switchroom 0.19.43 → 0.19.44

package/dist/auth-broker/index.js

@@ -10994,7 +10994,7 @@ var init_observation_scopes = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, PollSpecSchema, TelegramMessageActionSchema, WebhookActionSchema, ActionSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, ObservationScopesSchema, ObservationScopeStrategySchema, AntiConfabulationDirectiveSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, LiteLLMConfigSchema, HindsightPerOpLlmSchema, HindsightConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, MicrosoftAccountEmailSchema, MicrosoftToolTokenSchema, MicrosoftAccountBindingSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReactionDispatchSchema, releaseBlockFields, ReleaseBlock, RootReleaseBlock, NetworkIsolationSchema, servesField, knowsField, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, FleetHealthConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, UserSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   init_observation_scopes();
@@ -11111,6 +11111,7 @@ var init_schema = __esm(() => {
   }).optional();
   ObservationScopesSchema = exports_external.enum(OBSERVATION_SCOPES).optional().describe("Operator PIN for the per-row observation scope, overriding the " + 'default `curated` strategy (see docs/configuration.md). "shared" ' + "forces Hindsight's consolidation to write EVERY observation into ONE " + "global untagged scope — what several agents pooling one bank want so " + "their observations merge rather than sitting in parallel silos. " + '"combined" is the pin form of opting out (restores the pre-#4035 ' + "engine default). UNSET does NOT mean 'nothing on the wire': the " + "`curated` strategy still computes a scope per retain. Applies to " + "every retain path (Stop hook, " + "sidechain, boot reconcile, queue drain, backfill, session-handoff " + "mirror) and is carried on the queued payload, so a retain that fails " + "now and drains later still lands in this scope. Accepted values: " + `${OBSERVATION_SCOPES.join(", ")}. ` + "Cascade: override (per-agent wins over default).");
   ObservationScopeStrategySchema = exports_external.enum(OBSERVATION_SCOPE_STRATEGIES).optional().describe("Per-retain strategy that decides how the observation scope is " + 'computed when no `observation_scopes` pin is set. "curated" ' + "(the default since #4035) strips volatile per-session provenance " + "tags from each retain's consolidation scope — keeping the stable " + "semantic ones on the source fact — so an agent's observations dedup " + "and merge across sessions instead of pocketing one-per-session. " + '"shared" sends every retain to the one global untagged scope. ' + '"combined" / "off" opt OUT: no per-row scope goes on the wire, ' + "restoring the pre-feature engine default (byte-identical to an " + "unconfigured client). OMITTED BY DEFAULT: unset leaves the plugin's " + "own default (`curated`) in force. A manual `observation_scopes` pin " + "wins over this strategy. Accepted values: " + `${OBSERVATION_SCOPE_STRATEGIES.join(", ")}. ` + "Cascade: override (per-agent wins over default).");
+  AntiConfabulationDirectiveSchema = exports_external.union([exports_external.boolean(), exports_external.string().min(1)]).optional().describe("The seeded anti-confabulation directive: reflect has no relevance " + "floor (`min_scores` is a /recall-only parameter), so a bank holding " + "nothing relevant still yields a confident answer, and a question that " + "presupposes a decision reliably produces one. Directives ARE applied " + "during reflect, so this is the lever. Unset or true (the default) " + "seeds and maintains switchroom's own text; false disables seeding and " + "leaves any existing directive untouched; a string is operator-authored " + "text that wins outright. Switchroom only ever upgrades directive text " + "byte-equal to a default it shipped, so editing the directive in the " + "bank is also a permanent override. " + "Cascade: override (per-agent wins over default).");
   AgentMemorySchema = exports_external.object({
     collection: exports_external.string().describe("Hindsight collection name for this agent"),
     auto_recall: exports_external.boolean().default(true).describe("Auto-search memories before each response"),
@@ -11146,6 +11147,7 @@ var init_schema = __esm(() => {
       empathy: exports_external.number().int().min(1).max(5).optional().describe("How much the bank weights emotional/relational context (1-5; engine default 3).")
     }).optional().describe("Personality traits (1-5 each) steering how this bank frames recall, " + "reflect, and observation synthesis — a coach leans empathy-high, a " + "lawyer/analyst leans skepticism/literalism-high. Maps to the engine's " + "flat `disposition_skepticism`/`_literalism`/`_empathy` fields. " + "Cascade: per-key merge (an agent overrides individual traits and " + "inherits the rest, matching `recall`)."),
     directive_capture_nudge: exports_external.boolean().optional().describe("Deterministic directive-capture nudge (issue #2848 Stage B). When " + "on (switchroom default true — Stage A measured a ~55% miss rate on " + "durable corrections), the auto-recall hook regex-detects correction " + '/ standing-rule-shaped inbound ("always/never …", "from now on …", ' + `"stop doing …", a stated preference, "that's wrong, it's …") and ` + "appends a terse advisory to the turn's context telling the model to " + "persist the rule with mcp__hindsight__create_directive if it IS " + "durable. Detection is pure regex — the model does the judgment " + "in-session and calls create_directive itself (no model callsite, no " + "silent hook-side write). Set false to disable per-agent. " + "Cascade: override (per-agent wins over default)."),
+    anti_confabulation_directive: AntiConfabulationDirectiveSchema,
     observation_scopes: ObservationScopesSchema,
     observation_scope_strategy: ObservationScopeStrategySchema,
     recall: exports_external.object({
@@ -11416,7 +11418,7 @@ var init_schema = __esm(() => {
       reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent → uses global."),
       consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent → global.")
     }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
-    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
+    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "RERANKER_LOCAL_BATCH_SIZE, LLM_MAX_CONCURRENT, " + "RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, LLM_STRICT_SCHEMA, " + "LLM_MAX_RETRIES, CONSOLIDATION_LLM_PARALLELISM, " + "MAX_OBSERVATIONS_PER_SCOPE, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT, " + "RERANKER_LOCAL_BUCKET_BATCHING, RERANKER_MAX_CANDIDATES, " + "RERANKER_LOCAL_MAX_CONCURRENT, RECALL_MAX_CONCURRENT, " + "REFLECT_WALL_TIMEOUT, WORKER_CONSOLIDATION_RESERVED_SLOTS, " + "WORKER_CONSOLIDATION_SLOT_LIMIT, " + "CONSOLIDATION_MAX_MEMORIES_PER_ROUND, GRAPH_SEED_MIN_SIMILARITY, " + "LLM_SUPPORTS_MAX_ITEMS, RECENCY_DECAY_FUNCTION, " + "RECENCY_DECAY_HALFLIFE_DAYS — switchroom defaults recall's recency " + "curve to `exponential` with a 30-day half-life so a fact retained " + "today outranks a stale one, instead of upstream's near-flat " + "linear/365-day window), the override-only keys " + "switchroom manages but ships NO default for " + "(`HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS`: " + "HINDSIGHT_API_WORKER_CONSOLIDATION_BANK_PRIORITY — a per-deployment " + "`bank-pattern:priority,...` map; unset means upstream's flat " + "created_at FIFO across banks; and " + "HINDSIGHT_CE_DECISIVE_RELATIVE_GAP — the rollback knob for " + "switchroom's CE-saturation damping patch, a float; >= ~0.65 backs the " + "damping out entirely, unset means the patch's own derived gap; and " + "HINDSIGHT_API_RECENCY_DECAY_LINEAR_WINDOW_DAYS — only read when the " + "decay function is `linear`, so switchroom ships no default for it but " + "still honours an operator who flips the function back; and " + "HINDSIGHT_API_WORKER_MAX_SLOTS — the worker poller's TOTAL in-flight " + "task budget, the pool WORKER_CONSOLIDATION_RESERVED_SLOTS reserves out of; " + "unset means upstream's own default; and " + "HINDSIGHT_API_WORKER_RETAIN_RESERVED_SLOTS — the reserved slot FLOOR for the " + "retain (memory write) lane, carved from that same total; unset means " + "upstream's own 0, i.e. no floor and retain competes for the shared " + "pool; and " + "the pre-0.8.6 name HINDSIGHT_API_WORKER_<TYPE>_MAX_SLOTS is still " + "accepted for every operation type and normalised to " + "..._RESERVED_SLOTS on the way in, because setting both names for " + "one type is a hard boot failure in the engine and switchroom " + "therefore emits only the canonical name; and " + "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY — the cosine-similarity floor a " + "candidate must reach to be returned by the semantic retrieval arm at " + "all (0..1); unset means upstream's own 0.3, and where it should sit " + "depends on the bank's embedding model and phrasing diversity, so " + "switchroom ships no opinion; and " + "HINDSIGHT_MCP_RECALL_BUDGET_MODE — the rollback knob for switchroom's " + "mcp-recall-token-budget image patch; `legacy` restores upstream's " + "exact pre-patch recall returns, anything else or unset is the " + "honest-envelope mode; and " + "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT — upstream's own per-op reflect " + "temperature knob, made live by switchroom's reflect-temperature image " + "patch; a float, or `none` to omit the kwarg (provider default, " + "upstream's accidental pre-patch behaviour); unset means the image's " + "baked default 0.1; and " + "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT — the background " + "half of switchroom's recall-admission split (#3660): of the " + "RECALL_MAX_CONCURRENT admission slots, at most this many may be held " + "by background consolidation recalls at once, so foreground per-turn " + "recall always keeps the remainder; must be >= 1 and strictly less " + "than RECALL_MAX_CONCURRENT or the engine refuses to boot; unset " + "means the image's derived default min(2, RECALL_MAX_CONCURRENT - 1); " + "1 biases hard toward the interactive lane while a consolidation " + "backlog drains), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS — a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED — a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
   });
   MicrosoftWorkspaceConfigSchema = exports_external.object({
     microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL — omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
@@ -11550,6 +11552,7 @@ var init_schema = __esm(() => {
       isolation: exports_external.enum(["default", "strict"]).optional(),
       profile: exports_external.string().optional(),
       directive_capture_nudge: exports_external.boolean().optional(),
+      anti_confabulation_directive: AntiConfabulationDirectiveSchema,
       observation_scopes: ObservationScopesSchema,
       observation_scope_strategy: ObservationScopeStrategySchema,
       recall: exports_external.object({
@@ -18761,18 +18764,18 @@ var init_resolver = __esm(() => {
 
 // src/auth/broker/index.ts
 init_loader();
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "node:fs";
 
 // src/auth/broker/server.ts
 import * as net from "node:net";
 import {
   chmodSync,
   chownSync as chownSync2,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync5,
-  readFileSync as readFileSync7,
-  realpathSync as realpathSync3,
+  readFileSync as readFileSync8,
+  realpathSync as realpathSync4,
   renameSync as renameSync3,
   rmSync as rmSync5,
   statSync as statSync6,
@@ -18782,15 +18785,72 @@ import {
 import { closeSync as closeSync2, openSync as openSync2, writeSync as writeSync2 } from "node:fs";
 import * as constants2 from "node:constants";
 import { createHash as createHash2 } from "node:crypto";
-import { basename as basename2, dirname as dirname4, join as join8, resolve as resolve9 } from "node:path";
+import { basename as basename2, dirname as dirname4, join as join7, resolve as resolve9 } from "node:path";
 
 // src/agents/compose.ts
 init_schema();
 
 // src/agents/scaffold.ts
-import { dirname, isAbsolute, join as join4, relative, resolve as resolve5 } from "node:path";
 init_atomic();
 
+// src/util/shipped-assets.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, realpathSync } from "node:fs";
+import { dirname, resolve as resolve4 } from "node:path";
+var FHS_SHARE_ROOTS = [
+  "/usr/local/share/switchroom",
+  "/usr/share/switchroom"
+];
+var PROFILES_ASSET = {
+  asset: "profiles",
+  envVar: "SWITCHROOM_PROFILES_ROOT"
+};
+function orderedCandidates(spec, probe) {
+  const out = [];
+  const push = (path, source) => {
+    if (!out.some((c) => c.path === path))
+      out.push({ path, source });
+  };
+  if (probe.bundleDir) {
+    push(resolve4(probe.bundleDir, "../..", spec.asset), "npm");
+    push(resolve4(probe.bundleDir, spec.asset), "image");
+  }
+  if (probe.execPath) {
+    push(resolve4(dirname(probe.execPath), "../share/switchroom", spec.asset), "sea-sibling");
+  }
+  for (const root of FHS_SHARE_ROOTS) {
+    push(resolve4(root, spec.asset), "fhs");
+  }
+  return out;
+}
+function resolveShippedAsset(spec, probe) {
+  const env = probe.env ?? process.env;
+  const override = env[spec.envVar]?.trim();
+  if (override) {
+    const path = canonicalise(resolve4(override), probe);
+    return { path, candidates: [path], source: "env" };
+  }
+  const exists = probe.exists ?? existsSync4;
+  const candidates = orderedCandidates(spec, probe);
+  for (const c of candidates) {
+    if (exists(c.path)) {
+      return {
+        path: canonicalise(c.path, probe),
+        candidates: candidates.map((x) => x.path),
+        source: c.source
+      };
+    }
+  }
+  return { path: null, candidates: candidates.map((x) => x.path), source: "none" };
+}
+function canonicalise(path, probe) {
+  const realpath = probe.realpath ?? realpathSync;
+  try {
+    return realpath(path);
+  } catch {
+    return path;
+  }
+}
+
 // src/agents/agent-uid.ts
 init_peercred();
 import { createHash } from "node:crypto";
@@ -18849,37 +18909,29 @@ var AUDIT_ROOT = join(homedir2(), ".switchroom", "audit");
 
 // src/agents/profiles.ts
 var import_handlebars = __toESM(require_lib(), 1);
-import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync4, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync, realpathSync } from "node:fs";
-import { resolve as resolve4, join as join2, sep as pathSep } from "node:path";
-function resolveProfilesRoot() {
-  const envOverride = process.env.SWITCHROOM_PROFILES_ROOT?.trim();
-  if (envOverride) {
-    return resolve4(envOverride);
-  }
-  const candidates = [
-    resolve4(import.meta.dirname, "../../profiles"),
-    resolve4(import.meta.dirname, "profiles")
-  ];
-  for (const candidate of candidates) {
-    if (existsSync4(candidate)) {
-      return candidate;
-    }
-  }
-  return candidates[0];
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync5, readdirSync as readdirSync2, statSync as statSync2, copyFileSync, mkdirSync, realpathSync as realpathSync2 } from "node:fs";
+import { resolve as resolve5, join as join2, sep as pathSep } from "node:path";
+function resolveProfilesRootDetailed() {
+  return resolveShippedAsset(PROFILES_ASSET, {
+    bundleDir: import.meta.dirname,
+    execPath: process.execPath
+  });
 }
-var PROFILES_ROOT = resolveProfilesRoot();
+var PROFILES_RESOLUTION = resolveProfilesRootDetailed();
+var PROFILES_ROOT = PROFILES_RESOLUTION.path ?? PROFILES_RESOLUTION.candidates[0];
+var PROFILES_ROOT_SEARCH = PROFILES_RESOLUTION.candidates;
 import_handlebars.default.registerHelper("json", (value) => {
   return new import_handlebars.default.SafeString(JSON.stringify(value, null, 2));
 });
 import_handlebars.default.registerHelper("isNumber", (value) => {
   return typeof value === "number" && Number.isFinite(value);
 });
-var SHARED_FRAGMENTS_DIR = resolve4(PROFILES_ROOT, "_shared");
+var SHARED_FRAGMENTS_DIR = resolve5(PROFILES_ROOT, "_shared");
 var SHARED_FRAGMENTS = ["vault-protocol", "agent-self-service", "execution-discipline", "reply-discipline", "dev-protocol"];
 for (const name of SHARED_FRAGMENTS) {
   const fragPath = join2(SHARED_FRAGMENTS_DIR, `${name}.md.hbs`);
-  if (existsSync4(fragPath)) {
-    import_handlebars.default.registerPartial(name, readFileSync3(fragPath, "utf-8"));
+  if (existsSync5(fragPath)) {
+    import_handlebars.default.registerPartial(name, readFileSync4(fragPath, "utf-8"));
   }
 }
 
@@ -19082,7 +19134,8 @@ var HINDSIGHT_PERF_OVERRIDE_ONLY_KEYS = new Set([
   "HINDSIGHT_API_SEMANTIC_MIN_SIMILARITY",
   "HINDSIGHT_MCP_RECALL_BUDGET_MODE",
   "HINDSIGHT_API_LLM_TEMPERATURE_REFLECT",
-  "HINDSIGHT_API_RETAIN_WALL_TIMEOUT"
+  "HINDSIGHT_API_RETAIN_WALL_TIMEOUT",
+  "HINDSIGHT_API_CONSOLIDATION_RECALL_MAX_CONCURRENT"
 ]);
 var HINDSIGHT_WORKER_SLOT_TYPES = [
   "consolidation",
@@ -19177,6 +19230,15 @@ var DEFAULT_RETAIN_MISSION = `Extract durable facts that will still be true and
 ` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
 ` + `  system's self-reports are not memories.
 ` + `- Restatements of the user's current request or the task in progress.
+` + `- The assistant's own answers, summaries, recaps, or reflect output. Before
+` + `  extracting, ask: does anything in this transcript support this claim OTHER
+` + `  than the assistant having asserted it? If not, drop it — a model's own
+` + `  synthesis re-extracted as a fact is how a guess becomes permanent.
+` + `  Concretely, never produce a fact whose only support is the assistant
+` + `  stating a date, a version, an attribution, a total, or a decision that the
+` + `  user never confirmed and no tool output shows. An unverified claim recalls
+` + `  later as though it had been established, which is worse than not
+` + `  remembering it at all.
 ` + `- Volatile state written as a timeless assertion. A version, count, size,
 ` + `  backlog, status, or any "X is running Y" / "X is at Y" / "X is currently Y"
 ` + `  claim is true only at the instant it was said. Concretely, never produce a
@@ -19332,6 +19394,64 @@ var SUPERSEDED_RETAIN_MISSIONS = [
 ` + `
 ` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
 ` + `nothing durable remains, return an empty facts list.
+`,
+  `Extract durable facts that will still be true and useful weeks from now, once this session is forgotten.
+` + `
+` + `DURABILITY GATE. Emit a candidate ONLY if it is one of these five classes:
+` + `- PREFERENCE — what the user likes, wants, or always does; a standing rule or correction.
+` + `- DECISION — a settled choice that changes how future work is done, including a choice NOT to do something. A decision about the mechanics of the CURRENT task (which worker to dispatch, which branch to rebase, which PR to merge now, what to do next) is process narration, not a durable decision — drop it unless it establishes a standing rule or permanently changes a system.
+` + `- FINDING — a root cause, a measurement, or verified behaviour of a system. Include the number.
+` + `- OUTCOME — a completed result that changed the world: what shipped, what a thing turned out to be. Not the act of shipping it.
+` + `- RELATIONSHIP — who a person is, what a project or tool is, and how they connect.
+` + `If a candidate fits none of the five, it is not a memory. Drop it; do not reword it into one.
+` + `
+` + `A preference revealed by a request is durable — record the preference (what the user likes, wants, or always does), not the request itself.
+` + `
+` + `A TOOL RESULT IS NOT A FACT. Before extracting, ask: is the subject of this
+` + `candidate a file path, a command/process/agent/session id, a temp directory, or
+` + `the location where some output was written? If yes, drop it — it is transcript
+` + `exhaust, not memory.
+` + `
+` + `NEVER extract:
+` + `- Tool results verbatim or paraphrased. Concretely, never produce a fact whose
+` + `  text resembles any of these: "File created successfully at /path/to/file",
+` + `  "A background command with ID bctz4yskm is running, and its output will be
+` + `  written to /tmp/...", "Async agent a745598ba84e71df1 was launched successfully
+` + `  and is running in the background", "User executed a Bash command to sleep for
+` + `  200 seconds", "The assistant used grep to locate 'truncateSync' in src/foo.ts".
+` + `- Anything mentioning a path under /tmp, a scratchpad directory, or a .tmp file.
+` + `- Agent tool-use traces or narration of what the assistant did (e.g. "the
+` + `  assistant used X to query Y", "ran a search", "sent the message").
+` + `- The act of delegating, dispatching, spawning, launching, steering or merging
+` + `  work — including when it succeeded. "X was dispatched and completed" is the
+` + `  session describing itself. Record only what the work LEARNED or CHANGED.
+` + `- In-flight workflow/process narration (a sub-task started, paused, or is still
+` + `  running) — retain the outcome only once the task completes or a decision is made.
+` + `- Operation, request, batch, agent, command or session IDs, UUIDs, hashes, or error codes.
+` + `- Slash commands the user typed and their effects (e.g. "User issued /clear to
+` + `  reset assistant state").
+` + `- Hindsight's own errors, retries, backlogs, or internal state — the memory
+` + `  system's self-reports are not memories.
+` + `- Restatements of the user's current request or the task in progress.
+` + `- Volatile state written as a timeless assertion. A version, count, size,
+` + `  backlog, status, or any "X is running Y" / "X is at Y" / "X is currently Y"
+` + `  claim is true only at the instant it was said. Concretely, never produce a
+` + `  fact whose text resembles any of these: "Switchroom fleet is running image
+` + `  version v0.18.19", "The switchroom repo is at /path/to/fleet, version
+` + `  v0.19.5", "Bank overlord has 43155 pending consolidations", "The build is
+` + `  currently green". If the claim is worth keeping, put the date INSIDE the
+` + `  fact text ("As of 2026-07-19 the fleet was running v0.18.19"); if you
+` + `  cannot date it, drop it. An undated one is recalled forever as though it
+` + `  were still true, which is worse than not remembering it at all.
+` + `- Transient state (unread counts, build status, what is running right now) unless
+` + `  the fact is explicitly dated, in which case record it as a dated observation.
+` + `- Greetings, acknowledgements, and routine operational chatter.
+` + `
+` + `Write each fact so it stands alone: name the thing, the number, and the date. A
+` + `sentence that only makes sense while reading this transcript is not durable.
+` + `
+` + `If a candidate fact matches an exclusion, drop it rather than rewording it. If
+` + `nothing durable remains, return an empty facts list.
 `
 ];
 var DEFAULT_OBSERVATIONS_MISSION = `Synthesise durable, standing knowledge about the people, projects, and systems this agent works with: preferences and standing rules, roles and relationships, skills and recurring patterns, technical and operational decisions with their rationale, and the state of long-running work once it lands.
@@ -19432,6 +19552,22 @@ function normalizeMicrosoftBindings(mw) {
 var warnedMissingPool = new Set;
 var warnedMissingDefault = new Set;
 
+// src/memory/hindsight-retain-provenance.ts
+var RETAIN_PROVENANCE_TAG = "source:transcript";
+var RETAIN_TAGS_DEFAULT = Object.freeze([
+  "{session_id}",
+  RETAIN_PROVENANCE_TAG
+]);
+
+// src/memory/hindsight-seed-directives.ts
+var ANTI_CONFABULATION_DIRECTIVE = `When the retrieved memories do not support an answer, say so instead of composing one.
+` + `
+` + `- If nothing retrieved scores meaningfully above zero, or what came back is off-topic, the honest answer is that the bank does not know. Say that plainly, and say what would settle it.
+` + `- Never assert a date, a version, a number, an attribution, a decision, or an outcome that no retrieved memory states. A question that presupposes something is not evidence for it: asked when a decision was made, when the bank records no such decision, answer that none is recorded — do not supply one.
+` + `- Keep what the bank RECORDED separate from what you INFER. State inferences as inferences, and say which memory a recorded fact came from.
+` + `- Treat a memory that was extracted from a conversation transcript as an unverified claim, not an established fact — it may be an assistant's own earlier guess. If it is the only support for an answer, say that it is.
+` + "- Partial knowledge with its gaps named is more useful than a fluent answer that fills them in.";
+
 // src/telegram/state.ts
 init_paths();
 
@@ -19469,7 +19605,6 @@ var RECALL_PASSTHROUGH_DEFAULTS = Object.freeze({
 init_paths();
 
 // src/agents/scaffold.ts
-var REPO_ROOT = resolve5(import.meta.dirname, "../..");
 var CLAUDE_MD_YOURS_PLACEHOLDER = "This space is yours. Add per-agent rules, exceptions, or context the " + "Switchroom template doesn't capture. Everything above the marker line is " + "regenerated on every apply; this section is preserved.";
 var pendingBankOps = new Set;
 var SWITCHROOM_OWNED_SETTINGS_KEYS = new Set([
@@ -20141,11 +20276,11 @@ async function fetchAndSummarizeExternalSpend(opts) {
 
 // src/auth/broker/mirror-write.ts
 init_atomic();
-import { lstatSync, realpathSync as realpathSync2 } from "node:fs";
+import { lstatSync, realpathSync as realpathSync3 } from "node:fs";
 function safeMirrorWrite(input) {
   let realParent;
   try {
-    realParent = realpathSync2(input.parentDir);
+    realParent = realpathSync3(input.parentDir);
   } catch (err) {
     input.logErr(`mirror parent realpath failed: ${err.message}`);
     return false;
@@ -20177,16 +20312,16 @@ function safeMirrorWrite(input) {
 init_atomic();
 import {
   chownSync,
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   readdirSync as readdirSync3,
   renameSync as renameSync2,
   rmSync as rmSync2,
   statSync as statSync3
 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join5, resolve as resolve6 } from "node:path";
+import { join as join4, resolve as resolve6 } from "node:path";
 var LABEL_MAX = 64;
 var LABEL_RE = /^[A-Za-z0-9._@+-]+$/;
 function accountsRootOverride() {
@@ -20199,13 +20334,13 @@ function accountsRoot(home2 = homedir4()) {
   return accountsRootOverride() ?? resolve6(home2, ".switchroom", "accounts");
 }
 function accountDir(label, home2 = homedir4()) {
-  return join5(accountsRoot(home2), label);
+  return join4(accountsRoot(home2), label);
 }
 function accountCredentialsPath(label, home2 = homedir4()) {
-  return join5(accountDir(label, home2), "credentials.json");
+  return join4(accountDir(label, home2), "credentials.json");
 }
 function accountMetaPath(label, home2 = homedir4()) {
-  return join5(accountDir(label, home2), "meta.json");
+  return join4(accountDir(label, home2), "meta.json");
 }
 function validateAccountLabel(label) {
   if (typeof label !== "string" || label.length === 0) {
@@ -20226,12 +20361,12 @@ function validateAccountLabel(label) {
 }
 function listAccounts(home2 = homedir4()) {
   const root = accountsRoot(home2);
-  if (!existsSync5(root))
+  if (!existsSync6(root))
     return [];
   try {
     return readdirSync3(root).filter((name) => {
       try {
-        return statSync3(join5(root, name)).isDirectory();
+        return statSync3(join4(root, name)).isDirectory();
       } catch {
         return false;
       }
@@ -20241,14 +20376,14 @@ function listAccounts(home2 = homedir4()) {
   }
 }
 function accountExists(label, home2 = homedir4()) {
-  return existsSync5(accountCredentialsPath(label, home2));
+  return existsSync6(accountCredentialsPath(label, home2));
 }
 function readAccountCredentials(label, home2 = homedir4()) {
   const p = accountCredentialsPath(label, home2);
-  if (!existsSync5(p))
+  if (!existsSync6(p))
     return null;
   try {
-    return JSON.parse(readFileSync4(p, "utf-8"));
+    return JSON.parse(readFileSync5(p, "utf-8"));
   } catch {
     return null;
   }
@@ -20274,21 +20409,21 @@ function writeAccountCredentials(label, value, home2 = homedir4()) {
 function chownAccountFiles(label, uid, home2 = homedir4()) {
   validateAccountLabel(label);
   const dir = accountDir(label, home2);
-  if (existsSync5(dir))
+  if (existsSync6(dir))
     chownSync(dir, uid, uid);
   const creds = accountCredentialsPath(label, home2);
-  if (existsSync5(creds))
+  if (existsSync6(creds))
     chownSync(creds, uid, uid);
   const meta = accountMetaPath(label, home2);
-  if (existsSync5(meta))
+  if (existsSync6(meta))
     chownSync(meta, uid, uid);
 }
 function readAccountMeta(label, home2 = homedir4()) {
   const p = accountMetaPath(label, home2);
-  if (!existsSync5(p))
+  if (!existsSync6(p))
     return null;
   try {
-    return JSON.parse(readFileSync4(p, "utf-8"));
+    return JSON.parse(readFileSync5(p, "utf-8"));
   } catch {
     return null;
   }
@@ -20812,8 +20947,8 @@ function resolveMicrosoftClientId(configClientId) {
 
 // src/auth/broker/google-storage.ts
 init_atomic();
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync5, rmSync as rmSync3, statSync as statSync4 } from "node:fs";
-import { dirname as dirname2, join as join6, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync6, rmSync as rmSync3, statSync as statSync4 } from "node:fs";
+import { dirname as dirname2, join as join5, resolve as resolve7 } from "node:path";
 function normalizeGoogleAccountForStorage(account) {
   return account.trim().toLowerCase();
 }
@@ -20835,17 +20970,17 @@ function googleAccountDir(stateDir, account) {
   return resolve7(stateDir, "google", normalizeGoogleAccountForStorage(account));
 }
 function googleAccountCredentialsPath(stateDir, account) {
-  return join6(googleAccountDir(stateDir, account), "credentials.json");
+  return join5(googleAccountDir(stateDir, account), "credentials.json");
 }
 function googleAccountExists(stateDir, account) {
-  return existsSync6(googleAccountCredentialsPath(stateDir, account));
+  return existsSync7(googleAccountCredentialsPath(stateDir, account));
 }
 function readGoogleAccountCredentials(stateDir, account) {
   const path = googleAccountCredentialsPath(stateDir, account);
-  if (!existsSync6(path))
+  if (!existsSync7(path))
     return null;
   try {
-    const raw = readFileSync5(path, "utf-8");
+    const raw = readFileSync6(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed?.googleOauth?.accessToken)
       return null;
@@ -20862,27 +20997,27 @@ function writeGoogleAccountCredentials(stateDir, account, credentials) {
 }
 function removeGoogleAccount(stateDir, account) {
   const dir = googleAccountDir(stateDir, account);
-  if (existsSync6(dir)) {
+  if (existsSync7(dir)) {
     rmSync3(dir, { recursive: true, force: true });
   }
 }
 function listGoogleAccounts(stateDir) {
-  const root = join6(stateDir, "google");
-  if (!existsSync6(root))
+  const root = join5(stateDir, "google");
+  if (!existsSync7(root))
     return [];
   return readdirSync4(root).filter((name) => {
     try {
-      return statSync4(join6(root, name)).isDirectory();
+      return statSync4(join5(root, name)).isDirectory();
     } catch {
       return false;
     }
-  }).filter((name) => existsSync6(join6(root, name, "credentials.json")));
+  }).filter((name) => existsSync7(join5(root, name, "credentials.json")));
 }
 
 // src/auth/broker/microsoft-storage.ts
 init_atomic();
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync6, rmSync as rmSync4, statSync as statSync5 } from "node:fs";
-import { dirname as dirname3, join as join7, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync7, rmSync as rmSync4, statSync as statSync5 } from "node:fs";
+import { dirname as dirname3, join as join6, resolve as resolve8 } from "node:path";
 function normalizeMicrosoftAccountForStorage(account) {
   return account.trim().toLowerCase();
 }
@@ -20904,17 +21039,17 @@ function microsoftAccountDir(stateDir, account) {
   return resolve8(stateDir, "microsoft", normalizeMicrosoftAccountForStorage(account));
 }
 function microsoftAccountCredentialsPath(stateDir, account) {
-  return join7(microsoftAccountDir(stateDir, account), "credentials.json");
+  return join6(microsoftAccountDir(stateDir, account), "credentials.json");
 }
 function microsoftAccountExists(stateDir, account) {
-  return existsSync7(microsoftAccountCredentialsPath(stateDir, account));
+  return existsSync8(microsoftAccountCredentialsPath(stateDir, account));
 }
 function readMicrosoftAccountCredentials(stateDir, account) {
   const path = microsoftAccountCredentialsPath(stateDir, account);
-  if (!existsSync7(path))
+  if (!existsSync8(path))
     return null;
   try {
-    const raw = readFileSync6(path, "utf-8");
+    const raw = readFileSync7(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed?.microsoftOauth?.accessToken)
       return null;
@@ -20931,21 +21066,21 @@ function writeMicrosoftAccountCredentials(stateDir, account, credentials) {
 }
 function removeMicrosoftAccount(stateDir, account) {
   const dir = microsoftAccountDir(stateDir, account);
-  if (existsSync7(dir)) {
+  if (existsSync8(dir)) {
     rmSync4(dir, { recursive: true, force: true });
   }
 }
 function listMicrosoftAccounts(stateDir) {
-  const root = join7(stateDir, "microsoft");
-  if (!existsSync7(root))
+  const root = join6(stateDir, "microsoft");
+  if (!existsSync8(root))
     return [];
   return readdirSync5(root).filter((name) => {
     try {
-      return statSync5(join7(root, name)).isDirectory();
+      return statSync5(join6(root, name)).isDirectory();
     } catch {
       return false;
     }
-  }).filter((name) => existsSync7(join7(root, name, "credentials.json")));
+  }).filter((name) => existsSync8(join6(root, name, "credentials.json")));
 }
 
 // src/auth/broker/provider.ts
@@ -21481,7 +21616,7 @@ class AuthBroker {
   async start() {
     process.umask(63);
     mkdirSync5(this.stateDir, { recursive: true, mode: 448 });
-    mkdirSync5(join8(this.stateDir, "refresh-lease"), { recursive: true, mode: 448 });
+    mkdirSync5(join7(this.stateDir, "refresh-lease"), { recursive: true, mode: 448 });
     mkdirSync5(this.socketRoot, { recursive: true, mode: 493 });
     this.loadStateFromDisk();
     this.assertDriftFree();
@@ -21530,7 +21665,7 @@ class AuthBroker {
     }
     if (!this.opts.skipHealthyMarker) {
       try {
-        const healthyPath = join8(this.stateDir, "healthy");
+        const healthyPath = join7(this.stateDir, "healthy");
         writeFileSync2(healthyPath, String(this.now()) + `
 `, { mode: 384 });
       } catch (err) {
@@ -21569,14 +21704,14 @@ class AuthBroker {
         } catch {}
       }
       try {
-        if (existsSync8(sock))
+        if (existsSync9(sock))
           unlinkSync(sock);
       } catch {}
     }
     this.listeners.clear();
     try {
-      const healthyPath = join8(this.stateDir, "healthy");
-      if (existsSync8(healthyPath))
+      const healthyPath = join7(this.stateDir, "healthy");
+      if (existsSync9(healthyPath))
         unlinkSync(healthyPath);
     } catch {}
   }
@@ -21607,7 +21742,7 @@ class AuthBroker {
           lis.server.close();
         } catch {}
         try {
-          if (existsSync8(sock))
+          if (existsSync9(sock))
             unlinkSync(sock);
         } catch {}
         for (const s of lis.sockets) {
@@ -21641,13 +21776,13 @@ class AuthBroker {
     }
   }
   agentSocketPath(name) {
-    return join8(this.socketRoot, name, "sock");
+    return join7(this.socketRoot, name, "sock");
   }
   consumerSocketPath(name) {
-    return join8(this.socketRoot, name, "sock");
+    return join7(this.socketRoot, name, "sock");
   }
   operatorSocketPath() {
-    return join8(this.socketRoot, "operator", "sock");
+    return join7(this.socketRoot, "operator", "sock");
   }
   async bindAgentListener(agentName) {
     if (RESERVED_NAMES.has(agentName)) {
@@ -21679,7 +21814,7 @@ class AuthBroker {
   }
   async bindListener(sockPath, targetUid, sockMode, identity) {
     const dir = dirname4(sockPath);
-    if (existsSync8(dir)) {
+    if (existsSync9(dir)) {
       try {
         chownSync2(dir, 0, 0);
       } catch {}
@@ -21689,7 +21824,7 @@ class AuthBroker {
     } else {
       mkdirSync5(dir, { recursive: true, mode: 448 });
     }
-    if (existsSync8(sockPath)) {
+    if (existsSync9(sockPath)) {
       try {
         unlinkSync(sockPath);
       } catch {}
@@ -22516,7 +22651,7 @@ class AuthBroker {
       ...earliestReset != null ? { earliest_reset: earliestReset } : {},
       at: this.now()
     };
-    atomicWriteJsonSync(join8(this.stateDir, "premium-tier-all-walled.json"), this.premiumTierAllWalled, 384);
+    atomicWriteJsonSync(join7(this.stateDir, "premium-tier-all-walled.json"), this.premiumTierAllWalled, 384);
     process.stdout.write(`auth-broker: ALL accounts flagship-tier walled (bucket=${bucket ?? "?"}` + `${earliestReset != null ? `, earliest reset ${new Date(earliestReset).toISOString()}` : ""}) ` + `— no premium-eligible failover target
 `);
   }
@@ -22525,7 +22660,7 @@ class AuthBroker {
       return;
     this.premiumTierAllWalled = null;
     try {
-      unlinkSync(join8(this.stateDir, "premium-tier-all-walled.json"));
+      unlinkSync(join7(this.stateDir, "premium-tier-all-walled.json"));
     } catch {}
   }
   premiumCanarySet() {
@@ -22861,10 +22996,10 @@ class AuthBroker {
     if (envKey)
       return envKey;
     try {
-      const path = join8(this.stateDir, LITELLM_MASTER_KEY_STATE_BASENAME);
-      if (!existsSync8(path))
+      const path = join7(this.stateDir, LITELLM_MASTER_KEY_STATE_BASENAME);
+      if (!existsSync9(path))
         return null;
-      const raw = readFileSync7(path, "utf-8").trim();
+      const raw = readFileSync8(path, "utf-8").trim();
       return raw.length > 0 ? raw : null;
     } catch {
       return null;
@@ -22985,7 +23120,7 @@ class AuthBroker {
     delete this.softAvoidState[label];
     delete this.softAvoidRolledTo[label];
     this.chownAccountFilesIfRoot(label);
-    const contents = readFileSync7(accountCredentialsPath(label, this.home), "utf-8");
+    const contents = readFileSync8(accountCredentialsPath(label, this.home), "utf-8");
     this.shaIndex[label] = sha256Hex(contents);
     this.lastWrittenExpiresAt.set(label, credentials.claudeAiOauth?.expiresAt);
     this.persistShaIndex();
@@ -23383,7 +23518,7 @@ class AuthBroker {
         return { kind: "noop" };
       }
     }
-    const leasePath = join8(this.stateDir, "refresh-lease", label);
+    const leasePath = join7(this.stateDir, "refresh-lease", label);
     let leaseFd = null;
     try {
       leaseFd = openSync2(leasePath, constants2.O_RDWR | constants2.O_CREAT, 384);
@@ -23400,7 +23535,7 @@ class AuthBroker {
         const creds = readAccountCredentials(label, this.home);
         const newExpiresAt = creds?.claudeAiOauth?.expiresAt ?? outcome.newExpiresAt;
         this.lastWrittenExpiresAt.set(label, newExpiresAt);
-        const contents = readFileSync7(accountCredentialsPath(label, this.home), "utf-8");
+        const contents = readFileSync8(accountCredentialsPath(label, this.home), "utf-8");
         this.shaIndex[label] = sha256Hex(contents);
         this.persistShaIndex();
         this.fanoutToAffectedAgents(label);
@@ -23487,9 +23622,9 @@ class AuthBroker {
     if (!mirrorDir)
       return false;
     const credsPath = accountCredentialsPath(label, this.home);
-    if (!existsSync8(credsPath))
+    if (!existsSync9(credsPath))
       return false;
-    const mirrorContent = enrichMirrorContent(readFileSync7(credsPath, "utf-8"));
+    const mirrorContent = enrichMirrorContent(readFileSync8(credsPath, "utf-8"));
     const safe = this.resolveConsumerMirrorPathsSafe(consumer.name, mirrorDir);
     if (!safe)
       return false;
@@ -23532,7 +23667,7 @@ class AuthBroker {
         return null;
       }
     }
-    const targetPath = join8(mirrorDir, ".credentials.json");
+    const targetPath = join7(mirrorDir, ".credentials.json");
     const targetStat = this.lstatOrNull(targetPath);
     if (targetStat) {
       if (targetStat.isSymbolicLink())
@@ -23542,7 +23677,7 @@ class AuthBroker {
     }
     let expectedRealParent;
     try {
-      expectedRealParent = join8(realpathSync3(parent), basename2(mirrorDir));
+      expectedRealParent = join7(realpathSync4(parent), basename2(mirrorDir));
     } catch (err) {
       this.logErr(`consumer-mirror ${consumerName}: realpath ${parent}: ${err.message}`);
       return null;
@@ -23599,8 +23734,8 @@ class AuthBroker {
   resolveMirrorPathsSafe(agentName) {
     const agentsDir = resolveAgentsDir(this.config);
     const agentDir = resolve9(agentsDir, agentName);
-    const claudeDir = join8(agentDir, ".claude");
-    const targetPath = join8(claudeDir, ".credentials.json");
+    const claudeDir = join7(agentDir, ".claude");
+    const targetPath = join7(claudeDir, ".credentials.json");
     const refuse = (component, reason) => {
       this.auditMirrorRefused({ kind: "agent", name: agentName, admin: false }, component, reason);
       return null;
@@ -23633,7 +23768,7 @@ class AuthBroker {
       if (!targetStat.isFile())
         return refuse(".credentials.json", "is-not-a-regular-file");
     }
-    const expectedRealParent = join8(realpathSync3(agentsDir), agentName, ".claude");
+    const expectedRealParent = join7(realpathSync4(agentsDir), agentName, ".claude");
     return { agentDir, claudeDir, targetPath, expectedRealParent };
   }
   lstatOrNull(path) {
@@ -23655,9 +23790,9 @@ class AuthBroker {
   }
   mirrorAccountToAgent(label, agentName) {
     const credsPath = accountCredentialsPath(label, this.home);
-    if (!existsSync8(credsPath))
+    if (!existsSync9(credsPath))
       return false;
-    const mirrorContent = enrichMirrorContent(readFileSync7(credsPath, "utf-8"));
+    const mirrorContent = enrichMirrorContent(readFileSync8(credsPath, "utf-8"));
     const safe = this.resolveMirrorPathsSafe(agentName);
     if (!safe)
       return false;
@@ -23711,7 +23846,7 @@ class AuthBroker {
       process.stdout.write(`auth-broker: active-override dropped — yaml auth.active changed since the swap ` + `(${ov.yaml_active_at_write ?? "unset"} → ${yamlActive ?? "unset"}); yaml wins
 `);
       try {
-        unlinkSync(join8(this.stateDir, "active-override.json"));
+        unlinkSync(join7(this.stateDir, "active-override.json"));
       } catch {}
       return;
     }
@@ -23735,34 +23870,34 @@ class AuthBroker {
       yaml_active_at_write: this.yamlActive ?? null,
       updated_at: this.now()
     };
-    atomicWriteJsonSync(join8(this.stateDir, "active-override.json"), entry, 384);
+    atomicWriteJsonSync(join7(this.stateDir, "active-override.json"), entry, 384);
   }
   readJson(name) {
-    const p = join8(this.stateDir, name);
-    if (!existsSync8(p))
+    const p = join7(this.stateDir, name);
+    if (!existsSync9(p))
       return null;
     try {
-      return JSON.parse(readFileSync7(p, "utf-8"));
+      return JSON.parse(readFileSync8(p, "utf-8"));
     } catch {
       return null;
     }
   }
   persistQuota() {
-    atomicWriteJsonSync(join8(this.stateDir, "quota.json"), this.quota, 384);
+    atomicWriteJsonSync(join7(this.stateDir, "quota.json"), this.quota, 384);
   }
   persistLastQuotaCache() {
-    atomicWriteJsonSync(join8(this.stateDir, "last-quota.json"), this.lastQuotaCache, 384);
+    atomicWriteJsonSync(join7(this.stateDir, "last-quota.json"), this.lastQuotaCache, 384);
   }
   persistExternalSpendCache() {
     if (!this.externalSpendCache)
       return;
-    atomicWriteJsonSync(join8(this.stateDir, "external-spend.json"), this.externalSpendCache, 384);
+    atomicWriteJsonSync(join7(this.stateDir, "external-spend.json"), this.externalSpendCache, 384);
   }
   persistLastTierQuotaCache() {
-    atomicWriteJsonSync(join8(this.stateDir, "last-tier-quota.json"), this.lastTierQuotaCache, 384);
+    atomicWriteJsonSync(join7(this.stateDir, "last-tier-quota.json"), this.lastTierQuotaCache, 384);
   }
   persistUsageLedger() {
-    atomicWriteJsonSync(join8(this.stateDir, "usage-ledger.json"), this.usageLedger, 384);
+    atomicWriteJsonSync(join7(this.stateDir, "usage-ledger.json"), this.usageLedger, 384);
   }
   recordUsage(label, tier, sample) {
     if (sample == null)
@@ -23775,26 +23910,26 @@ class AuthBroker {
     }
   }
   persistNotificationClaims() {
-    atomicWriteJsonSync(join8(this.stateDir, "notification-claims.json"), this.notificationClaims, 384);
+    atomicWriteJsonSync(join7(this.stateDir, "notification-claims.json"), this.notificationClaims, 384);
   }
   persistLastFleetRoll() {
     if (this.lastFleetRoll)
-      atomicWriteJsonSync(join8(this.stateDir, "last-fleet-roll.json"), this.lastFleetRoll, 384);
+      atomicWriteJsonSync(join7(this.stateDir, "last-fleet-roll.json"), this.lastFleetRoll, 384);
   }
   persistShaIndex() {
-    atomicWriteJsonSync(join8(this.stateDir, "sha-index.json"), this.shaIndex, 384);
+    atomicWriteJsonSync(join7(this.stateDir, "sha-index.json"), this.shaIndex, 384);
   }
   persistThresholdViolations() {
-    atomicWriteJsonSync(join8(this.stateDir, "threshold-violations.json"), this.thresholdViolations, 384);
+    atomicWriteJsonSync(join7(this.stateDir, "threshold-violations.json"), this.thresholdViolations, 384);
   }
   assertDriftFree() {
     for (const label of Object.keys(this.shaIndex)) {
       const p = accountCredentialsPath(label, this.home);
-      if (!existsSync8(p)) {
+      if (!existsSync9(p)) {
         this.logErr(`DRIFT_DETECTED ${label}: index entry but no on-disk credentials`);
         process.exit(1);
       }
-      const got = sha256Hex(readFileSync7(p, "utf-8"));
+      const got = sha256Hex(readFileSync8(p, "utf-8"));
       if (got !== this.shaIndex[label]) {
         this.logErr(`DRIFT_DETECTED ${label}: sha256 mismatch (recover with 'switchroom auth add ${label} --replace')`);
         process.exit(1);
@@ -23820,7 +23955,7 @@ class AuthBroker {
       replace: entry.replace,
       reason: entry.reason
     });
-    const auditPath = join8(this.stateDir, "audit.jsonl");
+    const auditPath = join7(this.stateDir, "audit.jsonl");
     try {
       this.rotateAuditIfLarge(auditPath);
       const line = row + `
@@ -23861,7 +23996,7 @@ class AuthBroker {
     for (let i = AUDIT_KEEP - 1;i >= 1; i--) {
       const src = `${path}.${i}`;
       const dst = `${path}.${i + 1}`;
-      if (existsSync8(src)) {
+      if (existsSync9(src)) {
         try {
           renameSync3(src, dst);
         } catch {}
@@ -23960,14 +24095,14 @@ async function main() {
   const flags = parseFlags(argv);
   const operatorUid = flags.operatorUid ?? operatorUidFromEnv();
   const configPath = process.env.SWITCHROOM_CONFIG;
-  if (configPath !== undefined && !existsSync9(configPath)) {
+  if (configPath !== undefined && !existsSync10(configPath)) {
     process.stderr.write(`auth-broker fatal: SWITCHROOM_CONFIG='${configPath}' does not exist
 `);
     process.exit(1);
   }
   if (configPath !== undefined) {
     try {
-      readFileSync8(configPath, "utf-8");
+      readFileSync9(configPath, "utf-8");
     } catch (err) {
       process.stderr.write(`auth-broker fatal: failed to read ${configPath}: ${err.message}
 `);