = "VaultError";
+      if (options?.cause !== undefined)
+        this.cause = options.cause;
+    }
+  };
+});
+
+// src/vault/broker/protocol.ts
+function decodeRequest(line) {
+  if (Buffer.byteLength(line, "utf8") > MAX_FRAME_BYTES) {
+    throw new RangeError(`Request frame too large (${Buffer.byteLength(line, "utf8")} bytes; max ${MAX_FRAME_BYTES})`);
+  }
+  const obj = JSON.parse(line);
+  return RequestSchema.parse(obj);
 }
-function checkGoogleAccountAcl(config, agentName, account, key) {
-  const accounts = config.google_accounts ?? {};
-  const accountKey = account.toLowerCase();
-  const accountEntry = accounts[accountKey] ?? accounts[account];
-  if (!accountEntry) {
-    return {
-      allow: false,
-      reason: `google_accounts['${account}'] not configured (key '${key}')`
-    };
+function encodeResponse(resp) {
+  const json = JSON.stringify(resp);
+  if (Buffer.byteLength(json, "utf8") > MAX_FRAME_BYTES) {
+    throw new Error(`Response frame too large (${Buffer.byteLength(json, "utf8")} bytes; max ${MAX_FRAME_BYTES})`);
   }
-  const enabled = accountEntry.enabled_for ?? [];
-  if (enabled.length === 0) {
+  return json + `
+`;
+}
+function errorResponse(code, msg) {
+  return { ok: false, code, msg };
+}
+function entryResponse(entry) {
+  const stripped = stripWireFields(entry);
+  return { ok: true, entry: stripped };
+}
+function stripWireFields(entry) {
+  if (entry.kind === "string" || entry.kind === "binary") {
     return {
-      allow: false,
-      reason: `google_accounts['${account}'].enabled_for is empty (key '${key}')`
+      kind: entry.kind,
+      value: entry.value,
+      ...entry.format !== undefined ? { format: entry.format } : {}
     };
   }
-  if (!enabled.includes(agentName)) {
-    return {
-      allow: false,
-      reason: `agent '${agentName}' not in google_accounts['${account}'].enabled_for (key '${key}')`
-    };
+  return {
+    kind: "files",
+    files: entry.files
+  };
+}
+var MAX_FRAME_BYTES, AgentNameSchema, GetRequestSchema, PutRequestSchema, ListRequestSchema, MintGrantRequestSchema, ListGrantsRequestSchema, RevokeGrantRequestSchema, StatusRequestSchema, LockRequestSchema, PreflightAccessRequestSchema, OkPreflightAccessResponseSchema, ApprovalRequestRequestSchema, ApprovalLookupRequestSchema, ApprovalLookupByRequestRequestSchema, ApprovalConsumeRequestSchema, ApprovalRevokeRequestSchema, ApprovalListRequestSchema, ApprovalDecisionModeSchema, ApprovalRecordRequestSchema, ApprovalConsumeRecordRequestSchema, RequestSchema, VaultEntrySchema, ErrorCode, OkEntryResponseSchema, OkKeysResponseSchema, BrokerStatus, OkStatusResponseSchema, OkLockResponseSchema, OkPutResponseSchema, OkMintGrantResponseSchema, GrantMetaSchema, OkListGrantsResponseSchema, OkRevokeGrantResponseSchema, OkApprovalRequestResponseSchema, ApprovalDecisionMetaSchema, OkApprovalLookupResponseSchema, OkApprovalConsumeResponseSchema, OkApprovalRevokeResponseSchema, OkApprovalListResponseSchema, OkApprovalRecordResponseSchema, OkApprovalConsumeRecordResponseSchema, ErrorResponseSchema, ResponseSchema;
+var init_protocol = __esm(() => {
+  init_zod();
+  init_peercred();
+  MAX_FRAME_BYTES = 64 * 1024;
+  AgentNameSchema = exports_external.string().min(1).max(64, "agent name max 64 chars").regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/, "agent name must be kebab-case ASCII (alnum + _- only, first char alnum)").refine((s) => !isReservedAgentName(s), {
+    message: "agent name is reserved"
+  });
+  GetRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("get"),
+    key: exports_external.string().min(1),
+    filename: exports_external.string().optional(),
+    token: exports_external.string().optional()
+  });
+  PutRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("put"),
+    key: exports_external.string().min(1),
+    entry: exports_external.union([
+      exports_external.object({ kind: exports_external.literal("string"), value: exports_external.string() }),
+      exports_external.object({ kind: exports_external.literal("binary"), value: exports_external.string() })
+    ]),
+    token: exports_external.string().optional(),
+    passphrase: exports_external.string().optional(),
+    attest_via_posture: exports_external.boolean().optional()
+  });
+  ListRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("list"),
+    token: exports_external.string().optional()
+  });
+  MintGrantRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("mint_grant"),
+    agent: AgentNameSchema,
+    keys: exports_external.array(exports_external.string().min(1)),
+    ttl_seconds: exports_external.number().int().positive().nullable(),
+    description: exports_external.string().optional(),
+    write_keys: exports_external.array(exports_external.string().min(1)).optional(),
+    passphrase: exports_external.string().optional(),
+    attest_via_posture: exports_external.boolean().optional(),
+    decision_id: exports_external.string().optional()
+  });
+  ListGrantsRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("list_grants"),
+    agent: AgentNameSchema.optional(),
+    passphrase: exports_external.string().optional(),
+    attest_via_posture: exports_external.boolean().optional()
+  });
+  RevokeGrantRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("revoke_grant"),
+    id: exports_external.string().min(1)
+  });
+  StatusRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("status")
+  });
+  LockRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("lock")
+  });
+  PreflightAccessRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("preflight_access"),
+    agent: AgentNameSchema,
+    keys: exports_external.array(exports_external.string().min(1)).min(1).max(128)
+  });
+  OkPreflightAccessResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    op: exports_external.literal("preflight_access"),
+    results: exports_external.array(exports_external.object({
+      key: exports_external.string(),
+      exists: exports_external.boolean(),
+      acl_ok: exports_external.boolean(),
+      acl_reason: exports_external.string().optional(),
+      scope_ok: exports_external.boolean(),
+      scope_reason: exports_external.string().optional()
+    }))
+  });
+  ApprovalRequestRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("approval_request"),
+    agent_unit: exports_external.string().min(1),
+    scope: exports_external.string().min(1),
+    action: exports_external.string().min(1),
+    approver_set: exports_external.array(exports_external.string()),
+    why: exports_external.string().optional(),
+    ttl_ms: exports_external.number().int().positive().optional()
+  });
+  ApprovalLookupRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("approval_lookup"),
+    agent_unit: exports_external.string().min(1),
+    scope: exports_external.string().min(1),
+    action: exports_external.string().min(1),
+    current_approver_set: exports_external.array(exports_external.string())
+  });
+  ApprovalLookupByRequestRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("approval_lookup_by_request"),
+    agent_unit: exports_external.string().min(1),
+    request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
+    current_approver_set: exports_external.array(exports_external.string())
+  });
+  ApprovalConsumeRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("approval_consume"),
+    request_id: exports_external.string().regex(/^[0-9a-f]{32}$/)
+  });
+  ApprovalRevokeRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("approval_revoke"),
+    decision_id: exports_external.string().min(1),
+    actor: exports_external.string().min(1),
+    reason: exports_external.string().optional()
+  });
+  ApprovalListRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("approval_list"),
+    agent_unit: exports_external.string().optional()
+  });
+  ApprovalDecisionModeSchema = exports_external.enum([
+    "allow_once",
+    "allow_always",
+    "allow_ttl",
+    "deny",
+    "deny_perm"
+  ]);
+  ApprovalRecordRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("approval_record"),
+    request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
+    decision: ApprovalDecisionModeSchema,
+    approver_set: exports_external.array(exports_external.string()),
+    granted_by_user_id: exports_external.number().int(),
+    ttl_ms: exports_external.number().int().positive().nullable().optional()
+  });
+  ApprovalConsumeRecordRequestSchema = exports_external.object({
+    v: exports_external.literal(1),
+    op: exports_external.literal("approval_consume_record"),
+    request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
+    decision: ApprovalDecisionModeSchema,
+    approver_set: exports_external.array(exports_external.string()),
+    granted_by_user_id: exports_external.number().int(),
+    ttl_ms: exports_external.number().int().positive().nullable().optional()
+  });
+  RequestSchema = exports_external.discriminatedUnion("op", [
+    GetRequestSchema,
+    PutRequestSchema,
+    ListRequestSchema,
+    StatusRequestSchema,
+    LockRequestSchema,
+    PreflightAccessRequestSchema,
+    MintGrantRequestSchema,
+    ListGrantsRequestSchema,
+    RevokeGrantRequestSchema,
+    ApprovalRequestRequestSchema,
+    ApprovalLookupRequestSchema,
+    ApprovalLookupByRequestRequestSchema,
+    ApprovalConsumeRequestSchema,
+    ApprovalRevokeRequestSchema,
+    ApprovalListRequestSchema,
+    ApprovalRecordRequestSchema,
+    ApprovalConsumeRecordRequestSchema
+  ]);
+  VaultEntrySchema = exports_external.union([
+    exports_external.object({ kind: exports_external.literal("string"), value: exports_external.string() }),
+    exports_external.object({ kind: exports_external.literal("binary"), value: exports_external.string() }),
+    exports_external.object({
+      kind: exports_external.literal("files"),
+      files: exports_external.record(exports_external.string(), exports_external.object({
+        encoding: exports_external.enum(["utf8", "base64"]),
+        value: exports_external.string()
+      }))
+    })
+  ]);
+  ErrorCode = exports_external.enum([
+    "LOCKED",
+    "DENIED",
+    "UNKNOWN_KEY",
+    "BAD_REQUEST",
+    "INTERNAL",
+    "AUDIT_UNAVAILABLE"
+  ]);
+  OkEntryResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    entry: VaultEntrySchema
+  });
+  OkKeysResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    keys: exports_external.array(exports_external.string())
+  });
+  BrokerStatus = exports_external.object({
+    unlocked: exports_external.boolean(),
+    keyCount: exports_external.number().int().nonnegative(),
+    uptimeSec: exports_external.number().nonnegative()
+  });
+  OkStatusResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    status: BrokerStatus
+  });
+  OkLockResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    locked: exports_external.literal(true)
+  });
+  OkPutResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    put: exports_external.literal(true),
+    key: exports_external.string()
+  });
+  OkMintGrantResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    token: exports_external.string(),
+    id: exports_external.string(),
+    expires_at: exports_external.number().nullable()
+  });
+  GrantMetaSchema = exports_external.object({
+    id: exports_external.string(),
+    agent_slug: exports_external.string(),
+    key_allow: exports_external.array(exports_external.string()),
+    write_allow: exports_external.array(exports_external.string()).default([]),
+    expires_at: exports_external.number().nullable(),
+    created_at: exports_external.number(),
+    description: exports_external.string().nullable()
+  });
+  OkListGrantsResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    grants: exports_external.array(GrantMetaSchema)
+  });
+  OkRevokeGrantResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    revoked: exports_external.boolean()
+  });
+  OkApprovalRequestResponseSchema = exports_external.discriminatedUnion("state", [
+    exports_external.object({
+      ok: exports_external.literal(true),
+      kind: exports_external.literal("approval_request"),
+      state: exports_external.literal("pending"),
+      request_id: exports_external.string(),
+      expires_at: exports_external.number()
+    }),
+    exports_external.object({
+      ok: exports_external.literal(true),
+      kind: exports_external.literal("approval_request"),
+      state: exports_external.literal("rate_limited"),
+      retry_after_ms: exports_external.number()
+    })
+  ]);
+  ApprovalDecisionMetaSchema = exports_external.object({
+    id: exports_external.string(),
+    agent_unit: exports_external.string(),
+    scope: exports_external.string(),
+    action: exports_external.string(),
+    decision: ApprovalDecisionModeSchema,
+    granted_at: exports_external.number(),
+    granted_by_user_id: exports_external.number(),
+    ttl_expires_at: exports_external.number().nullable(),
+    last_used_at: exports_external.number().nullable(),
+    revoked_at: exports_external.number().nullable(),
+    revoke_reason: exports_external.string().nullable(),
+    origin: exports_external.enum(["agent", "operator"]).optional()
+  });
+  OkApprovalLookupResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    state: exports_external.enum(["granted", "denied", "pending", "expired", "drift_revoked", "no_decision"]),
+    decision: ApprovalDecisionMetaSchema.nullable().optional()
+  });
+  OkApprovalConsumeResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    consumed: exports_external.boolean(),
+    agent_unit: exports_external.string().optional(),
+    scope: exports_external.string().optional(),
+    action: exports_external.string().optional(),
+    why: exports_external.string().nullable().optional()
+  });
+  OkApprovalRevokeResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    revoked: exports_external.boolean()
+  });
+  OkApprovalListResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    decisions: exports_external.array(ApprovalDecisionMetaSchema)
+  });
+  OkApprovalRecordResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    decision_id: exports_external.string()
+  });
+  OkApprovalConsumeRecordResponseSchema = exports_external.object({
+    ok: exports_external.literal(true),
+    consumed: exports_external.boolean(),
+    decision_id: exports_external.string().optional(),
+    agent_unit: exports_external.string().optional(),
+    scope: exports_external.string().optional(),
+    action: exports_external.string().optional(),
+    why: exports_external.string().nullable().optional()
+  });
+  ErrorResponseSchema = exports_external.object({
+    ok: exports_external.literal(false),
+    code: ErrorCode,
+    msg: exports_external.string()
+  });
+  ResponseSchema = exports_external.union([
+    OkEntryResponseSchema,
+    OkKeysResponseSchema,
+    OkStatusResponseSchema,
+    OkLockResponseSchema,
+    OkPreflightAccessResponseSchema,
+    OkPutResponseSchema,
+    OkMintGrantResponseSchema,
+    OkListGrantsResponseSchema,
+    OkRevokeGrantResponseSchema,
+    OkApprovalRequestResponseSchema,
+    OkApprovalLookupResponseSchema,
+    OkApprovalConsumeResponseSchema,
+    OkApprovalRevokeResponseSchema,
+    OkApprovalListResponseSchema,
+    OkApprovalRecordResponseSchema,
+    OkApprovalConsumeRecordResponseSchema,
+    ErrorResponseSchema
+  ]);
+});
+// src/vault/broker/client.ts
+import { homedir as homedir3 } from "node:os";
+import { join as join3 } from "node:path";
+var LEGACY_SOCKET_PATH, OPERATOR_SOCKET_PATH;
+var init_client = __esm(() => {
+  init_protocol();
+  init_peercred();
+  LEGACY_SOCKET_PATH = join3(homedir3(), ".switchroom", "vault-broker.sock");
+  OPERATOR_SOCKET_PATH = join3(homedir3(), ".switchroom", "broker-operator", "sock");
+});
+
+// src/vault/resolver.ts
+var materializedDirs;
+var init_resolver = __esm(() => {
+  init_vault();
+  init_loader();
+  init_client();
+  materializedDirs = new Set;
+});
+
+// src/vault/broker/server.ts
+import * as net from "node:net";
+import { mkdirSync as mkdirSync8, chmodSync as chmodSync5, chownSync as chownSync2, existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync5, statSync as statSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync5 } from "node:fs";
+
+// src/agents/compose.ts
+init_schema();
+
+// src/agents/scaffold.ts
+import { dirname as dirname2, isAbsolute, join as join4, relative, resolve as resolve6 } from "node:path";
+init_atomic();
+
+// src/agents/agent-uid.ts
+init_peercred();
+import { createHash } from "node:crypto";
+var AGENT_UID_MIN = 10001;
+var AGENT_UID_MAX = 10999;
+function allocateAgentUid(name) {
+  if (isReservedAgentName(name)) {
+    throw new Error(`agent name '${name}' is reserved by switchroom for another identity kind ` + `(see vault/broker/peercred.ts:RESERVED_AGENT_NAMES). Pick a different name.`);
   }
-  return { allow: true };
+  const hash = createHash("sha256").update(name).digest();
+  const u32 = hash.readUInt32BE(0);
+  const range = AGENT_UID_MAX - AGENT_UID_MIN + 1;
+  return AGENT_UID_MIN + u32 % range;
 }
 
-// src/scheduler/cron-introspect.ts
-init_overlay_loader();
+// src/setup/hindsight-recall-tunables.ts
+var RECALL_DEADLINE_HEADROOM_SECONDS = 2;
+var MIN_RECALL_HOOK_TIMEOUT_SECONDS = RECALL_DEADLINE_HEADROOM_SECONDS + 1;
+
+// src/agents/scaffold.ts
+init_schema();
+
+// src/config/users.ts
+init_merge();
+
+// src/config/thinking-effort-risk.ts
+var RISKY_EFFORTS = new Set(["medium", "high", "xhigh", "max"]);
+
+// src/agents/scaffold.ts
+init_merge();
+init_timezone();
 
 // src/cli/agent-config.ts
-var AUDIT_ROOT = join(homedir2(), ".switchroom", "audit");
+import { join } from "node:path";
+import { homedir as homedir2 } from "node:os";
 
-// src/agents/profiles.ts
-var import_handlebars = __toESM(require_lib(), 1);
-import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync, realpathSync } from "node:fs";
-import { resolve as resolve4, join as join2, sep as pathSep } from "node:path";
-function resolveProfilesRoot() {
-  const envOverride = process.env.SWITCHROOM_PROFILES_ROOT?.trim();
-  if (envOverride) {
-    return resolve4(envOverride);
+// src/cli/helpers.ts
+init_loader();
+
+// src/cli/agent-config.ts
+init_loader();
+init_merge();
+
+// src/config/google-workspace-acl.ts
+function shouldEmitGdriveMcp(agentName, agentGoogleAccount, googleAccounts) {
+  if (!agentGoogleAccount)
+    return false;
+  const account = agentGoogleAccount.trim().toLowerCase();
+  if (account.length === 0)
+    return false;
+  const acctEntry = googleAccounts?.[account];
+  if (!acctEntry)
+    return false;
+  const enabledFor = acctEntry.enabled_for ?? [];
+  return enabledFor.includes(agentName);
+}
+function vaultRefKey(value) {
+  if (typeof value !== "string" || !value.startsWith("vault:"))
+    return null;
+  const key = value.slice("vault:".length).split("#")[0];
+  return key.length > 0 ? key : null;
+}
+function isGoogleClientCredentialKeyForAgent(config, agentName, key) {
+  if (!agentName || !key)
+    return false;
+  const agentConfig = config.agents?.[agentName];
+  if (!agentConfig)
+    return false;
+  if (agentConfig.mcp_servers?.["gdrive"] === false) {
+    return false;
   }
-  const candidates = [
-    resolve4(import.meta.dirname, "../../profiles"),
-    resolve4(import.meta.dirname, "profiles")
-  ];
-  for (const candidate of candidates) {
-    if (existsSync4(candidate)) {
-      return candidate;
-    }
+  const account = agentConfig.google_workspace?.account;
+  if (!shouldEmitGdriveMcp(agentName, account, config.google_accounts)) {
+    return false;
   }
-  return candidates[0];
-}
-var PROFILES_ROOT = resolveProfilesRoot();
-import_handlebars.default.registerHelper("json", (value) => {
-  return new import_handlebars.default.SafeString(JSON.stringify(value, null, 2));
-});
-import_handlebars.default.registerHelper("isNumber", (value) => {
-  return typeof value === "number" && Number.isFinite(value);
-});
-var SHARED_FRAGMENTS_DIR = resolve4(PROFILES_ROOT, "_shared");
-var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
-for (const name of SHARED_FRAGMENTS) {
-  const fragPath = join2(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
-  if (existsSync4(fragPath)) {
-    import_handlebars.default.registerPartial(name, readFileSync4(fragPath, "utf-8"));
+  const gw = config.google_workspace;
+  if (!gw)
+    return false;
+  for (const ref of [gw.google_client_id, gw.google_client_secret]) {
+    if (vaultRefKey(ref) === key)
+      return true;
   }
+  return false;
 }
 
-// src/litellm/timeout-budget.ts
-var LITELLM_ROUTER_MARGIN_S = 10;
-var LITELLM_TIMEOUT_TIERS = {
-  interactive: {
-    group: "gpt-oss-20b",
-    localTimeoutS: 90,
-    fallbackGroup: "gpt-oss-20b-openrouter",
+// src/vault/broker/acl.ts
+var WEBKITE_VAULT_KEYS = new Set([
+  "webkite/cloudflare-account-id",
+  "webkite/cloudflare-api-token",
+  "webkite/firecrawl-api-key"
+]);
+function isWebkiteCredentialKeyForAgent(agentConfig, key) {
+  if (!WEBKITE_VAULT_KEYS.has(key))
+    return false;
+  if ((agentConfig?.mcp_servers ?? {})["webkite"] === false)
+    return false;
+  return true;
+}
+function checkEntryScope(scope, agentSlug) {
+  if (scope === undefined || scope === null) {
+    return { allow: true };
+  }
+  const deny = scope.deny ?? [];
+  const allow = scope.allow ?? [];
+  if (agentSlug !== null && deny.includes(agentSlug)) {
+    return {
+      allow: false,
+      reason: `agent '${agentSlug}' is in the entry's deny list (scope-deny)`
+    };
+  }
+  if (allow.length > 0) {
+    if (agentSlug === null || !allow.includes(agentSlug)) {
+      return {
+        allow: false,
+        reason: agentSlug === null ? "caller agent slug could not be determined; entry has a non-empty allow list (scope-allow)" : `agent '${agentSlug}' is not in the entry's allow list (scope-allow)`
+      };
+    }
+  }
+  return { allow: true };
+}
+function checkAclByAgent(config, agentName, key) {
+  if (!agentName) {
+    return { allow: false, reason: "agent name unresolved" };
+  }
+  const agentConfig = config.agents?.[agentName];
+  if (!agentConfig) {
+    return { allow: false, reason: `agent '${agentName}' not found in config` };
+  }
+  const googleSlot = parseGoogleAccountSlotKey(key);
+  if (googleSlot !== null) {
+    return checkGoogleAccountAcl(config, agentName, googleSlot.account, key);
+  }
+  if (isGoogleClientCredentialKeyForAgent(config, agentName, key)) {
+    return { allow: true };
+  }
+  if (isWebkiteCredentialKeyForAgent(agentConfig, key)) {
+    return { allow: true };
+  }
+  const agentBot = agentConfig.bot_token;
+  const botRef = agentBot && agentBot.length > 0 ? agentBot : config.telegram?.bot_token;
+  if (typeof botRef === "string" && botRef.startsWith("vault:")) {
+    const botKey = botRef.slice("vault:".length).split("#")[0];
+    if (botKey.length > 0 && botKey === key) {
+      return { allow: true };
+    }
+  }
+  const cfgWithProfiles = config;
+  const profileName = agentConfig.extends;
+  const profileMcp = profileName != null && profileName.length > 0 ? cfgWithProfiles.profiles?.[profileName]?.mcp_servers ?? {} : {};
+  const effectiveMcp = {
+    ...cfgWithProfiles.defaults?.mcp_servers ?? {},
+    ...profileMcp,
+    ...agentConfig.mcp_servers ?? {}
+  };
+  for (const mcpEntry of Object.values(effectiveMcp)) {
+    if (!mcpEntry || typeof mcpEntry !== "object")
+      continue;
+    const declared = mcpEntry.secrets;
+    if (Array.isArray(declared) && declared.includes(key)) {
+      return { allow: true };
+    }
+  }
+  const cfgSecrets = config;
+  const profileSecrets = profileName != null && profileName.length > 0 ? cfgSecrets.profiles?.[profileName]?.secrets : undefined;
+  const standingSecrets = [
+    ...Array.isArray(cfgSecrets.defaults?.secrets) ? cfgSecrets.defaults.secrets : [],
+    ...Array.isArray(profileSecrets) ? profileSecrets : [],
+    ...Array.isArray(agentConfig.secrets) ? agentConfig.secrets : []
+  ];
+  if (standingSecrets.includes(key)) {
+    return { allow: true };
+  }
+  const schedule = agentConfig.schedule ?? [];
+  if (schedule.length === 0) {
+    return {
+      allow: false,
+      reason: `agent '${agentName}' has no schedule entries declaring 'secrets', no mcp_servers.*.secrets[], and no agents.${agentName}.secrets[] standing grant declaring '${key}'; nothing is broker-accessible`
+    };
+  }
+  for (const entry of schedule) {
+    const allowed = entry?.secrets ?? [];
+    if (allowed.includes(key)) {
+      return { allow: true };
+    }
+  }
+  return {
+    allow: false,
+    reason: `key '${key}' not in ACL for agent '${agentName}'`
+  };
+}
+function parseGoogleAccountSlotKey(key) {
+  const match = key.match(/^google:([^:]+):([a-z_]+)$/);
+  if (!match)
+    return null;
+  return { account: match[1], field: match[2] };
+}
+function checkGoogleAccountAcl(config, agentName, account, key) {
+  const accounts = config.google_accounts ?? {};
+  const accountKey = account.toLowerCase();
+  const accountEntry = accounts[accountKey] ?? accounts[account];
+  if (!accountEntry) {
+    return {
+      allow: false,
+      reason: `google_accounts['${account}'] not configured (key '${key}')`
+    };
+  }
+  const enabled = accountEntry.enabled_for ?? [];
+  if (enabled.length === 0) {
+    return {
+      allow: false,
+      reason: `google_accounts['${account}'].enabled_for is empty (key '${key}')`
+    };
+  }
+  if (!enabled.includes(agentName)) {
+    return {
+      allow: false,
+      reason: `agent '${agentName}' not in google_accounts['${account}'].enabled_for (key '${key}')`
+    };
+  }
+  return { allow: true };
+}
+
+// src/scheduler/cron-introspect.ts
+init_overlay_loader();
+
+// src/cli/agent-config.ts
+var AUDIT_ROOT = join(homedir2(), ".switchroom", "audit");
+
+// src/agents/profiles.ts
+var import_handlebars = __toESM(require_lib(), 1);
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync, realpathSync } from "node:fs";
+import { resolve as resolve4, join as join2, sep as pathSep } from "node:path";
+function resolveProfilesRoot() {
+  const envOverride = process.env.SWITCHROOM_PROFILES_ROOT?.trim();
+  if (envOverride) {
+    return resolve4(envOverride);
+  }
+  const candidates = [
+    resolve4(import.meta.dirname, "../../profiles"),
+    resolve4(import.meta.dirname, "profiles")
+  ];
+  for (const candidate of candidates) {
+    if (existsSync4(candidate)) {
+      return candidate;
+    }
+  }
+  return candidates[0];
+}
+var PROFILES_ROOT = resolveProfilesRoot();
+import_handlebars.default.registerHelper("json", (value) => {
+  return new import_handlebars.default.SafeString(JSON.stringify(value, null, 2));
+});
+import_handlebars.default.registerHelper("isNumber", (value) => {
+  return typeof value === "number" && Number.isFinite(value);
+});
+var SHARED_FRAGMENTS_DIR = resolve4(PROFILES_ROOT, "_shared");
+var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
+for (const name of SHARED_FRAGMENTS) {
+  const fragPath = join2(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
+  if (existsSync4(fragPath)) {
+    import_handlebars.default.registerPartial(name, readFileSync4(fragPath, "utf-8"));
+  }
+}
+
+// src/litellm/timeout-budget.ts
+var LITELLM_ROUTER_MARGIN_S = 10;
+var LITELLM_TIMEOUT_TIERS = {
+  interactive: {
+    group: "gpt-oss-20b",
+    localTimeoutS: 90,
+    fallbackGroup: "gpt-oss-20b-openrouter",
     fallbackTimeoutS: 60
   },
   retain: {
@@ -18971,12 +19757,15 @@ function pgMib(mib) {
 }
 var HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE_ENV = "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE";
 var HINDSIGHT_PG_SHARED_BUFFERS_ENV = "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS";
+var HINDSIGHT_PG_FSYNC_ENV = "SWITCHROOM_HINDSIGHT_PG_FSYNC";
+var HINDSIGHT_PG_DEFAULT_FSYNC = "on";
 var HINDSIGHT_PG_DEFAULTS = [
   [
     HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE_ENV,
     pgMib(HINDSIGHT_PG_DEFAULT_EFFECTIVE_CACHE_SIZE_MIB)
   ],
-  [HINDSIGHT_PG_SHARED_BUFFERS_ENV, pgMib(HINDSIGHT_PG_DEFAULT_SHARED_BUFFERS_MIB)]
+  [HINDSIGHT_PG_SHARED_BUFFERS_ENV, pgMib(HINDSIGHT_PG_DEFAULT_SHARED_BUFFERS_MIB)],
+  [HINDSIGHT_PG_FSYNC_ENV, HINDSIGHT_PG_DEFAULT_FSYNC]
 ];
 var HINDSIGHT_PG_ENV_KEYS = new Set(HINDSIGHT_PG_DEFAULTS.map(([k]) => k));
 
@@ -19138,6 +19927,8 @@ var HINDSIGHT_RETAIN_CLIENT_DEADLINE_S = hindsightRetainClientTimeoutSeconds() +
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 var DOCKER_PROBE_TIMEOUT_MS = 60 * 1000;
+var HINDSIGHT_CP_UNAUTHENTICATED_BIND_ADDR = "127.0.0.1";
+var HINDSIGHT_CP_NO_ACCESS_KEY_WARNING = "hindsight: no `hindsight.cp_access_key` configured — the control-plane " + "dashboard has NO login (the access-key middleware is inert when " + "HINDSIGHT_CP_ACCESS_KEY is unset), so it is pinned to " + `${HINDSIGHT_CP_UNAUTHENTICATED_BIND_ADDR} and will NOT be reachable from ` + "the LAN or tailnet. Set `hindsight.cp_access_key: vault:<key>` in " + "switchroom.yaml to arm the login and open it up.";
 
 // src/memory/hindsight.ts
 var DEFAULT_RETAIN_MISSION = `Extract durable facts that will still be true and useful weeks from now, once this session is forgotten.
@@ -19180,1019 +19971,244 @@ var DEFAULT_RETAIN_MISSION = `Extract durable facts that will still be true and
 ` + `- Restatements of the user's current request or the task in progress.
 ` + `- Volatile state written as a timeless assertion. A version, count, size,
 ` + `  backlog, status, or any "X is running Y" / "X is at Y" / "X is currently Y"
-` + `  claim is true only at the instant it was said. Concretely, never produce a
-` + `  fact whose text resembles any of these: "Switchroom fleet is running image
-` + `  version v0.18.19", "The switchroom repo is at /path/to/fleet, version
-` + `  v0.19.5", "Bank overlord has 43155 pending consolidations", "The build is
-` + `  currently green". If the claim is worth keeping, put the date INSIDE the
-` + `  fact text ("As of 2026-07-19 the fleet was running v0.18.19"); if you
-` + `  cannot date it, drop it. An undated one is recalled forever as though it
-` + `  were still true, which is worse than not remembering it at all.
-` + `- Transient state (unread counts, build status, what is running right now) unless
-` + `  the fact is explicitly dated, in which case record it as a dated observation.
-` + `- Greetings, acknowledgements, and routine operational chatter.
-` + `
-` + `Write each fact so it stands alone: name the thing, the number, and the date. A
-` + `sentence that only makes sense while reading this transcript is not durable.
-` + `
-` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
-` + `nothing durable remains, return an empty facts list.
-`;
-var SUPERSEDED_RETAIN_MISSIONS = [
-  "Extract technical decisions, architectural choices, user preferences, project context, and people/tool relationships. Ignore routine greetings and transient operational details.",
-  "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise.",
-  "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise, " + "including in-flight workflow/process narration (a sub-task started, " + "paused, or is still running) — only retain the outcome once a task " + "actually completes or a decision is made.",
-  "Extract durable facts that will still be true and useful weeks from now: " + "user preferences and standing rules, ongoing projects and recurring " + "commitments, technical and architectural decisions with their rationale, " + "and people/tool relationships. A preference revealed by a request is " + "durable — record the preference (what the user likes, wants, or always " + `does), not the request itself.
-
-` + `NEVER extract:
-` + "- Agent tool-use traces or narration of what the assistant did (e.g. " + `"the assistant used X to query Y", "ran a search", "sent the message").
-` + "- In-flight workflow/process narration (a sub-task started, paused, or is " + "still running) — retain the outcome only once the task completes or a " + `decision is made.
-` + `- Operation, request, batch or session IDs, UUIDs, hashes, or error codes.
-` + "- Hindsight's own errors, retries, backlogs, or internal state — the " + `memory system's self-reports are not memories.
-` + `- Restatements of the user's current request or the task in progress.
-` + "- Transient state (unread counts, build status, what is running right now) " + "unless the fact is explicitly dated, in which case record it as a dated " + `observation.
-` + `- Greetings, acknowledgements, and routine operational chatter.
-
-` + "If a candidate fact matches an exclusion, drop it rather than rewording " + "it. If nothing durable remains, return an empty facts list.",
-  `Extract durable facts that will still be true and useful weeks from now: user preferences and standing rules, ongoing projects and recurring commitments, technical and architectural decisions with their rationale, and people/tool relationships. A preference revealed by a request is durable — record the preference (what the user likes, wants, or always does), not the request itself.
-` + `
-` + `A TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this
-` + `candidate a file path, a command/process/agent/session id, a temp directory, or
-` + `the location where some output was written? If yes, drop it — it is transcript
-` + `exhaust, not memory.
-` + `
-` + `NEVER extract:
-` + `- Tool results verbatim or paraphrased. Concretely, never produce a fact whose
-` + `  text resembles any of these: "File created successfully at /path/to/file",
-` + `  "A background command with ID bctz4yskm is running, and its output will be
-` + `  written to /tmp/...", "Async agent a745598ba84e71df1 was launched successfully
-` + `  and is running in the background", "User executed a Bash command to sleep for
-` + `  200 seconds", "The assistant used grep to locate 'truncateSync' in src/foo.ts".
-` + `- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.
-` + `- Agent tool-use traces or narration of what the assistant did (e.g. "the
-` + `  assistant used X to query Y", "ran a search", "sent the message").
-` + `- In-flight workflow/process narration (a sub-task started, paused, or is still
-` + `  running) — retain the outcome only once the task completes or a decision is made.
-` + `- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.
-` + `- Slash commands the user typed and their effects (e.g. "User issued /clear to
-` + `  reset assistant state").
-` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
-` + `  system's self-reports are not memories.
-` + `- Restatements of the user's current request or the task in progress.
-` + `- Transient state (unread counts, build status, what is running right now) unless
-` + `  the fact is explicitly dated, in which case record it as a dated observation.
-` + `- Greetings, acknowledgements, and routine operational chatter.
-` + `
-` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
-` + "nothing durable remains, return an empty facts list.",
-  `Extract durable facts that will still be true and useful weeks from now: user preferences and standing rules, ongoing projects and recurring commitments, technical and architectural decisions with their rationale, and people/tool relationships. A preference revealed by a request is durable — record the preference (what the user likes, wants, or always does), not the request itself.
-` + `
-` + `A TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this
-` + `candidate a file path, a command/process/agent/session id, a temp directory, or
-` + `the location where some output was written? If yes, drop it — it is transcript
-` + `exhaust, not memory.
-` + `
-` + `NEVER extract:
-` + `- Tool results verbatim or paraphrased. Concretely, never produce a fact whose
-` + `  text resembles any of these: "File created successfully at /path/to/file",
-` + `  "A background command with ID bctz4yskm is running, and its output will be
-` + `  written to /tmp/...", "Async agent a745598ba84e71df1 was launched successfully
-` + `  and is running in the background", "User executed a Bash command to sleep for
-` + `  200 seconds", "The assistant used grep to locate 'truncateSync' in src/foo.ts".
-` + `- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.
-` + `- Agent tool-use traces or narration of what the assistant did (e.g. "the
-` + `  assistant used X to query Y", "ran a search", "sent the message").
-` + `- In-flight workflow/process narration (a sub-task started, paused, or is still
-` + `  running) — retain the outcome only once the task completes or a decision is made.
-` + `- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.
-` + `- Slash commands the user typed and their effects (e.g. "User issued /clear to
-` + `  reset assistant state").
-` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
-` + `  system's self-reports are not memories.
-` + `- Restatements of the user's current request or the task in progress.
-` + `- Volatile state written as a timeless assertion. A version, count, size,
-` + `  backlog, status, or any "X is running Y" / "X is at Y" / "X is currently Y"
-` + `  claim is true only at the instant it was said. Concretely, never produce a
-` + `  fact whose text resembles any of these: "Switchroom fleet is running image
-` + `  version v0.18.19", "The switchroom repo is at /path/to/fleet, version
-` + `  v0.19.5", "Bank overlord has 43155 pending consolidations", "The build is
-` + `  currently green". If the claim is worth keeping, put the date INSIDE the
-` + `  fact text ("As of 2026-07-19 the fleet was running v0.18.19"); if you
-` + `  cannot date it, drop it. An undated one is recalled forever as though it
-` + `  were still true, which is worse than not remembering it at all.
-` + `- Transient state (unread counts, build status, what is running right now) unless
-` + `  the fact is explicitly dated, in which case record it as a dated observation.
-` + `- Greetings, acknowledgements, and routine operational chatter.
-` + `
-` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
-` + "nothing durable remains, return an empty facts list.",
-  `Extract durable facts that will still be true and useful weeks from now, once this session is forgotten.
-` + `
-` + `DURABILITY GATE. Emit a candidate ONLY if it is one of these five classes:
-` + `- PREFERENCE — what the user likes, wants, or always does; a standing rule or correction.
-` + `- DECISION — a settled choice that changes how future work is done, including a choice NOT to do something. A decision about the mechanics of the CURRENT task (which worker to dispatch, which branch to rebase, which PR to merge now, what to do next) is process narration, not a durable decision — drop it unless it establishes a standing rule or permanently changes a system.
-` + `- FINDING — a root cause, a measurement, or verified behaviour of a system. Include the number.
-` + `- OUTCOME — a completed result that changed the world: what shipped, what a thing turned out to be. Not the act of shipping it.
-` + `- RELATIONSHIP — who a person is, what a project or tool is, and how they connect.
-` + `If a candidate fits none of the five, it is not a memory. Drop it; do not reword it into one.
-` + `
-` + `A preference revealed by a request is durable — record the preference (what the user likes, wants, or always does), not the request itself.
-` + `
-` + `A TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this
-` + `candidate a file path, a command/process/agent/session id, a temp directory, or
-` + `the location where some output was written? If yes, drop it — it is transcript
-` + `exhaust, not memory.
-` + `
-` + `NEVER extract:
-` + `- Tool results verbatim or paraphrased. Concretely, never produce a fact whose
-` + `  text resembles any of these: "File created successfully at /path/to/file",
-` + `  "A background command with ID bctz4yskm is running, and its output will be
-` + `  written to /tmp/...", "Async agent a745598ba84e71df1 was launched successfully
-` + `  and is running in the background", "User executed a Bash command to sleep for
-` + `  200 seconds", "The assistant used grep to locate 'truncateSync' in src/foo.ts".
-` + `- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.
-` + `- Agent tool-use traces or narration of what the assistant did (e.g. "the
-` + `  assistant used X to query Y", "ran a search", "sent the message").
-` + `- The act of delegating, dispatching, spawning, launching, steering or merging
-` + `  work — including when it succeeded. "X was dispatched and completed" is the
-` + `  session describing itself. Record only what the work LEARNED or CHANGED.
-` + `- In-flight workflow/process narration (a sub-task started, paused, or is still
-` + `  running) — retain the outcome only once the task completes or a decision is made.
-` + `- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.
-` + `- Slash commands the user typed and their effects (e.g. "User issued /clear to
-` + `  reset assistant state").
-` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
-` + `  system's self-reports are not memories.
-` + `- Restatements of the user's current request or the task in progress.
-` + `- Transient state (unread counts, build status, what is running right now) unless
-` + `  the fact is explicitly dated, in which case record it as a dated observation.
-` + `- Greetings, acknowledgements, and routine operational chatter.
-` + `
-` + `Write each fact so it stands alone: name the thing, the number, and the date. A
-` + `sentence that only makes sense while reading this transcript is not durable.
-` + `
-` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
-` + `nothing durable remains, return an empty facts list.
-`
-];
-var DEFAULT_OBSERVATIONS_MISSION = `Synthesise durable, standing knowledge about the people, projects, and systems this agent works with: preferences and standing rules, roles and relationships, skills and recurring patterns, technical and operational decisions with their rationale, and the state of long-running work once it lands.
-` + `
-` + `The test is durability, not notability: an observation must still be worth reading weeks from now. A single dated event belongs in an observation only when it establishes or changes a standing fact.
-` + `
-` + `Do NOT synthesise observations from:
-` + `- Transcript exhaust — tool calls and their results, file paths, temp or scratchpad directories, where some output was written, or narration of what an assistant did.
-` + `- Identifiers with no standing meaning: session, agent, request, batch or command IDs, UUIDs, hashes, error codes.
-` + `- In-flight process narration — a task started, paused, or still running. Record the outcome once it lands, not the running state.
-` + `- The memory system's own errors, retries, backlogs, or internal state.
-` + `- Transient state (what is running right now, unread counts, build status) unless the fact is explicitly dated, in which case record it as dated.
-` + `
-` + "If the new facts contain nothing durable, record nothing rather than synthesising a weak observation.";
-var SUPERSEDED_OBSERVATIONS_MISSIONS = [
-  "Synthesise the person's wellbeing patterns, motivations, and emotional " + "context — how habits, setbacks, and encouragement connect over time."
-];
-var PROFILE_MEMORY_DEFAULTS = {
-  "health-coach": {
-    disposition: { skepticism: 2, literalism: 2, empathy: 5 },
-    observations_mission: `You consolidate the memory of a health and fitness coach working with one person. This bank records how that person actually lives and trains.
-` + `
-` + `Synthesise into durable observations:
-` + `- Goals, targets, and the plan currently in force, with the reasoning behind each.
-` + `- Training, nutrition, sleep, and alcohol patterns as they hold over weeks — what the person reliably does, not what they did once.
-` + `- Constraints that shape the plan: injuries, medical guidance, schedule, equipment, foods and sessions they refuse.
-` + `- Motivations, and what actually helps or backfires when they slip.
-` + `- Trends in the numbers: direction and range over time, not any single reading.
-` + `- Corrections to earlier beliefs, recorded explicitly as corrections.
-` + `
-` + `A single day's log, weight reading, or session is evidence, not an observation. Record one only when it establishes or changes a standing pattern, target, or constraint — then fold it into the observation for that pattern and say what changed and roughly when.
-` + `
-` + `Granularity: one observation per habit, target, constraint, or trend. Aggregate repeated daily evidence into the observation for that pattern rather than creating one per day, and keep training, nutrition, and sleep as separate observations.
-` + `
-` + "Word observations as the person's own pattern and framing, never as a verdict on them."
-  },
-  "executive-assistant": {
-    disposition: { skepticism: 4, literalism: 4, empathy: 3 },
-    observations_mission: `You consolidate the memory of an executive assistant working for one person. This bank records that person's commitments, people, and standing arrangements.
-` + `
-` + `Synthesise into durable observations:
-` + `- Standing rules and preferences: how they want things scheduled, written, and filed, and when they want to be interrupted.
-` + `- People and organisations, and the relationship: who they are, what they are involved in, how to reach them.
-` + `- Recurring commitments and routines, and the constraints around them.
-` + `- Obligations and their state: what was promised to whom, the deadline, and what is still outstanding.
-` + `- Decisions made and decisions deferred, with the reasoning and the trade accepted.
-` + `- Corrections to earlier beliefs, recorded explicitly as corrections.
-` + `
-` + `Live commitment state IS durable knowledge here, not ephemeral chatter. An outstanding obligation, a travel window, an unanswered request, a "currently X" arrangement — these are precisely what this agent must recall later. Keep them, and embed the date inside the observation text so a later reader can judge staleness. Do not drop them as ephemeral.
-` + `
-` + `Granularity: one observation per person, arrangement, or obligation. Aggregate repeated mentions into that observation rather than creating siblings; never merge two different people or two different commitments into one.
-` + `
-` + "Do not synthesise from transcript exhaust: tool calls and their results, message or event identifiers, or narration of what the assistant did."
-  },
-  coding: {
-    disposition: { skepticism: 4, literalism: 5, empathy: 2 },
-    observations_mission: `You consolidate the memory of a software-engineering agent. This bank records real work on real codebases.
-` + `
-` + `Synthesise into durable observations:
-` + `- Architecture and design decisions, each with its rationale and the trade accepted.
-` + `- Root causes, with the evidence chain, and negative results — what was ruled out matters as much as what was found.
-` + `- How the repository works: build, test, and lint commands, conventions, CI gates, and where things live.
-` + `- Outcomes of code work: issue and PR numbers, what changed, whether it merged, what review found.
-` + `- The user's standing rules, preferences, and corrections to this agent's behaviour.
-` + `- Corrections to earlier beliefs, recorded explicitly as corrections.
-` + `
-` + `Repository and service state IS durable knowledge here, not ephemeral chatter. Versions, a failing gate, an open PR, a measured number, a "currently X" claim — these are precisely what this agent must recall later. Keep them, and embed the date inside the observation text so a later reader can judge staleness. Do not drop them as ephemeral.
-` + `
-` + `Granularity: one observation per distinct decision, cause, convention, or work item. Aggregate repeated evidence about the same one into that observation rather than creating siblings; never merge two separate decisions into a single summary.
-` + `
-` + "Do not synthesise from transcript exhaust: tool calls and their results, scratch paths, session or request identifiers, or narration of what the agent did. Prefer specific and falsifiable — naming the file, the number, the commit, or the decision beats summarising the topic."
-  }
-};
-// src/agents/reconcile-default-skills.ts
-var warnedMissingPool = new Set;
-var warnedMissingDefault = new Set;
-
-// src/telegram/state.ts
-init_paths();
-
-// src/agents/scaffold.ts
-init_paths();
-init_loader();
-
-// src/vault/vault.ts
-import { randomBytes, scryptSync, createCipheriv, createDecipheriv } from "node:crypto";
-import {
-  readFileSync as readFileSync6,
-  writeSync as writeSync3,
-  existsSync as existsSync6,
-  renameSync as renameSync2,
-  mkdirSync as mkdirSync2,
-  unlinkSync as unlinkSync2,
-  fsyncSync as fsyncSync3,
-  openSync as openSync3,
-  closeSync as closeSync3,
-  lstatSync,
-  realpathSync as realpathSync2
-} from "node:fs";
-import { dirname, basename as basename2, resolve as resolve5 } from "node:path";
-
-// src/vault/flock.ts
-import {
-  existsSync as existsSync5,
-  openSync as openSync2,
-  closeSync as closeSync2,
-  writeSync as writeSync2,
-  fsyncSync as fsyncSync2,
-  unlinkSync,
-  readFileSync as readFileSync5,
-  readdirSync as readdirSync3,
-  rmdirSync,
-  statSync as statSync3,
-  constants as fsConstants
-} from "node:fs";
-var DEFAULT_LOCK_RETRY_MS = 5000;
-function lockPathFor(vaultPath) {
-  return `${vaultPath}.lock`;
-}
-function readLockHolder(lockPath) {
-  try {
-    const raw = readFileSync5(lockPath, "utf8");
-    const lines = raw.split(`
-`);
-    const pid = Number.parseInt(lines[0] ?? "", 10);
-    const acquiredAtMs = Number.parseInt(lines[1] ?? "", 10);
-    if (!Number.isFinite(pid) || pid <= 0)
-      return null;
-    if (!Number.isFinite(acquiredAtMs) || acquiredAtMs <= 0)
-      return null;
-    return { pid, acquiredAtMs, argv0: lines[2] ?? "" };
-  } catch {
-    return null;
-  }
-}
-function pidIsLive(pid) {
-  if (process.platform === "linux") {
-    return existsSync5(`/proc/${pid}`);
-  }
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function parseProcStartTimeMs(statLine, procStat, now) {
-  const tailStart = statLine.lastIndexOf(")");
-  if (tailStart < 0)
-    return null;
-  const tokens = statLine.slice(tailStart + 1).trim().split(/\s+/);
-  const starttimeTicks = Number.parseInt(tokens[19] ?? "", 10);
-  if (!Number.isFinite(starttimeTicks))
-    return null;
-  const btimeMatch = procStat.match(/^btime\s+(\d+)/m);
-  if (!btimeMatch)
-    return null;
-  const bootEpochSec = Number.parseInt(btimeMatch[1], 10);
-  if (!Number.isFinite(bootEpochSec))
-    return null;
-  const USER_HZ = 100;
-  const startEpochMs = bootEpochSec * 1000 + starttimeTicks / USER_HZ * 1000;
-  const bootEpochMs = bootEpochSec * 1000;
-  const SLOP_MS = 5000;
-  if (startEpochMs < bootEpochMs - SLOP_MS || startEpochMs > now + SLOP_MS) {
-    return null;
-  }
-  return Math.floor(startEpochMs);
-}
-function pidStartTimeMs(pid) {
-  if (process.platform !== "linux")
-    return null;
-  try {
-    const statLine = readFileSync5(`/proc/${pid}/stat`, "utf8");
-    const procStat = readFileSync5("/proc/stat", "utf8");
-    return parseProcStartTimeMs(statLine, procStat, Date.now());
-  } catch {
-    return null;
-  }
-}
-function pidIsOriginalHolder(holder) {
-  const startMs = pidStartTimeMs(holder.pid);
-  if (startMs === null)
-    return true;
-  return startMs <= holder.acquiredAtMs + 100;
-}
-var STALE_MTIME_FLOOR_MS = 1e4;
-function lockFileMtimeIsOlderThan(lockPath, budgetMs) {
-  try {
-    const s = statSync3(lockPath);
-    const threshold = Math.max(STALE_MTIME_FLOOR_MS, budgetMs * 2);
-    return Date.now() - s.mtimeMs > threshold;
-  } catch {
-    return false;
-  }
-}
-var SENTINEL_DIR_RECENT_WRITE_MS = 60000;
-function clearStaleSentinelDir(lockPath) {
-  try {
-    if (!existsSync5(lockPath))
-      return true;
-    const s = statSync3(lockPath);
-    if (!s.isDirectory())
-      return true;
-    const now = Date.now();
-    for (const entry of readdirSync3(lockPath)) {
-      try {
-        const childStat = statSync3(`${lockPath}/${entry}`);
-        if (now - childStat.mtimeMs < SENTINEL_DIR_RECENT_WRITE_MS) {
-          return false;
-        }
-      } catch {}
-    }
-    for (const entry of readdirSync3(lockPath)) {
-      try {
-        unlinkSync(`${lockPath}/${entry}`);
-      } catch {}
-    }
-    rmdirSync(lockPath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function acquireLock(vaultPath, options = {}) {
-  const budgetMs = options.budgetMs ?? DEFAULT_LOCK_RETRY_MS;
-  const lockPath = lockPathFor(vaultPath);
-  const deadline = Date.now() + budgetMs;
-  const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
-  while (true) {
-    let fd = null;
-    try {
-      fd = openSync2(lockPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
-    } catch (err) {
-      const code = err?.code ?? "";
-      if (code === "EEXIST") {
-        let isDir = false;
-        try {
-          isDir = statSync3(lockPath).isDirectory();
-        } catch {}
-        if (isDir) {
-          if (clearStaleSentinelDir(lockPath))
-            continue;
-        }
-        const holder = readLockHolder(lockPath);
-        const isDeadPid = holder !== null && !pidIsLive(holder.pid);
-        const isReusedPid = holder !== null && pidIsLive(holder.pid) && !pidIsOriginalHolder(holder);
-        const isUnparseableAndOld = holder === null && lockFileMtimeIsOlderThan(lockPath, budgetMs);
-        if (isDeadPid || isReusedPid || isUnparseableAndOld) {
-          try {
-            unlinkSync(lockPath);
-          } catch {}
-          continue;
-        }
-        if (Date.now() >= deadline) {
-          throw makeBusyError(vaultPath, lockPath, holder, budgetMs);
-        }
-        Atomics.wait(sleepBuf, 0, 0, 100);
-        continue;
-      } else {
-        throw err;
-      }
-    }
-    try {
-      const meta = `${process.pid}
-${Date.now()}
-${process.argv[1] ?? ""}
-`;
-      writeSync2(fd, meta);
-      fsyncSync2(fd);
-    } catch {
-      try {
-        closeSync2(fd);
-      } catch {}
-      try {
-        unlinkSync(lockPath);
-      } catch {}
-      throw new Error(`vault flock: failed to write holder metadata to ${lockPath}`);
-    }
-    const ownedFd = fd;
-    return {
-      release: () => {
-        try {
-          closeSync2(ownedFd);
-        } catch {}
-        try {
-          unlinkSync(lockPath);
-        } catch {}
-      }
-    };
-  }
-}
-
-class VaultBusyError extends Error {
-  vaultPath;
-  lockPath;
-  holderPid;
-  heldForMs;
-  budgetMs;
-  constructor(message, fields) {
-    super(message);
-    this.name = "VaultBusyError";
-    this.vaultPath = fields.vaultPath;
-    this.lockPath = fields.lockPath;
-    this.holderPid = fields.holderPid;
-    this.heldForMs = fields.heldForMs;
-    this.budgetMs = fields.budgetMs;
-  }
-}
-function makeBusyError(vaultPath, lockPath, holder, budgetMs) {
-  const holderPid = holder?.pid ?? null;
-  const heldForMs = holder ? Date.now() - holder.acquiredAtMs : null;
-  const holderClause = holder ? `held by pid ${holder.pid} (acquired ${Math.round((heldForMs ?? 0) / 1000)}s ago)` : "held by another writer (holder PID unreadable — lock file empty or unparseable)";
-  return new VaultBusyError(`vault busy: ${holderClause} at ${lockPath} (retried for ${budgetMs}ms). ` + `Try again in a moment. If the holder process is gone, the next acquirer ` + `will clear the stale lock automatically.`, { vaultPath, lockPath, holderPid, heldForMs, budgetMs });
-}
-
-// src/vault/vault.ts
-var KNOWN_VAULT_ARTIFACT_NAMES = new Set([
-  "vault.enc",
-  "vault.enc.bak",
-  "vault.enc.tmp",
-  "vault.enc.lock",
-  ".vault.enc.symlink-tmp"
-]);
-var SAVE_VAULT_LOCK_RETRY_MS = DEFAULT_LOCK_RETRY_MS;
-var SCRYPT_N = 32768;
-var SCRYPT_R = 8;
-var SCRYPT_P = 1;
-var SCRYPT_MAXMEM = 128 * 1024 * 1024;
-function atomicWriteFileSync(path, data, mode) {
-  let effectivePath = path;
-  try {
-    if (existsSync6(path) && lstatSync(path).isSymbolicLink()) {
-      effectivePath = realpathSync2(path);
-    }
-  } catch {}
-  const dir = dirname(resolve5(effectivePath));
-  const tmp = resolve5(dir, `.${basename2(effectivePath)}.${process.pid}.${Date.now()}.tmp`);
-  try {
-    const fd = openSync3(tmp, "wx", mode);
-    try {
-      writeSync3(fd, data);
-      fsyncSync3(fd);
-    } finally {
-      closeSync3(fd);
-    }
-    renameSync2(tmp, effectivePath);
-    try {
-      const dirFd = openSync3(dir, "r");
-      try {
-        fsyncSync3(dirFd);
-      } finally {
-        closeSync3(dirFd);
-      }
-    } catch {}
-  } catch (err) {
-    try {
-      if (existsSync6(tmp))
-        unlinkSync2(tmp);
-    } catch {}
-    throw err;
-  }
-}
-
-class VaultError extends Error {
-  cause;
-  constructor(message, options) {
-    super(message);
-    this.name = "VaultError";
-    if (options?.cause !== undefined)
-      this.cause = options.cause;
-  }
-}
-var LEGACY_SCRYPT_N = 16384;
-function deriveKey(passphrase, salt, params = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }) {
-  return scryptSync(passphrase, salt, 32, {
-    N: params.N,
-    r: params.r,
-    p: params.p,
-    maxmem: SCRYPT_MAXMEM
-  });
-}
-function encrypt(key, plaintext) {
-  const iv = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return {
-    iv: iv.toString("hex"),
-    data: encrypted.toString("hex"),
-    tag: tag.toString("hex")
-  };
-}
-function decrypt(key, iv, data, tag) {
-  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"));
-  decipher.setAuthTag(Buffer.from(tag, "hex"));
-  const decrypted = Buffer.concat([
-    decipher.update(Buffer.from(data, "hex")),
-    decipher.final()
-  ]);
-  return decrypted.toString("utf8");
-}
-function normalizeEntry(raw) {
-  if (typeof raw === "string") {
-    return { kind: "string", value: raw };
-  }
-  return raw;
-}
-function normalizeSecrets(raw) {
-  const out = {};
-  for (const [k, v] of Object.entries(raw)) {
-    out[k] = normalizeEntry(v);
-  }
-  return out;
-}
-function openVault(passphrase, vaultPath) {
-  if (!existsSync6(vaultPath)) {
-    throw new VaultError(`Vault file not found: ${vaultPath}`);
-  }
-  let vaultFile;
-  try {
-    vaultFile = JSON.parse(readFileSync6(vaultPath, "utf8"));
-  } catch {
-    throw new VaultError(`Failed to read vault file: ${vaultPath}`);
-  }
-  const salt = Buffer.from(vaultFile.salt, "hex");
-  const kdfParams = vaultFile.kdf ?? { N: LEGACY_SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
-  const key = deriveKey(passphrase, salt, kdfParams);
-  let plaintext;
-  try {
-    plaintext = decrypt(key, vaultFile.iv, vaultFile.data, vaultFile.tag);
-  } catch {
-    throw new VaultError("Failed to decrypt vault. Wrong passphrase?");
-  }
-  let vaultData;
-  try {
-    vaultData = JSON.parse(plaintext);
-  } catch {
-    throw new VaultError("Vault data is corrupted");
-  }
-  return normalizeSecrets(vaultData.secrets ?? {});
-}
-function saveVault(passphrase, vaultPath, secrets) {
-  if (!existsSync6(vaultPath)) {
-    throw new VaultError(`Vault file not found: ${vaultPath}`);
-  }
-  let releaseLock = null;
-  try {
-    releaseLock = acquireLock(vaultPath, { budgetMs: SAVE_VAULT_LOCK_RETRY_MS }).release;
-  } catch (err) {
-    if (err instanceof VaultBusyError) {
-      throw new VaultError(err.message, { cause: err });
-    }
-    throw err;
-  }
-  try {
-    let vaultFile;
-    try {
-      vaultFile = JSON.parse(readFileSync6(vaultPath, "utf8"));
-    } catch {
-      throw new VaultError(`Failed to read vault file: ${vaultPath}`);
-    }
-    const salt = Buffer.from(vaultFile.salt, "hex");
-    const key = deriveKey(passphrase, salt, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
-    vaultFile.kdf = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
-    const vaultData = { secrets };
-    const { iv, data, tag } = encrypt(key, JSON.stringify(vaultData));
-    vaultFile.iv = iv;
-    vaultFile.data = data;
-    vaultFile.tag = tag;
-    atomicWriteFileSync(vaultPath, JSON.stringify(vaultFile, null, 2), 384);
-  } finally {
-    if (releaseLock !== null) {
-      try {
-        releaseLock();
-      } catch {}
-    }
-  }
-}
-function acquireVaultLock(vaultPath) {
-  try {
-    return acquireLock(vaultPath, { budgetMs: SAVE_VAULT_LOCK_RETRY_MS }).release;
-  } catch (err) {
-    if (err instanceof VaultBusyError) {
-      throw new VaultError(err.message, { cause: err });
-    }
-    throw err;
-  }
-}
-
-// src/vault/resolver.ts
-init_loader();
-
-// src/vault/broker/client.ts
-import { homedir as homedir3 } from "node:os";
-import { join as join3 } from "node:path";
-
-// src/vault/broker/protocol.ts
-init_zod();
-var MAX_FRAME_BYTES = 64 * 1024;
-var AgentNameSchema = exports_external.string().min(1).max(64, "agent name max 64 chars").regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/, "agent name must be kebab-case ASCII (alnum + _- only, first char alnum)").refine((s) => !isReservedAgentName(s), {
-  message: "agent name is reserved"
-});
-var GetRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("get"),
-  key: exports_external.string().min(1),
-  filename: exports_external.string().optional(),
-  token: exports_external.string().optional()
-});
-var PutRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("put"),
-  key: exports_external.string().min(1),
-  entry: exports_external.union([
-    exports_external.object({ kind: exports_external.literal("string"), value: exports_external.string() }),
-    exports_external.object({ kind: exports_external.literal("binary"), value: exports_external.string() })
-  ]),
-  token: exports_external.string().optional(),
-  passphrase: exports_external.string().optional(),
-  attest_via_posture: exports_external.boolean().optional()
-});
-var ListRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("list"),
-  token: exports_external.string().optional()
-});
-var MintGrantRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("mint_grant"),
-  agent: AgentNameSchema,
-  keys: exports_external.array(exports_external.string().min(1)),
-  ttl_seconds: exports_external.number().int().positive().nullable(),
-  description: exports_external.string().optional(),
-  write_keys: exports_external.array(exports_external.string().min(1)).optional(),
-  passphrase: exports_external.string().optional(),
-  attest_via_posture: exports_external.boolean().optional(),
-  decision_id: exports_external.string().optional()
-});
-var ListGrantsRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("list_grants"),
-  agent: AgentNameSchema.optional(),
-  passphrase: exports_external.string().optional(),
-  attest_via_posture: exports_external.boolean().optional()
-});
-var RevokeGrantRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("revoke_grant"),
-  id: exports_external.string().min(1)
-});
-var StatusRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("status")
-});
-var LockRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("lock")
-});
-var PreflightAccessRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("preflight_access"),
-  agent: AgentNameSchema,
-  keys: exports_external.array(exports_external.string().min(1)).min(1).max(128)
-});
-var OkPreflightAccessResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  op: exports_external.literal("preflight_access"),
-  results: exports_external.array(exports_external.object({
-    key: exports_external.string(),
-    exists: exports_external.boolean(),
-    acl_ok: exports_external.boolean(),
-    acl_reason: exports_external.string().optional(),
-    scope_ok: exports_external.boolean(),
-    scope_reason: exports_external.string().optional()
-  }))
-});
-var ApprovalRequestRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("approval_request"),
-  agent_unit: exports_external.string().min(1),
-  scope: exports_external.string().min(1),
-  action: exports_external.string().min(1),
-  approver_set: exports_external.array(exports_external.string()),
-  why: exports_external.string().optional(),
-  ttl_ms: exports_external.number().int().positive().optional()
-});
-var ApprovalLookupRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("approval_lookup"),
-  agent_unit: exports_external.string().min(1),
-  scope: exports_external.string().min(1),
-  action: exports_external.string().min(1),
-  current_approver_set: exports_external.array(exports_external.string())
-});
-var ApprovalLookupByRequestRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("approval_lookup_by_request"),
-  agent_unit: exports_external.string().min(1),
-  request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
-  current_approver_set: exports_external.array(exports_external.string())
-});
-var ApprovalConsumeRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("approval_consume"),
-  request_id: exports_external.string().regex(/^[0-9a-f]{32}$/)
-});
-var ApprovalRevokeRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("approval_revoke"),
-  decision_id: exports_external.string().min(1),
-  actor: exports_external.string().min(1),
-  reason: exports_external.string().optional()
-});
-var ApprovalListRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("approval_list"),
-  agent_unit: exports_external.string().optional()
-});
-var ApprovalDecisionModeSchema = exports_external.enum([
-  "allow_once",
-  "allow_always",
-  "allow_ttl",
-  "deny",
-  "deny_perm"
-]);
-var ApprovalRecordRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("approval_record"),
-  request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
-  decision: ApprovalDecisionModeSchema,
-  approver_set: exports_external.array(exports_external.string()),
-  granted_by_user_id: exports_external.number().int(),
-  ttl_ms: exports_external.number().int().positive().nullable().optional()
-});
-var ApprovalConsumeRecordRequestSchema = exports_external.object({
-  v: exports_external.literal(1),
-  op: exports_external.literal("approval_consume_record"),
-  request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
-  decision: ApprovalDecisionModeSchema,
-  approver_set: exports_external.array(exports_external.string()),
-  granted_by_user_id: exports_external.number().int(),
-  ttl_ms: exports_external.number().int().positive().nullable().optional()
-});
-var RequestSchema = exports_external.discriminatedUnion("op", [
-  GetRequestSchema,
-  PutRequestSchema,
-  ListRequestSchema,
-  StatusRequestSchema,
-  LockRequestSchema,
-  PreflightAccessRequestSchema,
-  MintGrantRequestSchema,
-  ListGrantsRequestSchema,
-  RevokeGrantRequestSchema,
-  ApprovalRequestRequestSchema,
-  ApprovalLookupRequestSchema,
-  ApprovalLookupByRequestRequestSchema,
-  ApprovalConsumeRequestSchema,
-  ApprovalRevokeRequestSchema,
-  ApprovalListRequestSchema,
-  ApprovalRecordRequestSchema,
-  ApprovalConsumeRecordRequestSchema
-]);
-var VaultEntrySchema = exports_external.union([
-  exports_external.object({ kind: exports_external.literal("string"), value: exports_external.string() }),
-  exports_external.object({ kind: exports_external.literal("binary"), value: exports_external.string() }),
-  exports_external.object({
-    kind: exports_external.literal("files"),
-    files: exports_external.record(exports_external.string(), exports_external.object({
-      encoding: exports_external.enum(["utf8", "base64"]),
-      value: exports_external.string()
-    }))
-  })
-]);
-var ErrorCode = exports_external.enum([
-  "LOCKED",
-  "DENIED",
-  "UNKNOWN_KEY",
-  "BAD_REQUEST",
-  "INTERNAL",
-  "AUDIT_UNAVAILABLE"
-]);
-var OkEntryResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  entry: VaultEntrySchema
-});
-var OkKeysResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  keys: exports_external.array(exports_external.string())
-});
-var BrokerStatus = exports_external.object({
-  unlocked: exports_external.boolean(),
-  keyCount: exports_external.number().int().nonnegative(),
-  uptimeSec: exports_external.number().nonnegative()
-});
-var OkStatusResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  status: BrokerStatus
-});
-var OkLockResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  locked: exports_external.literal(true)
-});
-var OkPutResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  put: exports_external.literal(true),
-  key: exports_external.string()
-});
-var OkMintGrantResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  token: exports_external.string(),
-  id: exports_external.string(),
-  expires_at: exports_external.number().nullable()
-});
-var GrantMetaSchema = exports_external.object({
-  id: exports_external.string(),
-  agent_slug: exports_external.string(),
-  key_allow: exports_external.array(exports_external.string()),
-  write_allow: exports_external.array(exports_external.string()).default([]),
-  expires_at: exports_external.number().nullable(),
-  created_at: exports_external.number(),
-  description: exports_external.string().nullable()
-});
-var OkListGrantsResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  grants: exports_external.array(GrantMetaSchema)
-});
-var OkRevokeGrantResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  revoked: exports_external.boolean()
-});
-var OkApprovalRequestResponseSchema = exports_external.discriminatedUnion("state", [
-  exports_external.object({
-    ok: exports_external.literal(true),
-    kind: exports_external.literal("approval_request"),
-    state: exports_external.literal("pending"),
-    request_id: exports_external.string(),
-    expires_at: exports_external.number()
-  }),
-  exports_external.object({
-    ok: exports_external.literal(true),
-    kind: exports_external.literal("approval_request"),
-    state: exports_external.literal("rate_limited"),
-    retry_after_ms: exports_external.number()
-  })
-]);
-var ApprovalDecisionMetaSchema = exports_external.object({
-  id: exports_external.string(),
-  agent_unit: exports_external.string(),
-  scope: exports_external.string(),
-  action: exports_external.string(),
-  decision: ApprovalDecisionModeSchema,
-  granted_at: exports_external.number(),
-  granted_by_user_id: exports_external.number(),
-  ttl_expires_at: exports_external.number().nullable(),
-  last_used_at: exports_external.number().nullable(),
-  revoked_at: exports_external.number().nullable(),
-  revoke_reason: exports_external.string().nullable(),
-  origin: exports_external.enum(["agent", "operator"]).optional()
-});
-var OkApprovalLookupResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  state: exports_external.enum(["granted", "denied", "pending", "expired", "drift_revoked", "no_decision"]),
-  decision: ApprovalDecisionMetaSchema.nullable().optional()
-});
-var OkApprovalConsumeResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  consumed: exports_external.boolean(),
-  agent_unit: exports_external.string().optional(),
-  scope: exports_external.string().optional(),
-  action: exports_external.string().optional(),
-  why: exports_external.string().nullable().optional()
-});
-var OkApprovalRevokeResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  revoked: exports_external.boolean()
-});
-var OkApprovalListResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  decisions: exports_external.array(ApprovalDecisionMetaSchema)
-});
-var OkApprovalRecordResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  decision_id: exports_external.string()
-});
-var OkApprovalConsumeRecordResponseSchema = exports_external.object({
-  ok: exports_external.literal(true),
-  consumed: exports_external.boolean(),
-  decision_id: exports_external.string().optional(),
-  agent_unit: exports_external.string().optional(),
-  scope: exports_external.string().optional(),
-  action: exports_external.string().optional(),
-  why: exports_external.string().nullable().optional()
-});
-var ErrorResponseSchema = exports_external.object({
-  ok: exports_external.literal(false),
-  code: ErrorCode,
-  msg: exports_external.string()
-});
-var ResponseSchema = exports_external.union([
-  OkEntryResponseSchema,
-  OkKeysResponseSchema,
-  OkStatusResponseSchema,
-  OkLockResponseSchema,
-  OkPreflightAccessResponseSchema,
-  OkPutResponseSchema,
-  OkMintGrantResponseSchema,
-  OkListGrantsResponseSchema,
-  OkRevokeGrantResponseSchema,
-  OkApprovalRequestResponseSchema,
-  OkApprovalLookupResponseSchema,
-  OkApprovalConsumeResponseSchema,
-  OkApprovalRevokeResponseSchema,
-  OkApprovalListResponseSchema,
-  OkApprovalRecordResponseSchema,
-  OkApprovalConsumeRecordResponseSchema,
-  ErrorResponseSchema
-]);
-function decodeRequest(line) {
-  if (Buffer.byteLength(line, "utf8") > MAX_FRAME_BYTES) {
-    throw new RangeError(`Request frame too large (${Buffer.byteLength(line, "utf8")} bytes; max ${MAX_FRAME_BYTES})`);
-  }
-  const obj = JSON.parse(line);
-  return RequestSchema.parse(obj);
-}
-function encodeResponse(resp) {
-  const json = JSON.stringify(resp);
-  if (Buffer.byteLength(json, "utf8") > MAX_FRAME_BYTES) {
-    throw new Error(`Response frame too large (${Buffer.byteLength(json, "utf8")} bytes; max ${MAX_FRAME_BYTES})`);
-  }
-  return json + `
+` + `  claim is true only at the instant it was said. Concretely, never produce a
+` + `  fact whose text resembles any of these: "Switchroom fleet is running image
+` + `  version v0.18.19", "The switchroom repo is at /path/to/fleet, version
+` + `  v0.19.5", "Bank overlord has 43155 pending consolidations", "The build is
+` + `  currently green". If the claim is worth keeping, put the date INSIDE the
+` + `  fact text ("As of 2026-07-19 the fleet was running v0.18.19"); if you
+` + `  cannot date it, drop it. An undated one is recalled forever as though it
+` + `  were still true, which is worse than not remembering it at all.
+` + `- Transient state (unread counts, build status, what is running right now) unless
+` + `  the fact is explicitly dated, in which case record it as a dated observation.
+` + `- Greetings, acknowledgements, and routine operational chatter.
+` + `
+` + `Write each fact so it stands alone: name the thing, the number, and the date. A
+` + `sentence that only makes sense while reading this transcript is not durable.
+` + `
+` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
+` + `nothing durable remains, return an empty facts list.
 `;
-}
-function errorResponse(code, msg) {
-  return { ok: false, code, msg };
-}
-function entryResponse(entry) {
-  const stripped = stripWireFields(entry);
-  return { ok: true, entry: stripped };
-}
-function stripWireFields(entry) {
-  if (entry.kind === "string" || entry.kind === "binary") {
-    return {
-      kind: entry.kind,
-      value: entry.value,
-      ...entry.format !== undefined ? { format: entry.format } : {}
-    };
+var SUPERSEDED_RETAIN_MISSIONS = [
+  "Extract technical decisions, architectural choices, user preferences, project context, and people/tool relationships. Ignore routine greetings and transient operational details.",
+  "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise.",
+  "Extract user preferences, ongoing projects, recurring commitments, " + "important context, and durable facts that should help across future " + "conversations. Skip one-off chatter and temporary task noise, " + "including in-flight workflow/process narration (a sub-task started, " + "paused, or is still running) — only retain the outcome once a task " + "actually completes or a decision is made.",
+  "Extract durable facts that will still be true and useful weeks from now: " + "user preferences and standing rules, ongoing projects and recurring " + "commitments, technical and architectural decisions with their rationale, " + "and people/tool relationships. A preference revealed by a request is " + "durable — record the preference (what the user likes, wants, or always " + `does), not the request itself.
+
+` + `NEVER extract:
+` + "- Agent tool-use traces or narration of what the assistant did (e.g. " + `"the assistant used X to query Y", "ran a search", "sent the message").
+` + "- In-flight workflow/process narration (a sub-task started, paused, or is " + "still running) — retain the outcome only once the task completes or a " + `decision is made.
+` + `- Operation, request, batch or session IDs, UUIDs, hashes, or error codes.
+` + "- Hindsight's own errors, retries, backlogs, or internal state — the " + `memory system's self-reports are not memories.
+` + `- Restatements of the user's current request or the task in progress.
+` + "- Transient state (unread counts, build status, what is running right now) " + "unless the fact is explicitly dated, in which case record it as a dated " + `observation.
+` + `- Greetings, acknowledgements, and routine operational chatter.
+
+` + "If a candidate fact matches an exclusion, drop it rather than rewording " + "it. If nothing durable remains, return an empty facts list.",
+  `Extract durable facts that will still be true and useful weeks from now: user preferences and standing rules, ongoing projects and recurring commitments, technical and architectural decisions with their rationale, and people/tool relationships. A preference revealed by a request is durable — record the preference (what the user likes, wants, or always does), not the request itself.
+` + `
+` + `A TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this
+` + `candidate a file path, a command/process/agent/session id, a temp directory, or
+` + `the location where some output was written? If yes, drop it — it is transcript
+` + `exhaust, not memory.
+` + `
+` + `NEVER extract:
+` + `- Tool results verbatim or paraphrased. Concretely, never produce a fact whose
+` + `  text resembles any of these: "File created successfully at /path/to/file",
+` + `  "A background command with ID bctz4yskm is running, and its output will be
+` + `  written to /tmp/...", "Async agent a745598ba84e71df1 was launched successfully
+` + `  and is running in the background", "User executed a Bash command to sleep for
+` + `  200 seconds", "The assistant used grep to locate 'truncateSync' in src/foo.ts".
+` + `- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.
+` + `- Agent tool-use traces or narration of what the assistant did (e.g. "the
+` + `  assistant used X to query Y", "ran a search", "sent the message").
+` + `- In-flight workflow/process narration (a sub-task started, paused, or is still
+` + `  running) — retain the outcome only once the task completes or a decision is made.
+` + `- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.
+` + `- Slash commands the user typed and their effects (e.g. "User issued /clear to
+` + `  reset assistant state").
+` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
+` + `  system's self-reports are not memories.
+` + `- Restatements of the user's current request or the task in progress.
+` + `- Transient state (unread counts, build status, what is running right now) unless
+` + `  the fact is explicitly dated, in which case record it as a dated observation.
+` + `- Greetings, acknowledgements, and routine operational chatter.
+` + `
+` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
+` + "nothing durable remains, return an empty facts list.",
+  `Extract durable facts that will still be true and useful weeks from now: user preferences and standing rules, ongoing projects and recurring commitments, technical and architectural decisions with their rationale, and people/tool relationships. A preference revealed by a request is durable — record the preference (what the user likes, wants, or always does), not the request itself.
+` + `
+` + `A TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this
+` + `candidate a file path, a command/process/agent/session id, a temp directory, or
+` + `the location where some output was written? If yes, drop it — it is transcript
+` + `exhaust, not memory.
+` + `
+` + `NEVER extract:
+` + `- Tool results verbatim or paraphrased. Concretely, never produce a fact whose
+` + `  text resembles any of these: "File created successfully at /path/to/file",
+` + `  "A background command with ID bctz4yskm is running, and its output will be
+` + `  written to /tmp/...", "Async agent a745598ba84e71df1 was launched successfully
+` + `  and is running in the background", "User executed a Bash command to sleep for
+` + `  200 seconds", "The assistant used grep to locate 'truncateSync' in src/foo.ts".
+` + `- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.
+` + `- Agent tool-use traces or narration of what the assistant did (e.g. "the
+` + `  assistant used X to query Y", "ran a search", "sent the message").
+` + `- In-flight workflow/process narration (a sub-task started, paused, or is still
+` + `  running) — retain the outcome only once the task completes or a decision is made.
+` + `- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.
+` + `- Slash commands the user typed and their effects (e.g. "User issued /clear to
+` + `  reset assistant state").
+` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
+` + `  system's self-reports are not memories.
+` + `- Restatements of the user's current request or the task in progress.
+` + `- Volatile state written as a timeless assertion. A version, count, size,
+` + `  backlog, status, or any "X is running Y" / "X is at Y" / "X is currently Y"
+` + `  claim is true only at the instant it was said. Concretely, never produce a
+` + `  fact whose text resembles any of these: "Switchroom fleet is running image
+` + `  version v0.18.19", "The switchroom repo is at /path/to/fleet, version
+` + `  v0.19.5", "Bank overlord has 43155 pending consolidations", "The build is
+` + `  currently green". If the claim is worth keeping, put the date INSIDE the
+` + `  fact text ("As of 2026-07-19 the fleet was running v0.18.19"); if you
+` + `  cannot date it, drop it. An undated one is recalled forever as though it
+` + `  were still true, which is worse than not remembering it at all.
+` + `- Transient state (unread counts, build status, what is running right now) unless
+` + `  the fact is explicitly dated, in which case record it as a dated observation.
+` + `- Greetings, acknowledgements, and routine operational chatter.
+` + `
+` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
+` + "nothing durable remains, return an empty facts list.",
+  `Extract durable facts that will still be true and useful weeks from now, once this session is forgotten.
+` + `
+` + `DURABILITY GATE. Emit a candidate ONLY if it is one of these five classes:
+` + `- PREFERENCE — what the user likes, wants, or always does; a standing rule or correction.
+` + `- DECISION — a settled choice that changes how future work is done, including a choice NOT to do something. A decision about the mechanics of the CURRENT task (which worker to dispatch, which branch to rebase, which PR to merge now, what to do next) is process narration, not a durable decision — drop it unless it establishes a standing rule or permanently changes a system.
+` + `- FINDING — a root cause, a measurement, or verified behaviour of a system. Include the number.
+` + `- OUTCOME — a completed result that changed the world: what shipped, what a thing turned out to be. Not the act of shipping it.
+` + `- RELATIONSHIP — who a person is, what a project or tool is, and how they connect.
+` + `If a candidate fits none of the five, it is not a memory. Drop it; do not reword it into one.
+` + `
+` + `A preference revealed by a request is durable — record the preference (what the user likes, wants, or always does), not the request itself.
+` + `
+` + `A TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this
+` + `candidate a file path, a command/process/agent/session id, a temp directory, or
+` + `the location where some output was written? If yes, drop it — it is transcript
+` + `exhaust, not memory.
+` + `
+` + `NEVER extract:
+` + `- Tool results verbatim or paraphrased. Concretely, never produce a fact whose
+` + `  text resembles any of these: "File created successfully at /path/to/file",
+` + `  "A background command with ID bctz4yskm is running, and its output will be
+` + `  written to /tmp/...", "Async agent a745598ba84e71df1 was launched successfully
+` + `  and is running in the background", "User executed a Bash command to sleep for
+` + `  200 seconds", "The assistant used grep to locate 'truncateSync' in src/foo.ts".
+` + `- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.
+` + `- Agent tool-use traces or narration of what the assistant did (e.g. "the
+` + `  assistant used X to query Y", "ran a search", "sent the message").
+` + `- The act of delegating, dispatching, spawning, launching, steering or merging
+` + `  work — including when it succeeded. "X was dispatched and completed" is the
+` + `  session describing itself. Record only what the work LEARNED or CHANGED.
+` + `- In-flight workflow/process narration (a sub-task started, paused, or is still
+` + `  running) — retain the outcome only once the task completes or a decision is made.
+` + `- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.
+` + `- Slash commands the user typed and their effects (e.g. "User issued /clear to
+` + `  reset assistant state").
+` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
+` + `  system's self-reports are not memories.
+` + `- Restatements of the user's current request or the task in progress.
+` + `- Transient state (unread counts, build status, what is running right now) unless
+` + `  the fact is explicitly dated, in which case record it as a dated observation.
+` + `- Greetings, acknowledgements, and routine operational chatter.
+` + `
+` + `Write each fact so it stands alone: name the thing, the number, and the date. A
+` + `sentence that only makes sense while reading this transcript is not durable.
+` + `
+` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
+` + `nothing durable remains, return an empty facts list.
+`
+];
+var DEFAULT_OBSERVATIONS_MISSION = `Synthesise durable, standing knowledge about the people, projects, and systems this agent works with: preferences and standing rules, roles and relationships, skills and recurring patterns, technical and operational decisions with their rationale, and the state of long-running work once it lands.
+` + `
+` + `The test is durability, not notability: an observation must still be worth reading weeks from now. A single dated event belongs in an observation only when it establishes or changes a standing fact.
+` + `
+` + `Do NOT synthesise observations from:
+` + `- Transcript exhaust — tool calls and their results, file paths, temp or scratchpad directories, where some output was written, or narration of what an assistant did.
+` + `- Identifiers with no standing meaning: session, agent, request, batch or command IDs, UUIDs, hashes, error codes.
+` + `- In-flight process narration — a task started, paused, or still running. Record the outcome once it lands, not the running state.
+` + `- The memory system's own errors, retries, backlogs, or internal state.
+` + `- Transient state (what is running right now, unread counts, build status) unless the fact is explicitly dated, in which case record it as dated.
+` + `
+` + "If the new facts contain nothing durable, record nothing rather than synthesising a weak observation.";
+var SUPERSEDED_OBSERVATIONS_MISSIONS = [
+  "Synthesise the person's wellbeing patterns, motivations, and emotional " + "context — how habits, setbacks, and encouragement connect over time."
+];
+var PROFILE_MEMORY_DEFAULTS = {
+  "health-coach": {
+    disposition: { skepticism: 2, literalism: 2, empathy: 5 },
+    observations_mission: `You consolidate the memory of a health and fitness coach working with one person. This bank records how that person actually lives and trains.
+` + `
+` + `Synthesise into durable observations:
+` + `- Goals, targets, and the plan currently in force, with the reasoning behind each.
+` + `- Training, nutrition, sleep, and alcohol patterns as they hold over weeks — what the person reliably does, not what they did once.
+` + `- Constraints that shape the plan: injuries, medical guidance, schedule, equipment, foods and sessions they refuse.
+` + `- Motivations, and what actually helps or backfires when they slip.
+` + `- Trends in the numbers: direction and range over time, not any single reading.
+` + `- Corrections to earlier beliefs, recorded explicitly as corrections.
+` + `
+` + `A single day's log, weight reading, or session is evidence, not an observation. Record one only when it establishes or changes a standing pattern, target, or constraint — then fold it into the observation for that pattern and say what changed and roughly when.
+` + `
+` + `Granularity: one observation per habit, target, constraint, or trend. Aggregate repeated daily evidence into the observation for that pattern rather than creating one per day, and keep training, nutrition, and sleep as separate observations.
+` + `
+` + "Word observations as the person's own pattern and framing, never as a verdict on them."
+  },
+  "executive-assistant": {
+    disposition: { skepticism: 4, literalism: 4, empathy: 3 },
+    observations_mission: `You consolidate the memory of an executive assistant working for one person. This bank records that person's commitments, people, and standing arrangements.
+` + `
+` + `Synthesise into durable observations:
+` + `- Standing rules and preferences: how they want things scheduled, written, and filed, and when they want to be interrupted.
+` + `- People and organisations, and the relationship: who they are, what they are involved in, how to reach them.
+` + `- Recurring commitments and routines, and the constraints around them.
+` + `- Obligations and their state: what was promised to whom, the deadline, and what is still outstanding.
+` + `- Decisions made and decisions deferred, with the reasoning and the trade accepted.
+` + `- Corrections to earlier beliefs, recorded explicitly as corrections.
+` + `
+` + `Live commitment state IS durable knowledge here, not ephemeral chatter. An outstanding obligation, a travel window, an unanswered request, a "currently X" arrangement — these are precisely what this agent must recall later. Keep them, and embed the date inside the observation text so a later reader can judge staleness. Do not drop them as ephemeral.
+` + `
+` + `Granularity: one observation per person, arrangement, or obligation. Aggregate repeated mentions into that observation rather than creating siblings; never merge two different people or two different commitments into one.
+` + `
+` + "Do not synthesise from transcript exhaust: tool calls and their results, message or event identifiers, or narration of what the assistant did."
+  },
+  coding: {
+    disposition: { skepticism: 4, literalism: 5, empathy: 2 },
+    observations_mission: `You consolidate the memory of a software-engineering agent. This bank records real work on real codebases.
+` + `
+` + `Synthesise into durable observations:
+` + `- Architecture and design decisions, each with its rationale and the trade accepted.
+` + `- Root causes, with the evidence chain, and negative results — what was ruled out matters as much as what was found.
+` + `- How the repository works: build, test, and lint commands, conventions, CI gates, and where things live.
+` + `- Outcomes of code work: issue and PR numbers, what changed, whether it merged, what review found.
+` + `- The user's standing rules, preferences, and corrections to this agent's behaviour.
+` + `- Corrections to earlier beliefs, recorded explicitly as corrections.
+` + `
+` + `Repository and service state IS durable knowledge here, not ephemeral chatter. Versions, a failing gate, an open PR, a measured number, a "currently X" claim — these are precisely what this agent must recall later. Keep them, and embed the date inside the observation text so a later reader can judge staleness. Do not drop them as ephemeral.
+` + `
+` + `Granularity: one observation per distinct decision, cause, convention, or work item. Aggregate repeated evidence about the same one into that observation rather than creating siblings; never merge two separate decisions into a single summary.
+` + `
+` + "Do not synthesise from transcript exhaust: tool calls and their results, scratch paths, session or request identifiers, or narration of what the agent did. Prefer specific and falsifiable — naming the file, the number, the commit, or the decision beats summarising the topic."
   }
-  return {
-    kind: "files",
-    files: entry.files
-  };
-}
+};
+// src/agents/reconcile-default-skills.ts
+var warnedMissingPool = new Set;
+var warnedMissingDefault = new Set;
 
-// src/vault/broker/client.ts
-var LEGACY_SOCKET_PATH = join3(homedir3(), ".switchroom", "vault-broker.sock");
-var OPERATOR_SOCKET_PATH = join3(homedir3(), ".switchroom", "broker-operator", "sock");
+// src/telegram/state.ts
+init_paths();
 
-// src/vault/resolver.ts
-var materializedDirs = new Set;
+// src/agents/scaffold.ts
+init_paths();
+init_loader();
+init_resolver();
+init_vault();
 
 // src/setup/onboarding.ts
 init_paths();
@@ -20375,11 +20391,13 @@ function errText(err) {
 }
 
 // src/vault/broker/server.ts
+init_vault();
 import { dirname as dirname7, resolve as resolve9, basename as basename5 } from "node:path";
 import * as os3 from "node:os";
 import * as path5 from "node:path";
 
 // src/vault/migrate-layout.ts
+init_vault();
 import {
   copyFileSync as copyFileSync2,
   chmodSync as chmodSync2,
@@ -20610,6 +20628,10 @@ function readAutoUnlockFile(filePath) {
 }
 var DEFAULT_AUTO_UNLOCK_PATH = "~/.switchroom/vault-auto-unlock";
 
+// src/vault/broker/server.ts
+init_peercred();
+init_protocol();
+
 // src/vault/broker/audit-log.ts
 import * as fs3 from "node:fs";
 import * as os2 from "node:os";