switchroom 0.20.21 → 0.21.0

package/dist/host-control/main.js

@@ -21096,9 +21096,9 @@ var require_commander = __commonJS((exports2) => {
 
 // src/host-control/main.ts
 init_loader();
-import { homedir as homedir8 } from "node:os";
-import { existsSync as existsSync17, readdirSync as readdirSync7 } from "node:fs";
-import { join as join13, resolve as resolve10 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { existsSync as existsSync18, readdirSync as readdirSync7 } from "node:fs";
+import { join as join14, resolve as resolve10 } from "node:path";
 
 // src/host-control/config-degraded.ts
 init_loader();
@@ -21565,13 +21565,13 @@ function allocateAgentUid(name) {
 }
 
 // src/build-info.ts
-var VERSION = "0.20.21";
+var VERSION = "0.21.0";
 
 // src/setup/hindsight-recall-passthrough.ts
 var HINDSIGHT_RECALL_TAG_WEIGHT_SEED = Object.freeze({ sidechain: 0.8 });
 var HINDSIGHT_RECALL_PROMPT_PREAMBLE_DEFAULT = "Relevant memories from past conversations (prioritize recent when " + "conflicting). Only use memories that are directly useful to continue " + "this conversation; ignore the rest:";
 var RECALL_PASSTHROUGH_DEFAULTS = Object.freeze({
-  budget: "low",
+  budget: "mid",
   maxTokens: 1024,
   preferObservations: true,
   contextTurns: 2,
@@ -22356,11 +22356,11 @@ import { spawn as spawn2, spawnSync as spawnSync4 } from "node:child_process";
 import { mkdir as mkdir2, chmod, chown, unlink, appendFile } from "node:fs/promises";
 import {
   readdirSync as readdirSync6,
-  existsSync as existsSync16,
-  readFileSync as readFileSync12,
-  writeFileSync as writeFileSync6,
-  renameSync as renameSync5,
-  mkdirSync as mkdirSync5,
+  existsSync as existsSync17,
+  readFileSync as readFileSync13,
+  writeFileSync as writeFileSync7,
+  renameSync as renameSync6,
+  mkdirSync as mkdirSync6,
   openSync as openSync5,
   ftruncateSync,
   writeSync as writeSync3,
@@ -22369,7 +22369,7 @@ import {
   copyFileSync as copyFileSync3,
   unlinkSync as unlinkSync5
 } from "node:fs";
-import { join as join12, dirname as dirname9, resolve as resolve9 } from "node:path";
+import { join as join13, dirname as dirname9, resolve as resolve9 } from "node:path";
 import { createHash as createHash6, randomUUID as randomUUID2, randomBytes } from "node:crypto";
 
 // src/host-control/protocol.ts
@@ -28540,6 +28540,169 @@ function resolveOperatorUid(ownershipDeps = {}) {
   return resolveOperatorUidFromOwnership(ownershipDeps);
 }
 
+// src/cli/host-cli-stamp.ts
+import {
+  chownSync as chownSync2,
+  existsSync as existsSync14,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync10,
+  renameSync as renameSync5,
+  statSync as statSync8,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join9 } from "node:path";
+var HOST_CLI_STAMP_FILENAME = "host-cli.json";
+var SWITCHROOM_HOME_MARKER2 = "switchroom.yaml";
+var CONTAINER_OPERATOR_HOME2 = "/host-home";
+function resolveIo(io) {
+  return {
+    env: io.env ?? process.env,
+    home: io.home ?? homedir7(),
+    exists: io.exists ?? ((p) => existsSync14(p)),
+    readFile: io.readFile ?? ((p) => readFileSync10(p, "utf8")),
+    writeFile: io.writeFile ?? ((p, c) => {
+      const tmp = `${p}.${process.pid}.tmp`;
+      writeFileSync5(tmp, c, { mode: 420 });
+      renameSync5(tmp, p);
+    }),
+    statUid: io.statUid ?? ((p) => {
+      try {
+        return statSync8(p).uid;
+      } catch {
+        return;
+      }
+    }),
+    userForUid: io.userForUid ?? userFromPasswd,
+    getuid: io.getuid ?? (() => process.getuid?.()),
+    chown: io.chown ?? ((p, uid, gid) => chownSync2(p, uid, gid)),
+    statOwner: io.statOwner ?? ((p) => {
+      try {
+        const st = statSync8(p);
+        return { uid: st.uid, gid: st.gid };
+      } catch {
+        return;
+      }
+    })
+  };
+}
+function userFromPasswd(uid) {
+  try {
+    for (const line of readFileSync10("/etc/passwd", "utf8").split(`
+`)) {
+      const f = line.split(":");
+      if (f[2] !== undefined && parseInt(f[2], 10) === uid && f[0])
+        return f[0];
+    }
+  } catch {}
+  return;
+}
+function homeFromPasswd(user) {
+  try {
+    for (const line of readFileSync10("/etc/passwd", "utf8").split(`
+`)) {
+      const f = line.split(":");
+      if (f[0] === user && f[5])
+        return f[5];
+    }
+  } catch {}
+  return;
+}
+function stampHomeCandidates(env, home2, homeForUser = homeFromPasswd) {
+  const sudoUser = env.SUDO_USER;
+  const roots = [
+    env.SWITCHROOM_HOST_HOME?.trim(),
+    sudoUser && sudoUser !== "root" ? homeForUser(sudoUser) : undefined,
+    home2,
+    CONTAINER_OPERATOR_HOME2
+  ];
+  const out = [];
+  for (const r of roots) {
+    if (!r)
+      continue;
+    const dir = join9(r, ".switchroom");
+    if (!out.includes(dir))
+      out.push(dir);
+  }
+  return out;
+}
+function resolveStampDir(io = {}) {
+  const { env, home: home2, exists } = resolveIo(io);
+  const homeForUser = (u) => homeFromPasswd(u);
+  for (const dir of stampHomeCandidates(env, home2, homeForUser)) {
+    if (exists(join9(dir, SWITCHROOM_HOME_MARKER2)))
+      return dir;
+  }
+  return;
+}
+function readHostCliStamp(io = {}) {
+  try {
+    const dir = resolveStampDir(io);
+    if (!dir)
+      return;
+    const { exists, readFile } = resolveIo(io);
+    const path3 = join9(dir, HOST_CLI_STAMP_FILENAME);
+    if (!exists(path3))
+      return;
+    const parsed = JSON.parse(readFile(path3));
+    if (typeof parsed.version !== "string" || parsed.version.length === 0)
+      return;
+    return {
+      version: parsed.version,
+      installKind: parsed.installKind ?? "unknown",
+      path: typeof parsed.path === "string" ? parsed.path : "",
+      ...parsed.npmPrefix ? { npmPrefix: parsed.npmPrefix } : {},
+      ...parsed.ownerUser ? { ownerUser: parsed.ownerUser } : {},
+      ...typeof parsed.ownerUid === "number" ? { ownerUid: parsed.ownerUid } : {}
+    };
+  } catch {
+    return;
+  }
+}
+function hostCliInstallCommand(stamp, target) {
+  const bare = target.replace(/^v/, "");
+  if (!stamp) {
+    return `upgrade the host operator CLI to ${bare} host-side ` + `(\`switchroom update\` for a static-binary install; ` + `\`npm i -g switchroom@${bare}\` for an npm install — as the user who owns ` + `the npm prefix)`;
+  }
+  switch (stamp.installKind) {
+    case "npm-global": {
+      const npmCmd = `npm i -g${stamp.npmPrefix ? ` --prefix ${stamp.npmPrefix}` : ""} switchroom@${bare}`;
+      if (stamp.ownerUid === 0)
+        return `sudo ${npmCmd}`;
+      const who = stamp.ownerUser ?? (stamp.ownerUid !== undefined ? `uid ${stamp.ownerUid}` : undefined);
+      const asNote = who ? ` — run as ${who}, NOT under sudo` : ` — run as the user owning ${stamp.path}, NOT under sudo`;
+      return `${npmCmd}${asNote}`;
+    }
+    case "static-binary":
+      return `switchroom update --pin v${bare}  (replaces the static binary at ${stamp.path})`;
+    case "source-checkout":
+      return `git pull && bun install && npm run build  (source checkout at ${stamp.path})`;
+    case "container":
+    case "unknown":
+    default:
+      return `upgrade the host operator CLI at ${stamp.path} to ${bare} using the ` + `method it was installed with`;
+  }
+}
+function hostCliInstallShellCommand(stamp, target) {
+  if (!stamp)
+    return;
+  const bare = target.replace(/^v/, "");
+  if (stamp.installKind === "static-binary")
+    return `switchroom update --pin v${bare}`;
+  if (stamp.installKind === "npm-global" && stamp.ownerUid === 0) {
+    return `sudo npm i -g${stamp.npmPrefix ? ` --prefix ${stamp.npmPrefix}` : ""} switchroom@${bare}`;
+  }
+  return;
+}
+function compareHostCliToTarget(stamp, target) {
+  if (!stamp)
+    return "unknown";
+  const cmp = compareReleaseTags(`v${stamp.version.replace(/^v/, "")}`, `v${target.replace(/^v/, "")}`);
+  if (cmp === null)
+    return "unknown";
+  return cmp < 0 ? "behind" : "current-or-ahead";
+}
+
 // src/cli/rollout.ts
 init_atomic();
 
@@ -28558,15 +28721,15 @@ function hostdTemplateRegenVerdict(target, fromVersion) {
 }
 
 // src/cli/resolve-version.ts
-import { existsSync as existsSync14, readFileSync as readFileSync10 } from "node:fs";
-import { dirname as dirname7, join as join9 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync11 } from "node:fs";
+import { dirname as dirname7, join as join10 } from "node:path";
 function readPackageVersion() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 12 && dir && dir !== "/"; i++) {
-    const p = join9(dir, "package.json");
-    if (existsSync14(p)) {
+    const p = join10(dir, "package.json");
+    if (existsSync15(p)) {
       try {
-        const pkg = JSON.parse(readFileSync10(p, "utf-8"));
+        const pkg = JSON.parse(readFileSync11(p, "utf-8"));
         if (pkg?.name === "switchroom" && typeof pkg.version === "string") {
           return pkg.version;
         }
@@ -28866,7 +29029,7 @@ var ROLLOUT_RUN_TIMEOUT_MS = envMs("SWITCHROOM_ROLLOUT_RUN_TIMEOUT_MS", 20 * 60
 var ROLLOUT_PROBE_TIMEOUT_MS = envMs("SWITCHROOM_ROLLOUT_PROBE_TIMEOUT_MS", 60 * 1000);
 
 // src/cli/write-compose.ts
-import { chownSync as chownSync2 } from "node:fs";
+import { chownSync as chownSync3 } from "node:fs";
 import { mkdir, readFile, writeFile, rename, copyFile } from "node:fs/promises";
 init_merge();
 var AGENT_IMAGE_TAG_RE = /image:\s*\S*switchroom-agent:(\S+)/;
@@ -28956,7 +29119,7 @@ async function restoreComposeBackup(composePath, opts = {}) {
   const operatorUid = resolveOperatorUid();
   if (operatorUid !== undefined && process.geteuid?.() === 0) {
     try {
-      chownSync2(composePath, operatorUid, operatorUid);
+      chownSync3(composePath, operatorUid, operatorUid);
     } catch {}
   }
   return { restored: true, imageTag: composeImageTag(content) };
@@ -28967,8 +29130,8 @@ var import__2 = __toESM(require_commander(), 1);
 
 // src/cli/update.ts
 init_loader();
-import { join as join10, dirname as dirname8 } from "node:path";
-import { homedir as homedir7 } from "node:os";
+import { join as join11, dirname as dirname8 } from "node:path";
+import { homedir as homedir8 } from "node:os";
 
 // src/agents/lifecycle.ts
 import { execFileSync, spawn, spawnSync } from "node:child_process";
@@ -29070,7 +29233,7 @@ function getAllAgentStatuses(config) {
 
 // src/cli/update.ts
 init_atomic();
-var DEFAULT_COMPOSE_PATH = join10(homedir7(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH = join11(homedir8(), ".switchroom", "compose", "docker-compose.yml");
 var PACKAGED_INSTALL_KINDS = new Set([
   "static-binary",
   "npm-global",
@@ -29161,9 +29324,9 @@ function resolvePriorPinFromFleet(components, target, scope) {
 // src/host-control/config-edit-validator.ts
 init_schema();
 var import_yaml5 = __toESM(require_dist(), 1);
-import { mkdtempSync, writeFileSync as writeFileSync5, rmSync as rmSync2, existsSync as existsSync15, readFileSync as readFileSync11 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync6, rmSync as rmSync2, existsSync as existsSync16, readFileSync as readFileSync12 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join11, isAbsolute as isAbsolute2, normalize, basename as basename4 } from "node:path";
+import { join as join12, isAbsolute as isAbsolute2, normalize, basename as basename4 } from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { isDeepStrictEqual } from "node:util";
 var MAX_PATCH_BYTES = 1024 * 1024;
@@ -29303,22 +29466,22 @@ function validateShape(unifiedDiff, targetPath) {
   return null;
 }
 function applyPatch(unifiedDiff, configPath, gitBin) {
-  if (!existsSync15(configPath)) {
+  if (!existsSync16(configPath)) {
     return {
       ok: false,
       code: "E_PATCH_APPLY_FAILED",
       detail: `target config not found at ${configPath}`
     };
   }
-  const liveContent = readFileSync11(configPath, "utf8");
-  const scratchDir = mkdtempSync(join11(tmpdir(), "config-propose-edit-"));
+  const liveContent = readFileSync12(configPath, "utf8");
+  const scratchDir = mkdtempSync(join12(tmpdir(), "config-propose-edit-"));
   try {
     const targetBasename = configPath.split("/").pop() ?? "switchroom.yaml";
-    const scratchFile = join11(scratchDir, targetBasename);
-    writeFileSync5(scratchFile, liveContent);
+    const scratchFile = join12(scratchDir, targetBasename);
+    writeFileSync6(scratchFile, liveContent);
     const normalizedDiff = normalizeDiffHeadersToBasename(unifiedDiff, targetBasename);
-    const patchFile = join11(scratchDir, "proposal.patch");
-    writeFileSync5(patchFile, normalizedDiff);
+    const patchFile = join12(scratchDir, "proposal.patch");
+    writeFileSync6(patchFile, normalizedDiff);
     const bin = gitBin ?? "git";
     const baseArgs = [
       "apply",
@@ -29347,7 +29510,7 @@ function applyPatch(unifiedDiff, configPath, gitBin) {
         detail: `git apply failed: ${(real.stderr || "").trim().slice(0, 500)}`
       };
     }
-    const after = readFileSync11(scratchFile, "utf8");
+    const after = readFileSync12(scratchFile, "utf8");
     return { ok: true, after };
   } finally {
     rmSync2(scratchDir, { recursive: true, force: true });
@@ -29545,7 +29708,7 @@ function validateConfigEdit(opts) {
     return schemaErr;
   let beforeData = {};
   try {
-    const beforeRaw = existsSync15(opts.configPath) ? readFileSync11(opts.configPath, "utf8") : "";
+    const beforeRaw = existsSync16(opts.configPath) ? readFileSync12(opts.configPath, "utf8") : "";
     const beforeDoc = import_yaml5.parseDocument(beforeRaw, { merge: false, strict: false });
     beforeData = beforeDoc.toJS();
   } catch {
@@ -29918,33 +30081,30 @@ function etaLine(s) {
   const meanMs = done.reduce((t, a) => t + (a.durationMs ?? 0), 0) / done.length;
   return `~${formatDurationMs(meanMs * remaining)} left (rough est.)`;
 }
-function deferredLines(target, fromVersion) {
-  const bare = target.trim().replace(/^v/, "");
+function deferredLines(target, fromVersion, hostCli) {
   const head = [
-    `**Verified on ${target}** — every component this roll owned passed \`verify-components\`, so this is host convergence, not just the agents. Anything the roll was told to skip is named in its warnings.`,
-    `**Still host-side (nothing in a roll can do these):**`
+    `**Verified on ${target}** — every component this roll owned passed \`verify-components\`, so this is host convergence, not just the agents. Anything the roll was told to skip is named in its warnings.`
   ];
+  const posture = compareHostCliToTarget(hostCli, target);
+  const hostCliOutstanding = posture !== "current-or-ahead";
+  if (posture === "current-or-ahead" && hostCli) {
+    head.push(`Host operator CLI: **on ${hostCli.version}** (read from \`~/.switchroom/host-cli.json\`) — nothing to do.`);
+  }
+  const cliCommand = hostCliInstallCommand(hostCli, target);
+  const cliLine = !hostCli ? `- host operator CLI (version not observable from here — no \`~/.switchroom/host-cli.json\`) — ${cliCommand}` : posture === "behind" ? `- host operator CLI — observed **${hostCli.version}**, run: \`${cliCommand}\`` : `- host operator CLI — observed **${hostCli.version}**, which is not comparable to ${target} (a channel/pre-release build). Confirm host-side with \`switchroom --version\`; if it is behind: ${cliCommand}`;
   const verdict = hostdTemplateRegenVerdict(target, fromVersion);
-  if (verdict === "required") {
+  const collapsible = verdict === "required" && posture === "behind" ? hostCliInstallShellCommand(hostCli, target) : undefined;
+  if (collapsible) {
     return [
       ...head,
+      `**Still host-side (nothing in a roll can do these):**`,
       `- host operator CLI + hostd template regen — regen is **REQUIRED** for this roll (hostd mounts/env changed in ${HOSTD_TEMPLATE_LAST_CHANGED}). One copy-paste:`,
-      `  \`sudo npm i -g switchroom@${bare} && switchroom hostd install --tag ${target}\``
+      `  \`${collapsible} && switchroom hostd install --tag ${target}\``
     ];
   }
-  const cliLine = `- host operator CLI — \`sudo npm i -g switchroom@${bare}\``;
-  if (verdict === "not-needed") {
-    return [
-      ...head,
-      cliLine,
-      `- hostd template regen: **not needed** for this release — hostd mounts/env unchanged since ${HOSTD_TEMPLATE_LAST_CHANGED}.`
-    ];
-  }
-  return [
-    ...head,
-    cliLine,
-    `- hostd template regen (only if the release changed hostd mounts/env) — \`switchroom hostd install --tag ${target}\``
-  ];
+  const regenLine = verdict === "required" ? `- hostd template regen — **REQUIRED** for this roll (hostd mounts/env changed in ${HOSTD_TEMPLATE_LAST_CHANGED}): \`switchroom hostd install --tag ${target}\`` : verdict === "not-needed" ? `- hostd template regen: **not needed** for this release — hostd mounts/env unchanged since ${HOSTD_TEMPLATE_LAST_CHANGED}.` : `- hostd template regen (only if the release changed hostd mounts/env) — \`switchroom hostd install --tag ${target}\``;
+  const outstanding = [...hostCliOutstanding ? [cliLine] : [], regenLine];
+  return [...head, `**Still host-side (nothing in a roll can do these):**`, ...outstanding];
 }
 function warningLines(warnings) {
   if (!warnings || warnings.length === 0)
@@ -29986,7 +30146,7 @@ function renderWith(s, compact) {
     if (warnings.length > 0)
       parts2.push("", ...warnings);
     if (s.deferred !== false)
-      parts2.push("", ...deferredLines(s.target, s.fromVersion));
+      parts2.push("", ...deferredLines(s.target, s.fromVersion, s.hostCli));
     return parts2.join(`
 `);
   }
@@ -30148,11 +30308,11 @@ function resolveDigests(imageRefs) {
   return out;
 }
 function readCachedInstallType(bindRoot) {
-  const cacheDir = join12(bindRoot, ".switchroom");
-  const cachePath = join12(cacheDir, "install-type.json");
-  if (existsSync16(cachePath)) {
+  const cacheDir = join13(bindRoot, ".switchroom");
+  const cachePath = join13(cacheDir, "install-type.json");
+  if (existsSync17(cachePath)) {
     try {
-      const raw = readFileSync12(cachePath, "utf-8");
+      const raw = readFileSync13(cachePath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed.install_type === "string" && typeof parsed.detected_at === "string") {
         return parsed;
@@ -30169,10 +30329,10 @@ function readCachedInstallType(bindRoot) {
     source_paths: ctx.source_paths
   };
   try {
-    mkdirSync5(cacheDir, { recursive: true });
+    mkdirSync6(cacheDir, { recursive: true });
     const tmp = `${cachePath}.tmp`;
-    writeFileSync6(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
-    renameSync5(tmp, cachePath);
+    writeFileSync7(tmp, JSON.stringify(payload, null, 2), { mode: 420 });
+    renameSync6(tmp, cachePath);
   } catch {}
   return payload;
 }
@@ -30204,7 +30364,7 @@ function writeFileInPlacePreservingInode(targetPath, content) {
   } finally {
     closeSync5(fd);
   }
-  const readBack = readFileSync12(targetPath);
+  const readBack = readFileSync13(targetPath);
   if (readBack.length !== buf.length) {
     throw new Error(`in-place write short: wrote ${buf.length} bytes but read back ${readBack.length}`);
   }
@@ -30239,11 +30399,11 @@ class HostdServer {
   fleetMutationInFlight = null;
   lastAutoRolloutFailedPin = null;
   autoRolloutLatchPath() {
-    return join12(this.hostdDirPath(), AUTO_ROLLOUT_LATCH_FILENAME);
+    return join13(this.hostdDirPath(), AUTO_ROLLOUT_LATCH_FILENAME);
   }
   readAutoRolloutLatch() {
     try {
-      const raw = readFileSync12(this.autoRolloutLatchPath(), "utf-8");
+      const raw = readFileSync13(this.autoRolloutLatchPath(), "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed && parsed.v === 1 && typeof parsed.pin === "string" && parsed.pin.length > 0 && (parsed.outcome === "attempting" || parsed.outcome === "failed")) {
         return parsed;
@@ -30258,8 +30418,8 @@ class HostdServer {
   }
   writeAutoRolloutLatch(latch) {
     try {
-      mkdirSync5(this.hostdDirPath(), { recursive: true });
-      writeFileSync6(this.autoRolloutLatchPath(), JSON.stringify(latch, null, 2), {
+      mkdirSync6(this.hostdDirPath(), { recursive: true });
+      writeFileSync7(this.autoRolloutLatchPath(), JSON.stringify(latch, null, 2), {
         mode: 384
       });
     } catch (e) {
@@ -30282,7 +30442,7 @@ class HostdServer {
     return resolveHostdConfigPath(this.opts.configPath);
   }
   fleetComposePath() {
-    return join12(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
+    return join13(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
   }
   recoverRolloutPinJournal(context) {
     let note = null;
@@ -30321,7 +30481,7 @@ class HostdServer {
     return note;
   }
   async start() {
-    const hostdDir = join12(this.opts.homeDir, ".switchroom", "hostd");
+    const hostdDir = join13(this.opts.homeDir, ".switchroom", "hostd");
     await mkdir2(hostdDir, { recursive: true });
     await chmod(hostdDir, 493).catch(() => {
       return;
@@ -30342,13 +30502,13 @@ class HostdServer {
     }
     try {
       for (const name of agentNames) {
-        const dir = join12(hostdDir, name);
-        const sockPath = join12(dir, "sock");
+        const dir = join13(hostdDir, name);
+        const sockPath = join13(dir, "sock");
         await mkdir2(dir, { recursive: true });
         await chmod(dir, 493).catch(() => {
           return;
         });
-        if (existsSync16(sockPath))
+        if (existsSync17(sockPath))
           await unlink(sockPath).catch(() => {
             return;
           });
@@ -30379,13 +30539,13 @@ class HostdServer {
           process.stderr.write(`hostd: SWITCHROOM_HOSTD_OPERATOR_UID='${opUidStr}' is not a positive integer; skipping operator listener
 `);
         } else {
-          const dir = join12(hostdDir, "operator");
-          const sockPath = join12(dir, "sock");
+          const dir = join13(hostdDir, "operator");
+          const sockPath = join13(dir, "sock");
           await mkdir2(dir, { recursive: true });
           await chmod(dir, 493).catch(() => {
             return;
           });
-          if (existsSync16(sockPath))
+          if (existsSync17(sockPath))
             await unlink(sockPath).catch(() => {
               return;
             });
@@ -30421,11 +30581,11 @@ class HostdServer {
   }
   async reconcileOrphanedFleetMutations() {
     const path3 = this.auditLogPath();
-    if (!existsSync16(path3))
+    if (!existsSync17(path3))
       return;
     let raw;
     try {
-      raw = readFileSync12(path3, "utf-8");
+      raw = readFileSync13(path3, "utf-8");
     } catch {
       return;
     }
@@ -30824,11 +30984,11 @@ class HostdServer {
   missingApplyAssets() {
     const root = this.opts.applyAssetsRoot ?? resolve9(import.meta.dirname, "../..");
     return [
-      join12(root, "profiles"),
-      join12(root, "profiles", "default"),
-      join12(root, "vendor", "hindsight-memory"),
-      join12(root, "skills")
-    ].filter((p) => !existsSync16(p));
+      join13(root, "profiles"),
+      join13(root, "profiles", "default"),
+      join13(root, "vendor", "hindsight-memory"),
+      join13(root, "skills")
+    ].filter((p) => !existsSync17(p));
   }
   applyAssetPreflight(request_id, started) {
     const missing = this.missingApplyAssets();
@@ -31086,19 +31246,19 @@ class HostdServer {
     return entry;
   }
   hostdDirPath() {
-    return join12(this.opts.homeDir, ".switchroom", "hostd");
+    return join13(this.opts.homeDir, ".switchroom", "hostd");
   }
   hostdDirHostPath() {
     const hostHome = this.opts.hostHomeDir ?? process.env.SWITCHROOM_HOST_HOME?.trim() ?? this.opts.homeDir;
-    return join12(hostHome, ".switchroom", "hostd");
+    return join13(hostHome, ".switchroom", "hostd");
   }
   async beginSelfBump(req, caller, started) {
     const ownVersion = this.opts.selfVersion ?? SWITCHROOM_VERSION;
-    const composePath = join12(this.hostdDirPath(), "docker-compose.yml");
-    if (!existsSync16(composePath)) {
+    const composePath = join13(this.hostdDirPath(), "docker-compose.yml");
+    if (!existsSync17(composePath)) {
       return deniedResponse(req.request_id, `rollout: hostd's CLI (v${ownVersion}) is older than the target ` + `${req.args.pin} and needs a self-bump first, but its compose file ` + `is missing at ${composePath}. Run \`switchroom hostd install ` + `--tag ${req.args.pin}\` on the host, then re-run the roll. ` + `Nothing was changed.`, Date.now() - started);
     }
-    const before = readFileSync12(composePath, "utf8");
+    const before = readFileSync13(composePath, "utf8");
     const bumped = bumpHostdComposeImageTag(before, req.args.pin);
     if (!bumped) {
       return deniedResponse(req.request_id, `rollout: hostd needs a self-bump to ${req.args.pin} but no ` + `switchroom-hostd image line was found in ${composePath} ` + `(hand-edited compose?). Run \`switchroom hostd install --tag ` + `${req.args.pin}\` on the host, then re-run the roll. Nothing ` + `was changed.`, Date.now() - started);
@@ -31119,10 +31279,10 @@ class HostdServer {
     try {
       const baks = readdirSync6(this.hostdDirPath()).filter((f) => f.startsWith("docker-compose.yml.bak-selfbump-")).sort();
       for (const f of baks.slice(0, Math.max(0, baks.length - 4))) {
-        unlinkSync5(join12(this.hostdDirPath(), f));
+        unlinkSync5(join13(this.hostdDirPath(), f));
       }
     } catch {}
-    const markerPath = join12(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+    const markerPath = join13(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
     const marker = {
       v: 1,
       request_id: req.request_id,
@@ -31135,10 +31295,10 @@ class HostdServer {
       prior_hostd_version: ownVersion
     };
     copyFileSync3(composePath, bakPath);
-    writeFileSync6(composePath, bumped.yaml, "utf8");
+    writeFileSync7(composePath, bumped.yaml, "utf8");
     process.stderr.write(`hostd: self-bump rewrote ${bumped.bumpedCount} switchroom-hostd ` + `image line(s) → ${bumped.newImageRef}
 `);
-    writeFileSync6(markerPath, encodePendingRolloutMarker(marker), {
+    writeFileSync7(markerPath, encodePendingRolloutMarker(marker), {
       mode: 384
     });
     const entry = {
@@ -31206,7 +31366,7 @@ class HostdServer {
       rollbackBump();
       entry.result = "error";
       entry.finished_at = Date.now();
-      entry.error = `self-bump helper failed (container exit ${Number.isFinite(code) ? code : "unknown"}). ` + `See ${join12(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)} on the host. ` + `Compose bump rolled back. Fallback: \`switchroom hostd install ` + `--tag ${req.args.pin}\` host-side, then re-run the roll.`;
+      entry.error = `self-bump helper failed (container exit ${Number.isFinite(code) ? code : "unknown"}). ` + `See ${join13(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)} on the host. ` + `Compose bump rolled back. Fallback: \`switchroom hostd install ` + `--tag ${req.args.pin}\` host-side, then re-run the roll.`;
       if (this.fleetMutationInFlight && this.fleetMutationInFlight.request_id === entry.request_id) {
         this.fleetMutationInFlight = null;
       }
@@ -31233,10 +31393,10 @@ class HostdServer {
     try {
       if (!Number.isInteger(messageId) || messageId <= 0)
         return;
-      const markerPath = join12(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
-      if (!existsSync16(markerPath))
+      const markerPath = join13(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+      if (!existsSync17(markerPath))
         return;
-      const marker = parsePendingRolloutMarker(readFileSync12(markerPath, "utf8"));
+      const marker = parsePendingRolloutMarker(readFileSync13(markerPath, "utf8"));
       if (!marker)
         return;
       if (marker.request_id !== requestId)
@@ -31246,17 +31406,17 @@ class HostdServer {
         narration_message_id: messageId
       };
       const tmp = `${markerPath}.tmp`;
-      writeFileSync6(tmp, encodePendingRolloutMarker(updated), { mode: 384 });
-      renameSync5(tmp, markerPath);
+      writeFileSync7(tmp, encodePendingRolloutMarker(updated), { mode: 384 });
+      renameSync6(tmp, markerPath);
     } catch {}
   }
   async resumePendingSelfBumpRollout() {
-    const markerPath = join12(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
-    if (!existsSync16(markerPath))
+    const markerPath = join13(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
+    if (!existsSync17(markerPath))
       return;
     let raw;
     try {
-      raw = readFileSync12(markerPath, "utf8");
+      raw = readFileSync13(markerPath, "utf8");
     } finally {
       try {
         unlinkSync5(markerPath);
@@ -31307,7 +31467,7 @@ class HostdServer {
       return;
     }
     if (needsSelfBump(ownVersion, marker.pin)) {
-      await failResume(`hostd is still on v${ownVersion} after the self-bump to ` + `${marker.pin} (helper failed? see ` + `${join12(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)}). ` + `Fallback: \`switchroom hostd install --tag ${marker.pin}\` ` + `host-side, then re-issue the rollout.`);
+      await failResume(`hostd is still on v${ownVersion} after the self-bump to ` + `${marker.pin} (helper failed? see ` + `${join13(this.hostdDirHostPath(), SELF_BUMP_LOG_FILENAME)}). ` + `Fallback: \`switchroom hostd install --tag ${marker.pin}\` ` + `host-side, then re-issue the rollout.`);
       return;
     }
     process.stderr.write(`hostd: resuming rollout ${marker.request_id} → ${marker.pin} after ` + `self-bump (v${marker.prior_hostd_version} → v${ownVersion})
@@ -31415,7 +31575,7 @@ class HostdServer {
     }
     let beforeContent;
     try {
-      beforeContent = readFileSync12(configPath, "utf-8");
+      beforeContent = readFileSync13(configPath, "utf-8");
     } catch {
       beforeContent = "";
     }
@@ -31535,7 +31695,7 @@ class HostdServer {
     try {
       let snapshot;
       try {
-        snapshot = readFileSync12(configPath, "utf-8");
+        snapshot = readFileSync13(configPath, "utf-8");
       } catch (e) {
         await approval.finalize({
           outcome: "reconcile_failed_rolled_back",
@@ -31833,8 +31993,8 @@ ${output.recovery.stderr}` : "";
     if (this.opts.imageRefsForDigests)
       return this.opts.imageRefsForDigests();
     try {
-      const composePath = join12(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
-      if (!existsSync16(composePath))
+      const composePath = join13(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
+      if (!existsSync17(composePath))
         return [];
       const r = spawnSync4("docker", [
         "compose",
@@ -32054,7 +32214,11 @@ ${pinNote}`.trim();
         ...entry.failed_agent ? { failedAgent: entry.failed_agent } : {},
         ...entry.got !== undefined ? { got: entry.got } : {},
         ...entry.drifted && entry.drifted.length > 0 ? { drifted: entry.drifted } : {},
-        ...entry.warnings && entry.warnings.length > 0 ? { warnings: entry.warnings } : {}
+        ...entry.warnings && entry.warnings.length > 0 ? { warnings: entry.warnings } : {},
+        ...(() => {
+          const stamp = readHostCliStamp();
+          return stamp ? { hostCli: stamp } : {};
+        })()
       });
       this.opts.rolloutRelay.postTerminal({
         requestId: entry.request_id,
@@ -32092,10 +32256,10 @@ ${pinNote}`.trim();
   }
   rolloutRowExistsInLog(targetRequestId) {
     const path3 = this.auditLogPath();
-    if (!existsSync16(path3))
+    if (!existsSync17(path3))
       return false;
     try {
-      const raw = readFileSync12(path3, "utf-8");
+      const raw = readFileSync13(path3, "utf-8");
       return latestRolloutRowForRequest(raw, targetRequestId) !== null;
     } catch {
       return false;
@@ -32103,11 +32267,11 @@ ${pinNote}`.trim();
   }
   rolloutStatusFromLog(responseRequestId, targetRequestId, started) {
     const path3 = this.auditLogPath();
-    if (!existsSync16(path3))
+    if (!existsSync17(path3))
       return null;
     let raw;
     try {
-      raw = readFileSync12(path3, "utf-8");
+      raw = readFileSync13(path3, "utf-8");
     } catch {
       return null;
     }
@@ -32189,7 +32353,7 @@ ${pinNote}`.trim();
     }
   }
   auditLogPath() {
-    return this.opts.auditLogPath ?? join12(this.opts.homeDir, ".switchroom", "host-control-audit.log");
+    return this.opts.auditLogPath ?? join13(this.opts.homeDir, ".switchroom", "host-control-audit.log");
   }
   maybeRotateAuditLog(path3) {
     const { maxBytes, maxFiles } = resolveRotationConfig({
@@ -33673,7 +33837,7 @@ function makeRestart(switchroomBin) {
 }
 
 // src/host-control/update-notifier.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync13, renameSync as renameSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync14, renameSync as renameSync7, writeFileSync as writeFileSync8 } from "node:fs";
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { dirname as dirname10 } from "node:path";
 var FINALIZE_DETAIL_MAX = 450;
@@ -33790,7 +33954,7 @@ class UpdateNotifier {
   }
   readState() {
     try {
-      const raw = readFileSync13(this.opts.statePath, "utf8");
+      const raw = readFileSync14(this.opts.statePath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed === null || typeof parsed !== "object")
         return null;
@@ -33810,11 +33974,11 @@ class UpdateNotifier {
   }
   writeState(state) {
     try {
-      mkdirSync6(dirname10(this.opts.statePath), { recursive: true });
+      mkdirSync7(dirname10(this.opts.statePath), { recursive: true });
       const tmp = `${this.opts.statePath}.tmp`;
-      writeFileSync7(tmp, JSON.stringify(state) + `
+      writeFileSync8(tmp, JSON.stringify(state) + `
 `, "utf8");
-      renameSync6(tmp, this.opts.statePath);
+      renameSync7(tmp, this.opts.statePath);
     } catch (err2) {
       this.log(`failed to persist notify state: ${errMsg2(err2)}`);
     }
@@ -33919,7 +34083,7 @@ import { appendFile as appendFile2 } from "node:fs/promises";
 async function loadConfigResilient() {
   try {
     const config = loadConfig();
-    clearStaleDegradedMarker(homedir8(), (m) => process.stderr.write(`hostd: ${m}
+    clearStaleDegradedMarker(homedir9(), (m) => process.stderr.write(`hostd: ${m}
 `));
     return config;
   } catch (err2) {
@@ -33931,13 +34095,13 @@ async function loadConfigResilient() {
     } catch {
       configPath = undefined;
     }
-    const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join13(homedir8(), ".switchroom", "agents");
+    const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join14(homedir9(), ".switchroom", "agents");
     const listGatewayCandidates = () => {
       const out = [];
       try {
         for (const name of readdirSync7(agentsDir).sort()) {
           const sock = resolve10(agentsDir, name, "telegram", "gateway.sock");
-          if (existsSync17(sock))
+          if (existsSync18(sock))
             out.push({ agent: name, sock });
         }
       } catch {}
@@ -33960,7 +34124,7 @@ async function loadConfigResilient() {
     };
     return waitForConfigRecovery({
       initialError: err2,
-      homeDir: homedir8(),
+      homeDir: homedir9(),
       loadFn: () => loadConfig(),
       configPath,
       notify,
@@ -33984,10 +34148,10 @@ async function main() {
 `);
     process.exit(2);
   }
-  const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join13(homedir8(), ".switchroom", "agents");
+  const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join14(homedir9(), ".switchroom", "agents");
   const resolveGatewaySocket = (agentName) => {
     const sock = resolve10(agentsDir, agentName, "telegram", "gateway.sock");
-    return existsSync17(sock) ? sock : null;
+    return existsSync18(sock) ? sock : null;
   };
   const approvalGateway = new SocketApprovalGateway({
     resolveGatewaySocket,
@@ -34011,7 +34175,7 @@ async function main() {
 `)
   });
   const server = new HostdServer({
-    homeDir: homedir8(),
+    homeDir: homedir9(),
     agentUids,
     fleetComponents: () => dockerFleetComponents(),
     config: {
@@ -34041,7 +34205,7 @@ async function main() {
   const autoRel = config.host_control?.auto_release_check;
   const watcherMode = resolveReleaseWatcherMode(config);
   if (watcherMode.mode !== "off") {
-    const eventsLog = join13(homedir8(), ".switchroom", "release-watcher-events.jsonl");
+    const eventsLog = join14(homedir9(), ".switchroom", "release-watcher-events.jsonl");
     const log = (m) => {
       process.stderr.write(`hostd: ${m}
 `);
@@ -34100,7 +34264,7 @@ async function main() {
 `);
         } else
           notifier = new UpdateNotifier({
-            statePath: join13(homedir8(), ".switchroom", "release-notify-state.json"),
+            statePath: join14(homedir9(), ".switchroom", "release-notify-state.json"),
             repostSuppressMs: cardTimeoutMs,
             isFleetMutationInFlight: () => server.isFleetMutationLocked(),
             startApply: (requestId) => {