switchroom 0.19.44 → 0.19.45

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.19.44", COMMIT_SHA = "82d3b0b2";
+var VERSION = "0.19.45", COMMIT_SHA = "2ad33d5d";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -13572,28 +13572,7 @@ var init_zod = __esm(() => {
 });
 
 // src/memory/observation-scopes.ts
-function isObservationScope(value) {
-  return typeof value === "string" && OBSERVATION_SCOPES.includes(value);
-}
-function observationScopesHint() {
-  return OBSERVATION_SCOPES.join(", ");
-}
-function classifyObservationScope(raw) {
-  if (raw === undefined)
-    return { kind: "unset" };
-  const value = raw.trim();
-  if (!value)
-    return { kind: "unset" };
-  if (!isObservationScope(value))
-    return { kind: "invalid", raw };
-  return { kind: "set", scope: value };
-}
-function resolveObservationScope(configured, env2 = process.env) {
-  if (configured !== undefined)
-    return classifyObservationScope(configured);
-  return classifyObservationScope(env2[OBSERVATION_SCOPES_ENV]);
-}
-var OBSERVATION_SCOPES, OBSERVATION_SCOPES_ENV = "HINDSIGHT_OBSERVATION_SCOPES", OBSERVATION_SCOPE_STRATEGIES;
+var OBSERVATION_SCOPES, OBSERVATION_SCOPE_STRATEGIES;
 var init_observation_scopes = __esm(() => {
   OBSERVATION_SCOPES = [
     "per_tag",
@@ -36321,7 +36300,7 @@ class AuthBrokerClient {
       sock.once("error", onError);
       sock.once("connect", () => {
         sock.removeListener("error", onError);
-        sock.on("data", (chunk2) => this.onData(chunk2));
+        sock.on("data", (chunk) => this.onData(chunk));
         sock.on("error", (err) => this.onSocketError(err));
         sock.on("close", () => this.onSocketClose());
         this.socket = sock;
@@ -36335,8 +36314,8 @@ class AuthBrokerClient {
       this.connecting = null;
     }
   }
-  onData(chunk2) {
-    this.buffer += chunk2.toString("utf8");
+  onData(chunk) {
+    this.buffer += chunk.toString("utf8");
     let idx;
     while ((idx = this.buffer.indexOf(`
 `)) !== -1) {
@@ -73049,730 +73028,137 @@ import { execFileSync as execFileSync11 } from "node:child_process";
 init_atomic();
 import { readFileSync as readFileSync20, writeFileSync as writeFileSync9, renameSync as renameSync7, mkdirSync as mkdirSync16, existsSync as existsSync24, statSync as statSync11, readdirSync as readdirSync10 } from "node:fs";
 import { join as join18 } from "node:path";
-
-// telegram-plugin/secret-detect/patterns.ts
-var ANCHORED_PATTERNS = [
-  { rule_id: "anthropic_api_key", regex: /\b(sk-ant-[A-Za-z0-9_-]{8,})\b/g, captureIndex: 1, slugHint: "anthropic_api_key" },
-  { rule_id: "anthropic_oauth_code", regex: /(?:^|\s)([A-Za-z0-9_-]{20,}#[A-Za-z0-9_-]{20,})(?=\s|$)/gm, captureIndex: 1, slugHint: "anthropic_oauth_code" },
-  { rule_id: "openai_api_key", regex: /\b(sk-[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "openai_api_key" },
-  { rule_id: "github_pat_classic", regex: /\b(ghp_[A-Za-z0-9]{20,})\b/g, captureIndex: 1, slugHint: "github_pat" },
-  { rule_id: "github_pat_fine_grained", regex: /\b(github_pat_[A-Za-z0-9_]{20,})\b/g, captureIndex: 1, slugHint: "github_pat" },
-  { rule_id: "slack_token", regex: /\b(xox[baprs]-[A-Za-z0-9-]{10,})\b/g, captureIndex: 1, slugHint: "slack_token" },
-  { rule_id: "slack_app_token", regex: /\b(xapp-[A-Za-z0-9-]{10,})\b/g, captureIndex: 1, slugHint: "slack_app_token" },
-  { rule_id: "groq_api_key", regex: /\b(gsk_[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "groq_api_key" },
-  { rule_id: "google_api_key", regex: /\b(AIza[0-9A-Za-z\-_]{20,})\b/g, captureIndex: 1, slugHint: "google_api_key" },
-  { rule_id: "perplexity_api_key", regex: /\b(pplx-[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "perplexity_api_key" },
-  { rule_id: "npm_token", regex: /\b(npm_[A-Za-z0-9]{10,})\b/g, captureIndex: 1, slugHint: "npm_token" },
-  { rule_id: "telegram_bot_token_prefixed", regex: /\bbot(\d{6,}:[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "telegram_bot_token" },
-  { rule_id: "telegram_bot_token", regex: /\b(\d{6,}:[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "telegram_bot_token" },
-  { rule_id: "laravel_sanctum_token", regex: /\b(\d+\|[A-Za-z0-9]{40,})\b/g, captureIndex: 1, slugHint: "api_token" },
-  { rule_id: "aws_access_key", regex: /\b(AKIA[0-9A-Z]{16})\b/g, captureIndex: 1, slugHint: "aws_access_key" },
-  { rule_id: "jwt", regex: /\b(eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "jwt" }
-];
-var STRUCTURED_PATTERNS = [
-  {
-    rule_id: "env_key_value",
-    regex: /\b([A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD))\b\s*[=:]\s*(["']?)([^\s"'\\]+)\2/g,
-    captureIndex: 3,
-    slugHint: "env"
-  },
-  {
-    rule_id: "json_secret_field",
-    regex: /"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken)"\s*:\s*"([^"]+)"/g,
-    captureIndex: 1,
-    slugHint: "json_secret"
-  },
-  {
-    rule_id: "cli_flag",
-    regex: /--(?:api[-_]?key|hook[-_]?token|token|secret|password|passwd)\s+(["']?)([^\s"']+)\1/g,
-    captureIndex: 2,
-    slugHint: "cli_flag"
-  },
-  {
-    rule_id: "bearer_auth_header",
-    regex: /Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)/gi,
-    captureIndex: 1,
-    slugHint: "bearer_token"
-  },
-  {
-    rule_id: "bearer_loose",
-    regex: /\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b/gi,
-    captureIndex: 1,
-    slugHint: "bearer_token"
-  },
-  {
-    rule_id: "basic_auth_header",
-    regex: /Authorization\s*[:=]\s*Basic\s+([A-Za-z0-9+/=]{8,})/gi,
-    captureIndex: 1,
-    slugHint: "basic_auth"
-  },
-  {
-    rule_id: "pem_private_key",
-    regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----/g,
-    captureIndex: 0,
-    slugHint: "pem_private_key"
-  }
-];
-var PROVIDER_PATTERNS = [
-  { rule_id: "slack_webhook", regex: /(https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9_/]+)/g, captureIndex: 1, slugHint: "slack_webhook" },
-  { rule_id: "stripe_live_secret", regex: /\b(sk_live_[A-Za-z0-9]{24,})\b/g, captureIndex: 1, slugHint: "stripe_key" },
-  { rule_id: "stripe_restricted", regex: /\b(rk_live_[A-Za-z0-9]{24,})\b/g, captureIndex: 1, slugHint: "stripe_key" },
-  { rule_id: "sendgrid_api_key", regex: /\b(SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43})\b/g, captureIndex: 1, slugHint: "sendgrid_key" },
-  { rule_id: "gitlab_pat", regex: /\b(glpat-[A-Za-z0-9_-]{20})\b/g, captureIndex: 1, slugHint: "gitlab_pat" },
-  { rule_id: "huggingface_token", regex: /\b(hf_[A-Za-z0-9]{34,})\b/g, captureIndex: 1, slugHint: "huggingface_token" },
-  { rule_id: "twilio_api_key", regex: /\b(SK[0-9a-f]{32})\b/g, captureIndex: 1, slugHint: "twilio_api_key" },
-  { rule_id: "mailgun_key", regex: /\b(key-[0-9a-f]{32})\b/g, captureIndex: 1, slugHint: "mailgun_key" },
-  { rule_id: "digitalocean_pat", regex: /\b(dop_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
-  { rule_id: "digitalocean_oauth", regex: /\b(doo_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
-  { rule_id: "digitalocean_refresh", regex: /\b(dor_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
-  { rule_id: "doppler_token", regex: /\b(dp\.(?:pt|st|ct|sa|scim|audit)\.[A-Za-z0-9]{40,44})\b/g, captureIndex: 1, slugHint: "doppler_token" },
-  { rule_id: "linear_api_key", regex: /\b(lin_api_[A-Za-z0-9]{40})\b/g, captureIndex: 1, slugHint: "linear_api_key" },
-  { rule_id: "shopify_access_token", regex: /\b(shpat_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
-  { rule_id: "shopify_shared_secret", regex: /\b(shpss_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
-  { rule_id: "shopify_private_app", regex: /\b(shppa_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
-  { rule_id: "square_access_token", regex: /\b(sq0atp-[A-Za-z0-9_-]{22})\b/g, captureIndex: 1, slugHint: "square_token" },
-  { rule_id: "square_oauth_secret", regex: /\b(sq0csp-[A-Za-z0-9_-]{43})\b/g, captureIndex: 1, slugHint: "square_token" },
-  { rule_id: "newrelic_key", regex: /\b(NRAK-[A-Z0-9]{27})\b/g, captureIndex: 1, slugHint: "newrelic_key" },
-  { rule_id: "notion_token", regex: /\b(ntn_[A-Za-z0-9]{46})\b/g, captureIndex: 1, slugHint: "notion_token" },
-  { rule_id: "planetscale_password", regex: /\b(pscale_pw_[A-Za-z0-9_.-]{43})\b/g, captureIndex: 1, slugHint: "planetscale_token" },
-  { rule_id: "planetscale_token", regex: /\b(pscale_tkn_[A-Za-z0-9_.-]{43})\b/g, captureIndex: 1, slugHint: "planetscale_token" },
-  { rule_id: "supabase_service_key", regex: /\b(sbp_[a-f0-9]{40})\b/g, captureIndex: 1, slugHint: "supabase_key" },
-  { rule_id: "atlassian_token", regex: /\b(ATATT[A-Za-z0-9_\-=]{20,})\b/g, captureIndex: 1, slugHint: "atlassian_token" },
-  { rule_id: "dropbox_token", regex: /\b(sl\.[A-Za-z0-9_-]{130,})/g, captureIndex: 1, slugHint: "dropbox_token" },
-  { rule_id: "databricks_token", regex: /\b(dapi[a-f0-9]{32})\b/g, captureIndex: 1, slugHint: "databricks_token" },
-  { rule_id: "grafana_service_account", regex: /\b(glsa_[A-Za-z0-9]{32}_[a-fA-F0-9]{8})\b/g, captureIndex: 1, slugHint: "grafana_token" },
-  { rule_id: "pypi_token", regex: /\b(pypi-AgEIcHlwaS[A-Za-z0-9_-]{50,})/g, captureIndex: 1, slugHint: "pypi_token" },
-  { rule_id: "aws_temp_access_key", regex: /\b(ASIA[0-9A-Z]{16})\b/g, captureIndex: 1, slugHint: "aws_access_key" },
-  { rule_id: "gcp_oauth_token", regex: /\b(ya29\.[A-Za-z0-9_-]{30,})/g, captureIndex: 1, slugHint: "gcp_oauth_token" }
-];
-var ALL_PATTERNS = [...ANCHORED_PATTERNS, ...PROVIDER_PATTERNS, ...STRUCTURED_PATTERNS];
-
-// telegram-plugin/secret-detect/entropy.ts
-function shannonEntropy(s) {
-  if (s.length === 0)
-    return 0;
-  const counts = new Map;
-  for (const ch of s) {
-    counts.set(ch, (counts.get(ch) ?? 0) + 1);
-  }
-  let h = 0;
-  const len = s.length;
-  for (const c of counts.values()) {
-    const p = c / len;
-    h -= p * Math.log2(p);
-  }
-  return h;
-}
-
-// telegram-plugin/secret-detect/inert-values.ts
-var INERT_VALUE_RE = [
-  /^\[REDACTED(?::[A-Za-z0-9_]+)?\]$/i,
-  /^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/,
-  /^\{\{[^\n\r\u2028\u2029]*\}\}$/,
-  /^<[^<>\n\r\u2028\u2029]*>$/,
-  /^%[A-Za-z_][A-Za-z0-9_]*%$/,
-  /^vault:[A-Za-z0-9_./-]*$/i,
-  /^[*x\u2022.]+$/i,
-  /^(?:process\.env|import\.meta\.env|os\.environ)(?:\.[A-Za-z_$][A-Za-z0-9_$]*|\[["']?[A-Za-z_$][A-Za-z0-9_$]*["']?\])*$/,
-  /^(?:changeme|change-me|replaceme|replace-me|placeholder|todo|tbd|yourkey|your-key|yourpassword|your-password|yoursecret|your-secret|yourtoken|your-token)(?:[-_][A-Za-z0-9-]+)?$/i,
-  /^[a-z]+(?: [a-z]+){2,}$/
-];
-var CREDENTIAL_RUN_RE = /[A-Za-z0-9]{12,}/g;
-var MIXED_CLASS_RUN_MIN = 12;
-var SINGLE_CLASS_RUN_MIN = 16;
-function runIsCredentialShaped(run) {
-  let classes = 0;
-  if (/[a-z]/.test(run))
-    classes++;
-  if (/[A-Z]/.test(run))
-    classes++;
-  if (/[0-9]/.test(run))
-    classes++;
-  return run.length >= (classes >= 2 ? MIXED_CLASS_RUN_MIN : SINGLE_CLASS_RUN_MIN);
-}
-function hasCredentialShapedRun(value) {
-  for (const run of value.match(CREDENTIAL_RUN_RE) ?? []) {
-    if (runIsCredentialShaped(run))
-      return true;
+var DEFAULT_MAX_TURNS = 50;
+var TOPIC_MAX_CHARS = 117;
+var TURN_TEXT_MAX_CHARS = 1200;
+function extractTurnsFromJsonl(path2, maxTurns) {
+  let raw;
+  try {
+    raw = readFileSync20(path2, "utf-8");
+  } catch {
+    return [];
   }
-  return false;
-}
-function isInertValue(value) {
-  if (!INERT_VALUE_RE.some((re) => re.test(value)))
-    return false;
-  return !hasCredentialShapedRun(value);
-}
-var INERT_GATED_RULES = new Set([
-  "env_key_value",
-  "json_secret_field",
-  "cli_flag"
-]);
-var TRAILING_PUNCT_RE = /[.,;:!?)\]}]+$/;
-function stripTrailingPunctuation(value) {
-  return value.replace(TRAILING_PUNCT_RE, "");
-}
-
-// telegram-plugin/secret-detect/kv-scanner.ts
-var KV_RE = /\b([A-Za-z_][A-Za-z0-9_-]*(?:password|passwd|token|secret|key|api[_-]?key))\s*[:=]\s*["']?([^\s"'\\]{8,})["']?/gi;
-var KV_ENTROPY_THRESHOLD = 4;
-var MEMORABLE_PW_RE = /\b([A-Za-z0-9_-]*(?:password|passwd|passphrase|pwd))\b\s*(?:[:=]\s*|\s+is\s+)(["']?)([^\s"']{8,64})\2/gi;
-var MEMORABLE_PW_RULE_ID = "memorable_password";
-var MEMORABLE_PW_MIN_CLASSES = 2;
-function charClassCount(value) {
-  let n = 0;
-  if (/[a-z]/.test(value))
-    n++;
-  if (/[A-Z]/.test(value))
-    n++;
-  if (/[0-9]/.test(value))
-    n++;
-  if (/[^A-Za-z0-9]/.test(value))
-    n++;
-  return n;
-}
-function looksLikeMemorablePassword(value) {
-  if (isInertValue(value))
-    return false;
-  const core = stripTrailingPunctuation(value);
-  if (core.length < 8 || core.length > 64)
-    return false;
-  if (isInertValue(core))
-    return false;
-  if (new Set(core).size < 4)
-    return false;
-  return charClassCount(core) >= MEMORABLE_PW_MIN_CLASSES;
-}
-function scanMemorablePasswords(text) {
-  const hits = [];
-  MEMORABLE_PW_RE.lastIndex = 0;
-  let m;
-  while ((m = MEMORABLE_PW_RE.exec(text)) !== null) {
-    const keyName = m[1];
-    const value = m[3];
-    if (!value || !looksLikeMemorablePassword(value))
-      continue;
-    const valueOffsetInMatch = m[0].indexOf(value, keyName.length);
-    if (valueOffsetInMatch < 0)
+  const turns = [];
+  for (const line of raw.split(`
+`)) {
+    if (!line.trim())
       continue;
-    const start = m.index + valueOffsetInMatch;
-    hits.push({
-      rule_id: MEMORABLE_PW_RULE_ID,
-      start,
-      end: start + value.length,
-      matched_text: value,
-      key_name: keyName,
-      confidence: "ambiguous"
-    });
-  }
-  return hits;
-}
-function scanKeyValue(text) {
-  const hits = [];
-  KV_RE.lastIndex = 0;
-  let m;
-  while ((m = KV_RE.exec(text)) !== null) {
-    const [, keyName, value] = m;
-    if (!value)
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
       continue;
-    if (isInertValue(value))
+    }
+    if (obj.type === "queue-operation") {
+      const op = obj.operation;
+      if (op !== "enqueue")
+        continue;
+      const content = obj.content;
+      if (typeof content !== "string")
+        continue;
+      const text = extractChannelBody(content);
+      if (text)
+        turns.push({ role: "user", text });
       continue;
-    const h = shannonEntropy(value);
-    if (h < KV_ENTROPY_THRESHOLD)
+    }
+    if (obj.type === "user" && obj.message && typeof obj.message === "object") {
+      const content = obj.message.content;
+      const raw2 = extractTextBlocks(content);
+      const text = raw2 ? extractChannelBody(raw2) : null;
+      if (text)
+        turns.push({ role: "user", text });
       continue;
-    const valueOffsetInMatch = m[0].indexOf(value, keyName.length);
-    if (valueOffsetInMatch < 0)
+    }
+    if (obj.type === "assistant" && obj.message && typeof obj.message === "object") {
+      const content = obj.message.content;
+      const text = extractTextBlocks(content);
+      if (text)
+        turns.push({ role: "assistant", text });
       continue;
-    const start = m.index + valueOffsetInMatch;
-    const end = start + value.length;
-    hits.push({
-      rule_id: "kv_entropy",
-      start,
-      end,
-      matched_text: value,
-      key_name: keyName,
-      confidence: "ambiguous"
-    });
+    }
   }
-  return hits;
-}
-
-// telegram-plugin/secret-detect/db-uri.ts
-var DB_URI_RE = /\b([a-zA-Z][a-zA-Z0-9+.-]+):\/\/([^\s:/@]+):([^\s/?#]+)@([^\s/@?#]+)/g;
-var DB_URI_RULE_ID = "db_uri_password";
-function isInertPassword(value) {
-  if (value.startsWith("[REDACTED"))
-    return true;
-  return /^[*x]+$/i.test(value);
-}
-function scanDbUris(text) {
-  const hits = [];
-  DB_URI_RE.lastIndex = 0;
-  let m;
-  while ((m = DB_URI_RE.exec(text)) !== null) {
-    const scheme = m[1];
-    const user = m[2];
-    const password = m[3];
-    if (isInertPassword(password))
+  const deduped = [];
+  for (const t of turns) {
+    const prev = deduped[deduped.length - 1];
+    if (prev && prev.role === t.role && prev.text === t.text)
       continue;
-    const start = m.index + scheme.length + 3 + user.length + 1;
-    hits.push({
-      rule_id: DB_URI_RULE_ID,
-      start,
-      end: start + password.length,
-      matched_text: password,
-      key_name: `${scheme}_password`,
-      confidence: "ambiguous"
-    });
+    deduped.push(t);
   }
-  return hits;
+  if (deduped.length <= maxTurns)
+    return deduped;
+  return deduped.slice(deduped.length - maxTurns);
 }
-
-// telegram-plugin/secret-detect/generic-entropy.ts
-var CANDIDATE_RE = /[A-Za-z0-9]{28,}/g;
-var GENERIC_MIN_DISTINCT = 18;
-var MAX_GENERIC_HITS = 20;
-function hasDistinctChars(tok, n) {
-  const seen = new Uint8Array(128);
-  let distinct = 0;
-  for (let i = 0;i < tok.length; i++) {
-    const c = tok.charCodeAt(i);
-    if (seen[c] === 0) {
-      seen[c] = 1;
-      if (++distinct >= n)
-        return true;
-    }
-  }
-  return false;
+function extractChannelBody(raw) {
+  const m = raw.match(/<channel[^>]*>([\s\S]*?)<\/channel>/);
+  if (m)
+    return m[1].trim();
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : null;
 }
-function hasDigit(tok) {
-  for (let i = 0;i < tok.length; i++) {
-    const c = tok.charCodeAt(i);
-    if (c >= 48 && c <= 57)
-      return true;
+function extractTextBlocks(content) {
+  if (typeof content === "string") {
+    const t = content.trim();
+    return t.length > 0 ? t : null;
   }
-  return false;
-}
-function scanGenericSecrets(text) {
-  const hits = [];
-  CANDIDATE_RE.lastIndex = 0;
-  let m;
-  while ((m = CANDIDATE_RE.exec(text)) !== null) {
-    if (hits.length >= MAX_GENERIC_HITS)
-      break;
-    const tok = m[0];
-    if (!hasDigit(tok))
-      continue;
-    if (!hasDistinctChars(tok, GENERIC_MIN_DISTINCT))
+  if (!Array.isArray(content))
+    return null;
+  const parts = [];
+  for (const block of content) {
+    if (!block || typeof block !== "object")
       continue;
-    hits.push({
-      rule_id: "generic_high_entropy",
-      start: m.index,
-      end: m.index + tok.length,
-      matched_text: tok,
-      confidence: "ambiguous"
-    });
+    const b = block;
+    if (b.type === "text" && typeof b.text === "string") {
+      parts.push(b.text);
+    } else if (b.type === "tool_result" && typeof b.content === "string") {
+      parts.push(`[tool result] ${b.content.slice(0, 400)}`);
+    }
   }
-  return hits;
+  const joined = parts.join(`
+`).trim();
+  return joined.length > 0 ? joined : null;
 }
+function formatTranscriptTail(turns) {
+  const header = `# Handoff \u2014 previous session
 
-// telegram-plugin/secret-detect/chunker.ts
-var CHUNK_THRESHOLD = 32 * 1024;
-var WINDOW_SIZE = 16 * 1024;
-var OVERLAP = 8 * 1024;
-function chunk(text) {
-  if (text.length <= CHUNK_THRESHOLD) {
-    return [{ offset: 0, text }];
-  }
-  const out = [];
-  let offset = 0;
-  while (offset < text.length) {
-    const end = Math.min(offset + WINDOW_SIZE, text.length);
-    out.push({ offset, text: text.slice(offset, end) });
-    if (end >= text.length)
-      break;
-    offset = end - OVERLAP;
+` + "You are resuming this agent's work. There is no generated summary " + "\u2014 below is the **raw tail of the previous session's transcript** " + "(oldest first, most recent last). Read it to reorient, then carry " + "on. Anything important worth keeping long-term should already be " + `in your memory files \u2014 check those too.
+`;
+  if (turns.length === 0) {
+    return header + `
+_(No recent turns were recoverable from the previous session.)_
+`;
   }
-  return out;
-}
+  const body = turns.map((t) => {
+    let text = t.text;
+    if (text.length > TURN_TEXT_MAX_CHARS) {
+      text = text.slice(0, TURN_TEXT_MAX_CHARS) + `
+\u2026[truncated]`;
+    }
+    return `### ${t.role === "user" ? "User" : "Assistant"}
+${text}`;
+  }).join(`
 
-// telegram-plugin/secret-detect/suppressor.ts
-var MARKERS = ["test", "mock", "example", "fixture", "dummy"];
-var WINDOW = 40;
-var MARKER_RE = new RegExp(`\\b(?:${MARKERS.join("|")})\\b`, "i");
-function isSuppressed(text, start, end) {
-  const left = Math.max(0, start - WINDOW);
-  const right = Math.min(text.length, end + WINDOW);
-  const context = text.slice(left, start) + text.slice(end, right);
-  return MARKER_RE.test(context);
-}
+`);
+  return `${header}
+## Recent turns
 
-// telegram-plugin/secret-detect/slug.ts
-function sanitizeKeyName(raw) {
-  const up = raw.toUpperCase();
-  const cleaned = up.replace(/[^A-Z0-9_]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
-  return cleaned.length > 0 ? cleaned : "SECRET";
-}
-function datePart(now = new Date) {
-  const y = now.getUTCFullYear();
-  const m = String(now.getUTCMonth() + 1).padStart(2, "0");
-  const d = String(now.getUTCDate()).padStart(2, "0");
-  return `${y}${m}${d}`;
+${body}
+`;
 }
-function deriveSlug(inputs, existing) {
-  let base;
-  if (inputs.key_name && inputs.key_name.trim().length > 0) {
-    base = sanitizeKeyName(inputs.key_name);
-  } else {
-    base = `${inputs.rule_id}_${datePart(inputs.now)}`;
+function deriveTopic(turns) {
+  for (let i = turns.length - 1;i >= 0; i--) {
+    if (turns[i].role === "user")
+      return clampTopic(firstLine(turns[i].text));
   }
-  if (!existing.has(base))
-    return base;
-  let n = 2;
-  while (existing.has(`${base}_${n}`))
-    n++;
-  return `${base}_${n}`;
+  if (turns.length > 0)
+    return clampTopic(firstLine(turns[turns.length - 1].text));
+  return "previous session";
 }
-// telegram-plugin/secret-detect/url-redact.ts
-var SENSITIVE_PARAMS = new Set([
-  "token",
-  "key",
-  "api_key",
-  "apikey",
-  "secret",
-  "access_token",
-  "password",
-  "pass",
-  "auth",
-  "client_secret",
-  "refresh_token",
-  "signature"
-]);
-var URL_RE = /\b(?:https?|wss?|ftp):\/\/[^\s<>"']+/gi;
-function redactUrls(text) {
-  return text.replace(URL_RE, (m) => {
-    const redacted = redactOne(m);
-    return redacted ?? m;
-  });
+function firstLine(s) {
+  const line = s.split(/\r?\n/).find((l) => l.trim().length > 0) ?? s;
+  return line.trim();
 }
-function redactOne(raw) {
-  let u;
-  try {
-    u = new URL(raw);
-  } catch {
-    return null;
-  }
-  let changed = false;
-  if (u.username || u.password) {
-    u.username = "***";
-    u.password = "";
-    changed = true;
-  }
-  for (const [key] of u.searchParams) {
-    if (SENSITIVE_PARAMS.has(key.toLowerCase())) {
-      u.searchParams.set(key, "***");
-      changed = true;
-    }
-  }
-  return changed ? u.toString() : null;
-}
-
-// telegram-plugin/secret-detect/index.ts
-function detectSecrets(text) {
-  if (!text || text.length === 0)
-    return [];
-  const windows = chunk(text);
-  const raw = [];
-  for (const win of windows) {
-    for (const p of ALL_PATTERNS) {
-      const re = new RegExp(p.regex.source, p.regex.flags.includes("g") ? p.regex.flags : p.regex.flags + "g");
-      let m;
-      while ((m = re.exec(win.text)) !== null) {
-        if (m[0].length === 0) {
-          re.lastIndex++;
-          continue;
-        }
-        const cap = p.captureIndex === 0 ? m[0] : m[p.captureIndex];
-        if (!cap)
-          continue;
-        const matchStart = p.captureIndex === 0 ? m.index : m.index + m[0].indexOf(cap);
-        if (matchStart < 0)
-          continue;
-        const globalStart = win.offset + matchStart;
-        const globalEnd = globalStart + cap.length;
-        const keyName = p.rule_id === "env_key_value" ? m[1] : undefined;
-        if (INERT_GATED_RULES.has(p.rule_id) && isInertValue(cap))
-          continue;
-        if (p.rule_id === "env_key_value") {
-          const ENV_KV_MIN_LEN = 12;
-          const ENV_KV_MIN_ENTROPY = 3.5;
-          if (cap.length < ENV_KV_MIN_LEN)
-            continue;
-          if (shannonEntropy(cap) < ENV_KV_MIN_ENTROPY)
-            continue;
-        }
-        raw.push({
-          rule_id: p.rule_id,
-          start: globalStart,
-          end: globalEnd,
-          matched_text: cap,
-          key_name: keyName,
-          confidence: "high"
-        });
-      }
-    }
-    const kvHits = scanKeyValue(win.text);
-    for (const h of kvHits) {
-      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
-    }
-    for (const h of scanDbUris(win.text)) {
-      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
-    }
-    for (const h of scanMemorablePasswords(win.text)) {
-      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
-    }
-    const genHits = scanGenericSecrets(win.text);
-    for (const h of genHits) {
-      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
-    }
-  }
-  const deduped = dedupeRaw(raw);
-  const final = dropOverlaps(deduped);
-  const existing = new Set;
-  const out = [];
-  for (const h of final) {
-    const suggested_slug = deriveSlug({ key_name: h.key_name, rule_id: h.rule_id }, existing);
-    existing.add(suggested_slug);
-    out.push({
-      rule_id: h.rule_id,
-      matched_text: h.matched_text,
-      start: h.start,
-      end: h.end,
-      confidence: h.confidence,
-      suppressed: isSuppressed(text, h.start, h.end),
-      suggested_slug,
-      key_name: h.key_name
-    });
-  }
-  out.sort((a, b) => a.start - b.start);
-  return out;
-}
-function dedupeRaw(raw) {
-  const seen = new Map;
-  for (const h of raw) {
-    const key = `${h.start}:${h.end}`;
-    const existing = seen.get(key);
-    if (!existing) {
-      seen.set(key, h);
-      continue;
-    }
-    if (existing.confidence === "ambiguous" && h.confidence === "high") {
-      seen.set(key, h);
-    }
-  }
-  return Array.from(seen.values());
-}
-function dropOverlaps(hits) {
-  const out = hits.filter((h) => !(h.confidence === "ambiguous" && hits.some((o) => o !== h && o.start <= h.start && o.end >= h.end && !(o.start === h.start && o.end === h.end))));
-  out.sort((a, b) => a.start - b.start || a.end - b.end);
-  return out;
-}
-
-// telegram-plugin/secret-detect/redact.ts
-var REDACTED_MARKER = "[REDACTED]";
-function redact(text) {
-  if (!text || text.length === 0)
-    return text;
-  const urlScrubbed = redactUrls(text);
-  const hits = detectSecrets(urlScrubbed).filter((h) => h.rule_id !== "generic_high_entropy");
-  if (hits.length === 0)
-    return urlScrubbed;
-  const sorted = [...hits].sort((a, b) => b.start - a.start);
-  let out = urlScrubbed;
-  for (const h of sorted) {
-    out = out.slice(0, h.start) + redactedMarker(h.rule_id) + out.slice(h.end);
-  }
-  return out;
-}
-function redactedMarker(ruleId) {
-  const trimmed = ruleId.replace(/^(kv|env)_/, "");
-  if (!trimmed || trimmed === "key_value" || trimmed === "kv_entropy") {
-    return REDACTED_MARKER;
-  }
-  return `[REDACTED:${trimmed}]`;
-}
-// src/memory/hindsight-write-redaction.ts
-function redactJsonStrings(value) {
-  if (typeof value === "string")
-    return redact(value);
-  if (Array.isArray(value))
-    return value.map(redactJsonStrings);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = redactJsonStrings(v);
-    }
-    return out;
-  }
-  return value;
-}
-var REDACTED_ITEM_FIELDS = ["content", "context"];
-function redactMemoryWriteBody(body) {
-  if (!body || typeof body !== "object" || Array.isArray(body))
-    return body;
-  const src = body;
-  if (!Array.isArray(src.items))
-    return body;
-  const items = src.items.map((item) => {
-    if (!item || typeof item !== "object" || Array.isArray(item))
-      return item;
-    const row = { ...item };
-    for (const field of REDACTED_ITEM_FIELDS) {
-      if (typeof row[field] === "string") {
-        row[field] = redact(row[field]);
-      }
-    }
-    if (row.metadata && typeof row.metadata === "object") {
-      row.metadata = redactJsonStrings(row.metadata);
-    }
-    return row;
-  });
-  return { ...src, items };
-}
-
-// src/agents/handoff-summarizer.ts
-init_observation_scopes();
-var HANDOFF_STATUS_MIRROR_SKIPPED = "mirror-skipped-invalid-scope";
-var DEFAULT_MAX_TURNS = 50;
-var TOPIC_MAX_CHARS = 117;
-var TURN_TEXT_MAX_CHARS = 1200;
-function extractTurnsFromJsonl(path2, maxTurns) {
-  let raw;
-  try {
-    raw = readFileSync20(path2, "utf-8");
-  } catch {
-    return [];
-  }
-  const turns = [];
-  for (const line of raw.split(`
-`)) {
-    if (!line.trim())
-      continue;
-    let obj;
-    try {
-      obj = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    if (obj.type === "queue-operation") {
-      const op = obj.operation;
-      if (op !== "enqueue")
-        continue;
-      const content = obj.content;
-      if (typeof content !== "string")
-        continue;
-      const text = extractChannelBody(content);
-      if (text)
-        turns.push({ role: "user", text });
-      continue;
-    }
-    if (obj.type === "user" && obj.message && typeof obj.message === "object") {
-      const content = obj.message.content;
-      const raw2 = extractTextBlocks(content);
-      const text = raw2 ? extractChannelBody(raw2) : null;
-      if (text)
-        turns.push({ role: "user", text });
-      continue;
-    }
-    if (obj.type === "assistant" && obj.message && typeof obj.message === "object") {
-      const content = obj.message.content;
-      const text = extractTextBlocks(content);
-      if (text)
-        turns.push({ role: "assistant", text });
-      continue;
-    }
-  }
-  const deduped = [];
-  for (const t of turns) {
-    const prev = deduped[deduped.length - 1];
-    if (prev && prev.role === t.role && prev.text === t.text)
-      continue;
-    deduped.push(t);
-  }
-  if (deduped.length <= maxTurns)
-    return deduped;
-  return deduped.slice(deduped.length - maxTurns);
-}
-function extractChannelBody(raw) {
-  const m = raw.match(/<channel[^>]*>([\s\S]*?)<\/channel>/);
-  if (m)
-    return m[1].trim();
-  const trimmed = raw.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-function extractTextBlocks(content) {
-  if (typeof content === "string") {
-    const t = content.trim();
-    return t.length > 0 ? t : null;
-  }
-  if (!Array.isArray(content))
-    return null;
-  const parts = [];
-  for (const block of content) {
-    if (!block || typeof block !== "object")
-      continue;
-    const b = block;
-    if (b.type === "text" && typeof b.text === "string") {
-      parts.push(b.text);
-    } else if (b.type === "tool_result" && typeof b.content === "string") {
-      parts.push(`[tool result] ${b.content.slice(0, 400)}`);
-    }
-  }
-  const joined = parts.join(`
-`).trim();
-  return joined.length > 0 ? joined : null;
-}
-function formatTranscriptTail(turns) {
-  const header = `# Handoff \u2014 previous session
-
-` + "You are resuming this agent's work. There is no generated summary " + "\u2014 below is the **raw tail of the previous session's transcript** " + "(oldest first, most recent last). Read it to reorient, then carry " + "on. Anything important worth keeping long-term should already be " + `in your memory files \u2014 check those too.
-`;
-  if (turns.length === 0) {
-    return header + `
-_(No recent turns were recoverable from the previous session.)_
-`;
-  }
-  const body = turns.map((t) => {
-    let text = t.text;
-    if (text.length > TURN_TEXT_MAX_CHARS) {
-      text = text.slice(0, TURN_TEXT_MAX_CHARS) + `
-\u2026[truncated]`;
-    }
-    return `### ${t.role === "user" ? "User" : "Assistant"}
-${text}`;
-  }).join(`
-
-`);
-  return `${header}
-## Recent turns
-
-${body}
-`;
-}
-function deriveTopic(turns) {
-  for (let i = turns.length - 1;i >= 0; i--) {
-    if (turns[i].role === "user")
-      return clampTopic(firstLine(turns[i].text));
-  }
-  if (turns.length > 0)
-    return clampTopic(firstLine(turns[turns.length - 1].text));
-  return "previous session";
-}
-function firstLine(s) {
-  const line = s.split(/\r?\n/).find((l) => l.trim().length > 0) ?? s;
-  return line.trim();
-}
-function clampTopic(s) {
-  return s.length > TOPIC_MAX_CHARS ? s.slice(0, TOPIC_MAX_CHARS) + "\u2026" : s;
+function clampTopic(s) {
+  return s.length > TOPIC_MAX_CHARS ? s.slice(0, TOPIC_MAX_CHARS) + "\u2026" : s;
 }
 function writeSidecarsAtomic(agentDir, briefing, topic) {
   mkdirSync16(agentDir, { recursive: true });
@@ -73805,8 +73191,7 @@ async function buildHandoff(opts) {
 `);
     return "write-error";
   }
-  const mirrored = await mirrorToHindsight(briefing, opts).catch(() => true);
-  return mirrored ? "ok" : HANDOFF_STATUS_MIRROR_SKIPPED;
+  return "ok";
 }
 function errMsg(err) {
   if (err && typeof err === "object" && "message" in err) {
@@ -73814,42 +73199,6 @@ function errMsg(err) {
   }
   return String(err);
 }
-async function mirrorToHindsight(briefing, opts) {
-  const url = opts.hindsightUrl ?? process.env.HINDSIGHT_API_URL;
-  const bankId = opts.hindsightBankId ?? process.env.HINDSIGHT_BANK_ID ?? "default";
-  if (!url)
-    return true;
-  const fetchFn = opts.fetch ?? fetch;
-  const endpoint = `${url.replace(/\/$/, "")}/v1/default/banks/${encodeURIComponent(bankId)}/memories`;
-  const scope = resolveObservationScope(opts.observationScopes, opts.env ?? process.env);
-  if (scope.kind === "invalid") {
-    process.stderr.write(`handoff: hindsight mirror SKIPPED \u2014 observation scope ` + `${JSON.stringify(scope.raw)} is not valid ` + `(accepted: ${observationScopesHint()}). Fix ` + `memory.observation_scopes in switchroom.yaml (or the ` + `${OBSERVATION_SCOPES_ENV} export), then \`switchroom apply\` and ` + `restart the agent. The on-disk handoff sidecars were written ` + `normally; only the recallable Hindsight copy was skipped.
-`);
-    return false;
-  }
-  const body = redactMemoryWriteBody({
-    items: [
-      {
-        content: briefing,
-        document_id: "session_handoff",
-        tags: ["session_handoff", opts.agentName],
-        ...scope.kind === "set" ? { observation_scopes: scope.scope } : {}
-      }
-    ],
-    async: true
-  });
-  try {
-    await fetchFn(endpoint, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(body)
-    });
-  } catch (err) {
-    process.stderr.write(`handoff: hindsight mirror failed \u2014 ${errMsg(err)}
-`);
-  }
-  return true;
-}
 function findLatestSessionJsonl(claudeConfigDir) {
   const projects = join18(claudeConfigDir, "projects");
   if (!existsSync24(projects))
@@ -76856,8 +76205,8 @@ Bootstrapping agent: ${name}
     const code = await new Promise((resolve25) => {
       process.stdin.setEncoding("utf-8");
       let buf = "";
-      process.stdin.on("data", (chunk2) => {
-        buf += chunk2.toString();
+      process.stdin.on("data", (chunk) => {
+        buf += chunk.toString();
         const newlineIdx = buf.indexOf(`
 `);
         if (newlineIdx !== -1) {
@@ -76939,8 +76288,8 @@ switchroom agent add: ${name}
       return new Promise((resolveLine) => {
         process.stdin.setEncoding("utf-8");
         let buf = "";
-        const onData = (chunk2) => {
-          buf += chunk2.toString();
+        const onData = (chunk) => {
+          buf += chunk.toString();
           const newlineIdx = buf.indexOf(`
 `);
           if (newlineIdx !== -1) {
@@ -78971,8 +78320,8 @@ async function readHiddenLine2(prompt) {
       stdin.setRawMode(true);
     }
     let line = "";
-    const onData = (chunk2) => {
-      const s = chunk2.toString("utf8");
+    const onData = (chunk) => {
+      const s = chunk.toString("utf8");
       for (const ch of s) {
         if (ch === `
 ` || ch === "\r") {
@@ -79901,7 +79250,7 @@ function getVaultPath2(configPath) {
     return resolvePath("~/.switchroom/vault.enc");
   }
 }
-function maskToken2(s) {
+function maskToken(s) {
   if (s.length >= 18)
     return `${s.slice(0, 6)}...${s.slice(-4)}`;
   return "***";
@@ -80189,7 +79538,7 @@ function registerVaultSweep(vault, program3) {
     console.log("");
     console.log(source_default.dim(`masked values for display only:`));
     for (const v of values) {
-      console.log(`  vault:${v.key} \u2192 ${maskToken2(v.value)}`);
+      console.log(`  vault:${v.key} \u2192 ${maskToken(v.value)}`);
     }
     if (opts.dryRun) {
       console.log(source_default.yellow("dry-run \u2014 no files modified. Rerun without --dry-run to apply."));
@@ -83162,8 +82511,8 @@ class VaultBroker {
       peer = this.testOpts._testIdentify ? this.testOpts._testIdentify(listenerSocketPath, socket) : identify(listenerSocketPath, socket);
     }
     let buffer = "";
-    socket.on("data", (chunk2) => {
-      buffer += chunk2.toString("utf8");
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
       if (Buffer.byteLength(buffer, "utf8") > MAX_FRAME_BYTES) {
         const resp = encodeResponse(errorResponse("BAD_REQUEST", "Frame exceeds 64 KiB limit"));
         socket.end(resp);
@@ -84272,8 +83621,8 @@ class VaultBroker {
     const auditCaller = isOperator ? "operator" : unlockPeer !== null ? callerFromPeer(unlockPeer) : `pid:${process.pid}`;
     const auditCgroup = isOperator ? undefined : unlockPeer?.systemdUnit ?? undefined;
     let buffer = "";
-    socket.on("data", (chunk2) => {
-      buffer += chunk2.toString("utf8");
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
       const newlineIdx = buffer.indexOf(`
 `);
       if (newlineIdx === -1) {
@@ -85840,7 +85189,7 @@ function promptLine2(prompt, hidden = false) {
 function readStdinToEnd() {
   return new Promise((resolve31, reject) => {
     const chunks = [];
-    process.stdin.on("data", (chunk2) => chunks.push(chunk2));
+    process.stdin.on("data", (chunk) => chunks.push(chunk));
     process.stdin.on("end", () => {
       resolve31(Buffer.concat(chunks).toString("utf8"));
     });
@@ -87265,257 +86614,846 @@ function registerLinearAgentCommand(program3) {
     } else {
       console.log(source_default.green(`\u2713 Default Linear team for '${opts.agent}' set to ${opts.team.trim()}.`));
     }
-    console.log(source_default.gray(`  Run 'switchroom agent restart ${opts.agent}' to pick up the change.`));
-  }));
+    console.log(source_default.gray(`  Run 'switchroom agent restart ${opts.agent}' to pick up the change.`));
+  }));
+}
+function printLinearInstructions(opts, vaultKey) {
+  const base = opts.webhookBase ?? "https://<your-switchroom-web-host>";
+  const webhookUrl = `${base.replace(/\/$/, "")}/webhook/${opts.agent}/linear`;
+  console.log("");
+  console.log(source_default.bold("Next steps in Linear (browser, one-time per agent):"));
+  console.log(source_default.gray("  1. Create / open your Linear OAuth app with actor=app and scopes"));
+  console.log(source_default.gray("     app:mentionable + app:assignable (https://linear.app/developers/agents)."));
+  if (opts.clientId) {
+    const redirect = opts.redirectUri ?? `${base.replace(/\/$/, "")}/oauth/callback`;
+    const authorizeUrl = `https://linear.app/oauth/authorize?` + `client_id=${encodeURIComponent(opts.clientId)}` + `&redirect_uri=${encodeURIComponent(redirect)}` + `&response_type=code` + `&scope=${encodeURIComponent("read,write,app:assignable,app:mentionable")}` + `&actor=app`;
+    console.log(source_default.gray("  2. Authorize the app as an actor (open in a browser):"));
+    console.log(source_default.cyan(`     ${authorizeUrl}`));
+    console.log(source_default.gray("     The redirect delivers the app token you pass to this verb via --token."));
+  } else {
+    console.log(source_default.gray("  2. Authorize the app (actor=app) in a browser; capture the app token and"));
+    console.log(source_default.gray("     re-run this verb with --token (and optionally --client-id to print the"));
+    console.log(source_default.gray("     authorize URL)."));
+  }
+  console.log(source_default.gray("  3. Register this webhook URL on the app (AgentSessionEvent + Issue/Comment):"));
+  console.log(source_default.cyan(`     ${webhookUrl}`));
+  console.log(source_default.gray("     Use Linear's signing secret as the webhook secret \u2014 store it in the vault " + `under webhook/${opts.agent}/linear (e.g. 'switchroom telegram enable webhook ` + `--agent ${opts.agent} --source linear --secret <signing-secret>').`));
+  console.log("");
+  console.log(source_default.gray(`  Token is read at runtime from vault:${vaultKey} (actor=app).`));
+}
+function makeUnifiedDiff2(before, after) {
+  const a = before.split(`
+`);
+  const b = after.split(`
+`);
+  const out = [];
+  let i = 0, j = 0;
+  while (i < a.length || j < b.length) {
+    if (i < a.length && j < b.length && a[i] === b[j]) {
+      out.push(`  ${a[i]}`);
+      i++;
+      j++;
+    } else if (j < b.length && (i >= a.length || a[i] !== b[j])) {
+      out.push(source_default.green(`+ ${b[j]}`));
+      j++;
+    } else {
+      out.push(source_default.red(`- ${a[i]}`));
+      i++;
+    }
+  }
+  return out.join(`
+`);
+}
+function fail3(msg) {
+  console.error(source_default.red(`Error: ${msg}`));
+  process.exit(1);
+}
+
+// src/cli/memory.ts
+init_source();
+init_hindsight2();
+
+// src/memory/search.ts
+init_hindsight2();
+function shellQuote2(s) {
+  return "'" + s.replace(/'/g, `'"'"'`) + "'";
+}
+function searchMemory(query, collection) {
+  return `hindsight recall --collection ${shellQuote2(collection)} --query ${shellQuote2(query)}`;
+}
+function getMemoryStats(collection) {
+  return `hindsight stats --collection ${shellQuote2(collection)}`;
+}
+function reflectAcrossAgents(config) {
+  const eligible = [];
+  const excluded = [];
+  for (const agentName of Object.keys(config.agents)) {
+    const collection = getCollectionForAgent(agentName, config);
+    if (isStrictIsolation(agentName, config)) {
+      excluded.push({ agent: agentName, collection });
+    } else {
+      eligible.push({ agent: agentName, collection });
+    }
+  }
+  const commands = eligible.map(({ collection }) => `hindsight reflect --collection ${shellQuote2(collection)}`);
+  return { eligible, excluded, commands };
+}
+
+// src/memory/observation-scope-cleanup.ts
+var CLEANUP_VOLATILE_PATTERNS = [
+  /^parent_session:/,
+  /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}(-sub-.+)?$/
+];
+var CLEANUP_STALE_PATTERNS = [/^agent-[0-9a-f]{8,}$/];
+function matchesAny(tag, patterns) {
+  return patterns.some((p) => p.test(tag));
+}
+function scopeKey(tags) {
+  return tags.length === 0 ? "shared" : [...tags].sort().join(",");
+}
+function planScopeCleanup(bankId, scopes, options = {}) {
+  const volatilePatterns = options.volatilePatterns ?? CLEANUP_VOLATILE_PATTERNS;
+  const stalePatterns = options.stalePatterns ?? CLEANUP_STALE_PATTERNS;
+  const retireStale = options.retireStale ?? false;
+  const totalScopes = scopes.length;
+  const totalObservations = scopes.reduce((n, s) => n + s.count, 0);
+  const reclassified = [];
+  const breakdown = {
+    allVolatileScopes: 0,
+    allVolatileObservations: 0,
+    mixedScopes: 0,
+    mixedObservations: 0,
+    staleScopes: 0,
+    staleObservations: 0
+  };
+  const targets = new Map;
+  for (const s of scopes) {
+    const volatileTags = s.tags.filter((t) => matchesAny(t, volatilePatterns));
+    const staleTags = s.tags.filter((t) => matchesAny(t, stalePatterns));
+    const stripped = s.tags.filter((t) => {
+      if (matchesAny(t, volatilePatterns))
+        return false;
+      if (retireStale && matchesAny(t, stalePatterns))
+        return false;
+      return true;
+    });
+    const toKey = scopeKey(stripped);
+    const changed = scopeKey(s.tags) !== toKey;
+    const hasStable = s.tags.some((t) => !matchesAny(t, volatilePatterns) && !matchesAny(t, stalePatterns));
+    if (staleTags.length > 0) {
+      breakdown.staleScopes += 1;
+      breakdown.staleObservations += s.count;
+    }
+    if (volatileTags.length > 0 && !hasStable && staleTags.length === 0) {
+      breakdown.allVolatileScopes += 1;
+      breakdown.allVolatileObservations += s.count;
+    } else if (volatileTags.length > 0 && hasStable) {
+      breakdown.mixedScopes += 1;
+      breakdown.mixedObservations += s.count;
+    }
+    const entry = targets.get(toKey) ?? { sources: 0, observations: 0, changed: false };
+    entry.sources += 1;
+    entry.observations += s.count;
+    entry.changed = entry.changed || changed;
+    targets.set(toKey, entry);
+    if (changed) {
+      reclassified.push({
+        from: s.tags,
+        to: toKey,
+        count: s.count,
+        strippedVolatile: volatileTags,
+        strippedStale: retireStale ? staleTags : []
+      });
+    }
+  }
+  reclassified.sort((a, b) => b.count - a.count);
+  const merges = [...targets.entries()].filter(([, v]) => v.sources > 1 && v.changed).map(([target, v]) => ({ target, sourceScopes: v.sources, observations: v.observations })).sort((a, b) => b.observations - a.observations);
+  const affectedObservations = reclassified.reduce((n, r) => n + r.count, 0);
+  const resultingScopeCount = targets.size;
+  return {
+    bankId,
+    ok: true,
+    totalScopes,
+    totalObservations,
+    reclassified,
+    merges,
+    affectedScopes: reclassified.length,
+    affectedObservations,
+    resultingScopeCount,
+    scopeReduction: totalScopes - resultingScopeCount,
+    breakdown
+  };
+}
+async function getJson2(url, opts) {
+  const fetchImpl = opts?.fetchImpl ?? fetch;
+  const timeoutMs = opts?.timeoutMs ?? 15000;
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetchImpl(url, { signal: controller.signal });
+    clearTimeout(timeout);
+    if (!resp.ok)
+      return { ok: false, reason: `HTTP ${resp.status}` };
+    return { ok: true, data: await resp.json() };
+  } catch (err) {
+    clearTimeout(timeout);
+    if (err.name === "AbortError")
+      return { ok: false, reason: "Timeout" };
+    return { ok: false, reason: String(err.message ?? err) };
+  }
+}
+async function planBankCleanup(apiUrl, bankId, options = {}, fetchOpts) {
+  const base = hindsightRestBase(apiUrl);
+  const bank = encodeURIComponent(bankId);
+  const resp = await getJson2(`${base}/v1/default/banks/${bank}/observations/scopes`, fetchOpts);
+  if (!resp.ok) {
+    return {
+      bankId,
+      ok: false,
+      reason: resp.reason,
+      totalScopes: 0,
+      totalObservations: 0,
+      reclassified: [],
+      merges: [],
+      affectedScopes: 0,
+      affectedObservations: 0,
+      resultingScopeCount: 0,
+      scopeReduction: 0,
+      breakdown: {
+        allVolatileScopes: 0,
+        allVolatileObservations: 0,
+        mixedScopes: 0,
+        mixedObservations: 0,
+        staleScopes: 0,
+        staleObservations: 0
+      }
+    };
+  }
+  const raw = resp.data?.scopes;
+  const scopes = [];
+  if (Array.isArray(raw)) {
+    for (const entry of raw) {
+      const tags = entry?.tags;
+      const count = entry?.count;
+      if (!Array.isArray(tags) || typeof count !== "number")
+        continue;
+      if (!tags.every((t) => typeof t === "string"))
+        continue;
+      scopes.push({ tags, count });
+    }
+  }
+  return planScopeCleanup(bankId, scopes, options);
+}
+function formatCleanupPlan(plan, maxMerges = 10) {
+  if (!plan.ok) {
+    return `bank ${plan.bankId}: UNREADABLE (${plan.reason ?? "unknown"})`;
+  }
+  const b = plan.breakdown;
+  const lines = [];
+  lines.push(`bank ${plan.bankId}`);
+  lines.push(`  today: ${plan.totalScopes} scopes, ${plan.totalObservations.toLocaleString()} observations`);
+  lines.push(`  legacy fragmentation:` + ` all-volatile ${b.allVolatileScopes} scopes / ${b.allVolatileObservations.toLocaleString()} obs;` + ` mixed ${b.mixedScopes} scopes / ${b.mixedObservations.toLocaleString()} obs;` + ` stale agent-<hex> ${b.staleScopes} scopes / ${b.staleObservations.toLocaleString()} obs`);
+  lines.push(`  WOULD change: ${plan.affectedScopes} scopes` + ` (${plan.affectedObservations.toLocaleString()} obs re-homed),` + ` ${plan.totalScopes} \u2192 ${plan.resultingScopeCount} scopes` + ` (\u2212${plan.scopeReduction})`);
+  if (plan.merges.length > 0) {
+    lines.push(`  top merges:`);
+    for (const m of plan.merges.slice(0, maxMerges)) {
+      lines.push(`    ${m.sourceScopes} scopes \u2192 ${m.target}  (${m.observations.toLocaleString()} obs)`);
+    }
+    if (plan.merges.length > maxMerges) {
+      lines.push(`    +${plan.merges.length - maxMerges} more merge targets`);
+    }
+  }
+  return lines.join(`
+`);
+}
+
+// telegram-plugin/secret-detect/patterns.ts
+var ANCHORED_PATTERNS = [
+  { rule_id: "anthropic_api_key", regex: /\b(sk-ant-[A-Za-z0-9_-]{8,})\b/g, captureIndex: 1, slugHint: "anthropic_api_key" },
+  { rule_id: "anthropic_oauth_code", regex: /(?:^|\s)([A-Za-z0-9_-]{20,}#[A-Za-z0-9_-]{20,})(?=\s|$)/gm, captureIndex: 1, slugHint: "anthropic_oauth_code" },
+  { rule_id: "openai_api_key", regex: /\b(sk-[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "openai_api_key" },
+  { rule_id: "github_pat_classic", regex: /\b(ghp_[A-Za-z0-9]{20,})\b/g, captureIndex: 1, slugHint: "github_pat" },
+  { rule_id: "github_pat_fine_grained", regex: /\b(github_pat_[A-Za-z0-9_]{20,})\b/g, captureIndex: 1, slugHint: "github_pat" },
+  { rule_id: "slack_token", regex: /\b(xox[baprs]-[A-Za-z0-9-]{10,})\b/g, captureIndex: 1, slugHint: "slack_token" },
+  { rule_id: "slack_app_token", regex: /\b(xapp-[A-Za-z0-9-]{10,})\b/g, captureIndex: 1, slugHint: "slack_app_token" },
+  { rule_id: "groq_api_key", regex: /\b(gsk_[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "groq_api_key" },
+  { rule_id: "google_api_key", regex: /\b(AIza[0-9A-Za-z\-_]{20,})\b/g, captureIndex: 1, slugHint: "google_api_key" },
+  { rule_id: "perplexity_api_key", regex: /\b(pplx-[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "perplexity_api_key" },
+  { rule_id: "npm_token", regex: /\b(npm_[A-Za-z0-9]{10,})\b/g, captureIndex: 1, slugHint: "npm_token" },
+  { rule_id: "telegram_bot_token_prefixed", regex: /\bbot(\d{6,}:[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "telegram_bot_token" },
+  { rule_id: "telegram_bot_token", regex: /\b(\d{6,}:[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "telegram_bot_token" },
+  { rule_id: "laravel_sanctum_token", regex: /\b(\d+\|[A-Za-z0-9]{40,})\b/g, captureIndex: 1, slugHint: "api_token" },
+  { rule_id: "aws_access_key", regex: /\b(AKIA[0-9A-Z]{16})\b/g, captureIndex: 1, slugHint: "aws_access_key" },
+  { rule_id: "jwt", regex: /\b(eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "jwt" }
+];
+var STRUCTURED_PATTERNS = [
+  {
+    rule_id: "env_key_value",
+    regex: /\b([A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD))\b\s*[=:]\s*(["']?)([^\s"'\\]+)\2/g,
+    captureIndex: 3,
+    slugHint: "env"
+  },
+  {
+    rule_id: "json_secret_field",
+    regex: /"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken)"\s*:\s*"([^"]+)"/g,
+    captureIndex: 1,
+    slugHint: "json_secret"
+  },
+  {
+    rule_id: "cli_flag",
+    regex: /--(?:api[-_]?key|hook[-_]?token|token|secret|password|passwd)\s+(["']?)([^\s"']+)\1/g,
+    captureIndex: 2,
+    slugHint: "cli_flag"
+  },
+  {
+    rule_id: "bearer_auth_header",
+    regex: /Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)/gi,
+    captureIndex: 1,
+    slugHint: "bearer_token"
+  },
+  {
+    rule_id: "bearer_loose",
+    regex: /\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b/gi,
+    captureIndex: 1,
+    slugHint: "bearer_token"
+  },
+  {
+    rule_id: "basic_auth_header",
+    regex: /Authorization\s*[:=]\s*Basic\s+([A-Za-z0-9+/=]{8,})/gi,
+    captureIndex: 1,
+    slugHint: "basic_auth"
+  },
+  {
+    rule_id: "pem_private_key",
+    regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----/g,
+    captureIndex: 0,
+    slugHint: "pem_private_key"
+  }
+];
+var PROVIDER_PATTERNS = [
+  { rule_id: "slack_webhook", regex: /(https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9_/]+)/g, captureIndex: 1, slugHint: "slack_webhook" },
+  { rule_id: "stripe_live_secret", regex: /\b(sk_live_[A-Za-z0-9]{24,})\b/g, captureIndex: 1, slugHint: "stripe_key" },
+  { rule_id: "stripe_restricted", regex: /\b(rk_live_[A-Za-z0-9]{24,})\b/g, captureIndex: 1, slugHint: "stripe_key" },
+  { rule_id: "sendgrid_api_key", regex: /\b(SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43})\b/g, captureIndex: 1, slugHint: "sendgrid_key" },
+  { rule_id: "gitlab_pat", regex: /\b(glpat-[A-Za-z0-9_-]{20})\b/g, captureIndex: 1, slugHint: "gitlab_pat" },
+  { rule_id: "huggingface_token", regex: /\b(hf_[A-Za-z0-9]{34,})\b/g, captureIndex: 1, slugHint: "huggingface_token" },
+  { rule_id: "twilio_api_key", regex: /\b(SK[0-9a-f]{32})\b/g, captureIndex: 1, slugHint: "twilio_api_key" },
+  { rule_id: "mailgun_key", regex: /\b(key-[0-9a-f]{32})\b/g, captureIndex: 1, slugHint: "mailgun_key" },
+  { rule_id: "digitalocean_pat", regex: /\b(dop_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
+  { rule_id: "digitalocean_oauth", regex: /\b(doo_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
+  { rule_id: "digitalocean_refresh", regex: /\b(dor_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
+  { rule_id: "doppler_token", regex: /\b(dp\.(?:pt|st|ct|sa|scim|audit)\.[A-Za-z0-9]{40,44})\b/g, captureIndex: 1, slugHint: "doppler_token" },
+  { rule_id: "linear_api_key", regex: /\b(lin_api_[A-Za-z0-9]{40})\b/g, captureIndex: 1, slugHint: "linear_api_key" },
+  { rule_id: "shopify_access_token", regex: /\b(shpat_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
+  { rule_id: "shopify_shared_secret", regex: /\b(shpss_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
+  { rule_id: "shopify_private_app", regex: /\b(shppa_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
+  { rule_id: "square_access_token", regex: /\b(sq0atp-[A-Za-z0-9_-]{22})\b/g, captureIndex: 1, slugHint: "square_token" },
+  { rule_id: "square_oauth_secret", regex: /\b(sq0csp-[A-Za-z0-9_-]{43})\b/g, captureIndex: 1, slugHint: "square_token" },
+  { rule_id: "newrelic_key", regex: /\b(NRAK-[A-Z0-9]{27})\b/g, captureIndex: 1, slugHint: "newrelic_key" },
+  { rule_id: "notion_token", regex: /\b(ntn_[A-Za-z0-9]{46})\b/g, captureIndex: 1, slugHint: "notion_token" },
+  { rule_id: "planetscale_password", regex: /\b(pscale_pw_[A-Za-z0-9_.-]{43})\b/g, captureIndex: 1, slugHint: "planetscale_token" },
+  { rule_id: "planetscale_token", regex: /\b(pscale_tkn_[A-Za-z0-9_.-]{43})\b/g, captureIndex: 1, slugHint: "planetscale_token" },
+  { rule_id: "supabase_service_key", regex: /\b(sbp_[a-f0-9]{40})\b/g, captureIndex: 1, slugHint: "supabase_key" },
+  { rule_id: "atlassian_token", regex: /\b(ATATT[A-Za-z0-9_\-=]{20,})\b/g, captureIndex: 1, slugHint: "atlassian_token" },
+  { rule_id: "dropbox_token", regex: /\b(sl\.[A-Za-z0-9_-]{130,})/g, captureIndex: 1, slugHint: "dropbox_token" },
+  { rule_id: "databricks_token", regex: /\b(dapi[a-f0-9]{32})\b/g, captureIndex: 1, slugHint: "databricks_token" },
+  { rule_id: "grafana_service_account", regex: /\b(glsa_[A-Za-z0-9]{32}_[a-fA-F0-9]{8})\b/g, captureIndex: 1, slugHint: "grafana_token" },
+  { rule_id: "pypi_token", regex: /\b(pypi-AgEIcHlwaS[A-Za-z0-9_-]{50,})/g, captureIndex: 1, slugHint: "pypi_token" },
+  { rule_id: "aws_temp_access_key", regex: /\b(ASIA[0-9A-Z]{16})\b/g, captureIndex: 1, slugHint: "aws_access_key" },
+  { rule_id: "gcp_oauth_token", regex: /\b(ya29\.[A-Za-z0-9_-]{30,})/g, captureIndex: 1, slugHint: "gcp_oauth_token" }
+];
+var ALL_PATTERNS = [...ANCHORED_PATTERNS, ...PROVIDER_PATTERNS, ...STRUCTURED_PATTERNS];
+
+// telegram-plugin/secret-detect/entropy.ts
+function shannonEntropy(s) {
+  if (s.length === 0)
+    return 0;
+  const counts = new Map;
+  for (const ch of s) {
+    counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  }
+  let h = 0;
+  const len = s.length;
+  for (const c of counts.values()) {
+    const p = c / len;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
+
+// telegram-plugin/secret-detect/inert-values.ts
+var INERT_VALUE_RE = [
+  /^\[REDACTED(?::[A-Za-z0-9_]+)?\]$/i,
+  /^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/,
+  /^\{\{[^\n\r\u2028\u2029]*\}\}$/,
+  /^<[^<>\n\r\u2028\u2029]*>$/,
+  /^%[A-Za-z_][A-Za-z0-9_]*%$/,
+  /^vault:[A-Za-z0-9_./-]*$/i,
+  /^[*x\u2022.]+$/i,
+  /^(?:process\.env|import\.meta\.env|os\.environ)(?:\.[A-Za-z_$][A-Za-z0-9_$]*|\[["']?[A-Za-z_$][A-Za-z0-9_$]*["']?\])*$/,
+  /^(?:changeme|change-me|replaceme|replace-me|placeholder|todo|tbd|yourkey|your-key|yourpassword|your-password|yoursecret|your-secret|yourtoken|your-token)(?:[-_][A-Za-z0-9-]+)?$/i,
+  /^[a-z]+(?: [a-z]+){2,}$/
+];
+var CREDENTIAL_RUN_RE = /[A-Za-z0-9]{12,}/g;
+var MIXED_CLASS_RUN_MIN = 12;
+var SINGLE_CLASS_RUN_MIN = 16;
+function runIsCredentialShaped(run) {
+  let classes = 0;
+  if (/[a-z]/.test(run))
+    classes++;
+  if (/[A-Z]/.test(run))
+    classes++;
+  if (/[0-9]/.test(run))
+    classes++;
+  return run.length >= (classes >= 2 ? MIXED_CLASS_RUN_MIN : SINGLE_CLASS_RUN_MIN);
+}
+function hasCredentialShapedRun(value) {
+  for (const run of value.match(CREDENTIAL_RUN_RE) ?? []) {
+    if (runIsCredentialShaped(run))
+      return true;
+  }
+  return false;
+}
+function isInertValue(value) {
+  if (!INERT_VALUE_RE.some((re) => re.test(value)))
+    return false;
+  return !hasCredentialShapedRun(value);
+}
+var INERT_GATED_RULES = new Set([
+  "env_key_value",
+  "json_secret_field",
+  "cli_flag"
+]);
+var TRAILING_PUNCT_RE = /[.,;:!?)\]}]+$/;
+function stripTrailingPunctuation(value) {
+  return value.replace(TRAILING_PUNCT_RE, "");
+}
+
+// telegram-plugin/secret-detect/kv-scanner.ts
+var KV_RE = /\b([A-Za-z_][A-Za-z0-9_-]*(?:password|passwd|token|secret|key|api[_-]?key))\s*[:=]\s*["']?([^\s"'\\]{8,})["']?/gi;
+var KV_ENTROPY_THRESHOLD = 4;
+var MEMORABLE_PW_RE = /\b([A-Za-z0-9_-]*(?:password|passwd|passphrase|pwd))\b\s*(?:[:=]\s*|\s+is\s+)(["']?)([^\s"']{8,64})\2/gi;
+var MEMORABLE_PW_RULE_ID = "memorable_password";
+var MEMORABLE_PW_MIN_CLASSES = 2;
+function charClassCount(value) {
+  let n = 0;
+  if (/[a-z]/.test(value))
+    n++;
+  if (/[A-Z]/.test(value))
+    n++;
+  if (/[0-9]/.test(value))
+    n++;
+  if (/[^A-Za-z0-9]/.test(value))
+    n++;
+  return n;
+}
+function looksLikeMemorablePassword(value) {
+  if (isInertValue(value))
+    return false;
+  const core = stripTrailingPunctuation(value);
+  if (core.length < 8 || core.length > 64)
+    return false;
+  if (isInertValue(core))
+    return false;
+  if (new Set(core).size < 4)
+    return false;
+  return charClassCount(core) >= MEMORABLE_PW_MIN_CLASSES;
+}
+function scanMemorablePasswords(text) {
+  const hits = [];
+  MEMORABLE_PW_RE.lastIndex = 0;
+  let m;
+  while ((m = MEMORABLE_PW_RE.exec(text)) !== null) {
+    const keyName = m[1];
+    const value = m[3];
+    if (!value || !looksLikeMemorablePassword(value))
+      continue;
+    const valueOffsetInMatch = m[0].indexOf(value, keyName.length);
+    if (valueOffsetInMatch < 0)
+      continue;
+    const start = m.index + valueOffsetInMatch;
+    hits.push({
+      rule_id: MEMORABLE_PW_RULE_ID,
+      start,
+      end: start + value.length,
+      matched_text: value,
+      key_name: keyName,
+      confidence: "ambiguous"
+    });
+  }
+  return hits;
+}
+function scanKeyValue(text) {
+  const hits = [];
+  KV_RE.lastIndex = 0;
+  let m;
+  while ((m = KV_RE.exec(text)) !== null) {
+    const [, keyName, value] = m;
+    if (!value)
+      continue;
+    if (isInertValue(value))
+      continue;
+    const h = shannonEntropy(value);
+    if (h < KV_ENTROPY_THRESHOLD)
+      continue;
+    const valueOffsetInMatch = m[0].indexOf(value, keyName.length);
+    if (valueOffsetInMatch < 0)
+      continue;
+    const start = m.index + valueOffsetInMatch;
+    const end = start + value.length;
+    hits.push({
+      rule_id: "kv_entropy",
+      start,
+      end,
+      matched_text: value,
+      key_name: keyName,
+      confidence: "ambiguous"
+    });
+  }
+  return hits;
+}
+
+// telegram-plugin/secret-detect/db-uri.ts
+var DB_URI_RE = /\b([a-zA-Z][a-zA-Z0-9+.-]+):\/\/([^\s:/@]+):([^\s/?#]+)@([^\s/@?#]+)/g;
+var DB_URI_RULE_ID = "db_uri_password";
+function isInertPassword(value) {
+  if (value.startsWith("[REDACTED"))
+    return true;
+  return /^[*x]+$/i.test(value);
+}
+function scanDbUris(text) {
+  const hits = [];
+  DB_URI_RE.lastIndex = 0;
+  let m;
+  while ((m = DB_URI_RE.exec(text)) !== null) {
+    const scheme = m[1];
+    const user = m[2];
+    const password = m[3];
+    if (isInertPassword(password))
+      continue;
+    const start = m.index + scheme.length + 3 + user.length + 1;
+    hits.push({
+      rule_id: DB_URI_RULE_ID,
+      start,
+      end: start + password.length,
+      matched_text: password,
+      key_name: `${scheme}_password`,
+      confidence: "ambiguous"
+    });
+  }
+  return hits;
+}
+
+// telegram-plugin/secret-detect/generic-entropy.ts
+var CANDIDATE_RE = /[A-Za-z0-9]{28,}/g;
+var GENERIC_MIN_DISTINCT = 18;
+var MAX_GENERIC_HITS = 20;
+function hasDistinctChars(tok, n) {
+  const seen = new Uint8Array(128);
+  let distinct = 0;
+  for (let i = 0;i < tok.length; i++) {
+    const c = tok.charCodeAt(i);
+    if (seen[c] === 0) {
+      seen[c] = 1;
+      if (++distinct >= n)
+        return true;
+    }
+  }
+  return false;
 }
-function printLinearInstructions(opts, vaultKey) {
-  const base = opts.webhookBase ?? "https://<your-switchroom-web-host>";
-  const webhookUrl = `${base.replace(/\/$/, "")}/webhook/${opts.agent}/linear`;
-  console.log("");
-  console.log(source_default.bold("Next steps in Linear (browser, one-time per agent):"));
-  console.log(source_default.gray("  1. Create / open your Linear OAuth app with actor=app and scopes"));
-  console.log(source_default.gray("     app:mentionable + app:assignable (https://linear.app/developers/agents)."));
-  if (opts.clientId) {
-    const redirect = opts.redirectUri ?? `${base.replace(/\/$/, "")}/oauth/callback`;
-    const authorizeUrl = `https://linear.app/oauth/authorize?` + `client_id=${encodeURIComponent(opts.clientId)}` + `&redirect_uri=${encodeURIComponent(redirect)}` + `&response_type=code` + `&scope=${encodeURIComponent("read,write,app:assignable,app:mentionable")}` + `&actor=app`;
-    console.log(source_default.gray("  2. Authorize the app as an actor (open in a browser):"));
-    console.log(source_default.cyan(`     ${authorizeUrl}`));
-    console.log(source_default.gray("     The redirect delivers the app token you pass to this verb via --token."));
-  } else {
-    console.log(source_default.gray("  2. Authorize the app (actor=app) in a browser; capture the app token and"));
-    console.log(source_default.gray("     re-run this verb with --token (and optionally --client-id to print the"));
-    console.log(source_default.gray("     authorize URL)."));
+function hasDigit(tok) {
+  for (let i = 0;i < tok.length; i++) {
+    const c = tok.charCodeAt(i);
+    if (c >= 48 && c <= 57)
+      return true;
   }
-  console.log(source_default.gray("  3. Register this webhook URL on the app (AgentSessionEvent + Issue/Comment):"));
-  console.log(source_default.cyan(`     ${webhookUrl}`));
-  console.log(source_default.gray("     Use Linear's signing secret as the webhook secret \u2014 store it in the vault " + `under webhook/${opts.agent}/linear (e.g. 'switchroom telegram enable webhook ` + `--agent ${opts.agent} --source linear --secret <signing-secret>').`));
-  console.log("");
-  console.log(source_default.gray(`  Token is read at runtime from vault:${vaultKey} (actor=app).`));
+  return false;
 }
-function makeUnifiedDiff2(before, after) {
-  const a = before.split(`
-`);
-  const b = after.split(`
-`);
-  const out = [];
-  let i = 0, j = 0;
-  while (i < a.length || j < b.length) {
-    if (i < a.length && j < b.length && a[i] === b[j]) {
-      out.push(`  ${a[i]}`);
-      i++;
-      j++;
-    } else if (j < b.length && (i >= a.length || a[i] !== b[j])) {
-      out.push(source_default.green(`+ ${b[j]}`));
-      j++;
-    } else {
-      out.push(source_default.red(`- ${a[i]}`));
-      i++;
-    }
+function scanGenericSecrets(text) {
+  const hits = [];
+  CANDIDATE_RE.lastIndex = 0;
+  let m;
+  while ((m = CANDIDATE_RE.exec(text)) !== null) {
+    if (hits.length >= MAX_GENERIC_HITS)
+      break;
+    const tok = m[0];
+    if (!hasDigit(tok))
+      continue;
+    if (!hasDistinctChars(tok, GENERIC_MIN_DISTINCT))
+      continue;
+    hits.push({
+      rule_id: "generic_high_entropy",
+      start: m.index,
+      end: m.index + tok.length,
+      matched_text: tok,
+      confidence: "ambiguous"
+    });
   }
-  return out.join(`
-`);
+  return hits;
 }
-function fail3(msg) {
-  console.error(source_default.red(`Error: ${msg}`));
-  process.exit(1);
+
+// telegram-plugin/secret-detect/chunker.ts
+var CHUNK_THRESHOLD = 32 * 1024;
+var WINDOW_SIZE = 16 * 1024;
+var OVERLAP = 8 * 1024;
+function chunk(text) {
+  if (text.length <= CHUNK_THRESHOLD) {
+    return [{ offset: 0, text }];
+  }
+  const out = [];
+  let offset = 0;
+  while (offset < text.length) {
+    const end = Math.min(offset + WINDOW_SIZE, text.length);
+    out.push({ offset, text: text.slice(offset, end) });
+    if (end >= text.length)
+      break;
+    offset = end - OVERLAP;
+  }
+  return out;
 }
 
-// src/cli/memory.ts
-init_source();
-init_hindsight2();
+// telegram-plugin/secret-detect/suppressor.ts
+var MARKERS = ["test", "mock", "example", "fixture", "dummy"];
+var WINDOW = 40;
+var MARKER_RE = new RegExp(`\\b(?:${MARKERS.join("|")})\\b`, "i");
+function isSuppressed(text, start, end) {
+  const left = Math.max(0, start - WINDOW);
+  const right = Math.min(text.length, end + WINDOW);
+  const context = text.slice(left, start) + text.slice(end, right);
+  return MARKER_RE.test(context);
+}
 
-// src/memory/search.ts
-init_hindsight2();
-function shellQuote2(s) {
-  return "'" + s.replace(/'/g, `'"'"'`) + "'";
+// telegram-plugin/secret-detect/slug.ts
+function sanitizeKeyName(raw) {
+  const up = raw.toUpperCase();
+  const cleaned = up.replace(/[^A-Z0-9_]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
+  return cleaned.length > 0 ? cleaned : "SECRET";
 }
-function searchMemory(query, collection) {
-  return `hindsight recall --collection ${shellQuote2(collection)} --query ${shellQuote2(query)}`;
+function datePart(now = new Date) {
+  const y = now.getUTCFullYear();
+  const m = String(now.getUTCMonth() + 1).padStart(2, "0");
+  const d = String(now.getUTCDate()).padStart(2, "0");
+  return `${y}${m}${d}`;
 }
-function getMemoryStats(collection) {
-  return `hindsight stats --collection ${shellQuote2(collection)}`;
+function deriveSlug(inputs, existing) {
+  let base;
+  if (inputs.key_name && inputs.key_name.trim().length > 0) {
+    base = sanitizeKeyName(inputs.key_name);
+  } else {
+    base = `${inputs.rule_id}_${datePart(inputs.now)}`;
+  }
+  if (!existing.has(base))
+    return base;
+  let n = 2;
+  while (existing.has(`${base}_${n}`))
+    n++;
+  return `${base}_${n}`;
 }
-function reflectAcrossAgents(config) {
-  const eligible = [];
-  const excluded = [];
-  for (const agentName of Object.keys(config.agents)) {
-    const collection = getCollectionForAgent(agentName, config);
-    if (isStrictIsolation(agentName, config)) {
-      excluded.push({ agent: agentName, collection });
-    } else {
-      eligible.push({ agent: agentName, collection });
+// telegram-plugin/secret-detect/url-redact.ts
+var SENSITIVE_PARAMS = new Set([
+  "token",
+  "key",
+  "api_key",
+  "apikey",
+  "secret",
+  "access_token",
+  "password",
+  "pass",
+  "auth",
+  "client_secret",
+  "refresh_token",
+  "signature"
+]);
+var URL_RE = /\b(?:https?|wss?|ftp):\/\/[^\s<>"']+/gi;
+function redactUrls(text) {
+  return text.replace(URL_RE, (m) => {
+    const redacted = redactOne(m);
+    return redacted ?? m;
+  });
+}
+function redactOne(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return null;
+  }
+  let changed = false;
+  if (u.username || u.password) {
+    u.username = "***";
+    u.password = "";
+    changed = true;
+  }
+  for (const [key] of u.searchParams) {
+    if (SENSITIVE_PARAMS.has(key.toLowerCase())) {
+      u.searchParams.set(key, "***");
+      changed = true;
     }
   }
-  const commands = eligible.map(({ collection }) => `hindsight reflect --collection ${shellQuote2(collection)}`);
-  return { eligible, excluded, commands };
+  return changed ? u.toString() : null;
 }
 
-// src/memory/observation-scope-cleanup.ts
-var CLEANUP_VOLATILE_PATTERNS = [
-  /^parent_session:/,
-  /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}(-sub-.+)?$/
-];
-var CLEANUP_STALE_PATTERNS = [/^agent-[0-9a-f]{8,}$/];
-function matchesAny(tag, patterns) {
-  return patterns.some((p) => p.test(tag));
-}
-function scopeKey(tags) {
-  return tags.length === 0 ? "shared" : [...tags].sort().join(",");
-}
-function planScopeCleanup(bankId, scopes, options = {}) {
-  const volatilePatterns = options.volatilePatterns ?? CLEANUP_VOLATILE_PATTERNS;
-  const stalePatterns = options.stalePatterns ?? CLEANUP_STALE_PATTERNS;
-  const retireStale = options.retireStale ?? false;
-  const totalScopes = scopes.length;
-  const totalObservations = scopes.reduce((n, s) => n + s.count, 0);
-  const reclassified = [];
-  const breakdown = {
-    allVolatileScopes: 0,
-    allVolatileObservations: 0,
-    mixedScopes: 0,
-    mixedObservations: 0,
-    staleScopes: 0,
-    staleObservations: 0
-  };
-  const targets = new Map;
-  for (const s of scopes) {
-    const volatileTags = s.tags.filter((t) => matchesAny(t, volatilePatterns));
-    const staleTags = s.tags.filter((t) => matchesAny(t, stalePatterns));
-    const stripped = s.tags.filter((t) => {
-      if (matchesAny(t, volatilePatterns))
-        return false;
-      if (retireStale && matchesAny(t, stalePatterns))
-        return false;
-      return true;
-    });
-    const toKey = scopeKey(stripped);
-    const changed = scopeKey(s.tags) !== toKey;
-    const hasStable = s.tags.some((t) => !matchesAny(t, volatilePatterns) && !matchesAny(t, stalePatterns));
-    if (staleTags.length > 0) {
-      breakdown.staleScopes += 1;
-      breakdown.staleObservations += s.count;
+// telegram-plugin/secret-detect/index.ts
+function detectSecrets(text) {
+  if (!text || text.length === 0)
+    return [];
+  const windows = chunk(text);
+  const raw = [];
+  for (const win of windows) {
+    for (const p of ALL_PATTERNS) {
+      const re = new RegExp(p.regex.source, p.regex.flags.includes("g") ? p.regex.flags : p.regex.flags + "g");
+      let m;
+      while ((m = re.exec(win.text)) !== null) {
+        if (m[0].length === 0) {
+          re.lastIndex++;
+          continue;
+        }
+        const cap = p.captureIndex === 0 ? m[0] : m[p.captureIndex];
+        if (!cap)
+          continue;
+        const matchStart = p.captureIndex === 0 ? m.index : m.index + m[0].indexOf(cap);
+        if (matchStart < 0)
+          continue;
+        const globalStart = win.offset + matchStart;
+        const globalEnd = globalStart + cap.length;
+        const keyName = p.rule_id === "env_key_value" ? m[1] : undefined;
+        if (INERT_GATED_RULES.has(p.rule_id) && isInertValue(cap))
+          continue;
+        if (p.rule_id === "env_key_value") {
+          const ENV_KV_MIN_LEN = 12;
+          const ENV_KV_MIN_ENTROPY = 3.5;
+          if (cap.length < ENV_KV_MIN_LEN)
+            continue;
+          if (shannonEntropy(cap) < ENV_KV_MIN_ENTROPY)
+            continue;
+        }
+        raw.push({
+          rule_id: p.rule_id,
+          start: globalStart,
+          end: globalEnd,
+          matched_text: cap,
+          key_name: keyName,
+          confidence: "high"
+        });
+      }
     }
-    if (volatileTags.length > 0 && !hasStable && staleTags.length === 0) {
-      breakdown.allVolatileScopes += 1;
-      breakdown.allVolatileObservations += s.count;
-    } else if (volatileTags.length > 0 && hasStable) {
-      breakdown.mixedScopes += 1;
-      breakdown.mixedObservations += s.count;
+    const kvHits = scanKeyValue(win.text);
+    for (const h of kvHits) {
+      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
     }
-    const entry = targets.get(toKey) ?? { sources: 0, observations: 0, changed: false };
-    entry.sources += 1;
-    entry.observations += s.count;
-    entry.changed = entry.changed || changed;
-    targets.set(toKey, entry);
-    if (changed) {
-      reclassified.push({
-        from: s.tags,
-        to: toKey,
-        count: s.count,
-        strippedVolatile: volatileTags,
-        strippedStale: retireStale ? staleTags : []
-      });
+    for (const h of scanDbUris(win.text)) {
+      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
+    }
+    for (const h of scanMemorablePasswords(win.text)) {
+      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
+    }
+    const genHits = scanGenericSecrets(win.text);
+    for (const h of genHits) {
+      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
     }
   }
-  reclassified.sort((a, b) => b.count - a.count);
-  const merges = [...targets.entries()].filter(([, v]) => v.sources > 1 && v.changed).map(([target, v]) => ({ target, sourceScopes: v.sources, observations: v.observations })).sort((a, b) => b.observations - a.observations);
-  const affectedObservations = reclassified.reduce((n, r) => n + r.count, 0);
-  const resultingScopeCount = targets.size;
-  return {
-    bankId,
-    ok: true,
-    totalScopes,
-    totalObservations,
-    reclassified,
-    merges,
-    affectedScopes: reclassified.length,
-    affectedObservations,
-    resultingScopeCount,
-    scopeReduction: totalScopes - resultingScopeCount,
-    breakdown
-  };
+  const deduped = dedupeRaw(raw);
+  const final = dropOverlaps(deduped);
+  const existing = new Set;
+  const out = [];
+  for (const h of final) {
+    const suggested_slug = deriveSlug({ key_name: h.key_name, rule_id: h.rule_id }, existing);
+    existing.add(suggested_slug);
+    out.push({
+      rule_id: h.rule_id,
+      matched_text: h.matched_text,
+      start: h.start,
+      end: h.end,
+      confidence: h.confidence,
+      suppressed: isSuppressed(text, h.start, h.end),
+      suggested_slug,
+      key_name: h.key_name
+    });
+  }
+  out.sort((a, b) => a.start - b.start);
+  return out;
 }
-async function getJson2(url, opts) {
-  const fetchImpl = opts?.fetchImpl ?? fetch;
-  const timeoutMs = opts?.timeoutMs ?? 15000;
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const resp = await fetchImpl(url, { signal: controller.signal });
-    clearTimeout(timeout);
-    if (!resp.ok)
-      return { ok: false, reason: `HTTP ${resp.status}` };
-    return { ok: true, data: await resp.json() };
-  } catch (err) {
-    clearTimeout(timeout);
-    if (err.name === "AbortError")
-      return { ok: false, reason: "Timeout" };
-    return { ok: false, reason: String(err.message ?? err) };
+function dedupeRaw(raw) {
+  const seen = new Map;
+  for (const h of raw) {
+    const key = `${h.start}:${h.end}`;
+    const existing = seen.get(key);
+    if (!existing) {
+      seen.set(key, h);
+      continue;
+    }
+    if (existing.confidence === "ambiguous" && h.confidence === "high") {
+      seen.set(key, h);
+    }
   }
+  return Array.from(seen.values());
 }
-async function planBankCleanup(apiUrl, bankId, options = {}, fetchOpts) {
-  const base = hindsightRestBase(apiUrl);
-  const bank = encodeURIComponent(bankId);
-  const resp = await getJson2(`${base}/v1/default/banks/${bank}/observations/scopes`, fetchOpts);
-  if (!resp.ok) {
-    return {
-      bankId,
-      ok: false,
-      reason: resp.reason,
-      totalScopes: 0,
-      totalObservations: 0,
-      reclassified: [],
-      merges: [],
-      affectedScopes: 0,
-      affectedObservations: 0,
-      resultingScopeCount: 0,
-      scopeReduction: 0,
-      breakdown: {
-        allVolatileScopes: 0,
-        allVolatileObservations: 0,
-        mixedScopes: 0,
-        mixedObservations: 0,
-        staleScopes: 0,
-        staleObservations: 0
-      }
-    };
+function dropOverlaps(hits) {
+  const out = hits.filter((h) => !(h.confidence === "ambiguous" && hits.some((o) => o !== h && o.start <= h.start && o.end >= h.end && !(o.start === h.start && o.end === h.end))));
+  out.sort((a, b) => a.start - b.start || a.end - b.end);
+  return out;
+}
+
+// telegram-plugin/secret-detect/redact.ts
+var REDACTED_MARKER = "[REDACTED]";
+function redact(text) {
+  if (!text || text.length === 0)
+    return text;
+  const urlScrubbed = redactUrls(text);
+  const hits = detectSecrets(urlScrubbed).filter((h) => h.rule_id !== "generic_high_entropy");
+  if (hits.length === 0)
+    return urlScrubbed;
+  const sorted = [...hits].sort((a, b) => b.start - a.start);
+  let out = urlScrubbed;
+  for (const h of sorted) {
+    out = out.slice(0, h.start) + redactedMarker(h.rule_id) + out.slice(h.end);
   }
-  const raw = resp.data?.scopes;
-  const scopes = [];
-  if (Array.isArray(raw)) {
-    for (const entry of raw) {
-      const tags = entry?.tags;
-      const count = entry?.count;
-      if (!Array.isArray(tags) || typeof count !== "number")
-        continue;
-      if (!tags.every((t) => typeof t === "string"))
-        continue;
-      scopes.push({ tags, count });
-    }
+  return out;
+}
+function redactedMarker(ruleId) {
+  const trimmed = ruleId.replace(/^(kv|env)_/, "");
+  if (!trimmed || trimmed === "key_value" || trimmed === "kv_entropy") {
+    return REDACTED_MARKER;
   }
-  return planScopeCleanup(bankId, scopes, options);
+  return `[REDACTED:${trimmed}]`;
 }
-function formatCleanupPlan(plan, maxMerges = 10) {
-  if (!plan.ok) {
-    return `bank ${plan.bankId}: UNREADABLE (${plan.reason ?? "unknown"})`;
+// src/memory/hindsight-write-redaction.ts
+function redactJsonStrings(value) {
+  if (typeof value === "string")
+    return redact(value);
+  if (Array.isArray(value))
+    return value.map(redactJsonStrings);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redactJsonStrings(v);
+    }
+    return out;
   }
-  const b = plan.breakdown;
-  const lines = [];
-  lines.push(`bank ${plan.bankId}`);
-  lines.push(`  today: ${plan.totalScopes} scopes, ${plan.totalObservations.toLocaleString()} observations`);
-  lines.push(`  legacy fragmentation:` + ` all-volatile ${b.allVolatileScopes} scopes / ${b.allVolatileObservations.toLocaleString()} obs;` + ` mixed ${b.mixedScopes} scopes / ${b.mixedObservations.toLocaleString()} obs;` + ` stale agent-<hex> ${b.staleScopes} scopes / ${b.staleObservations.toLocaleString()} obs`);
-  lines.push(`  WOULD change: ${plan.affectedScopes} scopes` + ` (${plan.affectedObservations.toLocaleString()} obs re-homed),` + ` ${plan.totalScopes} \u2192 ${plan.resultingScopeCount} scopes` + ` (\u2212${plan.scopeReduction})`);
-  if (plan.merges.length > 0) {
-    lines.push(`  top merges:`);
-    for (const m of plan.merges.slice(0, maxMerges)) {
-      lines.push(`    ${m.sourceScopes} scopes \u2192 ${m.target}  (${m.observations.toLocaleString()} obs)`);
+  return value;
+}
+var REDACTED_ITEM_FIELDS = ["content", "context"];
+function redactMemoryWriteBody(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body))
+    return body;
+  const src = body;
+  if (!Array.isArray(src.items))
+    return body;
+  const items = src.items.map((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item))
+      return item;
+    const row = { ...item };
+    for (const field of REDACTED_ITEM_FIELDS) {
+      if (typeof row[field] === "string") {
+        row[field] = redact(row[field]);
+      }
     }
-    if (plan.merges.length > maxMerges) {
-      lines.push(`    +${plan.merges.length - maxMerges} more merge targets`);
+    if (row.metadata && typeof row.metadata === "object") {
+      row.metadata = redactJsonStrings(row.metadata);
     }
-  }
-  return lines.join(`
-`);
+    return row;
+  });
+  return { ...src, items };
 }
 
 // src/cli/memory.ts
@@ -97162,14 +97100,10 @@ function registerHandoffCommand(program3) {
       jsonlPath: jsonl,
       agentDir,
       agentName,
-      maxTurns: cappedMaxTurns,
-      observationScopes: agentConfig?.memory?.observation_scopes
+      maxTurns: cappedMaxTurns
     });
     process.stderr.write(`handoff: ${status}
 `);
-    if (status === HANDOFF_STATUS_MIRROR_SKIPPED) {
-      process.exitCode = 1;
-    }
     const retention = pruneSessionJsonl(claudeConfigDir, {
       maxCount: continuity?.session_retention_max_count ?? DEFAULT_SESSION_RETENTION_MAX_COUNT,
       maxAgeDays: continuity?.session_retention_max_age_days ?? DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS,