switchroom 0.19.38 → 0.19.39

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.19.38", COMMIT_SHA = "9ec88983";
+var VERSION = "0.19.39", COMMIT_SHA = "4aff2bdd";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -15830,7 +15830,7 @@ function hindsightPgEnv(overrides = new Map) {
   }
   return out;
 }
-var HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION, HINDSIGHT_PG_APP_ANON_MIB = 2560, HINDSIGHT_PG_PAGE_CACHE_FLOOR_MIB = 2048, HINDSIGHT_PG_SHARED_BUFFERS_BUDGET_MIB, HINDSIGHT_PG_DEFAULT_SHARED_BUFFERS_MIB = 3072, HINDSIGHT_PG_DEFAULT_EFFECTIVE_CACHE_SIZE_MIB = 7168, HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE_ENV = "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE", HINDSIGHT_PG_SHARED_BUFFERS_ENV = "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS", HINDSIGHT_PG_FSYNC_ENV = "SWITCHROOM_HINDSIGHT_PG_FSYNC", HINDSIGHT_PG_DEFAULT_FSYNC = "on", HINDSIGHT_PG_DEFAULTS, HINDSIGHT_PG_ENV_KEYS;
+var HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION, HINDSIGHT_PG_APP_ANON_MIB = 2560, HINDSIGHT_PG_PAGE_CACHE_FLOOR_MIB = 2048, HINDSIGHT_PG_SHARED_BUFFERS_BUDGET_MIB, HINDSIGHT_PG_DEFAULT_SHARED_BUFFERS_MIB = 6144, HINDSIGHT_PG_DEFAULT_EFFECTIVE_CACHE_SIZE_MIB = 12288, HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE_ENV = "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE", HINDSIGHT_PG_SHARED_BUFFERS_ENV = "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS", HINDSIGHT_PG_FSYNC_ENV = "SWITCHROOM_HINDSIGHT_PG_FSYNC", HINDSIGHT_PG_DEFAULT_FSYNC = "on", HINDSIGHT_PG_DEFAULTS, HINDSIGHT_PG_ENV_KEYS;
 var init_hindsight_pg_defaults = __esm(() => {
   HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION = 16 * 1024;
   HINDSIGHT_PG_SHARED_BUFFERS_BUDGET_MIB = HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION - HINDSIGHT_PG_APP_ANON_MIB - HINDSIGHT_PG_PAGE_CACHE_FLOOR_MIB;
@@ -15908,7 +15908,7 @@ function hindsightPerfEnv(caps, overrides = new Map) {
 function findUnmanagedHindsightEnvKeys(configEnv) {
   return Object.keys(configEnv ?? {}).filter((key) => !HINDSIGHT_PERF_ENV_KEYS.has(key) && !HINDSIGHT_PG_ENV_KEYS.has(key)).sort();
 }
-var HINDSIGHT_RERANKER_MAX_CANDIDATES_FOR_DERIVATION = 150, HINDSIGHT_DEFAULT_RECALL_MAX_CANDIDATES_PER_SOURCE, HINDSIGHT_DEFAULT_LINK_EXPANSION_PER_ENTITY_LIMIT = 50, HINDSIGHT_DEFAULT_LINK_EXPANSION_TIMEOUT_S = 2, HINDSIGHT_DEFAULT_LLM_REASONING_EFFORT = "low", HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT = 4, HINDSIGHT_DEFAULT_RETAIN_LLM_MAX_CONCURRENT = 1, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT, HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16 = "true", HINDSIGHT_DEFAULT_RERANKER_LOCAL_BATCH_SIZE = 128, HINDSIGHT_DEFAULT_LLM_STRICT_SCHEMA = "true", HINDSIGHT_DEFAULT_LLM_MAX_RETRIES = 2, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM = 2, HINDSIGHT_DEFAULT_MAX_OBSERVATIONS_PER_SCOPE = 1000, HINDSIGHT_DEFAULT_RERANKER_BUCKET_BATCHING = "true", HINDSIGHT_DEFAULT_RERANKER_MAX_CANDIDATES = 150, HINDSIGHT_DEFAULT_RERANKER_LOCAL_MAX_CONCURRENT = 4, HINDSIGHT_DEFAULT_RECALL_MAX_CONCURRENT = 8, HINDSIGHT_DEFAULT_REFLECT_WALL_TIMEOUT_S = 600, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND = 500, HINDSIGHT_DEFAULT_CONSOLIDATION_SLOT_LIMIT = 6, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_SLOTS = 1, HINDSIGHT_DEFAULT_RECENCY_DECAY_FUNCTION = "exponential", HINDSIGHT_DEFAULT_RECENCY_DECAY_HALFLIFE_DAYS = 30, HINDSIGHT_PERF_DEFAULTS_UNGATED, HINDSIGHT_PERF_DEFAULTS_GPU, HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM, HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS, HINDSIGHT_PERF_ENV_KEYS;
+var HINDSIGHT_RERANKER_MAX_CANDIDATES_FOR_DERIVATION = 150, HINDSIGHT_DEFAULT_RECALL_MAX_CANDIDATES_PER_SOURCE, HINDSIGHT_DEFAULT_LINK_EXPANSION_PER_ENTITY_LIMIT = 50, HINDSIGHT_DEFAULT_LINK_EXPANSION_TIMEOUT_S = 2, HINDSIGHT_DEFAULT_LLM_REASONING_EFFORT = "low", HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT = 4, HINDSIGHT_DEFAULT_RETAIN_LLM_MAX_CONCURRENT = 1, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT, HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16 = "true", HINDSIGHT_DEFAULT_RERANKER_LOCAL_BATCH_SIZE = 128, HINDSIGHT_DEFAULT_LLM_STRICT_SCHEMA = "true", HINDSIGHT_DEFAULT_LLM_MAX_RETRIES = 2, HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_PARALLELISM = 2, HINDSIGHT_DEFAULT_MAX_OBSERVATIONS_PER_SCOPE = 1000, HINDSIGHT_DEFAULT_RERANKER_BUCKET_BATCHING = "true", HINDSIGHT_DEFAULT_RERANKER_MAX_CANDIDATES = 150, HINDSIGHT_DEFAULT_RERANKER_LOCAL_MAX_CONCURRENT = 4, HINDSIGHT_DEFAULT_RECALL_MAX_CONCURRENT = 8, HINDSIGHT_DEFAULT_REFLECT_WALL_TIMEOUT_S = 600, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_MEMORIES_PER_ROUND = 250, HINDSIGHT_DEFAULT_CONSOLIDATION_SLOT_LIMIT = 6, HINDSIGHT_DEFAULT_CONSOLIDATION_MAX_SLOTS = 1, HINDSIGHT_DEFAULT_RECENCY_DECAY_FUNCTION = "exponential", HINDSIGHT_DEFAULT_RECENCY_DECAY_HALFLIFE_DAYS = 30, HINDSIGHT_PERF_DEFAULTS_UNGATED, HINDSIGHT_PERF_DEFAULTS_GPU, HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM, HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS, HINDSIGHT_PERF_ENV_KEYS;
 var init_hindsight_perf_defaults = __esm(() => {
   init_hindsight_pg_defaults();
   HINDSIGHT_DEFAULT_RECALL_MAX_CANDIDATES_PER_SOURCE = Math.ceil(HINDSIGHT_RERANKER_MAX_CANDIDATES_FOR_DERIVATION * 0.4);
@@ -45987,6 +45987,38 @@ function installCron(opts) {
   renameSync15(tmp, path6);
   return { status: "installed", path: path6, content };
 }
+function parseCronUser(content) {
+  for (const line of content.split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    if (!trimmed.includes("hindsight-watch"))
+      continue;
+    const fields = trimmed.split(/\s+/);
+    if (fields.length >= 7)
+      return fields[5];
+  }
+  return null;
+}
+function reconcileCron(opts) {
+  const path6 = opts.path ?? CRON_PATH;
+  if (!existsSync63(path6))
+    return { status: "absent", path: path6 };
+  let user = opts.fallbackUser;
+  try {
+    user = parseCronUser(readFileSync60(path6, "utf8")) ?? opts.fallbackUser;
+  } catch {}
+  if (!user) {
+    throw new Error(`cannot reconcile ${path6}: no cron-user parseable from the existing fragment and no fallback user available`);
+  }
+  const r = installCron({ user, binary: opts.binary, path: path6 });
+  return {
+    status: r.status === "installed" ? "reconciled" : "unchanged",
+    path: path6,
+    content: r.content
+  };
+}
 var CRON_PATH = "/etc/cron.d/hindsight-watch", CRON_SCHEDULE = "*/15 * * * *", CRON_LOG_PATH = "/var/log/hindsight-watch.log", CRON_LOCK_PATH = "/run/lock/hindsight-watch.lock";
 var init_install_cron = () => {};
 
@@ -51689,6 +51721,9 @@ import { spawnSync as spawnSync12 } from "node:child_process";
 function fixFor(c, target) {
   return remediationFor(classifyComponent(c), target);
 }
+function hostCliBehindStatus(c) {
+  return c.kind === "cli" ? "fail" : "warn";
+}
 function runComponentVersionChecks(config, opts = {}) {
   const exec = opts.exec ?? defaultExec2;
   const components = collectComponents(opts.cliVersion ?? SWITCHROOM_VERSION, exec);
@@ -51712,10 +51747,11 @@ function runComponentVersionChecks(config, opts = {}) {
     });
   }
   for (const c of report.behind) {
+    const status = hostCliBehindStatus(c);
     results.push({
       name: `component behind: ${c.name}`,
-      status: "warn",
-      detail: `on ${c.version}, expected ${report.target} (${src})`,
+      status,
+      detail: status === "fail" ? `on ${c.version}, expected ${report.target} (${src}) \u2014 the host CLI must never trail the fleet; it self-heals in-band via \`switchroom update\`` : `on ${c.version}, expected ${report.target} (${src})`,
       fix: fixFor(c, report.target)
     });
   }
@@ -68980,9 +69016,9 @@ __export(exports_server, {
   dispatchTool: () => dispatchTool,
   TOOLS: () => TOOLS
 });
-import { spawnSync as spawnSync22 } from "node:child_process";
+import { spawnSync as spawnSync23 } from "node:child_process";
 function execCli(args, stdin) {
-  const r = spawnSync22(CLI_BIN, args, {
+  const r = spawnSync23(CLI_BIN, args, {
     encoding: "utf-8",
     env: process.env,
     timeout: 15000,
@@ -69491,7 +69527,7 @@ __export(exports_server2, {
   TOOLS: () => TOOLS2
 });
 import { randomBytes as randomBytes16 } from "node:crypto";
-import { existsSync as existsSync105 } from "node:fs";
+import { existsSync as existsSync106 } from "node:fs";
 function selfSocketPath() {
   return `/run/switchroom/hostd/${SELF_AGENT}/sock`;
 }
@@ -69518,7 +69554,7 @@ async function dispatchTool2(name, args) {
     return errorText2("hostd MCP: SWITCHROOM_AGENT_NAME env var is not set \u2014 cannot " + "determine which per-agent socket to talk to.");
   }
   const sockPath = selfSocketPath();
-  if (!existsSync105(sockPath)) {
+  if (!existsSync106(sockPath)) {
     return errorText2(`hostd MCP: socket not bound at ${sockPath}. The host-control ` + `daemon is either not installed (run \`switchroom hostd install\`) ` + `or this agent isn't admin-flagged in switchroom.yaml. RFC C ` + `bind-mounts the per-agent socket only when host_control.enabled ` + `is true AND the agent has admin: true.`);
   }
   let req;
@@ -69769,13 +69805,13 @@ function resolveAuditLogPath() {
   if (process.env.HOSTD_AUDIT_LOG_PATH)
     return process.env.HOSTD_AUDIT_LOG_PATH;
   const bindMounted = "/host-home/.switchroom/host-control-audit.log";
-  if (existsSync105(bindMounted))
+  if (existsSync106(bindMounted))
     return bindMounted;
   return defaultAuditLogPath2();
 }
 function getLastUpdateApplyStatus() {
   const path10 = resolveAuditLogPath();
-  if (!existsSync105(path10)) {
+  if (!existsSync106(path10)) {
     return errorText2(`get_status: audit log not found at ${path10}. No update_apply has run yet?`);
   }
   let raw;
@@ -70494,11 +70530,11 @@ var init_test_agents = __esm(() => {
 });
 
 // src/litellm/header-passthrough-guard.ts
-import { existsSync as existsSync108, readdirSync as readdirSync41 } from "node:fs";
+import { existsSync as existsSync109, readdirSync as readdirSync41 } from "node:fs";
 function discoverLiveLitellmConfigPath(opts) {
   const servicesDir = opts?.servicesDir ?? COOLIFY_SERVICES_DIR;
   const readdir2 = opts?.readdirFn ?? ((p) => readdirSync41(p));
-  const exists = opts?.existsFn ?? existsSync108;
+  const exists = opts?.existsFn ?? existsSync109;
   let entries;
   try {
     entries = readdir2(servicesDir);
@@ -70588,7 +70624,7 @@ var init_header_passthrough_guard = __esm(() => {
 });
 
 // src/fleet-health/litellm-config-sensor.ts
-import { readFileSync as readFileSync97, existsSync as existsSync109 } from "node:fs";
+import { readFileSync as readFileSync98, existsSync as existsSync110 } from "node:fs";
 function resolveLitellmConfigPath(explicit, discoverFn = () => discoverLiveLitellmConfigPath()) {
   if (explicit)
     return explicit;
@@ -70599,8 +70635,8 @@ function resolveLitellmConfigPath(explicit, discoverFn = () => discoverLiveLitel
 }
 function scanLitellmConfig(opts = {}) {
   const path10 = resolveLitellmConfigPath(opts.path, opts.discoverFn);
-  const exists = opts.existsFn ?? existsSync109;
-  const read = opts.readFn ?? ((p) => readFileSync97(p, "utf-8"));
+  const exists = opts.existsFn ?? existsSync110;
+  const read = opts.readFn ?? ((p) => readFileSync98(p, "utf-8"));
   const log = opts.log ?? (() => {});
   const nowIso = opts.nowIso ?? new Date().toISOString();
   if (path10 === null) {
@@ -70675,20 +70711,20 @@ __export(exports_scan, {
   ledgerPathForBase: () => ledgerPathForBase
 });
 import {
-  readFileSync as readFileSync98,
+  readFileSync as readFileSync99,
   readdirSync as readdirSync42,
-  existsSync as existsSync110,
-  mkdirSync as mkdirSync63,
-  writeFileSync as writeFileSync46
+  existsSync as existsSync111,
+  mkdirSync as mkdirSync64,
+  writeFileSync as writeFileSync47
 } from "node:fs";
-import { resolve as resolve61, dirname as dirname42 } from "node:path";
+import { resolve as resolve61, dirname as dirname43 } from "node:path";
 import { homedir as homedir61 } from "node:os";
 function resolveSwitchroomBase(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir61()) {
   return resolve61(home2, ".switchroom");
 }
 function listAgents(base) {
   const dir = resolve61(base, "agents");
-  if (!existsSync110(dir))
+  if (!existsSync111(dir))
     return [];
   try {
     return readdirSync42(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
@@ -70717,16 +70753,16 @@ function runScan(opts = {}) {
     let gwText = "";
     let sawArtifact = false;
     try {
-      if (existsSync110(turnsPath)) {
-        turnsText = readFileSync98(turnsPath, "utf-8");
+      if (existsSync111(turnsPath)) {
+        turnsText = readFileSync99(turnsPath, "utf-8");
         sawArtifact = true;
       }
     } catch (e) {
       log(`fleet-health: WARN skipping ${agent} turns.jsonl unreadable: ${String(e)}`);
     }
     try {
-      if (existsSync110(gwPath)) {
-        gwText = readFileSync98(gwPath, "utf-8");
+      if (existsSync111(gwPath)) {
+        gwText = readFileSync99(gwPath, "utf-8");
         sawArtifact = true;
       }
     } catch (e) {
@@ -70768,20 +70804,20 @@ function runScan(opts = {}) {
 function readLedgerIfPresent(base) {
   const path10 = ledgerPathForBase(base);
   try {
-    if (!existsSync110(path10))
+    if (!existsSync111(path10))
       return null;
-    return JSON.parse(readFileSync98(path10, "utf-8"));
+    return JSON.parse(readFileSync99(path10, "utf-8"));
   } catch {
     return null;
   }
 }
 function ledgerPathForBase(base) {
-  return fleetHealthLedgerPath(dirname42(base));
+  return fleetHealthLedgerPath(dirname43(base));
 }
 function writeLedger(base, ledger) {
   const path10 = ledgerPathForBase(base);
-  mkdirSync63(dirname42(path10), { recursive: true });
-  writeFileSync46(path10, JSON.stringify(ledger, null, 2) + `
+  mkdirSync64(dirname43(path10), { recursive: true });
+  writeFileSync47(path10, JSON.stringify(ledger, null, 2) + `
 `, "utf-8");
   return path10;
 }
@@ -92108,9 +92144,9 @@ init_source();
 init_loader();
 init_lifecycle();
 init_compose_env();
-import { existsSync as existsSync80, mkdirSync as mkdirSync45, readFileSync as readFileSync74, realpathSync as realpathSync6, statSync as statSync45, chownSync as chownSync8 } from "node:fs";
-import { spawnSync as spawnSync16 } from "node:child_process";
-import { join as join84, dirname as dirname33, resolve as resolve45 } from "node:path";
+import { existsSync as existsSync81, mkdirSync as mkdirSync46, readFileSync as readFileSync75, realpathSync as realpathSync6, statSync as statSync45, chownSync as chownSync8 } from "node:fs";
+import { spawnSync as spawnSync17 } from "node:child_process";
+import { join as join84, dirname as dirname34, resolve as resolve45 } from "node:path";
 import { homedir as homedir44 } from "node:os";
 
 // src/cli/release-yaml.ts
@@ -92639,10 +92675,151 @@ function defaultSelfUpdateIO() {
 // src/cli/update.ts
 init_self_invoke();
 init_component_versions();
+init_install_cron();
+
+// src/host-cli-self-heal/install-timer.ts
+import { spawnSync as spawnSync16 } from "node:child_process";
+import { existsSync as existsSync80, mkdirSync as mkdirSync45, readFileSync as readFileSync74, renameSync as renameSync20, writeFileSync as writeFileSync31 } from "node:fs";
+import { dirname as dirname33 } from "node:path";
+var SERVICE_PATH = "/etc/systemd/system/switchroom-self-heal.service";
+var TIMER_PATH = "/etc/systemd/system/switchroom-self-heal.timer";
+var TIMER_UNIT = "switchroom-self-heal.timer";
+var SYSTEMD_MARKER = "/run/systemd/system";
+var DOC_URL = "https://github.com/switchroom/switchroom/blob/main/docs/operators/host-cli-self-heal.md";
+function renderService(opts) {
+  const homeLine = opts.home ? `Environment=HOME=${opts.home}
+` : "";
+  return `# switchroom host CLI self-heal \u2014 keeps /usr/local/bin/switchroom from silently
+` + `# trailing the fleet. Managed by \`switchroom update\`; edits are overwritten.
+` + `[Unit]
+` + `Description=Switchroom host CLI self-heal (re-run \`switchroom update\` so the host binary can't silently trail the fleet)
+` + `Documentation=${DOC_URL}
+` + `After=network-online.target docker.service
+` + `Wants=network-online.target
+` + `
+` + `[Service]
+` + `Type=oneshot
+` + `# Run as the operator whose ~/.switchroom holds the fleet config \u2014 NOT root.
+` + `User=${opts.user}
+` + homeLine + `# --skip-images keeps each tick cheap: self-update-cli (the host binary swap)
+` + `# still runs; GHCR pulls and container recreation do not.
+` + `ExecStart=${opts.binary} update --skip-images
+` + `# Self-heal must never wedge the host: bound the run and run at low priority.
+` + `TimeoutStartSec=600
+` + `Nice=10
+`;
+}
+function renderTimer() {
+  return `# switchroom host CLI self-heal timer. Managed by \`switchroom update\`.
+` + `[Unit]
+` + `Description=Run the Switchroom host CLI self-heal every 30 minutes
+` + `Documentation=${DOC_URL}
+` + `
+` + `[Timer]
+` + `OnBootSec=5min
+` + `OnUnitActiveSec=30min
+` + `RandomizedDelaySec=2min
+` + `Persistent=true
+` + `
+` + `[Install]
+` + `WantedBy=timers.target
+`;
+}
+function writeUnitIdempotent(path7, content) {
+  if (existsSync80(path7)) {
+    try {
+      if (readFileSync74(path7, "utf8") === content)
+        return "unchanged";
+    } catch {}
+  }
+  mkdirSync45(dirname33(path7), { recursive: true });
+  const tmp = `${path7}.${process.pid}.tmp`;
+  writeFileSync31(tmp, content, { mode: 420 });
+  renameSync20(tmp, path7);
+  return "written";
+}
+function homeFromPasswd(user) {
+  try {
+    for (const line of readFileSync74("/etc/passwd", "utf8").split(`
+`)) {
+      const f = line.split(":");
+      if (f[0] === user && f[5])
+        return f[5];
+    }
+  } catch {}
+  return;
+}
+function resolveOperatorUser(env2) {
+  const user = env2.SUDO_USER ?? env2.USER ?? env2.LOGNAME;
+  if (!user || user === "root")
+    return null;
+  return user;
+}
+function installSelfHealTimer(deps = {}) {
+  const env2 = deps.env ?? process.env;
+  const systemdBooted = deps.systemdBooted ?? (() => existsSync80(SYSTEMD_MARKER));
+  const geteuid = deps.geteuid ?? (() => typeof process.geteuid === "function" ? process.geteuid() : undefined);
+  const homeForUser = deps.homeForUser ?? homeFromPasswd;
+  const servicePath = deps.servicePath ?? SERVICE_PATH;
+  const timerPath = deps.timerPath ?? TIMER_PATH;
+  const binary = env2.SWITCHROOM_BINARY ?? "/usr/local/bin/switchroom";
+  const user = resolveOperatorUser(env2);
+  const renderUser = user ?? "OPERATOR";
+  const home2 = user ? homeForUser(user) : undefined;
+  const serviceContent = renderService({ binary, user: renderUser, ...home2 ? { home: home2 } : {} });
+  const timerContent = renderTimer();
+  const manualCommands = [
+    "sudo systemctl daemon-reload",
+    `sudo systemctl enable --now ${TIMER_UNIT}`
+  ];
+  const base = { servicePath, timerPath, serviceContent, timerContent, manualCommands };
+  if (!binary.startsWith("/")) {
+    return {
+      status: "skipped",
+      reason: `SWITCHROOM_BINARY must be an absolute path (got ${binary})`,
+      ...base
+    };
+  }
+  if (!systemdBooted()) {
+    return {
+      status: "skipped",
+      reason: "host is not systemd-booted (/run/systemd/system absent)",
+      ...base
+    };
+  }
+  if (geteuid() !== 0) {
+    return { status: "skipped", reason: "not privileged (euid != 0)", ...base };
+  }
+  if (!user) {
+    return {
+      status: "skipped",
+      reason: "no non-root operator user resolvable (SUDO_USER / USER / LOGNAME all unset or root)",
+      ...base
+    };
+  }
+  const svc = writeUnitIdempotent(servicePath, serviceContent);
+  const tim = writeUnitIdempotent(timerPath, timerContent);
+  const changed = svc === "written" || tim === "written";
+  const runner = deps.runner ?? ((cmd, args) => {
+    const r = spawnSync16(cmd, args, { stdio: "inherit" });
+    return { status: r.status ?? 1 };
+  });
+  const reload = runner("systemctl", ["daemon-reload"]);
+  if (reload.status !== 0) {
+    throw new Error(`systemctl daemon-reload failed (exit ${reload.status})`);
+  }
+  const enable = runner("systemctl", ["enable", "--now", TIMER_UNIT]);
+  if (enable.status !== 0) {
+    throw new Error(`systemctl enable --now ${TIMER_UNIT} failed (exit ${enable.status})`);
+  }
+  return { status: changed ? "installed" : "unchanged", ...base };
+}
+
+// src/cli/update.ts
 function defaultPersistPin(configPath) {
   return (pin) => {
     const path7 = configPath ?? findConfigFile();
-    const before = readFileSync74(path7, "utf8");
+    const before = readFileSync75(path7, "utf8");
     const after = setReleasePinInConfig(before, pin);
     if (after === before)
       return;
@@ -92658,16 +92835,16 @@ function defaultPersistPin(configPath) {
 }
 var DEFAULT_COMPOSE_PATH2 = join84(homedir44(), ".switchroom", "compose", "docker-compose.yml");
 function runningFromSwitchroomCheckout(scriptPath) {
-  let dir = dirname33(scriptPath);
+  let dir = dirname34(scriptPath);
   for (let i = 0;i < 12; i++) {
-    if (existsSync80(join84(dir, ".git"))) {
+    if (existsSync81(join84(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync74(join84(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync75(join84(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
     }
-    const parent = dirname33(dir);
+    const parent = dirname34(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -92728,7 +92905,7 @@ function planUpdate(opts) {
         bundleDir: import.meta.dirname,
         execPath: process.execPath,
         scriptPath,
-        inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync80("/.dockerenv")
+        inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync81("/.dockerenv")
       });
       if (detection.kind !== "static-binary") {
         say(source_default.gray(`  host CLI not self-updated: ${detection.reason}
@@ -92801,7 +92978,7 @@ function planUpdate(opts) {
   steps.push({
     name: "pull-images",
     description: "Pull broker / kernel / agent images from GHCR",
-    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync80(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
+    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync81(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
     run: () => {
       const r = runner("docker", [
         "compose",
@@ -92846,6 +93023,69 @@ function planUpdate(opts) {
         throw new Error("switchroom apply failed");
     }
   });
+  steps.push({
+    name: "reconcile-hindsight-watch-cron",
+    description: "Reconcile /etc/cron.d/hindsight-watch (binary path / schedule / flags) on already-armed hosts \u2014 idempotent; no-op when unarmed or already current",
+    skipReason: hostdContext ? "deferred (hostd-context): /etc/cron.d is on the host, not in the hostd container \u2014 finish host-side with `switchroom hindsight-watch --install-cron`" : undefined,
+    isHostdDeferred: hostdContext,
+    run: () => {
+      const say = opts.stdout ?? ((t) => process.stdout.write(t));
+      const binary = process.env.SWITCHROOM_BINARY ?? "/usr/local/bin/switchroom";
+      const fallbackUser = process.env.SUDO_USER ?? process.env.USER ?? process.env.LOGNAME;
+      let res;
+      try {
+        res = reconcileCron({
+          binary,
+          fallbackUser,
+          ...opts.watchCronPath ? { path: opts.watchCronPath } : {}
+        });
+      } catch (e) {
+        say(source_default.yellow(`  hindsight-watch cron not reconciled: ${e.message}
+`));
+        return;
+      }
+      if (res.status === "absent") {
+        say(source_default.gray("  hindsight-watch cron not armed \u2014 skipping reconcile " + "(arm with `switchroom hindsight-watch --install-cron`; doctor FAILs while unarmed)\n"));
+      } else if (res.status === "reconciled") {
+        say(source_default.green(`  hindsight-watch cron reconciled at ${res.path}
+`));
+      } else {
+        say(source_default.gray(`  hindsight-watch cron already current at ${res.path}
+`));
+      }
+    }
+  });
+  steps.push({
+    name: "install-self-heal-timer",
+    description: "Install + enable the switchroom-self-heal systemd timer so a shipped release converges the host binary automatically \u2014 graceful no-op without systemd/privilege",
+    skipReason: hostdContext ? "deferred (hostd-context): /etc/systemd/system is on the host, not in the hostd container \u2014 finish host-side by re-running `switchroom update` on the host" : undefined,
+    isHostdDeferred: hostdContext,
+    run: () => {
+      const say = opts.stdout ?? ((t) => process.stdout.write(t));
+      let res;
+      try {
+        res = installSelfHealTimer(opts.selfHealTimerDeps ?? {});
+      } catch (e) {
+        say(source_default.yellow(`  self-heal timer not installed: ${e.message}
+`));
+        return;
+      }
+      if (res.status === "installed") {
+        say(source_default.green(`  self-heal timer installed + enabled (${res.servicePath}, ${res.timerPath})
+`));
+      } else if (res.status === "unchanged") {
+        say(source_default.gray(`  self-heal timer already current + enabled at ${res.timerPath}
+`));
+      } else {
+        say(source_default.gray(`  self-heal timer not installed automatically: ${res.reason}
+`) + source_default.gray(`  Install it by hand:
+`) + source_default.gray(`    # ${res.servicePath}
+`) + res.serviceContent.replace(/^/gm, source_default.gray("    ")) + source_default.gray(`    # ${res.timerPath}
+`) + res.timerContent.replace(/^/gm, source_default.gray("    ")) + res.manualCommands.map((c) => source_default.gray(`    ${c}
+`)).join(""));
+      }
+    }
+  });
   let hostControlEnabled;
   if (typeof opts.hostControlEnabled === "boolean") {
     hostControlEnabled = opts.hostControlEnabled;
@@ -92922,13 +93162,13 @@ function planUpdate(opts) {
       }
       const source = resolve45(import.meta.dirname, "../../skills");
       const dest = join84(homedir44(), ".switchroom", "skills", "_bundled");
-      if (!existsSync80(source)) {
+      if (!existsSync81(source)) {
         process.stderr.write(`switchroom update: sync-bundled-skills \u2014 CLI bundle has no adjacent skills/ at ${source}; skipping.
 `);
         return;
       }
       try {
-        mkdirSync45(dirname33(dest), { recursive: true });
+        mkdirSync46(dirname34(dest), { recursive: true });
         const r = syncBundledSkills({
           source,
           dest,
@@ -92954,10 +93194,10 @@ function planUpdate(opts) {
       if (opts.syncBundledSkillsFn)
         return;
       const dest = join84(homedir44(), ".switchroom", "skills", "_bundled");
-      if (!existsSync80(dest)) {
+      if (!existsSync81(dest)) {
         return;
       }
-      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync80(join84(dest, key)));
+      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync81(join84(dest, key)));
       if (missing.length > 0) {
         throw new Error(`verify-bundled-skills: builtin default skill(s) missing from the pool after sync: ` + `${missing.join(", ")}. These ship in the CLI package and must exist in ${dest}. ` + `This is a broken sync or a packaging regression \u2014 the pool is not converged.`);
       }
@@ -92992,7 +93232,7 @@ function planUpdate(opts) {
     description: "docker compose up -d --remove-orphans (recreates services with new images / compose)",
     run: () => {
       try {
-        const composeText = readFileSync74(composePath, "utf8");
+        const composeText = readFileSync75(composePath, "utf8");
         const pf = validateBindSources(composeText);
         if (!pf.ok)
           throw new Error(formatPreflightError(pf));
@@ -93026,7 +93266,7 @@ function planUpdate(opts) {
   return steps;
 }
 function defaultRunner2(cmd, args) {
-  const r = spawnSync16(cmd, args, { stdio: "inherit" });
+  const r = spawnSync17(cmd, args, { stdio: "inherit" });
   return { status: r.status ?? 1 };
 }
 function writeMarkerInPreferredLocation(agent, reason, runner) {
@@ -93069,12 +93309,12 @@ function defaultStatusProbe(composePath) {
       try {
         cliBuiltAt = new Date(statSync45(scriptPath).mtimeMs).toISOString();
       } catch {}
-      let dir = dirname33(scriptPath);
+      let dir = dirname34(scriptPath);
       for (let i = 0;i < 8; i++) {
         const pkgPath = join84(dir, "package.json");
-        if (existsSync80(pkgPath)) {
+        if (existsSync81(pkgPath)) {
           try {
-            const pkg = JSON.parse(readFileSync74(pkgPath, "utf-8"));
+            const pkg = JSON.parse(readFileSync75(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
               cliVersion = pkg.version;
           } catch (err) {
@@ -93082,7 +93322,7 @@ function defaultStatusProbe(composePath) {
           }
           break;
         }
-        const parent = dirname33(dir);
+        const parent = dirname34(dir);
         if (parent === dir)
           break;
         dir = parent;
@@ -93095,13 +93335,13 @@ function defaultStatusProbe(composePath) {
     warnings.push("could not resolve CLI version (no package.json found above the resolved script path)");
   }
   const services = [];
-  if (!existsSync80(composePath)) {
+  if (!existsSync81(composePath)) {
     warnings.push(`compose file not found at ${composePath}; service status unknown`);
     return { cliVersion, cliBuiltAt, services, warnings };
   }
   let serviceList = [];
   try {
-    const r = spawnSync16("docker", ["compose", "-p", "switchroom", "-f", composePath, "config", "--services"], { encoding: "utf-8", timeout: 1e4 });
+    const r = spawnSync17("docker", ["compose", "-p", "switchroom", "-f", composePath, "config", "--services"], { encoding: "utf-8", timeout: 1e4 });
     if (r.status !== 0) {
       warnings.push(`docker compose config --services failed: ${r.stderr?.trim() ?? r.error?.message ?? "unknown"}`);
       return { cliVersion, cliBuiltAt, services, warnings };
@@ -93118,7 +93358,7 @@ function defaultStatusProbe(composePath) {
     let containerCreatedAt = null;
     let status = "<unknown>";
     try {
-      const r = spawnSync16("docker", ["inspect", "-f", "{{.Config.Image}}|{{.Created}}|{{.State.Status}}", containerName2], { encoding: "utf-8", timeout: 5000 });
+      const r = spawnSync17("docker", ["inspect", "-f", "{{.Config.Image}}|{{.Created}}|{{.State.Status}}", containerName2], { encoding: "utf-8", timeout: 5000 });
       if (r.status === 0) {
         const [img, created, st] = r.stdout.trim().split("|");
         image = img ?? null;
@@ -93134,7 +93374,7 @@ function defaultStatusProbe(composePath) {
     let imagePulledAt = null;
     if (image) {
       try {
-        const r = spawnSync16("docker", ["image", "inspect", "-f", "{{.Id}}|{{.Created}}|{{.Metadata.LastTagTime}}", image], { encoding: "utf-8", timeout: 5000 });
+        const r = spawnSync17("docker", ["image", "inspect", "-f", "{{.Id}}|{{.Created}}|{{.Metadata.LastTagTime}}", image], { encoding: "utf-8", timeout: 5000 });
         if (r.status === 0) {
           const [id, created, lastTag] = r.stdout.trim().split("|");
           imageDigestShort = id?.replace(/^sha256:/, "").slice(0, 12) ?? null;
@@ -93209,7 +93449,7 @@ function buildReexecArgs(opts) {
   return args;
 }
 function defaultReexec(binaryPath, args) {
-  const r = spawnSync16(binaryPath, args, {
+  const r = spawnSync17(binaryPath, args, {
     stdio: "inherit",
     env: { ...process.env, [SELF_UPDATE_ENV_SENTINEL]: "1" }
   });
@@ -93218,7 +93458,7 @@ function defaultReexec(binaryPath, args) {
 function renderDriftPreamble(opts) {
   try {
     const exec = opts.componentExec ?? ((cmd, args) => {
-      const r = spawnSync16(cmd, args, { encoding: "utf-8", timeout: 1e4 });
+      const r = spawnSync17(cmd, args, { encoding: "utf-8", timeout: 1e4 });
       return { status: r.status ?? 1, stdout: r.stdout ?? "" };
     });
     let pin;
@@ -93342,23 +93582,23 @@ function registerUpdateCommand(program3) {
 
 // src/cli/rollout.ts
 init_helpers();
-import { spawnSync as spawnSync18 } from "node:child_process";
-import { readFileSync as readFileSync76, chownSync as chownSync9, statSync as statSync47 } from "node:fs";
+import { spawnSync as spawnSync19 } from "node:child_process";
+import { readFileSync as readFileSync77, chownSync as chownSync9, statSync as statSync47 } from "node:fs";
 import { homedir as homedir46 } from "node:os";
 
 // src/cli/rollout-pin-journal.ts
 import {
-  existsSync as existsSync81,
-  readFileSync as readFileSync75,
-  writeFileSync as writeFileSync31,
-  renameSync as renameSync20,
+  existsSync as existsSync82,
+  readFileSync as readFileSync76,
+  writeFileSync as writeFileSync32,
+  renameSync as renameSync21,
   unlinkSync as unlinkSync15,
   statSync as statSync46,
-  mkdirSync as mkdirSync46
+  mkdirSync as mkdirSync47
 } from "node:fs";
 import { homedir as homedir45 } from "node:os";
 import { createHash as createHash17 } from "node:crypto";
-import { join as join85, basename as basename9, resolve as resolve46, dirname as dirname34 } from "node:path";
+import { join as join85, basename as basename9, resolve as resolve46, dirname as dirname35 } from "node:path";
 init_flock();
 var PIN_JOURNAL_MAX_AGE_MS = 15 * 60 * 1000;
 var STATE_DIR_NAME = ".switchroom";
@@ -93367,7 +93607,7 @@ function pinJournalDir(configPath) {
   if (override && override.trim().length > 0)
     return override.trim();
   if (configPath) {
-    const dir = dirname34(resolve46(configPath));
+    const dir = dirname35(resolve46(configPath));
     if (basename9(dir) === STATE_DIR_NAME)
       return dir;
   }
@@ -93410,9 +93650,9 @@ function readPinJournal(configPath, warn = (m) => process.stderr.write(m)) {
   const p = pinJournalPath(configPath);
   let raw;
   try {
-    raw = readFileSync75(p, "utf8");
+    raw = readFileSync76(p, "utf8");
   } catch (e) {
-    if (existsSync81(p)) {
+    if (existsSync82(p)) {
       warn(`\u26a0\ufe0f  rollout pin journal: ${p} exists but could not be read ` + `(${e.message}). A provisional \`release.pin\` may be ` + `uncommitted \u2014 verify it host-side before the next reconcile.
 `);
     }
@@ -93463,7 +93703,7 @@ function beginPinPersist(configPath, pin, opts = {}) {
     warn(`\u26a0\ufe0f  rollout pin journal: overwriting an ABANDONED journal at ${p} ` + `(pid ${existing.pid} recorded ${existing.at}, provisional pin ` + `${existing.pin}). Its roll never committed or reverted; \`release.pin\` ` + `in ${configPath} may still name that unproven build \u2014 verify it.
 `);
   }
-  const priorPin = getReleasePinFromConfig(readFileSync75(configPath, "utf8"));
+  const priorPin = getReleasePinFromConfig(readFileSync76(configPath, "utf8"));
   const journal = {
     v: 1,
     configPath,
@@ -93472,10 +93712,10 @@ function beginPinPersist(configPath, pin, opts = {}) {
     pid: process.pid,
     at: new Date().toISOString()
   };
-  mkdirSync46(dirname34(p), { recursive: true });
+  mkdirSync47(dirname35(p), { recursive: true });
   const tmp = `${p}.${process.pid}.tmp`;
-  writeFileSync31(tmp, JSON.stringify(journal), { encoding: "utf8", mode: 384 });
-  renameSync20(tmp, p);
+  writeFileSync32(tmp, JSON.stringify(journal), { encoding: "utf8", mode: 384 });
+  renameSync21(tmp, p);
   return journal;
 }
 function commitPinPersist(configPath) {
@@ -93484,7 +93724,7 @@ function commitPinPersist(configPath) {
     unlinkSync15(p);
     return null;
   } catch (e) {
-    if (!existsSync81(p))
+    if (!existsSync82(p))
       return null;
     return `rollout pin journal: FAILED to clear ${p} after a SUCCESSFUL roll ` + `(${e.message}). Delete it host-side \u2014 while it exists, ` + `recovery may revert a proven \`release.pin\`.`;
   }
@@ -93506,7 +93746,7 @@ function rollbackPinPersist(configPath, opts = {}) {
     }
   }
   try {
-    const current = readFileSync75(configPath, "utf8");
+    const current = readFileSync76(configPath, "utf8");
     const next = journal.priorPin ? setReleasePinInConfig(current, journal.priorPin) : deleteReleasePinInConfig(current);
     let mode = 384;
     try {
@@ -93515,7 +93755,7 @@ function rollbackPinPersist(configPath, opts = {}) {
     if (opts.writeConfig) {
       opts.writeConfig(configPath, next, mode);
     } else {
-      writeFileSync31(configPath, next, { encoding: "utf8", mode });
+      writeFileSync32(configPath, next, { encoding: "utf8", mode });
     }
   } catch (e) {
     return {
@@ -93563,10 +93803,10 @@ init_audit_reader();
 init_hindsight();
 
 // src/cli/deploy-version-guard.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
+import { spawnSync as spawnSync18 } from "node:child_process";
 var DOCKER_INSPECT_TIMEOUT_MS = 60 * 1000;
 var defaultRunner3 = (args) => {
-  const r = spawnSync17("docker", args, {
+  const r = spawnSync18("docker", args, {
     encoding: "utf8",
     timeout: DOCKER_INSPECT_TIMEOUT_MS,
     killSignal: "SIGKILL"
@@ -93990,7 +94230,7 @@ function isSpawnTimeout(r, killSignal) {
 var ROLLOUT_KILL_SIGNAL = "SIGKILL";
 function createRolloutDeps(params) {
   const { configPath, scriptPath, hostdCtx } = params;
-  const spawn6 = params.spawn ?? spawnSync18;
+  const spawn6 = params.spawn ?? spawnSync19;
   const warn = params.warn ?? ((line) => process.stderr.write(line));
   const self = resolveSelfInvocation({
     execPath: params.execPath ?? process.execPath,
@@ -94075,7 +94315,7 @@ function createRolloutDeps(params) {
       return { status: r.ok ? 0 : 1, stdout: r.stdout };
     }),
     persistPin: (pin) => {
-      const before = readFileSync76(configPath, "utf8");
+      const before = readFileSync77(configPath, "utf8");
       const after = setReleasePinInConfig(before, pin);
       if (after === before)
         return false;
@@ -94263,8 +94503,8 @@ init_helpers();
 init_lifecycle();
 init_resolve_version();
 import { execSync as execSync3 } from "node:child_process";
-import { existsSync as existsSync82, readFileSync as readFileSync77 } from "node:fs";
-import { dirname as dirname35, join as join86 } from "node:path";
+import { existsSync as existsSync83, readFileSync as readFileSync78 } from "node:fs";
+import { dirname as dirname36, join as join86 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync3("claude --version 2>/dev/null", {
@@ -94315,15 +94555,15 @@ function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 10 && dir && dir !== "/"; i++) {
     const pkgPath = join86(dir, "package.json");
-    if (existsSync82(pkgPath)) {
+    if (existsSync83(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync77(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync82(join86(dir, ".git"))) {
+        const pkg = JSON.parse(readFileSync78(pkgPath, "utf-8"));
+        if (pkg.name === "switchroom" && existsSync83(join86(dir, ".git"))) {
           return dir;
         }
       } catch {}
     }
-    dir = dirname35(dir);
+    dir = dirname36(dir);
   }
   return null;
 }
@@ -94497,7 +94737,7 @@ init_merge();
 
 // src/agents/session-retention.ts
 import {
-  existsSync as existsSync83,
+  existsSync as existsSync84,
   readdirSync as readdirSync28,
   statSync as statSync48,
   unlinkSync as unlinkSync16
@@ -94508,7 +94748,7 @@ var DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS = 30;
 var MIN_KEEP = 2;
 function collectSessionJsonl(claudeConfigDir) {
   const projects = join87(claudeConfigDir, "projects");
-  if (!existsSync83(projects))
+  if (!existsSync84(projects))
     return [];
   const found = [];
   const walk2 = (dir) => {
@@ -94644,15 +94884,15 @@ function registerHandoffCommand(program3) {
 // src/issues/store.ts
 import {
   closeSync as closeSync16,
-  existsSync as existsSync84,
-  mkdirSync as mkdirSync47,
+  existsSync as existsSync85,
+  mkdirSync as mkdirSync48,
   openSync as openSync16,
   readdirSync as readdirSync29,
-  readFileSync as readFileSync78,
-  renameSync as renameSync21,
+  readFileSync as readFileSync79,
+  renameSync as renameSync22,
   statSync as statSync49,
   unlinkSync as unlinkSync17,
-  writeFileSync as writeFileSync32,
+  writeFileSync as writeFileSync33,
   writeSync as writeSync9
 } from "node:fs";
 import { join as join88 } from "node:path";
@@ -94683,11 +94923,11 @@ var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
   const path7 = join88(stateDir, ISSUES_FILE);
-  if (!existsSync84(path7))
+  if (!existsSync85(path7))
     return [];
   let raw;
   try {
-    raw = readFileSync78(path7, "utf-8");
+    raw = readFileSync79(path7, "utf-8");
   } catch {
     return [];
   }
@@ -94760,7 +95000,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve49(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync84(join88(stateDir, ISSUES_FILE)))
+  if (!existsSync85(join88(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -94778,7 +95018,7 @@ function resolve49(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync84(join88(stateDir, ISSUES_FILE)))
+  if (!existsSync85(join88(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -94796,7 +95036,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync84(join88(stateDir, ISSUES_FILE)))
+  if (!existsSync85(join88(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -94826,7 +95066,7 @@ function prune(stateDir, opts = {}) {
   });
 }
 function ensureDir(stateDir) {
-  mkdirSync47(stateDir, { recursive: true });
+  mkdirSync48(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
   const path7 = join88(stateDir, ISSUES_FILE);
@@ -94835,8 +95075,8 @@ function writeAll(stateDir, events) {
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
 `) + `
 `;
-  writeFileSync32(tmp, body, "utf-8");
-  renameSync21(tmp, path7);
+  writeFileSync33(tmp, body, "utf-8");
+  renameSync22(tmp, path7);
 }
 var ORPHAN_TMP_TTL_MS = 60000;
 var TMP_PREFIX = `${ISSUES_FILE}.tmp-`;
@@ -94898,7 +95138,7 @@ function withLock(stateDir, fn) {
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync78(lockPath, "utf-8").trim();
+    pidStr = readFileSync79(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
@@ -95146,20 +95386,20 @@ function relTime(deltaMs) {
 
 // src/cli/deps.ts
 init_source();
-import { existsSync as existsSync87 } from "node:fs";
+import { existsSync as existsSync88 } from "node:fs";
 import { homedir as homedir49 } from "node:os";
 import { join as join91, resolve as resolve50 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash18 } from "node:crypto";
 import {
-  existsSync as existsSync85,
-  mkdirSync as mkdirSync48,
-  readFileSync as readFileSync79,
+  existsSync as existsSync86,
+  mkdirSync as mkdirSync49,
+  readFileSync as readFileSync80,
   rmSync as rmSync15,
-  writeFileSync as writeFileSync33
+  writeFileSync as writeFileSync34
 } from "node:fs";
-import { dirname as dirname36, join as join89 } from "node:path";
+import { dirname as dirname37, join as join89 } from "node:path";
 import { homedir as homedir47 } from "node:os";
 import { execFileSync as execFileSync24 } from "node:child_process";
 
@@ -95175,13 +95415,13 @@ function defaultPythonCacheRoot() {
   return join89(homedir47(), ".switchroom", "deps", "python");
 }
 function hashFile(path7) {
-  return createHash18("sha256").update(readFileSync79(path7)).digest("hex");
+  return createHash18("sha256").update(readFileSync80(path7)).digest("hex");
 }
 function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultPythonCacheRoot();
   const hostPython = opts.pythonBin ?? "python3";
-  if (!existsSync85(requirementsPath)) {
+  if (!existsSync86(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
   const venvDir = join89(cacheRoot, skillName);
@@ -95190,8 +95430,8 @@ function ensurePythonEnv(opts) {
   const pythonBin = join89(binDir, "python");
   const pipBin = join89(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
-  if (!force && existsSync85(stampPath) && existsSync85(pythonBin)) {
-    const existingHash = readFileSync79(stampPath, "utf8").trim();
+  if (!force && existsSync86(stampPath) && existsSync86(pythonBin)) {
+    const existingHash = readFileSync80(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -95203,10 +95443,10 @@ function ensurePythonEnv(opts) {
       };
     }
   }
-  if (existsSync85(venvDir)) {
+  if (existsSync86(venvDir)) {
     rmSync15(venvDir, { recursive: true, force: true });
   }
-  mkdirSync48(dirname36(venvDir), { recursive: true });
+  mkdirSync49(dirname37(venvDir), { recursive: true });
   try {
     execFileSync24(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
   } catch (err) {
@@ -95225,7 +95465,7 @@ function ensurePythonEnv(opts) {
     const e = err;
     throw new PythonEnvError(`Failed to install requirements for skill "${skillName}": ${e.message}`, e.stderr?.toString());
   }
-  writeFileSync33(stampPath, targetHash + `
+  writeFileSync34(stampPath, targetHash + `
 `);
   return {
     skillName,
@@ -95241,13 +95481,13 @@ function ensurePythonEnv(opts) {
 import { createHash as createHash19 } from "node:crypto";
 import {
   copyFileSync as copyFileSync12,
-  existsSync as existsSync86,
-  mkdirSync as mkdirSync49,
-  readFileSync as readFileSync80,
+  existsSync as existsSync87,
+  mkdirSync as mkdirSync50,
+  readFileSync as readFileSync81,
   rmSync as rmSync16,
-  writeFileSync as writeFileSync34
+  writeFileSync as writeFileSync35
 } from "node:fs";
-import { dirname as dirname37, join as join90 } from "node:path";
+import { dirname as dirname38, join as join90 } from "node:path";
 import { homedir as homedir48 } from "node:os";
 import { execFileSync as execFileSync25 } from "node:child_process";
 
@@ -95274,20 +95514,20 @@ function defaultNodeCacheRoot() {
   return join90(homedir48(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
-  const sourceDir = dirname37(packageJsonPath);
+  const sourceDir = dirname38(packageJsonPath);
   const hasher = createHash19("sha256");
   hasher.update(`package.json
 `);
-  hasher.update(readFileSync80(packageJsonPath));
+  hasher.update(readFileSync81(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
     const lockPath = join90(sourceDir, lockName);
-    if (existsSync86(lockPath)) {
+    if (existsSync87(lockPath)) {
       hasher.update(`
 `);
       hasher.update(lockName);
       hasher.update(`
 `);
-      hasher.update(readFileSync80(lockPath));
+      hasher.update(readFileSync81(lockPath));
     }
   }
   return hasher.digest("hex");
@@ -95296,17 +95536,17 @@ function ensureNodeEnv(opts) {
   const { skillName, packageJsonPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultNodeCacheRoot();
   const installer = opts.installer ?? "bun";
-  if (!existsSync86(packageJsonPath)) {
+  if (!existsSync87(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
-  const sourceDir = dirname37(packageJsonPath);
+  const sourceDir = dirname38(packageJsonPath);
   const envDir = join90(cacheRoot, skillName);
   const stampPath = join90(envDir, ".package.sha256");
   const nodeModulesDir = join90(envDir, "node_modules");
   const binDir = join90(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
-  if (!force && existsSync86(stampPath) && existsSync86(nodeModulesDir)) {
-    const existingHash = readFileSync80(stampPath, "utf8").trim();
+  if (!force && existsSync87(stampPath) && existsSync87(nodeModulesDir)) {
+    const existingHash = readFileSync81(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -95317,15 +95557,15 @@ function ensureNodeEnv(opts) {
       };
     }
   }
-  if (existsSync86(envDir)) {
+  if (existsSync87(envDir)) {
     rmSync16(envDir, { recursive: true, force: true });
   }
-  mkdirSync49(envDir, { recursive: true });
+  mkdirSync50(envDir, { recursive: true });
   copyFileSync12(packageJsonPath, join90(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
     const lockPath = join90(sourceDir, lockName);
-    if (existsSync86(lockPath)) {
+    if (existsSync87(lockPath)) {
       copyFileSync12(lockPath, join90(envDir, lockName));
       copiedLockfile = true;
     }
@@ -95342,7 +95582,7 @@ function ensureNodeEnv(opts) {
     const e = err;
     throw new NodeEnvError(`Failed to install node deps for skill "${skillName}" with ${installer}: ${e.message}`, e.stderr?.toString());
   }
-  writeFileSync34(stampPath, targetHash + `
+  writeFileSync35(stampPath, targetHash + `
 `);
   return {
     skillName,
@@ -95361,22 +95601,22 @@ function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
   deps.command("rebuild <skill>").description("Rebuild the Python venv and/or Node node_modules cache for a skill").option("-p, --python", "Rebuild only the Python env").option("-n, --node", "Rebuild only the Node env").action(async (skill, opts) => {
     const skillsRoot = builtinSkillsRoot();
-    if (!existsSync87(skillsRoot)) {
+    if (!existsSync88(skillsRoot)) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
     const skillDir = join91(skillsRoot, skill);
-    if (!existsSync87(skillDir)) {
+    if (!existsSync88(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
     const requirementsPath = join91(skillDir, "requirements.txt");
     const packageJsonPath = join91(skillDir, "package.json");
-    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync87(requirementsPath));
-    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync87(packageJsonPath));
+    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync88(requirementsPath));
+    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync88(packageJsonPath));
     let did = 0;
     if (wantPython) {
-      if (!existsSync87(requirementsPath)) {
+      if (!existsSync88(requirementsPath)) {
         console.error(source_default.red(`Skill "${skill}" has no requirements.txt at ${requirementsPath}`));
         process.exit(1);
       }
@@ -95400,7 +95640,7 @@ function registerDepsCommand(program3) {
       }
     }
     if (wantNode) {
-      if (!existsSync87(packageJsonPath)) {
+      if (!existsSync88(packageJsonPath)) {
         console.error(source_default.red(`Skill "${skill}" has no package.json at ${packageJsonPath}`));
         process.exit(1);
       }
@@ -95433,9 +95673,9 @@ function registerDepsCommand(program3) {
 // src/cli/workspace.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync88 } from "node:fs";
+import { existsSync as existsSync89 } from "node:fs";
 import { resolve as resolve51, sep as sep4 } from "node:path";
-import { spawnSync as spawnSync19 } from "node:child_process";
+import { spawnSync as spawnSync20 } from "node:child_process";
 
 // src/agents/workspace.ts
 import { readFile as readFile2, stat } from "node:fs/promises";
@@ -96148,7 +96388,7 @@ function registerWorkspaceCommand(program3) {
       process.exit(1);
     }
     const editor = process.env["EDITOR"] ?? process.env["VISUAL"] ?? "vi";
-    const child = spawnSync19(editor, [target], { stdio: "inherit" });
+    const child = spawnSync20(editor, [target], { stdio: "inherit" });
     if (child.status !== 0 && child.status !== null) {
       process.exit(child.status);
     }
@@ -96210,12 +96450,12 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve51(dir, ".git");
-    if (!existsSync88(gitDir)) {
+    if (!existsSync89(gitDir)) {
       process.stdout.write(`Workspace is not a git repository. Re-run \`switchroom agent create ${agentName}\` ` + `or manually \`git init\` in ${dir} to enable versioning.
 `);
       return;
     }
-    const statusResult = spawnSync19("git", ["status", "--short"], {
+    const statusResult = spawnSync20("git", ["status", "--short"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -96230,7 +96470,7 @@ function registerWorkspaceCommand(program3) {
       return;
     }
     const message = opts.message || `checkpoint: ${new Date().toISOString()}`;
-    const addResult = spawnSync19("git", ["add", "-A"], {
+    const addResult = spawnSync20("git", ["add", "-A"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -96239,7 +96479,7 @@ function registerWorkspaceCommand(program3) {
 `);
       process.exit(1);
     }
-    const commitResult = spawnSync19("git", ["commit", "-m", message], {
+    const commitResult = spawnSync20("git", ["commit", "-m", message], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -96248,7 +96488,7 @@ function registerWorkspaceCommand(program3) {
 `);
       process.exit(1);
     }
-    const shaResult = spawnSync19("git", ["rev-parse", "--short", "HEAD"], {
+    const shaResult = spawnSync20("git", ["rev-parse", "--short", "HEAD"], {
       cwd: dir,
       encoding: "utf-8"
     });
@@ -96264,12 +96504,12 @@ function registerWorkspaceCommand(program3) {
     if (!dir)
       return;
     const gitDir = resolve51(dir, ".git");
-    if (!existsSync88(gitDir)) {
+    if (!existsSync89(gitDir)) {
       process.stdout.write(`Workspace is not a git repository.
 `);
       return;
     }
-    const child = spawnSync19("git", ["status", "--short"], {
+    const child = spawnSync20("git", ["status", "--short"], {
       cwd: dir,
       stdio: "inherit"
     });
@@ -96289,7 +96529,7 @@ function resolveAgentWorkspaceDirOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve51(agentsDir, agentName);
   const dir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync88(dir)) {
+  if (!existsSync89(dir)) {
     process.stderr.write(`workspace: ${dir} does not exist yet. Run \`switchroom setup\` or \`switchroom agent scaffold ${agentName}\` to seed it.
 `);
     return;
@@ -96325,7 +96565,7 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync13, existsSync as existsSync89, readFileSync as readFileSync81, writeFileSync as writeFileSync35 } from "node:fs";
+import { copyFileSync as copyFileSync13, existsSync as existsSync90, readFileSync as readFileSync82, writeFileSync as writeFileSync36 } from "node:fs";
 import { join as join92, resolve as resolve52 } from "node:path";
 init_scaffold();
 init_profiles();
@@ -96343,7 +96583,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
   const agentsDir = resolveAgentsDir(config);
   const agentDir = resolve52(agentsDir, agentName);
   const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync89(workspaceDir)) {
+  if (!existsSync90(workspaceDir)) {
     console.error(`soul: ${workspaceDir} does not exist yet. Run \`switchroom setup\` ` + `or \`switchroom agent scaffold ${agentName}\` to seed it.`);
     process.exit(1);
   }
@@ -96369,11 +96609,11 @@ function registerSoulCommand(program3) {
     const t = resolveSoulTargetOrExit(program3, agentName);
     if (!t)
       return;
-    if (!existsSync89(t.soulPath)) {
+    if (!existsSync90(t.soulPath)) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
-    process.stdout.write(readFileSync81(t.soulPath, "utf-8"));
+    process.stdout.write(readFileSync82(t.soulPath, "utf-8"));
   }));
   cmd.command("reset <agent>").description("Re-seed SOUL.md from the agent's current profile " + "(backs the existing file up to SOUL.md.bak first)").option("-y, --yes", "Skip the confirmation prompt").action(withConfigError(async (agentName, opts) => {
     const t = resolveSoulTargetOrExit(program3, agentName);
@@ -96384,7 +96624,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: profile "${t.profileName}" ships no SOUL.md.hbs \u2014 ` + `nothing to re-seed from.`);
       process.exit(1);
     }
-    const exists = existsSync89(t.soulPath);
+    const exists = existsSync90(t.soulPath);
     if (exists && !opts.yes) {
       if (!isInteractive()) {
         console.error(`soul: ${t.soulPath} already exists. Re-run with --yes to ` + `replace it (the current file is backed up to SOUL.md.bak).`);
@@ -96399,12 +96639,12 @@ function registerSoulCommand(program3) {
     let backupPath;
     if (exists) {
       backupPath = `${t.soulPath}.bak`;
-      if (existsSync89(backupPath)) {
+      if (existsSync90(backupPath)) {
         backupPath = `${t.soulPath}.bak.${Date.now()}`;
       }
       copyFileSync13(t.soulPath, backupPath);
     }
-    writeFileSync35(t.soulPath, content, "utf-8");
+    writeFileSync36(t.soulPath, content, "utf-8");
     if (backupPath) {
       console.log(`soul: re-seeded ${agentName}'s SOUL.md from profile ` + `"${t.profileName}".
 ` + `      Previous version saved to ${backupPath}`);
@@ -96418,7 +96658,7 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync90, readFileSync as readFileSync82, readdirSync as readdirSync30, statSync as statSync50 } from "node:fs";
+import { existsSync as existsSync91, readFileSync as readFileSync83, readdirSync as readdirSync30, statSync as statSync50 } from "node:fs";
 import { resolve as resolve53, join as join93 } from "node:path";
 import { createHash as createHash20 } from "node:crypto";
 init_merge();
@@ -96431,10 +96671,10 @@ function estimateTokens(bytes) {
 }
 function readMcpServerNames(agentDir) {
   const mcpPath = join93(agentDir, ".mcp.json");
-  if (!existsSync90(mcpPath))
+  if (!existsSync91(mcpPath))
     return [];
   try {
-    const parsed = JSON.parse(readFileSync82(mcpPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync83(mcpPath, "utf-8"));
     return Object.keys(parsed.mcpServers ?? {});
   } catch {
     return null;
@@ -96445,7 +96685,7 @@ function sha256(content) {
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
   const projectsDir = join93(claudeConfigDir, "projects");
-  if (!existsSync90(projectsDir))
+  if (!existsSync91(projectsDir))
     return;
   try {
     const entries = readdirSync30(projectsDir, { withFileTypes: true });
@@ -96455,7 +96695,7 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
         continue;
       const projectPath = join93(projectsDir, entry.name);
       const transcriptPath = join93(projectPath, "transcript.jsonl");
-      if (!existsSync90(transcriptPath))
+      if (!existsSync91(transcriptPath))
         continue;
       const stat3 = statSync50(transcriptPath);
       if (!latest || stat3.mtimeMs > latest.mtime) {
@@ -96469,7 +96709,7 @@ function findLatestTranscriptJsonl(claudeConfigDir) {
 }
 function extractLatestUserMessage(transcriptPath) {
   try {
-    const content = readFileSync82(transcriptPath, "utf-8");
+    const content = readFileSync83(transcriptPath, "utf-8");
     const lines = content.trim().split(`
 `).filter(Boolean);
     for (let i = lines.length - 1;i >= 0; i--) {
@@ -96518,7 +96758,7 @@ function registerDebugCommand(program3) {
     }
     const agentsDir = resolveAgentsDir(config);
     const agentDir = resolve53(agentsDir, agentName);
-    if (!existsSync90(agentDir)) {
+    if (!existsSync91(agentDir)) {
       console.error(`Agent directory not found: ${agentDir}`);
       process.exit(1);
     }
@@ -96573,7 +96813,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Append System Prompt (per-session) ===
 `);
-    const handoffContent = existsSync90(handoffPath) ? readFileSync82(handoffPath, "utf-8") : "";
+    const handoffContent = existsSync91(handoffPath) ? readFileSync83(handoffPath, "utf-8") : "";
     if (handoffContent.trim().length > 0) {
       console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
       console.log(handoffContent);
@@ -96584,7 +96824,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
 `);
-    const claudeMdContent = existsSync90(claudeMdPath) ? readFileSync82(claudeMdPath, "utf-8") : "";
+    const claudeMdContent = existsSync91(claudeMdPath) ? readFileSync83(claudeMdPath, "utf-8") : "";
     if (claudeMdContent.trim().length > 0) {
       console.log(`(${formatBytes(claudeMdContent.length)})`);
       console.log(claudeMdContent);
@@ -96595,7 +96835,7 @@ function registerDebugCommand(program3) {
     }
     console.log(`=== Persona (SOUL.md) ===
 `);
-    const soulMdContent = existsSync90(soulMdPath) ? readFileSync82(soulMdPath, "utf-8") : existsSync90(workspaceSoulMdPath) ? readFileSync82(workspaceSoulMdPath, "utf-8") : "";
+    const soulMdContent = existsSync91(soulMdPath) ? readFileSync83(soulMdPath, "utf-8") : existsSync91(workspaceSoulMdPath) ? readFileSync83(workspaceSoulMdPath, "utf-8") : "";
     if (soulMdContent.trim().length > 0) {
       console.log(`(${formatBytes(soulMdContent.length)})`);
       console.log(soulMdContent);
@@ -96659,8 +96899,8 @@ function registerDebugCommand(program3) {
     const fleetDir = join93(agentsDir, "..", "fleet");
     const fleetInvPath = join93(fleetDir, "switchroom-invariants.md");
     const fleetClaudePath = join93(fleetDir, "CLAUDE.md");
-    const fleetInvBytes = existsSync90(fleetInvPath) ? readFileSync82(fleetInvPath, "utf-8").length : 0;
-    const fleetClaudeBytes = existsSync90(fleetClaudePath) ? readFileSync82(fleetClaudePath, "utf-8").length : 0;
+    const fleetInvBytes = existsSync91(fleetInvPath) ? readFileSync83(fleetInvPath, "utf-8").length : 0;
+    const fleetClaudeBytes = existsSync91(fleetClaudePath) ? readFileSync83(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
     const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
     console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
@@ -96693,20 +96933,20 @@ init_source();
 
 // src/worktree/claim.ts
 import { execFileSync as execFileSync26 } from "node:child_process";
-import { closeSync as closeSync17, mkdirSync as mkdirSync51, openSync as openSync17, existsSync as existsSync92, unlinkSync as unlinkSync19 } from "node:fs";
+import { closeSync as closeSync17, mkdirSync as mkdirSync52, openSync as openSync17, existsSync as existsSync93, unlinkSync as unlinkSync19 } from "node:fs";
 import { join as join95, resolve as resolve55 } from "node:path";
 import { homedir as homedir51 } from "node:os";
 import { randomBytes as randomBytes14 } from "node:crypto";
 
 // src/worktree/registry.ts
 import {
-  mkdirSync as mkdirSync50,
-  writeFileSync as writeFileSync36,
-  readFileSync as readFileSync83,
+  mkdirSync as mkdirSync51,
+  writeFileSync as writeFileSync37,
+  readFileSync as readFileSync84,
   readdirSync as readdirSync31,
   unlinkSync as unlinkSync18,
-  existsSync as existsSync91,
-  renameSync as renameSync22
+  existsSync as existsSync92,
+  renameSync as renameSync23
 } from "node:fs";
 import { join as join94, resolve as resolve54 } from "node:path";
 import { homedir as homedir50 } from "node:os";
@@ -96717,20 +96957,20 @@ function recordPath(id) {
   return join94(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
-  mkdirSync50(registryDir(), { recursive: true });
+  mkdirSync51(registryDir(), { recursive: true });
 }
 function writeRecord(record2) {
   ensureDir2();
   const target = recordPath(record2.id);
   const tmp = `${target}.tmp${process.pid}`;
-  writeFileSync36(tmp, JSON.stringify(record2, null, 2) + `
+  writeFileSync37(tmp, JSON.stringify(record2, null, 2) + `
 `, { mode: 384 });
-  renameSync22(tmp, target);
+  renameSync23(tmp, target);
 }
 function readRecord(id) {
   const path10 = recordPath(id);
   try {
-    const raw = readFileSync83(path10, "utf8");
+    const raw = readFileSync84(path10, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -96763,7 +97003,7 @@ function countByRepo(repoPath) {
 // src/worktree/claim.ts
 function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
-  mkdirSync51(lockDir, { recursive: true });
+  mkdirSync52(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
   const lockPath = join95(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
@@ -96819,7 +97059,7 @@ function expandHome(p) {
 }
 async function claimWorktree(input, codeRepos) {
   const repoPath = resolveRepoPath(input.repo, codeRepos);
-  if (!existsSync92(repoPath)) {
+  if (!existsSync93(repoPath)) {
     throw new Error(`Repository path does not exist: ${repoPath}`);
   }
   let concurrencyCap = DEFAULT_CONCURRENCY;
@@ -96841,7 +97081,7 @@ async function claimWorktree(input, codeRepos) {
     const taskSuffix = input.taskName ? sanitizeTaskName(input.taskName) : "task";
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
-    mkdirSync51(baseDir, { recursive: true });
+    mkdirSync52(baseDir, { recursive: true });
     worktreePath = join95(baseDir, `${id}-${taskSuffix}`);
     const ambientOwner = process.env.SWITCHROOM_AGENT_NAME;
     const ownerAgent = input.ownerAgent ?? (ambientOwner != null && ambientOwner !== "" ? ambientOwner : undefined);
@@ -96875,7 +97115,7 @@ async function claimWorktree(input, codeRepos) {
 
 // src/worktree/release.ts
 import { execFileSync as execFileSync27 } from "node:child_process";
-import { existsSync as existsSync93 } from "node:fs";
+import { existsSync as existsSync94 } from "node:fs";
 function releaseWorktree(input) {
   const { id } = input;
   const record2 = readRecord(id);
@@ -96883,7 +97123,7 @@ function releaseWorktree(input) {
     return { released: true };
   }
   let gitSuccess = true;
-  if (existsSync93(record2.path)) {
+  if (existsSync94(record2.path)) {
     try {
       execFileSync27("git", ["worktree", "remove", "--force", record2.path], {
         cwd: record2.repo,
@@ -96922,7 +97162,7 @@ function listWorktrees() {
 
 // src/worktree/reaper.ts
 import { execFileSync as execFileSync28 } from "node:child_process";
-import { existsSync as existsSync94 } from "node:fs";
+import { existsSync as existsSync95 } from "node:fs";
 var STALE_THRESHOLD_MS = 10 * 60 * 1000;
 function reapSkipReasonText(action) {
   switch (action) {
@@ -96983,7 +97223,7 @@ function planReaper(nowMs, deps = {}) {
   const plan = [];
   for (const record2 of listRecords()) {
     const heartbeatAge = now - new Date(record2.heartbeatAt).getTime();
-    const worktreeExists = existsSync94(record2.path);
+    const worktreeExists = existsSync95(record2.path);
     if (!worktreeExists) {
       plan.push({
         record: record2,
@@ -97064,12 +97304,12 @@ function runReaper(nowMs, deps = {}) {
 // src/worktree/gc.ts
 import { execFileSync as execFileSync29 } from "node:child_process";
 import {
-  existsSync as existsSync95,
-  readFileSync as readFileSync84,
+  existsSync as existsSync96,
+  readFileSync as readFileSync85,
   readdirSync as readdirSync32,
   statSync as statSync51,
-  renameSync as renameSync23,
-  mkdirSync as mkdirSync52,
+  renameSync as renameSync24,
+  mkdirSync as mkdirSync53,
   rmSync as rmSync17
 } from "node:fs";
 import { homedir as homedir52 } from "node:os";
@@ -97191,9 +97431,9 @@ function trashRoot() {
   return resolve56(process.env.SWITCHROOM_WORKTREE_TRASH ?? join96(homedir52(), ".switchroom", "worktree-gc-trash"));
 }
 function planGc(roots, deps = {}) {
-  const exists = deps.existsSync ?? existsSync95;
+  const exists = deps.existsSync ?? existsSync96;
   const readDir = deps.readDir ?? ((p) => readdirSync32(p));
-  const readFile4 = deps.readFile ?? ((p) => readFileSync84(p, "utf8"));
+  const readFile4 = deps.readFile ?? ((p) => readFileSync85(p, "utf8"));
   const stat3 = deps.stat ?? ((p) => statSync51(p));
   const exec = deps.exec ?? defaultExec3;
   const prSignal = deps.prSignal ?? ((repo, branch) => defaultPrSignal(repo, branch, exec));
@@ -97321,10 +97561,10 @@ function planGc(roots, deps = {}) {
 }
 function applyGc(plan, deps = {}) {
   const exec = deps.exec ?? defaultExec3;
-  const mkdirp = deps.mkdirp ?? ((p) => void mkdirSync52(p, { recursive: true }));
+  const mkdirp = deps.mkdirp ?? ((p) => void mkdirSync53(p, { recursive: true }));
   const move = deps.move ?? ((src, dest) => {
     try {
-      renameSync23(src, dest);
+      renameSync24(src, dest);
     } catch {
       exec("mv", [src, dest]);
     }
@@ -97370,7 +97610,7 @@ function selectPurgeTargets(entries, olderThanDays) {
   return entries.filter((e) => e.ageDays >= olderThanDays).map((e) => e.path);
 }
 function listTrashEntries(nowMs, deps = {}) {
-  const exists = deps.existsSync ?? existsSync95;
+  const exists = deps.existsSync ?? existsSync96;
   const readDir = deps.readDir ?? ((p) => readdirSync32(p));
   const root = trashRoot();
   if (!exists(root))
@@ -97632,10 +97872,10 @@ init_drive();
 init_scaffold_integration();
 import {
   chmodSync as chmodSync16,
-  mkdirSync as mkdirSync53,
+  mkdirSync as mkdirSync54,
   readdirSync as readdirSync33,
   rmSync as rmSync18,
-  writeFileSync as writeFileSync37
+  writeFileSync as writeFileSync38
 } from "node:fs";
 import { join as join97 } from "node:path";
 function encodeCredentialsFilename(email) {
@@ -97830,14 +98070,14 @@ function resolveCredentialsDir(env2) {
   return join97(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
-  mkdirSync53(dir, { recursive: true, mode: 448 });
+  mkdirSync54(dir, { recursive: true, mode: 448 });
   chmodSync16(dir, 448);
   for (const name of readdirSync33(dir)) {
     rmSync18(join97(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
   const filePath = join97(dir, filename);
-  writeFileSync37(filePath, JSON.stringify(seed), { mode: 384 });
+  writeFileSync38(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync16(filePath, 384);
   return filePath;
 }
@@ -97995,8 +98235,8 @@ function registerDriveMcpLauncherCommand(program3) {
 // src/cli/m365-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
-import { writeFileSync as writeFileSync38, mkdirSync as mkdirSync54 } from "node:fs";
-import { dirname as dirname38, join as join98 } from "node:path";
+import { writeFileSync as writeFileSync39, mkdirSync as mkdirSync55 } from "node:fs";
+import { dirname as dirname39, join as join98 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -98032,8 +98272,8 @@ function computeRefreshDelayMs(expiresAt, now, leadMs = DEFAULT_REFRESH_LEAD_MS)
 function writeRefreshHeartbeat(agentName, data, account) {
   const path10 = heartbeatPath(agentName, account);
   try {
-    mkdirSync54(dirname38(path10), { recursive: true });
-    writeFileSync38(path10, JSON.stringify(data, null, 2), { mode: 420 });
+    mkdirSync55(dirname39(path10), { recursive: true });
+    writeFileSync39(path10, JSON.stringify(data, null, 2), { mode: 420 });
   } catch {}
 }
 function heartbeatPath(agentName, account) {
@@ -98273,8 +98513,8 @@ function registerM365McpLauncherCommand(program3) {
 // src/cli/notion-mcp-launcher.ts
 init_scaffold_integration();
 import { spawn as spawn7 } from "node:child_process";
-import { existsSync as existsSync96, mkdirSync as mkdirSync55, writeFileSync as writeFileSync39 } from "node:fs";
-import { dirname as dirname39 } from "node:path";
+import { existsSync as existsSync97, mkdirSync as mkdirSync56, writeFileSync as writeFileSync40 } from "node:fs";
+import { dirname as dirname40 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
 var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
 var DEFAULT_VAULT_KEY = "notion/integration-token";
@@ -98284,10 +98524,10 @@ function buildNotionMcpArgs(opts) {
 }
 function defaultWriteHeartbeat(path10, contents) {
   try {
-    const dir = dirname39(path10);
-    if (!existsSync96(dir))
-      mkdirSync55(dir, { recursive: true });
-    writeFileSync39(path10, contents);
+    const dir = dirname40(path10);
+    if (!existsSync97(dir))
+      mkdirSync56(dir, { recursive: true });
+    writeFileSync40(path10, contents);
   } catch {}
 }
 async function runNotionMcpLauncher(opts, runtime) {
@@ -98396,7 +98636,7 @@ function registerNotionMcpLauncherCommand(program3) {
 }
 
 // src/cli/hindsight-mcp-shim.ts
-import { mkdirSync as mkdirSync56, readFileSync as readFileSync85, renameSync as renameSync24, writeFileSync as writeFileSync40 } from "node:fs";
+import { mkdirSync as mkdirSync57, readFileSync as readFileSync86, renameSync as renameSync25, writeFileSync as writeFileSync41 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { join as join99 } from "node:path";
 import { createInterface as createInterface6 } from "node:readline";
@@ -98848,18 +99088,18 @@ class HindsightShim {
   }
   writeCache(result) {
     try {
-      mkdirSync56(this.opts.cacheDir, { recursive: true });
+      mkdirSync57(this.opts.cacheDir, { recursive: true });
       const tmp = join99(this.opts.cacheDir, `.${TOOLS_CACHE_FILENAME}.${process.pid}.tmp`);
-      writeFileSync40(tmp, JSON.stringify(result, null, 2) + `
+      writeFileSync41(tmp, JSON.stringify(result, null, 2) + `
 `);
-      renameSync24(tmp, this.cachePath);
+      renameSync25(tmp, this.cachePath);
     } catch (err) {
       this.log(`[hindsight-shim] cache write failed: ${String(err)}`);
     }
   }
   readCache() {
     try {
-      const parsed = JSON.parse(readFileSync85(this.cachePath, "utf-8"));
+      const parsed = JSON.parse(readFileSync86(this.cachePath, "utf-8"));
       if (Array.isArray(parsed.tools))
         return parsed;
       return null;
@@ -99092,7 +99332,7 @@ function registerHindsightMcpShimCommand(program3) {
 
 // src/cli/deliver-file.ts
 init_client2();
-import { readFileSync as readFileSync86, statSync as statSync52 } from "node:fs";
+import { readFileSync as readFileSync87, statSync as statSync52 } from "node:fs";
 import { basename as basename13 } from "node:path";
 
 // src/delivery/onedrive.ts
@@ -99432,7 +99672,7 @@ async function defaultResolveProvider() {
 async function runDeliverFile(localPath, deps = {}) {
   const agentName = safeAgentName(deps.agentName ?? process.env.SWITCHROOM_AGENT_NAME);
   const sizeOf = deps.fileSize ?? ((p) => statSync52(p).size);
-  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync86(p)));
+  const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync87(p)));
   const resolveProvider = deps.resolveProvider ?? defaultResolveProvider;
   let size;
   try {
@@ -99753,7 +99993,7 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync87, existsSync as existsSync97, readdirSync as readdirSync34 } from "node:fs";
+import { readFileSync as readFileSync88, existsSync as existsSync98, readdirSync as readdirSync34 } from "node:fs";
 import { join as join100 } from "node:path";
 import { homedir as homedir53 } from "node:os";
 
@@ -100029,7 +100269,7 @@ function runReport(opts) {
   for (const src of sources) {
     let content;
     try {
-      content = readFileSync87(src.path, "utf-8");
+      content = readFileSync88(src.path, "utf-8");
     } catch (err) {
       process.stderr.write(`status-ask report: cannot read ${src.path}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -100076,7 +100316,7 @@ function runReport(opts) {
 function resolveSources(explicitPath) {
   if (explicitPath != null && explicitPath.trim() !== "") {
     const trimmed = explicitPath.trim();
-    if (!existsSync97(trimmed)) {
+    if (!existsSync98(trimmed)) {
       process.stderr.write(`status-ask report: ${trimmed}: file not found
 `);
       process.exit(1);
@@ -100092,7 +100332,7 @@ function resolveSources(explicitPath) {
   } catch {
     agentsDir = join100(homedir53(), ".switchroom", "agents");
   }
-  if (!existsSync97(agentsDir))
+  if (!existsSync98(agentsDir))
     return [];
   const sources = [];
   let entries;
@@ -100103,7 +100343,7 @@ function resolveSources(explicitPath) {
   }
   for (const name of entries) {
     const path10 = join100(agentsDir, name, "runtime-metrics.jsonl");
-    if (existsSync97(path10)) {
+    if (existsSync98(path10)) {
       sources.push({ path: path10, agent: name });
     }
   }
@@ -100133,13 +100373,13 @@ var import_yaml21 = __toESM(require_dist(), 1);
 init_paths();
 import {
   closeSync as closeSync18,
-  existsSync as existsSync98,
+  existsSync as existsSync99,
   fsyncSync as fsyncSync8,
-  mkdirSync as mkdirSync57,
+  mkdirSync as mkdirSync58,
   openSync as openSync18,
   readdirSync as readdirSync35,
-  readFileSync as readFileSync88,
-  renameSync as renameSync25,
+  readFileSync as readFileSync89,
+  renameSync as renameSync26,
   statSync as statSync53,
   unlinkSync as unlinkSync20,
   writeSync as writeSync10
@@ -100163,15 +100403,15 @@ function overlayPathsFor(agent, opts = {}) {
   };
 }
 function ensureDirs(paths) {
-  mkdirSync57(paths.scheduleDir, { recursive: true });
-  mkdirSync57(paths.scheduleStagingDir, { recursive: true });
+  mkdirSync58(paths.scheduleDir, { recursive: true });
+  mkdirSync58(paths.scheduleStagingDir, { recursive: true });
 }
 function ensureSkillsDirs(paths) {
-  mkdirSync57(paths.skillsDir, { recursive: true });
-  mkdirSync57(paths.skillsStagingDir, { recursive: true });
+  mkdirSync58(paths.skillsDir, { recursive: true });
+  mkdirSync58(paths.skillsStagingDir, { recursive: true });
 }
 function withAgentLock(paths, fn) {
-  mkdirSync57(paths.agentRoot, { recursive: true });
+  mkdirSync58(paths.agentRoot, { recursive: true });
   const start = Date.now();
   const TIMEOUT_MS = 5000;
   let fd = null;
@@ -100221,7 +100461,7 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
     } finally {
       closeSync18(fd);
     }
-    renameSync25(stagingPath, finalPath);
+    renameSync26(stagingPath, finalPath);
     return finalPath;
   });
 }
@@ -100238,7 +100478,7 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
     } finally {
       closeSync18(fd);
     }
-    renameSync25(stagingPath, finalPath);
+    renameSync26(stagingPath, finalPath);
     return finalPath;
   });
 }
@@ -100246,7 +100486,7 @@ function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     const finalPath = join101(paths.skillsDir, `${slug}.yaml`);
-    if (!existsSync98(finalPath))
+    if (!existsSync99(finalPath))
       return false;
     unlinkSync20(finalPath);
     return true;
@@ -100254,7 +100494,7 @@ function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
 }
 function listSkillsOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync98(paths.skillsDir))
+  if (!existsSync99(paths.skillsDir))
     return [];
   const out = [];
   for (const name of readdirSync35(paths.skillsDir)) {
@@ -100262,7 +100502,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
       continue;
     const full = join101(paths.skillsDir, name);
     try {
-      const raw = readFileSync88(full, "utf-8");
+      const raw = readFileSync89(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -100273,7 +100513,7 @@ function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     const finalPath = join101(paths.scheduleDir, `${slug}.yaml`);
-    if (!existsSync98(finalPath))
+    if (!existsSync99(finalPath))
       return false;
     unlinkSync20(finalPath);
     return true;
@@ -100281,7 +100521,7 @@ function deleteOverlayEntry(agent, slug, opts = {}) {
 }
 function listOverlayEntries(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  if (!existsSync98(paths.scheduleDir))
+  if (!existsSync99(paths.scheduleDir))
     return [];
   const out = [];
   for (const name of readdirSync35(paths.scheduleDir)) {
@@ -100289,7 +100529,7 @@ function listOverlayEntries(agent, opts = {}) {
       continue;
     const full = join101(paths.scheduleDir, name);
     try {
-      const raw = readFileSync88(full, "utf-8");
+      const raw = readFileSync89(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
       out.push({ slug, path: full, raw });
     } catch {}
@@ -100509,15 +100749,15 @@ function reconcileAgentCronOnly(agent) {
 // src/cli/agent-config-pending.ts
 import {
   closeSync as closeSync19,
-  existsSync as existsSync99,
+  existsSync as existsSync100,
   fsyncSync as fsyncSync9,
-  mkdirSync as mkdirSync58,
+  mkdirSync as mkdirSync59,
   openSync as openSync19,
   readdirSync as readdirSync36,
-  readFileSync as readFileSync89,
-  renameSync as renameSync26,
+  readFileSync as readFileSync90,
+  renameSync as renameSync27,
   unlinkSync as unlinkSync21,
-  writeFileSync as writeFileSync41,
+  writeFileSync as writeFileSync42,
   writeSync as writeSync11
 } from "node:fs";
 import { join as join102 } from "node:path";
@@ -100529,7 +100769,7 @@ function pendingDir(agent, opts = {}) {
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  mkdirSync58(dir, { recursive: true });
+  mkdirSync59(dir, { recursive: true });
   return dir;
 }
 function newStageId() {
@@ -100558,15 +100798,15 @@ function stagePendingScheduleEntry(opts) {
     } finally {
       closeSync19(fd);
     }
-    renameSync26(yamlTmp, yamlPath);
+    renameSync27(yamlTmp, yamlPath);
   }
-  writeFileSync41(metaPath, JSON.stringify(meta, null, 2) + `
+  writeFileSync42(metaPath, JSON.stringify(meta, null, 2) + `
 `, { mode: 384 });
   return { stageId, yamlPath, metaPath };
 }
 function listPendingScheduleEntries(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
-  if (!existsSync99(dir))
+  if (!existsSync100(dir))
     return [];
   const out = [];
   for (const name of readdirSync36(dir).sort()) {
@@ -100575,10 +100815,10 @@ function listPendingScheduleEntries(agent, opts = {}) {
     const stageId = name.slice(0, -".meta.json".length);
     const metaPath = join102(dir, name);
     const yamlPath = join102(dir, `${stageId}.yaml`);
-    if (!existsSync99(yamlPath))
+    if (!existsSync100(yamlPath))
       continue;
     try {
-      const meta = JSON.parse(readFileSync89(metaPath, "utf-8"));
+      const meta = JSON.parse(readFileSync90(metaPath, "utf-8"));
       if (meta?.v !== 1 || typeof meta.stage_id !== "string")
         continue;
       out.push({ stageId: meta.stage_id, agent: meta.agent, yamlPath, metaPath, meta });
@@ -100594,10 +100834,10 @@ function commitPendingScheduleEntry(opts) {
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
   const finalPath = join102(paths.scheduleDir, `${slug}.yaml`);
-  if (existsSync99(finalPath)) {
+  if (existsSync100(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
-  renameSync26(match.yamlPath, finalPath);
+  renameSync27(match.yamlPath, finalPath);
   unlinkSync21(match.metaPath);
   return { committed: true, path: finalPath, slug };
 }
@@ -100616,7 +100856,7 @@ function denyPendingScheduleEntry(opts) {
 }
 
 // src/cli/agent-config-write.ts
-import { existsSync as existsSync100, readFileSync as readFileSync90 } from "node:fs";
+import { existsSync as existsSync101, readFileSync as readFileSync91 } from "node:fs";
 import { execFileSync as execFileSync30 } from "node:child_process";
 
 // src/scheduler/schedule-report.ts
@@ -101006,8 +101246,8 @@ function scheduleRemove(opts) {
   }
   let priorContent = null;
   try {
-    if (existsSync100(match.path))
-      priorContent = readFileSync90(match.path, "utf-8");
+    if (existsSync101(match.path))
+      priorContent = readFileSync91(match.path, "utf-8");
   } catch {}
   deleteOverlayEntry(agent, match.slug, { root: opts.root });
   const reconcileFn = opts.reconcile === undefined ? opts.root ? null : reconcileAgentCronOnly : opts.reconcile;
@@ -101210,7 +101450,7 @@ function registerAgentConfigWriteCommands(program3) {
     }
     let blob;
     if (opts.jsonl) {
-      blob = existsSync100(opts.jsonl) ? readFileSync90(opts.jsonl, "utf-8") : "";
+      blob = existsSync101(opts.jsonl) ? readFileSync91(opts.jsonl, "utf-8") : "";
     } else {
       try {
         blob = execFileSync30("docker", ["exec", `switchroom-${agent}`, "cat", "/state/agent/scheduler.jsonl"], {
@@ -101242,7 +101482,7 @@ function registerAgentConfigWriteCommands(program3) {
 
 // src/cli/agent-config-skill-write.ts
 var import_yaml22 = __toESM(require_dist(), 1);
-import { existsSync as existsSync101 } from "node:fs";
+import { existsSync as existsSync102 } from "node:fs";
 init_reconcile_default_skills();
 init_agent_config();
 var import_yaml23 = __toESM(require_dist(), 1);
@@ -101322,7 +101562,7 @@ function skillInstall(opts) {
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
   const skillPath = join103(poolDir, skillName);
-  if (!existsSync101(skillPath)) {
+  if (!existsSync102(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
   const yamlText = import_yaml22.stringify({ skills: [skillName] });
@@ -101486,22 +101726,22 @@ function registerAgentConfigSkillWriteCommands(program3) {
 // src/cli/skill.ts
 import {
   closeSync as closeSync20,
-  existsSync as existsSync102,
+  existsSync as existsSync103,
   lstatSync as lstatSync12,
-  mkdirSync as mkdirSync59,
+  mkdirSync as mkdirSync60,
   mkdtempSync as mkdtempSync5,
   openSync as openSync20,
-  readFileSync as readFileSync91,
+  readFileSync as readFileSync92,
   readdirSync as readdirSync37,
   realpathSync as realpathSync7,
-  renameSync as renameSync27,
+  renameSync as renameSync28,
   rmSync as rmSync19,
   statSync as statSync54,
-  writeFileSync as writeFileSync42
+  writeFileSync as writeFileSync43
 } from "node:fs";
 import { tmpdir as tmpdir6, homedir as homedir54 } from "node:os";
-import { dirname as dirname40, join as join104, relative as relative4, resolve as resolve58 } from "node:path";
-import { spawnSync as spawnSync20 } from "node:child_process";
+import { dirname as dirname41, join as join104, relative as relative4, resolve as resolve58 } from "node:path";
+import { spawnSync as spawnSync21 } from "node:child_process";
 
 // src/cli/skill-common.ts
 var import_yaml24 = __toESM(require_dist(), 1);
@@ -101784,7 +102024,7 @@ function loadFromDir(dir) {
         continue;
       }
       if (ent.isFile()) {
-        const buf = readFileSync91(full);
+        const buf = readFileSync92(full);
         files[rel.replace(/\\/g, "/")] = buf.toString("utf-8");
       }
     }
@@ -101795,7 +102035,7 @@ function loadFromDir(dir) {
 function loadFromTarball(tarPath) {
   const isGz = tarPath.endsWith(".gz") || tarPath.endsWith(".tgz");
   const listFlags = isGz ? ["-tzf"] : ["-tf"];
-  const list2 = spawnSync20("tar", [...listFlags, tarPath], {
+  const list2 = spawnSync21("tar", [...listFlags, tarPath], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -101812,7 +102052,7 @@ function loadFromTarball(tarPath) {
   const staging = mkdtempSync5(join104(tmpdir6(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
-    const r = spawnSync20("tar", [
+    const r = spawnSync21("tar", [
       ...flags,
       tarPath,
       "-C",
@@ -101833,7 +102073,7 @@ function loadFromTarball(tarPath) {
   }
 }
 function loadSingleFile(filePath) {
-  const content = readFileSync91(filePath, "utf-8");
+  const content = readFileSync92(filePath, "utf-8");
   return { "SKILL.md": content };
 }
 function loadFromStdin() {
@@ -101887,7 +102127,7 @@ function validatePayload(name, files) {
   if (errors2.length === 0) {
     for (const [path10, content] of Object.entries(files)) {
       if (SH_SCRIPT_RE2.test(path10)) {
-        const r = spawnSync20("bash", ["-n"], {
+        const r = spawnSync21("bash", ["-n"], {
           input: content,
           encoding: "utf-8"
         });
@@ -101898,8 +102138,8 @@ function validatePayload(name, files) {
         const tmp = mkdtempSync5(join104(tmpdir6(), "skill-apply-py-"));
         const tmpPy = join104(tmp, "check.py");
         try {
-          writeFileSync42(tmpPy, content);
-          const r = spawnSync20("python3", ["-m", "py_compile", tmpPy], {
+          writeFileSync43(tmpPy, content);
+          const r = spawnSync21("python3", ["-m", "py_compile", tmpPy], {
             encoding: "utf-8"
           });
           if (r.status !== 0) {
@@ -101916,7 +102156,7 @@ function validatePayload(name, files) {
 function diffSummary(currentDir, files) {
   const lines = [];
   const currentFiles = {};
-  if (existsSync102(currentDir)) {
+  if (existsSync103(currentDir)) {
     const walk2 = (sub) => {
       for (const ent of readdirSync37(sub, { withFileTypes: true })) {
         const full = join104(sub, ent.name);
@@ -101924,7 +102164,7 @@ function diffSummary(currentDir, files) {
         if (ent.isDirectory()) {
           walk2(full);
         } else if (ent.isFile()) {
-          currentFiles[rel.replace(/\\/g, "/")] = readFileSync91(full, "utf-8");
+          currentFiles[rel.replace(/\\/g, "/")] = readFileSync92(full, "utf-8");
         }
       }
     };
@@ -101952,8 +102192,8 @@ function diffSummary(currentDir, files) {
 `);
 }
 function writePayload(poolDir, name, files) {
-  if (!existsSync102(poolDir)) {
-    mkdirSync59(poolDir, { recursive: true, mode: 493 });
+  if (!existsSync103(poolDir)) {
+    mkdirSync60(poolDir, { recursive: true, mode: 493 });
   }
   const target = join104(poolDir, name);
   let targetIsSymlink = false;
@@ -101971,10 +102211,10 @@ function writePayload(poolDir, name, files) {
   try {
     for (const [path10, content] of Object.entries(files)) {
       const full = join104(staging, path10);
-      mkdirSync59(dirname40(full), { recursive: true, mode: 493 });
+      mkdirSync60(dirname41(full), { recursive: true, mode: 493 });
       const fd = openSync20(full, "wx");
       try {
-        writeFileSync42(fd, content);
+        writeFileSync43(fd, content);
       } finally {
         closeSync20(fd);
       }
@@ -101990,9 +102230,9 @@ function writePayload(poolDir, name, files) {
     } catch {}
     if (targetExists) {
       oldRename = `${target}.skill-apply-old-${Date.now()}`;
-      renameSync27(target, oldRename);
+      renameSync28(target, oldRename);
     }
-    renameSync27(staging, target);
+    renameSync28(staging, target);
     if (oldRename) {
       rmSync19(oldRename, { recursive: true, force: true });
       oldRename = null;
@@ -102001,12 +102241,12 @@ function writePayload(poolDir, name, files) {
     try {
       rmSync19(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync102(oldRename)) {
+    if (oldRename && existsSync103(oldRename)) {
       try {
-        if (existsSync102(target)) {
+        if (existsSync103(target)) {
           rmSync19(target, { recursive: true, force: true });
         }
-        renameSync27(oldRename, target);
+        renameSync28(oldRename, target);
       } catch {}
     }
     throw err2;
@@ -102024,7 +102264,7 @@ function registerSkillCommand(program3) {
       files = loadFromStdin();
     } else {
       const fromPath = resolve58(opts.from);
-      if (!existsSync102(fromPath)) {
+      if (!existsSync103(fromPath)) {
         fail4(`--from path does not exist: ${opts.from}`);
       }
       const st = statSync54(fromPath);
@@ -102062,7 +102302,7 @@ function registerSkillCommand(program3) {
 \u2713 Wrote ${name} to ${currentDir}`));
     const self = selfInvokeArgv(["apply", "--non-interactive"]);
     console.log(source_default.gray(`Running \`switchroom apply --non-interactive\`...`));
-    const r = spawnSync20(self.command, self.argv, { stdio: "inherit" });
+    const r = spawnSync21(self.command, self.argv, { stdio: "inherit" });
     if (r.status !== 0) {
       console.error(source_default.yellow(`(warning: \`switchroom apply\` exited ${r.status} \u2014 skill is ` + `in the pool but symlinks may not be refreshed. Re-run manually.)`));
     }
@@ -102080,22 +102320,22 @@ function sumBytes(files) {
 init_esm();
 import {
   closeSync as closeSync21,
-  existsSync as existsSync103,
+  existsSync as existsSync104,
   lstatSync as lstatSync13,
-  mkdirSync as mkdirSync60,
+  mkdirSync as mkdirSync61,
   mkdtempSync as mkdtempSync6,
   openSync as openSync21,
-  readFileSync as readFileSync92,
+  readFileSync as readFileSync93,
   readdirSync as readdirSync38,
-  renameSync as renameSync28,
+  renameSync as renameSync29,
   rmSync as rmSync20,
   statSync as statSync55,
   utimesSync,
-  writeFileSync as writeFileSync43
+  writeFileSync as writeFileSync44
 } from "node:fs";
-import { dirname as dirname41, join as join105, relative as relative5, resolve as resolve59 } from "node:path";
+import { dirname as dirname42, join as join105, relative as relative5, resolve as resolve59 } from "node:path";
 import { homedir as homedir55, tmpdir as tmpdir7 } from "node:os";
-import { spawnSync as spawnSync21 } from "node:child_process";
+import { spawnSync as spawnSync22 } from "node:child_process";
 init_helpers();
 init_agent_config();
 init_source();
@@ -102106,14 +102346,14 @@ var PERSONAL_SKILLS_SUBPATH = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
   const candidate = override ? resolve59(override) : join105(homedir55(), ".switchroom-config");
-  if (!existsSync103(candidate))
+  if (!existsSync104(candidate))
     return null;
   return join105(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
   try {
-    if (!existsSync103(configSkillsRoot))
+    if (!existsSync104(configSkillsRoot))
       return;
     const now = Date.now();
     for (const ent of readdirSync38(configSkillsRoot)) {
@@ -102149,17 +102389,17 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     }
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
-      if (existsSync103(dest)) {
+      if (existsSync104(dest)) {
         const trash = join105(configSkillsRoot, `.${name}-trash-${Date.now()}`);
-        renameSync28(dest, trash);
+        renameSync29(dest, trash);
       }
       return;
     }
-    mkdirSync60(configSkillsRoot, { recursive: true, mode: 493 });
+    mkdirSync61(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
     const staging = mkdtempSync6(join105(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
-      mkdirSync60(dst, { recursive: true, mode: 493 });
+      mkdirSync61(dst, { recursive: true, mode: 493 });
       for (const ent of readdirSync38(src, { withFileTypes: true })) {
         const s = join105(src, ent.name);
         const d = join105(dst, ent.name);
@@ -102168,16 +102408,16 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
         if (ent.isDirectory())
           walk2(s, d);
         else if (ent.isFile()) {
-          writeFileSync43(d, readFileSync92(s));
+          writeFileSync44(d, readFileSync93(s));
         }
       }
     };
     walk2(liveSkillDir, staging);
-    if (existsSync103(dest)) {
+    if (existsSync104(dest)) {
       const prior = join105(configSkillsRoot, `.${name}-prior-${Date.now()}`);
-      renameSync28(dest, prior);
+      renameSync29(dest, prior);
     }
-    renameSync28(staging, dest);
+    renameSync29(staging, dest);
   } catch (err2) {
     process.stderr.write(source_default.yellow(`warning: mirror to ${dest} failed (${err2.message ?? err2}); ` + `live copy still works, but this skill is not version-controlled until next successful sync.
 `));
@@ -102214,7 +102454,7 @@ function trashDir(agentsRoot, agent) {
 }
 function countPersonalSkills(agentsRoot, agent) {
   const skillsDir = join105(agentsRoot, agent, ".claude", "skills");
-  if (!existsSync103(skillsDir))
+  if (!existsSync104(skillsDir))
     return 0;
   let n = 0;
   for (const ent of readdirSync38(skillsDir, { withFileTypes: true })) {
@@ -102261,7 +102501,7 @@ function loadFromDir2(dir) {
       }
       if (ent.isFile()) {
         const rel = relative5(abs, full).replace(/\\/g, "/");
-        files[rel] = readFileSync92(full, "utf-8");
+        files[rel] = readFileSync93(full, "utf-8");
       }
     }
   };
@@ -102299,7 +102539,7 @@ function behavioralValidate(files) {
   const errors2 = [];
   for (const [path10, content] of Object.entries(files)) {
     if (SH_SCRIPT_RE.test(path10)) {
-      const r = spawnSync21("bash", ["-n"], { input: content, encoding: "utf-8" });
+      const r = spawnSync22("bash", ["-n"], { input: content, encoding: "utf-8" });
       if (r.status !== 0) {
         errors2.push(`${path10} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
@@ -102307,8 +102547,8 @@ function behavioralValidate(files) {
       const tmp = mkdtempSync6(join105(tmpdir7(), "skill-personal-py-"));
       const tmpPy = join105(tmp, "check.py");
       try {
-        writeFileSync43(tmpPy, content);
-        const r = spawnSync21("python3", ["-m", "py_compile", tmpPy], {
+        writeFileSync44(tmpPy, content);
+        const r = spawnSync22("python3", ["-m", "py_compile", tmpPy], {
           encoding: "utf-8"
         });
         if (r.status !== 0) {
@@ -102323,7 +102563,7 @@ function behavioralValidate(files) {
 }
 function sweepTrash(agentsRoot, agent) {
   const trash = trashDir(agentsRoot, agent);
-  if (!existsSync103(trash))
+  if (!existsSync104(trash))
     return;
   const now = Date.now();
   for (const ent of readdirSync38(trash, { withFileTypes: true })) {
@@ -102349,16 +102589,16 @@ function writePersonalSkill(targetDir, files) {
   if (targetIsSymlink) {
     fail5(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
-  mkdirSync60(dirname41(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join105(dirname41(targetDir), `.skill-personal-stage-`));
+  mkdirSync61(dirname42(targetDir), { recursive: true, mode: 493 });
+  const staging = mkdtempSync6(join105(dirname42(targetDir), `.skill-personal-stage-`));
   let oldRename = null;
   try {
     for (const [path10, content] of Object.entries(files)) {
       const full = join105(staging, path10);
-      mkdirSync60(dirname41(full), { recursive: true, mode: 493 });
+      mkdirSync61(dirname42(full), { recursive: true, mode: 493 });
       const fd = openSync21(full, "wx");
       try {
-        writeFileSync43(fd, content);
+        writeFileSync44(fd, content);
       } finally {
         closeSync21(fd);
       }
@@ -102374,9 +102614,9 @@ function writePersonalSkill(targetDir, files) {
     } catch {}
     if (targetExists) {
       oldRename = `${targetDir}.personal-old-${Date.now()}`;
-      renameSync28(targetDir, oldRename);
+      renameSync29(targetDir, oldRename);
     }
-    renameSync28(staging, targetDir);
+    renameSync29(staging, targetDir);
     if (oldRename) {
       rmSync20(oldRename, { recursive: true, force: true });
       oldRename = null;
@@ -102385,12 +102625,12 @@ function writePersonalSkill(targetDir, files) {
     try {
       rmSync20(staging, { recursive: true, force: true });
     } catch {}
-    if (oldRename && existsSync103(oldRename)) {
+    if (oldRename && existsSync104(oldRename)) {
       try {
-        if (existsSync103(targetDir)) {
+        if (existsSync104(targetDir)) {
           rmSync20(targetDir, { recursive: true, force: true });
         }
-        renameSync28(oldRename, targetDir);
+        renameSync29(oldRename, targetDir);
       } catch {}
     }
     throw err2;
@@ -102453,7 +102693,7 @@ function loadFiles(opts) {
     return loadFromStdin2();
   }
   const p = resolve59(opts.from);
-  if (!existsSync103(p)) {
+  if (!existsSync104(p)) {
     fail5(`--from path does not exist: ${opts.from}`);
   }
   const st = statSync55(p);
@@ -102461,7 +102701,7 @@ function loadFiles(opts) {
     return loadFromDir2(p);
   }
   if (p.endsWith(".md")) {
-    return { "SKILL.md": readFileSync92(p, "utf-8") };
+    return { "SKILL.md": readFileSync93(p, "utf-8") };
   }
   fail5(`--from must be a directory or a .md file. Got: ${opts.from}`);
 }
@@ -102515,7 +102755,7 @@ function resolveCloneSource(source, opts) {
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
   const dir = join105(root, slug);
-  if (!existsSync103(dir)) {
+  if (!existsSync104(dir)) {
     fail5(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
   const st = lstatSync13(dir);
@@ -102550,7 +102790,7 @@ function readSourceFiles(dir) {
             fail5(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
           }
         } catch {}
-        files[rel] = readFileSync92(full, "utf-8");
+        files[rel] = readFileSync93(full, "utf-8");
       }
     }
   };
@@ -102639,10 +102879,10 @@ function removePersonalAction(name, opts) {
     throw err2;
   }
   const trashRoot2 = trashDir(agentsRoot, agent);
-  mkdirSync60(trashRoot2, { recursive: true, mode: 493 });
+  mkdirSync61(trashRoot2, { recursive: true, mode: 493 });
   const ts = Date.now();
   const trashTarget = join105(trashRoot2, `${name}-${ts}`);
-  renameSync28(target, trashTarget);
+  renameSync29(target, trashTarget);
   const now = new Date(ts);
   utimesSync(trashTarget, now, now);
   mirrorToConfigRepo(agent, name, null);
@@ -102662,7 +102902,7 @@ function listPersonalAction(opts) {
   sweepTrash(agentsRoot, agent);
   const skillsDir = join105(agentsRoot, agent, ".claude", "skills");
   const personal = [];
-  if (existsSync103(skillsDir)) {
+  if (existsSync104(skillsDir)) {
     for (const ent of readdirSync38(skillsDir, { withFileTypes: true })) {
       if (!ent.isDirectory())
         continue;
@@ -102720,7 +102960,7 @@ function registerSkillPersonalCommands(program3) {
 import { createConnection as createConnection4 } from "node:net";
 import { homedir as homedir56 } from "node:os";
 import { join as join106 } from "node:path";
-import { readFileSync as readFileSync93 } from "node:fs";
+import { readFileSync as readFileSync94 } from "node:fs";
 var IPC_CONNECT_TIMEOUT_MS = 5000;
 function gatewaySocketPath() {
   return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join106(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join106(homedir56(), ".claude", "channels", "telegram", "gateway.sock"));
@@ -102758,7 +102998,7 @@ function registerSelfImproveProposeSkillCommand(program3) {
       fail6("agent name required (--agent or $SWITCHROOM_AGENT_NAME)");
     let draft;
     try {
-      draft = JSON.parse(readFileSync93(opts.draft, "utf-8"));
+      draft = JSON.parse(readFileSync94(opts.draft, "utf-8"));
     } catch (e) {
       fail6(`failed to read/parse --draft: ${e.message}`);
     }
@@ -102795,7 +103035,7 @@ function registerSelfImproveProposeSkillCommand(program3) {
 init_esm();
 init_helpers();
 var import_yaml25 = __toESM(require_dist(), 1);
-import { existsSync as existsSync104, readdirSync as readdirSync39, readFileSync as readFileSync94, statSync as statSync56 } from "node:fs";
+import { existsSync as existsSync105, readdirSync as readdirSync39, readFileSync as readFileSync95, statSync as statSync56 } from "node:fs";
 import { homedir as homedir57 } from "node:os";
 import { join as join107, resolve as resolve60 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
@@ -102812,11 +103052,11 @@ function defaultBundledRoot2() {
 }
 function readSkillFrontmatter(skillDir) {
   const mdPath = join107(skillDir, "SKILL.md");
-  if (!existsSync104(mdPath))
+  if (!existsSync105(mdPath))
     return null;
   let content;
   try {
-    content = readFileSync94(mdPath, "utf-8");
+    content = readFileSync95(mdPath, "utf-8");
   } catch {
     return null;
   }
@@ -102856,7 +103096,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
   const skillsDir = join107(agentsRoot, agent, ".claude/skills");
-  if (!existsSync104(skillsDir))
+  if (!existsSync105(skillsDir))
     return [];
   const out = [];
   let entries;
@@ -102894,7 +103134,7 @@ function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   return out;
 }
 function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
-  if (!existsSync104(sharedRoot))
+  if (!existsSync105(sharedRoot))
     return [];
   const out = [];
   let entries;
@@ -102932,7 +103172,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
   return out;
 }
 function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
-  if (!existsSync104(bundledRoot))
+  if (!existsSync105(bundledRoot))
     return [];
   const out = [];
   let entries;
@@ -103090,10 +103330,10 @@ init_source();
 init_helpers();
 init_operator_uid();
 import {
-  existsSync as existsSync106,
-  mkdirSync as mkdirSync61,
+  existsSync as existsSync107,
+  mkdirSync as mkdirSync62,
   readdirSync as readdirSync40,
-  writeFileSync as writeFileSync44,
+  writeFileSync as writeFileSync45,
   statSync as statSync57,
   lstatSync as lstatSync14,
   realpathSync as realpathSync8,
@@ -103101,13 +103341,13 @@ import {
 } from "node:fs";
 import { homedir as homedir58 } from "node:os";
 import { join as join108 } from "node:path";
-import { spawnSync as spawnSync24 } from "node:child_process";
+import { spawnSync as spawnSync25 } from "node:child_process";
 
 // src/cli/singleton-stale-cleanup.ts
-import { spawnSync as spawnSync23 } from "node:child_process";
+import { spawnSync as spawnSync24 } from "node:child_process";
 function makeDockerRunner() {
   return (args) => {
-    const r = spawnSync23("docker", args, { encoding: "utf8" });
+    const r = spawnSync24("docker", args, { encoding: "utf8" });
     return {
       ok: r.status === 0,
       stdout: r.stdout ?? "",
@@ -103466,7 +103706,7 @@ function resolveHostdSkillsTarget(hostHome) {
     console.warn(`switchroom hostd install: ~/.switchroom/skills is a symlink whose target ` + `does not resolve (dangling) \u2014 skipping the skills bind mount. Bundled ` + `skills will be unavailable to rollout/update until the symlink is fixed.`);
     return;
   }
-  if (!existsSync106(target)) {
+  if (!existsSync107(target)) {
     console.warn(`switchroom hostd install: ~/.switchroom/skills resolves to "${target}", ` + `which does not exist \u2014 skipping the skills bind mount. Bundled skills ` + `will be unavailable to rollout/update until the symlink target exists.`);
     return;
   }
@@ -103480,7 +103720,7 @@ function hostdComposePath() {
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
-  if (!existsSync106(p))
+  if (!existsSync107(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -103488,7 +103728,7 @@ function backupExistingCompose() {
   return bak;
 }
 function runDocker(args) {
-  const r = spawnSync24("docker", args, { encoding: "utf8" });
+  const r = spawnSync25("docker", args, { encoding: "utf8" });
   return {
     ok: r.status === 0,
     stdout: r.stdout ?? "",
@@ -103513,7 +103753,7 @@ async function doInstall(opts, program3) {
   }
   const dir = hostdDir();
   const composePath = hostdComposePath();
-  mkdirSync61(dir, { recursive: true });
+  mkdirSync62(dir, { recursive: true });
   const imageTag = resolveHostdImageTag(opts.tag, cfg.release);
   const guard = checkDowngrade({
     container: "switchroom-hostd",
@@ -103546,7 +103786,7 @@ async function doInstall(opts, program3) {
   const bak = backupExistingCompose();
   if (bak)
     console.log(source_default.dim(`  Backed up existing compose to ${bak}`));
-  writeFileSync44(composePath, yaml, "utf8");
+  writeFileSync45(composePath, yaml, "utf8");
   console.log(source_default.green(`  \u2713 Wrote ${composePath}`));
   const adminAgents = Object.entries(cfg.agents ?? {}).filter(([, a]) => a?.admin === true).map(([name]) => name);
   console.log(source_default.dim(`    agents served (one socket each): ${allAgents.length === 0 ? "(none)" : allAgents.join(", ")}`));
@@ -103578,7 +103818,7 @@ function doStatus() {
   const composeYml = hostdComposePath();
   console.log(source_default.bold("switchroom-hostd"));
   console.log("");
-  if (!existsSync106(composeYml)) {
+  if (!existsSync107(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom hostd install` to set up."));
     return;
@@ -103599,14 +103839,14 @@ function doStatus() {
   } else {
     console.log(source_default.green(`  container:  ${ps.stdout.trim()}`));
   }
-  if (existsSync106(dir)) {
+  if (existsSync107(dir)) {
     const entries = [];
     try {
       for (const name of readdirSync40(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
         const sockPath = join108(dir, name, "sock");
-        if (existsSync106(sockPath)) {
+        if (existsSync107(sockPath)) {
           const st = statSync57(sockPath);
           if ((st.mode & 61440) === 49152) {
             entries.push(`${name} \u2192 ${sockPath}`);
@@ -103625,7 +103865,7 @@ function doStatus() {
 }
 function doUninstall() {
   const composeYml = hostdComposePath();
-  if (!existsSync106(composeYml)) {
+  if (!existsSync107(composeYml)) {
     console.log(source_default.yellow("  No hostd install detected (no compose file at this path)."));
     return;
   }
@@ -103649,7 +103889,7 @@ function registerHostdCommand(program3) {
   hostd.command("uninstall").description("Stop the hostd container. Leaves the compose file in place for re-install.").action(() => doUninstall());
   hostd.command("audit").description("Tail and filter the hostd audit log (privileged-verb call history)").option("--tail <n>", "Number of matching entries to show (default: 50)", "50").option("--agent <name>", "Filter to a specific caller agent").option("--op <verb>", "Filter to a specific hostd verb (e.g. update_apply, agent_restart)").option("--error", "Show only failed (error/denied) entries").option("--verbose", "Show the captured stderr / error tail under each failed row").option("--path <file>", "Override audit log path (for debugging)").action((opts) => {
     const logPath = opts.path ?? defaultAuditLogPath2();
-    if (!existsSync106(logPath)) {
+    if (!existsSync107(logPath)) {
       console.error(source_default.yellow(`Audit log not found at ${logPath}.`) + source_default.gray(`
 The log is created when hostd handles its first privileged-verb request.`));
       return;
@@ -103698,10 +103938,10 @@ init_source();
 init_helpers();
 init_operator_uid();
 init_compose();
-import { chownSync as chownSync10, existsSync as existsSync107, mkdirSync as mkdirSync62, writeFileSync as writeFileSync45, copyFileSync as copyFileSync15 } from "node:fs";
+import { chownSync as chownSync10, existsSync as existsSync108, mkdirSync as mkdirSync63, writeFileSync as writeFileSync46, copyFileSync as copyFileSync15 } from "node:fs";
 import { homedir as homedir59 } from "node:os";
 import { join as join109 } from "node:path";
-import { spawnSync as spawnSync25 } from "node:child_process";
+import { spawnSync as spawnSync26 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
     return explicitTag;
@@ -103809,7 +104049,7 @@ function webdComposePath() {
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
-  if (!existsSync107(p))
+  if (!existsSync108(p))
     return null;
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const bak = `${p}.bak-${ts}`;
@@ -103817,7 +104057,7 @@ function backupExistingCompose2() {
   return bak;
 }
 function runDocker2(args) {
-  const r = spawnSync25("docker", args, { encoding: "utf8" });
+  const r = spawnSync26("docker", args, { encoding: "utf8" });
   return {
     ok: r.status === 0,
     stdout: r.stdout ?? "",
@@ -103840,7 +104080,7 @@ async function doInstall2(opts, program3) {
   }
   const dir = webdDir();
   const composePath = webdComposePath();
-  mkdirSync62(dir, { recursive: true });
+  mkdirSync63(dir, { recursive: true });
   const cfg = getConfig(program3);
   const imageTag = resolveWebImageTag(opts.tag, cfg.release);
   const port = cfg.web_service?.port ?? 8080;
@@ -103875,7 +104115,7 @@ async function doInstall2(opts, program3) {
   const bak = backupExistingCompose2();
   if (bak)
     console.log(source_default.dim(`  Backed up existing compose to ${bak}`));
-  writeFileSync45(composePath, yaml, "utf8");
+  writeFileSync46(composePath, yaml, "utf8");
   try {
     if (typeof process.geteuid === "function" && process.geteuid() === 0) {
       chownSync10(dir, operatorUid, operatorUid);
@@ -103917,7 +104157,7 @@ function doStatus2() {
   const composeYml = webdComposePath();
   console.log(source_default.bold("switchroom-web"));
   console.log("");
-  if (!existsSync107(composeYml)) {
+  if (!existsSync108(composeYml)) {
     console.log(source_default.yellow("  compose:    not installed"));
     console.log(source_default.dim("              run `switchroom webd install` to set up."));
     return;
@@ -103941,7 +104181,7 @@ function doStatus2() {
 }
 function doUninstall2() {
   const composeYml = webdComposePath();
-  if (!existsSync107(composeYml)) {
+  if (!existsSync108(composeYml)) {
     console.log(source_default.yellow("  No web-service install detected (no compose file at this path)."));
     return;
   }
@@ -104216,13 +104456,13 @@ init_helpers();
 init_scan();
 
 // src/fleet-health/gh-sync.ts
-import { spawnSync as spawnSync26 } from "node:child_process";
+import { spawnSync as spawnSync27 } from "node:child_process";
 var LABEL = "fleet-health";
 function defaultGhDeps(log) {
   return {
     log,
     run: (args) => {
-      const r = spawnSync26("gh", args, { encoding: "utf-8" });
+      const r = spawnSync27("gh", args, { encoding: "utf-8" });
       return {
         ok: r.status === 0,
         stdout: (r.stdout ?? "").trim(),
@@ -104427,7 +104667,7 @@ function printDeepDiveBrief(targets) {
 
 // src/cli/hindsight-watch.ts
 init_source();
-import { existsSync as existsSync112, readdirSync as readdirSync45 } from "node:fs";
+import { existsSync as existsSync113, readdirSync as readdirSync45 } from "node:fs";
 import { homedir as homedir63 } from "node:os";
 import { join as join112, resolve as resolve63 } from "node:path";
 
@@ -104497,8 +104737,8 @@ function postOperatorNoticeViaGateways(candidates, text, log, connectTimeoutMs =
 init_install_cron();
 
 // src/hindsight-watch/probe.ts
-import { spawnSync as spawnSync27 } from "node:child_process";
-import { readFileSync as readFileSync99, readdirSync as readdirSync44, statSync as statSync59 } from "node:fs";
+import { spawnSync as spawnSync28 } from "node:child_process";
+import { readFileSync as readFileSync100, readdirSync as readdirSync44, statSync as statSync59 } from "node:fs";
 import { homedir as homedir62 } from "node:os";
 import { resolve as resolve62 } from "node:path";
 
@@ -104626,7 +104866,7 @@ function readLlmSignals(series) {
 }
 
 // src/hindsight-watch/recall-log.ts
-import { closeSync as closeSync22, existsSync as existsSync111, openSync as openSync22, readdirSync as readdirSync43, readSync as readSync6, statSync as statSync58 } from "node:fs";
+import { closeSync as closeSync22, existsSync as existsSync112, openSync as openSync22, readdirSync as readdirSync43, readSync as readSync6, statSync as statSync58 } from "node:fs";
 import { join as join111 } from "node:path";
 var RECALL_WINDOW_ROWS = 200;
 var RECALL_MAX_TAIL_BYTES = 1024 * 1024;
@@ -104635,7 +104875,7 @@ function recallLogPath2(agentDir) {
   return join111(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
 }
 function readRecallLogTail2(path10, windowRows = RECALL_WINDOW_ROWS) {
-  if (!existsSync111(path10))
+  if (!existsSync112(path10))
     return [];
   let text;
   let truncatedHead = false;
@@ -104847,7 +105087,7 @@ async function probeMetrics(url = DEFAULT_METRICS_URL, fetchImpl = fetch) {
   }
 }
 var defaultRunner4 = (cmd, args) => {
-  const r = spawnSync27(cmd, args, { stdio: "pipe", timeout: 1e4, encoding: "utf8" });
+  const r = spawnSync28(cmd, args, { stdio: "pipe", timeout: 1e4, encoding: "utf8" });
   if (r.error)
     return { status: null, stdout: "", stderr: r.error.message };
   return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
@@ -104875,7 +105115,7 @@ function readDropCount(hindsightDir) {
   try {
     if (statSync59(path10).size > DROPS_LEDGER_MAX_BYTES)
       return 0;
-    parsed = JSON.parse(readFileSync99(path10, "utf8"));
+    parsed = JSON.parse(readFileSync100(path10, "utf8"));
   } catch {
     return 0;
   }
@@ -105923,7 +106163,7 @@ function collectRelayCandidates(agentsDir) {
   const candidates = [];
   for (const name of readdirSync45(agentsDir).sort()) {
     const sock = resolve63(agentsDir, name, "telegram", "gateway.sock");
-    if (existsSync112(sock))
+    if (existsSync113(sock))
       candidates.push({ agent: name, sock });
   }
   return orderRelayCandidates(candidates);
@@ -105945,13 +106185,13 @@ async function notifyOperator(agentsDir, text, log) {
 
 // src/cli/openrouter-watch.ts
 init_source();
-import { existsSync as existsSync114, readdirSync as readdirSync46 } from "node:fs";
+import { existsSync as existsSync115, readdirSync as readdirSync46 } from "node:fs";
 import { homedir as homedir65 } from "node:os";
 import { join as join113, resolve as resolve65 } from "node:path";
 
 // src/openrouter/install-cron.ts
-import { existsSync as existsSync113, mkdirSync as mkdirSync64, readFileSync as readFileSync100, renameSync as renameSync29, writeFileSync as writeFileSync47 } from "node:fs";
-import { dirname as dirname43 } from "node:path";
+import { existsSync as existsSync114, mkdirSync as mkdirSync65, readFileSync as readFileSync101, renameSync as renameSync30, writeFileSync as writeFileSync48 } from "node:fs";
+import { dirname as dirname44 } from "node:path";
 var CRON_PATH2 = "/etc/cron.d/openrouter-watch";
 var CRON_SCHEDULE2 = "17 * * * *";
 var CRON_LOG_PATH2 = "/var/log/openrouter-watch.log";
@@ -105968,30 +106208,30 @@ function renderCron2(opts) {
 function installCron2(opts) {
   const path10 = opts.path ?? CRON_PATH2;
   const content = renderCron2(opts);
-  if (existsSync113(path10)) {
+  if (existsSync114(path10)) {
     try {
-      if (readFileSync100(path10, "utf8") === content) {
+      if (readFileSync101(path10, "utf8") === content) {
         return { status: "unchanged", path: path10, content };
       }
     } catch {}
   }
-  mkdirSync64(dirname43(path10), { recursive: true });
+  mkdirSync65(dirname44(path10), { recursive: true });
   const tmp = `${path10}.${process.pid}.tmp`;
-  writeFileSync47(tmp, content, { mode: 420 });
-  renameSync29(tmp, path10);
+  writeFileSync48(tmp, content, { mode: 420 });
+  renameSync30(tmp, path10);
   return { status: "installed", path: path10, content };
 }
 // src/openrouter/state.ts
-import { mkdirSync as mkdirSync65, readFileSync as readFileSync101, renameSync as renameSync30, writeFileSync as writeFileSync48 } from "node:fs";
+import { mkdirSync as mkdirSync66, readFileSync as readFileSync102, renameSync as renameSync31, writeFileSync as writeFileSync49 } from "node:fs";
 import { homedir as homedir64 } from "node:os";
-import { dirname as dirname44, resolve as resolve64 } from "node:path";
+import { dirname as dirname45, resolve as resolve64 } from "node:path";
 function defaultStatePath3(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir64()) {
   return resolve64(home2, ".switchroom", "openrouter-watch", "state.json");
 }
 function loadState2(path10) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync101(path10, "utf8"));
+    parsed = JSON.parse(readFileSync102(path10, "utf8"));
   } catch {
     return {};
   }
@@ -106011,12 +106251,12 @@ function loadState2(path10) {
   return out;
 }
 function saveState2(path10, state) {
-  mkdirSync65(dirname44(path10), { recursive: true, mode: 448 });
+  mkdirSync66(dirname45(path10), { recursive: true, mode: 448 });
   const tmp = `${path10}.${process.pid}.tmp`;
   const payload = { v: 1, ...state };
-  writeFileSync48(tmp, JSON.stringify(payload, null, 2) + `
+  writeFileSync49(tmp, JSON.stringify(payload, null, 2) + `
 `, { mode: 384 });
-  renameSync30(tmp, path10);
+  renameSync31(tmp, path10);
 }
 
 // src/openrouter/watch.ts
@@ -106201,7 +106441,7 @@ async function notifyOperator2(agentsDir, text, log) {
   try {
     for (const name of readdirSync46(agentsDir).sort()) {
       const sock = resolve65(agentsDir, name, "telegram", "gateway.sock");
-      if (existsSync114(sock))
+      if (existsSync115(sock))
         candidates.push({ agent: name, sock });
     }
   } catch (e) {