switchroom 0.21.1 → 0.21.4

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.21.1", COMMIT_SHA = "6aef7b24";
+var VERSION = "0.21.4", COMMIT_SHA = "aa63e74c";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -63125,6 +63125,17 @@ function rollbackHint(installDir, previousVersion) {
 function alreadySelfUpdated(env2) {
   return env2[SELF_UPDATE_ENV_SENTINEL] === "1";
 }
+function describeBinaryProbeFailure(opts) {
+  const { probe: probe2, path: path7, subject } = opts;
+  switch (probe2.kind) {
+    case "not-executable":
+      return `could not EXECUTE ${subject} at ${path7} (${probe2.detail}). This is a ` + `property of WHERE it was staged, not of the artifact \u2014 the usual causes ` + `are a staging directory mounted \`noexec\`, a lost execute bit, or an ` + `architecture this kernel cannot run. The download's sha256 already ` + `matched the release's checksums file, so re-downloading will not help.`;
+    case "ran-but-failed":
+      return `${subject} at ${path7} ran but exited non-zero for \`--version\` ` + `(${probe2.detail}) \u2014 the artifact itself is faulty.`;
+    case "no-version":
+      return `${subject} at ${path7} ran and exited 0 but printed no parseable version ` + `(${probe2.detail}) \u2014 the artifact itself is faulty.`;
+  }
+}
 async function fetchLatestReleaseTag(io) {
   try {
     return parseLatestReleaseTag(await io.httpGetText(GITHUB_LATEST_RELEASE_URL));
@@ -63278,10 +63289,14 @@ async function performSelfUpdate(opts) {
     throw new Error(`self-update: SHA256 mismatch for ${assetName} (expected ${expected}, got ${actual}) \u2014 ` + `refusing to install. The installed CLI is unchanged.`);
   }
   io.chmodExec(tmp);
-  const proved = io.probeBinaryVersion(tmp);
-  if (!proved) {
+  const proved = io.probeBinary(tmp);
+  if (!proved.ok) {
     io.remove(tmp);
-    throw new Error(`self-update: the downloaded ${plan.to} binary did not run cleanly on this host ` + `(\`switchroom version\` failed) \u2014 refusing to install it. The installed CLI is unchanged.`);
+    throw new Error(`self-update: ${describeBinaryProbeFailure({
+      probe: proved,
+      path: tmp,
+      subject: `the downloaded ${plan.to} binary`
+    })} Refusing to install it. The installed CLI is unchanged.`);
   }
   const payload = await installAssetPayload({
     tag: plan.to,
@@ -63459,10 +63474,13 @@ function serializeStamp(stamp) {
 `;
 }
 function refreshHostCliStamp(input, io = {}) {
+  const stamp = buildHostCliStamp(input, io);
+  if (!stamp)
+    return { status: "skipped", reason: "running in a container" };
+  return writeHostCliStamp(stamp, io);
+}
+function writeHostCliStamp(stamp, io = {}) {
   try {
-    const stamp = buildHostCliStamp(input, io);
-    if (!stamp)
-      return { status: "skipped", reason: "running in a container" };
     const dir = resolveStampDir(io);
     if (!dir)
       return { status: "skipped", reason: "no switchroom home found" };
@@ -64917,6 +64935,7 @@ async function defaultLoadDecisions() {
       "exec",
       "switchroom-vault-broker",
       "sqlite3",
+      "-readonly",
       "-separator",
       SEP2,
       GRANTS_DB_CONTAINER_PATH,
@@ -84374,7 +84393,8 @@ function detectGatewayFindings(agent, logText, logName = `logs/${agent}/gateway-
   const gw_hits = {
     "duplicate-delivery-represent": 0,
     "represent-escalation": 0,
-    "reply-delivery-failure": 0
+    "reply-delivery-failure": 0,
+    "orphaned-db-handle": 0
   };
   const lines = logText.split(`
 `);
@@ -84432,7 +84452,8 @@ var init_detect = __esm(() => {
   GATEWAY_SIGNATURES = {
     "duplicate-delivery-represent": /represent duplicate-send/,
     "represent-escalation": /obligation escalation/,
-    "reply-delivery-failure": /tg-post method=sendRichMessage[^\n]*status=err(?![a-z])/
+    "reply-delivery-failure": /tg-post method=sendRichMessage[^\n]*status=err(?![a-z])/,
+    "orphaned-db-handle": /orphaned-db-sweep DETECTED \d+ deleted-inode DB handle/
   };
 });
 
@@ -84496,6 +84517,12 @@ var init_mapping = __esm(() => {
       job_spec: "talk-to-agents-from-anywhere",
       signature: "reply-delivery-failure:sendRichMessage-err"
     },
+    "orphaned-db-handle": {
+      failure_mode: "success-theater",
+      severity: 3,
+      job_spec: "survive-reboots-and-real-life",
+      signature: "orphaned-db-handle:deleted-inode-writes"
+    },
     "hang-long-stalled": {
       failure_mode: "partial",
       severity: 2,
@@ -84740,10 +84767,10 @@ var init_test_agents = __esm(() => {
 });
 
 // src/litellm/header-passthrough-guard.ts
-import { existsSync as existsSync124, readdirSync as readdirSync47 } from "node:fs";
+import { existsSync as existsSync124, readdirSync as readdirSync48 } from "node:fs";
 function discoverLiveLitellmConfigPath(opts) {
   const servicesDir = opts?.servicesDir ?? COOLIFY_SERVICES_DIR;
-  const readdir2 = opts?.readdirFn ?? ((p) => readdirSync47(p));
+  const readdir2 = opts?.readdirFn ?? ((p) => readdirSync48(p));
   const exists = opts?.existsFn ?? existsSync124;
   let entries;
   try {
@@ -84964,7 +84991,7 @@ var init_passthrough_mount_guard = __esm(() => {
 // src/fleet-health/litellm-config-sensor.ts
 import { execFileSync as execFileSync35 } from "node:child_process";
 import { readFileSync as readFileSync111, existsSync as existsSync125 } from "node:fs";
-import { dirname as dirname51, join as join126 } from "node:path";
+import { dirname as dirname52, join as join127 } from "node:path";
 function resolveLiveLitellmPythonVersion() {
   try {
     const ps = execFileSync35("docker", ["ps", "--format", "{{.Names}}\t{{.Image}}"], {
@@ -85048,7 +85075,7 @@ function scanLitellmConfig(opts = {}) {
       ts: nowIso
     });
   }
-  const composePath = join126(dirname51(path10), LIVE_COMPOSE_BASENAME);
+  const composePath = join127(dirname52(path10), LIVE_COMPOSE_BASENAME);
   let composeText = null;
   if (exists(composePath)) {
     try {
@@ -85152,12 +85179,12 @@ __export(exports_scan, {
 });
 import {
   readFileSync as readFileSync112,
-  readdirSync as readdirSync48,
+  readdirSync as readdirSync49,
   existsSync as existsSync126,
   mkdirSync as mkdirSync71,
   writeFileSync as writeFileSync53
 } from "node:fs";
-import { resolve as resolve64, dirname as dirname52 } from "node:path";
+import { resolve as resolve64, dirname as dirname53 } from "node:path";
 import { homedir as homedir68 } from "node:os";
 function resolveSwitchroomBase(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir68()) {
   return resolve64(home2, ".switchroom");
@@ -85167,7 +85194,7 @@ function listAgents(base) {
   if (!existsSync126(dir))
     return [];
   try {
-    return readdirSync48(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+    return readdirSync49(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
   } catch {
     return [];
   }
@@ -85254,11 +85281,11 @@ function readLedgerIfPresent(base) {
   }
 }
 function ledgerPathForBase(base) {
-  return fleetHealthLedgerPath(dirname52(base));
+  return fleetHealthLedgerPath(dirname53(base));
 }
 function writeLedger(base, ledger) {
   const path10 = ledgerPathForBase(base);
-  mkdirSync71(dirname52(path10), { recursive: true });
+  mkdirSync71(dirname53(path10), { recursive: true });
   writeFileSync53(path10, JSON.stringify(ledger, null, 2) + `
 `, "utf-8");
   return path10;
@@ -86285,6 +86312,7 @@ function readLastMessages(historyDbPath) {
   } catch {}
   try {
     const out = execFileSync11("sqlite3", [
+      "-readonly",
       historyDbPath,
       "SELECT role, MAX(ts) FROM messages GROUP BY role;"
     ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
@@ -92341,7 +92369,7 @@ function scrubSqlite(path2, values, dryRun) {
   for (const { value } of values) {
     const esc = value.replace(/'/g, "''");
     try {
-      const out = execFileSync17("sqlite3", [path2, `SELECT COUNT(*) FROM messages WHERE text LIKE '%${esc}%'`], { encoding: "utf8", timeout: 1e4 });
+      const out = execFileSync17("sqlite3", ["-readonly", path2, `SELECT COUNT(*) FROM messages WHERE text LIKE '%${esc}%'`], { encoding: "utf8", timeout: 1e4 });
       const n = parseInt(out.trim(), 10);
       if (!Number.isNaN(n))
         matches += n;
@@ -106606,7 +106634,7 @@ function readTopicsFromHistory(dbPath, chatId, limit) {
     fail2("`switchroom telegram topics` requires the Bun runtime (history DB uses bun:sqlite). " + "Run via `bun run dev` or via the installed `switchroom` CLI (bun-bundled).");
   }
   const { Database: Database2 } = metaRequire("bun:sqlite");
-  const db = new Database2(dbPath, { create: false });
+  const db = new Database2(dbPath, { create: false, readonly: true });
   try {
     const aggregateRows = db.prepare(`
         SELECT
@@ -115303,6 +115331,11 @@ import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { spawnSync as spawnSync18 } from "node:child_process";
 var HTTP_TIMEOUT_MS = 60000;
+function firstLine2(s) {
+  const line = `${s ?? ""}`.split(`
+`).map((l) => l.trim()).find((l) => l.length > 0) ?? "";
+  return line.length > 200 ? `${line.slice(0, 197)}...` : line;
+}
 function defaultSelfUpdateIO() {
   return {
     async httpGetText(url) {
@@ -115342,17 +115375,40 @@ function defaultSelfUpdateIO() {
       }
       return hash2.digest("hex");
     },
-    probeBinaryVersion(path7) {
-      const r = spawnSync18(path7, ["version"], {
+    probeBinary(path7) {
+      const r = spawnSync18(path7, ["--version"], {
         encoding: "utf-8",
         timeout: 30000,
         env: { ...process.env, SWITCHROOM_SELF_UPDATED: "" }
       });
-      if (r.status !== 0)
-        return null;
+      if (r.error) {
+        const code = r.error.code;
+        return {
+          ok: false,
+          kind: "not-executable",
+          detail: code ? `${code}: ${r.error.message}` : r.error.message
+        };
+      }
+      if (r.signal) {
+        return { ok: false, kind: "not-executable", detail: `killed by signal ${r.signal}` };
+      }
+      if (r.status !== 0) {
+        return {
+          ok: false,
+          kind: "ran-but-failed",
+          detail: `exit ${r.status}${firstLine2(r.stderr) ? `: ${firstLine2(r.stderr)}` : ""}`
+        };
+      }
       const out = `${r.stdout ?? ""}`.trim();
       const m = out.match(/\d+\.\d+\.\d+/);
-      return m ? m[0] : null;
+      if (!m) {
+        return {
+          ok: false,
+          kind: "no-version",
+          detail: out ? `printed ${JSON.stringify(firstLine2(out))}` : "printed nothing"
+        };
+      }
+      return { ok: true, version: m[0] };
     },
     mkdirp(dir) {
       mkdirSync49(dir, { recursive: true });
@@ -116419,7 +116475,7 @@ function registerUpdateCommand(program3) {
 // src/cli/rollout.ts
 init_helpers();
 import { spawnSync as spawnSync22 } from "node:child_process";
-import { readFileSync as readFileSync85, chownSync as chownSync12, statSync as statSync53 } from "node:fs";
+import { readFileSync as readFileSync85, chownSync as chownSync12, statSync as statSync54 } from "node:fs";
 import { homedir as homedir51 } from "node:os";
 
 // src/cli/rollout-pin-journal.ts
@@ -116633,6 +116689,363 @@ function recoverPinJournal(configPath, opts = {}) {
 // src/cli/rollout.ts
 init_operator_uid();
 init_host_cli_stamp();
+
+// src/cli/host-cli-upgrade.ts
+init_self_update();
+import { lchownSync, lstatSync as lstatSync14, readdirSync as readdirSync32, statSync as statSync53 } from "node:fs";
+import { basename as basename10, dirname as dirname42, join as join96 } from "node:path";
+init_shipped_assets();
+var HOST_CLI_UPGRADE_SENTINEL = "SWITCHROOM_HOST_CLI_UPGRADE:";
+function encodeHostCliUpgradeResult(r) {
+  return `${HOST_CLI_UPGRADE_SENTINEL}${JSON.stringify(r)}`;
+}
+function parseHostCliUpgradeResult(logs) {
+  const lines = logs.split(`
+`);
+  for (let i2 = lines.length - 1;i2 >= 0; i2--) {
+    const line = lines[i2]?.trim() ?? "";
+    if (!line.startsWith(HOST_CLI_UPGRADE_SENTINEL))
+      continue;
+    try {
+      const o = JSON.parse(line.slice(HOST_CLI_UPGRADE_SENTINEL.length));
+      if (typeof o !== "object" || o === null)
+        return null;
+      if (typeof o.ok !== "boolean")
+        return null;
+      return {
+        ok: o.ok,
+        ...typeof o.version === "string" ? { version: o.version } : {},
+        ...typeof o.binaryPath === "string" ? { binaryPath: o.binaryPath } : {},
+        ...typeof o.error === "string" ? { error: o.error } : {}
+      };
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+var SEMVER_TAG_RE2 = /^v\d+\.\d+\.\d+$/;
+function defaultIo() {
+  return {
+    isFile: (p) => {
+      try {
+        return statSync53(p).isFile();
+      } catch {
+        return false;
+      }
+    },
+    kind: (p) => {
+      try {
+        const st = lstatSync14(p);
+        if (st.isSymbolicLink())
+          return "symlink";
+        if (st.isDirectory())
+          return "dir";
+        if (st.isFile())
+          return "file";
+        return "other";
+      } catch {
+        return;
+      }
+    },
+    owner: (p) => {
+      try {
+        const st = lstatSync14(p);
+        return { uid: st.uid, gid: st.gid };
+      } catch {
+        return;
+      }
+    },
+    chown: (p, uid, gid) => lchownSync(p, uid, gid),
+    list: (d) => {
+      try {
+        return readdirSync32(d);
+      } catch {
+        return [];
+      }
+    },
+    selfUpdate: defaultSelfUpdateIO(),
+    platform: process.platform,
+    arch: process.arch,
+    getuid: () => process.getuid?.()
+  };
+}
+function handBackOwnership(paths, owner, io) {
+  const failures = [];
+  const seen = new Set;
+  const stack = [...paths];
+  while (stack.length > 0) {
+    const p = stack.pop();
+    if (p === undefined || seen.has(p))
+      continue;
+    seen.add(p);
+    const kind = io.kind(p);
+    if (kind === undefined)
+      continue;
+    try {
+      io.chown(p, owner.uid, owner.gid);
+    } catch (err) {
+      failures.push(`${p}: ${err.message}`);
+    }
+    if (kind !== "dir")
+      continue;
+    for (const child of io.list(p))
+      stack.push(join96(p, child));
+  }
+  return failures;
+}
+async function runHostCliUpgrade(opts, io = defaultIo(), log = () => {}) {
+  const { binary, pin, from } = opts;
+  if (!SEMVER_TAG_RE2.test(pin)) {
+    return { ok: false, error: `--pin must be a vX.Y.Z release tag, got "${pin}"` };
+  }
+  if (!binary.startsWith("/")) {
+    return { ok: false, error: `--binary must be an absolute path, got "${binary}"` };
+  }
+  if (basename10(binary) !== "switchroom") {
+    return {
+      ok: false,
+      error: `--binary must name a file called \`switchroom\`, got ` + `"${basename10(binary)}" \u2014 refusing to overwrite an unrelated file.`
+    };
+  }
+  if (!io.isFile(binary)) {
+    return {
+      ok: false,
+      error: `${binary} is not an existing regular file \u2014 the host bindir is either ` + `not mounted or the recorded host CLI path is stale.`
+    };
+  }
+  const asset = releaseAssetName(io.platform, io.arch);
+  if (!asset) {
+    return {
+      ok: false,
+      error: `no published binary for ${io.platform}/${io.arch}`
+    };
+  }
+  const priorOwner = io.owner(binary);
+  const handBack = () => {
+    try {
+      if (!priorOwner || priorOwner.uid === io.getuid())
+        return;
+      const installRoot = payloadInstallRoot(binary);
+      const failures = handBackOwnership([
+        binary,
+        join96(dirname42(binary), ".switchroom-versions"),
+        dirname42(installRoot),
+        installRoot,
+        payloadVersionDir(installRoot, pin)
+      ], priorOwner, io);
+      if (failures.length > 0) {
+        log(`warning: could not hand ownership back to uid ${priorOwner.uid}: ` + `${failures.join("; ")}
+`);
+      }
+    } catch (err) {
+      log(`warning: ownership handoff failed: ${err.message}
+`);
+    }
+  };
+  try {
+    let result;
+    try {
+      result = await performSelfUpdate({
+        plan: {
+          action: "update",
+          from: `v${from.replace(/^v/, "")}`,
+          to: pin,
+          binaryPath: binary
+        },
+        assetName: asset,
+        io: io.selfUpdate,
+        log
+      });
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+    const proven = io.selfUpdate.probeBinary(binary);
+    if (!proven.ok) {
+      return {
+        ok: false,
+        error: `swapped ${binary} but ${describeBinaryProbeFailure({
+          probe: proven,
+          path: binary,
+          subject: "the installed binary"
+        })} ${result.message}`
+      };
+    }
+    if (`v${proven.version.replace(/^v/, "")}` !== pin) {
+      return {
+        ok: false,
+        error: `swapped ${binary} but it reports ${proven.version}, not ${pin} \u2014 ` + `the install did not land. ${result.message}`
+      };
+    }
+    return { ok: true, version: pin, binaryPath: binary };
+  } finally {
+    handBack();
+  }
+}
+function registerHostCliUpgradeCommand(program3) {
+  program3.command("host-cli-upgrade").description("INTERNAL (#4585): replace a bind-mounted HOST switchroom binary with a " + "published release, checksum-verified. Spawned by rollout inside a " + "short-lived helper container; not for interactive use.").requiredOption("--binary <path>", "Path of the host binary to replace").requiredOption("--pin <version>", "Target release tag, vX.Y.Z").requiredOption("--from <version>", "Version currently installed").action(async (opts) => {
+    const result = await runHostCliUpgrade(opts, defaultIo(), (s) => process.stderr.write(s.endsWith(`
+`) ? s : `${s}
+`));
+    process.stdout.write(`${encodeHostCliUpgradeResult(result)}
+`);
+    if (!result.ok) {
+      process.stderr.write(`host-cli-upgrade failed: ${result.error}
+`);
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/cli/host-cli-heal.ts
+var HEAL_PREFIX_MOUNT = "/hostcli";
+var HEAL_HELPER_CONTAINER = "switchroom-hostcli-heal";
+var HOSTD_CONTAINER_NAME = "switchroom-hostd";
+var HOST_CLI_HEAL_TIMEOUT_MS = (() => {
+  const raw = process.env.SWITCHROOM_HOST_CLI_HEAL_TIMEOUT_MS;
+  const n = raw ? Number(raw) : NaN;
+  return Number.isFinite(n) && n > 0 ? n : 10 * 60 * 1000;
+})();
+function planHostCliHeal(opts) {
+  const { stamp, target, hostdCtx } = opts;
+  if (!hostdCtx) {
+    return {
+      action: "skip",
+      reason: "not running in hostd context \u2014 on the host shell the operator can run " + "the install command directly"
+    };
+  }
+  if (!stamp)
+    return { action: "skip", reason: "no host-cli.json stamp to act on" };
+  if (!/^v\d+\.\d+\.\d+$/.test(target)) {
+    return { action: "skip", reason: `target "${target}" is not a vX.Y.Z release tag` };
+  }
+  if (stamp.installKind !== "static-binary") {
+    return {
+      action: "skip",
+      reason: `the host CLI is a ${stamp.installKind} install \u2014 only a static-binary ` + `install can be replaced by swapping one file, so an operator must run ` + `the upgrade host-side`
+    };
+  }
+  const path7 = stamp.path;
+  if (!path7.startsWith("/") || path7.includes("/..")) {
+    return { action: "skip", reason: `recorded host CLI path "${path7}" is not a plain absolute path` };
+  }
+  const installDir = path7.slice(0, path7.lastIndexOf("/"));
+  const name = path7.slice(path7.lastIndexOf("/") + 1);
+  if (name !== "switchroom") {
+    return { action: "skip", reason: `recorded host CLI path "${path7}" is not named \`switchroom\`` };
+  }
+  const prefixHostPath = installDir.slice(0, installDir.lastIndexOf("/"));
+  const dirName = installDir.slice(installDir.lastIndexOf("/") + 1);
+  if (prefixHostPath.length === 0 || dirName.length === 0) {
+    return {
+      action: "skip",
+      reason: `recorded host CLI path "${path7}" has no install prefix to bind \u2014 ` + `refusing to mount the host root`
+    };
+  }
+  return {
+    action: "heal",
+    prefixHostPath,
+    containerBinaryPath: `${HEAL_PREFIX_MOUNT}/${dirName}/switchroom`,
+    from: stamp.version,
+    target
+  };
+}
+function healHelperArgs(opts) {
+  const { plan, helperImage } = opts;
+  return [
+    "run",
+    "-d",
+    "--name",
+    opts.containerName ?? HEAL_HELPER_CONTAINER,
+    "--label",
+    "switchroom.hostcli-heal=true",
+    "-v",
+    `${plan.prefixHostPath}:${HEAL_PREFIX_MOUNT}:rw`,
+    helperImage,
+    "switchroom",
+    "host-cli-upgrade",
+    "--binary",
+    plan.containerBinaryPath,
+    "--pin",
+    plan.target,
+    "--from",
+    plan.from
+  ];
+}
+function resolveHelperImage(docker) {
+  const r = docker(["inspect", "--format", "{{.Config.Image}}", HOSTD_CONTAINER_NAME]);
+  if (!r.ok)
+    return null;
+  const ref = r.stdout.trim().split(`
+`)[0]?.trim() ?? "";
+  return ref.length > 0 ? ref : null;
+}
+function runHostCliHeal(opts) {
+  const { plan, docker } = opts;
+  const name = opts.containerName ?? HEAL_HELPER_CONTAINER;
+  const log = opts.log ?? (() => {});
+  const image = resolveHelperImage(docker);
+  if (!image) {
+    return {
+      ok: false,
+      message: `could not resolve the image of the running \`${HOSTD_CONTAINER_NAME}\` ` + `container, so there is no image to run the upgrade helper from`
+    };
+  }
+  docker(["rm", "-f", name]);
+  log(`\u21bb host CLI ${plan.from} \u2192 ${plan.target}: running the upgrade helper ` + `(${image}, binding ${plan.prefixHostPath})
+`);
+  const started = docker(healHelperArgs({ plan, helperImage: image, containerName: name }));
+  if (!started.ok) {
+    return {
+      ok: false,
+      message: `could not start the upgrade helper: ${oneLine(started.stderr) || "docker run failed"}`
+    };
+  }
+  try {
+    return waitForHelper(docker, name, plan);
+  } catch (err) {
+    return { ok: false, message: `the upgrade helper could not be waited on: ${err.message}` };
+  } finally {
+    try {
+      docker(["rm", "-f", name]);
+    } catch {}
+  }
+}
+function waitForHelper(docker, name, plan) {
+  const waited = docker(["wait", name]);
+  const logs = docker(["logs", name]);
+  const blob = `${logs.stdout}
+${logs.stderr}`;
+  const parsed = parseHostCliUpgradeResult(blob);
+  if (!waited.ok) {
+    return {
+      ok: false,
+      message: `waiting on the upgrade helper failed (${oneLine(waited.stderr) || "docker wait failed"})` + (parsed?.error ? `; helper reported: ${parsed.error}` : "")
+    };
+  }
+  const code = waited.stdout.trim().split(`
+`).pop()?.trim() ?? "";
+  if (code !== "0" || !parsed || !parsed.ok) {
+    return {
+      ok: false,
+      message: `the upgrade helper exited ${code || "?"}: ` + (parsed?.error ?? (oneLine(blob) || "no diagnostic on stdout/stderr"))
+    };
+  }
+  if (!parsed.version) {
+    return { ok: false, message: "the upgrade helper reported success without a version" };
+  }
+  return {
+    ok: true,
+    version: parsed.version,
+    message: `host CLI upgraded ${plan.from} \u2192 ${parsed.version} at ${plan.containerBinaryPath.replace(HEAL_PREFIX_MOUNT, plan.prefixHostPath)}`
+  };
+}
+function oneLine(s) {
+  const flat = s.replace(/\s+/g, " ").trim();
+  return flat.length > 400 ? `${flat.slice(0, 397)}...` : flat;
+}
+
+// src/cli/rollout.ts
 init_self_invoke();
 init_atomic();
 
@@ -117281,7 +117694,7 @@ function createRolloutDeps(params) {
       if (after === before)
         return false;
       beginPinPersist(configPath, pin);
-      writeConfigPreservingOwnership(configPath, after, statSync53(configPath).mode & 511);
+      writeConfigPreservingOwnership(configPath, after, statSync54(configPath).mode & 511);
       return true;
     },
     commitPin: () => {
@@ -117309,8 +117722,21 @@ function createRolloutDeps(params) {
     } : {}
   };
 }
-function registerRolloutCommand(program3) {
+function registerRolloutCommand(program3, testHooks) {
   const hostdCtx = isHostdContext2();
+  const hostCliHealDocker = testHooks?.hostCliHealDocker;
+  const defaultHostCliHealDocker = (args) => {
+    try {
+      const r = spawnSync22("docker", args, {
+        encoding: "utf8",
+        timeout: HOST_CLI_HEAL_TIMEOUT_MS,
+        killSignal: ROLLOUT_KILL_SIGNAL
+      });
+      return { ok: r.status === 0, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+    } catch (err) {
+      return { ok: false, stdout: "", stderr: err.message };
+    }
+  };
   program3.command("rollout").description("Deploy a pinned version to the fleet, safely (staggered restart + " + "per-agent version assert + web/hostd refresh)." + (hostdCtx ? "" : " Run with sudo.")).option("--pin <version>", "Version to roll (e.g. v0.15.18). Defaults to release.pin from config.").option("--agents <list>", "Comma-separated subset of agents to roll (default: all configured).").option("--skip-web", "Skip the web refresh (host-shell path: also the hostd + hindsight " + "refresh). On the hostd/agent path only the web refresh is skipped \u2014 " + "hindsight is still recreated and hostd stays deferred regardless.").option("--allow-downgrade", "Permit rolling to an older semver tag (operator-approved rollback path). " + "When set, the downgrade guard is relaxed so --pin may be older than the " + "current release.pin. All other safety rails apply unchanged.").option("--allow-stale-host-cli", "Roll the fleet even though the HOST operator CLI is observably behind " + "the target. Escape hatch for the host-CLI-first gate: the host CLI is " + "then left drifted and every later host-shell command runs old code. " + "HOST-SHELL ONLY: deliberately not exposed as an `mcp__hostd__rollout` " + "parameter, so an agent cannot roll past the gate on its own \u2014 " + "overriding requires the same host shell needed to actually fix it.").option("--dry-run", "Print the plan and exit without changing anything.").action(async (opts) => {
     if (!opts.dryRun) {
       const note = recoverPinJournal(getConfigPath(program3));
@@ -117360,29 +117786,6 @@ function registerRolloutCommand(program3) {
       process.exitCode = 2;
       return;
     }
-    const hostCliStamp = readHostCliStamp();
-    if (!opts.allowStaleHostCli && shouldRefuseStaleHostCli(hostCliStamp, target)) {
-      const observed = hostCliStamp?.version ?? "unknown";
-      const refusal = `rollout refused: the HOST operator CLI is v${observed}, OLDER than ` + `the target ${target}. The host CLI must be upgraded FIRST \u2014 it is ` + `what runs \`switchroom apply\`, \`vault\`, \`doctor\` and the next ` + `roll host-side, and leaving it behind is how it silently drifted ` + `five releases. Run this on the host, then re-run the roll: ` + `${hostCliInstallCommand(hostCliStamp, target)}. ` + `(Observed from ${HOST_CLI_STAMP_FILENAME}, refreshed by every ` + `host-context switchroom command \u2014 if you already upgraded, run any ` + `switchroom command on the host to refresh it, or pass ` + `--allow-stale-host-cli to roll anyway.) Nothing was changed.`;
-      process.stderr.write(refusal + `
-`);
-      if (hostdCtx) {
-        process.stdout.write(encodeRolloutResultLine({
-          ok: false,
-          rolled: [],
-          failedStep: PREFLIGHT_HOST_CLI_STALE_STEP,
-          got: observed,
-          warnings: [refusal]
-        }) + `
-`);
-      }
-      process.exitCode = 2;
-      return;
-    }
-    if (opts.allowStaleHostCli && shouldRefuseStaleHostCli(hostCliStamp, target)) {
-      process.stderr.write(`\u26a0\ufe0f  --allow-stale-host-cli: rolling past a HOST operator CLI on ` + `v${hostCliStamp?.version} (target ${target}). Fix it host-side ` + `with: ${hostCliInstallCommand(hostCliStamp, target)}
-`);
-    }
     if (shouldRefuseDowngrade(hostdCtx, resolvedPin, config.release?.pin, opts.allowDowngrade)) {
       const current = config.release?.pin;
       process.stderr.write(`rollout (hostd path) refuses a DOWNGRADE: ${resolvedPin} is older ` + `than the current pin ${current}. Pass --allow-downgrade to ` + `authorize an operator-approved rollback to a known-good earlier ` + `tag. Nothing was changed.
@@ -117410,6 +117813,63 @@ function registerRolloutCommand(program3) {
       process.exitCode = 2;
       return;
     }
+    let hostCliStamp = readHostCliStamp();
+    let healNote;
+    let healDeferredByDryRun = false;
+    if (!opts.allowStaleHostCli && shouldRefuseStaleHostCli(hostCliStamp, target)) {
+      const plan = planHostCliHeal({ stamp: hostCliStamp, target, hostdCtx });
+      if (plan.action === "skip") {
+        healNote = `host CLI self-heal not attempted: ${plan.reason}.`;
+      } else if (opts.dryRun) {
+        healDeferredByDryRun = true;
+        healNote = `would upgrade the HOST CLI ${plan.from} \u2192 ${plan.target} first, in a ` + `short-lived helper container binding ${plan.prefixHostPath}`;
+        process.stdout.write(`\u21bb dry-run: ${healNote}
+`);
+      } else {
+        const outcome = runHostCliHeal({
+          plan,
+          docker: hostCliHealDocker ?? defaultHostCliHealDocker,
+          log: (line) => process.stderr.write(line)
+        });
+        if (outcome.ok && outcome.version) {
+          const updated = {
+            ...hostCliStamp,
+            version: outcome.version.replace(/^v/, "")
+          };
+          const w = writeHostCliStamp(updated, testHooks?.hostCliStampIo ?? {});
+          hostCliStamp = updated;
+          healNote = `${outcome.message}` + (w.status === "skipped" ? ` (proceeding on the PROVEN version; ${HOST_CLI_STAMP_FILENAME} ` + `could not be refreshed: ${w.reason} \u2014 the next roll will ` + `re-observe the old version and heal again)` : "");
+          process.stderr.write(`\u2705 ${healNote}
+`);
+        } else {
+          healNote = `host CLI self-heal FAILED: ${outcome.message}.`;
+          process.stderr.write(`\u26a0\ufe0f  ${healNote}
+`);
+        }
+      }
+    }
+    if (!opts.allowStaleHostCli && !healDeferredByDryRun && shouldRefuseStaleHostCli(hostCliStamp, target)) {
+      const observed = hostCliStamp?.version ?? "unknown";
+      const refusal = `rollout refused: the HOST operator CLI is v${observed}, OLDER than ` + `the target ${target}. The host CLI must be upgraded FIRST \u2014 it is ` + `what runs \`switchroom apply\`, \`vault\`, \`doctor\` and the next ` + `roll host-side, and leaving it behind is how it silently drifted ` + `five releases. ` + (healNote ? `${healNote} ` : "") + `An operator must run this on the host, then re-run the roll: ` + `${hostCliInstallCommand(hostCliStamp, target)}. ` + `(Observed from ${HOST_CLI_STAMP_FILENAME}, refreshed by every ` + `host-context switchroom command \u2014 if you already upgraded, run any ` + `switchroom command on the host to refresh it, or pass ` + `--allow-stale-host-cli to roll anyway.) Nothing was changed.`;
+      process.stderr.write(refusal + `
+`);
+      if (hostdCtx) {
+        process.stdout.write(encodeRolloutResultLine({
+          ok: false,
+          rolled: [],
+          failedStep: PREFLIGHT_HOST_CLI_STALE_STEP,
+          got: observed,
+          warnings: [refusal]
+        }) + `
+`);
+      }
+      process.exitCode = 2;
+      return;
+    }
+    if (opts.allowStaleHostCli && shouldRefuseStaleHostCli(hostCliStamp, target)) {
+      process.stderr.write(`\u26a0\ufe0f  --allow-stale-host-cli: rolling past a HOST operator CLI on ` + `v${hostCliStamp?.version} (target ${target}). Fix it host-side ` + `with: ${hostCliInstallCommand(hostCliStamp, target)}
+`);
+    }
     const steps = planRollout(requested, {
       skipWeb: opts.skipWeb,
       pinToPersist: resolvedPin ?? undefined,
@@ -117429,7 +117889,7 @@ function registerRolloutCommand(program3) {
       hindsightApiUrl = rawUrl ? rawUrl.replace(/\/mcp\/?$/, "").replace(/\/$/, "") : HINDSIGHT_DEFAULT_API_BASE_URL;
       resolveBankId = (agent) => config.agents?.[agent]?.memory?.collection ?? agent;
     }
-    const deps = createRolloutDeps({
+    const deps = testHooks?.rolloutDeps ?? createRolloutDeps({
       configPath,
       scriptPath,
       hostdCtx,
@@ -117519,7 +117979,7 @@ init_lifecycle();
 init_resolve_version();
 import { execSync as execSync3 } from "node:child_process";
 import { existsSync as existsSync93, readFileSync as readFileSync86 } from "node:fs";
-import { dirname as dirname42, join as join96 } from "node:path";
+import { dirname as dirname43, join as join97 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync3("claude --version 2>/dev/null", {
@@ -117569,16 +118029,16 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i2 = 0;i2 < 10 && dir && dir !== "/"; i2++) {
-    const pkgPath = join96(dir, "package.json");
+    const pkgPath = join97(dir, "package.json");
     if (existsSync93(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync86(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync93(join96(dir, ".git"))) {
+        if (pkg.name === "switchroom" && existsSync93(join97(dir, ".git"))) {
           return dir;
         }
       } catch {}
     }
-    dir = dirname42(dir);
+    dir = dirname43(dir);
   }
   return null;
 }
@@ -117755,31 +118215,31 @@ init_merge();
 // src/agents/session-retention.ts
 import {
   existsSync as existsSync94,
-  readdirSync as readdirSync32,
-  statSync as statSync54,
+  readdirSync as readdirSync33,
+  statSync as statSync55,
   unlinkSync as unlinkSync18
 } from "node:fs";
-import { join as join97 } from "node:path";
+import { join as join98 } from "node:path";
 var DEFAULT_SESSION_RETENTION_MAX_COUNT = 20;
 var DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS = 30;
 var MIN_KEEP = 2;
 function collectSessionJsonl(claudeConfigDir) {
-  const projects = join97(claudeConfigDir, "projects");
+  const projects = join98(claudeConfigDir, "projects");
   if (!existsSync94(projects))
     return [];
   const found = [];
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync32(dir);
+      entries = readdirSync33(dir);
     } catch {
       return;
     }
     for (const name of entries) {
-      const full = join97(dir, name);
+      const full = join98(dir, name);
       let st;
       try {
-        st = statSync54(full);
+        st = statSync55(full);
       } catch {
         continue;
       }
@@ -117900,15 +118360,15 @@ import {
   existsSync as existsSync95,
   mkdirSync as mkdirSync53,
   openSync as openSync17,
-  readdirSync as readdirSync33,
+  readdirSync as readdirSync34,
   readFileSync as readFileSync87,
   renameSync as renameSync25,
-  statSync as statSync55,
+  statSync as statSync56,
   unlinkSync as unlinkSync19,
   writeFileSync as writeFileSync38,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join98 } from "node:path";
+import { join as join99 } from "node:path";
 import { randomBytes as randomBytes15 } from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
 
@@ -117935,7 +118395,7 @@ function computeFingerprint(source, code) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path7 = join98(stateDir, ISSUES_FILE);
+  const path7 = join99(stateDir, ISSUES_FILE);
   if (!existsSync95(path7))
     return [];
   let raw;
@@ -118013,7 +118473,7 @@ function record(stateDir, input, nowFn = Date.now) {
   });
 }
 function resolve51(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync95(join98(stateDir, ISSUES_FILE)))
+  if (!existsSync95(join99(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -118031,7 +118491,7 @@ function resolve51(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync95(join98(stateDir, ISSUES_FILE)))
+  if (!existsSync95(join99(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -118049,7 +118509,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync95(join98(stateDir, ISSUES_FILE)))
+  if (!existsSync95(join99(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -118082,7 +118542,7 @@ function ensureDir(stateDir) {
   mkdirSync53(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path7 = join98(stateDir, ISSUES_FILE);
+  const path7 = join99(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
   const tmp = `${path7}.tmp-${process.pid}-${randomBytes15(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
@@ -118096,7 +118556,7 @@ var TMP_PREFIX = `${ISSUES_FILE}.tmp-`;
 function sweepOrphanTmpFiles(stateDir) {
   let entries;
   try {
-    entries = readdirSync33(stateDir);
+    entries = readdirSync34(stateDir);
   } catch {
     return;
   }
@@ -118104,9 +118564,9 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join98(stateDir, entry);
+    const tmpPath = join99(stateDir, entry);
     try {
-      const stat = statSync55(tmpPath);
+      const stat = statSync56(tmpPath);
       if (stat.mtimeMs < cutoff) {
         unlinkSync19(tmpPath);
       }
@@ -118116,7 +118576,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join98(stateDir, ISSUES_LOCK);
+  const lockPath = join99(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -118401,7 +118861,7 @@ function relTime(deltaMs) {
 init_source();
 import { existsSync as existsSync98 } from "node:fs";
 import { homedir as homedir54 } from "node:os";
-import { join as join101, resolve as resolve52 } from "node:path";
+import { join as join102, resolve as resolve52 } from "node:path";
 
 // src/deps/python.ts
 import { createHash as createHash18 } from "node:crypto";
@@ -118412,7 +118872,7 @@ import {
   rmSync as rmSync16,
   writeFileSync as writeFileSync39
 } from "node:fs";
-import { dirname as dirname43, join as join99 } from "node:path";
+import { dirname as dirname44, join as join100 } from "node:path";
 import { homedir as homedir52 } from "node:os";
 import { execFileSync as execFileSync28 } from "node:child_process";
 
@@ -118425,7 +118885,7 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join99(homedir52(), ".switchroom", "deps", "python");
+  return join100(homedir52(), ".switchroom", "deps", "python");
 }
 function hashFile(path7) {
   return createHash18("sha256").update(readFileSync88(path7)).digest("hex");
@@ -118437,11 +118897,11 @@ function ensurePythonEnv(opts) {
   if (!existsSync96(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join99(cacheRoot, skillName);
-  const stampPath = join99(venvDir, ".requirements.sha256");
-  const binDir = join99(venvDir, "bin");
-  const pythonBin = join99(binDir, "python");
-  const pipBin = join99(binDir, "pip");
+  const venvDir = join100(cacheRoot, skillName);
+  const stampPath = join100(venvDir, ".requirements.sha256");
+  const binDir = join100(venvDir, "bin");
+  const pythonBin = join100(binDir, "python");
+  const pipBin = join100(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
   if (!force && existsSync96(stampPath) && existsSync96(pythonBin)) {
     const existingHash = readFileSync88(stampPath, "utf8").trim();
@@ -118459,7 +118919,7 @@ function ensurePythonEnv(opts) {
   if (existsSync96(venvDir)) {
     rmSync16(venvDir, { recursive: true, force: true });
   }
-  mkdirSync54(dirname43(venvDir), { recursive: true });
+  mkdirSync54(dirname44(venvDir), { recursive: true });
   try {
     execFileSync28(hostPython, ["-m", "venv", venvDir], { stdio: "pipe" });
   } catch (err) {
@@ -118500,7 +118960,7 @@ import {
   rmSync as rmSync17,
   writeFileSync as writeFileSync40
 } from "node:fs";
-import { dirname as dirname44, join as join100 } from "node:path";
+import { dirname as dirname45, join as join101 } from "node:path";
 import { homedir as homedir53 } from "node:os";
 import { execFileSync as execFileSync29 } from "node:child_process";
 
@@ -118524,16 +118984,16 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join100(homedir53(), ".switchroom", "deps", "node");
+  return join101(homedir53(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
-  const sourceDir = dirname44(packageJsonPath);
+  const sourceDir = dirname45(packageJsonPath);
   const hasher = createHash19("sha256");
   hasher.update(`package.json
 `);
   hasher.update(readFileSync89(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join100(sourceDir, lockName);
+    const lockPath = join101(sourceDir, lockName);
     if (existsSync97(lockPath)) {
       hasher.update(`
 `);
@@ -118552,11 +119012,11 @@ function ensureNodeEnv(opts) {
   if (!existsSync97(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
-  const sourceDir = dirname44(packageJsonPath);
-  const envDir = join100(cacheRoot, skillName);
-  const stampPath = join100(envDir, ".package.sha256");
-  const nodeModulesDir = join100(envDir, "node_modules");
-  const binDir = join100(nodeModulesDir, ".bin");
+  const sourceDir = dirname45(packageJsonPath);
+  const envDir = join101(cacheRoot, skillName);
+  const stampPath = join101(envDir, ".package.sha256");
+  const nodeModulesDir = join101(envDir, "node_modules");
+  const binDir = join101(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
   if (!force && existsSync97(stampPath) && existsSync97(nodeModulesDir)) {
     const existingHash = readFileSync89(stampPath, "utf8").trim();
@@ -118574,12 +119034,12 @@ function ensureNodeEnv(opts) {
     rmSync17(envDir, { recursive: true, force: true });
   }
   mkdirSync55(envDir, { recursive: true });
-  copyFileSync13(packageJsonPath, join100(envDir, "package.json"));
+  copyFileSync13(packageJsonPath, join101(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join100(sourceDir, lockName);
+    const lockPath = join101(sourceDir, lockName);
     if (existsSync97(lockPath)) {
-      copyFileSync13(lockPath, join100(envDir, lockName));
+      copyFileSync13(lockPath, join101(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -118618,13 +119078,13 @@ function registerDepsCommand(program3) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join101(skillsRoot, skill);
+    const skillDir = join102(skillsRoot, skill);
     if (!existsSync98(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join101(skillDir, "requirements.txt");
-    const packageJsonPath = join101(skillDir, "package.json");
+    const requirementsPath = join102(skillDir, "requirements.txt");
+    const packageJsonPath = join102(skillDir, "package.json");
     const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync98(requirementsPath));
     const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync98(packageJsonPath));
     let did = 0;
@@ -119579,7 +120039,7 @@ init_helpers();
 init_loader();
 init_merge();
 import { copyFileSync as copyFileSync14, existsSync as existsSync100, readFileSync as readFileSync90, writeFileSync as writeFileSync41 } from "node:fs";
-import { join as join102, resolve as resolve54 } from "node:path";
+import { join as join103, resolve as resolve54 } from "node:path";
 init_scaffold();
 init_profiles();
 init_schema();
@@ -119605,7 +120065,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join102(workspaceDir, "SOUL.md"),
+    soulPath: join103(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -119671,8 +120131,8 @@ function registerSoulCommand(program3) {
 // src/cli/debug.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync101, readFileSync as readFileSync91, readdirSync as readdirSync34, statSync as statSync56 } from "node:fs";
-import { resolve as resolve55, join as join103 } from "node:path";
+import { existsSync as existsSync101, readFileSync as readFileSync91, readdirSync as readdirSync35, statSync as statSync57 } from "node:fs";
+import { resolve as resolve55, join as join104 } from "node:path";
 import { createHash as createHash20 } from "node:crypto";
 init_merge();
 init_hindsight2();
@@ -119683,7 +120143,7 @@ function estimateTokens(bytes) {
   return Math.round(bytes / 3.7);
 }
 function readMcpServerNames(agentDir) {
-  const mcpPath = join103(agentDir, ".mcp.json");
+  const mcpPath = join104(agentDir, ".mcp.json");
   if (!existsSync101(mcpPath))
     return [];
   try {
@@ -119697,20 +120157,20 @@ function sha2562(content) {
   return createHash20("sha256").update(content).digest("hex").slice(0, 16);
 }
 function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join103(claudeConfigDir, "projects");
+  const projectsDir = join104(claudeConfigDir, "projects");
   if (!existsSync101(projectsDir))
     return;
   try {
-    const entries = readdirSync34(projectsDir, { withFileTypes: true });
+    const entries = readdirSync35(projectsDir, { withFileTypes: true });
     let latest;
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const projectPath = join103(projectsDir, entry.name);
-      const transcriptPath = join103(projectPath, "transcript.jsonl");
+      const projectPath = join104(projectsDir, entry.name);
+      const transcriptPath = join104(projectPath, "transcript.jsonl");
       if (!existsSync101(transcriptPath))
         continue;
-      const stat3 = statSync56(transcriptPath);
+      const stat3 = statSync57(transcriptPath);
       if (!latest || stat3.mtimeMs > latest.mtime) {
         latest = { path: transcriptPath, mtime: stat3.mtimeMs };
       }
@@ -119776,11 +120236,11 @@ function registerDebugCommand(program3) {
       process.exit(1);
     }
     const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join103(agentDir, ".claude");
-    const claudeMdPath = join103(agentDir, "CLAUDE.md");
-    const soulMdPath = join103(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join103(workspaceDir, "SOUL.md");
-    const handoffPath = join103(agentDir, ".handoff.md");
+    const claudeConfigDir = join104(agentDir, ".claude");
+    const claudeMdPath = join104(agentDir, "CLAUDE.md");
+    const soulMdPath = join104(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join104(workspaceDir, "SOUL.md");
+    const handoffPath = join104(agentDir, ".handoff.md");
     const lastN = parseInt(opts.last, 10);
     if (isNaN(lastN) || lastN < 1) {
       console.error("--last must be a positive integer");
@@ -119909,9 +120369,9 @@ function registerDebugCommand(program3) {
     const soulMdBytes = soulMdContent.length;
     const perTurnBytes = dynamicResult.concatenated.length;
     const userBytes = userMessage?.text.length ?? 0;
-    const fleetDir = join103(agentsDir, "..", "fleet");
-    const fleetInvPath = join103(fleetDir, "switchroom-invariants.md");
-    const fleetClaudePath = join103(fleetDir, "CLAUDE.md");
+    const fleetDir = join104(agentsDir, "..", "fleet");
+    const fleetInvPath = join104(fleetDir, "switchroom-invariants.md");
+    const fleetClaudePath = join104(fleetDir, "CLAUDE.md");
     const fleetInvBytes = existsSync101(fleetInvPath) ? readFileSync91(fleetInvPath, "utf-8").length : 0;
     const fleetClaudeBytes = existsSync101(fleetClaudePath) ? readFileSync91(fleetClaudePath, "utf-8").length : 0;
     const fleetBytes = fleetInvBytes + fleetClaudeBytes;
@@ -119947,7 +120407,7 @@ init_source();
 // src/worktree/claim.ts
 import { execFileSync as execFileSync30 } from "node:child_process";
 import { closeSync as closeSync18, mkdirSync as mkdirSync57, openSync as openSync18, existsSync as existsSync103, unlinkSync as unlinkSync21 } from "node:fs";
-import { join as join105, resolve as resolve57 } from "node:path";
+import { join as join106, resolve as resolve57 } from "node:path";
 import { homedir as homedir56 } from "node:os";
 import { randomBytes as randomBytes16 } from "node:crypto";
 
@@ -119956,18 +120416,18 @@ import {
   mkdirSync as mkdirSync56,
   writeFileSync as writeFileSync42,
   readFileSync as readFileSync92,
-  readdirSync as readdirSync35,
+  readdirSync as readdirSync36,
   unlinkSync as unlinkSync20,
   existsSync as existsSync102,
   renameSync as renameSync26
 } from "node:fs";
-import { join as join104, resolve as resolve56 } from "node:path";
+import { join as join105, resolve as resolve56 } from "node:path";
 import { homedir as homedir55 } from "node:os";
 function registryDir() {
-  return resolve56(process.env.SWITCHROOM_WORKTREE_DIR ?? join104(homedir55(), ".switchroom", "worktrees"));
+  return resolve56(process.env.SWITCHROOM_WORKTREE_DIR ?? join105(homedir55(), ".switchroom", "worktrees"));
 }
 function recordPath(id) {
-  return join104(registryDir(), `${id}.json`);
+  return join105(registryDir(), `${id}.json`);
 }
 function ensureDir2() {
   mkdirSync56(registryDir(), { recursive: true });
@@ -119999,7 +120459,7 @@ function listRecords() {
   ensureDir2();
   const dir = registryDir();
   const records = [];
-  for (const entry of readdirSync35(dir)) {
+  for (const entry of readdirSync36(dir)) {
     if (!entry.endsWith(".json"))
       continue;
     const id = entry.slice(0, -5);
@@ -120018,7 +120478,7 @@ function acquireRepoLock(repoPath) {
   const lockDir = registryDir();
   mkdirSync57(lockDir, { recursive: true });
   const lockName = repoPath.replace(/[^A-Za-z0-9]/g, "_");
-  const lockPath = join105(lockDir, `.lock-${lockName}`);
+  const lockPath = join106(lockDir, `.lock-${lockName}`);
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -120045,7 +120505,7 @@ function acquireRepoLock(repoPath) {
 }
 var DEFAULT_CONCURRENCY = 5;
 function worktreesBaseDir() {
-  return resolve57(process.env.SWITCHROOM_WORKTREE_BASE ?? join105(homedir56(), ".switchroom", "worktree-checkouts"));
+  return resolve57(process.env.SWITCHROOM_WORKTREE_BASE ?? join106(homedir56(), ".switchroom", "worktree-checkouts"));
 }
 function shortId() {
   return randomBytes16(4).toString("hex");
@@ -120067,7 +120527,7 @@ function resolveRepoPath(repo, codeRepos) {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return join105(homedir56(), p.slice(2));
+    return join106(homedir56(), p.slice(2));
   return p;
 }
 async function claimWorktree(input, codeRepos) {
@@ -120095,7 +120555,7 @@ async function claimWorktree(input, codeRepos) {
     branch = `task/${taskSuffix}-${id}`;
     const baseDir = worktreesBaseDir();
     mkdirSync57(baseDir, { recursive: true });
-    worktreePath = join105(baseDir, `${id}-${taskSuffix}`);
+    worktreePath = join106(baseDir, `${id}-${taskSuffix}`);
     const ambientOwner = process.env.SWITCHROOM_AGENT_NAME;
     const ownerAgent = input.ownerAgent ?? (ambientOwner != null && ambientOwner !== "" ? ambientOwner : undefined);
     const now2 = new Date().toISOString();
@@ -120319,14 +120779,14 @@ import { execFileSync as execFileSync33 } from "node:child_process";
 import {
   existsSync as existsSync106,
   readFileSync as readFileSync93,
-  readdirSync as readdirSync36,
-  statSync as statSync57,
+  readdirSync as readdirSync37,
+  statSync as statSync58,
   renameSync as renameSync27,
   mkdirSync as mkdirSync58,
   rmSync as rmSync18
 } from "node:fs";
 import { homedir as homedir57 } from "node:os";
-import { join as join106, resolve as resolve58 } from "node:path";
+import { join as join107, resolve as resolve58 } from "node:path";
 function parseGitdirPointer(dotGitFileContents) {
   const m = /^gitdir:\s*(.+?)\s*$/m.exec(dotGitFileContents);
   return m ? m[1] : null;
@@ -120485,7 +120945,7 @@ function defaultNewestTrackedMtimeMs(dir, exec) {
   let newest = 0;
   for (const f of files) {
     try {
-      const m = statSync57(join106(dir, f)).mtimeMs;
+      const m = statSync58(join107(dir, f)).mtimeMs;
       if (m > newest)
         newest = m;
     } catch {}
@@ -120493,17 +120953,17 @@ function defaultNewestTrackedMtimeMs(dir, exec) {
   return newest || Date.now();
 }
 function trashRoot() {
-  return resolve58(process.env.SWITCHROOM_WORKTREE_TRASH ?? join106(homedir57(), ".switchroom", "worktree-gc-trash"));
+  return resolve58(process.env.SWITCHROOM_WORKTREE_TRASH ?? join107(homedir57(), ".switchroom", "worktree-gc-trash"));
 }
 function planGc(roots, deps = {}, taskTreeRoots = []) {
   const exists = deps.existsSync ?? existsSync106;
-  const readDir = deps.readDir ?? ((p) => readdirSync36(p));
+  const readDir = deps.readDir ?? ((p) => readdirSync37(p));
   const readFile4 = deps.readFile ?? ((p) => readFileSync93(p, "utf8"));
-  const stat3 = deps.stat ?? ((p) => statSync57(p));
+  const stat3 = deps.stat ?? ((p) => statSync58(p));
   const exec = deps.exec ?? defaultExec3;
   const prSignal = deps.prSignal ?? ((repo, branch) => defaultPrSignal(repo, branch, exec));
   const stamp = deps.dateStamp ?? "undated";
-  const trash = join106(trashRoot(), stamp);
+  const trash = join107(trashRoot(), stamp);
   const probeInUse = deps.probeInUse ?? probePathInUse;
   const newestMtime = deps.newestTrackedMtimeMs ?? ((dir) => defaultNewestTrackedMtimeMs(dir, exec));
   const idleDays = deps.idleDays ?? 14;
@@ -120544,10 +121004,10 @@ function planGc(roots, deps = {}, taskTreeRoots = []) {
       continue;
     }
     for (const name of entries) {
-      const dir = join106(root, name);
+      const dir = join107(root, name);
       if (isEphemeralPath(dir))
         continue;
-      const dotGit = join106(dir, ".git");
+      const dotGit = join107(dir, ".git");
       if (!exists(dotGit))
         continue;
       let st;
@@ -120576,7 +121036,7 @@ function planGc(roots, deps = {}, taskTreeRoots = []) {
       ownerRepos.add(repoRoot);
       if (exists(ptr))
         continue;
-      orphans.push({ dir, owner: repoRoot, dest: join106(trash, name) });
+      orphans.push({ dir, owner: repoRoot, dest: join107(trash, name) });
     }
   }
   const registered = [];
@@ -120631,10 +121091,10 @@ function planGc(roots, deps = {}, taskTreeRoots = []) {
       continue;
     }
     for (const name of entries) {
-      const dir = join106(root, name);
+      const dir = join107(root, name);
       if (isEphemeralPath(dir))
         continue;
-      const dotGit = join106(dir, ".git");
+      const dotGit = join107(dir, ".git");
       if (!exists(dotGit))
         continue;
       let shape;
@@ -120739,7 +121199,7 @@ function planGc(roots, deps = {}, taskTreeRoots = []) {
         verdict,
         prSignal: sig,
         idle,
-        dest: join106(trash, name),
+        dest: join107(trash, name),
         willAct
       });
     }
@@ -120816,13 +121276,13 @@ function selectPurgeTargets(entries, olderThanDays) {
 }
 function listTrashEntries(nowMs, deps = {}) {
   const exists = deps.existsSync ?? existsSync106;
-  const readDir = deps.readDir ?? ((p) => readdirSync36(p));
+  const readDir = deps.readDir ?? ((p) => readdirSync37(p));
   const root = trashRoot();
   if (!exists(root))
     return [];
   const out = [];
   for (const stamp of readDir(root)) {
-    const stampDir = join106(root, stamp);
+    const stampDir = join107(root, stamp);
     let names;
     try {
       names = readDir(stampDir);
@@ -120830,10 +121290,10 @@ function listTrashEntries(nowMs, deps = {}) {
       continue;
     }
     for (const name of names) {
-      const p = join106(stampDir, name);
+      const p = join107(stampDir, name);
       let mtimeMs = nowMs;
       try {
-        mtimeMs = statSync57(p).mtimeMs;
+        mtimeMs = statSync58(p).mtimeMs;
       } catch {}
       out.push({ path: p, ageDays: (nowMs - mtimeMs) / 86400000 });
     }
@@ -120854,20 +121314,20 @@ function purgeTrash(paths) {
   return { deleted, errors: errors2 };
 }
 function defaultRoots() {
-  return [join106(homedir57(), "code")];
+  return [join107(homedir57(), "code")];
 }
 function defaultTaskTreeRoots() {
-  const agentsDir = join106(homedir57(), ".switchroom", "agents");
+  const agentsDir = join107(homedir57(), ".switchroom", "agents");
   let names;
   try {
-    names = readdirSync36(agentsDir);
+    names = readdirSync37(agentsDir);
   } catch {
     return [];
   }
   const roots = [];
   for (const name of names.sort()) {
     for (const sub of ["home/work", "home/workspace"]) {
-      const r = join106(agentsDir, name, sub);
+      const r = join107(agentsDir, name, sub);
       if (existsSync106(r))
         roots.push(r);
     }
@@ -121128,11 +121588,11 @@ init_scaffold_integration();
 import {
   chmodSync as chmodSync17,
   mkdirSync as mkdirSync59,
-  readdirSync as readdirSync37,
+  readdirSync as readdirSync38,
   rmSync as rmSync19,
   writeFileSync as writeFileSync43
 } from "node:fs";
-import { join as join107 } from "node:path";
+import { join as join108 } from "node:path";
 function encodeCredentialsFilename(email) {
   const SAFE = new Set([
     ..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
@@ -121396,16 +121856,16 @@ function resolveCredentialsDir(env2) {
   if (explicit && explicit.length > 0)
     return explicit;
   const stateBase = env2.SWITCHROOM_CONTAINER === "1" ? "/state/agent" : env2.HOME ?? ".";
-  return join107(stateBase, "google-workspace-mcp", "credentials");
+  return join108(stateBase, "google-workspace-mcp", "credentials");
 }
 function writeSeedFile(dir, email, seed) {
   mkdirSync59(dir, { recursive: true, mode: 448 });
   chmodSync17(dir, 448);
-  for (const name of readdirSync37(dir)) {
-    rmSync19(join107(dir, name), { force: true, recursive: true });
+  for (const name of readdirSync38(dir)) {
+    rmSync19(join108(dir, name), { force: true, recursive: true });
   }
   const filename = encodeCredentialsFilename(email);
-  const filePath = join107(dir, filename);
+  const filePath = join108(dir, filename);
   writeFileSync43(filePath, JSON.stringify(seed), { mode: 384 });
   chmodSync17(filePath, 384);
   return filePath;
@@ -121602,7 +122062,7 @@ function registerDriveMcpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn6 } from "node:child_process";
 import { writeFileSync as writeFileSync44, mkdirSync as mkdirSync60 } from "node:fs";
-import { dirname as dirname45, join as join108 } from "node:path";
+import { dirname as dirname46, join as join109 } from "node:path";
 var SOFTERIA_TOKEN_ENV = "MS365_MCP_OAUTH_TOKEN";
 var DEFAULT_REFRESH_LEAD_MS = 5 * 60 * 1000;
 var MAX_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
@@ -121638,7 +122098,7 @@ function computeRefreshDelayMs(expiresAt, now2, leadMs = DEFAULT_REFRESH_LEAD_MS
 function writeRefreshHeartbeat(agentName, data, account) {
   const path10 = heartbeatPath(agentName, account);
   try {
-    mkdirSync60(dirname45(path10), { recursive: true });
+    mkdirSync60(dirname46(path10), { recursive: true });
     writeFileSync44(path10, JSON.stringify(data, null, 2), { mode: 420 });
   } catch {}
 }
@@ -121647,7 +122107,7 @@ function heartbeatPath(agentName, account) {
   const override = process.env.SWITCHROOM_M365_HEARTBEAT_DIR;
   if (override) {
     const base = slug ? `m365-launcher-${agentName}-${slug}` : `m365-launcher-${agentName}`;
-    return join108(override, `${base}.heartbeat.json`);
+    return join109(override, `${base}.heartbeat.json`);
   }
   return slug ? `/state/agent/m365-launcher-${slug}.heartbeat.json` : "/state/agent/m365-launcher.heartbeat.json";
 }
@@ -121880,7 +122340,7 @@ function registerM365McpLauncherCommand(program3) {
 init_scaffold_integration();
 import { spawn as spawn7 } from "node:child_process";
 import { existsSync as existsSync107, mkdirSync as mkdirSync61, writeFileSync as writeFileSync45 } from "node:fs";
-import { dirname as dirname46 } from "node:path";
+import { dirname as dirname47 } from "node:path";
 var HEARTBEAT_WRITE_INTERVAL_MS = 30 * 1000;
 var DEFAULT_HEARTBEAT_PATH = "/state/agent/notion-launcher.heartbeat.json";
 var DEFAULT_VAULT_KEY = "notion/integration-token";
@@ -121890,7 +122350,7 @@ function buildNotionMcpArgs(opts) {
 }
 function defaultWriteHeartbeat(path10, contents) {
   try {
-    const dir = dirname46(path10);
+    const dir = dirname47(path10);
     if (!existsSync107(dir))
       mkdirSync61(dir, { recursive: true });
     writeFileSync45(path10, contents);
@@ -122005,7 +122465,7 @@ function registerNotionMcpLauncherCommand(program3) {
 init_hindsight_directive_admin();
 import { mkdirSync as mkdirSync62, readFileSync as readFileSync94, renameSync as renameSync28, writeFileSync as writeFileSync46 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join109 } from "node:path";
+import { join as join110 } from "node:path";
 import { createInterface as createInterface7 } from "node:readline";
 
 // src/memory/hindsight-knowledge-admin.ts
@@ -122593,12 +123053,12 @@ class HindsightShim {
 `));
   }
   get cachePath() {
-    return join109(this.opts.cacheDir, TOOLS_CACHE_FILENAME);
+    return join110(this.opts.cacheDir, TOOLS_CACHE_FILENAME);
   }
   writeCache(result) {
     try {
       mkdirSync62(this.opts.cacheDir, { recursive: true });
-      const tmp = join109(this.opts.cacheDir, `.${TOOLS_CACHE_FILENAME}.${process.pid}.tmp`);
+      const tmp = join110(this.opts.cacheDir, `.${TOOLS_CACHE_FILENAME}.${process.pid}.tmp`);
       writeFileSync46(tmp, JSON.stringify(result, null, 2) + `
 `);
       renameSync28(tmp, this.cachePath);
@@ -122882,7 +123342,7 @@ function resolveShimOptionsFromEnv(env2) {
   return {
     url: env2.HINDSIGHT_MCP_URL || HINDSIGHT_DEFAULT_MCP_URL,
     bankId: env2.HINDSIGHT_BANK_ID || "",
-    cacheDir: env2.HINDSIGHT_SHIM_CACHE_DIR || join109(home2, ".hindsight-shim")
+    cacheDir: env2.HINDSIGHT_SHIM_CACHE_DIR || join110(home2, ".hindsight-shim")
   };
 }
 function registerHindsightMcpShimCommand(program3) {
@@ -122895,11 +123355,11 @@ function registerHindsightMcpShimCommand(program3) {
 
 // src/cli/deliver-file.ts
 init_client2();
-import { readFileSync as readFileSync95, statSync as statSync58 } from "node:fs";
-import { basename as basename13 } from "node:path";
+import { readFileSync as readFileSync95, statSync as statSync59 } from "node:fs";
+import { basename as basename14 } from "node:path";
 
 // src/delivery/onedrive.ts
-import { basename as basename11 } from "node:path";
+import { basename as basename12 } from "node:path";
 var GRAPH = "https://graph.microsoft.com/v1.0";
 var ONEDRIVE_INLINE_MAX_BYTES = 4 * 1024 * 1024;
 function authHeaders2(token) {
@@ -123022,14 +123482,14 @@ async function createShareLink(deps, item, scopes = ["anonymous", "organization"
 async function deliverToOneDrive(args) {
   const deps = { accessToken: args.accessToken, fetchImpl: args.fetchImpl };
   const folder = await ensureSwitchroomFolder(deps, args.agentName);
-  const filename = basename11(args.localPath);
+  const filename = basename12(args.localPath);
   const item = await uploadFile(deps, folder.id, filename, args.bytes);
   const link = await createShareLink(deps, item, args.linkScopes);
   return { itemId: item.id, link, folderPath: `Switchroom/${args.agentName}` };
 }
 
 // src/delivery/gdrive.ts
-import { basename as basename12 } from "node:path";
+import { basename as basename13 } from "node:path";
 var DRIVE = "https://www.googleapis.com/drive/v3";
 var UPLOAD = "https://www.googleapis.com/upload/drive/v3";
 var FOLDER_MIME = "application/vnd.google-apps.folder";
@@ -123177,7 +123637,7 @@ async function createShareLink2(deps, file, scopes = ["anyone"]) {
 async function deliverToGoogleDrive(args) {
   const deps = { accessToken: args.accessToken, fetchImpl: args.fetchImpl };
   const folder = await ensureSwitchroomFolder2(deps, args.agentName);
-  const filename = basename12(args.localPath);
+  const filename = basename13(args.localPath);
   const file = await uploadFile2(deps, folder.id, filename, args.bytes);
   const link = await createShareLink2(deps, file, args.linkScopes);
   return { itemId: file.id, link, folderPath: `Switchroom/${args.agentName}` };
@@ -123234,7 +123694,7 @@ async function defaultResolveProvider() {
 }
 async function runDeliverFile(localPath, deps = {}) {
   const agentName = safeAgentName(deps.agentName ?? process.env.SWITCHROOM_AGENT_NAME);
-  const sizeOf = deps.fileSize ?? ((p) => statSync58(p).size);
+  const sizeOf = deps.fileSize ?? ((p) => statSync59(p).size);
   const read = deps.readFile ?? ((p) => new Uint8Array(readFileSync95(p)));
   const resolveProvider = deps.resolveProvider ?? defaultResolveProvider;
   let size;
@@ -123256,7 +123716,7 @@ async function runDeliverFile(localPath, deps = {}) {
   try {
     const bytes = read(localPath);
     const out = await provider.deliver({ agentName, localPath, bytes });
-    return { ok: true, provider: provider.name, link: out.link, folderPath: out.folderPath, filename: basename13(localPath) };
+    return { ok: true, provider: provider.name, link: out.link, folderPath: out.folderPath, filename: basename14(localPath) };
   } catch (err) {
     return { ok: false, provider: provider.name, error: `upload failed: ${err.message}` };
   }
@@ -123556,8 +124016,8 @@ function runRedactStdin() {
 }
 
 // src/cli/status-ask.ts
-import { readFileSync as readFileSync96, existsSync as existsSync108, readdirSync as readdirSync38 } from "node:fs";
-import { join as join110 } from "node:path";
+import { readFileSync as readFileSync96, existsSync as existsSync108, readdirSync as readdirSync39 } from "node:fs";
+import { join as join111 } from "node:path";
 import { homedir as homedir58 } from "node:os";
 
 // src/status-ask/report.ts
@@ -123893,19 +124353,19 @@ function resolveSources(explicitPath) {
     const config = loadConfig();
     agentsDir = resolveAgentsDir(config);
   } catch {
-    agentsDir = join110(homedir58(), ".switchroom", "agents");
+    agentsDir = join111(homedir58(), ".switchroom", "agents");
   }
   if (!existsSync108(agentsDir))
     return [];
   const sources = [];
   let entries;
   try {
-    entries = readdirSync38(agentsDir);
+    entries = readdirSync39(agentsDir);
   } catch {
     return [];
   }
   for (const name of entries) {
-    const path10 = join110(agentsDir, name, "runtime-metrics.jsonl");
+    const path10 = join111(agentsDir, name, "runtime-metrics.jsonl");
     if (existsSync108(path10)) {
       sources.push({ path: path10, agent: name });
     }
@@ -123941,28 +124401,28 @@ import {
   fsyncSync as fsyncSync8,
   mkdirSync as mkdirSync63,
   openSync as openSync19,
-  readdirSync as readdirSync39,
+  readdirSync as readdirSync40,
   readFileSync as readFileSync97,
   renameSync as renameSync29,
-  statSync as statSync59,
+  statSync as statSync60,
   unlinkSync as unlinkSync22,
   writeSync as writeSync10
 } from "node:fs";
-import { join as join111, resolve as resolve59 } from "node:path";
+import { join as join112, resolve as resolve59 } from "node:path";
 var STAGING_SUBDIR = ".staging";
 function overlayPathsFor(agent, opts = {}) {
   const base = opts.root ? resolve59(opts.root, agent) : resolve59(resolveDualPath(`~/.switchroom/agents/${agent}`));
-  const scheduleDir = join111(base, "schedule.d");
-  const scheduleStagingDir = join111(scheduleDir, STAGING_SUBDIR);
-  const skillsDir = join111(base, "skills.d");
-  const skillsStagingDir = join111(skillsDir, STAGING_SUBDIR);
+  const scheduleDir = join112(base, "schedule.d");
+  const scheduleStagingDir = join112(scheduleDir, STAGING_SUBDIR);
+  const skillsDir = join112(base, "skills.d");
+  const skillsStagingDir = join112(skillsDir, STAGING_SUBDIR);
   return {
     agentRoot: base,
     scheduleDir,
     scheduleStagingDir,
     skillsDir,
     skillsStagingDir,
-    lockPath: join111(base, ".lock"),
+    lockPath: join112(base, ".lock"),
     stagingDir: scheduleStagingDir
   };
 }
@@ -123988,7 +124448,7 @@ function withAgentLock(paths, fn) {
       if (e.code !== "EEXIST")
         throw err;
       try {
-        const age = Date.now() - statSync59(paths.lockPath).mtimeMs;
+        const age = Date.now() - statSync60(paths.lockPath).mtimeMs;
         if (age > 30000) {
           unlinkSync22(paths.lockPath);
           continue;
@@ -124021,7 +124481,7 @@ function alignStagedOwnerToDir(stagingPath, targetDir) {
     const euid = overlayWriterRuntime.geteuid();
     if (euid === undefined)
       return;
-    const dirStat = statSync59(targetDir);
+    const dirStat = statSync60(targetDir);
     if (dirStat.uid === euid)
       return;
     overlayWriterRuntime.chown(stagingPath, dirStat.uid, dirStat.gid);
@@ -124031,8 +124491,8 @@ function writeOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureDirs(paths);
-    const stagingPath = join111(paths.scheduleStagingDir, `${slug}.yaml`);
-    const finalPath = join111(paths.scheduleDir, `${slug}.yaml`);
+    const stagingPath = join112(paths.scheduleStagingDir, `${slug}.yaml`);
+    const finalPath = join112(paths.scheduleDir, `${slug}.yaml`);
     const fd = openSync19(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
@@ -124049,8 +124509,8 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
     ensureSkillsDirs(paths);
-    const stagingPath = join111(paths.skillsStagingDir, `${slug}.yaml`);
-    const finalPath = join111(paths.skillsDir, `${slug}.yaml`);
+    const stagingPath = join112(paths.skillsStagingDir, `${slug}.yaml`);
+    const finalPath = join112(paths.skillsDir, `${slug}.yaml`);
     const fd = openSync19(stagingPath, "w", 384);
     try {
       writeSync10(fd, yamlText);
@@ -124066,7 +124526,7 @@ function writeSkillsOverlayEntry(agent, slug, yamlText, opts = {}) {
 function deleteSkillsOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join111(paths.skillsDir, `${slug}.yaml`);
+    const finalPath = join112(paths.skillsDir, `${slug}.yaml`);
     if (!existsSync109(finalPath))
       return false;
     unlinkSync22(finalPath);
@@ -124078,10 +124538,10 @@ function listSkillsOverlayEntries(agent, opts = {}) {
   if (!existsSync109(paths.skillsDir))
     return [];
   const out = [];
-  for (const name of readdirSync39(paths.skillsDir)) {
+  for (const name of readdirSync40(paths.skillsDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join111(paths.skillsDir, name);
+    const full = join112(paths.skillsDir, name);
     try {
       const raw = readFileSync97(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -124093,7 +124553,7 @@ function listSkillsOverlayEntries(agent, opts = {}) {
 function deleteOverlayEntry(agent, slug, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
   return withAgentLock(paths, () => {
-    const finalPath = join111(paths.scheduleDir, `${slug}.yaml`);
+    const finalPath = join112(paths.scheduleDir, `${slug}.yaml`);
     if (!existsSync109(finalPath))
       return false;
     unlinkSync22(finalPath);
@@ -124105,10 +124565,10 @@ function listOverlayEntries(agent, opts = {}) {
   if (!existsSync109(paths.scheduleDir))
     return [];
   const out = [];
-  for (const name of readdirSync39(paths.scheduleDir)) {
+  for (const name of readdirSync40(paths.scheduleDir)) {
     if (!/\.ya?ml$/i.test(name))
       continue;
-    const full = join111(paths.scheduleDir, name);
+    const full = join112(paths.scheduleDir, name);
     try {
       const raw = readFileSync97(full, "utf-8");
       const slug = name.replace(/\.ya?ml$/i, "");
@@ -124334,19 +124794,19 @@ import {
   fsyncSync as fsyncSync9,
   mkdirSync as mkdirSync64,
   openSync as openSync20,
-  readdirSync as readdirSync40,
+  readdirSync as readdirSync41,
   readFileSync as readFileSync98,
   renameSync as renameSync30,
   unlinkSync as unlinkSync23,
   writeFileSync as writeFileSync47,
   writeSync as writeSync11
 } from "node:fs";
-import { join as join112 } from "node:path";
+import { join as join113 } from "node:path";
 import { randomBytes as randomBytes17 } from "node:crypto";
 var STAGE_ID_PREFIX = "cap_";
 function pendingDir(agent, opts = {}) {
   const paths = overlayPathsFor(agent, opts);
-  return join112(paths.scheduleDir, ".pending");
+  return join113(paths.scheduleDir, ".pending");
 }
 function ensurePendingDir(agent, opts = {}) {
   const dir = pendingDir(agent, opts);
@@ -124359,8 +124819,8 @@ function newStageId() {
 function stagePendingScheduleEntry(opts) {
   const dir = ensurePendingDir(opts.agent, { root: opts.root });
   const stageId = opts.stageId ?? newStageId();
-  const yamlPath = join112(dir, `${stageId}.yaml`);
-  const metaPath = join112(dir, `${stageId}.meta.json`);
+  const yamlPath = join113(dir, `${stageId}.yaml`);
+  const metaPath = join113(dir, `${stageId}.meta.json`);
   const meta = {
     v: 1,
     stage_id: stageId,
@@ -124390,12 +124850,12 @@ function listPendingScheduleEntries(agent, opts = {}) {
   if (!existsSync110(dir))
     return [];
   const out = [];
-  for (const name of readdirSync40(dir).sort()) {
+  for (const name of readdirSync41(dir).sort()) {
     if (!name.endsWith(".meta.json"))
       continue;
     const stageId = name.slice(0, -".meta.json".length);
-    const metaPath = join112(dir, name);
-    const yamlPath = join112(dir, `${stageId}.yaml`);
+    const metaPath = join113(dir, name);
+    const yamlPath = join113(dir, `${stageId}.yaml`);
     if (!existsSync110(yamlPath))
       continue;
     try {
@@ -124414,7 +124874,7 @@ function commitPendingScheduleEntry(opts) {
     return { committed: false, reason: "not_found" };
   const slug = match.meta.entry.name ?? match.stageId;
   const paths = overlayPathsFor(opts.agent, { root: opts.root });
-  const finalPath = join112(paths.scheduleDir, `${slug}.yaml`);
+  const finalPath = join113(paths.scheduleDir, `${slug}.yaml`);
   if (existsSync110(finalPath)) {
     return { committed: false, reason: "slug_collision" };
   }
@@ -125067,7 +125527,7 @@ import { existsSync as existsSync112 } from "node:fs";
 init_reconcile_default_skills();
 init_agent_config();
 var import_yaml25 = __toESM(require_dist(), 1);
-import { join as join113 } from "node:path";
+import { join as join114 } from "node:path";
 var MAX_SKILLS_PER_AGENT2 = 20;
 var V1_ALLOWED_SOURCE_PREFIX = "bundled:";
 function exitCodeFor2(code) {
@@ -125142,7 +125602,7 @@ function skillInstall(opts) {
     return err("E_SKILL_QUOTA_EXCEEDED", `agent ${agent} already has ${used} overlay-installed skills (cap ${MAX_SKILLS_PER_AGENT2})`);
   }
   const poolDir = opts.bundledSkillsPoolDir ?? getBundledSkillsPoolDir();
-  const skillPath = join113(poolDir, skillName);
+  const skillPath = join114(poolDir, skillName);
   if (!existsSync112(skillPath)) {
     return err("E_SKILL_NOT_FOUND", `bundled skill not found at ${skillPath}. The operator needs to ` + `place the skill at this path before the agent can opt in.`);
   }
@@ -125314,20 +125774,20 @@ import {
   chmodSync as chmodSync18,
   closeSync as closeSync21,
   existsSync as existsSync113,
-  lstatSync as lstatSync14,
+  lstatSync as lstatSync15,
   mkdirSync as mkdirSync65,
   mkdtempSync as mkdtempSync5,
   openSync as openSync21,
   readFileSync as readFileSync100,
-  readdirSync as readdirSync41,
+  readdirSync as readdirSync42,
   realpathSync as realpathSync9,
   renameSync as renameSync31,
   rmSync as rmSync20,
-  statSync as statSync60,
+  statSync as statSync61,
   writeFileSync as writeFileSync48
 } from "node:fs";
 import { tmpdir as tmpdir6, homedir as homedir59 } from "node:os";
-import { dirname as dirname47, join as join114, relative as relative6, resolve as resolve60 } from "node:path";
+import { dirname as dirname48, join as join115, relative as relative6, resolve as resolve60 } from "node:path";
 import { spawnSync as spawnSync24 } from "node:child_process";
 var SKILL_NAME_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;
 var SH_SCRIPT_RE2 = /^scripts\/[A-Za-z0-9_.-]+\.sh$/;
@@ -125341,7 +125801,7 @@ function scanForClaudeP2(content) {
 function resolveSkillsPoolDir2(override) {
   const raw = override ?? "~/.switchroom/skills";
   if (raw.startsWith("~/")) {
-    return join114(homedir59(), raw.slice(2));
+    return join115(homedir59(), raw.slice(2));
   }
   if (raw === "~")
     return homedir59();
@@ -125373,14 +125833,14 @@ function isTarballPath(p) {
 }
 function loadFromDir(dir) {
   const abs = realpathSync9(dir);
-  if (!statSync60(abs).isDirectory()) {
+  if (!statSync61(abs).isDirectory()) {
     fail4(`--from path is not a directory: ${dir}`);
   }
   const files = {};
   const walk2 = (sub) => {
-    const entries = readdirSync41(sub, { withFileTypes: true });
+    const entries = readdirSync42(sub, { withFileTypes: true });
     for (const ent of entries) {
-      const full = join114(sub, ent.name);
+      const full = join115(sub, ent.name);
       const rel = relative6(abs, full);
       if (ent.isSymbolicLink()) {
         fail4(`refusing to read symlink inside --from dir: ${rel}`);
@@ -125415,7 +125875,7 @@ function loadFromTarball(tarPath) {
       fail4(`tarball contains disallowed path: ${JSON.stringify(entry)} \u2014 ` + `refusing to extract before any file is written`);
     }
   }
-  const staging = mkdtempSync5(join114(tmpdir6(), "skill-apply-extract-"));
+  const staging = mkdtempSync5(join115(tmpdir6(), "skill-apply-extract-"));
   try {
     const flags = isGz ? ["-xzf"] : ["-xf"];
     const r = spawnSync24("tar", [
@@ -125501,8 +125961,8 @@ function validatePayload(name, files) {
           errors2.push(`${path10} fails \`bash -n\` syntax check: ${(r.stderr ?? "").trim()}`);
         }
       } else if (PY_SCRIPT_RE2.test(path10)) {
-        const tmp = mkdtempSync5(join114(tmpdir6(), "skill-apply-py-"));
-        const tmpPy = join114(tmp, "check.py");
+        const tmp = mkdtempSync5(join115(tmpdir6(), "skill-apply-py-"));
+        const tmpPy = join115(tmp, "check.py");
         try {
           writeFileSync48(tmpPy, content);
           const r = spawnSync24("python3", ["-m", "py_compile", tmpPy], {
@@ -125524,8 +125984,8 @@ function diffSummary(currentDir, files) {
   const currentFiles = {};
   if (existsSync113(currentDir)) {
     const walk2 = (sub) => {
-      for (const ent of readdirSync41(sub, { withFileTypes: true })) {
-        const full = join114(sub, ent.name);
+      for (const ent of readdirSync42(sub, { withFileTypes: true })) {
+        const full = join115(sub, ent.name);
         const rel = relative6(currentDir, full);
         if (ent.isDirectory()) {
           walk2(full);
@@ -125561,10 +126021,10 @@ function writePayload(poolDir, name, files) {
   if (!existsSync113(poolDir)) {
     mkdirSync65(poolDir, { recursive: true, mode: 493 });
   }
-  const target = join114(poolDir, name);
+  const target = join115(poolDir, name);
   let targetIsSymlink = false;
   try {
-    const st = lstatSync14(target);
+    const st = lstatSync15(target);
     if (st.isSymbolicLink()) {
       targetIsSymlink = true;
     }
@@ -125572,13 +126032,13 @@ function writePayload(poolDir, name, files) {
   if (targetIsSymlink) {
     fail4(`refusing to overwrite symlink at ${target}; investigate manually`);
   }
-  const staging = mkdtempSync5(join114(poolDir, `.skill-apply-stage-${name}-`));
+  const staging = mkdtempSync5(join115(poolDir, `.skill-apply-stage-${name}-`));
   chmodSync18(staging, 493);
   let oldRename = null;
   try {
     for (const [path10, content] of Object.entries(files)) {
-      const full = join114(staging, path10);
-      mkdirSync65(dirname47(full), { recursive: true, mode: 493 });
+      const full = join115(staging, path10);
+      mkdirSync65(dirname48(full), { recursive: true, mode: 493 });
       const fd = openSync21(full, "wx");
       try {
         writeFileSync48(fd, content);
@@ -125592,7 +126052,7 @@ function writePayload(poolDir, name, files) {
     }
     let targetExists = false;
     try {
-      lstatSync14(target);
+      lstatSync15(target);
       targetExists = true;
     } catch {}
     if (targetExists) {
@@ -125634,7 +126094,7 @@ function registerSkillCommand(program3) {
       if (!existsSync113(fromPath)) {
         fail4(`--from path does not exist: ${opts.from}`);
       }
-      const st = statSync60(fromPath);
+      const st = statSync61(fromPath);
       if (st.isDirectory()) {
         files = loadFromDir(fromPath);
       } else if (isTarballPath(fromPath)) {
@@ -125655,7 +126115,7 @@ function registerSkillCommand(program3) {
     }
     const config = loadConfig();
     const poolDir = resolveSkillsPoolDir2(config.switchroom?.skills_dir);
-    const currentDir = join114(poolDir, name);
+    const currentDir = join115(poolDir, name);
     console.log(source_default.bold(`Skill: ${name}`) + source_default.gray(` (${Object.keys(files).length} files, ${sumBytes(files)} bytes)`));
     console.log(source_default.bold("Diff vs current pool content:"));
     console.log(diffSummary(currentDir, files));
@@ -125693,19 +126153,19 @@ import {
   chmodSync as chmodSync19,
   closeSync as closeSync22,
   existsSync as existsSync114,
-  lstatSync as lstatSync15,
+  lstatSync as lstatSync16,
   mkdirSync as mkdirSync66,
   mkdtempSync as mkdtempSync6,
   openSync as openSync22,
   readFileSync as readFileSync101,
-  readdirSync as readdirSync42,
+  readdirSync as readdirSync43,
   renameSync as renameSync32,
   rmSync as rmSync21,
-  statSync as statSync61,
+  statSync as statSync62,
   utimesSync,
   writeFileSync as writeFileSync49
 } from "node:fs";
-import { dirname as dirname48, join as join115, relative as relative7, resolve as resolve61 } from "node:path";
+import { dirname as dirname49, join as join116, relative as relative7, resolve as resolve61 } from "node:path";
 import { homedir as homedir60, tmpdir as tmpdir7 } from "node:os";
 import { spawnSync as spawnSync25 } from "node:child_process";
 var PERSONAL_PREFIX = "personal-";
@@ -125714,10 +126174,10 @@ var TRASH_TTL_MS = 24 * 60 * 60 * 1000;
 var PERSONAL_SKILLS_SUBPATH2 = "personal-skills";
 function resolveConfigSkillsDir(agent) {
   const override = process.env.SWITCHROOM_CONFIG_DIR;
-  const candidate = override ? resolve61(override) : join115(homedir60(), ".switchroom-config");
+  const candidate = override ? resolve61(override) : join116(homedir60(), ".switchroom-config");
   if (!existsSync114(candidate))
     return null;
-  return join115(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH2);
+  return join116(candidate, "agents", agent, PERSONAL_SKILLS_SUBPATH2);
 }
 var MIRROR_PRIOR_TTL_MS = 24 * 60 * 60 * 1000;
 function sweepMirrorPriors(configSkillsRoot) {
@@ -125725,7 +126185,7 @@ function sweepMirrorPriors(configSkillsRoot) {
     if (!existsSync114(configSkillsRoot))
       return;
     const now2 = Date.now();
-    for (const ent of readdirSync42(configSkillsRoot)) {
+    for (const ent of readdirSync43(configSkillsRoot)) {
       const m = /^\.(?:.+)-(?:prior|trash)-(\d+)$/.exec(ent);
       if (!m)
         continue;
@@ -125735,7 +126195,7 @@ function sweepMirrorPriors(configSkillsRoot) {
       if (now2 - ts < MIRROR_PRIOR_TTL_MS)
         continue;
       try {
-        rmSync21(join115(configSkillsRoot, ent), { recursive: true, force: true });
+        rmSync21(join116(configSkillsRoot, ent), { recursive: true, force: true });
       } catch {}
     }
   } catch {}
@@ -125744,11 +126204,11 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
   const configSkillsRoot = resolveConfigSkillsDir(agent);
   if (!configSkillsRoot)
     return;
-  const dest = join115(configSkillsRoot, name);
+  const dest = join116(configSkillsRoot, name);
   try {
     if (liveSkillDir !== null) {
       try {
-        const st = lstatSync15(liveSkillDir);
+        const st = lstatSync16(liveSkillDir);
         if (st.isSymbolicLink()) {
           process.stderr.write(source_default.yellow(`warning: refusing to mirror ${liveSkillDir} \u2014 source is a symlink
 `));
@@ -125759,19 +126219,19 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     if (liveSkillDir === null) {
       sweepMirrorPriors(configSkillsRoot);
       if (existsSync114(dest)) {
-        const trash = join115(configSkillsRoot, `.${name}-trash-${Date.now()}`);
+        const trash = join116(configSkillsRoot, `.${name}-trash-${Date.now()}`);
         renameSync32(dest, trash);
       }
       return;
     }
     mkdirSync66(configSkillsRoot, { recursive: true, mode: 493 });
     sweepMirrorPriors(configSkillsRoot);
-    const staging = mkdtempSync6(join115(configSkillsRoot, `.${name}-staging-`));
+    const staging = mkdtempSync6(join116(configSkillsRoot, `.${name}-staging-`));
     const walk2 = (src, dst) => {
       mkdirSync66(dst, { recursive: true, mode: 493 });
-      for (const ent of readdirSync42(src, { withFileTypes: true })) {
-        const s = join115(src, ent.name);
-        const d = join115(dst, ent.name);
+      for (const ent of readdirSync43(src, { withFileTypes: true })) {
+        const s = join116(src, ent.name);
+        const d = join116(dst, ent.name);
         if (ent.isSymbolicLink())
           continue;
         if (ent.isDirectory())
@@ -125784,7 +126244,7 @@ function mirrorToConfigRepo(agent, name, liveSkillDir) {
     walk2(liveSkillDir, staging);
     chmodSync19(staging, 493);
     if (existsSync114(dest)) {
-      const prior = join115(configSkillsRoot, `.${name}-prior-${Date.now()}`);
+      const prior = join116(configSkillsRoot, `.${name}-prior-${Date.now()}`);
       renameSync32(dest, prior);
     }
     renameSync32(staging, dest);
@@ -125814,20 +126274,20 @@ function resolveAgent(opts) {
 function resolveAgentsRoot(opts) {
   if (opts.root)
     return resolve61(opts.root);
-  return join115(homedir60(), ".switchroom", "agents");
+  return join116(homedir60(), ".switchroom", "agents");
 }
 function personalSkillDir(agentsRoot, agent, name) {
-  return join115(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
+  return join116(agentsRoot, agent, ".claude", "skills", PERSONAL_PREFIX + name);
 }
 function trashDir(agentsRoot, agent) {
-  return join115(agentsRoot, agent, ".claude", TRASH_DIRNAME);
+  return join116(agentsRoot, agent, ".claude", TRASH_DIRNAME);
 }
 function countPersonalSkills(agentsRoot, agent) {
-  const skillsDir = join115(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join116(agentsRoot, agent, ".claude", "skills");
   if (!existsSync114(skillsDir))
     return 0;
   let n = 0;
-  for (const ent of readdirSync42(skillsDir, { withFileTypes: true })) {
+  for (const ent of readdirSync43(skillsDir, { withFileTypes: true })) {
     if (ent.isDirectory() && ent.name.startsWith(PERSONAL_PREFIX))
       n += 1;
   }
@@ -125855,13 +126315,13 @@ function readStdinSync2() {
 }
 function loadFromDir2(dir) {
   const abs = resolve61(dir);
-  if (!statSync61(abs).isDirectory()) {
+  if (!statSync62(abs).isDirectory()) {
     fail5(`--from path is not a directory: ${dir}`);
   }
   const files = {};
   const walk2 = (sub) => {
-    for (const ent of readdirSync42(sub, { withFileTypes: true })) {
-      const full = join115(sub, ent.name);
+    for (const ent of readdirSync43(sub, { withFileTypes: true })) {
+      const full = join116(sub, ent.name);
       if (ent.isSymbolicLink()) {
         fail5(`refusing to read symlink in --from dir: ${relative7(abs, full)}`);
       }
@@ -125914,8 +126374,8 @@ function behavioralValidate(files) {
         errors2.push(`${path10} fails \`bash -n\`: ${(r.stderr ?? "").trim()}`);
       }
     } else if (PY_SCRIPT_RE.test(path10)) {
-      const tmp = mkdtempSync6(join115(tmpdir7(), "skill-personal-py-"));
-      const tmpPy = join115(tmp, "check.py");
+      const tmp = mkdtempSync6(join116(tmpdir7(), "skill-personal-py-"));
+      const tmpPy = join116(tmp, "check.py");
       try {
         writeFileSync49(tmpPy, content);
         const r = spawnSync25("python3", ["-m", "py_compile", tmpPy], {
@@ -125936,12 +126396,12 @@ function sweepTrash(agentsRoot, agent) {
   if (!existsSync114(trash))
     return;
   const now2 = Date.now();
-  for (const ent of readdirSync42(trash, { withFileTypes: true })) {
+  for (const ent of readdirSync43(trash, { withFileTypes: true })) {
     if (!ent.isDirectory())
       continue;
-    const entPath = join115(trash, ent.name);
+    const entPath = join116(trash, ent.name);
     try {
-      const st = statSync61(entPath);
+      const st = statSync62(entPath);
       if (now2 - st.mtimeMs > TRASH_TTL_MS) {
         rmSync21(entPath, { recursive: true, force: true });
       }
@@ -125951,7 +126411,7 @@ function sweepTrash(agentsRoot, agent) {
 function writePersonalSkill(targetDir, files) {
   let targetIsSymlink = false;
   try {
-    const st = lstatSync15(targetDir);
+    const st = lstatSync16(targetDir);
     if (st.isSymbolicLink()) {
       targetIsSymlink = true;
     }
@@ -125959,14 +126419,14 @@ function writePersonalSkill(targetDir, files) {
   if (targetIsSymlink) {
     fail5(`refusing to overwrite symlink at ${targetDir}; investigate manually`);
   }
-  mkdirSync66(dirname48(targetDir), { recursive: true, mode: 493 });
-  const staging = mkdtempSync6(join115(dirname48(targetDir), `.skill-personal-stage-`));
+  mkdirSync66(dirname49(targetDir), { recursive: true, mode: 493 });
+  const staging = mkdtempSync6(join116(dirname49(targetDir), `.skill-personal-stage-`));
   chmodSync19(staging, 493);
   let oldRename = null;
   try {
     for (const [path10, content] of Object.entries(files)) {
-      const full = join115(staging, path10);
-      mkdirSync66(dirname48(full), { recursive: true, mode: 493 });
+      const full = join116(staging, path10);
+      mkdirSync66(dirname49(full), { recursive: true, mode: 493 });
       const fd = openSync22(full, "wx");
       try {
         writeFileSync49(fd, content);
@@ -125980,7 +126440,7 @@ function writePersonalSkill(targetDir, files) {
     }
     let targetExists = false;
     try {
-      lstatSync15(targetDir);
+      lstatSync16(targetDir);
       targetExists = true;
     } catch {}
     if (targetExists) {
@@ -126015,7 +126475,7 @@ function loadValidateWrite(agentsRoot, agent, name, files, ensureNew) {
   const target = personalSkillDir(agentsRoot, agent, name);
   const exists = (() => {
     try {
-      lstatSync15(target);
+      lstatSync16(target);
       return true;
     } catch {
       return false;
@@ -126067,7 +126527,7 @@ function loadFiles(opts) {
   if (!existsSync114(p)) {
     fail5(`--from path does not exist: ${opts.from}`);
   }
-  const st = statSync61(p);
+  const st = statSync62(p);
   if (st.isDirectory()) {
     return loadFromDir2(p);
   }
@@ -126112,10 +126572,10 @@ function editPersonalAction(name, opts) {
 }
 var CLONE_SOURCE_RE = /^(shared|bundled):([a-z0-9][a-z0-9_-]{0,62})$/;
 function defaultSharedRoot() {
-  return join115(homedir60(), ".switchroom", "skills");
+  return join116(homedir60(), ".switchroom", "skills");
 }
 function defaultBundledRoot() {
-  return join115(homedir60(), ".switchroom", "skills", "_bundled");
+  return join116(homedir60(), ".switchroom", "skills", "_bundled");
 }
 function resolveCloneSource(source, opts) {
   const m = CLONE_SOURCE_RE.exec(source);
@@ -126125,11 +126585,11 @@ function resolveCloneSource(source, opts) {
   const tier = m[1];
   const slug = m[2];
   const root = tier === "bundled" ? opts.bundledRoot ?? defaultBundledRoot() : opts.sharedRoot ?? defaultSharedRoot();
-  const dir = join115(root, slug);
+  const dir = join116(root, slug);
   if (!existsSync114(dir)) {
     fail5(`clone source ${JSON.stringify(source)} not found at ${dir}; ` + `check \`switchroom skill search --tier ${tier}\``, 1);
   }
-  const st = lstatSync15(dir);
+  const st = lstatSync16(dir);
   if (st.isSymbolicLink()) {
     fail5(`clone source ${JSON.stringify(source)} is a symlink at ${dir}; ` + `point clone at the canonical pool path instead`);
   }
@@ -126140,8 +126600,8 @@ function readSourceFiles(dir) {
   const files = {};
   const skipped = [];
   const walk2 = (sub) => {
-    for (const ent of readdirSync42(sub, { withFileTypes: true })) {
-      const full = join115(sub, ent.name);
+    for (const ent of readdirSync43(sub, { withFileTypes: true })) {
+      const full = join116(sub, ent.name);
       if (ent.isSymbolicLink()) {
         continue;
       }
@@ -126156,7 +126616,7 @@ function readSourceFiles(dir) {
           continue;
         }
         try {
-          const st = lstatSync15(full);
+          const st = lstatSync16(full);
           if (st.size > CLONE_MAX_FILE_BYTES) {
             fail5(`clone source has oversized file ${rel} (${st.size} bytes > ${CLONE_MAX_FILE_BYTES}); ` + `refuse to read`, 3);
           }
@@ -126238,7 +126698,7 @@ function removePersonalAction(name, opts) {
   }
   const target = personalSkillDir(agentsRoot, agent, name);
   try {
-    const st = lstatSync15(target);
+    const st = lstatSync16(target);
     if (st.isSymbolicLink()) {
       fail5(`refusing to remove symlink at ${target}; investigate manually`);
     }
@@ -126252,7 +126712,7 @@ function removePersonalAction(name, opts) {
   const trashRoot2 = trashDir(agentsRoot, agent);
   mkdirSync66(trashRoot2, { recursive: true, mode: 493 });
   const ts = Date.now();
-  const trashTarget = join115(trashRoot2, `${name}-${ts}`);
+  const trashTarget = join116(trashRoot2, `${name}-${ts}`);
   renameSync32(target, trashTarget);
   const now2 = new Date(ts);
   utimesSync(trashTarget, now2, now2);
@@ -126271,27 +126731,27 @@ function listPersonalAction(opts) {
   const agent = resolveAgent(opts);
   const agentsRoot = resolveAgentsRoot(opts);
   sweepTrash(agentsRoot, agent);
-  const skillsDir = join115(agentsRoot, agent, ".claude", "skills");
+  const skillsDir = join116(agentsRoot, agent, ".claude", "skills");
   const personal = [];
   if (existsSync114(skillsDir)) {
-    for (const ent of readdirSync42(skillsDir, { withFileTypes: true })) {
+    for (const ent of readdirSync43(skillsDir, { withFileTypes: true })) {
       if (!ent.isDirectory())
         continue;
       if (!ent.name.startsWith(PERSONAL_PREFIX))
         continue;
       const skillName = ent.name.slice(PERSONAL_PREFIX.length);
-      const skillPath = join115(skillsDir, ent.name);
+      const skillPath = join116(skillsDir, ent.name);
       let fileCount = 0;
       let totalBytes = 0;
       const walk2 = (sub) => {
-        for (const e of readdirSync42(sub, { withFileTypes: true })) {
+        for (const e of readdirSync43(sub, { withFileTypes: true })) {
           if (e.isFile()) {
             fileCount += 1;
             try {
-              totalBytes += statSync61(join115(sub, e.name)).size;
+              totalBytes += statSync62(join116(sub, e.name)).size;
             } catch {}
           } else if (e.isDirectory()) {
-            walk2(join115(sub, e.name));
+            walk2(join116(sub, e.name));
           }
         }
       };
@@ -126330,7 +126790,7 @@ function registerSkillPersonalCommands(program3) {
 // src/cli/self-improve-propose-skill.ts
 import { createConnection as createConnection4 } from "node:net";
 import { homedir as homedir61 } from "node:os";
-import { join as join116 } from "node:path";
+import { join as join117 } from "node:path";
 import { readFileSync as readFileSync102 } from "node:fs";
 
 // src/self-improve/skill-proposals.ts
@@ -126378,7 +126838,7 @@ var STOPWORDS = new Set([
 // src/cli/self-improve-propose-skill.ts
 var IPC_CONNECT_TIMEOUT_MS = 5000;
 function gatewaySocketPath() {
-  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join116(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join116(homedir61(), ".claude", "channels", "telegram", "gateway.sock"));
+  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? (process.env.TELEGRAM_STATE_DIR ? join117(process.env.TELEGRAM_STATE_DIR, "gateway.sock") : join117(homedir61(), ".claude", "channels", "telegram", "gateway.sock"));
 }
 function fail6(msg, code = 1) {
   console.error(msg);
@@ -126458,11 +126918,11 @@ function registerSelfImproveProposeSkillCommand(program3) {
 // src/cli/self-improve-eval-case.ts
 import { createConnection as createConnection5 } from "node:net";
 import { homedir as homedir62 } from "node:os";
-import { join as join120, resolve as resolve62, sep as sep7 } from "node:path";
+import { join as join121, resolve as resolve62, sep as sep7 } from "node:path";
 import { existsSync as existsSync119, readFileSync as readFileSync107, realpathSync as realpathSync10 } from "node:fs";
 
 // src/self-improve/apply-guard.ts
-import { existsSync as existsSync117, lstatSync as lstatSync16, readFileSync as readFileSync105, statSync as statSync63 } from "node:fs";
+import { existsSync as existsSync117, lstatSync as lstatSync17, readFileSync as readFileSync105, statSync as statSync64 } from "node:fs";
 
 // src/self-improve/config.ts
 function intEnv(name, def) {
@@ -126483,11 +126943,11 @@ function resolveSelfImproveConfig() {
 }
 
 // src/self-improve/eval-gate.ts
-import { existsSync as existsSync115, readFileSync as readFileSync103, readdirSync as readdirSync43, statSync as statSync62 } from "node:fs";
-import { join as join117 } from "node:path";
+import { existsSync as existsSync115, readFileSync as readFileSync103, readdirSync as readdirSync44, statSync as statSync63 } from "node:fs";
+import { join as join118 } from "node:path";
 import { spawnSync as spawnSync26 } from "node:child_process";
 function evalsJsonPath(skillDir) {
-  return join117(skillDir, "evals", "evals.json");
+  return join118(skillDir, "evals", "evals.json");
 }
 function skillHasEvals(skillDir) {
   const p = evalsJsonPath(skillDir);
@@ -126501,7 +126961,7 @@ function skillHasEvals(skillDir) {
   }
 }
 function aggregateBenchmark(benchmarkDir, repoRoot, pythonBin = process.env.SWITCHROOM_PYTHON ?? "python3") {
-  const script = join117(repoRoot, "skills", "skill-creator", "scripts", "aggregate_benchmark.py");
+  const script = join118(repoRoot, "skills", "skill-creator", "scripts", "aggregate_benchmark.py");
   if (!existsSync115(script)) {
     return { ok: false, error: `aggregate_benchmark.py not found at ${script}` };
   }
@@ -126515,25 +126975,25 @@ function aggregateBenchmark(benchmarkDir, repoRoot, pythonBin = process.env.SWIT
       error: `aggregate_benchmark exited ${r.status}: ${(r.stderr ?? "").trim()}`
     };
   }
-  return { ok: true, benchmarkJson: join117(benchmarkDir, "benchmark.json") };
+  return { ok: true, benchmarkJson: join118(benchmarkDir, "benchmark.json") };
 }
 function isBenchmarkDir(dir) {
   try {
-    if (!statSync62(dir).isDirectory())
+    if (!statSync63(dir).isDirectory())
       return false;
   } catch {
     return false;
   }
   const hasEvalDirs = (d) => {
     try {
-      return readdirSync43(d, { withFileTypes: true }).some((e) => e.isDirectory() && e.name.startsWith("eval-"));
+      return readdirSync44(d, { withFileTypes: true }).some((e) => e.isDirectory() && e.name.startsWith("eval-"));
     } catch {
       return false;
     }
   };
   if (hasEvalDirs(dir))
     return true;
-  const runs = join117(dir, "runs");
+  const runs = join118(dir, "runs");
   return existsSync115(runs) && hasEvalDirs(runs);
 }
 function resolveBenchmarkDir(baseDir, explicit) {
@@ -126544,13 +127004,13 @@ function resolveBenchmarkDir(baseDir, explicit) {
     return baseDir;
   let entries;
   try {
-    entries = readdirSync43(baseDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => join117(baseDir, e.name)).filter(isBenchmarkDir);
+    entries = readdirSync44(baseDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => join118(baseDir, e.name)).filter(isBenchmarkDir);
   } catch {
     return null;
   }
   if (entries.length === 0)
     return null;
-  entries.sort((a, b) => statSync62(b).mtimeMs - statSync62(a).mtimeMs);
+  entries.sort((a, b) => statSync63(b).mtimeMs - statSync63(a).mtimeMs);
   return entries[0];
 }
 var CANDIDATE_CONFIGS = ["with_skill", "candidate", "new_skill", "after"];
@@ -126617,12 +127077,12 @@ import {
   mkdirSync as mkdirSync67,
   openSync as openSync23,
   readFileSync as readFileSync104,
-  readdirSync as readdirSync44,
+  readdirSync as readdirSync45,
   renameSync as renameSync33,
   writeFileSync as writeFileSync50,
   writeSync as writeSync12
 } from "node:fs";
-import { dirname as dirname49, join as join118 } from "node:path";
+import { dirname as dirname50, join as join119 } from "node:path";
 import { createHash as createHash21 } from "node:crypto";
 
 // src/self-improve/pii-scan.ts
@@ -126773,7 +127233,7 @@ function readEvalsDoc(skillDir) {
   }
 }
 function writeAtomic(path10, content) {
-  mkdirSync67(dirname49(path10), { recursive: true });
+  mkdirSync67(dirname50(path10), { recursive: true });
   const tmp = `${path10}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync50(tmp, content, { encoding: "utf-8", mode: 420 });
   renameSync33(tmp, path10);
@@ -126812,7 +127272,7 @@ function appendEvalCase(skillDir, slug, input) {
 }
 var HELD_OUT_FILE = "self-improve-held-out-evals.jsonl";
 function heldOutPath(stateDir) {
-  return join118(stateDir, HELD_OUT_FILE);
+  return join119(stateDir, HELD_OUT_FILE);
 }
 function heldOutHasFingerprint(stateDir, slug, fp) {
   const path10 = heldOutPath(stateDir);
@@ -126861,10 +127321,10 @@ function appendHeldOutCase(stateDir, slug, ec, opts = {}) {
 var EVAL_MANIFEST_FILE = "self-improve-eval-manifest.json";
 var EVAL_BASELINE_SUBDIR = "self-improve-eval-baselines";
 function manifestPath(stateDir) {
-  return join118(stateDir, EVAL_MANIFEST_FILE);
+  return join119(stateDir, EVAL_MANIFEST_FILE);
 }
 function baselineEvalsPath(stateDir, slug) {
-  return join118(stateDir, EVAL_BASELINE_SUBDIR, slug, "evals.json");
+  return join119(stateDir, EVAL_BASELINE_SUBDIR, slug, "evals.json");
 }
 function evalsSha256(skillDir) {
   const p = evalsJsonPath(skillDir);
@@ -126900,7 +127360,7 @@ function recordEvalBaseline(stateDir, slug, skillDir, opts = {}) {
   m[slug] = { sha256: sha, updated_at: new Date(now2()).toISOString(), skill_dir: skillDir };
   writeManifest(stateDir, m);
   const snap = baselineEvalsPath(stateDir, slug);
-  mkdirSync67(dirname49(snap), { recursive: true });
+  mkdirSync67(dirname50(snap), { recursive: true });
   copyFileSync15(evalsJsonPath(skillDir), snap);
 }
 
@@ -126908,7 +127368,7 @@ function recordEvalBaseline(stateDir, slug, skillDir, opts = {}) {
 var BENCHMARK_SUBDIR = "self-improve-benchmarks";
 function ownsSkill(skillDir) {
   try {
-    const st = lstatSync16(skillDir);
+    const st = lstatSync17(skillDir);
     if (st.isSymbolicLink())
       return false;
     return st.isDirectory();
@@ -126926,10 +127386,10 @@ import {
   readFileSync as readFileSync106,
   writeSync as writeSync13
 } from "node:fs";
-import { join as join119 } from "node:path";
+import { join as join120 } from "node:path";
 var EVAL_CASE_PROPOSALS_FILE = "eval-case-proposals.jsonl";
 function proposalsPath(stateDir) {
-  return join119(stateDir, EVAL_CASE_PROPOSALS_FILE);
+  return join120(stateDir, EVAL_CASE_PROPOSALS_FILE);
 }
 function isRecord2(v) {
   return !!v && typeof v === "object" && typeof v.id === "string" && typeof v.skill_slug === "string" && !!v.case && typeof v.case === "object";
@@ -126964,16 +127424,16 @@ function getEvalCaseProposal(stateDir, id) {
 // src/cli/self-improve-eval-case.ts
 var IPC_CONNECT_TIMEOUT_MS2 = 5000;
 function stateDir() {
-  return process.env.TELEGRAM_STATE_DIR ?? join120(homedir62(), ".claude", "channels", "telegram");
+  return process.env.TELEGRAM_STATE_DIR ?? join121(homedir62(), ".claude", "channels", "telegram");
 }
 function gatewaySocketPath2() {
-  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? join120(stateDir(), "gateway.sock");
+  return process.env.SWITCHROOM_GATEWAY_SOCKET ?? join121(stateDir(), "gateway.sock");
 }
 function skillsRoot() {
-  return join120(homedir62(), ".claude", "skills");
+  return join121(homedir62(), ".claude", "skills");
 }
 function skillDirFor(slug) {
-  return join120(skillsRoot(), slug);
+  return join121(skillsRoot(), slug);
 }
 function authorizeApplyTarget(persistedDir, slug) {
   const dir = skillDirFor(slug);
@@ -127171,20 +127631,20 @@ function registerSelfImproveEvalCaseCommands(program3) {
 
 // src/cli/self-improve-bench.ts
 import { homedir as homedir63 } from "node:os";
-import { dirname as dirname50, join as join121 } from "node:path";
+import { dirname as dirname51, join as join122 } from "node:path";
 init_shipped_assets();
 function fail8(msg, code = 1) {
   console.error(msg);
   process.exit(code);
 }
 function stateDir2() {
-  return process.env.TELEGRAM_STATE_DIR ?? join121(homedir63(), ".claude", "channels", "telegram");
+  return process.env.TELEGRAM_STATE_DIR ?? join122(homedir63(), ".claude", "channels", "telegram");
 }
 function skillDirFor2(slug) {
-  return join121(homedir63(), ".claude", "skills", slug);
+  return join122(homedir63(), ".claude", "skills", slug);
 }
 function benchmarkBaseDir(slug) {
-  return join121(stateDir2(), BENCHMARK_SUBDIR, slug);
+  return join122(stateDir2(), BENCHMARK_SUBDIR, slug);
 }
 function resolveAggregatorRepoRoot() {
   const res = resolveShippedAsset(SKILLS_ASSET, {
@@ -127196,7 +127656,7 @@ function resolveAggregatorRepoRoot() {
 `);
     return null;
   }
-  return dirname50(res.path);
+  return dirname51(res.path);
 }
 function registerSelfImproveBenchCommand(program3) {
   const parent = program3.commands.find((c) => c.name() === "self-improve") ?? program3.command("self-improve").description("Agent self-improvement ops");
@@ -127246,9 +127706,9 @@ function registerSelfImproveBenchCommand(program3) {
 init_esm();
 init_helpers();
 var import_yaml26 = __toESM(require_dist(), 1);
-import { existsSync as existsSync120, readdirSync as readdirSync45, readFileSync as readFileSync108, statSync as statSync64 } from "node:fs";
+import { existsSync as existsSync120, readdirSync as readdirSync46, readFileSync as readFileSync108, statSync as statSync65 } from "node:fs";
 import { homedir as homedir64 } from "node:os";
-import { join as join122, resolve as resolve63 } from "node:path";
+import { join as join123, resolve as resolve63 } from "node:path";
 var PERSONAL_PREFIX2 = "personal-";
 var BUNDLED_SUBDIR = "_bundled";
 var AGENT_NAME_RE3 = /^[a-z][a-z0-9_-]{0,62}$/;
@@ -127262,7 +127722,7 @@ function defaultBundledRoot2() {
   return resolve63(homedir64(), ".switchroom/skills/_bundled");
 }
 function readSkillFrontmatter(skillDir) {
-  const mdPath = join122(skillDir, "SKILL.md");
+  const mdPath = join123(skillDir, "SKILL.md");
   if (!existsSync120(mdPath))
     return null;
   let content;
@@ -127295,9 +127755,9 @@ function readSkillFrontmatter(skillDir) {
   return { fm: parsed };
 }
 function statSkillMd(skillDir) {
-  const mdPath = join122(skillDir, "SKILL.md");
+  const mdPath = join123(skillDir, "SKILL.md");
   try {
-    const st = statSync64(mdPath);
+    const st = statSync65(mdPath);
     return { size: st.size, mtime: st.mtime.toISOString() };
   } catch {
     return null;
@@ -127306,22 +127766,22 @@ function statSkillMd(skillDir) {
 function listPersonalSkills(agent, agentsRoot = defaultAgentsRoot()) {
   if (!AGENT_NAME_RE3.test(agent))
     return [];
-  const skillsDir = join122(agentsRoot, agent, ".claude/skills");
+  const skillsDir = join123(agentsRoot, agent, ".claude/skills");
   if (!existsSync120(skillsDir))
     return [];
   const out = [];
   let entries;
   try {
-    entries = readdirSync45(skillsDir);
+    entries = readdirSync46(skillsDir);
   } catch {
     return [];
   }
   for (const ent of entries) {
     if (!ent.startsWith(PERSONAL_PREFIX2))
       continue;
-    const dirPath = join122(skillsDir, ent);
+    const dirPath = join123(skillsDir, ent);
     try {
-      if (!statSync64(dirPath).isDirectory())
+      if (!statSync65(dirPath).isDirectory())
         continue;
     } catch {
       continue;
@@ -127350,7 +127810,7 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync45(sharedRoot);
+    entries = readdirSync46(sharedRoot);
   } catch {
     return [];
   }
@@ -127359,9 +127819,9 @@ function listSharedSkills(sharedRoot = defaultSharedRoot2()) {
       continue;
     if (ent.startsWith("."))
       continue;
-    const dirPath = join122(sharedRoot, ent);
+    const dirPath = join123(sharedRoot, ent);
     try {
-      if (!statSync64(dirPath).isDirectory())
+      if (!statSync65(dirPath).isDirectory())
         continue;
     } catch {
       continue;
@@ -127388,16 +127848,16 @@ function listBundledSkills(bundledRoot = defaultBundledRoot2()) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync45(bundledRoot);
+    entries = readdirSync46(bundledRoot);
   } catch {
     return [];
   }
   for (const ent of entries) {
     if (ent.startsWith("."))
       continue;
-    const dirPath = join122(bundledRoot, ent);
+    const dirPath = join123(bundledRoot, ent);
     try {
-      if (!statSync64(dirPath).isDirectory())
+      if (!statSync65(dirPath).isDirectory())
         continue;
     } catch {
       continue;
@@ -127544,15 +128004,15 @@ init_operator_uid();
 import {
   existsSync as existsSync122,
   mkdirSync as mkdirSync69,
-  readdirSync as readdirSync46,
+  readdirSync as readdirSync47,
   writeFileSync as writeFileSync51,
-  statSync as statSync65,
-  lstatSync as lstatSync17,
+  statSync as statSync66,
+  lstatSync as lstatSync18,
   realpathSync as realpathSync11,
   copyFileSync as copyFileSync16
 } from "node:fs";
 import { homedir as homedir65 } from "node:os";
-import { join as join123 } from "node:path";
+import { join as join124 } from "node:path";
 import { spawnSync as spawnSync29 } from "node:child_process";
 
 // src/cli/singleton-stale-cleanup.ts
@@ -127908,10 +128368,10 @@ function resolveHostdHostHome(env2 = process.env, home2 = homedir65()) {
   return resolved;
 }
 function resolveHostdSkillsTarget(hostHome) {
-  const skillsPath = join123(hostHome, ".switchroom", "skills");
+  const skillsPath = join124(hostHome, ".switchroom", "skills");
   let st;
   try {
-    st = lstatSync17(skillsPath);
+    st = lstatSync18(skillsPath);
   } catch {
     return;
   }
@@ -127932,10 +128392,10 @@ function resolveHostdSkillsTarget(hostHome) {
   return target;
 }
 function hostdDir() {
-  return join123(homedir65(), ".switchroom", "hostd");
+  return join124(homedir65(), ".switchroom", "hostd");
 }
 function hostdComposePath() {
-  return join123(hostdDir(), "docker-compose.yml");
+  return join124(hostdDir(), "docker-compose.yml");
 }
 function backupExistingCompose() {
   const p = hostdComposePath();
@@ -128062,12 +128522,12 @@ function doStatus() {
   if (existsSync122(dir)) {
     const entries = [];
     try {
-      for (const name of readdirSync46(dir)) {
+      for (const name of readdirSync47(dir)) {
         if (name === "docker-compose.yml" || name.startsWith("docker-compose.yml."))
           continue;
-        const sockPath = join123(dir, name, "sock");
+        const sockPath = join124(dir, name, "sock");
         if (existsSync122(sockPath)) {
-          const st = statSync65(sockPath);
+          const st = statSync66(sockPath);
           if ((st.mode & 61440) === 49152) {
             entries.push(`${name} \u2192 ${sockPath}`);
           }
@@ -128160,7 +128620,7 @@ init_operator_uid();
 init_compose();
 import { chownSync as chownSync14, existsSync as existsSync123, mkdirSync as mkdirSync70, writeFileSync as writeFileSync52, copyFileSync as copyFileSync17 } from "node:fs";
 import { homedir as homedir66 } from "node:os";
-import { join as join124 } from "node:path";
+import { join as join125 } from "node:path";
 import { spawnSync as spawnSync30 } from "node:child_process";
 function resolveWebImageTag(explicitTag, release) {
   if (explicitTag)
@@ -128262,10 +128722,10 @@ services:
 `;
 }
 function webdDir() {
-  return join124(homedir66(), ".switchroom", "web");
+  return join125(homedir66(), ".switchroom", "web");
 }
 function webdComposePath() {
-  return join124(webdDir(), "docker-compose.yml");
+  return join125(webdDir(), "docker-compose.yml");
 }
 function backupExistingCompose2() {
   const p = webdComposePath();
@@ -128431,9 +128891,9 @@ function registerWebdCommand(program3) {
 // src/cli/host-repair.ts
 init_source();
 import { homedir as homedir67 } from "node:os";
-import { join as join125 } from "node:path";
+import { join as join126 } from "node:path";
 var ARTIFACT_ALLOWLIST = {
-  dockerComposePluginDir: (home2) => join125(home2, ".docker", "cli-plugins", "docker-compose"),
+  dockerComposePluginDir: (home2) => join126(home2, ".docker", "cli-plugins", "docker-compose"),
   stateSentinel: "/state"
 };
 function isStateBogusAutoDir(probe2) {
@@ -128587,18 +129047,18 @@ function applyMountRepairs(items, deps) {
 function registerHostCommand(program3) {
   const host = program3.command("host").description("Host-level maintenance operations for switchroom");
   host.command("repair-mounts").description("Detect and remove known auto-dir artifacts left by a container-context deploy " + "(2026-06-23 outage class). Default: dry-run. Pass --yes to apply.").option("--yes", "Actually perform the removals (default is dry-run)").action(async (opts) => {
-    const { rmdirSync: rmdirSync2, rmSync: rmSync22, lstatSync: lstatSync18, readdirSync: readdirSync47 } = await import("node:fs");
+    const { rmdirSync: rmdirSync2, rmSync: rmSync22, lstatSync: lstatSync19, readdirSync: readdirSync48 } = await import("node:fs");
     const probe2 = {
       lstat(path10) {
         try {
-          return lstatSync18(path10);
+          return lstatSync19(path10);
         } catch {
           return null;
         }
       },
       readdir(path10) {
         try {
-          return readdirSync47(path10);
+          return readdirSync48(path10);
         } catch {
           return null;
         }
@@ -128887,9 +129347,9 @@ function printDeepDiveBrief(targets) {
 
 // src/cli/hindsight-watch.ts
 init_source();
-import { existsSync as existsSync128, readdirSync as readdirSync51 } from "node:fs";
+import { existsSync as existsSync128, readdirSync as readdirSync52 } from "node:fs";
 import { homedir as homedir70 } from "node:os";
-import { join as join128, resolve as resolve66 } from "node:path";
+import { join as join129, resolve as resolve66 } from "node:path";
 
 // src/host-control/config-degraded.ts
 import { connect as connect3 } from "node:net";
@@ -128958,7 +129418,7 @@ init_install_cron();
 
 // src/hindsight-watch/probe.ts
 import { spawnSync as spawnSync32 } from "node:child_process";
-import { readFileSync as readFileSync113, readdirSync as readdirSync50, statSync as statSync67 } from "node:fs";
+import { readFileSync as readFileSync113, readdirSync as readdirSync51, statSync as statSync68 } from "node:fs";
 import { homedir as homedir69 } from "node:os";
 import { resolve as resolve65 } from "node:path";
 
@@ -129086,13 +129546,13 @@ function readLlmSignals(series) {
 }
 
 // src/hindsight-watch/recall-log.ts
-import { closeSync as closeSync25, existsSync as existsSync127, openSync as openSync25, readdirSync as readdirSync49, readSync as readSync6, statSync as statSync66 } from "node:fs";
-import { join as join127 } from "node:path";
+import { closeSync as closeSync25, existsSync as existsSync127, openSync as openSync25, readdirSync as readdirSync50, readSync as readSync6, statSync as statSync67 } from "node:fs";
+import { join as join128 } from "node:path";
 var RECALL_WINDOW_ROWS = 200;
 var RECALL_MAX_TAIL_BYTES = 1024 * 1024;
 var RECALL_MAX_ROW_AGE_MS = 24 * 60 * 60 * 1000;
 function recallLogPath2(agentDir) {
-  return join127(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
+  return join128(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
 }
 function readRecallLogTail2(path10, windowRows = RECALL_WINDOW_ROWS) {
   if (!existsSync127(path10))
@@ -129101,7 +129561,7 @@ function readRecallLogTail2(path10, windowRows = RECALL_WINDOW_ROWS) {
   let truncatedHead = false;
   let fd;
   try {
-    const size = statSync66(path10).size;
+    const size = statSync67(path10).size;
     const start = Math.max(0, size - RECALL_MAX_TAIL_BYTES);
     truncatedHead = start > 0;
     const length = size - start;
@@ -129236,11 +129696,11 @@ function summarizeRecallRows2(rows) {
   return out;
 }
 function probeRecallLogs(agentsDir, now2, windowRows = RECALL_WINDOW_ROWS, maxAgeMs = RECALL_MAX_ROW_AGE_MS) {
-  const names = readdirSync49(agentsDir);
+  const names = readdirSync50(agentsDir);
   const all = [];
   let agents = 0;
   for (const name of names) {
-    const rows = withinWindow(readRecallLogTail2(recallLogPath2(join127(agentsDir, name)), windowRows), now2, maxAgeMs);
+    const rows = withinWindow(readRecallLogTail2(recallLogPath2(join128(agentsDir, name)), windowRows), now2, maxAgeMs);
     if (rows.length > 0)
       agents++;
     all.push(...rows);
@@ -129333,7 +129793,7 @@ function readDropCount(hindsightDir) {
   const path10 = resolve65(hindsightDir, "pending-drops.json");
   let parsed;
   try {
-    if (statSync67(path10).size > DROPS_LEDGER_MAX_BYTES)
+    if (statSync68(path10).size > DROPS_LEDGER_MAX_BYTES)
       return 0;
     parsed = JSON.parse(readFileSync113(path10, "utf8"));
   } catch {
@@ -129350,7 +129810,7 @@ function resolveAgentsDir2(explicit) {
 function probeSpool(agentsDir = resolveAgentsDir2()) {
   let names;
   try {
-    names = readdirSync50(agentsDir);
+    names = readdirSync51(agentsDir);
   } catch (e) {
     throw new ProbeError(`reading ${agentsDir}: ${e.message}`, "spool");
   }
@@ -129364,7 +129824,7 @@ function probeSpool(agentsDir = resolveAgentsDir2()) {
     const hindsightDir = resolve65(agentsDir, name, "home", ".hindsight");
     let entries = null;
     try {
-      entries = readdirSync50(resolve65(hindsightDir, "pending-retains"));
+      entries = readdirSync51(resolve65(hindsightDir, "pending-retains"));
     } catch {}
     if (entries !== null) {
       agents++;
@@ -129376,19 +129836,19 @@ function probeSpool(agentsDir = resolveAgentsDir2()) {
       }
     }
     try {
-      for (const f of readdirSync50(resolve65(hindsightDir, "pending-evicted"))) {
+      for (const f of readdirSync51(resolve65(hindsightDir, "pending-evicted"))) {
         if (f.endsWith(".json"))
           evicted++;
       }
     } catch {}
     try {
-      for (const f of readdirSync50(resolve65(hindsightDir, "pending-dead"))) {
+      for (const f of readdirSync51(resolve65(hindsightDir, "pending-dead"))) {
         if (f.endsWith(".dead"))
           dead++;
       }
     } catch {}
     try {
-      for (const f of readdirSync50(resolve65(hindsightDir, "pending-duplicate"))) {
+      for (const f of readdirSync51(resolve65(hindsightDir, "pending-duplicate"))) {
         if (f.endsWith(".json"))
           duplicates++;
       }
@@ -130298,7 +130758,7 @@ function registerHindsightWatchCommand(program3) {
       process.exitCode = runInstallCron(opts.cronUser);
       return;
     }
-    const agentsDir = opts.agentsDir ?? process.env.SWITCHROOM_AGENTS_DIR ?? join128(process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir70(), ".switchroom", "agents");
+    const agentsDir = opts.agentsDir ?? process.env.SWITCHROOM_AGENTS_DIR ?? join129(process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir70(), ".switchroom", "agents");
     const statePath = opts.state ?? defaultStatePath2();
     const log = (m) => {
       process.stderr.write(`${m}
@@ -130412,7 +130872,7 @@ function orderRelayCandidates(candidates, preferred = PREFERRED_RELAY_AGENT) {
 }
 function collectRelayCandidates(agentsDir) {
   const candidates = [];
-  for (const name of readdirSync51(agentsDir).sort()) {
+  for (const name of readdirSync52(agentsDir).sort()) {
     const sock = resolve66(agentsDir, name, "telegram", "gateway.sock");
     if (existsSync128(sock))
       candidates.push({ agent: name, sock });
@@ -130437,7 +130897,7 @@ async function notifyOperator(agentsDir, text, log) {
 // src/cli/hindsight-bench.ts
 init_source();
 import { mkdirSync as mkdirSync72, readFileSync as readFileSync114, writeFileSync as writeFileSync54 } from "node:fs";
-import { dirname as dirname53, resolve as resolve67 } from "node:path";
+import { dirname as dirname54, resolve as resolve67 } from "node:path";
 
 // src/hindsight-bench/anonymise.ts
 function pseudonym(n, width) {
@@ -131565,7 +132025,7 @@ function readResult(path10) {
 }
 function writeOut(path10, body) {
   const abs = resolve67(path10);
-  mkdirSync72(dirname53(abs), { recursive: true });
+  mkdirSync72(dirname54(abs), { recursive: true });
   writeFileSync54(abs, body);
   process.stderr.write(`${source_default.green("\u2713")} wrote ${abs}
 `);
@@ -131770,13 +132230,13 @@ async function runMeasureMode(opts) {
 
 // src/cli/openrouter-watch.ts
 init_source();
-import { existsSync as existsSync130, readdirSync as readdirSync52 } from "node:fs";
+import { existsSync as existsSync130, readdirSync as readdirSync53 } from "node:fs";
 import { homedir as homedir72 } from "node:os";
-import { join as join129, resolve as resolve69 } from "node:path";
+import { join as join130, resolve as resolve69 } from "node:path";
 
 // src/openrouter/install-cron.ts
 import { existsSync as existsSync129, mkdirSync as mkdirSync73, readFileSync as readFileSync115, renameSync as renameSync34, writeFileSync as writeFileSync55 } from "node:fs";
-import { dirname as dirname54 } from "node:path";
+import { dirname as dirname55 } from "node:path";
 var CRON_PATH3 = "/etc/cron.d/openrouter-watch";
 var CRON_SCHEDULE2 = "17 * * * *";
 var CRON_LOG_PATH3 = "/var/log/openrouter-watch.log";
@@ -131800,7 +132260,7 @@ function installCron3(opts) {
       }
     } catch {}
   }
-  mkdirSync73(dirname54(path10), { recursive: true });
+  mkdirSync73(dirname55(path10), { recursive: true });
   const tmp = `${path10}.${process.pid}.tmp`;
   writeFileSync55(tmp, content, { mode: 420 });
   renameSync34(tmp, path10);
@@ -131809,7 +132269,7 @@ function installCron3(opts) {
 // src/openrouter/state.ts
 import { mkdirSync as mkdirSync74, readFileSync as readFileSync116, renameSync as renameSync35, writeFileSync as writeFileSync56 } from "node:fs";
 import { homedir as homedir71 } from "node:os";
-import { dirname as dirname55, resolve as resolve68 } from "node:path";
+import { dirname as dirname56, resolve as resolve68 } from "node:path";
 function defaultStatePath3(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir71()) {
   return resolve68(home2, ".switchroom", "openrouter-watch", "state.json");
 }
@@ -131836,7 +132296,7 @@ function loadState2(path10) {
   return out;
 }
 function saveState2(path10, state) {
-  mkdirSync74(dirname55(path10), { recursive: true, mode: 448 });
+  mkdirSync74(dirname56(path10), { recursive: true, mode: 448 });
   const tmp = `${path10}.${process.pid}.tmp`;
   const payload = { v: 1, ...state };
   writeFileSync56(tmp, JSON.stringify(payload, null, 2) + `
@@ -131927,7 +132387,7 @@ function registerOpenRouterWatchCommand(program3) {
       process.exitCode = runInstallCron2(opts.cronUser);
       return;
     }
-    const agentsDir = opts.agentsDir ?? process.env.SWITCHROOM_AGENTS_DIR ?? join129(process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir72(), ".switchroom", "agents");
+    const agentsDir = opts.agentsDir ?? process.env.SWITCHROOM_AGENTS_DIR ?? join130(process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir72(), ".switchroom", "agents");
     const statePath = opts.state ?? defaultStatePath3();
     const log = (m) => {
       process.stderr.write(`${m}
@@ -132024,7 +132484,7 @@ function runInstallCron2(cronUser) {
 async function notifyOperator2(agentsDir, text, log) {
   const candidates = [];
   try {
-    for (const name of readdirSync52(agentsDir).sort()) {
+    for (const name of readdirSync53(agentsDir).sort()) {
       const sock = resolve69(agentsDir, name, "telegram", "gateway.sock");
       if (existsSync130(sock))
         candidates.push({ agent: name, sock });
@@ -132047,7 +132507,7 @@ init_sync();
 init_install_cron2();
 init_flock();
 import { homedir as homedir73 } from "node:os";
-import { join as join130 } from "node:path";
+import { join as join131 } from "node:path";
 function switchroomHome() {
   return process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir73();
 }
@@ -132059,9 +132519,9 @@ function resolveSyncOptions(configPath, opts) {
       cfg = loaded.config_repo;
   } catch {}
   const home2 = switchroomHome();
-  const repoPath = opts.path ? resolvePath(opts.path) : cfg.path ? resolvePath(cfg.path) : join130(home2, ".switchroom-config");
-  const livePath = process.env.SWITCHROOM_CONFIG ?? join130(home2, ".switchroom", "switchroom.yaml");
-  const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join130(home2, ".switchroom", "agents");
+  const repoPath = opts.path ? resolvePath(opts.path) : cfg.path ? resolvePath(cfg.path) : join131(home2, ".switchroom-config");
+  const livePath = process.env.SWITCHROOM_CONFIG ?? join131(home2, ".switchroom", "switchroom.yaml");
+  const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join131(home2, ".switchroom", "agents");
   const push = opts.push === false ? false : cfg.push ?? true;
   const remote = opts.remote ?? cfg.remote ?? "origin";
   const requirePrivate = opts.requirePrivate ?? cfg.require_private ?? true;
@@ -132245,6 +132705,7 @@ registerDoctorCommand(program3);
 registerUpdateCommand(program3);
 registerRolloutCommand(program3);
 registerRollbackCommand(program3);
+registerHostCliUpgradeCommand(program3);
 registerRestartCommand(program3);
 registerVersionCommand(program3);
 registerVersionsCommand(program3);