switchroom 0.20.0 → 0.20.1

package/dist/host-control/main.js

@@ -11387,7 +11387,7 @@ var init_schema = __esm(() => {
     default_channel_id: exports_external.string().describe("Relay-minted group UUID (the NIP-29 `h` tag) the sidecar subscribes " + "to and stamps on injected turns."),
     channel_map: exports_external.record(exports_external.string(), exports_external.string()).default({}).describe("Optional map of extra group UUIDs → friendly labels."),
     pubkey_names: exports_external.record(exports_external.string(), exports_external.string()).default({}).describe("Optional petnames: hex/npub pubkey → display name, used to label " + "the sender on injected turns."),
-    pinned_relay_digest: exports_external.string().optional().describe("Pinned relay image digest (M4). The compat-check warns on mismatch; " + "advisory in Phase 1.")
+    pinned_relay_digest: exports_external.string().optional().describe("Pinned relay image digest (M4). RESERVED — no consumer of this field " + "exists; the existing compat-check (compat-check.ts) validates only " + "the wire contract (AUTH kind, message kind, tag names) and does not " + "read this field. Kept in the schema so the intended digest-pin can " + "be wired without a config shape change.")
   }).strict();
   ChannelsSchema = exports_external.object({
     telegram: TelegramChannelSchema,
@@ -21432,7 +21432,7 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.20.0";
+var VERSION = "0.20.1";
 
 // src/setup/hindsight-recall-tunables.ts
 var RECALL_DEADLINE_HEADROOM_SECONDS = 2;
@@ -28372,6 +28372,20 @@ function resolveOperatorUid(ownershipDeps = {}) {
 // src/cli/rollout.ts
 init_atomic();
 
+// src/config/hostd-template-version.ts
+var HOSTD_TEMPLATE_LAST_CHANGED = "v0.19.43";
+function hostdTemplateRegenVerdict(target, fromVersion) {
+  const cmpTarget = compareReleaseTags(HOSTD_TEMPLATE_LAST_CHANGED, target);
+  if (cmpTarget === null)
+    return "unknown";
+  const cmpFrom = compareReleaseTags(HOSTD_TEMPLATE_LAST_CHANGED, fromVersion);
+  if (cmpFrom === null)
+    return "unknown";
+  const targetHas = cmpTarget <= 0;
+  const fromHas = cmpFrom <= 0;
+  return targetHas === fromHas ? "not-needed" : "required";
+}
+
 // src/cli/resolve-version.ts
 import { existsSync as existsSync14, readFileSync as readFileSync10 } from "node:fs";
 import { dirname as dirname7, join as join9 } from "node:path";
@@ -29733,12 +29747,31 @@ function etaLine(s) {
   const meanMs = done.reduce((t, a) => t + (a.durationMs ?? 0), 0) / done.length;
   return `~${formatDurationMs(meanMs * remaining)} left (rough est.)`;
 }
-function deferredLines(target) {
+function deferredLines(target, fromVersion) {
   const bare = target.trim().replace(/^v/, "");
-  return [
+  const head = [
     `**Verified on ${target}** — every component this roll owned passed \`verify-components\`, so this is host convergence, not just the agents. Anything the roll was told to skip is named in its warnings.`,
-    `**Still host-side (nothing in a roll can do these):**`,
-    `- host operator CLI — \`sudo npm i -g switchroom@${bare}\``,
+    `**Still host-side (nothing in a roll can do these):**`
+  ];
+  const verdict = hostdTemplateRegenVerdict(target, fromVersion);
+  if (verdict === "required") {
+    return [
+      ...head,
+      `- host operator CLI + hostd template regen — regen is **REQUIRED** for this roll (hostd mounts/env changed in ${HOSTD_TEMPLATE_LAST_CHANGED}). One copy-paste:`,
+      `  \`sudo npm i -g switchroom@${bare} && switchroom hostd install --tag ${target}\``
+    ];
+  }
+  const cliLine = `- host operator CLI — \`sudo npm i -g switchroom@${bare}\``;
+  if (verdict === "not-needed") {
+    return [
+      ...head,
+      cliLine,
+      `- hostd template regen: **not needed** for this release — hostd mounts/env unchanged since ${HOSTD_TEMPLATE_LAST_CHANGED}.`
+    ];
+  }
+  return [
+    ...head,
+    cliLine,
     `- hostd template regen (only if the release changed hostd mounts/env) — \`switchroom hostd install --tag ${target}\``
   ];
 }
@@ -29782,7 +29815,7 @@ function renderWith(s, compact) {
     if (warnings.length > 0)
       parts2.push("", ...warnings);
     if (s.deferred !== false)
-      parts2.push("", ...deferredLines(s.target));
+      parts2.push("", ...deferredLines(s.target, s.fromVersion));
     return parts2.join(`
 `);
   }
@@ -32851,7 +32884,7 @@ class LogTailRolloutNarrator {
       case "hindsight-refresh":
       case "hindsight-refresh-done":
       case "hindsight-skipped":
-        return Number.MAX_SAFE_INTEGER - 3;
+        return 1;
       case "hostd-web-deferred":
         return Number.MAX_SAFE_INTEGER - 1;
       default:

package/dist/vault/approvals/kernel-server.js

@@ -4827,7 +4827,7 @@ var init_schema = __esm(() => {
     default_channel_id: exports_external.string().describe("Relay-minted group UUID (the NIP-29 `h` tag) the sidecar subscribes " + "to and stamps on injected turns."),
     channel_map: exports_external.record(exports_external.string(), exports_external.string()).default({}).describe("Optional map of extra group UUIDs → friendly labels."),
     pubkey_names: exports_external.record(exports_external.string(), exports_external.string()).default({}).describe("Optional petnames: hex/npub pubkey → display name, used to label " + "the sender on injected turns."),
-    pinned_relay_digest: exports_external.string().optional().describe("Pinned relay image digest (M4). The compat-check warns on mismatch; " + "advisory in Phase 1.")
+    pinned_relay_digest: exports_external.string().optional().describe("Pinned relay image digest (M4). RESERVED — no consumer of this field " + "exists; the existing compat-check (compat-check.ts) validates only " + "the wire contract (AUTH kind, message kind, tag names) and does not " + "read this field. Kept in the schema so the intended digest-pin can " + "be wired without a config shape change.")
   }).strict();
   ChannelsSchema = exports_external.object({
     telegram: TelegramChannelSchema,

package/dist/vault/broker/server.js

@@ -4423,7 +4423,7 @@ var init_schema = __esm(() => {
     default_channel_id: exports_external.string().describe("Relay-minted group UUID (the NIP-29 `h` tag) the sidecar subscribes " + "to and stamps on injected turns."),
     channel_map: exports_external.record(exports_external.string(), exports_external.string()).default({}).describe("Optional map of extra group UUIDs → friendly labels."),
     pubkey_names: exports_external.record(exports_external.string(), exports_external.string()).default({}).describe("Optional petnames: hex/npub pubkey → display name, used to label " + "the sender on injected turns."),
-    pinned_relay_digest: exports_external.string().optional().describe("Pinned relay image digest (M4). The compat-check warns on mismatch; " + "advisory in Phase 1.")
+    pinned_relay_digest: exports_external.string().optional().describe("Pinned relay image digest (M4). RESERVED — no consumer of this field " + "exists; the existing compat-check (compat-check.ts) validates only " + "the wire contract (AUTH kind, message kind, tag names) and does not " + "read this field. Kept in the schema so the intended digest-pin can " + "be wired without a config shape change.")
   }).strict();
   ChannelsSchema = exports_external.object({
     telegram: TelegramChannelSchema,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
     "test:vitest": "vitest run",
     "test:bun": "bun test telegram-plugin/tests/agent-state-dir-preload.test.ts telegram-plugin/tests/catch-all-forwarded-history.test.ts src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-scope-persist.test.ts src/vault/broker/server-tokenless-scope.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/self-approval-bypass.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/boot-briefing-builder.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-buzz-dedup.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/rollout-narration-edit-socket.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:watch": "vitest",
-    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-test-runner-coverage.mjs && node scripts/check-bun-module-mock-scope.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-auth-test-hermeticity.mjs && node scripts/check-agent-state-dir-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-mcp-instructions-budget.mjs && node scripts/check-web-subscription-honest.mjs && node scripts/check-no-unpinned-npx-playwright.mjs && node scripts/check-gateway-line-ratchet.mjs && node scripts/check-retry-flood-hooks.mjs && node scripts/check-callback-ctx-wrapping.mjs && node scripts/check-status-pin-single-path.mjs && node scripts/check-litellm-config-guard.mjs && node scripts/check-release-asset-names.mjs && node scripts/check-agent-attribution-trailers.mjs && node scripts/check-hindsight-write-redaction.mjs && bun scripts/check-secret-pattern-parity.ts",
+    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-test-runner-coverage.mjs && node scripts/check-bun-module-mock-scope.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-auth-test-hermeticity.mjs && node scripts/check-agent-state-dir-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-mcp-instructions-budget.mjs && node scripts/check-web-subscription-honest.mjs && node scripts/check-no-unpinned-npx-playwright.mjs && node scripts/check-gateway-line-ratchet.mjs && node scripts/check-retry-flood-hooks.mjs && node scripts/check-callback-ctx-wrapping.mjs && node scripts/check-status-pin-single-path.mjs && node scripts/check-litellm-config-guard.mjs && node scripts/check-release-asset-names.mjs && node scripts/check-agent-attribution-trailers.mjs && node scripts/check-hindsight-write-redaction.mjs && bun scripts/check-secret-pattern-parity.ts && bun scripts/check-hostd-template-guard.ts",
     "lint:tsc": "tsc --noEmit",
     "lint:hindsight-write-redaction": "node scripts/check-hindsight-write-redaction.mjs",
     "lint:secret-pattern-parity": "bun scripts/check-secret-pattern-parity.ts",
@@ -50,6 +50,7 @@
     "lint:litellm-config-guard": "node scripts/check-litellm-config-guard.mjs",
     "lint:release-asset-contract": "node scripts/check-release-asset-names.mjs",
     "lint:agent-attribution-trailers": "node scripts/check-agent-attribution-trailers.mjs",
+    "lint:hostd-template-guard": "bun scripts/check-hostd-template-guard.ts",
     "prepublishOnly": "npm run build && npm run lint && npm test"
   },
   "dependencies": {

package/profiles/_base/start.sh.hbs

@@ -70,6 +70,21 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
   export SWITCHROOM_SESSION_BRIEFING="{{#if sessionBriefingMode}}{{{sessionBriefingMode}}}{{else}}legacy{{/if}}"
   export SWITCHROOM_RESUME_MODE="{{#if resumeMode}}{{{resumeMode}}}{{else}}handoff{{/if}}"
 
+{{#if hindsightEnabled}}
+  # Hindsight endpoint for the gateway boot briefing (session_continuity.briefing:
+  # gateway). When assembling the fresh-session reorientation briefing the gateway
+  # daemon does its OWN Hindsight recall — mirroring bin/handoff-briefing.sh — to
+  # fold recent memory into the briefing alongside the durable Telegram history.
+  # The authoritative exports live in the inner pass (~line 893), AFTER the
+  # gateway fork below, so without this hoist the forked daemon never sees the
+  # endpoint and the Hindsight section silently no-ops for every boot (same
+  # start.sh env-fork landmine as SWITCHROOM_SESSION_BRIEFING above). Hoist both
+  # here, before the fork; idempotent with the inner-pass exports (same rendered
+  # template values). Pinned by tests/scaffold.gateway-env-order.test.ts.
+  export HINDSIGHT_API_URL={{{hindsightApiBaseUrlQ}}}
+  export HINDSIGHT_BANK_ID={{{hindsightBankIdQ}}}
+{{/if}}
+
   # Force-fresh suppression signal for the gateway boot briefing. The gateway
   # suppresses the briefing when this boot is a /reset·/new fresh start —
   # re-feeding the just-reset conversation into the fresh session would defeat
@@ -450,6 +465,32 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
 
   _gateway_bundle=/opt/switchroom/telegram-plugin/dist/gateway/gateway.js
   _telegram_enabled={{#if telegramEnabledFlag}}{{telegramEnabledFlag}}{{else}}true{{/if}}
+
+  # Version-skew handshake for the gateway boot briefing (#4245). This start.sh
+  # is fresh; the deployed /opt/switchroom gateway bundle may NOT be. When it
+  # sets briefing=gateway it also skips the legacy shell handoff-briefing
+  # assembler (inner pass, below) — so if the bundle PREDATES the boot-briefing
+  # builder, BOTH paths are dead and the agent gets a SILENT no-briefing until
+  # the image is updated. The stale bundle cannot self-report a feature it lacks,
+  # so this fresh start.sh does the handshake: grep the bundle for the capability
+  # sentinel the builder exports (GATEWAY_BOOT_BRIEFING_CAPABILITY in
+  # telegram-plugin/gateway/boot-briefing-capability.ts; the bundle is built
+  # un-minified so the literal survives verbatim). On a miss, warn LOUDLY and
+  # drop a marker so the inner pass runs the legacy handoff assembler as a
+  # fallback instead of leaving this boot with nothing. Resolve the marker afresh
+  # every boot (rm, then re-touch only on a confirmed miss) so a later image
+  # update self-heals with no leftover state.
+  _briefing_skew_marker="{{agentDir}}/.gateway-briefing-unavailable"
+  rm -f "$_briefing_skew_marker"
+  if [ "$SWITCHROOM_SESSION_BRIEFING" = "gateway" ]; then
+    if [ -f "$_gateway_bundle" ] && grep -q '{{gatewayBriefingCapability}}' "$_gateway_bundle" 2>/dev/null; then
+      : # bundle carries the boot-briefing builder — gateway path is live
+    else
+      echo "[start.sh] WARNING: session_continuity.briefing=gateway is configured, but the deployed gateway bundle ($_gateway_bundle) PREDATES the boot-briefing builder (capability sentinel '{{gatewayBriefingCapability}}' absent from the bundle). The gateway cannot assemble the reorientation briefing, and the legacy shell handoff path is skipped for 'gateway' mode — so this boot would otherwise get NO briefing at all. FALLING BACK to the legacy handoff-briefing assembler for this boot. Update the agent image (/opt/switchroom) to a build that includes the boot-briefing feature to use the gateway path." >&2
+      touch "$_briefing_skew_marker" 2>/dev/null || true
+    fi
+  fi
+
   if [ "$_telegram_enabled" = "true" ] && [ -f "$_gateway_bundle" ] && command -v bun >/dev/null 2>&1; then
     _switchroom_supervise gateway /var/log/switchroom/gateway-supervisor.log \
       bun "$_gateway_bundle" &
@@ -506,14 +547,13 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
   #
   #     Default OFF and deterministic: the block is present for every agent
   #     (start.sh stays byte-identical fleet-wide) but forks the sidecar ONLY
-  #     when BUZZ_ENABLED=1 is set in the container env. NOTE: nothing in this
-  #     branch sets BUZZ_ENABLED (or the other BUZZ_* vars) — projecting an
-  #     ENABLED channels.buzz block into container env is DEFERRED to the
-  #     deploy-wiring phase. Until then the env is unset for every agent and
-  #     this block is a no-op, so the channel is dark by construction. The
-  #     sidecar itself also fails closed if its env is incomplete, and fetches
-  #     the nsec in-process from the vault broker (never an env var, never
-  #     logged).
+  #     when BUZZ_ENABLED=1 is set in the container env. That var is projected
+  #     by src/agents/compose.ts from the cascade-resolved channels.buzz block,
+  #     and BUZZ_ENABLED=1 lands ONLY when that block sets enabled:true. An
+  #     enabled:false/absent block leaves it unset, so for those agents this
+  #     block is a no-op and the channel is dark by construction. The sidecar
+  #     itself also fails closed if its env is incomplete, and fetches the nsec
+  #     in-process from the vault broker (never an env var, never logged).
   if [ "$BUZZ_ENABLED" = "1" ] \
      && [ -f /opt/switchroom/buzz-gateway/index.js ] \
      && command -v bun >/dev/null 2>&1; then
@@ -1430,9 +1470,38 @@ if [ "$_HANDOFF_STALE" = "1" ]; then
   # running the shell assembler here would double-inject the same recent
   # conversation. The Stop-hook .handoff.md path below is left untouched in
   # this stage of the migration.
-  if [ "$SWITCHROOM_RESUME_MODE" = "handoff" ] && [ "{{#if sessionBriefingMode}}{{{sessionBriefingMode}}}{{else}}legacy{{/if}}" != "gateway" ] && command -v handoff-briefing.sh >/dev/null 2>&1; then
+  #
+  # EXCEPTION (#4245): when the outer pass detected a bundle version skew
+  # (briefing=gateway requested but the deployed gateway bundle predates the
+  # boot-briefing builder), it dropped the .gateway-briefing-unavailable marker.
+  # In that case the gateway path is dead, so run the legacy assembler here as a
+  # fallback even in 'gateway' mode — the double-inject risk does not apply
+  # because the stale gateway never queues a briefing. This is a file-based
+  # handshake on purpose: the marker survives the outer→inner tmux re-exec
+  # deterministically (written before the exec, read after), unlike env.
+  if [ "$SWITCHROOM_RESUME_MODE" = "handoff" ] \
+     && { [ "{{#if sessionBriefingMode}}{{{sessionBriefingMode}}}{{else}}legacy{{/if}}" != "gateway" ] || [ -f "{{agentDir}}/.gateway-briefing-unavailable" ]; } \
+     && command -v handoff-briefing.sh >/dev/null 2>&1; then
     export AGENT_DIR="{{agentDir}}"
-    timeout 5 handoff-briefing.sh 2>/dev/null || true
+    # Clear any prior-boot briefing BEFORE rebuilding (#continuity). The
+    # sidecar rm below (post-injection) is skipped if a boot crashes between
+    # the rebuild and injection, leaving last boot's .handoff-briefing.md on
+    # disk. If this boot's rebuild is then killed by the outer `timeout`
+    # (SIGTERM — `timeout 10` sends SIGTERM by default, not SIGKILL) before
+    # handoff-briefing.sh's atomic write, the injection would re-serve that
+    # STALE prior-boot briefing. Deleting the target up front makes a killed
+    # rebuild yield a MISSING file (injection skips) rather than a stale one.
+    # handoff-briefing.sh recreates it via tmp+mv on success.
+    rm -f "$HANDOFF_BRIEFING_FILE" 2>/dev/null || true
+    # Outer kill budget (10s) must strictly exceed the inner Hindsight cap
+    # (3s, HANDOFF_BRIEFING_HINDSIGHT_TIMEOUT) with margin, so the SIGTERM
+    # (`timeout 10`'s default signal) lands only on a genuinely wedged run —
+    # never mid-write of a recall that was about to return. The local SQLite
+    # (Telegram) and daily-memory reads are sub-second; Hindsight is the only
+    # network hop and is self-capped, so 10s leaves ~7s of headroom over the
+    # worst-case source.
+    export HANDOFF_BRIEFING_HINDSIGHT_TIMEOUT="${HANDOFF_BRIEFING_HINDSIGHT_TIMEOUT:-3}"
+    timeout 10 handoff-briefing.sh 2>/dev/null || true
   fi
 fi
 APPEND_PROMPT={{#if systemPromptAppendShellQuoted}}{{{systemPromptAppendShellQuoted}}}{{else}}""{{/if}}