switchroom 0.19.44 → 0.19.46

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.19.44", COMMIT_SHA = "82d3b0b2";
+var VERSION = "0.19.46", COMMIT_SHA = "306c3ed1";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -13572,28 +13572,7 @@ var init_zod = __esm(() => {
 });
 
 // src/memory/observation-scopes.ts
-function isObservationScope(value) {
-  return typeof value === "string" && OBSERVATION_SCOPES.includes(value);
-}
-function observationScopesHint() {
-  return OBSERVATION_SCOPES.join(", ");
-}
-function classifyObservationScope(raw) {
-  if (raw === undefined)
-    return { kind: "unset" };
-  const value = raw.trim();
-  if (!value)
-    return { kind: "unset" };
-  if (!isObservationScope(value))
-    return { kind: "invalid", raw };
-  return { kind: "set", scope: value };
-}
-function resolveObservationScope(configured, env2 = process.env) {
-  if (configured !== undefined)
-    return classifyObservationScope(configured);
-  return classifyObservationScope(env2[OBSERVATION_SCOPES_ENV]);
-}
-var OBSERVATION_SCOPES, OBSERVATION_SCOPES_ENV = "HINDSIGHT_OBSERVATION_SCOPES", OBSERVATION_SCOPE_STRATEGIES;
+var OBSERVATION_SCOPES, OBSERVATION_SCOPE_STRATEGIES;
 var init_observation_scopes = __esm(() => {
   OBSERVATION_SCOPES = [
     "per_tag",
@@ -36321,7 +36300,7 @@ class AuthBrokerClient {
       sock.once("error", onError);
       sock.once("connect", () => {
         sock.removeListener("error", onError);
-        sock.on("data", (chunk2) => this.onData(chunk2));
+        sock.on("data", (chunk) => this.onData(chunk));
         sock.on("error", (err) => this.onSocketError(err));
         sock.on("close", () => this.onSocketClose());
         this.socket = sock;
@@ -36335,8 +36314,8 @@ class AuthBrokerClient {
       this.connecting = null;
     }
   }
-  onData(chunk2) {
-    this.buffer += chunk2.toString("utf8");
+  onData(chunk) {
+    this.buffer += chunk.toString("utf8");
     let idx;
     while ((idx = this.buffer.indexOf(`
 `)) !== -1) {
@@ -37460,11 +37439,14 @@ __export(exports_drive, {
   selectGoogleWorkspaceScopes: () => selectGoogleWorkspaceScopes,
   selectDriveAccountScopes: () => selectDriveAccountScopes,
   runDriveOAuthFlow: () => runDriveOAuthFlow,
+  resolveReconsentCapabilities: () => resolveReconsentCapabilities,
   registerDriveCommand: () => registerDriveCommand,
+  capabilitiesFromScopeString: () => capabilitiesFromScopeString,
   __test: () => __test,
   GOOGLE_SLIDES_SCOPE: () => GOOGLE_SLIDES_SCOPE,
   GOOGLE_SHEETS_SCOPE: () => GOOGLE_SHEETS_SCOPE,
   GOOGLE_DOCS_SCOPE: () => GOOGLE_DOCS_SCOPE,
+  GOOGLE_CALENDAR_READONLY_SCOPE: () => GOOGLE_CALENDAR_READONLY_SCOPE,
   DRIVE_WRITE_SCOPES: () => DRIVE_WRITE_SCOPES,
   DRIVE_READONLY_SCOPES: () => DRIVE_READONLY_SCOPES
 });
@@ -37482,7 +37464,29 @@ function selectDriveAccountScopes(write) {
 function selectGoogleWorkspaceScopes(opts) {
   const base = selectDriveAccountScopes(opts.write);
   const workspace = workspaceScopesForTier(opts.tier ?? "core");
-  return [...new Set([...base, ...workspace])];
+  const calendar = opts.calendar ? [GOOGLE_CALENDAR_READONLY_SCOPE] : [];
+  return [...new Set([...base, ...workspace, ...calendar])];
+}
+function capabilitiesFromScopeString(scope) {
+  const have = new Set(scope.split(/\s+/).map((s) => s.trim()).filter((s) => s.length > 0));
+  return {
+    write: have.has("https://www.googleapis.com/auth/drive.file"),
+    calendar: have.has(GOOGLE_CALENDAR_READONLY_SCOPE)
+  };
+}
+function resolveReconsentCapabilities(requested, existing) {
+  const keys = ["write", "calendar"];
+  if (!existing) {
+    return { effective: { ...requested }, carried: [], added: [] };
+  }
+  return {
+    effective: {
+      write: requested.write || existing.write,
+      calendar: requested.calendar || existing.calendar
+    },
+    carried: keys.filter((k) => existing[k] && !requested[k]),
+    added: keys.filter((k) => requested[k] && !existing[k])
+  };
 }
 function getVaultPath(configPath) {
   try {
@@ -37896,7 +37900,7 @@ function registerDriveCommand(program3, deps = {}) {
     await runDisconnect({ agentName: agent }, deps);
   });
 }
-var EXIT_OK = 0, EXIT_DENIED = 1, EXIT_TIMEOUT = 2, EXIT_RATE_LIMITED = 3, EXIT_ERROR = 4, EXIT_ABORTED = 130, DRIVE_READONLY_SCOPES, DRIVE_WRITE_SCOPES, DEFAULT_SCOPES, GOOGLE_DOCS_SCOPE = "https://www.googleapis.com/auth/documents", GOOGLE_SHEETS_SCOPE = "https://www.googleapis.com/auth/spreadsheets", GOOGLE_SLIDES_SCOPE = "https://www.googleapis.com/auth/presentations", __test;
+var EXIT_OK = 0, EXIT_DENIED = 1, EXIT_TIMEOUT = 2, EXIT_RATE_LIMITED = 3, EXIT_ERROR = 4, EXIT_ABORTED = 130, DRIVE_READONLY_SCOPES, DRIVE_WRITE_SCOPES, DEFAULT_SCOPES, GOOGLE_DOCS_SCOPE = "https://www.googleapis.com/auth/documents", GOOGLE_SHEETS_SCOPE = "https://www.googleapis.com/auth/spreadsheets", GOOGLE_SLIDES_SCOPE = "https://www.googleapis.com/auth/presentations", GOOGLE_CALENDAR_READONLY_SCOPE = "https://www.googleapis.com/auth/calendar.readonly", __test;
 var init_drive = __esm(() => {
   init_source();
   init_loader();
@@ -73049,764 +73053,170 @@ import { execFileSync as execFileSync11 } from "node:child_process";
 init_atomic();
 import { readFileSync as readFileSync20, writeFileSync as writeFileSync9, renameSync as renameSync7, mkdirSync as mkdirSync16, existsSync as existsSync24, statSync as statSync11, readdirSync as readdirSync10 } from "node:fs";
 import { join as join18 } from "node:path";
-
-// telegram-plugin/secret-detect/patterns.ts
-var ANCHORED_PATTERNS = [
-  { rule_id: "anthropic_api_key", regex: /\b(sk-ant-[A-Za-z0-9_-]{8,})\b/g, captureIndex: 1, slugHint: "anthropic_api_key" },
-  { rule_id: "anthropic_oauth_code", regex: /(?:^|\s)([A-Za-z0-9_-]{20,}#[A-Za-z0-9_-]{20,})(?=\s|$)/gm, captureIndex: 1, slugHint: "anthropic_oauth_code" },
-  { rule_id: "openai_api_key", regex: /\b(sk-[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "openai_api_key" },
-  { rule_id: "github_pat_classic", regex: /\b(ghp_[A-Za-z0-9]{20,})\b/g, captureIndex: 1, slugHint: "github_pat" },
-  { rule_id: "github_pat_fine_grained", regex: /\b(github_pat_[A-Za-z0-9_]{20,})\b/g, captureIndex: 1, slugHint: "github_pat" },
-  { rule_id: "slack_token", regex: /\b(xox[baprs]-[A-Za-z0-9-]{10,})\b/g, captureIndex: 1, slugHint: "slack_token" },
-  { rule_id: "slack_app_token", regex: /\b(xapp-[A-Za-z0-9-]{10,})\b/g, captureIndex: 1, slugHint: "slack_app_token" },
-  { rule_id: "groq_api_key", regex: /\b(gsk_[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "groq_api_key" },
-  { rule_id: "google_api_key", regex: /\b(AIza[0-9A-Za-z\-_]{20,})\b/g, captureIndex: 1, slugHint: "google_api_key" },
-  { rule_id: "perplexity_api_key", regex: /\b(pplx-[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "perplexity_api_key" },
-  { rule_id: "npm_token", regex: /\b(npm_[A-Za-z0-9]{10,})\b/g, captureIndex: 1, slugHint: "npm_token" },
-  { rule_id: "telegram_bot_token_prefixed", regex: /\bbot(\d{6,}:[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "telegram_bot_token" },
-  { rule_id: "telegram_bot_token", regex: /\b(\d{6,}:[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "telegram_bot_token" },
-  { rule_id: "laravel_sanctum_token", regex: /\b(\d+\|[A-Za-z0-9]{40,})\b/g, captureIndex: 1, slugHint: "api_token" },
-  { rule_id: "aws_access_key", regex: /\b(AKIA[0-9A-Z]{16})\b/g, captureIndex: 1, slugHint: "aws_access_key" },
-  { rule_id: "jwt", regex: /\b(eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "jwt" }
-];
-var STRUCTURED_PATTERNS = [
-  {
-    rule_id: "env_key_value",
-    regex: /\b([A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD))\b\s*[=:]\s*(["']?)([^\s"'\\]+)\2/g,
-    captureIndex: 3,
-    slugHint: "env"
-  },
-  {
-    rule_id: "json_secret_field",
-    regex: /"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken)"\s*:\s*"([^"]+)"/g,
-    captureIndex: 1,
-    slugHint: "json_secret"
-  },
-  {
-    rule_id: "cli_flag",
-    regex: /--(?:api[-_]?key|hook[-_]?token|token|secret|password|passwd)\s+(["']?)([^\s"']+)\1/g,
-    captureIndex: 2,
-    slugHint: "cli_flag"
-  },
-  {
-    rule_id: "bearer_auth_header",
-    regex: /Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)/gi,
-    captureIndex: 1,
-    slugHint: "bearer_token"
-  },
-  {
-    rule_id: "bearer_loose",
-    regex: /\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b/gi,
-    captureIndex: 1,
-    slugHint: "bearer_token"
-  },
-  {
-    rule_id: "basic_auth_header",
-    regex: /Authorization\s*[:=]\s*Basic\s+([A-Za-z0-9+/=]{8,})/gi,
-    captureIndex: 1,
-    slugHint: "basic_auth"
-  },
-  {
-    rule_id: "pem_private_key",
-    regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----/g,
-    captureIndex: 0,
-    slugHint: "pem_private_key"
-  }
-];
-var PROVIDER_PATTERNS = [
-  { rule_id: "slack_webhook", regex: /(https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9_/]+)/g, captureIndex: 1, slugHint: "slack_webhook" },
-  { rule_id: "stripe_live_secret", regex: /\b(sk_live_[A-Za-z0-9]{24,})\b/g, captureIndex: 1, slugHint: "stripe_key" },
-  { rule_id: "stripe_restricted", regex: /\b(rk_live_[A-Za-z0-9]{24,})\b/g, captureIndex: 1, slugHint: "stripe_key" },
-  { rule_id: "sendgrid_api_key", regex: /\b(SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43})\b/g, captureIndex: 1, slugHint: "sendgrid_key" },
-  { rule_id: "gitlab_pat", regex: /\b(glpat-[A-Za-z0-9_-]{20})\b/g, captureIndex: 1, slugHint: "gitlab_pat" },
-  { rule_id: "huggingface_token", regex: /\b(hf_[A-Za-z0-9]{34,})\b/g, captureIndex: 1, slugHint: "huggingface_token" },
-  { rule_id: "twilio_api_key", regex: /\b(SK[0-9a-f]{32})\b/g, captureIndex: 1, slugHint: "twilio_api_key" },
-  { rule_id: "mailgun_key", regex: /\b(key-[0-9a-f]{32})\b/g, captureIndex: 1, slugHint: "mailgun_key" },
-  { rule_id: "digitalocean_pat", regex: /\b(dop_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
-  { rule_id: "digitalocean_oauth", regex: /\b(doo_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
-  { rule_id: "digitalocean_refresh", regex: /\b(dor_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
-  { rule_id: "doppler_token", regex: /\b(dp\.(?:pt|st|ct|sa|scim|audit)\.[A-Za-z0-9]{40,44})\b/g, captureIndex: 1, slugHint: "doppler_token" },
-  { rule_id: "linear_api_key", regex: /\b(lin_api_[A-Za-z0-9]{40})\b/g, captureIndex: 1, slugHint: "linear_api_key" },
-  { rule_id: "shopify_access_token", regex: /\b(shpat_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
-  { rule_id: "shopify_shared_secret", regex: /\b(shpss_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
-  { rule_id: "shopify_private_app", regex: /\b(shppa_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
-  { rule_id: "square_access_token", regex: /\b(sq0atp-[A-Za-z0-9_-]{22})\b/g, captureIndex: 1, slugHint: "square_token" },
-  { rule_id: "square_oauth_secret", regex: /\b(sq0csp-[A-Za-z0-9_-]{43})\b/g, captureIndex: 1, slugHint: "square_token" },
-  { rule_id: "newrelic_key", regex: /\b(NRAK-[A-Z0-9]{27})\b/g, captureIndex: 1, slugHint: "newrelic_key" },
-  { rule_id: "notion_token", regex: /\b(ntn_[A-Za-z0-9]{46})\b/g, captureIndex: 1, slugHint: "notion_token" },
-  { rule_id: "planetscale_password", regex: /\b(pscale_pw_[A-Za-z0-9_.-]{43})\b/g, captureIndex: 1, slugHint: "planetscale_token" },
-  { rule_id: "planetscale_token", regex: /\b(pscale_tkn_[A-Za-z0-9_.-]{43})\b/g, captureIndex: 1, slugHint: "planetscale_token" },
-  { rule_id: "supabase_service_key", regex: /\b(sbp_[a-f0-9]{40})\b/g, captureIndex: 1, slugHint: "supabase_key" },
-  { rule_id: "atlassian_token", regex: /\b(ATATT[A-Za-z0-9_\-=]{20,})\b/g, captureIndex: 1, slugHint: "atlassian_token" },
-  { rule_id: "dropbox_token", regex: /\b(sl\.[A-Za-z0-9_-]{130,})/g, captureIndex: 1, slugHint: "dropbox_token" },
-  { rule_id: "databricks_token", regex: /\b(dapi[a-f0-9]{32})\b/g, captureIndex: 1, slugHint: "databricks_token" },
-  { rule_id: "grafana_service_account", regex: /\b(glsa_[A-Za-z0-9]{32}_[a-fA-F0-9]{8})\b/g, captureIndex: 1, slugHint: "grafana_token" },
-  { rule_id: "pypi_token", regex: /\b(pypi-AgEIcHlwaS[A-Za-z0-9_-]{50,})/g, captureIndex: 1, slugHint: "pypi_token" },
-  { rule_id: "aws_temp_access_key", regex: /\b(ASIA[0-9A-Z]{16})\b/g, captureIndex: 1, slugHint: "aws_access_key" },
-  { rule_id: "gcp_oauth_token", regex: /\b(ya29\.[A-Za-z0-9_-]{30,})/g, captureIndex: 1, slugHint: "gcp_oauth_token" }
-];
-var ALL_PATTERNS = [...ANCHORED_PATTERNS, ...PROVIDER_PATTERNS, ...STRUCTURED_PATTERNS];
-
-// telegram-plugin/secret-detect/entropy.ts
-function shannonEntropy(s) {
-  if (s.length === 0)
-    return 0;
-  const counts = new Map;
-  for (const ch of s) {
-    counts.set(ch, (counts.get(ch) ?? 0) + 1);
-  }
-  let h = 0;
-  const len = s.length;
-  for (const c of counts.values()) {
-    const p = c / len;
-    h -= p * Math.log2(p);
-  }
-  return h;
-}
-
-// telegram-plugin/secret-detect/inert-values.ts
-var INERT_VALUE_RE = [
-  /^\[REDACTED(?::[A-Za-z0-9_]+)?\]$/i,
-  /^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/,
-  /^\{\{[^\n\r\u2028\u2029]*\}\}$/,
-  /^<[^<>\n\r\u2028\u2029]*>$/,
-  /^%[A-Za-z_][A-Za-z0-9_]*%$/,
-  /^vault:[A-Za-z0-9_./-]*$/i,
-  /^[*x\u2022.]+$/i,
-  /^(?:process\.env|import\.meta\.env|os\.environ)(?:\.[A-Za-z_$][A-Za-z0-9_$]*|\[["']?[A-Za-z_$][A-Za-z0-9_$]*["']?\])*$/,
-  /^(?:changeme|change-me|replaceme|replace-me|placeholder|todo|tbd|yourkey|your-key|yourpassword|your-password|yoursecret|your-secret|yourtoken|your-token)(?:[-_][A-Za-z0-9-]+)?$/i,
-  /^[a-z]+(?: [a-z]+){2,}$/
-];
-var CREDENTIAL_RUN_RE = /[A-Za-z0-9]{12,}/g;
-var MIXED_CLASS_RUN_MIN = 12;
-var SINGLE_CLASS_RUN_MIN = 16;
-function runIsCredentialShaped(run) {
-  let classes = 0;
-  if (/[a-z]/.test(run))
-    classes++;
-  if (/[A-Z]/.test(run))
-    classes++;
-  if (/[0-9]/.test(run))
-    classes++;
-  return run.length >= (classes >= 2 ? MIXED_CLASS_RUN_MIN : SINGLE_CLASS_RUN_MIN);
-}
-function hasCredentialShapedRun(value) {
-  for (const run of value.match(CREDENTIAL_RUN_RE) ?? []) {
-    if (runIsCredentialShaped(run))
-      return true;
+var DEFAULT_MAX_TURNS = 50;
+var TOPIC_MAX_CHARS = 117;
+var TURN_TEXT_MAX_CHARS = 1200;
+function extractTurnsFromJsonl(path2, maxTurns) {
+  let raw;
+  try {
+    raw = readFileSync20(path2, "utf-8");
+  } catch {
+    return [];
   }
-  return false;
-}
-function isInertValue(value) {
-  if (!INERT_VALUE_RE.some((re) => re.test(value)))
-    return false;
-  return !hasCredentialShapedRun(value);
-}
-var INERT_GATED_RULES = new Set([
-  "env_key_value",
-  "json_secret_field",
-  "cli_flag"
-]);
-var TRAILING_PUNCT_RE = /[.,;:!?)\]}]+$/;
-function stripTrailingPunctuation(value) {
-  return value.replace(TRAILING_PUNCT_RE, "");
-}
-
-// telegram-plugin/secret-detect/kv-scanner.ts
-var KV_RE = /\b([A-Za-z_][A-Za-z0-9_-]*(?:password|passwd|token|secret|key|api[_-]?key))\s*[:=]\s*["']?([^\s"'\\]{8,})["']?/gi;
-var KV_ENTROPY_THRESHOLD = 4;
-var MEMORABLE_PW_RE = /\b([A-Za-z0-9_-]*(?:password|passwd|passphrase|pwd))\b\s*(?:[:=]\s*|\s+is\s+)(["']?)([^\s"']{8,64})\2/gi;
-var MEMORABLE_PW_RULE_ID = "memorable_password";
-var MEMORABLE_PW_MIN_CLASSES = 2;
-function charClassCount(value) {
-  let n = 0;
-  if (/[a-z]/.test(value))
-    n++;
-  if (/[A-Z]/.test(value))
-    n++;
-  if (/[0-9]/.test(value))
-    n++;
-  if (/[^A-Za-z0-9]/.test(value))
-    n++;
-  return n;
-}
-function looksLikeMemorablePassword(value) {
-  if (isInertValue(value))
-    return false;
-  const core = stripTrailingPunctuation(value);
-  if (core.length < 8 || core.length > 64)
-    return false;
-  if (isInertValue(core))
-    return false;
-  if (new Set(core).size < 4)
-    return false;
-  return charClassCount(core) >= MEMORABLE_PW_MIN_CLASSES;
-}
-function scanMemorablePasswords(text) {
-  const hits = [];
-  MEMORABLE_PW_RE.lastIndex = 0;
-  let m;
-  while ((m = MEMORABLE_PW_RE.exec(text)) !== null) {
-    const keyName = m[1];
-    const value = m[3];
-    if (!value || !looksLikeMemorablePassword(value))
-      continue;
-    const valueOffsetInMatch = m[0].indexOf(value, keyName.length);
-    if (valueOffsetInMatch < 0)
+  const turns = [];
+  for (const line of raw.split(`
+`)) {
+    if (!line.trim())
       continue;
-    const start = m.index + valueOffsetInMatch;
-    hits.push({
-      rule_id: MEMORABLE_PW_RULE_ID,
-      start,
-      end: start + value.length,
-      matched_text: value,
-      key_name: keyName,
-      confidence: "ambiguous"
-    });
-  }
-  return hits;
-}
-function scanKeyValue(text) {
-  const hits = [];
-  KV_RE.lastIndex = 0;
-  let m;
-  while ((m = KV_RE.exec(text)) !== null) {
-    const [, keyName, value] = m;
-    if (!value)
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
       continue;
-    if (isInertValue(value))
+    }
+    if (obj.type === "queue-operation") {
+      const op = obj.operation;
+      if (op !== "enqueue")
+        continue;
+      const content = obj.content;
+      if (typeof content !== "string")
+        continue;
+      const text = extractChannelBody(content);
+      if (text)
+        turns.push({ role: "user", text });
       continue;
-    const h = shannonEntropy(value);
-    if (h < KV_ENTROPY_THRESHOLD)
+    }
+    if (obj.type === "user" && obj.message && typeof obj.message === "object") {
+      const content = obj.message.content;
+      const raw2 = extractTextBlocks(content);
+      const text = raw2 ? extractChannelBody(raw2) : null;
+      if (text)
+        turns.push({ role: "user", text });
       continue;
-    const valueOffsetInMatch = m[0].indexOf(value, keyName.length);
-    if (valueOffsetInMatch < 0)
+    }
+    if (obj.type === "assistant" && obj.message && typeof obj.message === "object") {
+      const content = obj.message.content;
+      const text = extractTextBlocks(content);
+      if (text)
+        turns.push({ role: "assistant", text });
       continue;
-    const start = m.index + valueOffsetInMatch;
-    const end = start + value.length;
-    hits.push({
-      rule_id: "kv_entropy",
-      start,
-      end,
-      matched_text: value,
-      key_name: keyName,
-      confidence: "ambiguous"
-    });
+    }
   }
-  return hits;
-}
-
-// telegram-plugin/secret-detect/db-uri.ts
-var DB_URI_RE = /\b([a-zA-Z][a-zA-Z0-9+.-]+):\/\/([^\s:/@]+):([^\s/?#]+)@([^\s/@?#]+)/g;
-var DB_URI_RULE_ID = "db_uri_password";
-function isInertPassword(value) {
-  if (value.startsWith("[REDACTED"))
-    return true;
-  return /^[*x]+$/i.test(value);
-}
-function scanDbUris(text) {
-  const hits = [];
-  DB_URI_RE.lastIndex = 0;
-  let m;
-  while ((m = DB_URI_RE.exec(text)) !== null) {
-    const scheme = m[1];
-    const user = m[2];
-    const password = m[3];
-    if (isInertPassword(password))
+  const deduped = [];
+  for (const t of turns) {
+    const prev = deduped[deduped.length - 1];
+    if (prev && prev.role === t.role && prev.text === t.text)
       continue;
-    const start = m.index + scheme.length + 3 + user.length + 1;
-    hits.push({
-      rule_id: DB_URI_RULE_ID,
-      start,
-      end: start + password.length,
-      matched_text: password,
-      key_name: `${scheme}_password`,
-      confidence: "ambiguous"
-    });
+    deduped.push(t);
   }
-  return hits;
+  if (deduped.length <= maxTurns)
+    return deduped;
+  return deduped.slice(deduped.length - maxTurns);
 }
-
-// telegram-plugin/secret-detect/generic-entropy.ts
-var CANDIDATE_RE = /[A-Za-z0-9]{28,}/g;
-var GENERIC_MIN_DISTINCT = 18;
-var MAX_GENERIC_HITS = 20;
-function hasDistinctChars(tok, n) {
-  const seen = new Uint8Array(128);
-  let distinct = 0;
-  for (let i = 0;i < tok.length; i++) {
-    const c = tok.charCodeAt(i);
-    if (seen[c] === 0) {
-      seen[c] = 1;
-      if (++distinct >= n)
-        return true;
-    }
-  }
-  return false;
+function extractChannelBody(raw) {
+  const m = raw.match(/<channel[^>]*>([\s\S]*?)<\/channel>/);
+  if (m)
+    return m[1].trim();
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : null;
 }
-function hasDigit(tok) {
-  for (let i = 0;i < tok.length; i++) {
-    const c = tok.charCodeAt(i);
-    if (c >= 48 && c <= 57)
-      return true;
+function extractTextBlocks(content) {
+  if (typeof content === "string") {
+    const t = content.trim();
+    return t.length > 0 ? t : null;
   }
-  return false;
-}
-function scanGenericSecrets(text) {
-  const hits = [];
-  CANDIDATE_RE.lastIndex = 0;
-  let m;
-  while ((m = CANDIDATE_RE.exec(text)) !== null) {
-    if (hits.length >= MAX_GENERIC_HITS)
-      break;
-    const tok = m[0];
-    if (!hasDigit(tok))
-      continue;
-    if (!hasDistinctChars(tok, GENERIC_MIN_DISTINCT))
+  if (!Array.isArray(content))
+    return null;
+  const parts = [];
+  for (const block of content) {
+    if (!block || typeof block !== "object")
       continue;
-    hits.push({
-      rule_id: "generic_high_entropy",
-      start: m.index,
-      end: m.index + tok.length,
-      matched_text: tok,
-      confidence: "ambiguous"
-    });
+    const b = block;
+    if (b.type === "text" && typeof b.text === "string") {
+      parts.push(b.text);
+    } else if (b.type === "tool_result" && typeof b.content === "string") {
+      parts.push(`[tool result] ${b.content.slice(0, 400)}`);
+    }
   }
-  return hits;
+  const joined = parts.join(`
+`).trim();
+  return joined.length > 0 ? joined : null;
 }
+function formatTranscriptTail(turns) {
+  const header = `# Handoff \u2014 previous session
 
-// telegram-plugin/secret-detect/chunker.ts
-var CHUNK_THRESHOLD = 32 * 1024;
-var WINDOW_SIZE = 16 * 1024;
-var OVERLAP = 8 * 1024;
-function chunk(text) {
-  if (text.length <= CHUNK_THRESHOLD) {
-    return [{ offset: 0, text }];
+` + "You are resuming this agent's work. There is no generated summary " + "\u2014 below is the **raw tail of the previous session's transcript** " + "(oldest first, most recent last). Read it to reorient, then carry " + "on. Anything important worth keeping long-term should already be " + `in your memory files \u2014 check those too.
+`;
+  if (turns.length === 0) {
+    return header + `
+_(No recent turns were recoverable from the previous session.)_
+`;
   }
-  const out = [];
-  let offset = 0;
-  while (offset < text.length) {
-    const end = Math.min(offset + WINDOW_SIZE, text.length);
-    out.push({ offset, text: text.slice(offset, end) });
-    if (end >= text.length)
-      break;
-    offset = end - OVERLAP;
+  const body = turns.map((t) => {
+    let text = t.text;
+    if (text.length > TURN_TEXT_MAX_CHARS) {
+      text = text.slice(0, TURN_TEXT_MAX_CHARS) + `
+\u2026[truncated]`;
+    }
+    return `### ${t.role === "user" ? "User" : "Assistant"}
+${text}`;
+  }).join(`
+
+`);
+  return `${header}
+## Recent turns
+
+${body}
+`;
+}
+function deriveTopic(turns) {
+  for (let i = turns.length - 1;i >= 0; i--) {
+    if (turns[i].role === "user")
+      return clampTopic(firstLine(turns[i].text));
   }
-  return out;
+  if (turns.length > 0)
+    return clampTopic(firstLine(turns[turns.length - 1].text));
+  return "previous session";
 }
-
-// telegram-plugin/secret-detect/suppressor.ts
-var MARKERS = ["test", "mock", "example", "fixture", "dummy"];
-var WINDOW = 40;
-var MARKER_RE = new RegExp(`\\b(?:${MARKERS.join("|")})\\b`, "i");
-function isSuppressed(text, start, end) {
-  const left = Math.max(0, start - WINDOW);
-  const right = Math.min(text.length, end + WINDOW);
-  const context = text.slice(left, start) + text.slice(end, right);
-  return MARKER_RE.test(context);
+function firstLine(s) {
+  const line = s.split(/\r?\n/).find((l) => l.trim().length > 0) ?? s;
+  return line.trim();
 }
-
-// telegram-plugin/secret-detect/slug.ts
-function sanitizeKeyName(raw) {
-  const up = raw.toUpperCase();
-  const cleaned = up.replace(/[^A-Z0-9_]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
-  return cleaned.length > 0 ? cleaned : "SECRET";
+function clampTopic(s) {
+  return s.length > TOPIC_MAX_CHARS ? s.slice(0, TOPIC_MAX_CHARS) + "\u2026" : s;
 }
-function datePart(now = new Date) {
-  const y = now.getUTCFullYear();
-  const m = String(now.getUTCMonth() + 1).padStart(2, "0");
-  const d = String(now.getUTCDate()).padStart(2, "0");
-  return `${y}${m}${d}`;
+function writeSidecarsAtomic(agentDir, briefing, topic) {
+  mkdirSync16(agentDir, { recursive: true });
+  const handoffPath = join18(agentDir, ".handoff.md");
+  const topicPath = join18(agentDir, ".handoff-topic");
+  const handoffTmp = handoffPath + ".tmp";
+  const topicTmp = topicPath + ".tmp";
+  writeFileSync9(handoffTmp, briefing, "utf-8");
+  writeFileSync9(topicTmp, topic, "utf-8");
+  fsyncPathSync(handoffTmp);
+  fsyncPathSync(topicTmp);
+  renameSync7(handoffTmp, handoffPath);
+  renameSync7(topicTmp, topicPath);
+  try {
+    fsyncPathSync(agentDir);
+  } catch {}
 }
-function deriveSlug(inputs, existing) {
-  let base;
-  if (inputs.key_name && inputs.key_name.trim().length > 0) {
-    base = sanitizeKeyName(inputs.key_name);
-  } else {
-    base = `${inputs.rule_id}_${datePart(inputs.now)}`;
+async function buildHandoff(opts) {
+  const maxTurns = opts.maxTurns ?? DEFAULT_MAX_TURNS;
+  const turns = extractTurnsFromJsonl(opts.jsonlPath, maxTurns);
+  if (turns.length === 0) {
+    return "no-turns";
   }
-  if (!existing.has(base))
-    return base;
-  let n = 2;
-  while (existing.has(`${base}_${n}`))
-    n++;
-  return `${base}_${n}`;
-}
-// telegram-plugin/secret-detect/url-redact.ts
-var SENSITIVE_PARAMS = new Set([
-  "token",
-  "key",
-  "api_key",
-  "apikey",
-  "secret",
-  "access_token",
-  "password",
-  "pass",
-  "auth",
-  "client_secret",
-  "refresh_token",
-  "signature"
-]);
-var URL_RE = /\b(?:https?|wss?|ftp):\/\/[^\s<>"']+/gi;
-function redactUrls(text) {
-  return text.replace(URL_RE, (m) => {
-    const redacted = redactOne(m);
-    return redacted ?? m;
-  });
-}
-function redactOne(raw) {
-  let u;
-  try {
-    u = new URL(raw);
-  } catch {
-    return null;
-  }
-  let changed = false;
-  if (u.username || u.password) {
-    u.username = "***";
-    u.password = "";
-    changed = true;
-  }
-  for (const [key] of u.searchParams) {
-    if (SENSITIVE_PARAMS.has(key.toLowerCase())) {
-      u.searchParams.set(key, "***");
-      changed = true;
-    }
-  }
-  return changed ? u.toString() : null;
-}
-
-// telegram-plugin/secret-detect/index.ts
-function detectSecrets(text) {
-  if (!text || text.length === 0)
-    return [];
-  const windows = chunk(text);
-  const raw = [];
-  for (const win of windows) {
-    for (const p of ALL_PATTERNS) {
-      const re = new RegExp(p.regex.source, p.regex.flags.includes("g") ? p.regex.flags : p.regex.flags + "g");
-      let m;
-      while ((m = re.exec(win.text)) !== null) {
-        if (m[0].length === 0) {
-          re.lastIndex++;
-          continue;
-        }
-        const cap = p.captureIndex === 0 ? m[0] : m[p.captureIndex];
-        if (!cap)
-          continue;
-        const matchStart = p.captureIndex === 0 ? m.index : m.index + m[0].indexOf(cap);
-        if (matchStart < 0)
-          continue;
-        const globalStart = win.offset + matchStart;
-        const globalEnd = globalStart + cap.length;
-        const keyName = p.rule_id === "env_key_value" ? m[1] : undefined;
-        if (INERT_GATED_RULES.has(p.rule_id) && isInertValue(cap))
-          continue;
-        if (p.rule_id === "env_key_value") {
-          const ENV_KV_MIN_LEN = 12;
-          const ENV_KV_MIN_ENTROPY = 3.5;
-          if (cap.length < ENV_KV_MIN_LEN)
-            continue;
-          if (shannonEntropy(cap) < ENV_KV_MIN_ENTROPY)
-            continue;
-        }
-        raw.push({
-          rule_id: p.rule_id,
-          start: globalStart,
-          end: globalEnd,
-          matched_text: cap,
-          key_name: keyName,
-          confidence: "high"
-        });
-      }
-    }
-    const kvHits = scanKeyValue(win.text);
-    for (const h of kvHits) {
-      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
-    }
-    for (const h of scanDbUris(win.text)) {
-      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
-    }
-    for (const h of scanMemorablePasswords(win.text)) {
-      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
-    }
-    const genHits = scanGenericSecrets(win.text);
-    for (const h of genHits) {
-      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
-    }
-  }
-  const deduped = dedupeRaw(raw);
-  const final = dropOverlaps(deduped);
-  const existing = new Set;
-  const out = [];
-  for (const h of final) {
-    const suggested_slug = deriveSlug({ key_name: h.key_name, rule_id: h.rule_id }, existing);
-    existing.add(suggested_slug);
-    out.push({
-      rule_id: h.rule_id,
-      matched_text: h.matched_text,
-      start: h.start,
-      end: h.end,
-      confidence: h.confidence,
-      suppressed: isSuppressed(text, h.start, h.end),
-      suggested_slug,
-      key_name: h.key_name
-    });
-  }
-  out.sort((a, b) => a.start - b.start);
-  return out;
-}
-function dedupeRaw(raw) {
-  const seen = new Map;
-  for (const h of raw) {
-    const key = `${h.start}:${h.end}`;
-    const existing = seen.get(key);
-    if (!existing) {
-      seen.set(key, h);
-      continue;
-    }
-    if (existing.confidence === "ambiguous" && h.confidence === "high") {
-      seen.set(key, h);
-    }
-  }
-  return Array.from(seen.values());
-}
-function dropOverlaps(hits) {
-  const out = hits.filter((h) => !(h.confidence === "ambiguous" && hits.some((o) => o !== h && o.start <= h.start && o.end >= h.end && !(o.start === h.start && o.end === h.end))));
-  out.sort((a, b) => a.start - b.start || a.end - b.end);
-  return out;
-}
-
-// telegram-plugin/secret-detect/redact.ts
-var REDACTED_MARKER = "[REDACTED]";
-function redact(text) {
-  if (!text || text.length === 0)
-    return text;
-  const urlScrubbed = redactUrls(text);
-  const hits = detectSecrets(urlScrubbed).filter((h) => h.rule_id !== "generic_high_entropy");
-  if (hits.length === 0)
-    return urlScrubbed;
-  const sorted = [...hits].sort((a, b) => b.start - a.start);
-  let out = urlScrubbed;
-  for (const h of sorted) {
-    out = out.slice(0, h.start) + redactedMarker(h.rule_id) + out.slice(h.end);
-  }
-  return out;
-}
-function redactedMarker(ruleId) {
-  const trimmed = ruleId.replace(/^(kv|env)_/, "");
-  if (!trimmed || trimmed === "key_value" || trimmed === "kv_entropy") {
-    return REDACTED_MARKER;
-  }
-  return `[REDACTED:${trimmed}]`;
-}
-// src/memory/hindsight-write-redaction.ts
-function redactJsonStrings(value) {
-  if (typeof value === "string")
-    return redact(value);
-  if (Array.isArray(value))
-    return value.map(redactJsonStrings);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = redactJsonStrings(v);
-    }
-    return out;
-  }
-  return value;
-}
-var REDACTED_ITEM_FIELDS = ["content", "context"];
-function redactMemoryWriteBody(body) {
-  if (!body || typeof body !== "object" || Array.isArray(body))
-    return body;
-  const src = body;
-  if (!Array.isArray(src.items))
-    return body;
-  const items = src.items.map((item) => {
-    if (!item || typeof item !== "object" || Array.isArray(item))
-      return item;
-    const row = { ...item };
-    for (const field of REDACTED_ITEM_FIELDS) {
-      if (typeof row[field] === "string") {
-        row[field] = redact(row[field]);
-      }
-    }
-    if (row.metadata && typeof row.metadata === "object") {
-      row.metadata = redactJsonStrings(row.metadata);
-    }
-    return row;
-  });
-  return { ...src, items };
-}
-
-// src/agents/handoff-summarizer.ts
-init_observation_scopes();
-var HANDOFF_STATUS_MIRROR_SKIPPED = "mirror-skipped-invalid-scope";
-var DEFAULT_MAX_TURNS = 50;
-var TOPIC_MAX_CHARS = 117;
-var TURN_TEXT_MAX_CHARS = 1200;
-function extractTurnsFromJsonl(path2, maxTurns) {
-  let raw;
-  try {
-    raw = readFileSync20(path2, "utf-8");
-  } catch {
-    return [];
-  }
-  const turns = [];
-  for (const line of raw.split(`
-`)) {
-    if (!line.trim())
-      continue;
-    let obj;
-    try {
-      obj = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    if (obj.type === "queue-operation") {
-      const op = obj.operation;
-      if (op !== "enqueue")
-        continue;
-      const content = obj.content;
-      if (typeof content !== "string")
-        continue;
-      const text = extractChannelBody(content);
-      if (text)
-        turns.push({ role: "user", text });
-      continue;
-    }
-    if (obj.type === "user" && obj.message && typeof obj.message === "object") {
-      const content = obj.message.content;
-      const raw2 = extractTextBlocks(content);
-      const text = raw2 ? extractChannelBody(raw2) : null;
-      if (text)
-        turns.push({ role: "user", text });
-      continue;
-    }
-    if (obj.type === "assistant" && obj.message && typeof obj.message === "object") {
-      const content = obj.message.content;
-      const text = extractTextBlocks(content);
-      if (text)
-        turns.push({ role: "assistant", text });
-      continue;
-    }
-  }
-  const deduped = [];
-  for (const t of turns) {
-    const prev = deduped[deduped.length - 1];
-    if (prev && prev.role === t.role && prev.text === t.text)
-      continue;
-    deduped.push(t);
-  }
-  if (deduped.length <= maxTurns)
-    return deduped;
-  return deduped.slice(deduped.length - maxTurns);
-}
-function extractChannelBody(raw) {
-  const m = raw.match(/<channel[^>]*>([\s\S]*?)<\/channel>/);
-  if (m)
-    return m[1].trim();
-  const trimmed = raw.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-function extractTextBlocks(content) {
-  if (typeof content === "string") {
-    const t = content.trim();
-    return t.length > 0 ? t : null;
-  }
-  if (!Array.isArray(content))
-    return null;
-  const parts = [];
-  for (const block of content) {
-    if (!block || typeof block !== "object")
-      continue;
-    const b = block;
-    if (b.type === "text" && typeof b.text === "string") {
-      parts.push(b.text);
-    } else if (b.type === "tool_result" && typeof b.content === "string") {
-      parts.push(`[tool result] ${b.content.slice(0, 400)}`);
-    }
-  }
-  const joined = parts.join(`
-`).trim();
-  return joined.length > 0 ? joined : null;
-}
-function formatTranscriptTail(turns) {
-  const header = `# Handoff \u2014 previous session
-
-` + "You are resuming this agent's work. There is no generated summary " + "\u2014 below is the **raw tail of the previous session's transcript** " + "(oldest first, most recent last). Read it to reorient, then carry " + "on. Anything important worth keeping long-term should already be " + `in your memory files \u2014 check those too.
-`;
-  if (turns.length === 0) {
-    return header + `
-_(No recent turns were recoverable from the previous session.)_
-`;
-  }
-  const body = turns.map((t) => {
-    let text = t.text;
-    if (text.length > TURN_TEXT_MAX_CHARS) {
-      text = text.slice(0, TURN_TEXT_MAX_CHARS) + `
-\u2026[truncated]`;
-    }
-    return `### ${t.role === "user" ? "User" : "Assistant"}
-${text}`;
-  }).join(`
-
-`);
-  return `${header}
-## Recent turns
-
-${body}
-`;
-}
-function deriveTopic(turns) {
-  for (let i = turns.length - 1;i >= 0; i--) {
-    if (turns[i].role === "user")
-      return clampTopic(firstLine(turns[i].text));
-  }
-  if (turns.length > 0)
-    return clampTopic(firstLine(turns[turns.length - 1].text));
-  return "previous session";
-}
-function firstLine(s) {
-  const line = s.split(/\r?\n/).find((l) => l.trim().length > 0) ?? s;
-  return line.trim();
-}
-function clampTopic(s) {
-  return s.length > TOPIC_MAX_CHARS ? s.slice(0, TOPIC_MAX_CHARS) + "\u2026" : s;
-}
-function writeSidecarsAtomic(agentDir, briefing, topic) {
-  mkdirSync16(agentDir, { recursive: true });
-  const handoffPath = join18(agentDir, ".handoff.md");
-  const topicPath = join18(agentDir, ".handoff-topic");
-  const handoffTmp = handoffPath + ".tmp";
-  const topicTmp = topicPath + ".tmp";
-  writeFileSync9(handoffTmp, briefing, "utf-8");
-  writeFileSync9(topicTmp, topic, "utf-8");
-  fsyncPathSync(handoffTmp);
-  fsyncPathSync(topicTmp);
-  renameSync7(handoffTmp, handoffPath);
-  renameSync7(topicTmp, topicPath);
-  try {
-    fsyncPathSync(agentDir);
-  } catch {}
-}
-async function buildHandoff(opts) {
-  const maxTurns = opts.maxTurns ?? DEFAULT_MAX_TURNS;
-  const turns = extractTurnsFromJsonl(opts.jsonlPath, maxTurns);
-  if (turns.length === 0) {
-    return "no-turns";
-  }
-  const briefing = formatTranscriptTail(turns);
-  const topic = deriveTopic(turns);
-  try {
-    writeSidecarsAtomic(opts.agentDir, briefing, topic);
-  } catch (err) {
-    process.stderr.write(`handoff: sidecar write failed \u2014 ${errMsg(err)}
-`);
-    return "write-error";
-  }
-  const mirrored = await mirrorToHindsight(briefing, opts).catch(() => true);
-  return mirrored ? "ok" : HANDOFF_STATUS_MIRROR_SKIPPED;
+  const briefing = formatTranscriptTail(turns);
+  const topic = deriveTopic(turns);
+  try {
+    writeSidecarsAtomic(opts.agentDir, briefing, topic);
+  } catch (err) {
+    process.stderr.write(`handoff: sidecar write failed \u2014 ${errMsg(err)}
+`);
+    return "write-error";
+  }
+  return "ok";
 }
 function errMsg(err) {
   if (err && typeof err === "object" && "message" in err) {
@@ -73814,42 +73224,6 @@ function errMsg(err) {
   }
   return String(err);
 }
-async function mirrorToHindsight(briefing, opts) {
-  const url = opts.hindsightUrl ?? process.env.HINDSIGHT_API_URL;
-  const bankId = opts.hindsightBankId ?? process.env.HINDSIGHT_BANK_ID ?? "default";
-  if (!url)
-    return true;
-  const fetchFn = opts.fetch ?? fetch;
-  const endpoint = `${url.replace(/\/$/, "")}/v1/default/banks/${encodeURIComponent(bankId)}/memories`;
-  const scope = resolveObservationScope(opts.observationScopes, opts.env ?? process.env);
-  if (scope.kind === "invalid") {
-    process.stderr.write(`handoff: hindsight mirror SKIPPED \u2014 observation scope ` + `${JSON.stringify(scope.raw)} is not valid ` + `(accepted: ${observationScopesHint()}). Fix ` + `memory.observation_scopes in switchroom.yaml (or the ` + `${OBSERVATION_SCOPES_ENV} export), then \`switchroom apply\` and ` + `restart the agent. The on-disk handoff sidecars were written ` + `normally; only the recallable Hindsight copy was skipped.
-`);
-    return false;
-  }
-  const body = redactMemoryWriteBody({
-    items: [
-      {
-        content: briefing,
-        document_id: "session_handoff",
-        tags: ["session_handoff", opts.agentName],
-        ...scope.kind === "set" ? { observation_scopes: scope.scope } : {}
-      }
-    ],
-    async: true
-  });
-  try {
-    await fetchFn(endpoint, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(body)
-    });
-  } catch (err) {
-    process.stderr.write(`handoff: hindsight mirror failed \u2014 ${errMsg(err)}
-`);
-  }
-  return true;
-}
 function findLatestSessionJsonl(claudeConfigDir) {
   const projects = join18(claudeConfigDir, "projects");
   if (!existsSync24(projects))
@@ -76856,8 +76230,8 @@ Bootstrapping agent: ${name}
     const code = await new Promise((resolve25) => {
       process.stdin.setEncoding("utf-8");
       let buf = "";
-      process.stdin.on("data", (chunk2) => {
-        buf += chunk2.toString();
+      process.stdin.on("data", (chunk) => {
+        buf += chunk.toString();
         const newlineIdx = buf.indexOf(`
 `);
         if (newlineIdx !== -1) {
@@ -76939,8 +76313,8 @@ switchroom agent add: ${name}
       return new Promise((resolveLine) => {
         process.stdin.setEncoding("utf-8");
         let buf = "";
-        const onData = (chunk2) => {
-          buf += chunk2.toString();
+        const onData = (chunk) => {
+          buf += chunk.toString();
           const newlineIdx = buf.indexOf(`
 `);
           if (newlineIdx !== -1) {
@@ -77955,10 +77329,15 @@ function pad(s, width) {
   return s.length >= width ? s : s + " ".repeat(width - s.length);
 }
 function registerAccountAdd(accountParent) {
-  accountParent.command("add <account>").description("Mint a Google OAuth refresh token for <account> and register it with the auth-broker. For Drive scopes the effective flow is desktop-loopback (device-code returns invalid_scope for Drive; OOB is retired) \u2014 use a Desktop OAuth client; on a headless host complete the browser step over an SSH port-forward. Add --write for create/edit (drive.file); default is read-only.").option("--replace", "Overwrite existing credentials for <account> (default refuses if account already registered)", false).option("--write", "Request Drive WRITE scope (drive.file: create + edit app-created files) in addition to read. Default is read-only \u2014 a read grant never silently becomes a write grant. Re-consent an existing account with `--replace --write`.", false).action(withConfigError(async (account, opts) => {
+  accountParent.command("add <account>").description("Mint a Google OAuth refresh token for <account> and register it with the auth-broker. For Drive scopes the effective flow is desktop-loopback (device-code returns invalid_scope for Drive; OOB is retired) \u2014 use a Desktop OAuth client; on a headless host complete the browser step over an SSH port-forward. Add --write for create/edit (drive.file) and --calendar for read-only Calendar; default is Drive read-only.").option("--replace", "Overwrite existing credentials for <account> (default refuses if account already registered)", false).option("--write", "Request Drive WRITE scope (drive.file: create + edit app-created files) in addition to read. Default is read-only \u2014 a read grant never silently becomes a write grant. Re-consent an existing account with `--replace --write`.", false).option("--calendar", "Request READ-ONLY Calendar scope (calendar.readonly) so the gdrive MCP's list_calendars / get_events tools authenticate. Opt-in \u2014 no tier grants it by default, and switchroom never requests a Calendar WRITE scope. Re-consent an existing account with `--replace --calendar`.", false).action(withConfigError(async (account, opts) => {
     const normalizedAccount = validateAndNormalizeAccountEmail(account);
     const [
-      { runDriveOAuthFlow: runDriveOAuthFlow2, selectGoogleWorkspaceScopes: selectGoogleWorkspaceScopes2 },
+      {
+        runDriveOAuthFlow: runDriveOAuthFlow2,
+        selectGoogleWorkspaceScopes: selectGoogleWorkspaceScopes2,
+        capabilitiesFromScopeString: capabilitiesFromScopeString2,
+        resolveReconsentCapabilities: resolveReconsentCapabilities2
+      },
       { selectInitialTier: selectInitialTier2 },
       { brokerCall: brokerCall2 },
       { loadConfig: loadConfig2, resolvePath: resolvePath2 },
@@ -78028,8 +77407,14 @@ function registerAccountAdd(accountParent) {
       clientSecretRaw = await resolveRef(clientSecretRaw, "google_client_secret");
     }
     const tier = gw.tier ?? "core";
+    const existingEntry = (await brokerCall2(async (client) => client.listGoogleAccounts())).accounts.find((a) => a.account === normalizedAccount);
+    const plan = resolveReconsentCapabilities2({ write: opts.write ?? false, calendar: opts.calendar ?? false }, existingEntry ? capabilitiesFromScopeString2(existingEntry.scope) : undefined);
+    if (existingEntry && !opts.replace && plan.added.length > 0) {
+      throw new Error(buildScopeReconsentRequiredError(normalizedAccount, plan.added));
+    }
     const accountScopes = selectGoogleWorkspaceScopes2({
-      write: opts.write ?? false,
+      write: plan.effective.write,
+      calendar: plan.effective.calendar,
       tier
     });
     const oauthCfg = {
@@ -78037,9 +77422,15 @@ function registerAccountAdd(accountParent) {
       client_secret: clientSecretRaw,
       scopes: accountScopes
     };
-    if (opts.write) {
+    if (plan.effective.write) {
       console.log(source_default.yellow("  Requesting Drive WRITE scope (drive.file \u2014 create/edit app-created files)."));
     }
+    if (plan.effective.calendar) {
+      console.log(source_default.yellow("  Requesting Calendar READ-ONLY scope (calendar.readonly \u2014 list calendars, read events)."));
+    }
+    for (const line of buildCarryForwardNotices(plan.carried)) {
+      console.log(source_default.gray(line));
+    }
     console.log(source_default.gray(`  Workspace tier: ${tier} \u2014 requesting Docs + Sheets` + (tier === "extended" || tier === "complete" ? " + Slides" : "") + " API scopes so the tier's tools can authenticate."));
     console.log(source_default.gray(`  Changing the tier later requires re-running this command
 ` + "  (`--replace`) \u2014 OAuth scopes are fixed at consent time."));
@@ -78076,6 +77467,40 @@ function registerAccountAdd(accountParent) {
     console.log();
   }));
 }
+var CAPABILITY_LABELS = {
+  write: {
+    flag: "--write",
+    scope: "drive.file",
+    summary: "Drive write (create + edit app-created files)"
+  },
+  calendar: {
+    flag: "--calendar",
+    scope: "calendar.readonly",
+    summary: "Calendar read-only (list calendars, read events)"
+  }
+};
+function buildScopeReconsentRequiredError(account, added) {
+  const flags = added.map((k) => CAPABILITY_LABELS[k].flag);
+  const scopes = added.map((k) => CAPABILITY_LABELS[k].scope).join(", ");
+  return [
+    `'${account}' is already registered with the auth-broker, and its stored ` + `token does not carry ${scopes}.`,
+    "",
+    "OAuth scopes are fixed at consent time \u2014 a stored token cannot be",
+    "widened in place. Re-consent to mint a new token that includes it:",
+    "",
+    `  switchroom auth google account add ${account} --replace ${flags.join(" ")}`,
+    "",
+    "Scopes the account already holds are carried forward automatically,",
+    "so re-consenting will not drop existing capabilities."
+  ].join(`
+`);
+}
+function buildCarryForwardNotices(carried) {
+  return carried.map((k) => {
+    const { flag, scope, summary } = CAPABILITY_LABELS[k];
+    return `  Carrying forward ${summary} \u2014 the existing token holds ${scope}, ` + `so it is re-requested even though ${flag} was not passed ` + `(re-consent would otherwise silently revoke it).`;
+  });
+}
 function oauthClientSetupGuidance(reason) {
   return [
     reason,
@@ -78971,8 +78396,8 @@ async function readHiddenLine2(prompt) {
       stdin.setRawMode(true);
     }
     let line = "";
-    const onData = (chunk2) => {
-      const s = chunk2.toString("utf8");
+    const onData = (chunk) => {
+      const s = chunk.toString("utf8");
       for (const ch of s) {
         if (ch === `
 ` || ch === "\r") {
@@ -79901,7 +79326,7 @@ function getVaultPath2(configPath) {
     return resolvePath("~/.switchroom/vault.enc");
   }
 }
-function maskToken2(s) {
+function maskToken(s) {
   if (s.length >= 18)
     return `${s.slice(0, 6)}...${s.slice(-4)}`;
   return "***";
@@ -80189,7 +79614,7 @@ function registerVaultSweep(vault, program3) {
     console.log("");
     console.log(source_default.dim(`masked values for display only:`));
     for (const v of values) {
-      console.log(`  vault:${v.key} \u2192 ${maskToken2(v.value)}`);
+      console.log(`  vault:${v.key} \u2192 ${maskToken(v.value)}`);
     }
     if (opts.dryRun) {
       console.log(source_default.yellow("dry-run \u2014 no files modified. Rerun without --dry-run to apply."));
@@ -83162,8 +82587,8 @@ class VaultBroker {
       peer = this.testOpts._testIdentify ? this.testOpts._testIdentify(listenerSocketPath, socket) : identify(listenerSocketPath, socket);
     }
     let buffer = "";
-    socket.on("data", (chunk2) => {
-      buffer += chunk2.toString("utf8");
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
       if (Buffer.byteLength(buffer, "utf8") > MAX_FRAME_BYTES) {
         const resp = encodeResponse(errorResponse("BAD_REQUEST", "Frame exceeds 64 KiB limit"));
         socket.end(resp);
@@ -84272,8 +83697,8 @@ class VaultBroker {
     const auditCaller = isOperator ? "operator" : unlockPeer !== null ? callerFromPeer(unlockPeer) : `pid:${process.pid}`;
     const auditCgroup = isOperator ? undefined : unlockPeer?.systemdUnit ?? undefined;
     let buffer = "";
-    socket.on("data", (chunk2) => {
-      buffer += chunk2.toString("utf8");
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
       const newlineIdx = buffer.indexOf(`
 `);
       if (newlineIdx === -1) {
@@ -85840,7 +85265,7 @@ function promptLine2(prompt, hidden = false) {
 function readStdinToEnd() {
   return new Promise((resolve31, reject) => {
     const chunks = [];
-    process.stdin.on("data", (chunk2) => chunks.push(chunk2));
+    process.stdin.on("data", (chunk) => chunks.push(chunk));
     process.stdin.on("end", () => {
       resolve31(Buffer.concat(chunks).toString("utf8"));
     });
@@ -87518,6 +86943,595 @@ function formatCleanupPlan(plan, maxMerges = 10) {
 `);
 }
 
+// telegram-plugin/secret-detect/patterns.ts
+var ANCHORED_PATTERNS = [
+  { rule_id: "anthropic_api_key", regex: /\b(sk-ant-[A-Za-z0-9_-]{8,})\b/g, captureIndex: 1, slugHint: "anthropic_api_key" },
+  { rule_id: "anthropic_oauth_code", regex: /(?:^|\s)([A-Za-z0-9_-]{20,}#[A-Za-z0-9_-]{20,})(?=\s|$)/gm, captureIndex: 1, slugHint: "anthropic_oauth_code" },
+  { rule_id: "openai_api_key", regex: /\b(sk-[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "openai_api_key" },
+  { rule_id: "github_pat_classic", regex: /\b(ghp_[A-Za-z0-9]{20,})\b/g, captureIndex: 1, slugHint: "github_pat" },
+  { rule_id: "github_pat_fine_grained", regex: /\b(github_pat_[A-Za-z0-9_]{20,})\b/g, captureIndex: 1, slugHint: "github_pat" },
+  { rule_id: "slack_token", regex: /\b(xox[baprs]-[A-Za-z0-9-]{10,})\b/g, captureIndex: 1, slugHint: "slack_token" },
+  { rule_id: "slack_app_token", regex: /\b(xapp-[A-Za-z0-9-]{10,})\b/g, captureIndex: 1, slugHint: "slack_app_token" },
+  { rule_id: "groq_api_key", regex: /\b(gsk_[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "groq_api_key" },
+  { rule_id: "google_api_key", regex: /\b(AIza[0-9A-Za-z\-_]{20,})\b/g, captureIndex: 1, slugHint: "google_api_key" },
+  { rule_id: "perplexity_api_key", regex: /\b(pplx-[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "perplexity_api_key" },
+  { rule_id: "npm_token", regex: /\b(npm_[A-Za-z0-9]{10,})\b/g, captureIndex: 1, slugHint: "npm_token" },
+  { rule_id: "telegram_bot_token_prefixed", regex: /\bbot(\d{6,}:[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "telegram_bot_token" },
+  { rule_id: "telegram_bot_token", regex: /\b(\d{6,}:[A-Za-z0-9_-]{20,})\b/g, captureIndex: 1, slugHint: "telegram_bot_token" },
+  { rule_id: "laravel_sanctum_token", regex: /\b(\d+\|[A-Za-z0-9]{40,})\b/g, captureIndex: 1, slugHint: "api_token" },
+  { rule_id: "aws_access_key", regex: /\b(AKIA[0-9A-Z]{16})\b/g, captureIndex: 1, slugHint: "aws_access_key" },
+  { rule_id: "jwt", regex: /\b(eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b/g, captureIndex: 1, slugHint: "jwt" }
+];
+var STRUCTURED_PATTERNS = [
+  {
+    rule_id: "env_key_value",
+    regex: /\b([A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD))\b\s*[=:]\s*(["']?)([^\s"'\\]+)\2/g,
+    captureIndex: 3,
+    slugHint: "env"
+  },
+  {
+    rule_id: "json_secret_field",
+    regex: /"(?:apiKey|token|secret|password|passwd|accessToken|refreshToken)"\s*:\s*"([^"]+)"/g,
+    captureIndex: 1,
+    slugHint: "json_secret"
+  },
+  {
+    rule_id: "cli_flag",
+    regex: /--(?:api[-_]?key|hook[-_]?token|token|secret|password|passwd)\s+(["']?)([^\s"']+)\1/g,
+    captureIndex: 2,
+    slugHint: "cli_flag"
+  },
+  {
+    rule_id: "bearer_auth_header",
+    regex: /Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)/gi,
+    captureIndex: 1,
+    slugHint: "bearer_token"
+  },
+  {
+    rule_id: "bearer_loose",
+    regex: /\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b/gi,
+    captureIndex: 1,
+    slugHint: "bearer_token"
+  },
+  {
+    rule_id: "basic_auth_header",
+    regex: /Authorization\s*[:=]\s*Basic\s+([A-Za-z0-9+/=]{8,})/gi,
+    captureIndex: 1,
+    slugHint: "basic_auth"
+  },
+  {
+    rule_id: "pem_private_key",
+    regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----/g,
+    captureIndex: 0,
+    slugHint: "pem_private_key"
+  }
+];
+var PROVIDER_PATTERNS = [
+  { rule_id: "slack_webhook", regex: /(https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9_/]+)/g, captureIndex: 1, slugHint: "slack_webhook" },
+  { rule_id: "stripe_live_secret", regex: /\b(sk_live_[A-Za-z0-9]{24,})\b/g, captureIndex: 1, slugHint: "stripe_key" },
+  { rule_id: "stripe_restricted", regex: /\b(rk_live_[A-Za-z0-9]{24,})\b/g, captureIndex: 1, slugHint: "stripe_key" },
+  { rule_id: "sendgrid_api_key", regex: /\b(SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43})\b/g, captureIndex: 1, slugHint: "sendgrid_key" },
+  { rule_id: "gitlab_pat", regex: /\b(glpat-[A-Za-z0-9_-]{20})\b/g, captureIndex: 1, slugHint: "gitlab_pat" },
+  { rule_id: "huggingface_token", regex: /\b(hf_[A-Za-z0-9]{34,})\b/g, captureIndex: 1, slugHint: "huggingface_token" },
+  { rule_id: "twilio_api_key", regex: /\b(SK[0-9a-f]{32})\b/g, captureIndex: 1, slugHint: "twilio_api_key" },
+  { rule_id: "mailgun_key", regex: /\b(key-[0-9a-f]{32})\b/g, captureIndex: 1, slugHint: "mailgun_key" },
+  { rule_id: "digitalocean_pat", regex: /\b(dop_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
+  { rule_id: "digitalocean_oauth", regex: /\b(doo_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
+  { rule_id: "digitalocean_refresh", regex: /\b(dor_v1_[a-f0-9]{64})\b/g, captureIndex: 1, slugHint: "digitalocean_token" },
+  { rule_id: "doppler_token", regex: /\b(dp\.(?:pt|st|ct|sa|scim|audit)\.[A-Za-z0-9]{40,44})\b/g, captureIndex: 1, slugHint: "doppler_token" },
+  { rule_id: "linear_api_key", regex: /\b(lin_api_[A-Za-z0-9]{40})\b/g, captureIndex: 1, slugHint: "linear_api_key" },
+  { rule_id: "shopify_access_token", regex: /\b(shpat_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
+  { rule_id: "shopify_shared_secret", regex: /\b(shpss_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
+  { rule_id: "shopify_private_app", regex: /\b(shppa_[a-fA-F0-9]{32})\b/g, captureIndex: 1, slugHint: "shopify_token" },
+  { rule_id: "square_access_token", regex: /\b(sq0atp-[A-Za-z0-9_-]{22})\b/g, captureIndex: 1, slugHint: "square_token" },
+  { rule_id: "square_oauth_secret", regex: /\b(sq0csp-[A-Za-z0-9_-]{43})\b/g, captureIndex: 1, slugHint: "square_token" },
+  { rule_id: "newrelic_key", regex: /\b(NRAK-[A-Z0-9]{27})\b/g, captureIndex: 1, slugHint: "newrelic_key" },
+  { rule_id: "notion_token", regex: /\b(ntn_[A-Za-z0-9]{46})\b/g, captureIndex: 1, slugHint: "notion_token" },
+  { rule_id: "planetscale_password", regex: /\b(pscale_pw_[A-Za-z0-9_.-]{43})\b/g, captureIndex: 1, slugHint: "planetscale_token" },
+  { rule_id: "planetscale_token", regex: /\b(pscale_tkn_[A-Za-z0-9_.-]{43})\b/g, captureIndex: 1, slugHint: "planetscale_token" },
+  { rule_id: "supabase_service_key", regex: /\b(sbp_[a-f0-9]{40})\b/g, captureIndex: 1, slugHint: "supabase_key" },
+  { rule_id: "atlassian_token", regex: /\b(ATATT[A-Za-z0-9_\-=]{20,})\b/g, captureIndex: 1, slugHint: "atlassian_token" },
+  { rule_id: "dropbox_token", regex: /\b(sl\.[A-Za-z0-9_-]{130,})/g, captureIndex: 1, slugHint: "dropbox_token" },
+  { rule_id: "databricks_token", regex: /\b(dapi[a-f0-9]{32})\b/g, captureIndex: 1, slugHint: "databricks_token" },
+  { rule_id: "grafana_service_account", regex: /\b(glsa_[A-Za-z0-9]{32}_[a-fA-F0-9]{8})\b/g, captureIndex: 1, slugHint: "grafana_token" },
+  { rule_id: "pypi_token", regex: /\b(pypi-AgEIcHlwaS[A-Za-z0-9_-]{50,})/g, captureIndex: 1, slugHint: "pypi_token" },
+  { rule_id: "aws_temp_access_key", regex: /\b(ASIA[0-9A-Z]{16})\b/g, captureIndex: 1, slugHint: "aws_access_key" },
+  { rule_id: "gcp_oauth_token", regex: /\b(ya29\.[A-Za-z0-9_-]{30,})/g, captureIndex: 1, slugHint: "gcp_oauth_token" }
+];
+var ALL_PATTERNS = [...ANCHORED_PATTERNS, ...PROVIDER_PATTERNS, ...STRUCTURED_PATTERNS];
+
+// telegram-plugin/secret-detect/entropy.ts
+function shannonEntropy(s) {
+  if (s.length === 0)
+    return 0;
+  const counts = new Map;
+  for (const ch of s) {
+    counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  }
+  let h = 0;
+  const len = s.length;
+  for (const c of counts.values()) {
+    const p = c / len;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
+
+// telegram-plugin/secret-detect/inert-values.ts
+var INERT_VALUE_RE = [
+  /^\[REDACTED(?::[A-Za-z0-9_]+)?\]$/i,
+  /^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/,
+  /^\{\{[^\n\r\u2028\u2029]*\}\}$/,
+  /^<[^<>\n\r\u2028\u2029]*>$/,
+  /^%[A-Za-z_][A-Za-z0-9_]*%$/,
+  /^vault:[A-Za-z0-9_./-]*$/i,
+  /^[*x\u2022.]+$/i,
+  /^(?:process\.env|import\.meta\.env|os\.environ)(?:\.[A-Za-z_$][A-Za-z0-9_$]*|\[["']?[A-Za-z_$][A-Za-z0-9_$]*["']?\])*$/,
+  /^(?:changeme|change-me|replaceme|replace-me|placeholder|todo|tbd|yourkey|your-key|yourpassword|your-password|yoursecret|your-secret|yourtoken|your-token)(?:[-_][A-Za-z0-9-]+)?$/i,
+  /^[a-z]+(?: [a-z]+){2,}$/
+];
+var CREDENTIAL_RUN_RE = /[A-Za-z0-9]{12,}/g;
+var MIXED_CLASS_RUN_MIN = 12;
+var SINGLE_CLASS_RUN_MIN = 16;
+function runIsCredentialShaped(run) {
+  let classes = 0;
+  if (/[a-z]/.test(run))
+    classes++;
+  if (/[A-Z]/.test(run))
+    classes++;
+  if (/[0-9]/.test(run))
+    classes++;
+  return run.length >= (classes >= 2 ? MIXED_CLASS_RUN_MIN : SINGLE_CLASS_RUN_MIN);
+}
+function hasCredentialShapedRun(value) {
+  for (const run of value.match(CREDENTIAL_RUN_RE) ?? []) {
+    if (runIsCredentialShaped(run))
+      return true;
+  }
+  return false;
+}
+function isInertValue(value) {
+  if (!INERT_VALUE_RE.some((re) => re.test(value)))
+    return false;
+  return !hasCredentialShapedRun(value);
+}
+var INERT_GATED_RULES = new Set([
+  "env_key_value",
+  "json_secret_field",
+  "cli_flag"
+]);
+var TRAILING_PUNCT_RE = /[.,;:!?)\]}]+$/;
+function stripTrailingPunctuation(value) {
+  return value.replace(TRAILING_PUNCT_RE, "");
+}
+
+// telegram-plugin/secret-detect/kv-scanner.ts
+var KV_RE = /\b([A-Za-z_][A-Za-z0-9_-]*(?:password|passwd|token|secret|key|api[_-]?key))\s*[:=]\s*["']?([^\s"'\\]{8,})["']?/gi;
+var KV_ENTROPY_THRESHOLD = 4;
+var MEMORABLE_PW_RE = /\b([A-Za-z0-9_-]*(?:password|passwd|passphrase|pwd))\b\s*(?:[:=]\s*|\s+is\s+)(["']?)([^\s"']{8,64})\2/gi;
+var MEMORABLE_PW_RULE_ID = "memorable_password";
+var MEMORABLE_PW_MIN_CLASSES = 2;
+function charClassCount(value) {
+  let n = 0;
+  if (/[a-z]/.test(value))
+    n++;
+  if (/[A-Z]/.test(value))
+    n++;
+  if (/[0-9]/.test(value))
+    n++;
+  if (/[^A-Za-z0-9]/.test(value))
+    n++;
+  return n;
+}
+function looksLikeMemorablePassword(value) {
+  if (isInertValue(value))
+    return false;
+  const core = stripTrailingPunctuation(value);
+  if (core.length < 8 || core.length > 64)
+    return false;
+  if (isInertValue(core))
+    return false;
+  if (new Set(core).size < 4)
+    return false;
+  return charClassCount(core) >= MEMORABLE_PW_MIN_CLASSES;
+}
+function scanMemorablePasswords(text) {
+  const hits = [];
+  MEMORABLE_PW_RE.lastIndex = 0;
+  let m;
+  while ((m = MEMORABLE_PW_RE.exec(text)) !== null) {
+    const keyName = m[1];
+    const value = m[3];
+    if (!value || !looksLikeMemorablePassword(value))
+      continue;
+    const valueOffsetInMatch = m[0].indexOf(value, keyName.length);
+    if (valueOffsetInMatch < 0)
+      continue;
+    const start = m.index + valueOffsetInMatch;
+    hits.push({
+      rule_id: MEMORABLE_PW_RULE_ID,
+      start,
+      end: start + value.length,
+      matched_text: value,
+      key_name: keyName,
+      confidence: "ambiguous"
+    });
+  }
+  return hits;
+}
+function scanKeyValue(text) {
+  const hits = [];
+  KV_RE.lastIndex = 0;
+  let m;
+  while ((m = KV_RE.exec(text)) !== null) {
+    const [, keyName, value] = m;
+    if (!value)
+      continue;
+    if (isInertValue(value))
+      continue;
+    const h = shannonEntropy(value);
+    if (h < KV_ENTROPY_THRESHOLD)
+      continue;
+    const valueOffsetInMatch = m[0].indexOf(value, keyName.length);
+    if (valueOffsetInMatch < 0)
+      continue;
+    const start = m.index + valueOffsetInMatch;
+    const end = start + value.length;
+    hits.push({
+      rule_id: "kv_entropy",
+      start,
+      end,
+      matched_text: value,
+      key_name: keyName,
+      confidence: "ambiguous"
+    });
+  }
+  return hits;
+}
+
+// telegram-plugin/secret-detect/db-uri.ts
+var DB_URI_RE = /\b([a-zA-Z][a-zA-Z0-9+.-]+):\/\/([^\s:/@]+):([^\s/?#]+)@([^\s/@?#]+)/g;
+var DB_URI_RULE_ID = "db_uri_password";
+function isInertPassword(value) {
+  if (value.startsWith("[REDACTED"))
+    return true;
+  return /^[*x]+$/i.test(value);
+}
+function scanDbUris(text) {
+  const hits = [];
+  DB_URI_RE.lastIndex = 0;
+  let m;
+  while ((m = DB_URI_RE.exec(text)) !== null) {
+    const scheme = m[1];
+    const user = m[2];
+    const password = m[3];
+    if (isInertPassword(password))
+      continue;
+    const start = m.index + scheme.length + 3 + user.length + 1;
+    hits.push({
+      rule_id: DB_URI_RULE_ID,
+      start,
+      end: start + password.length,
+      matched_text: password,
+      key_name: `${scheme}_password`,
+      confidence: "ambiguous"
+    });
+  }
+  return hits;
+}
+
+// telegram-plugin/secret-detect/generic-entropy.ts
+var CANDIDATE_RE = /[A-Za-z0-9]{28,}/g;
+var GENERIC_MIN_DISTINCT = 18;
+var MAX_GENERIC_HITS = 20;
+function hasDistinctChars(tok, n) {
+  const seen = new Uint8Array(128);
+  let distinct = 0;
+  for (let i = 0;i < tok.length; i++) {
+    const c = tok.charCodeAt(i);
+    if (seen[c] === 0) {
+      seen[c] = 1;
+      if (++distinct >= n)
+        return true;
+    }
+  }
+  return false;
+}
+function hasDigit(tok) {
+  for (let i = 0;i < tok.length; i++) {
+    const c = tok.charCodeAt(i);
+    if (c >= 48 && c <= 57)
+      return true;
+  }
+  return false;
+}
+function scanGenericSecrets(text) {
+  const hits = [];
+  CANDIDATE_RE.lastIndex = 0;
+  let m;
+  while ((m = CANDIDATE_RE.exec(text)) !== null) {
+    if (hits.length >= MAX_GENERIC_HITS)
+      break;
+    const tok = m[0];
+    if (!hasDigit(tok))
+      continue;
+    if (!hasDistinctChars(tok, GENERIC_MIN_DISTINCT))
+      continue;
+    hits.push({
+      rule_id: "generic_high_entropy",
+      start: m.index,
+      end: m.index + tok.length,
+      matched_text: tok,
+      confidence: "ambiguous"
+    });
+  }
+  return hits;
+}
+
+// telegram-plugin/secret-detect/chunker.ts
+var CHUNK_THRESHOLD = 32 * 1024;
+var WINDOW_SIZE = 16 * 1024;
+var OVERLAP = 8 * 1024;
+function chunk(text) {
+  if (text.length <= CHUNK_THRESHOLD) {
+    return [{ offset: 0, text }];
+  }
+  const out = [];
+  let offset = 0;
+  while (offset < text.length) {
+    const end = Math.min(offset + WINDOW_SIZE, text.length);
+    out.push({ offset, text: text.slice(offset, end) });
+    if (end >= text.length)
+      break;
+    offset = end - OVERLAP;
+  }
+  return out;
+}
+
+// telegram-plugin/secret-detect/suppressor.ts
+var MARKERS = ["test", "mock", "example", "fixture", "dummy"];
+var WINDOW = 40;
+var MARKER_RE = new RegExp(`\\b(?:${MARKERS.join("|")})\\b`, "i");
+function isSuppressed(text, start, end) {
+  const left = Math.max(0, start - WINDOW);
+  const right = Math.min(text.length, end + WINDOW);
+  const context = text.slice(left, start) + text.slice(end, right);
+  return MARKER_RE.test(context);
+}
+
+// telegram-plugin/secret-detect/slug.ts
+function sanitizeKeyName(raw) {
+  const up = raw.toUpperCase();
+  const cleaned = up.replace(/[^A-Z0-9_]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
+  return cleaned.length > 0 ? cleaned : "SECRET";
+}
+function datePart(now = new Date) {
+  const y = now.getUTCFullYear();
+  const m = String(now.getUTCMonth() + 1).padStart(2, "0");
+  const d = String(now.getUTCDate()).padStart(2, "0");
+  return `${y}${m}${d}`;
+}
+function deriveSlug(inputs, existing) {
+  let base;
+  if (inputs.key_name && inputs.key_name.trim().length > 0) {
+    base = sanitizeKeyName(inputs.key_name);
+  } else {
+    base = `${inputs.rule_id}_${datePart(inputs.now)}`;
+  }
+  if (!existing.has(base))
+    return base;
+  let n = 2;
+  while (existing.has(`${base}_${n}`))
+    n++;
+  return `${base}_${n}`;
+}
+// telegram-plugin/secret-detect/url-redact.ts
+var SENSITIVE_PARAMS = new Set([
+  "token",
+  "key",
+  "api_key",
+  "apikey",
+  "secret",
+  "access_token",
+  "password",
+  "pass",
+  "auth",
+  "client_secret",
+  "refresh_token",
+  "signature"
+]);
+var URL_RE = /\b(?:https?|wss?|ftp):\/\/[^\s<>"']+/gi;
+function redactUrls(text) {
+  return text.replace(URL_RE, (m) => {
+    const redacted = redactOne(m);
+    return redacted ?? m;
+  });
+}
+function redactOne(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return null;
+  }
+  let changed = false;
+  if (u.username || u.password) {
+    u.username = "***";
+    u.password = "";
+    changed = true;
+  }
+  for (const [key] of u.searchParams) {
+    if (SENSITIVE_PARAMS.has(key.toLowerCase())) {
+      u.searchParams.set(key, "***");
+      changed = true;
+    }
+  }
+  return changed ? u.toString() : null;
+}
+
+// telegram-plugin/secret-detect/index.ts
+function detectSecrets(text) {
+  if (!text || text.length === 0)
+    return [];
+  const windows = chunk(text);
+  const raw = [];
+  for (const win of windows) {
+    for (const p of ALL_PATTERNS) {
+      const re = new RegExp(p.regex.source, p.regex.flags.includes("g") ? p.regex.flags : p.regex.flags + "g");
+      let m;
+      while ((m = re.exec(win.text)) !== null) {
+        if (m[0].length === 0) {
+          re.lastIndex++;
+          continue;
+        }
+        const cap = p.captureIndex === 0 ? m[0] : m[p.captureIndex];
+        if (!cap)
+          continue;
+        const matchStart = p.captureIndex === 0 ? m.index : m.index + m[0].indexOf(cap);
+        if (matchStart < 0)
+          continue;
+        const globalStart = win.offset + matchStart;
+        const globalEnd = globalStart + cap.length;
+        const keyName = p.rule_id === "env_key_value" ? m[1] : undefined;
+        if (INERT_GATED_RULES.has(p.rule_id) && isInertValue(cap))
+          continue;
+        if (p.rule_id === "env_key_value") {
+          const ENV_KV_MIN_LEN = 12;
+          const ENV_KV_MIN_ENTROPY = 3.5;
+          if (cap.length < ENV_KV_MIN_LEN)
+            continue;
+          if (shannonEntropy(cap) < ENV_KV_MIN_ENTROPY)
+            continue;
+        }
+        raw.push({
+          rule_id: p.rule_id,
+          start: globalStart,
+          end: globalEnd,
+          matched_text: cap,
+          key_name: keyName,
+          confidence: "high"
+        });
+      }
+    }
+    const kvHits = scanKeyValue(win.text);
+    for (const h of kvHits) {
+      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
+    }
+    for (const h of scanDbUris(win.text)) {
+      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
+    }
+    for (const h of scanMemorablePasswords(win.text)) {
+      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
+    }
+    const genHits = scanGenericSecrets(win.text);
+    for (const h of genHits) {
+      raw.push({ ...h, start: h.start + win.offset, end: h.end + win.offset });
+    }
+  }
+  const deduped = dedupeRaw(raw);
+  const final = dropOverlaps(deduped);
+  const existing = new Set;
+  const out = [];
+  for (const h of final) {
+    const suggested_slug = deriveSlug({ key_name: h.key_name, rule_id: h.rule_id }, existing);
+    existing.add(suggested_slug);
+    out.push({
+      rule_id: h.rule_id,
+      matched_text: h.matched_text,
+      start: h.start,
+      end: h.end,
+      confidence: h.confidence,
+      suppressed: isSuppressed(text, h.start, h.end),
+      suggested_slug,
+      key_name: h.key_name
+    });
+  }
+  out.sort((a, b) => a.start - b.start);
+  return out;
+}
+function dedupeRaw(raw) {
+  const seen = new Map;
+  for (const h of raw) {
+    const key = `${h.start}:${h.end}`;
+    const existing = seen.get(key);
+    if (!existing) {
+      seen.set(key, h);
+      continue;
+    }
+    if (existing.confidence === "ambiguous" && h.confidence === "high") {
+      seen.set(key, h);
+    }
+  }
+  return Array.from(seen.values());
+}
+function dropOverlaps(hits) {
+  const out = hits.filter((h) => !(h.confidence === "ambiguous" && hits.some((o) => o !== h && o.start <= h.start && o.end >= h.end && !(o.start === h.start && o.end === h.end))));
+  out.sort((a, b) => a.start - b.start || a.end - b.end);
+  return out;
+}
+
+// telegram-plugin/secret-detect/redact.ts
+var REDACTED_MARKER = "[REDACTED]";
+function redact(text) {
+  if (!text || text.length === 0)
+    return text;
+  const urlScrubbed = redactUrls(text);
+  const hits = detectSecrets(urlScrubbed).filter((h) => h.rule_id !== "generic_high_entropy");
+  if (hits.length === 0)
+    return urlScrubbed;
+  const sorted = [...hits].sort((a, b) => b.start - a.start);
+  let out = urlScrubbed;
+  for (const h of sorted) {
+    out = out.slice(0, h.start) + redactedMarker(h.rule_id) + out.slice(h.end);
+  }
+  return out;
+}
+function redactedMarker(ruleId) {
+  const trimmed = ruleId.replace(/^(kv|env)_/, "");
+  if (!trimmed || trimmed === "key_value" || trimmed === "kv_entropy") {
+    return REDACTED_MARKER;
+  }
+  return `[REDACTED:${trimmed}]`;
+}
+// src/memory/hindsight-write-redaction.ts
+function redactJsonStrings(value) {
+  if (typeof value === "string")
+    return redact(value);
+  if (Array.isArray(value))
+    return value.map(redactJsonStrings);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redactJsonStrings(v);
+    }
+    return out;
+  }
+  return value;
+}
+var REDACTED_ITEM_FIELDS = ["content", "context"];
+function redactMemoryWriteBody(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body))
+    return body;
+  const src = body;
+  if (!Array.isArray(src.items))
+    return body;
+  const items = src.items.map((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item))
+      return item;
+    const row = { ...item };
+    for (const field of REDACTED_ITEM_FIELDS) {
+      if (typeof row[field] === "string") {
+        row[field] = redact(row[field]);
+      }
+    }
+    if (row.metadata && typeof row.metadata === "object") {
+      row.metadata = redactJsonStrings(row.metadata);
+    }
+    return row;
+  });
+  return { ...src, items };
+}
+
 // src/cli/memory.ts
 init_helpers();
 init_hindsight();
@@ -97162,14 +97176,10 @@ function registerHandoffCommand(program3) {
       jsonlPath: jsonl,
       agentDir,
       agentName,
-      maxTurns: cappedMaxTurns,
-      observationScopes: agentConfig?.memory?.observation_scopes
+      maxTurns: cappedMaxTurns
     });
     process.stderr.write(`handoff: ${status}
 `);
-    if (status === HANDOFF_STATUS_MIRROR_SKIPPED) {
-      process.exitCode = 1;
-    }
     const retention = pruneSessionJsonl(claudeConfigDir, {
       maxCount: continuity?.session_retention_max_count ?? DEFAULT_SESSION_RETENTION_MAX_COUNT,
       maxAgeDays: continuity?.session_retention_max_age_days ?? DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS,
@@ -100240,12 +100250,25 @@ function findMissingWorkspaceScopes(seedScope, tier) {
   return requiredWorkspaceScopesForTier(tier).filter((s) => !have.has(s));
 }
 var DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
-function buildMissingScopeWarning(missing, tier, accountEmail, hasWriteScope) {
+var CALENDAR_READONLY_SCOPE = "https://www.googleapis.com/auth/calendar.readonly";
+function seedOptInCapabilities(seedScope) {
+  const have = new Set(seedScope.split(/\s+/).map((s) => s.trim()).filter((s) => s.length > 0));
+  return {
+    write: have.has(DRIVE_FILE_SCOPE),
+    calendar: have.has(CALENDAR_READONLY_SCOPE)
+  };
+}
+function buildMissingScopeWarning(missing, tier, accountEmail, granted) {
   const short = missing.map((s) => s.replace(/^https:\/\/www\.googleapis\.com\/auth\//, "")).join(", ");
+  const suffix = (granted.write ? " --write" : "") + (granted.calendar ? " --calendar" : "");
+  const preserved = [
+    granted.write ? "--write preserves the existing Drive write capability" : "",
+    granted.calendar ? "--calendar preserves the existing Calendar read capability" : ""
+  ].filter((s) => s.length > 0);
   return `drive-mcp-launcher: WARNING \u2014 the Google account '${accountEmail}' was ` + `consented WITHOUT the scope(s) needed for tier '${tier ?? "core"}': ` + `${short}.
 ` + `  The matching MCP tools (Docs / Sheets / Slides create+edit) will FAIL ` + `to authenticate. OAuth scopes are fixed at consent time \u2014 re-run on the ` + `host to re-mint the token with the correct scopes:
-` + `    switchroom auth google account add ${accountEmail} --replace` + `${hasWriteScope ? " --write" : ""}
-` + `  (scopes are derived from \`google_workspace.tier\` \u2014 set the tier ` + `before re-running${hasWriteScope ? "; --write preserves the existing " + "Drive write capability" : ""}). Drive read/file tools are unaffected.
+` + `    switchroom auth google account add ${accountEmail} --replace` + `${suffix}
+` + `  (scopes are derived from \`google_workspace.tier\` \u2014 set the tier ` + `before re-running${preserved.length > 0 ? "; " + preserved.join("; ") : ""}` + `). Drive read/file tools are unaffected.
 `;
 }
 function buildUvxArgs(tier) {
@@ -100493,8 +100516,7 @@ async function runDriveMcpLauncher(opts) {
   const tier = opts.tier ?? configSecrets.tier;
   const missingScopes = findMissingWorkspaceScopes(brokerCreds.scope, tier);
   if (missingScopes.length > 0) {
-    const hasWriteScope = brokerCreds.scope.split(/\s+/).map((s) => s.trim()).includes(DRIVE_FILE_SCOPE);
-    process.stderr.write(buildMissingScopeWarning(missingScopes, tier, brokerCreds.accountEmail, hasWriteScope));
+    process.stderr.write(buildMissingScopeWarning(missingScopes, tier, brokerCreds.accountEmail, seedOptInCapabilities(brokerCreds.scope)));
   }
   const args = buildUvxArgs(tier);
   const env2 = buildChildEnv(process.env, credentialsDir, brokerCreds.accountEmail);