switchroom 0.21.16 → 0.21.18

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.21.16", COMMIT_SHA = "d6c1267a", COMMIT_DATE = "2026-08-17T09:16:43Z";
+var VERSION = "0.21.18", COMMIT_SHA = "ae063418", COMMIT_DATE = "2026-08-18T03:14:53Z";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -13745,6 +13745,10 @@ var init_schema = __esm(() => {
     }).optional().describe("Operator-declared, per-specialist Hindsight mental models (RFC " + "Phase 5). Named, opt-in curated reflections this agent's bank should " + "carry \u2014 e.g. a coach's 'training-plan-state' or a lawyer's " + "'open-matters'. Ensured idempotently at scaffold/reconcile: NOTHING " + "is created unless declared here (zero declarations = zero models, " + "matching post-#2447 behaviour), and no fixed identity model is " + "reintroduced \u2014 'who the user is' stays owned by dedicated profile " + "banks (users.*.profile_bank), never a per-agent model. Per-agent " + "ONLY: intentionally not accepted at the defaults/profile tier, so a " + "model can never be fleet-seeded \u2014 each specialist opts in on its own " + "(the invariant-clean inverse of the retired blind auto-seeding)."),
     observations_mission: exports_external.string().optional().describe("Steers what the observation-consolidation LLM synthesises from raw " + "facts (the higher-order 'what patterns matter' lens). Cascade: override."),
     rules_block: exports_external.boolean().default(false).describe("Memory v2 M3 go-live flag (M1 only DEFINES this, default false; " + "M3 flips it per agent). When true, the sanctioned rules/index " + "blocks render live in this agent's CLAUDE.md (marker-delimited, " + "below the `# --- Yours ---` line) AND the permission deny for " + "direct Edit/Write of the agent's own CLAUDE.md is seeded \u2014 the " + "flag couples deny + tools together so a live deny never orphans " + "the invited free-text edit path (the `memory_edit_yours` verb is " + "the only sanctioned writer once flipped). Unset/false \u21d2 byte-" + "identical to pre-M1 behaviour: no blocks, no deny, dark build. " + "Cascade: override (per-agent wins over default; never fleet-" + "seeded \u2014 each agent's flip is a deliberate M3 rollout step)."),
+    orientation: exports_external.boolean().optional().describe("Memory v2 M5 go-live flag (Surface B: orientation-at-boot), " + "effective default false \u2014 dark build (unset \u21d2 OFF, applied by the " + "scaffold resolver, NOT a Zod .default() \u2014 a hard default here would " + "shadow the per-agent value in the cascade the way it does every other " + "memory knob). When true, the orientation SessionStart " + "hook injects this agent's cron-refreshed `orientation` mental model " + "into context at boot AND re-seats it after every compaction (E-88), " + "deterministically and with zero tool call. Unset/false \u21d2 byte-" + "identical to pre-M5 behaviour: the hook no-ops before any bank " + "resolve or network call. Per-agent ONLY (never fleet-seeded \u2014 a " + "flip is a deliberate canary/rollout step gated on the agent's " + "m2-residue measurement + operator-created model, carve-M5 \u00a77). " + "Cascade: override (per-agent wins over default)."),
+    orientation_reinject_turns: exports_external.number().int().min(0).optional().describe("Memory v2 M5 optional per-turn re-inject cadence, effective default " + "0 = off (unset \u21d2 0, applied by the scaffold resolver, not a Zod " + ".default() \u2014 same cascade-shadowing reason as `orientation`). At 0 the " + "briefing is injected only at SessionStart + compaction (the cheap " + "path). N>0 " + "would additionally re-inject the orientation briefing every N turns; " + "priced at ~55M tok/30d at every-turn, which is WHY it defaults off " + "(carve-M5 \u00a72/\u00a74). Only late-session context loss should ever set it, " + "per-agent, measured. A stripped/absent value fails to 0 (fail-safe " + "AND fail-cheap). Per-agent ONLY. Cascade: override."),
+    orientation_cadence_hours: exports_external.number().int().min(1).optional().describe("Memory v2 M5 per-agent refresh cadence tier (hours), effective " + "default 48 (unset \u21d2 48, applied by the scaffold resolver, not a Zod " + ".default() \u2014 a hard default would shadow a `defaults.memory." + "orientation_cadence_hours` fleet value in the cascade). " + "The fast-churning agents (klanker, overlord) set 24; everyone else " + "inherits 48 (carve-M5 \u00a76, Ken's locked tiered cadence). Drives BOTH " + "the out-of-session refresh scheduler AND the staleness guard's " + "per-tier thresholds (stale prefix at 1.5\u00d7 cadence, cold degrade at " + "3\u00d7) \u2014 so a fixed 36h can never mislabel a 48h-tier agent as stale a " + "day early. Modelled as an explicit int (not a hard-coded name list) " + "so the tiering is data-driven and auditable. A cost knob, not an " + "enablement knob: a stripped/absent value failing to 48 is safe " + "(the cheaper tier). Cascade: override (per-agent wins over default); " + "unlike `orientation`/`_reinject_turns` it IS accepted at the " + "defaults/profile tier."),
+    inject_directives: exports_external.boolean().optional().describe("Memory v2 M3 Surface-A directive-injection switch (default TRUE \u2014 " + "on-by-default via the plugin settings.json stamp + config.py " + "DEFAULTS). When left unset the agent keeps injecting the " + "`<active_directives>` block on every turn, byte-identical to pre-M3. " + "Set FALSE to SUPPRESS that injection for this agent \u2014 its standing " + "rules are then served from the live rules block (memory.rules_block) " + "instead of re-injected directives, which is the change that collapses " + "the always-on directive-token spend (E-41). The suppression is " + "fail-safe and re-checked every turn in recall.py: it fires ONLY when " + "a non-empty rules block is physically present in the agent's " + "CLAUDE.md \u2014 a false flag with an empty/absent block keeps injecting " + "AND emits a degraded-canary notice, so a zero-standing-rules turn is " + "unreachable. Requires memory.rules_block=true first (the block must " + "be live before injection is turned off \u2014 enforce the ordering with " + "`switchroom memory flip`, never a bare flag flip). Coordinates with " + "M4's memory.recall prefetch (memoryPrefetchEnabled): the same guard " + "gates all three recall.py emit sites so a flipped agent leaks no " + "directive on a cache/prefetch hit. Cascade: override, per-agent ONLY " + "(never fleet-seeded from the defaults/profile tier \u2014 each flip is a " + "deliberate staggered M3 rollout step, same darkness safeguard as " + "rules_block). Default-true is the fail-safe direction under the " + "Zod-strip footgun: a stripped/misread key keeps the agent injecting."),
     disposition: exports_external.object({
       skepticism: exports_external.number().int().min(1).max(5).optional().describe("How much the bank doubts unverified claims (1-5; engine default 3)."),
       literalism: exports_external.number().int().min(1).max(5).optional().describe("How literally the bank reads statements vs inferring intent (1-5; engine default 3)."),
@@ -14190,6 +14194,7 @@ var init_schema = __esm(() => {
       profile: exports_external.string().optional(),
       directive_capture_nudge: exports_external.boolean().optional(),
       profile_capture_nudge: exports_external.boolean().optional(),
+      orientation_cadence_hours: exports_external.number().int().min(1).optional(),
       anti_confabulation_directive: AntiConfabulationDirectiveSchema,
       observation_scopes: ObservationScopesSchema,
       observation_scope_strategy: ObservationScopeStrategySchema,
@@ -19562,6 +19567,9 @@ function generateHindsightMcpConfig(collection, memoryConfig, opts = {}) {
       }
     };
   }
+  const grantedBanks = [
+    ...new Set((opts.knowledgeExtraBanks ?? []).filter((b) => b && b !== collection))
+  ];
   return {
     type: "stdio",
     command: HINDSIGHT_SHIM_CLI_PATH,
@@ -19569,6 +19577,7 @@ function generateHindsightMcpConfig(collection, memoryConfig, opts = {}) {
     env: {
       HINDSIGHT_MCP_URL: url,
       HINDSIGHT_BANK_ID: collection,
+      ...grantedBanks.length > 0 ? { HINDSIGHT_KNOWLEDGE_EXTRA_BANKS: grantedBanks.join(",") } : {},
       HINDSIGHT_SHIM_CACHE_DIR: `${HINDSIGHT_SHIM_AGENT_HOME}/.hindsight-shim`,
       HOME: HINDSIGHT_SHIM_AGENT_HOME,
       ...opts.reflectBudget ? { HINDSIGHT_SHIM_REFLECT_BUDGET: opts.reflectBudget } : {},
@@ -28007,9 +28016,11 @@ function getHindsightSettingsEntry(agentName, config) {
   }
   const collection = getCollectionForAgent(agentName, config);
   const resolved = resolveAgentConfig(config.defaults, config.profiles, config.agents[agentName] ?? {});
+  const { additionalBanks } = resolveUsers(config, agentName);
   const mcpConfig = generateHindsightMcpConfig(collection, memoryConfig, {
     reflectBudget: resolved.memory?.reflect_budget,
-    reflectMaxTokens: resolved.memory?.reflect_max_tokens
+    reflectMaxTokens: resolved.memory?.reflect_max_tokens,
+    knowledgeExtraBanks: additionalBanks
   });
   return { key: "hindsight", value: { ...mcpConfig, alwaysLoad: false } };
 }
@@ -28102,6 +28113,7 @@ function getBuiltinDefaultSkillEntries() {
 var GOOGLE_WORKSPACE_MCP_PINNED_SHA = "db6212992738d4380a94fb6940140bcebf5d861d", MICROSOFT_WORKSPACE_MCP_PINNED_VERSION = "0.113.0", MICROSOFT_WORKSPACE_MCP_PACKAGE = "@softeria/ms-365-mcp-server", NOTION_MCP_PINNED_VERSION = "1.8.1", NOTION_MCP_PACKAGE = "@notionhq/notion-mcp-server", NOTION_TOKEN_ENV = "NOTION_TOKEN";
 var init_scaffold_integration = __esm(() => {
   init_merge();
+  init_users();
   init_hindsight2();
 });
 
@@ -30493,6 +30505,7 @@ function installHindsightPlugin(agentName, agentDir, switchroomConfig, resolvedA
   const additionalBanks = resolveUsers(switchroomConfig, agentName).additionalBanks;
   const retainConfig = resolveHindsightRetainConfig(switchroomConfig, agentName, resolvedAgentConfig);
   const observationScopeSettings = resolveHindsightObservationScopeSettings(switchroomConfig, agentName, resolvedAgentConfig);
+  const orientationSettings = resolveHindsightOrientationSettings(switchroomConfig, agentName, resolvedAgentConfig);
   const recallConfig = resolveHindsightRecallConfig(switchroomConfig, agentName, resolvedAgentConfig);
   const recallTunables = resolveHindsightRecallTunables(recallConfig);
   const recallCaps = resolveHindsightRecallCaps(recallConfig);
@@ -30500,7 +30513,7 @@ function installHindsightPlugin(agentName, agentDir, switchroomConfig, resolvedA
   try {
     const vendorSettingsPath = join15(sourcePath, "settings.json");
     if (existsSync20(vendorSettingsPath)) {
-      const expectedSettings = renderHindsightSettingsOverrides(readFileSync17(vendorSettingsPath, "utf-8"), additionalBanks, retainConfig, recallTunables, recallCaps, observationScopeSettings);
+      const expectedSettings = renderHindsightSettingsOverrides(readFileSync17(vendorSettingsPath, "utf-8"), additionalBanks, retainConfig, recallTunables, recallCaps, observationScopeSettings, orientationSettings);
       if (expectedSettings != null)
         contentOverrides["settings.json"] = expectedSettings;
     }
@@ -30518,7 +30531,7 @@ function installHindsightPlugin(agentName, agentDir, switchroomConfig, resolvedA
     }
     copyDirRecursive2(sourcePath, destPath);
   }
-  applyHindsightSettingsOverrides(destPath, additionalBanks, retainConfig, recallTunables, recallCaps, observationScopeSettings);
+  applyHindsightSettingsOverrides(destPath, additionalBanks, retainConfig, recallTunables, recallCaps, observationScopeSettings, orientationSettings);
   applyHindsightHooksOverrides(destPath, recallTunables);
   const bankId = agentMemory?.collection ?? agentName;
   const mcpUrl = memory.config?.url ?? HINDSIGHT_DEFAULT_MCP_URL;
@@ -30547,6 +30560,15 @@ function resolveHindsightObservationScopeSettings(switchroomConfig, agentName, r
     observationScopeStrategy: memory?.observation_scope_strategy
   };
 }
+function resolveHindsightOrientationSettings(switchroomConfig, agentName, resolvedAgentConfig) {
+  const memory = resolvedAgentConfig ? resolvedAgentConfig.memory : switchroomConfig ? resolveAgentConfig(switchroomConfig.defaults, switchroomConfig.profiles, switchroomConfig.agents[agentName] ?? {})?.memory : undefined;
+  return {
+    enabled: memory?.orientation === true,
+    model: "orientation",
+    cadenceHours: typeof memory?.orientation_cadence_hours === "number" ? memory.orientation_cadence_hours : 48,
+    reinjectTurns: typeof memory?.orientation_reinject_turns === "number" ? memory.orientation_reinject_turns : 0
+  };
+}
 function resolveHindsightRecallConfig(switchroomConfig, agentName, resolvedAgentConfig) {
   if (resolvedAgentConfig) {
     return resolvedAgentConfig.memory?.recall;
@@ -30581,7 +30603,7 @@ function defaultRecallOwnBankMinSlots(maxMemories) {
 function defaultRecallAdditionalBankMinSlots(maxMemories) {
   return recallSlotFloorFromCap(maxMemories, RECALL_ADDITIONAL_BANK_SLOT_DIVISOR);
 }
-function applyHindsightSettingsOverrides(pluginDestPath, additionalBanks, retainConfig, recallTunables, recallCaps, observationScopeSettings) {
+function applyHindsightSettingsOverrides(pluginDestPath, additionalBanks, retainConfig, recallTunables, recallCaps, observationScopeSettings, orientationSettings) {
   const settingsPath = join15(pluginDestPath, "settings.json");
   if (!existsSync20(settingsPath))
     return;
@@ -30591,12 +30613,12 @@ function applyHindsightSettingsOverrides(pluginDestPath, additionalBanks, retain
   } catch {
     return;
   }
-  const next = renderHindsightSettingsOverrides(raw, additionalBanks, retainConfig, recallTunables, recallCaps, observationScopeSettings);
+  const next = renderHindsightSettingsOverrides(raw, additionalBanks, retainConfig, recallTunables, recallCaps, observationScopeSettings, orientationSettings);
   if (next == null)
     return;
   writeFileSyncIfChanged(settingsPath, next);
 }
-function renderHindsightSettingsOverrides(raw, additionalBanks, retainConfig, recallTunables, recallCaps, observationScopeSettings) {
+function renderHindsightSettingsOverrides(raw, additionalBanks, retainConfig, recallTunables, recallCaps, observationScopeSettings, orientationSettings) {
   let settings;
   try {
     settings = JSON.parse(raw);
@@ -30618,6 +30640,7 @@ function renderHindsightSettingsOverrides(raw, additionalBanks, retainConfig, re
   settings.recallSkipTrivial = true;
   settings.directiveCaptureNudge = true;
   settings.profileCaptureNudge = true;
+  settings.injectDirectives = true;
   settings.recallTagWeights = { ...HINDSIGHT_RECALL_TAG_WEIGHT_SEED };
   if (additionalBanks.length > 0) {
     settings.recallAdditionalBanks = [...additionalBanks];
@@ -30630,6 +30653,10 @@ function renderHindsightSettingsOverrides(raw, additionalBanks, retainConfig, re
   if (typeof observationScopeStrategy === "string" && observationScopeStrategy.length > 0) {
     settings.observationScopeStrategy = observationScopeStrategy;
   }
+  settings.memoryOrientationEnabled = orientationSettings.enabled;
+  settings.memoryOrientationModel = orientationSettings.model;
+  settings.memoryOrientationCadenceHours = orientationSettings.cadenceHours;
+  settings.memoryOrientationReinjectTurns = orientationSettings.reinjectTurns;
   return JSON.stringify(settings, null, 2) + `
 `;
 }
@@ -30672,6 +30699,7 @@ function buildWorkspaceContext(args) {
     hindsightRecallSkipTrivial,
     hindsightDirectiveCaptureNudge,
     hindsightProfileCaptureNudge,
+    hindsightInjectDirectives,
     hindsightObservationScopes,
     hindsightObservationScopeStrategy,
     hindsightTopicAliasesJson,
@@ -30728,6 +30756,7 @@ function buildWorkspaceContext(args) {
     hindsightRecallSkipTrivial,
     hindsightDirectiveCaptureNudge,
     hindsightProfileCaptureNudge,
+    hindsightInjectDirectives,
     hindsightObservationScopesQ: hindsightObservationScopes ? shellSingleQuote(hindsightObservationScopes) : undefined,
     hindsightObservationScopeStrategyQ: hindsightObservationScopeStrategy ? shellSingleQuote(hindsightObservationScopeStrategy) : undefined,
     hindsightTopicAliasesJsonQ: hindsightTopicAliasesJson ? shellSingleQuote(hindsightTopicAliasesJson) : undefined,
@@ -31004,6 +31033,7 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
   const hindsightRecallSkipTrivial = agentConfig.memory?.recall?.skip_trivial === undefined ? undefined : String(agentConfig.memory.recall.skip_trivial);
   const hindsightDirectiveCaptureNudge = agentConfig.memory?.directive_capture_nudge === undefined ? undefined : String(agentConfig.memory.directive_capture_nudge);
   const hindsightProfileCaptureNudge = agentConfig.memory?.profile_capture_nudge === undefined ? undefined : String(agentConfig.memory.profile_capture_nudge);
+  const hindsightInjectDirectives = agentConfig.memory?.inject_directives === undefined ? undefined : String(agentConfig.memory.inject_directives);
   const hindsightObservationScopes = agentConfig.memory?.observation_scopes;
   const hindsightObservationScopeStrategy = agentConfig.memory?.observation_scope_strategy;
   const topicAliases = agentConfig.channels?.telegram?.topic_aliases;
@@ -31042,6 +31072,7 @@ function scaffoldAgent(name, agentConfigRaw, agentsDir, telegramConfig, switchro
     hindsightRecallSkipTrivial,
     hindsightDirectiveCaptureNudge,
     hindsightProfileCaptureNudge,
+    hindsightInjectDirectives,
     hindsightObservationScopes,
     hindsightObservationScopeStrategy,
     hindsightTopicAliasesJson,
@@ -32031,6 +32062,7 @@ function reconcileAgentInner(name, agentConfigRaw, agentsDir, telegramConfig, sw
   const hindsightRecallSkipTrivial = agentConfig.memory?.recall?.skip_trivial === undefined ? undefined : String(agentConfig.memory.recall.skip_trivial);
   const hindsightDirectiveCaptureNudge = agentConfig.memory?.directive_capture_nudge === undefined ? undefined : String(agentConfig.memory.directive_capture_nudge);
   const hindsightProfileCaptureNudge = agentConfig.memory?.profile_capture_nudge === undefined ? undefined : String(agentConfig.memory.profile_capture_nudge);
+  const hindsightInjectDirectives = agentConfig.memory?.inject_directives === undefined ? undefined : String(agentConfig.memory.inject_directives);
   const hindsightObservationScopes = agentConfig.memory?.observation_scopes;
   const hindsightObservationScopeStrategy = agentConfig.memory?.observation_scope_strategy;
   const topicAliases = agentConfig.channels?.telegram?.topic_aliases;
@@ -32081,6 +32113,7 @@ function reconcileAgentInner(name, agentConfigRaw, agentsDir, telegramConfig, sw
       hindsightRecallSkipTrivial,
       hindsightDirectiveCaptureNudge,
       hindsightProfileCaptureNudge,
+      hindsightInjectDirectives,
       hindsightObservationScopesQ: hindsightObservationScopes ? shellSingleQuote(hindsightObservationScopes) : undefined,
       hindsightObservationScopeStrategyQ: hindsightObservationScopeStrategy ? shellSingleQuote(hindsightObservationScopeStrategy) : undefined,
       hindsightTopicAliasesJsonQ: hindsightTopicAliasesJson ? shellSingleQuote(hindsightTopicAliasesJson) : undefined,
@@ -32519,6 +32552,7 @@ ${body}
       hindsightRecallSkipTrivial,
       hindsightDirectiveCaptureNudge,
       hindsightProfileCaptureNudge,
+      hindsightInjectDirectives,
       hindsightObservationScopes,
       hindsightObservationScopeStrategy,
       hindsightTopicAliasesJson,
@@ -66507,6 +66541,51 @@ function readClaudeMdSafe(agentsDir, agentName, readFileFn) {
     return null;
   }
 }
+function runDirectiveFlipChecks(config, deps = {}) {
+  const readFileFn = deps.readFileFn ?? ((p) => readFileSync65(p, "utf-8"));
+  let agentsDir = deps.agentsDir;
+  if (agentsDir === undefined) {
+    try {
+      agentsDir = resolveAgentsDir(config);
+    } catch {
+      agentsDir = undefined;
+    }
+  }
+  const results = [];
+  for (const [agentName, agentConfig] of Object.entries(config.agents)) {
+    const resolved = resolveAgentConfig(config.defaults, config.profiles, agentConfig);
+    if (resolved.memory?.inject_directives !== false)
+      continue;
+    const name = `agent ${agentName} directive flip (inject_directives=false)`;
+    if (resolved.memory?.rules_block !== true) {
+      results.push({
+        name,
+        status: "fail",
+        detail: "inject_directives is false but memory.rules_block is not true \u2014 the " + "rules block that must carry the migrated directives is not even " + "enabled. recall.py fails safe (keeps injecting), but fix the config: " + "enable rules_block and migrate, or re-enable inject_directives.",
+        fix: `Set memory.rules_block: true for ${agentName} (and migrate its directives) before flipping.`
+      });
+      continue;
+    }
+    const claudeMd = readClaudeMdSafe(agentsDir, agentName, readFileFn);
+    const parsed = claudeMd ? parseRulesBlock(claudeMd) : null;
+    const ruleCount = parsed?.rules.length ?? 0;
+    if (ruleCount === 0) {
+      results.push({
+        name,
+        status: "fail",
+        detail: claudeMd === null ? "inject_directives is false but the agent's CLAUDE.md could not be " + "read to confirm a rules block carries the migrated directives." : "inject_directives is false but the CLAUDE.md rules block is empty " + "(no `- **R-\u2026` rule lines). Every directive would be suppressed with " + "nothing carrying its guarantee. recall.py fails safe at runtime, but " + "fix the config: migrate the directives into the rules block, or " + "re-enable inject_directives.",
+        fix: `Migrate ${agentName}'s directives into the rules block (memory rule add) or re-enable inject_directives.`
+      });
+    } else {
+      results.push({
+        name,
+        status: "ok",
+        detail: `flipped, and the rules block carries ${ruleCount} rule(s) \u2014 directive injection safely suppressed.`
+      });
+    }
+  }
+  return results;
+}
 async function runRulesBlockChecks(config, engineUrl, deps = {}) {
   const readFileFn = deps.readFileFn ?? ((p) => readFileSync65(p, "utf-8"));
   let agentsDir = deps.agentsDir;
@@ -68797,6 +68876,7 @@ async function checkHindsight(config) {
   results.push(...await checkBankIngestHealth(config, url, { includeConsolidationBacklog: true }));
   results.push(...await checkBankObservationsMissions(config, url));
   results.push(...await runRulesBlockChecks(config, url));
+  results.push(...runDirectiveFlipChecks(config));
   results.push(...await checkBankConfigApiReachable(config, url));
   results.push(await checkObservationScopeSaturation(config, url));
   const memoryAgentsDir = resolveAgentsDir(config);
@@ -71656,11 +71736,11 @@ var init_apply = __esm(() => {
 });
 
 // src/host-control/audit-reader.ts
-import { closeSync as closeSync15, existsSync as existsSync83, openSync as openSync15, readSync as readSync5, statSync as statSync49 } from "node:fs";
+import { closeSync as closeSync15, existsSync as existsSync84, openSync as openSync15, readSync as readSync5, statSync as statSync50 } from "node:fs";
 import { homedir as homedir43 } from "node:os";
-import { join as join90 } from "node:path";
+import { join as join91 } from "node:path";
 function defaultAuditLogPath2(home2 = homedir43()) {
-  return join90(home2, ".switchroom", "host-control-audit.log");
+  return join91(home2, ".switchroom", "host-control-audit.log");
 }
 function auditRotation() {
   return resolveRotationConfig({
@@ -71677,14 +71757,14 @@ function auditReadFullWindowBytes() {
 function auditReadMaxGenerations() {
   return auditRotation().maxFiles;
 }
-function tailBytes(path7, n, strict = false) {
+function tailBytes(path9, n, strict = false) {
   if (n <= 0)
     return "";
   let fd;
   let size;
   try {
-    size = statSync49(path7).size;
-    fd = openSync15(path7, "r");
+    size = statSync50(path9).size;
+    fd = openSync15(path9, "r");
   } catch (err) {
     if (strict && err.code !== "ENOENT")
       throw err;
@@ -71729,7 +71809,7 @@ function readAuditRaw(logPath, opts = {}) {
   budget -= Buffer.byteLength(active, "utf-8");
   for (let n = 1;n <= maxFiles && budget > 0; n++) {
     const gen = `${logPath}.${n}`;
-    if (!existsSync83(gen))
+    if (!existsSync84(gen))
       break;
     const chunk2 = tailBytes(gen, budget, strict);
     if (chunk2.length === 0)
@@ -71907,16 +71987,16 @@ var init_audit_reader = __esm(() => {
 });
 
 // src/web/fleet-health-read.ts
-import { readFileSync as readFileSync78 } from "node:fs";
-import { resolve as resolve45 } from "node:path";
+import { readFileSync as readFileSync79 } from "node:fs";
+import { resolve as resolve46 } from "node:path";
 import { homedir as homedir46 } from "node:os";
 function fleetHealthLedgerPath(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir46()) {
-  return resolve45(home2, ".switchroom", "fleet-health", "ledger.json");
+  return resolve46(home2, ".switchroom", "fleet-health", "ledger.json");
 }
-function readFleetHealth(path7) {
+function readFleetHealth(path9) {
   let ledger;
   try {
-    ledger = JSON.parse(readFileSync78(path7, "utf-8"));
+    ledger = JSON.parse(readFileSync79(path9, "utf-8"));
   } catch {
     return {
       owner_agent: null,
@@ -71942,8 +72022,8 @@ function readFleetHealth(path7) {
     ...ranked.length === 0 ? { reason: EMPTY_REASON } : {}
   };
 }
-function handleGetFleetHealth(path7 = fleetHealthLedgerPath()) {
-  return readFleetHealth(path7);
+function handleGetFleetHealth(path9 = fleetHealthLedgerPath()) {
+  return readFleetHealth(path9);
 }
 var EMPTY_REASON;
 var init_fleet_health_read = __esm(() => {
@@ -110178,8 +110258,8 @@ init_loader();
 init_hindsight();
 var import_yaml16 = __toESM(require_dist(), 1);
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync82, readFileSync as readFileSync74, statSync as statSync48 } from "node:fs";
-import { join as join88 } from "node:path";
+import { existsSync as existsSync83, readFileSync as readFileSync75, statSync as statSync49 } from "node:fs";
+import { join as join89 } from "node:path";
 
 // src/cli/memory-rules.ts
 init_source();
@@ -110446,11 +110526,933 @@ function registerMemoryDirectiveCommand(memory, program3) {
   }));
 }
 
+// src/cli/memory-flip.ts
+init_source();
+init_helpers();
+init_hindsight2();
+init_hindsight();
+init_hindsight_directive_admin();
+
+// src/memory/directive-triage.ts
+init_hindsight_directive_admin();
+var SUPERSEDED_BY_TAG_RE = /^superseded-by:(.+)$/;
+function classifyDirective(directive, override) {
+  const isActive = directive.is_active !== false;
+  const overrideSignal = override?.signal.trim();
+  if (hasRulesBlockMarker(directive.tags)) {
+    return {
+      category: "rules-block",
+      signal: "carries the rules-block marker tag \u2014 staged for M3, never retired",
+      action: "stage-for-m3"
+    };
+  }
+  if (override && override.category === "rules-block") {
+    return {
+      category: "rules-block",
+      signal: overrideSignal || "rules-block override with no signal text \u2014 staged for M3, never retired",
+      action: "stage-for-m3"
+    };
+  }
+  const supersessionTag = (directive.tags ?? []).map((t) => SUPERSEDED_BY_TAG_RE.exec(t)).find((m) => m !== null);
+  if (supersessionTag) {
+    const winner = supersessionTag[1];
+    return {
+      category: "retire",
+      signal: isActive ? `superseded by '${winner}' (superseded-by tag)` : `superseded by '${winner}' (superseded-by tag) \u2014 already inactive, nothing to retire`,
+      action: isActive ? "retire" : "keep",
+      supersededBy: winner
+    };
+  }
+  if (override && overrideSignal) {
+    if (override.category === "reflect-directive") {
+      return { category: "reflect-directive", signal: overrideSignal, action: "keep" };
+    }
+    return {
+      category: override.category,
+      signal: isActive ? overrideSignal : `${overrideSignal} \u2014 already inactive, nothing to retire`,
+      action: isActive ? "retire" : "keep"
+    };
+  }
+  return {
+    category: "reflect-directive",
+    signal: "no deterministic signal \u2014 defaults to KEEP",
+    action: "keep"
+  };
+}
+function buildDirectiveTriageRows(directives, overrides) {
+  return directives.map((d) => {
+    const classified = classifyDirective(d, overrides?.get(d.id));
+    return {
+      id: d.id,
+      name: d.name,
+      priority: d.priority ?? 0,
+      isActive: d.is_active !== false,
+      ...classified
+    };
+  });
+}
+
+// src/cli/debug.ts
+init_helpers();
+init_loader();
+import { existsSync as existsSync82, readFileSync as readFileSync74, readdirSync as readdirSync30, statSync as statSync48 } from "node:fs";
+import { resolve as resolve43, join as join88 } from "node:path";
+import { createHash as createHash15 } from "node:crypto";
+
+// src/agents/workspace.ts
+import { readFile as readFile2, stat } from "node:fs/promises";
+import path8 from "node:path";
+
+// src/agents/bootstrap-budget.ts
+import path7 from "node:path";
+var DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO = 0.85;
+var DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES = 3;
+var DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX = 32;
+
+class BootstrapBudgetExceededError extends Error {
+  analysis;
+  constructor(analysis, message) {
+    super(message);
+    this.analysis = analysis;
+    this.name = "BootstrapBudgetExceededError";
+  }
+}
+function normalizePositiveLimit(value) {
+  if (!Number.isFinite(value) || value <= 0) {
+    return 1;
+  }
+  return Math.floor(value);
+}
+function formatWarningCause(cause) {
+  return cause === "per-file-limit" ? "max/file" : "max/total";
+}
+function normalizeSeenSignatures(signatures) {
+  if (!Array.isArray(signatures) || signatures.length === 0) {
+    return [];
+  }
+  const seen = new Set;
+  const result = [];
+  for (const signature of signatures) {
+    const value = typeof signature === "string" ? signature.trim() : "";
+    if (!value || seen.has(value)) {
+      continue;
+    }
+    seen.add(value);
+    result.push(value);
+  }
+  return result;
+}
+function appendSeenSignature(signatures, signature) {
+  if (!signature.trim()) {
+    return signatures;
+  }
+  if (signatures.includes(signature)) {
+    return signatures;
+  }
+  const next = [...signatures, signature];
+  if (next.length <= DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX) {
+    return next;
+  }
+  return next.slice(-DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX);
+}
+function buildBootstrapInjectionStats(params) {
+  const injectedByPath = new Map;
+  const injectedByBaseName = new Map;
+  for (const file of params.injectedFiles) {
+    const pathValue = typeof file.path === "string" ? file.path.trim() : "";
+    if (!pathValue) {
+      continue;
+    }
+    if (!injectedByPath.has(pathValue)) {
+      injectedByPath.set(pathValue, file.content);
+    }
+    const normalizedPath = pathValue.replace(/\\/g, "/");
+    const baseName = path7.posix.basename(normalizedPath);
+    if (!injectedByBaseName.has(baseName)) {
+      injectedByBaseName.set(baseName, file.content);
+    }
+  }
+  return params.bootstrapFiles.map((file) => {
+    const pathValue = typeof file.path === "string" ? file.path.trim() : "";
+    const rawChars = file.missing ? 0 : (file.content ?? "").trimEnd().length;
+    const injected = (pathValue ? injectedByPath.get(pathValue) : undefined) ?? injectedByPath.get(file.name) ?? injectedByBaseName.get(file.name);
+    const injectedChars = injected ? injected.length : 0;
+    const truncated = !file.missing && injectedChars < rawChars;
+    return {
+      name: file.name,
+      path: pathValue || file.name,
+      missing: file.missing,
+      rawChars,
+      injectedChars,
+      truncated
+    };
+  });
+}
+function analyzeBootstrapBudget(params) {
+  const bootstrapMaxChars = normalizePositiveLimit(params.bootstrapMaxChars);
+  const bootstrapTotalMaxChars = normalizePositiveLimit(params.bootstrapTotalMaxChars);
+  const nearLimitRatio = typeof params.nearLimitRatio === "number" && Number.isFinite(params.nearLimitRatio) && params.nearLimitRatio > 0 && params.nearLimitRatio < 1 ? params.nearLimitRatio : DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO;
+  const nonMissing = params.files.filter((file) => !file.missing);
+  const rawChars = nonMissing.reduce((sum, file) => sum + file.rawChars, 0);
+  const injectedChars = nonMissing.reduce((sum, file) => sum + file.injectedChars, 0);
+  const totalNearLimit = injectedChars >= Math.ceil(bootstrapTotalMaxChars * nearLimitRatio);
+  const totalOverLimit = injectedChars >= bootstrapTotalMaxChars;
+  const files = params.files.map((file) => {
+    if (file.missing) {
+      return { ...file, nearLimit: false, causes: [] };
+    }
+    const perFileOverLimit = file.rawChars > bootstrapMaxChars;
+    const nearLimit = file.rawChars >= Math.ceil(bootstrapMaxChars * nearLimitRatio);
+    const causes = [];
+    if (file.truncated) {
+      if (perFileOverLimit) {
+        causes.push("per-file-limit");
+      }
+      if (totalOverLimit) {
+        causes.push("total-limit");
+      }
+    }
+    return { ...file, nearLimit, causes };
+  });
+  const truncatedFiles = files.filter((file) => file.truncated);
+  const nearLimitFiles = files.filter((file) => file.nearLimit);
+  return {
+    files,
+    truncatedFiles,
+    nearLimitFiles,
+    totalNearLimit,
+    hasTruncation: truncatedFiles.length > 0,
+    totals: {
+      rawChars,
+      injectedChars,
+      truncatedChars: Math.max(0, rawChars - injectedChars),
+      bootstrapMaxChars,
+      bootstrapTotalMaxChars,
+      nearLimitRatio
+    }
+  };
+}
+function buildBootstrapTruncationSignature(analysis) {
+  if (!analysis.hasTruncation) {
+    return;
+  }
+  const files = analysis.truncatedFiles.map((file) => ({
+    path: file.path || file.name,
+    rawChars: file.rawChars,
+    injectedChars: file.injectedChars,
+    causes: [...file.causes].sort()
+  })).sort((a, b) => {
+    const pathCmp = a.path.localeCompare(b.path);
+    if (pathCmp !== 0) {
+      return pathCmp;
+    }
+    if (a.rawChars !== b.rawChars) {
+      return a.rawChars - b.rawChars;
+    }
+    if (a.injectedChars !== b.injectedChars) {
+      return a.injectedChars - b.injectedChars;
+    }
+    return a.causes.join("+").localeCompare(b.causes.join("+"));
+  });
+  return JSON.stringify({
+    bootstrapMaxChars: analysis.totals.bootstrapMaxChars,
+    bootstrapTotalMaxChars: analysis.totals.bootstrapTotalMaxChars,
+    files
+  });
+}
+function formatBootstrapTruncationWarningLines(params) {
+  if (!params.analysis.hasTruncation) {
+    return [];
+  }
+  const maxFiles = typeof params.maxFiles === "number" && Number.isFinite(params.maxFiles) && params.maxFiles > 0 ? Math.floor(params.maxFiles) : DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES;
+  const lines = [];
+  const duplicateNameCounts = params.analysis.truncatedFiles.reduce((acc, file) => {
+    acc.set(file.name, (acc.get(file.name) ?? 0) + 1);
+    return acc;
+  }, new Map);
+  const topFiles = params.analysis.truncatedFiles.slice(0, maxFiles);
+  for (const file of topFiles) {
+    const pct = file.rawChars > 0 ? Math.round((file.rawChars - file.injectedChars) / file.rawChars * 100) : 0;
+    const causeText = file.causes.length > 0 ? file.causes.map((cause) => formatWarningCause(cause)).join(", ") : "";
+    const nameLabel = (duplicateNameCounts.get(file.name) ?? 0) > 1 && file.path.trim().length > 0 ? `${file.name} (${file.path})` : file.name;
+    lines.push(`${nameLabel}: ${file.rawChars} raw -> ${file.injectedChars} injected (~${Math.max(0, pct)}% removed${causeText ? `; ${causeText}` : ""}).`);
+  }
+  if (params.analysis.truncatedFiles.length > topFiles.length) {
+    lines.push(`+${params.analysis.truncatedFiles.length - topFiles.length} more truncated file(s).`);
+  }
+  lines.push("If unintentional, raise switchroom workspace bootstrapMaxChars and/or bootstrapTotalMaxChars config.");
+  return lines;
+}
+function buildBootstrapPromptWarning(params) {
+  const signature = buildBootstrapTruncationSignature(params.analysis);
+  let seenSignatures = normalizeSeenSignatures(params.seenSignatures);
+  if (params.previousSignature && !seenSignatures.includes(params.previousSignature)) {
+    seenSignatures = appendSeenSignature(seenSignatures, params.previousSignature);
+  }
+  const hasSeenSignature = Boolean(signature && seenSignatures.includes(signature));
+  const warningShown = params.mode !== "off" && Boolean(signature) && (params.mode === "always" || !hasSeenSignature);
+  const warningSignaturesSeen = signature && params.mode !== "off" ? appendSeenSignature(seenSignatures, signature) : seenSignatures;
+  return {
+    signature,
+    warningShown,
+    lines: warningShown ? formatBootstrapTruncationWarningLines({
+      analysis: params.analysis,
+      maxFiles: params.maxFiles
+    }) : [],
+    warningSignaturesSeen
+  };
+}
+
+// src/agents/bootstrap-types.ts
+var DEFAULT_AGENTS_FILENAME = "AGENTS.md";
+var DEFAULT_SOUL_DEFAULT_FILENAME = "SOUL.default.md";
+var DEFAULT_SOUL_FILENAME = "SOUL.md";
+var DEFAULT_TOOLS_FILENAME = "TOOLS.md";
+var DEFAULT_IDENTITY_FILENAME = "IDENTITY.md";
+var DEFAULT_USER_FILENAME = "USER.md";
+var DEFAULT_BOOTSTRAP_FILENAME = "BOOTSTRAP.md";
+var DEFAULT_MEMORY_FILENAME = "MEMORY.md";
+
+// src/agents/workspace.ts
+var DEFAULT_WORKSPACE_DIR_NAME = "workspace";
+var DEFAULT_MEMORY_SUBDIR = "memory";
+var STABLE_BOOTSTRAP_FILENAMES = [
+  DEFAULT_AGENTS_FILENAME,
+  DEFAULT_SOUL_DEFAULT_FILENAME,
+  DEFAULT_SOUL_FILENAME,
+  DEFAULT_IDENTITY_FILENAME,
+  DEFAULT_USER_FILENAME,
+  DEFAULT_TOOLS_FILENAME,
+  DEFAULT_BOOTSTRAP_FILENAME
+];
+var DYNAMIC_BOOTSTRAP_FILENAMES = [
+  DEFAULT_MEMORY_FILENAME
+];
+var DEFAULT_BOOTSTRAP_MAX_CHARS = 12000;
+var DEFAULT_BOOTSTRAP_TOTAL_MAX_CHARS = 64000;
+var DEFAULT_DYNAMIC_TOTAL_MAX_CHARS = 24000;
+function resolveAgentWorkspaceDir(agentDir) {
+  return path8.join(agentDir, DEFAULT_WORKSPACE_DIR_NAME);
+}
+async function readOptionalFile(filePath) {
+  try {
+    const content = await readFile2(filePath, "utf8");
+    return content;
+  } catch (err) {
+    if (isErrnoException(err) && (err.code === "ENOENT" || err.code === "EISDIR")) {
+      return;
+    }
+    throw err;
+  }
+}
+function isErrnoException(value) {
+  return value instanceof Error && typeof value.code === "string";
+}
+async function loadNamedFile(workspaceDir, name, relativePath) {
+  const filePath = path8.join(workspaceDir, relativePath ?? name);
+  const content = await readOptionalFile(filePath);
+  if (content === undefined) {
+    return { name, path: filePath, missing: true };
+  }
+  return { name, path: filePath, content, missing: false };
+}
+async function loadStableBootstrapFiles(workspaceDir, options) {
+  const defaultFiles = await Promise.all(STABLE_BOOTSTRAP_FILENAMES.map((name) => loadNamedFile(workspaceDir, name)));
+  const extras = options?.extraStableFiles ?? [];
+  if (extras.length === 0) {
+    return defaultFiles;
+  }
+  const extraFiles = await Promise.all(extras.map((name) => loadNamedFile(workspaceDir, name)));
+  return [...defaultFiles, ...extraFiles];
+}
+async function loadDynamicBootstrapFiles(workspaceDir, options) {
+  const now2 = options?.now ?? new Date;
+  const includeYesterday = options?.includeYesterday ?? true;
+  const files = await Promise.all(DYNAMIC_BOOTSTRAP_FILENAMES.map((name) => loadNamedFile(workspaceDir, name)));
+  const todayRelative = dailyMemoryRelativePath(now2);
+  const todayName = DEFAULT_MEMORY_FILENAME;
+  const today = await loadNamedFile(workspaceDir, todayName, todayRelative);
+  today.path = path8.join(workspaceDir, todayRelative);
+  files.push(today);
+  if (includeYesterday) {
+    const yesterdayRelative = dailyMemoryRelativePath(addDays(now2, -1));
+    const yesterday = await loadNamedFile(workspaceDir, todayName, yesterdayRelative);
+    yesterday.path = path8.join(workspaceDir, yesterdayRelative);
+    files.push(yesterday);
+  }
+  return files;
+}
+function pad22(n) {
+  return n < 10 ? `0${n}` : String(n);
+}
+function dailyMemoryRelativePath(date) {
+  const y = date.getFullYear();
+  const m = pad22(date.getMonth() + 1);
+  const d = pad22(date.getDate());
+  return path8.join(DEFAULT_MEMORY_SUBDIR, `${y}-${m}-${d}.md`);
+}
+function addDays(date, days) {
+  const out = new Date(date.getTime());
+  out.setDate(out.getDate() + days);
+  return out;
+}
+function truncateContent(name, content, maxChars) {
+  if (content.length <= maxChars) {
+    return content;
+  }
+  if (maxChars < 200) {
+    return content.slice(0, Math.max(0, maxChars));
+  }
+  const headRoomInitial = Math.floor(maxChars * 0.7);
+  const sampleMarker = `
+\u2026(truncated ${name}: kept ${headRoomInitial}+${Math.max(0, maxChars - headRoomInitial - 96)} chars of ${content.length})\u2026
+`;
+  const markerReserve = Math.max(64, sampleMarker.length + 8);
+  const headRoom = Math.min(headRoomInitial, Math.max(0, maxChars - markerReserve - 8));
+  const tailRoom = Math.max(0, maxChars - headRoom - markerReserve);
+  const head = content.slice(0, Math.max(0, headRoom));
+  const tail = tailRoom > 0 ? content.slice(content.length - tailRoom) : "";
+  const result = `${head}
+\u2026(truncated ${name}: kept ${headRoom}+${tailRoom} chars of ${content.length})\u2026
+${tail}`;
+  return result.length <= maxChars ? result : result.slice(0, maxChars);
+}
+function projectBootstrapFiles(params) {
+  const {
+    files,
+    heading,
+    budget,
+    seenSignatures,
+    warningMode = "error",
+    warningMaxFiles = DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES
+  } = params;
+  const perFileCap = budget.bootstrapMaxChars;
+  let remainingTotal = budget.bootstrapTotalMaxChars;
+  const injectedFiles = [];
+  const parts = [];
+  for (const file of files) {
+    if (file.missing || typeof file.content !== "string") {
+      continue;
+    }
+    const raw = file.content.trimEnd();
+    if (raw.length === 0) {
+      continue;
+    }
+    const perFileAllowed = Math.min(perFileCap, remainingTotal);
+    if (perFileAllowed <= 0) {
+      break;
+    }
+    const injected = truncateContent(file.name, raw, perFileAllowed);
+    const relativePath = file.path;
+    injectedFiles.push({ path: relativePath, content: injected });
+    parts.push(`## ${relativePath}`);
+    parts.push(injected);
+    remainingTotal -= injected.length;
+    if (remainingTotal <= 0) {
+      break;
+    }
+  }
+  const concatenated = parts.length > 0 ? [heading.trim().length > 0 ? `# ${heading}` : null, ...parts].filter((p) => p !== null).join(`
+
+`) : "";
+  const stats = buildBootstrapInjectionStats({
+    bootstrapFiles: files,
+    injectedFiles
+  });
+  const analysis = analyzeBootstrapBudget({
+    files: stats,
+    bootstrapMaxChars: budget.bootstrapMaxChars,
+    bootstrapTotalMaxChars: budget.bootstrapTotalMaxChars,
+    nearLimitRatio: budget.nearLimitRatio ?? DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO
+  });
+  const warning = buildBootstrapPromptWarning({
+    analysis,
+    mode: warningMode,
+    seenSignatures,
+    maxFiles: warningMaxFiles
+  });
+  if (warningMode === "error" && analysis.hasTruncation) {
+    const errorLines = [
+      "Bootstrap budget exceeded. The following files exceed limits:",
+      ""
+    ];
+    for (const file of analysis.truncatedFiles) {
+      const excessChars = file.rawChars - file.injectedChars;
+      const causes = file.causes.map((c) => c === "per-file-limit" ? `per-file limit (${analysis.totals.bootstrapMaxChars.toLocaleString()} chars)` : `total limit (${analysis.totals.bootstrapTotalMaxChars.toLocaleString()} chars)`);
+      errorLines.push(`  ${file.name}: ${file.rawChars.toLocaleString()} bytes (exceeds ${causes.join(", ")})`);
+      errorLines.push(`    Trim ${excessChars.toLocaleString()} bytes, or pass --warning-mode warn to proceed with truncation.`);
+    }
+    throw new BootstrapBudgetExceededError(analysis, errorLines.join(`
+`));
+  }
+  return { files, injectedFiles, concatenated, analysis, warning };
+}
+async function buildStableBootstrapPrompt(params) {
+  const files = await loadStableBootstrapFiles(params.workspaceDir, {
+    extraStableFiles: params.extraStableFiles
+  });
+  const budget = {
+    bootstrapMaxChars: params.budget?.bootstrapMaxChars ?? DEFAULT_BOOTSTRAP_MAX_CHARS,
+    bootstrapTotalMaxChars: params.budget?.bootstrapTotalMaxChars ?? DEFAULT_BOOTSTRAP_TOTAL_MAX_CHARS,
+    nearLimitRatio: params.budget?.nearLimitRatio
+  };
+  return projectBootstrapFiles({
+    files,
+    heading: "Project Context (stable workspace files)",
+    budget,
+    seenSignatures: params.seenSignatures,
+    warningMode: params.budget?.warningMode,
+    warningMaxFiles: params.budget?.warningMaxFiles
+  });
+}
+async function buildDynamicBootstrapPrompt(params) {
+  const files = await loadDynamicBootstrapFiles(params.workspaceDir, {
+    now: params.now,
+    includeYesterday: params.includeYesterday
+  });
+  const budget = {
+    bootstrapMaxChars: params.budget?.bootstrapMaxChars ?? DEFAULT_BOOTSTRAP_MAX_CHARS,
+    bootstrapTotalMaxChars: params.budget?.bootstrapTotalMaxChars ?? DEFAULT_DYNAMIC_TOTAL_MAX_CHARS,
+    nearLimitRatio: params.budget?.nearLimitRatio
+  };
+  return projectBootstrapFiles({
+    files,
+    heading: "Project Context (dynamic workspace files)",
+    budget,
+    seenSignatures: params.seenSignatures,
+    warningMode: params.budget?.warningMode,
+    warningMaxFiles: params.budget?.warningMaxFiles
+  });
+}
+
+// src/cli/debug.ts
+init_merge();
+init_hindsight2();
+function formatBytes(bytes) {
+  return `${bytes.toLocaleString()} bytes`;
+}
+function estimateTokens(bytes) {
+  return Math.round(bytes / 3.7);
+}
+function readMcpServerNames(agentDir) {
+  const mcpPath = join88(agentDir, ".mcp.json");
+  if (!existsSync82(mcpPath))
+    return [];
+  try {
+    const parsed = JSON.parse(readFileSync74(mcpPath, "utf-8"));
+    return Object.keys(parsed.mcpServers ?? {});
+  } catch {
+    return null;
+  }
+}
+function sha2562(content) {
+  return createHash15("sha256").update(content).digest("hex").slice(0, 16);
+}
+function findLatestTranscriptJsonl(claudeConfigDir) {
+  const projectsDir = join88(claudeConfigDir, "projects");
+  if (!existsSync82(projectsDir))
+    return;
+  try {
+    const entries = readdirSync30(projectsDir, { withFileTypes: true });
+    let latest;
+    for (const entry of entries) {
+      if (!entry.isDirectory())
+        continue;
+      const projectPath = join88(projectsDir, entry.name);
+      const transcriptPath = join88(projectPath, "transcript.jsonl");
+      if (!existsSync82(transcriptPath))
+        continue;
+      const stat2 = statSync48(transcriptPath);
+      if (!latest || stat2.mtimeMs > latest.mtime) {
+        latest = { path: transcriptPath, mtime: stat2.mtimeMs };
+      }
+    }
+    return latest?.path;
+  } catch {
+    return;
+  }
+}
+function extractLatestUserMessage(transcriptPath) {
+  try {
+    const content = readFileSync74(transcriptPath, "utf-8");
+    const lines = content.trim().split(`
+`).filter(Boolean);
+    for (let i2 = lines.length - 1;i2 >= 0; i2--) {
+      const line = lines[i2];
+      try {
+        const event = JSON.parse(line);
+        if (event.type === "message" && event.role === "user" && typeof event.content === "string") {
+          const timestamp = event.timestamp ? new Date(event.timestamp).toLocaleString() : "unknown";
+          return { text: event.content, timestamp };
+        }
+      } catch {
+        continue;
+      }
+    }
+  } catch {
+    return;
+  }
+}
+function buildProgressUpdateGuidance() {
+  return `## Progress updates (human-style check-ins)
+
+You're talking to a human colleague on Telegram. Alongside the emoji status
+ladder, send a short \`progress_update\` at inflection points, the moments a
+senior colleague would ping the person who asked them to do something:
+
+- **Plan formed:** "Got it. Going to do X first, then Y, then Z."
+- **Pivot or blocker:** "First approach didn't work because <reason>. Trying
+  <alternative> instead."
+- **Chunk finished:** "Done with X. Starting Y now."
+
+Keep them short (one or two sentences). Don't narrate every step, the pinned
+progress card shows that for free. Don't send an update on a trivial one-shot
+task. Send them when a colleague would genuinely want to know what's happening.
+
+Final answers still go through \`reply\` as usual,
+\`progress_update\` is only for mid-turn check-ins.`;
+}
+function registerDebugCommand(program3) {
+  const cmd = program3.command("debug", { hidden: true }).description("Observability tools for inspecting agent prompt layering [advanced]");
+  cmd.command("turn <agent>").description("Dump the exact prompt layering the model saw on the most recent turn").option("--last <n>", "Show N-th most recent turn instead of latest", "1").action(withConfigError(async (agentName, opts) => {
+    const config = getConfig(program3);
+    const agentConfig = config.agents[agentName];
+    if (!agentConfig) {
+      console.error(`Agent '${agentName}' not found in switchroom.yaml`);
+      process.exit(1);
+    }
+    const agentsDir = resolveAgentsDir(config);
+    const agentDir = resolve43(agentsDir, agentName);
+    if (!existsSync82(agentDir)) {
+      console.error(`Agent directory not found: ${agentDir}`);
+      process.exit(1);
+    }
+    const workspaceDir = resolveAgentWorkspaceDir(agentDir);
+    const claudeConfigDir = join88(agentDir, ".claude");
+    const claudeMdPath2 = join88(agentDir, "CLAUDE.md");
+    const soulMdPath = join88(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join88(workspaceDir, "SOUL.md");
+    const handoffPath = join88(agentDir, ".handoff.md");
+    const lastN = parseInt(opts.last, 10);
+    if (isNaN(lastN) || lastN < 1) {
+      console.error("--last must be a positive integer");
+      process.exit(1);
+    }
+    if (lastN > 1) {
+      console.error("Note: --last N where N > 1 not yet implemented (only latest turn supported)");
+      process.exit(1);
+    }
+    console.log(`=== Debug Turn Dump: ${agentName} ===
+`);
+    console.log(`=== Append System Prompt (stable) ===
+`);
+    const resolved = resolveAgentConfig(config.defaults, config.profiles, agentConfig);
+    const useHotReloadStable = resolved.channels?.telegram?.hotReloadStable === true;
+    const stableResult = await buildStableBootstrapPrompt({
+      workspaceDir,
+      budget: { warningMode: "off" }
+    });
+    if (useHotReloadStable) {
+      console.log(`-- Workspace Stable Render (not used \u2014 stable content is in per-turn hook) --`);
+      console.log();
+    } else if (stableResult.concatenated.trim().length > 0) {
+      console.log(`-- Workspace Stable Render (${formatBytes(stableResult.concatenated.length)}) --`);
+      console.log(stableResult.concatenated);
+      console.log();
+    } else {
+      console.log("-- Workspace Stable Render (0 bytes, not set up) --");
+      console.log();
+    }
+    const useSwitchroomPlugin = usesSwitchroomTelegramPlugin(resolved);
+    const progressGuidance = useSwitchroomPlugin ? buildProgressUpdateGuidance() : "";
+    if (progressGuidance.length > 0) {
+      console.log(`-- Progress Updates Guidance (${formatBytes(progressGuidance.length)}) --`);
+      console.log(progressGuidance);
+      console.log();
+    }
+    const baseSystemPromptAppend = resolved.system_prompt_append ?? "";
+    if (baseSystemPromptAppend.trim().length > 0) {
+      console.log(`-- User System Prompt Append (${formatBytes(baseSystemPromptAppend.length)}) --`);
+      console.log(baseSystemPromptAppend);
+      console.log();
+    }
+    console.log(`=== Append System Prompt (per-session) ===
+`);
+    const handoffContent = existsSync82(handoffPath) ? readFileSync74(handoffPath, "utf-8") : "";
+    if (handoffContent.trim().length > 0) {
+      console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
+      console.log(handoffContent);
+      console.log();
+    } else {
+      console.log("-- Handoff Briefing (0 bytes, no prior session) --");
+      console.log();
+    }
+    console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
+`);
+    const claudeMdContent = existsSync82(claudeMdPath2) ? readFileSync74(claudeMdPath2, "utf-8") : "";
+    if (claudeMdContent.trim().length > 0) {
+      console.log(`(${formatBytes(claudeMdContent.length)})`);
+      console.log(claudeMdContent);
+      console.log();
+    } else {
+      console.log("(0 bytes, not present)");
+      console.log();
+    }
+    console.log(`=== Persona (SOUL.md) ===
+`);
+    const soulMdContent = existsSync82(soulMdPath) ? readFileSync74(soulMdPath, "utf-8") : existsSync82(workspaceSoulMdPath) ? readFileSync74(workspaceSoulMdPath, "utf-8") : "";
+    if (soulMdContent.trim().length > 0) {
+      console.log(`(${formatBytes(soulMdContent.length)})`);
+      console.log(soulMdContent);
+      console.log();
+    } else {
+      console.log("(0 bytes, stale placeholder \u2014 Phase 2 item: single source of truth for persona)");
+      console.log();
+    }
+    console.log(`=== Per-Turn Injections (UserPromptSubmit) ===
+`);
+    if (useHotReloadStable) {
+      if (stableResult.concatenated.trim().length > 0) {
+        console.log(`-- Workspace Stable (hot-reload hook): ${formatBytes(stableResult.concatenated.length)} --`);
+        console.log(stableResult.concatenated);
+        console.log();
+      } else {
+        console.log("-- Workspace Stable (hot-reload hook): 0 bytes, not set up --");
+        console.log();
+      }
+    }
+    const dynamicResult = await buildDynamicBootstrapPrompt({
+      workspaceDir,
+      budget: { warningMode: "off" }
+    });
+    if (dynamicResult.concatenated.trim().length > 0) {
+      console.log(`-- Workspace Dynamic: fired, ${formatBytes(dynamicResult.concatenated.length)} --`);
+      console.log(dynamicResult.concatenated);
+      console.log();
+    } else {
+      console.log("-- Workspace Dynamic: no content (MEMORY.md and daily notes empty or missing) --");
+      console.log();
+    }
+    const hindsightEnabled = isHindsightEnabled(config) && agentConfig.memory?.auto_recall !== false;
+    if (hindsightEnabled) {
+      console.log("-- Hindsight Recall: enabled (exact content unavailable, check hindsight logs) --");
+      console.log();
+    } else {
+      console.log("-- Hindsight Recall: disabled --");
+      console.log();
+    }
+    console.log(`=== User Message (latest turn) ===
+`);
+    const transcriptPath = findLatestTranscriptJsonl(claudeConfigDir);
+    const userMessage = transcriptPath ? extractLatestUserMessage(transcriptPath) : undefined;
+    if (userMessage) {
+      console.log(`(Turn timestamp: ${userMessage.timestamp})`);
+      console.log(userMessage.text);
+      console.log();
+    } else {
+      console.log("(unavailable: no transcript found or transcript empty)");
+      console.log();
+    }
+    console.log(`=== Totals ===
+`);
+    const stableBytes = stableResult.concatenated.length + progressGuidance.length + baseSystemPromptAppend.length;
+    const perSessionBytes = handoffContent.length;
+    const claudeMdBytes = claudeMdContent.length;
+    const soulMdBytes = soulMdContent.length;
+    const perTurnBytes = dynamicResult.concatenated.length;
+    const userBytes = userMessage?.text.length ?? 0;
+    const fleetDir = join88(agentsDir, "..", "fleet");
+    const fleetInvPath = join88(fleetDir, "switchroom-invariants.md");
+    const fleetClaudePath = join88(fleetDir, "CLAUDE.md");
+    const fleetInvBytes = existsSync82(fleetInvPath) ? readFileSync74(fleetInvPath, "utf-8").length : 0;
+    const fleetClaudeBytes = existsSync82(fleetClaudePath) ? readFileSync74(fleetClaudePath, "utf-8").length : 0;
+    const fleetBytes = fleetInvBytes + fleetClaudeBytes;
+    const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
+    console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
+    console.log(`Per-session:       ${formatBytes(perSessionBytes).padEnd(20)} (cache-warm until next session)`);
+    console.log(`CLAUDE.md (cwd):   ${formatBytes(claudeMdBytes).padEnd(20)} (cache-hot)`);
+    console.log(`Fleet invariants:  ${formatBytes(fleetBytes).padEnd(20)} (--add-dir, cache-hot)`);
+    console.log(`Per-turn:          ${formatBytes(perTurnBytes).padEnd(20)} (never cached \u2014 the real per-turn $ cost)`);
+    console.log(`User message:      ${formatBytes(userBytes).padEnd(20)}`);
+    console.log(`Authored text:     ${formatBytes(totalBytes).padEnd(20)} (~${estimateTokens(totalBytes).toLocaleString()} tokens est.)`);
+    const mcpServers = readMcpServerNames(agentDir);
+    const mcpCount = mcpServers?.length ?? null;
+    const mcpEstK = mcpCount != null ? mcpCount * 3 : null;
+    const mcpLabel = mcpCount != null ? `${mcpCount} servers` : "(unreadable \u2014 agent-private .mcp.json)";
+    const mcpEstLabel = mcpEstK != null ? `~${mcpEstK.toLocaleString()}k tok` : "~30k tok (audit est.)";
+    console.log(`MCP tool surface:  ${mcpLabel.padEnd(20)} (NOT counted above; ~3k tok/server \u2248 ${mcpEstLabel} \u2014 deferred under tool search)`);
+    if (mcpServers && mcpServers.length > 0) {
+      console.log(`                   [${mcpServers.join(", ")}]`);
+    }
+    const floorMcp = mcpEstK != null ? `~${mcpEstK.toLocaleString()}k` : "~30k";
+    console.log(`Per-turn FLOOR:    ${`~${estimateTokens(totalBytes).toLocaleString()} + ${floorMcp} MCP + ~13k CLI-base`.padEnd(20)} tokens est. (before the user msg, recall, or tool results)`);
+    const stableCacheInput = stableResult.concatenated + progressGuidance + baseSystemPromptAppend;
+    const stableHash = sha2562(stableCacheInput);
+    console.log(`Cache stable hash: sha256:${stableHash}`);
+    console.log();
+  }));
+}
+
+// src/memory/directive-residue.ts
+var RESIDUE_CATEGORIES = new Set([
+  "rules-block",
+  "reflect-directive"
+]);
+function renderInjectedLine(index, directive) {
+  const priority = directive.priority ?? 0;
+  const name = (directive.name ?? "").trim() || "(unnamed)";
+  const content = (directive.content ?? "").trim();
+  return `${index}. [P${priority}] ${name}: ${content}`;
+}
+function measureDirectiveResidue(agent, rows, directivesById) {
+  const residueRows = rows.filter((r) => r.isActive && RESIDUE_CATEGORIES.has(r.category));
+  const lines = residueRows.map((row, i2) => {
+    const directive = directivesById.get(row.id);
+    if (!directive) {
+      throw new Error(`measureDirectiveResidue: row '${row.name}' (id ${row.id}) has no ` + "matching directive in directivesById \u2014 pass the SAME list the " + "rows were built from.");
+    }
+    return renderInjectedLine(i2 + 1, directive);
+  });
+  const residueBytes = lines.reduce((sum, line) => sum + Buffer.byteLength(line, "utf8") + 1, 0);
+  return {
+    agent,
+    residueDirectiveCount: residueRows.length,
+    totalDirectiveCount: rows.length,
+    residueBytes,
+    residueTokensEstimate: estimateTokens(residueBytes)
+  };
+}
+
+// src/memory/directive-flip.ts
+init_rules_block();
+function evaluateFlipReadiness(measurement, opts) {
+  const reasons = [];
+  if (!opts.rulesBlockEnabled) {
+    reasons.push("memory.rules_block (M1) is not enabled \u2014 enable the rules-block " + "toolchain and migrate the directives into the block BEFORE flipping " + "inject_directives off (two-flag ordering; flipping first strips every " + "guardrail).");
+  }
+  if (measurement.residueBytes > RULES_BLOCK_BUDGET_BYTES) {
+    reasons.push(`directive residue is ${measurement.residueBytes}B, over the ` + `${RULES_BLOCK_BUDGET_BYTES}B rules-block budget (` + `${measurement.residueDirectiveCount} active residue directive(s)). ` + "Triage the directive set down \u2014 retire stale rules or shorten bodies \u2014 " + "until the residue fits, then re-check. The budget, not MAX_DIRECTIVES, " + "is the binding gate.");
+  }
+  return {
+    agent: measurement.agent,
+    ready: reasons.length === 0,
+    reasons,
+    residueBytes: measurement.residueBytes,
+    budgetBytes: RULES_BLOCK_BUDGET_BYTES,
+    residueDirectiveCount: measurement.residueDirectiveCount
+  };
+}
+async function measureLiveResidue(admin, agent) {
+  const directives = await admin.list();
+  const rows = buildDirectiveTriageRows(directives);
+  const byId = new Map(directives.map((d) => [d.id, d]));
+  return measureDirectiveResidue(agent, rows, byId);
+}
+function flipConfigStanza(agent) {
+  return [
+    `# ${agent} \u2014 Memory v2 M3 Surface-A flip (suppress <active_directives>)`,
+    "memory:",
+    "  rules_block: true        # M1 must already be on (checked)",
+    "  inject_directives: false # M3: stop re-injecting migrated directives"
+  ].join(`
+`);
+}
+
+// src/cli/memory-flip.ts
+function resolveFlipAdmin(program3, agent) {
+  const config = getConfig(program3);
+  if (!config.agents[agent]) {
+    console.error(source_default.red(`Agent "${agent}" is not defined in switchroom.yaml`));
+    process.exit(1);
+  }
+  if (!isHindsightEnabled(config)) {
+    console.error(source_default.red("Hindsight memory is not enabled in this switchroom.yaml."));
+    process.exit(1);
+  }
+  const agentConfig = config.agents[agent];
+  const mcpBaseUrl = config.memory?.config?.url ?? HINDSIGHT_DEFAULT_MCP_URL;
+  const apiBaseUrl = mcpBaseUrl.replace(/\/mcp\/?$/, "").replace(/\/+$/, "");
+  const bankId = agentConfig?.memory?.collection ?? agent;
+  return new DirectiveAdmin({ apiBaseUrl, bankId });
+}
+function readRulesBlockEnabled(program3, agent) {
+  const config = getConfig(program3);
+  return config.agents[agent]?.memory?.rules_block === true;
+}
+function buildFlipPreflightJson(readiness, rulesBlockEnabled) {
+  return {
+    ok: true,
+    agent: readiness.agent,
+    ready: readiness.ready,
+    rules_block: rulesBlockEnabled,
+    residue_bytes: readiness.residueBytes,
+    budget_bytes: readiness.budgetBytes,
+    fits_budget: readiness.residueBytes <= readiness.budgetBytes,
+    residue_directive_count: readiness.residueDirectiveCount,
+    reasons: readiness.reasons
+  };
+}
+function renderFlipPreflight(readiness, rulesBlockEnabled) {
+  const fits = readiness.residueBytes <= readiness.budgetBytes;
+  const lines = [];
+  const verdict = readiness.ready ? source_default.green("READY") : source_default.red("NOT-READY");
+  lines.push(`${verdict} \u2014 ${readiness.agent} M3 flip preflight`);
+  lines.push("");
+  lines.push(`  residue:      ${readiness.residueBytes}B / ${readiness.budgetBytes}B budget ` + `(${readiness.residueDirectiveCount} active residue directive(s)) ` + (fits ? source_default.green("fits") : source_default.red("OVER budget")));
+  lines.push(`  rules_block:  ${rulesBlockEnabled ? source_default.green("on") : source_default.red("off")}`);
+  if (readiness.ready) {
+    lines.push("");
+    lines.push("  Apply this per-agent stanza to switchroom.yaml, then restart:");
+    lines.push("");
+    for (const l of flipConfigStanza(readiness.agent).split(`
+`)) {
+      lines.push(`    ${l}`);
+    }
+  } else {
+    lines.push("");
+    lines.push(source_default.red("  Blocked:"));
+    for (const reason of readiness.reasons) {
+      lines.push(`    - ${reason}`);
+    }
+  }
+  return lines.join(`
+`);
+}
+function registerMemoryFlipCommand(memory, program3, deps = {}) {
+  const makeAdmin = deps.makeAdmin ?? resolveFlipAdmin;
+  memory.command("flip-preflight <agent>").description("Deterministic M3 (Surface-A) flip-readiness gate for <agent>: measure " + "the live post-triage directive residue, check it fits the 6144B " + "rules-block budget AND that memory.rules_block is already on, and " + "print READY + the exact switchroom.yaml stanza, or NOT-READY + why. " + "Never mutates config \u2014 the flip itself is an operator-gated edit.").option("--json", "Machine-readable output").action(withConfigError(async (agent, opts) => {
+    const admin = makeAdmin(program3, agent);
+    const rulesBlockEnabled = readRulesBlockEnabled(program3, agent);
+    let ready;
+    try {
+      const measurement = await measureLiveResidue(admin, agent);
+      const readiness = evaluateFlipReadiness(measurement, { rulesBlockEnabled });
+      ready = readiness.ready;
+      if (opts.json) {
+        console.log(JSON.stringify(buildFlipPreflightJson(readiness, rulesBlockEnabled)));
+      } else {
+        console.log(renderFlipPreflight(readiness, rulesBlockEnabled));
+      }
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      if (opts.json) {
+        console.log(JSON.stringify({ ok: false, error: msg }));
+      } else {
+        console.error(source_default.red(`\u2717 flip preflight for ${agent} failed: ${msg}`));
+      }
+      process.exit(1);
+      return;
+    }
+    if (!ready)
+      process.exit(2);
+  }));
+}
+
 // src/cli/memory.ts
 function persistMemoryConfigUrl(configPath, provider, url) {
-  if (!existsSync82(configPath))
+  if (!existsSync83(configPath))
     return false;
-  const raw = readFileSync74(configPath, "utf-8");
+  const raw = readFileSync75(configPath, "utf-8");
   const doc = import_yaml16.default.parseDocument(raw);
   if (!doc.has("memory")) {
     doc.set("memory", { backend: "hindsight", shared_collection: "shared", config: { provider, url } });
@@ -110468,7 +111470,7 @@ function persistMemoryConfigUrl(configPath, provider, url) {
   }
   let mode = 420;
   try {
-    mode = statSync48(configPath).mode & 511;
+    mode = statSync49(configPath).mode & 511;
   } catch {}
   writeConfigFileSync(configPath, doc.toString(), mode);
   return true;
@@ -110517,12 +111519,12 @@ async function resolveLiteLLMForHindsight(config) {
   return resolveHindsightLiteLlm(config);
 }
 function readRecallLog(agentDir, limit) {
-  const path7 = join88(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
-  if (!existsSync82(path7))
+  const path9 = join89(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
+  if (!existsSync83(path9))
     return [];
   let raw;
   try {
-    raw = readFileSync74(path7, "utf-8");
+    raw = readFileSync75(path9, "utf-8");
   } catch {
     return [];
   }
@@ -111286,9 +112288,9 @@ Repairing vector index coverage for ${target}${opts.dryRun ? source_default.yell
       captured += chunk2.toString();
       process.stdout.write(chunk2);
     });
-    const childExit = await new Promise((resolve43) => {
-      child.on("error", () => resolve43(127));
-      child.on("close", (c) => resolve43(c ?? 1));
+    const childExit = await new Promise((resolve44) => {
+      child.on("error", () => resolve44(127));
+      child.on("close", (c) => resolve44(c ?? 1));
     });
     const outcome = classifyRepairOutcome({
       childExit,
@@ -111313,7 +112315,7 @@ Repairing vector index coverage for ${target}${opts.dryRun ? source_default.yell
       process.exit(1);
     })() : Object.keys(config.agents);
     for (const name of targets) {
-      const agentDir = join88(agentsDir, name);
+      const agentDir = join89(agentsDir, name);
       const entries = readRecallLog(agentDir, limit);
       if (opts.json) {
         for (const e of entries) {
@@ -111506,11 +112508,12 @@ Observation-scope cleanup \u2014 DRY RUN (no writes)
   }));
   registerMemoryRuleCommand(memory, program3);
   registerMemoryDirectiveCommand(memory, program3);
+  registerMemoryFlipCommand(memory, program3);
 }
 
 // src/cli/web.ts
 init_source();
-import { join as join100 } from "node:path";
+import { join as join101 } from "node:path";
 import { homedir as homedir50 } from "node:os";
 
 // src/web/server.ts
@@ -111518,8 +112521,8 @@ init_merge();
 init_loader();
 init_client();
 import {
-  readFileSync as readFileSync82,
-  existsSync as existsSync90,
+  readFileSync as readFileSync83,
+  existsSync as existsSync91,
   realpathSync as realpathSync7,
   mkdirSync as mkdirSync50,
   openSync as openSync17,
@@ -111527,7 +112530,7 @@ import {
   writeSync as writeSync8,
   constants as fsConstants6
 } from "node:fs";
-import { resolve as resolve47, extname, join as join99, relative as relative5, dirname as dirname36 } from "node:path";
+import { resolve as resolve48, extname, join as join100, relative as relative5, dirname as dirname36 } from "node:path";
 import { homedir as homedir49 } from "node:os";
 import { timingSafeEqual as timingSafeEqual3, randomBytes as randomBytes15 } from "node:crypto";
 
@@ -111536,8 +112539,8 @@ init_lifecycle();
 init_manager();
 init_hindsight2();
 import { spawnSync as spawnSync17 } from "node:child_process";
-import { existsSync as existsSync86, readFileSync as readFileSync77, statSync as statSync51 } from "node:fs";
-import { resolve as resolve44, join as join95 } from "node:path";
+import { existsSync as existsSync87, readFileSync as readFileSync78, statSync as statSync52 } from "node:fs";
+import { resolve as resolve45, join as join96 } from "node:path";
 
 // src/web/memory-remediation.ts
 init_hindsight2();
@@ -111605,15 +112608,15 @@ async function buildUserProfile(mcpUrl, bank, opts) {
 init_hindsight();
 
 // src/web/blocked-approvals-read.ts
-import { readFileSync as readFileSync75, readdirSync as readdirSync30 } from "node:fs";
-import { resolve as resolve43, join as join89 } from "node:path";
+import { readFileSync as readFileSync76, readdirSync as readdirSync31 } from "node:fs";
+import { resolve as resolve44, join as join90 } from "node:path";
 import { homedir as homedir42 } from "node:os";
 function blockedApprovalsDir(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir42()) {
-  return resolve43(home2, ".switchroom", "blocked-approvals");
+  return resolve44(home2, ".switchroom", "blocked-approvals");
 }
 var FALLBACK_RECORD_NAME = "blocked-approval.json";
 function agentStateRoot(sharedDir) {
-  return resolve43(sharedDir, "..", "agents");
+  return resolve44(sharedDir, "..", "agents");
 }
 function finiteOrNull(v) {
   const n = Number(v);
@@ -111652,7 +112655,7 @@ function readBlockedApprovalsWithErrors(dir, agentsRoot = agentStateRoot(dir)) {
 function readSharedRecords(dir) {
   let entries;
   try {
-    entries = readdirSync30(dir);
+    entries = readdirSync31(dir);
   } catch (err) {
     if (err?.code === "ENOENT") {
       return { blocked: [], unreadable: 0 };
@@ -111666,7 +112669,7 @@ function readSharedRecords(dir) {
       continue;
     let text;
     try {
-      text = readFileSync75(join89(dir, name), "utf-8");
+      text = readFileSync76(join90(dir, name), "utf-8");
     } catch {
       unreadable++;
       continue;
@@ -111685,7 +112688,7 @@ function readSharedRecords(dir) {
 function readFallbackRecords(agentsRoot, alreadySeen) {
   let agents;
   try {
-    agents = readdirSync30(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    agents = readdirSync31(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch (err) {
     if (err?.code === "ENOENT") {
       return { blocked: [], unreadable: 0 };
@@ -111699,7 +112702,7 @@ function readFallbackRecords(agentsRoot, alreadySeen) {
       continue;
     let text;
     try {
-      text = readFileSync75(join89(agentsRoot, agent, FALLBACK_RECORD_NAME), "utf-8");
+      text = readFileSync76(join90(agentsRoot, agent, FALLBACK_RECORD_NAME), "utf-8");
     } catch (err) {
       if (err?.code !== "ENOENT")
         unreadable++;
@@ -111746,7 +112749,7 @@ init_audit_reader();
 // src/scheduler/dispatch.ts
 init_merge();
 init_overlay_loader();
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 function collectScheduleEntries(config) {
   const out = [];
   const agentNames = Object.keys(config.agents).sort();
@@ -111766,7 +112769,7 @@ function collectScheduleEntries(config) {
         cron: entry.cron,
         ...typeof title === "string" && title.length > 0 ? { name: title } : {},
         ...entry.prompt !== undefined ? { prompt: entry.prompt } : {},
-        promptKey: createHash15("sha256").update(auditMaterial).digest("hex").slice(0, 12),
+        promptKey: createHash16("sha256").update(auditMaterial).digest("hex").slice(0, 12),
         ...entry.topic !== undefined ? { topic: entry.topic } : {},
         ...entry.kind !== undefined ? { kind: entry.kind } : {},
         ...entry.model !== undefined ? { model: entry.model } : {},
@@ -111815,7 +112818,7 @@ import { homedir as homedir45 } from "node:os";
 // src/web/config-edit-plan.ts
 init_schema();
 var import_yaml17 = __toESM(require_dist(), 1);
-import { readFileSync as readFileSync76 } from "node:fs";
+import { readFileSync as readFileSync77 } from "node:fs";
 
 class ConfigPlanError extends Error {
 }
@@ -111825,7 +112828,7 @@ function composeTransforms(...transforms) {
 function planConfigEdit(configPath, transform) {
   let before;
   try {
-    before = readFileSync76(configPath, "utf-8");
+    before = readFileSync77(configPath, "utf-8");
   } catch (err) {
     throw new ConfigPlanError(`could not read config: ${err.message}`);
   }
@@ -111860,19 +112863,19 @@ import {
 } from "node:fs";
 import { spawnSync as spawnSync16 } from "node:child_process";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join91 } from "node:path";
+import { join as join92 } from "node:path";
 
 class ConfigDiffError extends Error {
 }
 function generateUnifiedDiff(before, after, name = "switchroom.yaml", gitBin = "git") {
   if (before === after)
     return "";
-  const dir = mkdtemp(join91(tmpdir5(), "switchroom-config-diff-"));
+  const dir = mkdtemp(join92(tmpdir5(), "switchroom-config-diff-"));
   try {
-    mkdirSync47(join91(dir, "cur"), { recursive: true });
-    mkdirSync47(join91(dir, "new"), { recursive: true });
-    writeFileSync32(join91(dir, "cur", name), before);
-    writeFileSync32(join91(dir, "new", name), after);
+    mkdirSync47(join92(dir, "cur"), { recursive: true });
+    mkdirSync47(join92(dir, "new"), { recursive: true });
+    writeFileSync32(join92(dir, "cur", name), before);
+    writeFileSync32(join92(dir, "new", name), after);
     const r = spawnSync16(gitBin, ["diff", "--no-index", "--no-color", "--", `cur/${name}`, `new/${name}`], { cwd: dir, encoding: "utf-8", timeout: 1e4 });
     if (r.status === 0)
       return "";
@@ -111904,9 +112907,9 @@ function generateUnifiedDiff(before, after, name = "switchroom.yaml", gitBin = "
 
 // src/web/hostd-config-propose.ts
 init_client5();
-import { existsSync as existsSync84 } from "node:fs";
+import { existsSync as existsSync85 } from "node:fs";
 import { homedir as homedir44 } from "node:os";
-import { join as join92 } from "node:path";
+import { join as join93 } from "node:path";
 var PROPOSE_TIMEOUT_MS = 61 * 60 * 1000;
 function resolveHostdOperatorSocket(env2 = process.env) {
   const override = env2.SWITCHROOM_HOSTD_OPERATOR_SOCKET;
@@ -111914,10 +112917,10 @@ function resolveHostdOperatorSocket(env2 = process.env) {
     return override;
   const candidates = [
     "/host-home/.switchroom/hostd/operator/sock",
-    join92(homedir44(), ".switchroom", "hostd", "operator", "sock")
+    join93(homedir44(), ".switchroom", "hostd", "operator", "sock")
   ];
   for (const c of candidates) {
-    if (existsSync84(c))
+    if (existsSync85(c))
       return c;
   }
   return null;
@@ -112125,7 +113128,7 @@ init_client2();
 
 // telegram-plugin/registry/turns-schema.ts
 import { chmodSync as chmodSync15 } from "fs";
-import { join as join94 } from "path";
+import { join as join95 } from "path";
 
 // src/util/state-owner.ts
 init_atomic();
@@ -112133,28 +113136,28 @@ import {
   appendFileSync as appendFileSync4,
   closeSync as closeSync16,
   constants as constants2,
-  existsSync as existsSync85,
+  existsSync as existsSync86,
   fchownSync as fchownSync2,
   fstatSync as fstatSync5,
   mkdirSync as mkdirSync48,
   openSync as openSync16,
-  readdirSync as readdirSync31,
-  statSync as statSync50,
+  readdirSync as readdirSync32,
+  statSync as statSync51,
   writeFileSync as writeFileSync33
 } from "node:fs";
-import { dirname as dirname35, join as join93, relative as relative4, sep as sep6 } from "node:path";
+import { dirname as dirname35, join as join94, relative as relative4, sep as sep6 } from "node:path";
 var NOFOLLOW = constants2.O_NOFOLLOW ?? 0;
 var ownerCache = new Map;
 var loggedFailure = false;
 function defaultLog(line) {
   process.stderr.write(line);
 }
-function noteFailure(op, path7, err, log) {
+function noteFailure(op, path9, err, log) {
   if (loggedFailure)
     return;
   loggedFailure = true;
   const code = err.code ?? "";
-  log(`switchroom state-owner: ${op} could not adopt directory ownership for ${path7}` + `${code ? ` (${code})` : ""}: ${err.message}. ` + `Continuing; state files may stay owned by the writing uid. ` + `Further ownership warnings this process are suppressed.
+  log(`switchroom state-owner: ${op} could not adopt directory ownership for ${path9}` + `${code ? ` (${code})` : ""}: ${err.message}. ` + `Continuing; state files may stay owned by the writing uid. ` + `Further ownership warnings this process are suppressed.
 `);
 }
 function isMultiplyLinked(st) {
@@ -112168,7 +113171,7 @@ function resolveStateOwner(dir) {
     return cached;
   let owner = null;
   try {
-    const st = statSync50(dir);
+    const st = statSync51(dir);
     owner = st.uid === 0 && st.gid === 0 ? null : { uid: st.uid, gid: st.gid };
   } catch {
     owner = null;
@@ -112176,13 +113179,13 @@ function resolveStateOwner(dir) {
   ownerCache.set(dir, owner);
   return owner;
 }
-function adoptStateOwnership(path7, owner, log = defaultLog) {
-  const target = owner === undefined ? resolveStateOwner(dirname35(path7)) : owner;
+function adoptStateOwnership(path9, owner, log = defaultLog) {
+  const target = owner === undefined ? resolveStateOwner(dirname35(path9)) : owner;
   if (!target)
     return;
   let fd = null;
   try {
-    fd = openSync16(path7, constants2.O_RDONLY | NOFOLLOW);
+    fd = openSync16(path9, constants2.O_RDONLY | NOFOLLOW);
     const st = fstatSync5(fd);
     if (st.uid === target.uid && st.gid === target.gid)
       return;
@@ -112191,7 +113194,7 @@ function adoptStateOwnership(path7, owner, log = defaultLog) {
     fchownSync2(fd, target.uid, target.gid);
   } catch (err) {
     if (err.code !== "ENOENT") {
-      noteFailure("adopt", path7, err, log);
+      noteFailure("adopt", path9, err, log);
     }
   } finally {
     if (fd !== null) {
@@ -112209,8 +113212,8 @@ function adoptSqliteOwnership(dbPath, log = defaultLog) {
     adoptStateOwnership(dbPath + suffix, owner, log);
   }
 }
-function mkdirStateSync(path7, options = { recursive: true }, log = defaultLog) {
-  const first = mkdirSync48(path7, { ...options, recursive: true });
+function mkdirStateSync(path9, options = { recursive: true }, log = defaultLog) {
+  const first = mkdirSync48(path9, { ...options, recursive: true });
   if (first === undefined)
     return;
   const owner = resolveStateOwner(dirname35(first));
@@ -112218,13 +113221,13 @@ function mkdirStateSync(path7, options = { recursive: true }, log = defaultLog)
     return;
   let current = first;
   adoptStateOwnership(current, owner, log);
-  const tail = relative4(first, path7);
+  const tail = relative4(first, path9);
   if (tail === "" || tail.startsWith(".."))
     return;
   for (const part of tail.split(sep6)) {
     if (part === "")
       continue;
-    current = join93(current, part);
+    current = join94(current, part);
     adoptStateOwnership(current, owner, log);
   }
 }
@@ -112301,20 +113304,20 @@ function applySchema(db) {
 }
 function openTurnsDb(agentDir) {
   const Database2 = loadDatabaseClass();
-  const dir = join94(agentDir, "telegram");
+  const dir = join95(agentDir, "telegram");
   mkdirStateSync(dir, { recursive: true, mode: 448 });
-  const path7 = join94(dir, "registry.db");
-  const db = new Database2(path7, { create: true });
+  const path9 = join95(dir, "registry.db");
+  const db = new Database2(path9, { create: true });
   applySchema(db);
   try {
-    chmodSync15(path7, 420);
+    chmodSync15(path9, 420);
     for (const suffix of ["-shm", "-wal"]) {
       try {
-        chmodSync15(path7 + suffix, 420);
+        chmodSync15(path9 + suffix, 420);
       } catch {}
     }
   } catch {}
-  adoptSqliteOwnership(path7);
+  adoptSqliteOwnership(path9);
   return db;
 }
 function mapRow(row) {
@@ -112516,7 +113519,7 @@ var DASHBOARD_CACHE_TTL = {
 };
 function readContextOccupancy(agentsDir, name) {
   try {
-    const raw = readFileSync77(resolve44(agentsDir, name, "context-occupancy.json"), "utf-8");
+    const raw = readFileSync78(resolve45(agentsDir, name, "context-occupancy.json"), "utf-8");
     const s = JSON.parse(raw);
     if (typeof s?.occupancy !== "number")
       return null;
@@ -112527,7 +113530,7 @@ function readContextOccupancy(agentsDir, name) {
 }
 function readLastTurnAt(agentsDir, name) {
   try {
-    const db = openTurnsDb(resolve44(agentsDir, name));
+    const db = openTurnsDb(resolve45(agentsDir, name));
     try {
       const turns = listTurnsForAgent(db, { limit: 1 });
       return turns.length > 0 ? turns[0].started_at : null;
@@ -112540,8 +113543,8 @@ function readLastTurnAt(agentsDir, name) {
 }
 function agentBridgeAlive(agentsDir, name, maxAgeMs = 30000, now2 = Date.now()) {
   try {
-    const f = resolve44(agentsDir, name, "telegram", ".bridge-alive");
-    return now2 - statSync51(f).mtimeMs <= maxAgeMs;
+    const f = resolve45(agentsDir, name, "telegram", ".bridge-alive");
+    return now2 - statSync52(f).mtimeMs <= maxAgeMs;
   } catch {
     return false;
   }
@@ -112639,7 +113642,7 @@ function handleGetTurns(config, sessionId, limit) {
     const agentName = parsed.agentName;
     const hasThread = "threadId" in parsed;
     const agentsDir = resolveAgentsDir(config);
-    const agentDir = resolve44(agentsDir, agentName);
+    const agentDir = resolve45(agentsDir, agentName);
     const chatId = config.agents?.[agentName]?.channels?.telegram?.chat_id ?? undefined;
     const db = openTurnsDb(agentDir);
     try {
@@ -112662,7 +113665,7 @@ function handleListThreadIds(config, agentName) {
     if (!chatId)
       return [];
     const agentsDir = resolveAgentsDir(config);
-    const db = openTurnsDb(resolve44(agentsDir, agentName));
+    const db = openTurnsDb(resolve45(agentsDir, agentName));
     try {
       return listDistinctThreadIds(db, chatId);
     } finally {
@@ -112675,7 +113678,7 @@ function handleListThreadIds(config, agentName) {
 function handleGetSubagents(config, agentName, status) {
   try {
     const agentsDir = resolveAgentsDir(config);
-    const agentDir = resolve44(agentsDir, agentName);
+    const agentDir = resolve45(agentsDir, agentName);
     const db = openTurnsDb(agentDir);
     try {
       applySubagentsSchema(db);
@@ -112932,7 +113935,7 @@ async function handleGetSystemHealth(config, home2) {
   };
   try {
     const logPath = defaultAuditLogPath2(home2);
-    if (existsSync86(logPath)) {
+    if (existsSync87(logPath)) {
       hostd.auditLogPresent = true;
       const raw = readAuditRaw(logPath);
       hostd.recent = readAndFilter(raw, {}, 1000).filter((e) => !HOSTD_NOISE_OPS.has(e.op)).slice(-10);
@@ -113241,7 +114244,7 @@ async function handleGetSchedule(config, deps = {}) {
   const recentByAgent = {};
   const agents = new Set(entries.map((e) => e.agent));
   for (const agent of agents) {
-    const rows = readRecentFires(resolve44(agentsDir, agent, "scheduler.jsonl"));
+    const rows = readRecentFires(resolve45(agentsDir, agent, "scheduler.jsonl"));
     if (rows.length > 0)
       recentByAgent[agent] = rows.slice(-10);
   }
@@ -113273,11 +114276,11 @@ async function handleGetApprovals() {
   return { reachable: true, decisions: sorted };
 }
 function brokerOperatorSocketPath(home2 = process.env.HOME || homedir45()) {
-  return join95(home2, ".switchroom", "broker-operator", "sock");
+  return join96(home2, ".switchroom", "broker-operator", "sock");
 }
 function resolveBrokerOperatorSocket(home2 = process.env.HOME || homedir45()) {
   const p = brokerOperatorSocketPath(home2);
-  return existsSync86(p) ? p : null;
+  return existsSync87(p) ? p : null;
 }
 async function handleGetGrants(deps = {}) {
   const socket = "socketPath" in deps ? deps.socketPath : resolveBrokerOperatorSocket();
@@ -113668,8 +114671,8 @@ async function handleGetSummary(deps, now2 = Date.now()) {
 init_fleet_health_read();
 
 // src/web/webhook-handler.ts
-import { appendFileSync as appendFileSync5, existsSync as existsSync88, mkdirSync as mkdirSync49, readFileSync as readFileSync80, writeFileSync as writeFileSync34 } from "fs";
-import { join as join97 } from "path";
+import { appendFileSync as appendFileSync5, existsSync as existsSync89, mkdirSync as mkdirSync49, readFileSync as readFileSync81, writeFileSync as writeFileSync34 } from "fs";
+import { join as join98 } from "path";
 import { homedir as homedir48 } from "os";
 
 // src/web/webhook-verify.ts
@@ -113837,7 +114840,7 @@ init_log_rotation();
 import net4 from "node:net";
 function forwardToGateway(socketPath, req, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 5000;
-  return new Promise((resolve46) => {
+  return new Promise((resolve47) => {
     let settled = false;
     let buf = "";
     const done = (value) => {
@@ -113847,7 +114850,7 @@ function forwardToGateway(socketPath, req, opts = {}) {
       try {
         conn.destroy();
       } catch {}
-      resolve46(value);
+      resolve47(value);
     };
     const conn = net4.createConnection(socketPath);
     conn.setEncoding("utf8");
@@ -113878,20 +114881,20 @@ function forwardToGateway(socketPath, req, opts = {}) {
 }
 
 // src/web/webhook-edge.ts
-import { existsSync as existsSync87, readFileSync as readFileSync79 } from "fs";
-import { join as join96 } from "path";
+import { existsSync as existsSync88, readFileSync as readFileSync80 } from "fs";
+import { join as join97 } from "path";
 import { homedir as homedir47 } from "os";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var EDGE_HEADER = "x-switchroom-edge";
 function edgeSecretPath() {
-  return join96(homedir47(), ".switchroom", "webhook-edge-secret");
+  return join97(homedir47(), ".switchroom", "webhook-edge-secret");
 }
-function loadEdgeSecret(path7) {
-  const p = path7 ?? edgeSecretPath();
+function loadEdgeSecret(path9) {
+  const p = path9 ?? edgeSecretPath();
   try {
-    if (!existsSync87(p))
+    if (!existsSync88(p))
       return null;
-    const raw = readFileSync79(p, "utf-8").trim();
+    const raw = readFileSync80(p, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -113940,17 +114943,17 @@ function jsonReply(status, body, extraHeaders) {
 }
 var DEDUP_MAX = 1000;
 var DEDUP_TTL_MS = 24 * 60 * 60 * 1000;
-function loadDedupFile(path7) {
+function loadDedupFile(path9) {
   try {
-    if (!existsSync88(path7))
+    if (!existsSync89(path9))
       return {};
-    const raw = JSON.parse(readFileSync80(path7, "utf-8"));
+    const raw = JSON.parse(readFileSync81(path9, "utf-8"));
     return typeof raw.deliveries === "object" && raw.deliveries !== null ? raw.deliveries : {};
   } catch {
     return {};
   }
 }
-function saveDedupFile(path7, deliveries, now2) {
+function saveDedupFile(path9, deliveries, now2) {
   const pruned = {};
   for (const [id, ts] of Object.entries(deliveries)) {
     if (now2 - ts < DEDUP_TTL_MS)
@@ -113958,7 +114961,7 @@ function saveDedupFile(path7, deliveries, now2) {
   }
   const sorted = Object.entries(pruned).sort((a, b) => b[1] - a[1]).slice(0, DEDUP_MAX);
   const final = Object.fromEntries(sorted);
-  writeFileSync34(path7, JSON.stringify({ deliveries: final }), {
+  writeFileSync34(path9, JSON.stringify({ deliveries: final }), {
     mode: 384
   });
 }
@@ -113966,8 +114969,8 @@ var agentDedupCache = new Map;
 function createFileDedupStore(resolveAgentDir2) {
   return {
     check(agent, deliveryId, now2) {
-      const telegramDir = join97(resolveAgentDir2(agent), "telegram");
-      const filePath = join97(telegramDir, "webhook-dedup.json");
+      const telegramDir = join98(resolveAgentDir2(agent), "telegram");
+      const filePath = join98(telegramDir, "webhook-dedup.json");
       if (!agentDedupCache.has(agent)) {
         agentDedupCache.set(agent, loadDedupFile(filePath));
       }
@@ -114019,7 +115022,7 @@ function shouldWriteThrottleIssue(agent, source, now2, windowMap) {
   return true;
 }
 function writeThrottleIssue(agent, source, now2, telegramDir, log) {
-  const issuesPath = join97(telegramDir, "issues.jsonl");
+  const issuesPath = join98(telegramDir, "issues.jsonl");
   try {
     mkdirSync49(telegramDir, { recursive: true });
     const record = {
@@ -114044,7 +115047,7 @@ function writeThrottleIssue(agent, source, now2, telegramDir, log) {
 async function handleWebhookIngest(args, deps = {}) {
   const log = deps.log ?? ((s) => process.stderr.write(s));
   const now2 = (deps.now ?? Date.now)();
-  const resolveAgentDir2 = deps.resolveAgentDir ?? ((a) => join97(homedir48(), ".switchroom", "agents", a));
+  const resolveAgentDir2 = deps.resolveAgentDir ?? ((a) => join98(homedir48(), ".switchroom", "agents", a));
   const rateLimiter = deps.rateLimiter ?? defaultRateLimiter;
   const dedupStore = deps.dedupStore ?? createFileDedupStore(resolveAgentDir2);
   if (!args.agentExists) {
@@ -114111,7 +115114,7 @@ async function handleWebhookIngest(args, deps = {}) {
   if (retryAfter !== null) {
     if (!args.viaGateway) {
       const agentDir2 = resolveAgentDir2(args.agent);
-      const telegramDir2 = join97(agentDir2, "telegram");
+      const telegramDir2 = join98(agentDir2, "telegram");
       if (shouldWriteThrottleIssue(args.agent, source, now2)) {
         writeThrottleIssue(args.agent, source, now2, telegramDir2, log);
       }
@@ -114131,7 +115134,7 @@ async function handleWebhookIngest(args, deps = {}) {
   const eventType = source === "github" ? args.headers.get("x-github-event") ?? "unknown" : source === "linear" ? String(payload.type ?? "unknown").toLowerCase() : args.source;
   const rendered = source === "github" ? renderGithubEvent(eventType, payload) : source === "linear" ? renderLinearEvent(eventType, payload) : renderGenericEvent(args.source, payload);
   if (args.viaGateway) {
-    const socketPath = join97(resolveAgentDir2(args.agent), "telegram", "webhook.sock");
+    const socketPath = join98(resolveAgentDir2(args.agent), "telegram", "webhook.sock");
     const forward = deps.forwardFn ?? forwardToGateway;
     const deliveryId = source === "github" ? args.headers.get("x-github-delivery") ?? undefined : undefined;
     let resp;
@@ -114170,8 +115173,8 @@ async function handleWebhookIngest(args, deps = {}) {
     return jsonReply(202, { ok: true, recorded: true, ts: resp.ts });
   }
   const agentDir = resolveAgentDir2(args.agent);
-  const telegramDir = join97(agentDir, "telegram");
-  const logPath = join97(telegramDir, "webhook-events.jsonl");
+  const telegramDir = join98(agentDir, "telegram");
+  const logPath = join98(telegramDir, "webhook-events.jsonl");
   try {
     mkdirSync49(telegramDir, { recursive: true });
     rotateWebhookLogIfNeeded(logPath);
@@ -114200,9 +115203,9 @@ init_shipped_assets();
 // src/web/hermes-adapter.ts
 init_loader();
 import { createConnection as createConnection3 } from "node:net";
-import { createHash as createHash16 } from "node:crypto";
-import { join as join98, resolve as resolve46 } from "node:path";
-import { existsSync as existsSync89, readFileSync as readFileSync81 } from "node:fs";
+import { createHash as createHash17 } from "node:crypto";
+import { join as join99, resolve as resolve47 } from "node:path";
+import { existsSync as existsSync90, readFileSync as readFileSync82 } from "node:fs";
 
 // src/agent-scheduler/channel-target.ts
 init_merge();
@@ -114246,8 +115249,8 @@ function agentLiveness(config, agentName) {
   const agentsDir = resolveAgentsDir(config);
   if (agentBridgeAlive(agentsDir, agentName))
     return "active";
-  const alive = join98(agentsDir, agentName, "telegram", ".bridge-alive");
-  if (existsSync89(alive))
+  const alive = join99(agentsDir, agentName, "telegram", ".bridge-alive");
+  if (existsSync90(alive))
     return "idle";
   return "offline";
 }
@@ -114355,11 +115358,11 @@ function resolveAgentChat(config, sessionId, agentsDir) {
     const threadId = topicId !== undefined ? topicId === null ? undefined : parseInt(topicId, 10) || undefined : channel.threadId;
     return { chatId: channel.chatId, threadId };
   }
-  const accessPath = resolve46(agentsDir, agentName, "telegram", "access.json");
-  if (!existsSync89(accessPath))
+  const accessPath = resolve47(agentsDir, agentName, "telegram", "access.json");
+  if (!existsSync90(accessPath))
     return null;
   try {
-    const raw = readFileSync81(accessPath, "utf-8");
+    const raw = readFileSync82(accessPath, "utf-8");
     const access = JSON.parse(raw);
     const chatId = access.allowFrom?.[0];
     if (!chatId)
@@ -114370,8 +115373,8 @@ function resolveAgentChat(config, sessionId, agentsDir) {
   }
 }
 async function injectInbound(agentsDir, agentName, chatId, threadId, text, promptKey) {
-  const socketPath = resolve46(agentsDir, agentName, "telegram", "gateway.sock");
-  if (!existsSync89(socketPath)) {
+  const socketPath = resolve47(agentsDir, agentName, "telegram", "gateway.sock");
+  if (!existsSync90(socketPath)) {
     return { ok: false, error: `agent ${agentName} gateway socket not found \u2014 is it running?` };
   }
   const ts = Date.now();
@@ -114418,8 +115421,8 @@ async function injectInbound(agentsDir, agentName, chatId, threadId, text, promp
   });
 }
 function readHistoryDb(agentsDir, agentName, limit) {
-  const dbPath = resolve46(agentsDir, agentName, "telegram", "history.db");
-  if (!existsSync89(dbPath))
+  const dbPath = resolve47(agentsDir, agentName, "telegram", "history.db");
+  if (!existsSync90(dbPath))
     return null;
   try {
     let SqliteDatabase;
@@ -114448,7 +115451,7 @@ function readHistoryDb(agentsDir, agentName, limit) {
   }
 }
 function startHistoryPoll(ctx, agentsDir, agentName, sessionId, pollIntervalMs = 2000) {
-  const dbPath = resolve46(agentsDir, agentName, "telegram", "history.db");
+  const dbPath = resolve47(agentsDir, agentName, "telegram", "history.db");
   let SqliteDatabase = null;
   try {
     const meta = import.meta;
@@ -114458,7 +115461,7 @@ function startHistoryPoll(ctx, agentsDir, agentName, sessionId, pollIntervalMs =
     }
   } catch {}
   let cursor = 0;
-  if (SqliteDatabase && existsSync89(dbPath)) {
+  if (SqliteDatabase && existsSync90(dbPath)) {
     try {
       const db = new SqliteDatabase(dbPath, { readonly: true });
       try {
@@ -114470,7 +115473,7 @@ function startHistoryPoll(ctx, agentsDir, agentName, sessionId, pollIntervalMs =
     } catch {}
   }
   const timer = setInterval(() => {
-    if (!SqliteDatabase || !existsSync89(dbPath))
+    if (!SqliteDatabase || !existsSync90(dbPath))
       return;
     try {
       const db = new SqliteDatabase(dbPath, { readonly: true });
@@ -115133,7 +116136,7 @@ async function onHermesMessage(ctx, raw) {
         sendResponse(ctx, rpcErr(id, -32603, `Could not resolve chat for ${sessionId} \u2014 ensure the agent has telegram.forum_chat_id or channels.telegram.chat_id configured.`));
         break;
       }
-      const promptKey = createHash16("sha256").update(`${sessionId}:${Date.now()}:${content}`).digest("hex").slice(0, 12);
+      const promptKey = createHash17("sha256").update(`${sessionId}:${Date.now()}:${content}`).digest("hex").slice(0, 12);
       sendEvent(ctx, "message.start", sessionId, { prompt_key: promptKey });
       pendingPromptKeys(ctx).set(sessionId, promptKey);
       const result = await injectInbound(agentsDir, submitAgent, chat.chatId, chat.threadId, content, promptKey);
@@ -115329,9 +116332,9 @@ function resolveWebToken() {
   if (fromEnv && fromEnv.length > 0)
     return fromEnv;
   const home2 = process.env.HOME ?? homedir49();
-  const tokenPath = join99(home2, ".switchroom", "web-token");
-  if (existsSync90(tokenPath)) {
-    const existing = readFileSync82(tokenPath, "utf8").trim();
+  const tokenPath = join100(home2, ".switchroom", "web-token");
+  if (existsSync91(tokenPath)) {
+    const existing = readFileSync83(tokenPath, "utf8").trim();
     if (existing.length > 0)
       return existing;
   }
@@ -115348,7 +116351,7 @@ function resolveWebToken() {
     return token;
   } catch (err) {
     if (err.code === "EEXIST") {
-      const existing = readFileSync82(tokenPath, "utf8").trim();
+      const existing = readFileSync83(tokenPath, "utf8").trim();
       if (existing.length > 0)
         return existing;
     }
@@ -115421,14 +116424,14 @@ function checkWsAuth(req, token, server) {
   return presented !== null && constantTimeEqual(presented, token);
 }
 function loadWebhookSecrets() {
-  const path7 = join99(homedir49(), ".switchroom", "webhook-secrets.json");
-  if (!existsSync90(path7))
+  const path9 = join100(homedir49(), ".switchroom", "webhook-secrets.json");
+  if (!existsSync91(path9))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync82(path7, "utf-8"));
+    const parsed = JSON.parse(readFileSync83(path9, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (err) {
-    process.stderr.write(`webhook-ingest: failed to parse ${path7}: ${err.message} \u2014 webhooks will return 401 until fixed
+    process.stderr.write(`webhook-ingest: failed to parse ${path9}: ${err.message} \u2014 webhooks will return 401 until fixed
 `);
     return {};
   }
@@ -115615,11 +116618,11 @@ function resolveUiDir(probe2 = {
   bundleDir: import.meta.dirname,
   execPath: process.execPath
 }) {
-  return resolveShippedAsset(WEB_UI_ASSET, probe2).path ?? resolve47(probe2.bundleDir, WEB_UI_ASSET.asset);
+  return resolveShippedAsset(WEB_UI_ASSET, probe2).path ?? resolve48(probe2.bundleDir, WEB_UI_ASSET.asset);
 }
 function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
   const uiDirRaw = resolveUiDir();
-  const uiDir = existsSync90(uiDirRaw) ? realpathSync7(uiDirRaw) : uiDirRaw;
+  const uiDir = existsSync91(uiDirRaw) ? realpathSync7(uiDirRaw) : uiDirRaw;
   const token = resolveWebToken();
   const freshConfig = () => {
     if (!configPath)
@@ -115919,8 +116922,8 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         })();
       }
       const filePath = resolveDashboardFilePath(pathname);
-      const fullPath = join99(uiDir, filePath);
-      if (!existsSync90(fullPath)) {
+      const fullPath = join100(uiDir, filePath);
+      if (!existsSync91(fullPath)) {
         return new Response("Not Found", { status: 404 });
       }
       let realFullPath;
@@ -115930,12 +116933,12 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         return new Response("Not Found", { status: 404 });
       }
       const rel = relative5(uiDir, realFullPath);
-      if (rel.startsWith("..") || resolve47(uiDir, rel) !== realFullPath) {
+      if (rel.startsWith("..") || resolve48(uiDir, rel) !== realFullPath) {
         return new Response("Forbidden", { status: 403 });
       }
       const ext = extname(realFullPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
-      const content = readFileSync82(realFullPath);
+      const content = readFileSync83(realFullPath);
       const headers = { "Content-Type": contentType };
       const cacheControl = dashboardCacheControl(ext);
       if (cacheControl)
@@ -116058,13 +117061,13 @@ init_helpers();
 init_loader();
 
 // src/web/startup-guard.ts
-import { existsSync as existsSync91, readFileSync as readFileSync83, writeFileSync as writeFileSync35, mkdirSync as mkdirSync51, statSync as statSync52, unlinkSync as unlinkSync18 } from "node:fs";
+import { existsSync as existsSync92, readFileSync as readFileSync84, writeFileSync as writeFileSync35, mkdirSync as mkdirSync51, statSync as statSync53, unlinkSync as unlinkSync18 } from "node:fs";
 import { dirname as dirname37 } from "node:path";
 function detectConfigMountFault(configPath, deps = {}) {
-  const stat = deps.stat ?? ((p) => statSync52(p));
+  const stat2 = deps.stat ?? ((p) => statSync53(p));
   let st;
   try {
-    st = stat(configPath);
+    st = stat2(configPath);
   } catch {
     return null;
   }
@@ -116094,9 +117097,9 @@ function nextCrashBackoff(prior, now2, options = {}) {
 }
 function readCrashState(statePath) {
   try {
-    if (!existsSync91(statePath))
+    if (!existsSync92(statePath))
       return null;
-    const raw = JSON.parse(readFileSync83(statePath, "utf-8"));
+    const raw = JSON.parse(readFileSync84(statePath, "utf-8"));
     if (typeof raw.count !== "number" || typeof raw.lastTs !== "number")
       return null;
     return { count: raw.count, lastTs: raw.lastTs };
@@ -116112,7 +117115,7 @@ function writeCrashState(statePath, state) {
 }
 function clearCrashState(statePath) {
   try {
-    if (existsSync91(statePath))
+    if (existsSync92(statePath))
       unlinkSync18(statePath);
   } catch {}
 }
@@ -116135,7 +117138,7 @@ async function handleWebStartupFailure(err, configPath, stateFile) {
   throw err;
 }
 function webCrashStatePath() {
-  return join100(homedir50(), ".switchroom", "web", ".crashloop-state.json");
+  return join101(homedir50(), ".switchroom", "web", ".crashloop-state.json");
 }
 function registerWebCommand(program3) {
   program3.command("web").description("Start the web dashboard for monitoring agents").option("-p, --port <port>", "Port to listen on", "8080").option("-b, --bind <host>", "Host/IP to bind to (default: 127.0.0.1, localhost-only)", "127.0.0.1").action(withConfigError(async (opts) => {
@@ -116202,9 +117205,9 @@ init_embedded_examples();
 init_atomic();
 init_loader();
 init_scaffold();
-import { existsSync as existsSync93, readFileSync as readFileSync84, mkdirSync as mkdirSync52, statSync as statSync53, writeFileSync as writeFileSync36 } from "node:fs";
+import { existsSync as existsSync94, readFileSync as readFileSync85, mkdirSync as mkdirSync52, statSync as statSync54, writeFileSync as writeFileSync36 } from "node:fs";
 import { execFileSync as execFileSync29 } from "node:child_process";
-import { resolve as resolve48, dirname as dirname38 } from "node:path";
+import { resolve as resolve49, dirname as dirname38 } from "node:path";
 init_state();
 init_vault();
 init_manager();
@@ -116619,7 +117622,7 @@ ${status} ${source_default.bold(`Step ${num3}:`)} ${title}`);
 init_source();
 init_loader();
 init_hindsight();
-import { existsSync as existsSync92 } from "node:fs";
+import { existsSync as existsSync93 } from "node:fs";
 var HINDSIGHT_READY_RETRIES = 5;
 var HINDSIGHT_READY_INTERVAL_MS = 1000;
 async function resolveLiteLLMForHindsight2(config, deps = {}) {
@@ -116656,7 +117659,7 @@ async function stepMemoryBackend(config, nonInteractive, switchroomConfigPath, d
   try {
     const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
     const passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
-    if (passphrase && existsSync92(vaultPath)) {
+    if (passphrase && existsSync93(vaultPath)) {
       const { getStringSecret: getStringSecret2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
       const existing = getStringSecret2(passphrase, vaultPath, "hindsight-api-key");
       if (existing) {
@@ -116926,7 +117929,7 @@ async function stepMemoryBackend(config, nonInteractive, switchroomConfigPath, d
 function writeSwitchroomYaml(configPath, text) {
   let mode = 420;
   try {
-    mode = statSync53(configPath).mode & 511;
+    mode = statSync54(configPath).mode & 511;
   } catch {}
   writeConfigFileSync(configPath, text, mode);
 }
@@ -117025,7 +118028,7 @@ async function stepConfigFile(configPath, nonInteractive) {
       existingConfig = null;
     }
   }
-  if (existingConfig && existsSync93(existingConfig)) {
+  if (existingConfig && existsSync94(existingConfig)) {
     if (!nonInteractive) {
       const useExisting = await askYesNo(`  Found ${source_default.cyan(existingConfig)}. Use it?`, true);
       if (!useExisting) {
@@ -117037,9 +118040,9 @@ async function stepConfigFile(configPath, nonInteractive) {
     console.log(source_default.green(`  ${STEP_DONE} Config loaded`) + source_default.gray(` (${Object.keys(config.agents).length} agents)`));
     const hasExplicitTimezone = config.switchroom?.timezone !== undefined || config.defaults?.timezone !== undefined;
     if (!hasExplicitTimezone) {
-      await writeDetectedTimezone(resolve48(existingConfig), nonInteractive);
+      await writeDetectedTimezone(resolve49(existingConfig), nonInteractive);
     }
-    return { config, configPath: resolve48(existingConfig) };
+    return { config, configPath: resolve49(existingConfig) };
   }
   return await copyExampleConfig2(nonInteractive);
 }
@@ -117066,12 +118069,12 @@ async function copyExampleConfig2(nonInteractive) {
   await writeDetectedTimezone(destFile, nonInteractive);
   const config = loadConfig(destFile);
   console.log(source_default.green(`  ${STEP_DONE} Config loaded`) + source_default.gray(` (${Object.keys(config.agents).length} agents)`));
-  return { config, configPath: resolve48(destFile) };
+  return { config, configPath: resolve49(destFile) };
 }
 async function writeDetectedTimezone(destFile, nonInteractive, detect = detectServerTimezone, prompt = ask) {
   const detected = detect();
   if (detected !== undefined && detected !== "UTC" && isValidTimezone(detected)) {
-    const before2 = readFileSync84(destFile, "utf-8");
+    const before2 = readFileSync85(destFile, "utf-8");
     const after2 = setSwitchroomTimezone(before2, detected);
     if (after2 !== before2)
       writeSwitchroomYaml(destFile, after2);
@@ -117092,7 +118095,7 @@ async function writeDetectedTimezone(destFile, nonInteractive, detect = detectSe
     console.error(source_default.yellow(`  \u26a0 "${zone}" is not a valid IANA zone (expected Region/City like ` + '"Australia/Melbourne"). Skipping \u2014 agents will use UTC. ' + "Edit switchroom.timezone in switchroom.yaml by hand."));
     return;
   }
-  const before = readFileSync84(destFile, "utf-8");
+  const before = readFileSync85(destFile, "utf-8");
   const after = setSwitchroomTimezone(before, zone);
   if (after !== before)
     writeSwitchroomYaml(destFile, after);
@@ -117171,7 +118174,7 @@ async function resolveOrPromptToken(rawToken, label, config, nonInteractive) {
       try {
         const { openVault: openVault2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
         const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-        if (existsSync93(vaultPath)) {
+        if (existsSync94(vaultPath)) {
           const secrets = openVault2(passphrase, vaultPath);
           const key = rawToken.replace("vault:", "");
           const entry = secrets[key];
@@ -117199,7 +118202,7 @@ async function resolveOrPromptToken(rawToken, label, config, nonInteractive) {
 async function storeTokenInVault(config, vaultRef, token) {
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
   const key = vaultRef.replace("vault:", "");
-  if (!existsSync93(vaultPath)) {
+  if (!existsSync94(vaultPath)) {
     console.log(source_default.gray("  Creating encrypted vault..."));
     let passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
     if (!passphrase) {
@@ -117482,13 +118485,13 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
     return;
   }
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (!existsSync93(vaultPath)) {
+  if (!existsSync94(vaultPath)) {
     console.log(source_default.gray("  Skipping (vault not created yet)."));
     return;
   }
   const credPathRaw = config.vault?.broker?.autoUnlockCredentialPath ?? "~/.switchroom/vault-auto-unlock";
   const credPath = resolvePath(credPathRaw);
-  if (config.vault?.broker?.autoUnlock === true && existsSync93(credPath)) {
+  if (config.vault?.broker?.autoUnlock === true && existsSync94(credPath)) {
     console.log(source_default.green(`  ${STEP_DONE} Already configured (${credPath})`));
     return;
   }
@@ -117566,10 +118569,10 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
   }
 }
 function persistApprovalAuthTelegramId(configPath) {
-  if (!existsSync93(configPath)) {
+  if (!existsSync94(configPath)) {
     throw new ConfigError(`Cannot persist vault.broker.approvalAuth: config not found at ${configPath}`);
   }
-  const content = readFileSync84(configPath, "utf-8");
+  const content = readFileSync85(configPath, "utf-8");
   const result = insertVaultBrokerApprovalAuth(content, "telegram-id");
   if (result.kind === "rewritten") {
     writeSwitchroomYaml(configPath, result.content);
@@ -117577,10 +118580,10 @@ function persistApprovalAuthTelegramId(configPath) {
   return result.kind;
 }
 function persistDangerousMode(config, configPath) {
-  if (!existsSync93(configPath)) {
+  if (!existsSync94(configPath)) {
     throw new ConfigError(`Cannot persist dangerous_mode: config not found at ${configPath}`);
   }
-  let content = readFileSync84(configPath, "utf-8");
+  let content = readFileSync85(configPath, "utf-8");
   const agentNames = Object.keys(config.agents);
   for (const name of agentNames) {
     const agentPattern = new RegExp(`(^  ${name}:\\s*\\n)`, "m");
@@ -117620,7 +118623,7 @@ async function stepOnboardingGuidance(config, nonInteractive) {
   const agentNames = Object.keys(config.agents);
   let allAuthenticated = true;
   for (const name of agentNames) {
-    const agentDir = resolve48(agentsDir, name);
+    const agentDir = resolve49(agentsDir, name);
     const status = getAuthStatus(name, agentDir);
     if (status.authenticated) {
       console.log(`  ${source_default.green("OK")} ${source_default.bold(name)}` + source_default.gray(` - authenticated (expires: ${status.timeUntilExpiry ?? "unknown"})`));
@@ -117716,7 +118719,7 @@ async function stepVerification(config, nonInteractive, deps = {}, expect = {})
   const findings = [];
   let applyPending = false;
   if (!nonInteractive && agentNames.length > 0) {
-    const composeExists = (deps.composeFileExists ?? (() => existsSync93(composeFilePath())))();
+    const composeExists = (deps.composeFileExists ?? (() => existsSync94(composeFilePath())))();
     if (!composeExists) {
       applyPending = true;
       log(source_default.gray("  Not started: `switchroom apply` has not generated the compose file yet."));
@@ -117813,9 +118816,9 @@ init_source();
 init_loader();
 init_lifecycle();
 init_compose_env();
-import { existsSync as existsSync97, mkdirSync as mkdirSync56, readFileSync as readFileSync88, realpathSync as realpathSync8, statSync as statSync56, chownSync as chownSync13 } from "node:fs";
+import { existsSync as existsSync98, mkdirSync as mkdirSync56, readFileSync as readFileSync89, realpathSync as realpathSync8, statSync as statSync57, chownSync as chownSync13 } from "node:fs";
 import { spawnSync as spawnSync20 } from "node:child_process";
-import { join as join101, dirname as dirname42 } from "node:path";
+import { join as join102, dirname as dirname42 } from "node:path";
 import { homedir as homedir51 } from "node:os";
 
 // src/cli/release-yaml.ts
@@ -117876,7 +118879,7 @@ init_operator_uid();
 init_atomic();
 
 // src/cli/preflight-mounts.ts
-import { statSync as statSync54 } from "node:fs";
+import { statSync as statSync55 } from "node:fs";
 function parseHostBindSources(composeText) {
   const out = [];
   const FILE_HINT = /\.(ya?ml|db|log|toml|json|token|id)$|\/\.vault-token$|machine-id$|localtime$|vault-auto-unlock$|\/webkite$/;
@@ -117903,7 +118906,7 @@ function parseHostBindSources(composeText) {
   return out;
 }
 function validateBindSources(composeText, deps = {}) {
-  const stat = deps.stat ?? ((p) => statSync54(p));
+  const stat2 = deps.stat ?? ((p) => statSync55(p));
   const sources = parseHostBindSources(composeText);
   const issues = [];
   const seen = new Set;
@@ -117915,7 +118918,7 @@ function validateBindSources(composeText, deps = {}) {
     checked++;
     let st = null;
     try {
-      st = stat(source);
+      st = stat2(source);
     } catch {
       st = null;
     }
@@ -117949,18 +118952,18 @@ init_self_update();
 init_shipped_assets();
 
 // src/cli/self-update-io.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 import {
   chmodSync as chmodSync16,
   closeSync as closeSync18,
   copyFileSync as copyFileSync12,
   createWriteStream,
-  existsSync as existsSync94,
+  existsSync as existsSync95,
   lstatSync as lstatSync13,
   mkdirSync as mkdirSync53,
   openSync as openSync18,
-  readdirSync as readdirSync32,
-  readFileSync as readFileSync85,
+  readdirSync as readdirSync33,
+  readFileSync as readFileSync86,
   readSync as readSync6,
   renameSync as renameSync23,
   rmSync as rmSync18,
@@ -117999,9 +119002,9 @@ function defaultSelfUpdateIO() {
         throw new Error(`empty response body for ${url}`);
       await pipeline(Readable.fromWeb(res.body), createWriteStream(dest));
     },
-    sha256File(path7) {
-      const hash2 = createHash17("sha256");
-      const fd = openSync18(path7, "r");
+    sha256File(path9) {
+      const hash2 = createHash18("sha256");
+      const fd = openSync18(path9, "r");
       try {
         const buf = Buffer.allocUnsafe(1 << 20);
         for (;; ) {
@@ -118015,8 +119018,8 @@ function defaultSelfUpdateIO() {
       }
       return hash2.digest("hex");
     },
-    probeBinary(path7) {
-      const r = spawnSync18(path7, ["--version"], {
+    probeBinary(path9) {
+      const r = spawnSync18(path9, ["--version"], {
         encoding: "utf-8",
         timeout: 30000,
         env: { ...process.env, SWITCHROOM_SELF_UPDATED: "" }
@@ -118056,24 +119059,24 @@ function defaultSelfUpdateIO() {
     copyFile(src, dest) {
       copyFileSync12(src, dest);
     },
-    chmodExec(path7) {
-      chmodSync16(path7, 493);
+    chmodExec(path9) {
+      chmodSync16(path9, 493);
     },
     rename(src, dest) {
       renameSync23(src, dest);
     },
-    remove(path7) {
-      rmSync18(path7, { force: true });
+    remove(path9) {
+      rmSync18(path9, { force: true });
     },
-    exists(path7) {
-      return existsSync94(path7);
+    exists(path9) {
+      return existsSync95(path9);
     },
-    dirname(path7) {
-      return dirname39(path7);
+    dirname(path9) {
+      return dirname39(path9);
     },
-    readText(path7) {
+    readText(path9) {
       try {
-        return readFileSync85(path7, "utf-8");
+        return readFileSync86(path9, "utf-8");
       } catch {
         return null;
       }
@@ -118093,19 +119096,19 @@ function defaultSelfUpdateIO() {
     symlink(target, linkPath) {
       symlinkSync5(target, linkPath);
     },
-    isSymlink(path7) {
+    isSymlink(path9) {
       try {
-        return lstatSync13(path7).isSymbolicLink();
+        return lstatSync13(path9).isSymbolicLink();
       } catch {
         return false;
       }
     },
-    removeTree(path7) {
-      rmSync18(path7, { recursive: true, force: true });
+    removeTree(path9) {
+      rmSync18(path9, { recursive: true, force: true });
     },
     listDir(dir) {
       try {
-        return readdirSync32(dir);
+        return readdirSync33(dir);
       } catch {
         return [];
       }
@@ -118120,7 +119123,7 @@ init_install_cron();
 
 // src/memory/mm-refresh-cron.ts
 import { execFileSync as execFileSync30 } from "node:child_process";
-import { chownSync as chownSync12, existsSync as existsSync95, mkdirSync as mkdirSync54, readFileSync as readFileSync86, renameSync as renameSync24, statSync as statSync55, writeFileSync as writeFileSync37 } from "node:fs";
+import { chownSync as chownSync12, existsSync as existsSync96, mkdirSync as mkdirSync54, readFileSync as readFileSync87, renameSync as renameSync24, statSync as statSync56, writeFileSync as writeFileSync37 } from "node:fs";
 import { dirname as dirname40 } from "node:path";
 var CRON_PATH3 = "/etc/cron.d/mental-model-refresh";
 var CRON_SCHEDULE2 = "27 4 * * *";
@@ -118137,20 +119140,20 @@ function renderCron3(opts) {
 `;
 }
 function installCron3(opts) {
-  const path7 = opts.path ?? CRON_PATH3;
+  const path9 = opts.path ?? CRON_PATH3;
   const content = renderCron3(opts);
-  if (existsSync95(path7)) {
+  if (existsSync96(path9)) {
     try {
-      if (readFileSync86(path7, "utf8") === content) {
-        return { status: "unchanged", path: path7, content };
+      if (readFileSync87(path9, "utf8") === content) {
+        return { status: "unchanged", path: path9, content };
       }
     } catch {}
   }
-  mkdirSync54(dirname40(path7), { recursive: true });
-  const tmp = `${path7}.${process.pid}.tmp`;
+  mkdirSync54(dirname40(path9), { recursive: true });
+  const tmp = `${path9}.${process.pid}.tmp`;
   writeFileSync37(tmp, content, { mode: 420 });
-  renameSync24(tmp, path7);
-  return { status: "installed", path: path7, content };
+  renameSync24(tmp, path9);
+  return { status: "installed", path: path9, content };
 }
 var defaultIdResolver3 = (user) => {
   const uid = Number(execFileSync30("id", ["-u", user], { encoding: "utf8" }).trim());
@@ -118161,27 +119164,27 @@ var defaultIdResolver3 = (user) => {
   return { uid, gid };
 };
 function ensureLogFile3(opts) {
-  const path7 = opts.path ?? CRON_LOG_PATH3;
-  if (existsSync95(path7))
-    return { status: "unchanged", path: path7 };
+  const path9 = opts.path ?? CRON_LOG_PATH3;
+  if (existsSync96(path9))
+    return { status: "unchanged", path: path9 };
   const { uid, gid } = (opts.resolveIds ?? defaultIdResolver3)(opts.user);
-  mkdirSync54(dirname40(path7), { recursive: true });
-  writeFileSync37(path7, "", { mode: 420, flag: "a" });
+  mkdirSync54(dirname40(path9), { recursive: true });
+  writeFileSync37(path9, "", { mode: 420, flag: "a" });
   const isRoot = process.getuid?.() === 0;
   let alreadyOwned = false;
   try {
-    const st = statSync55(path7);
+    const st = statSync56(path9);
     alreadyOwned = st.uid === uid && st.gid === gid;
   } catch {}
   if (isRoot && !alreadyOwned) {
     try {
-      chownSync12(path7, uid, gid);
+      chownSync12(path9, uid, gid);
     } catch (e) {
       if (e.code !== "EPERM")
         throw e;
     }
   }
-  return { status: "created", path: path7 };
+  return { status: "created", path: path9 };
 }
 function renderLogrotate3(opts) {
   return `${opts.logPath} {
@@ -118197,20 +119200,20 @@ function renderLogrotate3(opts) {
 `;
 }
 function installLogrotate3(opts) {
-  const path7 = opts.path ?? LOGROTATE_PATH3;
+  const path9 = opts.path ?? LOGROTATE_PATH3;
   const content = renderLogrotate3({ logPath: opts.logPath ?? CRON_LOG_PATH3, user: opts.user });
-  if (existsSync95(path7)) {
+  if (existsSync96(path9)) {
     try {
-      if (readFileSync86(path7, "utf8") === content) {
-        return { status: "unchanged", path: path7, content };
+      if (readFileSync87(path9, "utf8") === content) {
+        return { status: "unchanged", path: path9, content };
       }
     } catch {}
   }
-  mkdirSync54(dirname40(path7), { recursive: true });
-  const tmp = `${path7}.${process.pid}.tmp`;
+  mkdirSync54(dirname40(path9), { recursive: true });
+  const tmp = `${path9}.${process.pid}.tmp`;
   writeFileSync37(tmp, content, { mode: 420 });
-  renameSync24(tmp, path7);
-  return { status: "installed", path: path7, content };
+  renameSync24(tmp, path9);
+  return { status: "installed", path: path9, content };
 }
 function parseCronUser3(content) {
   for (const line of content.split(`
@@ -118227,20 +119230,20 @@ function parseCronUser3(content) {
   return null;
 }
 function reconcileCron3(opts) {
-  const path7 = opts.path ?? CRON_PATH3;
-  if (!existsSync95(path7))
-    return { status: "absent", path: path7 };
+  const path9 = opts.path ?? CRON_PATH3;
+  if (!existsSync96(path9))
+    return { status: "absent", path: path9 };
   let user = opts.fallbackUser;
   try {
-    user = parseCronUser3(readFileSync86(path7, "utf8")) ?? opts.fallbackUser;
+    user = parseCronUser3(readFileSync87(path9, "utf8")) ?? opts.fallbackUser;
   } catch {}
   if (!user) {
-    throw new Error(`cannot reconcile ${path7}: no cron-user parseable from the existing fragment and no fallback user available`);
+    throw new Error(`cannot reconcile ${path9}: no cron-user parseable from the existing fragment and no fallback user available`);
   }
-  const r = installCron3({ user, binary: opts.binary, path: path7 });
+  const r = installCron3({ user, binary: opts.binary, path: path9 });
   return {
     status: r.status === "installed" ? "reconciled" : "unchanged",
-    path: path7,
+    path: path9,
     content: r.content
   };
 }
@@ -118250,7 +119253,7 @@ init_install_cron2();
 
 // src/host-cli-self-heal/install-timer.ts
 import { spawnSync as spawnSync19 } from "node:child_process";
-import { existsSync as existsSync96, mkdirSync as mkdirSync55, readFileSync as readFileSync87, renameSync as renameSync25, writeFileSync as writeFileSync38 } from "node:fs";
+import { existsSync as existsSync97, mkdirSync as mkdirSync55, readFileSync as readFileSync88, renameSync as renameSync25, writeFileSync as writeFileSync38 } from "node:fs";
 import { dirname as dirname41 } from "node:path";
 var SERVICE_PATH = "/etc/systemd/system/switchroom-self-heal.service";
 var TIMER_PATH = "/etc/systemd/system/switchroom-self-heal.timer";
@@ -118296,22 +119299,22 @@ function renderTimer() {
 ` + `WantedBy=timers.target
 `;
 }
-function writeUnitIdempotent(path7, content) {
-  if (existsSync96(path7)) {
+function writeUnitIdempotent(path9, content) {
+  if (existsSync97(path9)) {
     try {
-      if (readFileSync87(path7, "utf8") === content)
+      if (readFileSync88(path9, "utf8") === content)
         return "unchanged";
     } catch {}
   }
-  mkdirSync55(dirname41(path7), { recursive: true });
-  const tmp = `${path7}.${process.pid}.tmp`;
+  mkdirSync55(dirname41(path9), { recursive: true });
+  const tmp = `${path9}.${process.pid}.tmp`;
   writeFileSync38(tmp, content, { mode: 420 });
-  renameSync25(tmp, path7);
+  renameSync25(tmp, path9);
   return "written";
 }
 function homeFromPasswd2(user) {
   try {
-    for (const line of readFileSync87("/etc/passwd", "utf8").split(`
+    for (const line of readFileSync88("/etc/passwd", "utf8").split(`
 `)) {
       const f = line.split(":");
       if (f[0] === user && f[5])
@@ -118328,7 +119331,7 @@ function resolveOperatorUser(env2) {
 }
 function installSelfHealTimer(deps = {}) {
   const env2 = deps.env ?? process.env;
-  const systemdBooted = deps.systemdBooted ?? (() => existsSync96(SYSTEMD_MARKER));
+  const systemdBooted = deps.systemdBooted ?? (() => existsSync97(SYSTEMD_MARKER));
   const geteuid = deps.geteuid ?? (() => typeof process.geteuid === "function" ? process.geteuid() : undefined);
   const homeForUser = deps.homeForUser ?? homeFromPasswd2;
   const servicePath = deps.servicePath ?? SERVICE_PATH;
@@ -118389,22 +119392,22 @@ function installSelfHealTimer(deps = {}) {
 // src/cli/update.ts
 function defaultPersistPin(configPath) {
   return (pin) => {
-    const path7 = configPath ?? findConfigFile();
-    const before = readFileSync88(path7, "utf8");
+    const path9 = configPath ?? findConfigFile();
+    const before = readFileSync89(path9, "utf8");
     const after = setReleasePinInConfig(before, pin);
     if (after === before)
       return;
-    writeConfigFileSync(path7, after, statSync56(path7).mode & 511);
+    writeConfigFileSync(path9, after, statSync57(path9).mode & 511);
     try {
       if (typeof process.geteuid === "function" && process.geteuid() === 0) {
         const uid = resolveOperatorUid();
         if (uid !== undefined)
-          chownSync13(path7, uid, uid);
+          chownSync13(path9, uid, uid);
       }
     } catch {}
   };
 }
-var DEFAULT_COMPOSE_PATH2 = join101(homedir51(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH2 = join102(homedir51(), ".switchroom", "compose", "docker-compose.yml");
 var PACKAGED_INSTALL_KINDS = new Set([
   "static-binary",
   "npm-global",
@@ -118413,9 +119416,9 @@ var PACKAGED_INSTALL_KINDS = new Set([
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname42(scriptPath);
   for (let i2 = 0;i2 < 12; i2++) {
-    if (existsSync97(join101(dir, ".git"))) {
+    if (existsSync98(join102(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync88(join101(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync89(join102(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -118482,7 +119485,7 @@ function planUpdate(opts) {
         bundleDir: import.meta.dirname,
         execPath: process.execPath,
         scriptPath,
-        inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync97("/.dockerenv")
+        inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync98("/.dockerenv")
       });
       if (detection.kind !== "static-binary") {
         say(source_default.gray(`  host CLI not self-updated: ${detection.reason}
@@ -118565,7 +119568,7 @@ function planUpdate(opts) {
   steps.push({
     name: "pull-images",
     description: "Pull broker / kernel / agent images from GHCR",
-    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync97(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
+    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync98(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
     run: () => {
       const r = runner("docker", [
         "compose",
@@ -118822,13 +119825,13 @@ function planUpdate(opts) {
         bundleDir: import.meta.dirname,
         execPath: process.execPath
       });
-      const dest = join101(homedir51(), ".switchroom", "skills", "_bundled");
+      const dest = join102(homedir51(), ".switchroom", "skills", "_bundled");
       if (resolution.path === null) {
         const detection = detectInstallKind(opts.installProbe ?? {
           bundleDir: import.meta.dirname,
           execPath: process.execPath,
           scriptPath,
-          inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync97("/.dockerenv")
+          inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync98("/.dockerenv")
         });
         const detail = `no shipped skills/ payload found for this install ` + `(${detection.kind}; ${describeShippedAssetSearch(resolution)})`;
         if (PACKAGED_INSTALL_KINDS.has(detection.kind)) {
@@ -118867,11 +119870,11 @@ function planUpdate(opts) {
     run: () => {
       if (opts.syncBundledSkillsFn)
         return;
-      const dest = join101(homedir51(), ".switchroom", "skills", "_bundled");
-      if (!existsSync97(dest)) {
+      const dest = join102(homedir51(), ".switchroom", "skills", "_bundled");
+      if (!existsSync98(dest)) {
         return;
       }
-      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync97(join101(dest, key)));
+      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync98(join102(dest, key)));
       if (missing.length > 0) {
         throw new Error(`verify-bundled-skills: builtin default skill(s) missing from the pool after sync: ` + `${missing.join(", ")}. These ship in the CLI package and must exist in ${dest}. ` + `This is a broken sync or a packaging regression \u2014 the pool is not converged.`);
       }
@@ -118906,7 +119909,7 @@ function planUpdate(opts) {
     description: "docker compose up -d --remove-orphans (recreates services with new images / compose)",
     run: () => {
       try {
-        const composeText = readFileSync88(composePath, "utf8");
+        const composeText = readFileSync89(composePath, "utf8");
         const pf = validateBindSources(composeText);
         if (!pf.ok)
           throw new Error(formatPreflightError(pf));
@@ -118981,14 +119984,14 @@ function defaultStatusProbe(composePath) {
     } catch {}
     if (scriptPath) {
       try {
-        cliBuiltAt = new Date(statSync56(scriptPath).mtimeMs).toISOString();
+        cliBuiltAt = new Date(statSync57(scriptPath).mtimeMs).toISOString();
       } catch {}
       let dir = dirname42(scriptPath);
       for (let i2 = 0;i2 < 8; i2++) {
-        const pkgPath = join101(dir, "package.json");
-        if (existsSync97(pkgPath)) {
+        const pkgPath = join102(dir, "package.json");
+        if (existsSync98(pkgPath)) {
           try {
-            const pkg = JSON.parse(readFileSync88(pkgPath, "utf-8"));
+            const pkg = JSON.parse(readFileSync89(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
               cliVersion = pkg.version;
           } catch (err) {
@@ -119009,7 +120012,7 @@ function defaultStatusProbe(composePath) {
     warnings.push("could not resolve CLI version (no package.json found above the resolved script path)");
   }
   const services = [];
-  if (!existsSync97(composePath)) {
+  if (!existsSync98(composePath)) {
     warnings.push(`compose file not found at ${composePath}; service status unknown`);
     return { cliVersion, cliBuiltAt, services, warnings };
   }
@@ -119272,22 +120275,22 @@ function registerUpdateCommand(program3) {
 // src/cli/rollout.ts
 init_helpers();
 import { spawnSync as spawnSync22 } from "node:child_process";
-import { readFileSync as readFileSync90, chownSync as chownSync14, statSync as statSync59 } from "node:fs";
+import { readFileSync as readFileSync91, chownSync as chownSync14, statSync as statSync60 } from "node:fs";
 import { homedir as homedir53 } from "node:os";
 
 // src/cli/rollout-pin-journal.ts
 import {
-  existsSync as existsSync98,
-  readFileSync as readFileSync89,
+  existsSync as existsSync99,
+  readFileSync as readFileSync90,
   writeFileSync as writeFileSync39,
   renameSync as renameSync26,
   unlinkSync as unlinkSync19,
-  statSync as statSync57,
+  statSync as statSync58,
   mkdirSync as mkdirSync57
 } from "node:fs";
 import { homedir as homedir52 } from "node:os";
-import { createHash as createHash18 } from "node:crypto";
-import { join as join102, basename as basename9, resolve as resolve50, dirname as dirname43 } from "node:path";
+import { createHash as createHash19 } from "node:crypto";
+import { join as join103, basename as basename9, resolve as resolve51, dirname as dirname43 } from "node:path";
 init_flock();
 var PIN_JOURNAL_MAX_AGE_MS = 15 * 60 * 1000;
 var STATE_DIR_NAME = ".switchroom";
@@ -119296,16 +120299,16 @@ function pinJournalDir(configPath) {
   if (override && override.trim().length > 0)
     return override.trim();
   if (configPath) {
-    const dir = dirname43(resolve50(configPath));
+    const dir = dirname43(resolve51(configPath));
     if (basename9(dir) === STATE_DIR_NAME)
       return dir;
   }
-  return join102(homedir52(), STATE_DIR_NAME);
+  return join103(homedir52(), STATE_DIR_NAME);
 }
 function pinJournalPath(configPath) {
-  const abs = resolve50(configPath);
-  const key = createHash18("sha256").update(abs).digest("hex").slice(0, 12);
-  return join102(pinJournalDir(abs), `.rollout-pin-journal.${basename9(abs)}.${key}.json`);
+  const abs = resolve51(configPath);
+  const key = createHash19("sha256").update(abs).digest("hex").slice(0, 12);
+  return join103(pinJournalDir(abs), `.rollout-pin-journal.${basename9(abs)}.${key}.json`);
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0)
@@ -119339,9 +120342,9 @@ function readPinJournal(configPath, warn = (m) => process.stderr.write(m)) {
   const p = pinJournalPath(configPath);
   let raw;
   try {
-    raw = readFileSync89(p, "utf8");
+    raw = readFileSync90(p, "utf8");
   } catch (e) {
-    if (existsSync98(p)) {
+    if (existsSync99(p)) {
       warn(`\u26a0\ufe0f  rollout pin journal: ${p} exists but could not be read ` + `(${e.message}). A provisional \`release.pin\` may be ` + `uncommitted \u2014 verify it host-side before the next reconcile.
 `);
     }
@@ -119392,7 +120395,7 @@ function beginPinPersist(configPath, pin, opts = {}) {
     warn(`\u26a0\ufe0f  rollout pin journal: overwriting an ABANDONED journal at ${p} ` + `(pid ${existing.pid} recorded ${existing.at}, provisional pin ` + `${existing.pin}). Its roll never committed or reverted; \`release.pin\` ` + `in ${configPath} may still name that unproven build \u2014 verify it.
 `);
   }
-  const priorPin = getReleasePinFromConfig(readFileSync89(configPath, "utf8"));
+  const priorPin = getReleasePinFromConfig(readFileSync90(configPath, "utf8"));
   const journal = {
     v: 1,
     configPath,
@@ -119413,7 +120416,7 @@ function commitPinPersist(configPath) {
     unlinkSync19(p);
     return null;
   } catch (e) {
-    if (!existsSync98(p))
+    if (!existsSync99(p))
       return null;
     return `rollout pin journal: FAILED to clear ${p} after a SUCCESSFUL roll ` + `(${e.message}). Delete it host-side \u2014 while it exists, ` + `recovery may revert a proven \`release.pin\`.`;
   }
@@ -119435,11 +120438,11 @@ function rollbackPinPersist(configPath, opts = {}) {
     }
   }
   try {
-    const current = readFileSync89(configPath, "utf8");
+    const current = readFileSync90(configPath, "utf8");
     const next = journal.priorPin ? setReleasePinInConfig(current, journal.priorPin) : deleteReleasePinInConfig(current);
     let mode = 384;
     try {
-      mode = statSync57(configPath).mode & 511;
+      mode = statSync58(configPath).mode & 511;
     } catch {}
     if (opts.writeConfig) {
       opts.writeConfig(configPath, next, mode);
@@ -119489,8 +120492,8 @@ init_host_cli_stamp();
 
 // src/cli/host-cli-upgrade.ts
 init_self_update();
-import { lchownSync, lstatSync as lstatSync14, readdirSync as readdirSync33, statSync as statSync58 } from "node:fs";
-import { basename as basename10, dirname as dirname44, join as join103 } from "node:path";
+import { lchownSync, lstatSync as lstatSync14, readdirSync as readdirSync34, statSync as statSync59 } from "node:fs";
+import { basename as basename10, dirname as dirname44, join as join104 } from "node:path";
 init_shipped_assets();
 var HOST_CLI_UPGRADE_SENTINEL = "SWITCHROOM_HOST_CLI_UPGRADE:";
 function encodeHostCliUpgradeResult(r) {
@@ -119526,7 +120529,7 @@ function defaultIo() {
   return {
     isFile: (p) => {
       try {
-        return statSync58(p).isFile();
+        return statSync59(p).isFile();
       } catch {
         return false;
       }
@@ -119556,7 +120559,7 @@ function defaultIo() {
     chown: (p, uid, gid) => lchownSync(p, uid, gid),
     list: (d) => {
       try {
-        return readdirSync33(d);
+        return readdirSync34(d);
       } catch {
         return [];
       }
@@ -119587,7 +120590,7 @@ function handBackOwnership(paths, owner, io) {
     if (kind !== "dir")
       continue;
     for (const child of io.list(p))
-      stack.push(join103(p, child));
+      stack.push(join104(p, child));
   }
   return failures;
 }
@@ -119626,7 +120629,7 @@ async function runHostCliUpgrade(opts, io = defaultIo(), log = () => {}) {
       const installRoot = payloadInstallRoot(binary);
       const failures = handBackOwnership([
         binary,
-        join103(dirname44(binary), ".switchroom-versions"),
+        join104(dirname44(binary), ".switchroom-versions"),
         dirname44(installRoot),
         installRoot,
         payloadVersionDir(installRoot, pin)
@@ -119722,21 +120725,21 @@ function planHostCliHeal(opts) {
       reason: `the host CLI is a ${stamp.installKind} install \u2014 only a static-binary ` + `install can be replaced by swapping one file, so an operator must run ` + `the upgrade host-side`
     };
   }
-  const path7 = stamp.path;
-  if (!path7.startsWith("/") || path7.includes("/..")) {
-    return { action: "skip", reason: `recorded host CLI path "${path7}" is not a plain absolute path` };
+  const path9 = stamp.path;
+  if (!path9.startsWith("/") || path9.includes("/..")) {
+    return { action: "skip", reason: `recorded host CLI path "${path9}" is not a plain absolute path` };
   }
-  const installDir = path7.slice(0, path7.lastIndexOf("/"));
-  const name = path7.slice(path7.lastIndexOf("/") + 1);
+  const installDir = path9.slice(0, path9.lastIndexOf("/"));
+  const name = path9.slice(path9.lastIndexOf("/") + 1);
   if (name !== "switchroom") {
-    return { action: "skip", reason: `recorded host CLI path "${path7}" is not named \`switchroom\`` };
+    return { action: "skip", reason: `recorded host CLI path "${path9}" is not named \`switchroom\`` };
   }
   const prefixHostPath = installDir.slice(0, installDir.lastIndexOf("/"));
   const dirName = installDir.slice(installDir.lastIndexOf("/") + 1);
   if (prefixHostPath.length === 0 || dirName.length === 0) {
     return {
       action: "skip",
-      reason: `recorded host CLI path "${path7}" has no install prefix to bind \u2014 ` + `refusing to mount the host root`
+      reason: `recorded host CLI path "${path9}" has no install prefix to bind \u2014 ` + `refusing to mount the host root`
     };
   }
   return {
@@ -120421,13 +121424,13 @@ function createRolloutDeps(params) {
     }
     return { ok: r.status === 0, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
   };
-  const writeConfigPreservingOwnership = (path7, text, mode) => {
-    writeConfigFileSync(path7, text, mode);
+  const writeConfigPreservingOwnership = (path9, text, mode) => {
+    writeConfigFileSync(path9, text, mode);
     try {
       if (typeof process.geteuid === "function" && process.geteuid() === 0) {
         const uid = resolveOperatorUid();
         if (uid !== undefined) {
-          chownSync14(path7, uid, uid);
+          chownSync14(path9, uid, uid);
         } else if (hostdCtx) {
           warn("\u26a0\ufe0f  rollout (hostd path): could not resolve operator uid; " + "skipping config chown-back to avoid leaving switchroom.yaml " + "root-owned. Verify ownership host-side if other yaml verbs " + `EACCES.
 `);
@@ -120486,12 +121489,12 @@ function createRolloutDeps(params) {
       return stamp ? { hostCli: stamp } : {};
     })(),
     persistPin: (pin) => {
-      const before = readFileSync90(configPath, "utf8");
+      const before = readFileSync91(configPath, "utf8");
       const after = setReleasePinInConfig(before, pin);
       if (after === before)
         return false;
       beginPinPersist(configPath, pin);
-      writeConfigPreservingOwnership(configPath, after, statSync59(configPath).mode & 511);
+      writeConfigPreservingOwnership(configPath, after, statSync60(configPath).mode & 511);
       return true;
     },
     commitPin: () => {
@@ -120767,7 +121770,7 @@ init_source();
 init_helpers();
 init_loader();
 init_lifecycle();
-import { resolve as resolve51 } from "node:path";
+import { resolve as resolve52 } from "node:path";
 
 // src/cli/version.ts
 init_source();
@@ -120775,8 +121778,8 @@ init_helpers();
 init_lifecycle();
 init_resolve_version();
 import { execSync as execSync3 } from "node:child_process";
-import { existsSync as existsSync99, readFileSync as readFileSync91 } from "node:fs";
-import { dirname as dirname45, join as join104 } from "node:path";
+import { existsSync as existsSync100, readFileSync as readFileSync92 } from "node:fs";
+import { dirname as dirname45, join as join105 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync3("claude --version 2>/dev/null", {
@@ -120826,11 +121829,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i2 = 0;i2 < 10 && dir && dir !== "/"; i2++) {
-    const pkgPath = join104(dir, "package.json");
-    if (existsSync99(pkgPath)) {
+    const pkgPath = join105(dir, "package.json");
+    if (existsSync100(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync91(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync99(join104(dir, ".git"))) {
+        const pkg = JSON.parse(readFileSync92(pkgPath, "utf-8"));
+        if (pkg.name === "switchroom" && existsSync100(join105(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -120923,7 +121926,7 @@ function registerRestartCommand(program3) {
         }
         const didRestart = res.restarted || !graceful;
         if (didRestart) {
-          const agentDir = resolve51(agentsDir, name);
+          const agentDir = resolve52(agentsDir, name);
           const converged = waitForAuthConverge(name, agentDir);
           if (!converged) {
             console.log(source_default.yellow(`  ${name}: agent is up but auth status didn't converge in 30s \u2014 check logs`));
@@ -121006,37 +122009,37 @@ Dependency manifest`));
 // src/cli/handoff.ts
 init_helpers();
 init_loader();
-import { resolve as resolve52 } from "node:path";
+import { resolve as resolve53 } from "node:path";
 init_merge();
 
 // src/agents/session-retention.ts
 import {
-  existsSync as existsSync100,
-  readdirSync as readdirSync34,
-  statSync as statSync60,
+  existsSync as existsSync101,
+  readdirSync as readdirSync35,
+  statSync as statSync61,
   unlinkSync as unlinkSync20
 } from "node:fs";
-import { join as join105 } from "node:path";
+import { join as join106 } from "node:path";
 var DEFAULT_SESSION_RETENTION_MAX_COUNT = 20;
 var DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS = 30;
 var MIN_KEEP = 2;
 function collectSessionJsonl(claudeConfigDir) {
-  const projects = join105(claudeConfigDir, "projects");
-  if (!existsSync100(projects))
+  const projects = join106(claudeConfigDir, "projects");
+  if (!existsSync101(projects))
     return [];
   const found = [];
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync34(dir);
+      entries = readdirSync35(dir);
     } catch {
       return;
     }
     for (const name of entries) {
-      const full = join105(dir, name);
+      const full = join106(dir, name);
       let st;
       try {
-        st = statSync60(full);
+        st = statSync61(full);
       } catch {
         continue;
       }
@@ -121107,7 +122110,7 @@ function registerHandoffCommand(program3) {
       }
       agentConfig = resolveAgentConfig(config.defaults, config.profiles, rawAgent);
       const agentsDir = resolveAgentsDir(config);
-      agentDir = resolve52(agentsDir, agentName);
+      agentDir = resolve53(agentsDir, agentName);
     } catch (err) {
       if (!(err instanceof ConfigError))
         throw err;
@@ -121122,7 +122125,7 @@ function registerHandoffCommand(program3) {
 `);
       return;
     }
-    const claudeConfigDir = resolve52(agentDir, ".claude");
+    const claudeConfigDir = resolve53(agentDir, ".claude");
     const jsonl = findLatestSessionJsonl(claudeConfigDir);
     if (!jsonl) {
       process.stderr.write(`handoff: no session JSONL under ${claudeConfigDir}/projects; skipping
@@ -121154,18 +122157,18 @@ function registerHandoffCommand(program3) {
 // src/issues/store.ts
 import {
   closeSync as closeSync19,
-  existsSync as existsSync101,
+  existsSync as existsSync102,
   mkdirSync as mkdirSync58,
   openSync as openSync19,
-  readdirSync as readdirSync35,
-  readFileSync as readFileSync92,
+  readdirSync as readdirSync36,
+  readFileSync as readFileSync93,
   renameSync as renameSync27,
-  statSync as statSync61,
+  statSync as statSync62,
   unlinkSync as unlinkSync21,
   writeFileSync as writeFileSync40,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join106 } from "node:path";
+import { join as join107 } from "node:path";
 import { randomBytes as randomBytes16 } from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
 
@@ -121192,12 +122195,12 @@ function computeFingerprint(source, code) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path7 = join106(stateDir, ISSUES_FILE);
-  if (!existsSync101(path7))
+  const path9 = join107(stateDir, ISSUES_FILE);
+  if (!existsSync102(path9))
     return [];
   let raw;
   try {
-    raw = readFileSync92(path7, "utf-8");
+    raw = readFileSync93(path9, "utf-8");
   } catch {
     return [];
   }
@@ -121269,8 +122272,8 @@ function record(stateDir, input, nowFn = Date.now) {
     return result;
   });
 }
-function resolve53(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync101(join106(stateDir, ISSUES_FILE)))
+function resolve54(stateDir, fingerprint, nowFn = Date.now) {
+  if (!existsSync102(join107(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -121288,7 +122291,7 @@ function resolve53(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync101(join106(stateDir, ISSUES_FILE)))
+  if (!existsSync102(join107(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -121306,7 +122309,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync101(join106(stateDir, ISSUES_FILE)))
+  if (!existsSync102(join107(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -121339,21 +122342,21 @@ function ensureDir2(stateDir) {
   mkdirSync58(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path7 = join106(stateDir, ISSUES_FILE);
+  const path9 = join107(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
-  const tmp = `${path7}.tmp-${process.pid}-${randomBytes16(4).toString("hex")}`;
+  const tmp = `${path9}.tmp-${process.pid}-${randomBytes16(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
 `) + `
 `;
   writeFileSync40(tmp, body, "utf-8");
-  renameSync27(tmp, path7);
+  renameSync27(tmp, path9);
 }
 var ORPHAN_TMP_TTL_MS = 60000;
 var TMP_PREFIX = `${ISSUES_FILE}.tmp-`;
 function sweepOrphanTmpFiles(stateDir) {
   let entries;
   try {
-    entries = readdirSync35(stateDir);
+    entries = readdirSync36(stateDir);
   } catch {
     return;
   }
@@ -121361,10 +122364,10 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join106(stateDir, entry);
+    const tmpPath = join107(stateDir, entry);
     try {
-      const stat = statSync61(tmpPath);
-      if (stat.mtimeMs < cutoff) {
+      const stat2 = statSync62(tmpPath);
+      if (stat2.mtimeMs < cutoff) {
         unlinkSync21(tmpPath);
       }
     } catch {}
@@ -121373,7 +122376,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join106(stateDir, ISSUES_LOCK);
+  const lockPath = join107(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -121408,7 +122411,7 @@ function withLock(stateDir, fn) {
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync92(lockPath, "utf-8").trim();
+    pidStr = readFileSync93(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
@@ -121557,11 +122560,11 @@ function registerIssuesCommand(program3) {
       const stateDir = resolveStateDir2(opts);
       let flipped;
       if (opts.source && opts.code) {
-        flipped = resolve53(stateDir, computeFingerprint(opts.source, opts.code));
+        flipped = resolve54(stateDir, computeFingerprint(opts.source, opts.code));
       } else if (opts.source && !fingerprint) {
         flipped = resolveAllBySource(stateDir, opts.source);
       } else if (fingerprint) {
-        flipped = resolve53(stateDir, fingerprint);
+        flipped = resolve54(stateDir, fingerprint);
       } else {
         process.stderr.write(`issues resolve: need either <fingerprint>, --source, or --source + --code
 `);
@@ -121656,20 +122659,20 @@ function relTime(deltaMs) {
 
 // src/cli/deps.ts
 init_source();
-import { existsSync as existsSync104 } from "node:fs";
+import { existsSync as existsSync105 } from "node:fs";
 import { homedir as homedir56 } from "node:os";
-import { join as join109, resolve as resolve54 } from "node:path";
+import { join as join110, resolve as resolve55 } from "node:path";
 
 // src/deps/python.ts
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 import {
-  existsSync as existsSync102,
+  existsSync as existsSync103,
   mkdirSync as mkdirSync59,
-  readFileSync as readFileSync93,
+  readFileSync as readFileSync94,
   rmSync as rmSync19,
   writeFileSync as writeFileSync41
 } from "node:fs";
-import { dirname as dirname46, join as join107 } from "node:path";
+import { dirname as dirname46, join as join108 } from "node:path";
 import { homedir as homedir54 } from "node:os";
 import { execFileSync as execFileSync31 } from "node:child_process";
 
@@ -121682,26 +122685,26 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join107(homedir54(), ".switchroom", "deps", "python");
+  return join108(homedir54(), ".switchroom", "deps", "python");
 }
-function hashFile(path7) {
-  return createHash19("sha256").update(readFileSync93(path7)).digest("hex");
+function hashFile(path9) {
+  return createHash20("sha256").update(readFileSync94(path9)).digest("hex");
 }
 function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultPythonCacheRoot();
   const hostPython = opts.pythonBin ?? "python3";
-  if (!existsSync102(requirementsPath)) {
+  if (!existsSync103(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join107(cacheRoot, skillName);
-  const stampPath = join107(venvDir, ".requirements.sha256");
-  const binDir = join107(venvDir, "bin");
-  const pythonBin = join107(binDir, "python");
-  const pipBin = join107(binDir, "pip");
+  const venvDir = join108(cacheRoot, skillName);
+  const stampPath = join108(venvDir, ".requirements.sha256");
+  const binDir = join108(venvDir, "bin");
+  const pythonBin = join108(binDir, "python");
+  const pipBin = join108(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
-  if (!force && existsSync102(stampPath) && existsSync102(pythonBin)) {
-    const existingHash = readFileSync93(stampPath, "utf8").trim();
+  if (!force && existsSync103(stampPath) && existsSync103(pythonBin)) {
+    const existingHash = readFileSync94(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -121713,7 +122716,7 @@ function ensurePythonEnv(opts) {
       };
     }
   }
-  if (existsSync102(venvDir)) {
+  if (existsSync103(venvDir)) {
     rmSync19(venvDir, { recursive: true, force: true });
   }
   mkdirSync59(dirname46(venvDir), { recursive: true });
@@ -121748,16 +122751,16 @@ function ensurePythonEnv(opts) {
 }
 
 // src/deps/node.ts
-import { createHash as createHash20 } from "node:crypto";
+import { createHash as createHash21 } from "node:crypto";
 import {
   copyFileSync as copyFileSync13,
-  existsSync as existsSync103,
+  existsSync as existsSync104,
   mkdirSync as mkdirSync60,
-  readFileSync as readFileSync94,
+  readFileSync as readFileSync95,
   rmSync as rmSync20,
   writeFileSync as writeFileSync42
 } from "node:fs";
-import { dirname as dirname47, join as join108 } from "node:path";
+import { dirname as dirname47, join as join109 } from "node:path";
 import { homedir as homedir55 } from "node:os";
 import { execFileSync as execFileSync32 } from "node:child_process";
 
@@ -121781,23 +122784,23 @@ var LOCKFILES_FOR = {
   npm: ["package-lock.json"]
 };
 function defaultNodeCacheRoot() {
-  return join108(homedir55(), ".switchroom", "deps", "node");
+  return join109(homedir55(), ".switchroom", "deps", "node");
 }
 function hashDepInputs(packageJsonPath) {
   const sourceDir = dirname47(packageJsonPath);
-  const hasher = createHash20("sha256");
+  const hasher = createHash21("sha256");
   hasher.update(`package.json
 `);
-  hasher.update(readFileSync94(packageJsonPath));
+  hasher.update(readFileSync95(packageJsonPath));
   for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join108(sourceDir, lockName);
-    if (existsSync103(lockPath)) {
+    const lockPath = join109(sourceDir, lockName);
+    if (existsSync104(lockPath)) {
       hasher.update(`
 `);
       hasher.update(lockName);
       hasher.update(`
 `);
-      hasher.update(readFileSync94(lockPath));
+      hasher.update(readFileSync95(lockPath));
     }
   }
   return hasher.digest("hex");
@@ -121806,17 +122809,17 @@ function ensureNodeEnv(opts) {
   const { skillName, packageJsonPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultNodeCacheRoot();
   const installer = opts.installer ?? "bun";
-  if (!existsSync103(packageJsonPath)) {
+  if (!existsSync104(packageJsonPath)) {
     throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
   }
   const sourceDir = dirname47(packageJsonPath);
-  const envDir = join108(cacheRoot, skillName);
-  const stampPath = join108(envDir, ".package.sha256");
-  const nodeModulesDir = join108(envDir, "node_modules");
-  const binDir = join108(nodeModulesDir, ".bin");
+  const envDir = join109(cacheRoot, skillName);
+  const stampPath = join109(envDir, ".package.sha256");
+  const nodeModulesDir = join109(envDir, "node_modules");
+  const binDir = join109(nodeModulesDir, ".bin");
   const targetHash = hashDepInputs(packageJsonPath);
-  if (!force && existsSync103(stampPath) && existsSync103(nodeModulesDir)) {
-    const existingHash = readFileSync94(stampPath, "utf8").trim();
+  if (!force && existsSync104(stampPath) && existsSync104(nodeModulesDir)) {
+    const existingHash = readFileSync95(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -121827,16 +122830,16 @@ function ensureNodeEnv(opts) {
       };
     }
   }
-  if (existsSync103(envDir)) {
+  if (existsSync104(envDir)) {
     rmSync20(envDir, { recursive: true, force: true });
   }
   mkdirSync60(envDir, { recursive: true });
-  copyFileSync13(packageJsonPath, join108(envDir, "package.json"));
+  copyFileSync13(packageJsonPath, join109(envDir, "package.json"));
   let copiedLockfile = false;
   for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join108(sourceDir, lockName);
-    if (existsSync103(lockPath)) {
-      copyFileSync13(lockPath, join108(envDir, lockName));
+    const lockPath = join109(sourceDir, lockName);
+    if (existsSync104(lockPath)) {
+      copyFileSync13(lockPath, join109(envDir, lockName));
       copiedLockfile = true;
     }
   }
@@ -121865,28 +122868,28 @@ function ensureNodeEnv(opts) {
 
 // src/cli/deps.ts
 function builtinSkillsRoot() {
-  return resolve54(homedir56(), ".switchroom/skills/_bundled");
+  return resolve55(homedir56(), ".switchroom/skills/_bundled");
 }
 function registerDepsCommand(program3) {
   const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
   deps.command("rebuild <skill>").description("Rebuild the Python venv and/or Node node_modules cache for a skill").option("-p, --python", "Rebuild only the Python env").option("-n, --node", "Rebuild only the Node env").action(async (skill, opts) => {
     const skillsRoot = builtinSkillsRoot();
-    if (!existsSync104(skillsRoot)) {
+    if (!existsSync105(skillsRoot)) {
       console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
       process.exit(1);
     }
-    const skillDir = join109(skillsRoot, skill);
-    if (!existsSync104(skillDir)) {
+    const skillDir = join110(skillsRoot, skill);
+    if (!existsSync105(skillDir)) {
       console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
       process.exit(1);
     }
-    const requirementsPath = join109(skillDir, "requirements.txt");
-    const packageJsonPath = join109(skillDir, "package.json");
-    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync104(requirementsPath));
-    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync104(packageJsonPath));
+    const requirementsPath = join110(skillDir, "requirements.txt");
+    const packageJsonPath = join110(skillDir, "package.json");
+    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync105(requirementsPath));
+    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync105(packageJsonPath));
     let did = 0;
     if (wantPython) {
-      if (!existsSync104(requirementsPath)) {
+      if (!existsSync105(requirementsPath)) {
         console.error(source_default.red(`Skill "${skill}" has no requirements.txt at ${requirementsPath}`));
         process.exit(1);
       }
@@ -121910,7 +122913,7 @@ function registerDepsCommand(program3) {
       }
     }
     if (wantNode) {
-      if (!existsSync104(packageJsonPath)) {
+      if (!existsSync105(packageJsonPath)) {
         console.error(source_default.red(`Skill "${skill}" has no package.json at ${packageJsonPath}`));
         process.exit(1);
       }
@@ -121943,436 +122946,10 @@ function registerDepsCommand(program3) {
 // src/cli/workspace.ts
 init_helpers();
 init_loader();
-import { existsSync as existsSync105 } from "node:fs";
-import { resolve as resolve55, sep as sep7 } from "node:path";
+import { existsSync as existsSync106 } from "node:fs";
+import { resolve as resolve56, sep as sep7 } from "node:path";
 import { spawnSync as spawnSync23 } from "node:child_process";
 
-// src/agents/workspace.ts
-import { readFile as readFile2, stat } from "node:fs/promises";
-import path8 from "node:path";
-
-// src/agents/bootstrap-budget.ts
-import path7 from "node:path";
-var DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO = 0.85;
-var DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES = 3;
-var DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX = 32;
-
-class BootstrapBudgetExceededError extends Error {
-  analysis;
-  constructor(analysis, message) {
-    super(message);
-    this.analysis = analysis;
-    this.name = "BootstrapBudgetExceededError";
-  }
-}
-function normalizePositiveLimit(value) {
-  if (!Number.isFinite(value) || value <= 0) {
-    return 1;
-  }
-  return Math.floor(value);
-}
-function formatWarningCause(cause) {
-  return cause === "per-file-limit" ? "max/file" : "max/total";
-}
-function normalizeSeenSignatures(signatures) {
-  if (!Array.isArray(signatures) || signatures.length === 0) {
-    return [];
-  }
-  const seen = new Set;
-  const result = [];
-  for (const signature of signatures) {
-    const value = typeof signature === "string" ? signature.trim() : "";
-    if (!value || seen.has(value)) {
-      continue;
-    }
-    seen.add(value);
-    result.push(value);
-  }
-  return result;
-}
-function appendSeenSignature(signatures, signature) {
-  if (!signature.trim()) {
-    return signatures;
-  }
-  if (signatures.includes(signature)) {
-    return signatures;
-  }
-  const next = [...signatures, signature];
-  if (next.length <= DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX) {
-    return next;
-  }
-  return next.slice(-DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX);
-}
-function buildBootstrapInjectionStats(params) {
-  const injectedByPath = new Map;
-  const injectedByBaseName = new Map;
-  for (const file of params.injectedFiles) {
-    const pathValue = typeof file.path === "string" ? file.path.trim() : "";
-    if (!pathValue) {
-      continue;
-    }
-    if (!injectedByPath.has(pathValue)) {
-      injectedByPath.set(pathValue, file.content);
-    }
-    const normalizedPath = pathValue.replace(/\\/g, "/");
-    const baseName = path7.posix.basename(normalizedPath);
-    if (!injectedByBaseName.has(baseName)) {
-      injectedByBaseName.set(baseName, file.content);
-    }
-  }
-  return params.bootstrapFiles.map((file) => {
-    const pathValue = typeof file.path === "string" ? file.path.trim() : "";
-    const rawChars = file.missing ? 0 : (file.content ?? "").trimEnd().length;
-    const injected = (pathValue ? injectedByPath.get(pathValue) : undefined) ?? injectedByPath.get(file.name) ?? injectedByBaseName.get(file.name);
-    const injectedChars = injected ? injected.length : 0;
-    const truncated = !file.missing && injectedChars < rawChars;
-    return {
-      name: file.name,
-      path: pathValue || file.name,
-      missing: file.missing,
-      rawChars,
-      injectedChars,
-      truncated
-    };
-  });
-}
-function analyzeBootstrapBudget(params) {
-  const bootstrapMaxChars = normalizePositiveLimit(params.bootstrapMaxChars);
-  const bootstrapTotalMaxChars = normalizePositiveLimit(params.bootstrapTotalMaxChars);
-  const nearLimitRatio = typeof params.nearLimitRatio === "number" && Number.isFinite(params.nearLimitRatio) && params.nearLimitRatio > 0 && params.nearLimitRatio < 1 ? params.nearLimitRatio : DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO;
-  const nonMissing = params.files.filter((file) => !file.missing);
-  const rawChars = nonMissing.reduce((sum, file) => sum + file.rawChars, 0);
-  const injectedChars = nonMissing.reduce((sum, file) => sum + file.injectedChars, 0);
-  const totalNearLimit = injectedChars >= Math.ceil(bootstrapTotalMaxChars * nearLimitRatio);
-  const totalOverLimit = injectedChars >= bootstrapTotalMaxChars;
-  const files = params.files.map((file) => {
-    if (file.missing) {
-      return { ...file, nearLimit: false, causes: [] };
-    }
-    const perFileOverLimit = file.rawChars > bootstrapMaxChars;
-    const nearLimit = file.rawChars >= Math.ceil(bootstrapMaxChars * nearLimitRatio);
-    const causes = [];
-    if (file.truncated) {
-      if (perFileOverLimit) {
-        causes.push("per-file-limit");
-      }
-      if (totalOverLimit) {
-        causes.push("total-limit");
-      }
-    }
-    return { ...file, nearLimit, causes };
-  });
-  const truncatedFiles = files.filter((file) => file.truncated);
-  const nearLimitFiles = files.filter((file) => file.nearLimit);
-  return {
-    files,
-    truncatedFiles,
-    nearLimitFiles,
-    totalNearLimit,
-    hasTruncation: truncatedFiles.length > 0,
-    totals: {
-      rawChars,
-      injectedChars,
-      truncatedChars: Math.max(0, rawChars - injectedChars),
-      bootstrapMaxChars,
-      bootstrapTotalMaxChars,
-      nearLimitRatio
-    }
-  };
-}
-function buildBootstrapTruncationSignature(analysis) {
-  if (!analysis.hasTruncation) {
-    return;
-  }
-  const files = analysis.truncatedFiles.map((file) => ({
-    path: file.path || file.name,
-    rawChars: file.rawChars,
-    injectedChars: file.injectedChars,
-    causes: [...file.causes].sort()
-  })).sort((a, b) => {
-    const pathCmp = a.path.localeCompare(b.path);
-    if (pathCmp !== 0) {
-      return pathCmp;
-    }
-    if (a.rawChars !== b.rawChars) {
-      return a.rawChars - b.rawChars;
-    }
-    if (a.injectedChars !== b.injectedChars) {
-      return a.injectedChars - b.injectedChars;
-    }
-    return a.causes.join("+").localeCompare(b.causes.join("+"));
-  });
-  return JSON.stringify({
-    bootstrapMaxChars: analysis.totals.bootstrapMaxChars,
-    bootstrapTotalMaxChars: analysis.totals.bootstrapTotalMaxChars,
-    files
-  });
-}
-function formatBootstrapTruncationWarningLines(params) {
-  if (!params.analysis.hasTruncation) {
-    return [];
-  }
-  const maxFiles = typeof params.maxFiles === "number" && Number.isFinite(params.maxFiles) && params.maxFiles > 0 ? Math.floor(params.maxFiles) : DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES;
-  const lines = [];
-  const duplicateNameCounts = params.analysis.truncatedFiles.reduce((acc, file) => {
-    acc.set(file.name, (acc.get(file.name) ?? 0) + 1);
-    return acc;
-  }, new Map);
-  const topFiles = params.analysis.truncatedFiles.slice(0, maxFiles);
-  for (const file of topFiles) {
-    const pct = file.rawChars > 0 ? Math.round((file.rawChars - file.injectedChars) / file.rawChars * 100) : 0;
-    const causeText = file.causes.length > 0 ? file.causes.map((cause) => formatWarningCause(cause)).join(", ") : "";
-    const nameLabel = (duplicateNameCounts.get(file.name) ?? 0) > 1 && file.path.trim().length > 0 ? `${file.name} (${file.path})` : file.name;
-    lines.push(`${nameLabel}: ${file.rawChars} raw -> ${file.injectedChars} injected (~${Math.max(0, pct)}% removed${causeText ? `; ${causeText}` : ""}).`);
-  }
-  if (params.analysis.truncatedFiles.length > topFiles.length) {
-    lines.push(`+${params.analysis.truncatedFiles.length - topFiles.length} more truncated file(s).`);
-  }
-  lines.push("If unintentional, raise switchroom workspace bootstrapMaxChars and/or bootstrapTotalMaxChars config.");
-  return lines;
-}
-function buildBootstrapPromptWarning(params) {
-  const signature = buildBootstrapTruncationSignature(params.analysis);
-  let seenSignatures = normalizeSeenSignatures(params.seenSignatures);
-  if (params.previousSignature && !seenSignatures.includes(params.previousSignature)) {
-    seenSignatures = appendSeenSignature(seenSignatures, params.previousSignature);
-  }
-  const hasSeenSignature = Boolean(signature && seenSignatures.includes(signature));
-  const warningShown = params.mode !== "off" && Boolean(signature) && (params.mode === "always" || !hasSeenSignature);
-  const warningSignaturesSeen = signature && params.mode !== "off" ? appendSeenSignature(seenSignatures, signature) : seenSignatures;
-  return {
-    signature,
-    warningShown,
-    lines: warningShown ? formatBootstrapTruncationWarningLines({
-      analysis: params.analysis,
-      maxFiles: params.maxFiles
-    }) : [],
-    warningSignaturesSeen
-  };
-}
-
-// src/agents/bootstrap-types.ts
-var DEFAULT_AGENTS_FILENAME = "AGENTS.md";
-var DEFAULT_SOUL_DEFAULT_FILENAME = "SOUL.default.md";
-var DEFAULT_SOUL_FILENAME = "SOUL.md";
-var DEFAULT_TOOLS_FILENAME = "TOOLS.md";
-var DEFAULT_IDENTITY_FILENAME = "IDENTITY.md";
-var DEFAULT_USER_FILENAME = "USER.md";
-var DEFAULT_BOOTSTRAP_FILENAME = "BOOTSTRAP.md";
-var DEFAULT_MEMORY_FILENAME = "MEMORY.md";
-
-// src/agents/workspace.ts
-var DEFAULT_WORKSPACE_DIR_NAME = "workspace";
-var DEFAULT_MEMORY_SUBDIR = "memory";
-var STABLE_BOOTSTRAP_FILENAMES = [
-  DEFAULT_AGENTS_FILENAME,
-  DEFAULT_SOUL_DEFAULT_FILENAME,
-  DEFAULT_SOUL_FILENAME,
-  DEFAULT_IDENTITY_FILENAME,
-  DEFAULT_USER_FILENAME,
-  DEFAULT_TOOLS_FILENAME,
-  DEFAULT_BOOTSTRAP_FILENAME
-];
-var DYNAMIC_BOOTSTRAP_FILENAMES = [
-  DEFAULT_MEMORY_FILENAME
-];
-var DEFAULT_BOOTSTRAP_MAX_CHARS = 12000;
-var DEFAULT_BOOTSTRAP_TOTAL_MAX_CHARS = 64000;
-var DEFAULT_DYNAMIC_TOTAL_MAX_CHARS = 24000;
-function resolveAgentWorkspaceDir(agentDir) {
-  return path8.join(agentDir, DEFAULT_WORKSPACE_DIR_NAME);
-}
-async function readOptionalFile(filePath) {
-  try {
-    const content = await readFile2(filePath, "utf8");
-    return content;
-  } catch (err) {
-    if (isErrnoException(err) && (err.code === "ENOENT" || err.code === "EISDIR")) {
-      return;
-    }
-    throw err;
-  }
-}
-function isErrnoException(value) {
-  return value instanceof Error && typeof value.code === "string";
-}
-async function loadNamedFile(workspaceDir, name, relativePath) {
-  const filePath = path8.join(workspaceDir, relativePath ?? name);
-  const content = await readOptionalFile(filePath);
-  if (content === undefined) {
-    return { name, path: filePath, missing: true };
-  }
-  return { name, path: filePath, content, missing: false };
-}
-async function loadStableBootstrapFiles(workspaceDir, options) {
-  const defaultFiles = await Promise.all(STABLE_BOOTSTRAP_FILENAMES.map((name) => loadNamedFile(workspaceDir, name)));
-  const extras = options?.extraStableFiles ?? [];
-  if (extras.length === 0) {
-    return defaultFiles;
-  }
-  const extraFiles = await Promise.all(extras.map((name) => loadNamedFile(workspaceDir, name)));
-  return [...defaultFiles, ...extraFiles];
-}
-async function loadDynamicBootstrapFiles(workspaceDir, options) {
-  const now2 = options?.now ?? new Date;
-  const includeYesterday = options?.includeYesterday ?? true;
-  const files = await Promise.all(DYNAMIC_BOOTSTRAP_FILENAMES.map((name) => loadNamedFile(workspaceDir, name)));
-  const todayRelative = dailyMemoryRelativePath(now2);
-  const todayName = DEFAULT_MEMORY_FILENAME;
-  const today = await loadNamedFile(workspaceDir, todayName, todayRelative);
-  today.path = path8.join(workspaceDir, todayRelative);
-  files.push(today);
-  if (includeYesterday) {
-    const yesterdayRelative = dailyMemoryRelativePath(addDays(now2, -1));
-    const yesterday = await loadNamedFile(workspaceDir, todayName, yesterdayRelative);
-    yesterday.path = path8.join(workspaceDir, yesterdayRelative);
-    files.push(yesterday);
-  }
-  return files;
-}
-function pad22(n) {
-  return n < 10 ? `0${n}` : String(n);
-}
-function dailyMemoryRelativePath(date) {
-  const y = date.getFullYear();
-  const m = pad22(date.getMonth() + 1);
-  const d = pad22(date.getDate());
-  return path8.join(DEFAULT_MEMORY_SUBDIR, `${y}-${m}-${d}.md`);
-}
-function addDays(date, days) {
-  const out = new Date(date.getTime());
-  out.setDate(out.getDate() + days);
-  return out;
-}
-function truncateContent(name, content, maxChars) {
-  if (content.length <= maxChars) {
-    return content;
-  }
-  if (maxChars < 200) {
-    return content.slice(0, Math.max(0, maxChars));
-  }
-  const headRoomInitial = Math.floor(maxChars * 0.7);
-  const sampleMarker = `
-\u2026(truncated ${name}: kept ${headRoomInitial}+${Math.max(0, maxChars - headRoomInitial - 96)} chars of ${content.length})\u2026
-`;
-  const markerReserve = Math.max(64, sampleMarker.length + 8);
-  const headRoom = Math.min(headRoomInitial, Math.max(0, maxChars - markerReserve - 8));
-  const tailRoom = Math.max(0, maxChars - headRoom - markerReserve);
-  const head = content.slice(0, Math.max(0, headRoom));
-  const tail = tailRoom > 0 ? content.slice(content.length - tailRoom) : "";
-  const result = `${head}
-\u2026(truncated ${name}: kept ${headRoom}+${tailRoom} chars of ${content.length})\u2026
-${tail}`;
-  return result.length <= maxChars ? result : result.slice(0, maxChars);
-}
-function projectBootstrapFiles(params) {
-  const {
-    files,
-    heading,
-    budget,
-    seenSignatures,
-    warningMode = "error",
-    warningMaxFiles = DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES
-  } = params;
-  const perFileCap = budget.bootstrapMaxChars;
-  let remainingTotal = budget.bootstrapTotalMaxChars;
-  const injectedFiles = [];
-  const parts = [];
-  for (const file of files) {
-    if (file.missing || typeof file.content !== "string") {
-      continue;
-    }
-    const raw = file.content.trimEnd();
-    if (raw.length === 0) {
-      continue;
-    }
-    const perFileAllowed = Math.min(perFileCap, remainingTotal);
-    if (perFileAllowed <= 0) {
-      break;
-    }
-    const injected = truncateContent(file.name, raw, perFileAllowed);
-    const relativePath = file.path;
-    injectedFiles.push({ path: relativePath, content: injected });
-    parts.push(`## ${relativePath}`);
-    parts.push(injected);
-    remainingTotal -= injected.length;
-    if (remainingTotal <= 0) {
-      break;
-    }
-  }
-  const concatenated = parts.length > 0 ? [heading.trim().length > 0 ? `# ${heading}` : null, ...parts].filter((p) => p !== null).join(`
-
-`) : "";
-  const stats = buildBootstrapInjectionStats({
-    bootstrapFiles: files,
-    injectedFiles
-  });
-  const analysis = analyzeBootstrapBudget({
-    files: stats,
-    bootstrapMaxChars: budget.bootstrapMaxChars,
-    bootstrapTotalMaxChars: budget.bootstrapTotalMaxChars,
-    nearLimitRatio: budget.nearLimitRatio ?? DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO
-  });
-  const warning = buildBootstrapPromptWarning({
-    analysis,
-    mode: warningMode,
-    seenSignatures,
-    maxFiles: warningMaxFiles
-  });
-  if (warningMode === "error" && analysis.hasTruncation) {
-    const errorLines = [
-      "Bootstrap budget exceeded. The following files exceed limits:",
-      ""
-    ];
-    for (const file of analysis.truncatedFiles) {
-      const excessChars = file.rawChars - file.injectedChars;
-      const causes = file.causes.map((c) => c === "per-file-limit" ? `per-file limit (${analysis.totals.bootstrapMaxChars.toLocaleString()} chars)` : `total limit (${analysis.totals.bootstrapTotalMaxChars.toLocaleString()} chars)`);
-      errorLines.push(`  ${file.name}: ${file.rawChars.toLocaleString()} bytes (exceeds ${causes.join(", ")})`);
-      errorLines.push(`    Trim ${excessChars.toLocaleString()} bytes, or pass --warning-mode warn to proceed with truncation.`);
-    }
-    throw new BootstrapBudgetExceededError(analysis, errorLines.join(`
-`));
-  }
-  return { files, injectedFiles, concatenated, analysis, warning };
-}
-async function buildStableBootstrapPrompt(params) {
-  const files = await loadStableBootstrapFiles(params.workspaceDir, {
-    extraStableFiles: params.extraStableFiles
-  });
-  const budget = {
-    bootstrapMaxChars: params.budget?.bootstrapMaxChars ?? DEFAULT_BOOTSTRAP_MAX_CHARS,
-    bootstrapTotalMaxChars: params.budget?.bootstrapTotalMaxChars ?? DEFAULT_BOOTSTRAP_TOTAL_MAX_CHARS,
-    nearLimitRatio: params.budget?.nearLimitRatio
-  };
-  return projectBootstrapFiles({
-    files,
-    heading: "Project Context (stable workspace files)",
-    budget,
-    seenSignatures: params.seenSignatures,
-    warningMode: params.budget?.warningMode,
-    warningMaxFiles: params.budget?.warningMaxFiles
-  });
-}
-async function buildDynamicBootstrapPrompt(params) {
-  const files = await loadDynamicBootstrapFiles(params.workspaceDir, {
-    now: params.now,
-    includeYesterday: params.includeYesterday
-  });
-  const budget = {
-    bootstrapMaxChars: params.budget?.bootstrapMaxChars ?? DEFAULT_BOOTSTRAP_MAX_CHARS,
-    bootstrapTotalMaxChars: params.budget?.bootstrapTotalMaxChars ?? DEFAULT_DYNAMIC_TOTAL_MAX_CHARS,
-    nearLimitRatio: params.budget?.nearLimitRatio
-  };
-  return projectBootstrapFiles({
-    files,
-    heading: "Project Context (dynamic workspace files)",
-    budget,
-    seenSignatures: params.seenSignatures,
-    warningMode: params.budget?.warningMode,
-    warningMaxFiles: params.budget?.warningMaxFiles
-  });
-}
-
 // src/agents/memory-search.ts
 import { readFile as readFile3, readdir, realpath, stat as stat2 } from "node:fs/promises";
 import path9 from "node:path";
@@ -122650,8 +123227,8 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const resolvedWorkspace = resolve55(dir);
-    const target = resolve55(resolvedWorkspace, file ?? "AGENTS.md");
+    const resolvedWorkspace = resolve56(dir);
+    const target = resolve56(resolvedWorkspace, file ?? "AGENTS.md");
     if (!isInsideWorkspace(resolvedWorkspace, target)) {
       process.stderr.write(`workspace edit: refusing path traversal outside workspace dir (${target})
 `);
@@ -122719,8 +123296,8 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const gitDir = resolve55(dir, ".git");
-    if (!existsSync105(gitDir)) {
+    const gitDir = resolve56(dir, ".git");
+    if (!existsSync106(gitDir)) {
       process.stdout.write(`Workspace is not a git repository. Re-run \`switchroom agent create ${agentName}\` ` + `or manually \`git init\` in ${dir} to enable versioning.
 `);
       return;
@@ -122773,8 +123350,8 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const gitDir = resolve55(dir, ".git");
-    if (!existsSync105(gitDir)) {
+    const gitDir = resolve56(dir, ".git");
+    if (!existsSync106(gitDir)) {
       process.stdout.write(`Workspace is not a git repository.
 `);
       return;
@@ -122797,9 +123374,9 @@ function resolveAgentWorkspaceDirOrExit(program3, agentName) {
     return;
   }
   const agentsDir = resolveAgentsDir(config);
-  const agentDir = resolve55(agentsDir, agentName);
+  const agentDir = resolve56(agentsDir, agentName);
   const dir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync105(dir)) {
+  if (!existsSync106(dir)) {
     process.stderr.write(`workspace: ${dir} does not exist yet. Run \`switchroom setup\` or \`switchroom agent scaffold ${agentName}\` to seed it.
 `);
     return;
@@ -122835,8 +123412,8 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync14, existsSync as existsSync106, readFileSync as readFileSync95, writeFileSync as writeFileSync43 } from "node:fs";
-import { join as join110, resolve as resolve56 } from "node:path";
+import { copyFileSync as copyFileSync14, existsSync as existsSync107, readFileSync as readFileSync96, writeFileSync as writeFileSync43 } from "node:fs";
+import { join as join111, resolve as resolve57 } from "node:path";
 init_scaffold();
 init_profiles();
 init_schema();
@@ -122851,9 +123428,9 @@ function resolveSoulTargetOrExit(program3, agentName) {
   const profileName = merged.extends ?? DEFAULT_PROFILE;
   const profilePath = getProfilePath(profileName);
   const agentsDir = resolveAgentsDir(config);
-  const agentDir = resolve56(agentsDir, agentName);
+  const agentDir = resolve57(agentsDir, agentName);
   const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync106(workspaceDir)) {
+  if (!existsSync107(workspaceDir)) {
     console.error(`soul: ${workspaceDir} does not exist yet. Run \`switchroom setup\` ` + `or \`switchroom agent scaffold ${agentName}\` to seed it.`);
     process.exit(1);
   }
@@ -122862,7 +123439,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join110(workspaceDir, "SOUL.md"),
+    soulPath: join111(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -122879,11 +123456,11 @@ function registerSoulCommand(program3) {
     const t = resolveSoulTargetOrExit(program3, agentName);
     if (!t)
       return;
-    if (!existsSync106(t.soulPath)) {
+    if (!existsSync107(t.soulPath)) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
-    process.stdout.write(readFileSync95(t.soulPath, "utf-8"));
+    process.stdout.write(readFileSync96(t.soulPath, "utf-8"));
   }));
   cmd.command("reset <agent>").description("Re-seed SOUL.md from the agent's current profile " + "(backs the existing file up to SOUL.md.bak first)").option("-y, --yes", "Skip the confirmation prompt").action(withConfigError(async (agentName, opts) => {
     const t = resolveSoulTargetOrExit(program3, agentName);
@@ -122894,7 +123471,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: profile "${t.profileName}" ships no SOUL.md.hbs \u2014 ` + `nothing to re-seed from.`);
       process.exit(1);
     }
-    const exists = existsSync106(t.soulPath);
+    const exists = existsSync107(t.soulPath);
     if (exists && !opts.yes) {
       if (!isInteractive()) {
         console.error(`soul: ${t.soulPath} already exists. Re-run with --yes to ` + `replace it (the current file is backed up to SOUL.md.bak).`);
@@ -122909,7 +123486,7 @@ function registerSoulCommand(program3) {
     let backupPath;
     if (exists) {
       backupPath = `${t.soulPath}.bak`;
-      if (existsSync106(backupPath)) {
+      if (existsSync107(backupPath)) {
         backupPath = `${t.soulPath}.bak.${Date.now()}`;
       }
       copyFileSync14(t.soulPath, backupPath);
@@ -122925,279 +123502,6 @@ function registerSoulCommand(program3) {
   }));
 }
 
-// src/cli/debug.ts
-init_helpers();
-init_loader();
-import { existsSync as existsSync107, readFileSync as readFileSync96, readdirSync as readdirSync36, statSync as statSync62 } from "node:fs";
-import { resolve as resolve57, join as join111 } from "node:path";
-import { createHash as createHash21 } from "node:crypto";
-init_merge();
-init_hindsight2();
-function formatBytes(bytes) {
-  return `${bytes.toLocaleString()} bytes`;
-}
-function estimateTokens(bytes) {
-  return Math.round(bytes / 3.7);
-}
-function readMcpServerNames(agentDir) {
-  const mcpPath = join111(agentDir, ".mcp.json");
-  if (!existsSync107(mcpPath))
-    return [];
-  try {
-    const parsed = JSON.parse(readFileSync96(mcpPath, "utf-8"));
-    return Object.keys(parsed.mcpServers ?? {});
-  } catch {
-    return null;
-  }
-}
-function sha2562(content) {
-  return createHash21("sha256").update(content).digest("hex").slice(0, 16);
-}
-function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join111(claudeConfigDir, "projects");
-  if (!existsSync107(projectsDir))
-    return;
-  try {
-    const entries = readdirSync36(projectsDir, { withFileTypes: true });
-    let latest;
-    for (const entry of entries) {
-      if (!entry.isDirectory())
-        continue;
-      const projectPath = join111(projectsDir, entry.name);
-      const transcriptPath = join111(projectPath, "transcript.jsonl");
-      if (!existsSync107(transcriptPath))
-        continue;
-      const stat3 = statSync62(transcriptPath);
-      if (!latest || stat3.mtimeMs > latest.mtime) {
-        latest = { path: transcriptPath, mtime: stat3.mtimeMs };
-      }
-    }
-    return latest?.path;
-  } catch {
-    return;
-  }
-}
-function extractLatestUserMessage(transcriptPath) {
-  try {
-    const content = readFileSync96(transcriptPath, "utf-8");
-    const lines = content.trim().split(`
-`).filter(Boolean);
-    for (let i2 = lines.length - 1;i2 >= 0; i2--) {
-      const line = lines[i2];
-      try {
-        const event = JSON.parse(line);
-        if (event.type === "message" && event.role === "user" && typeof event.content === "string") {
-          const timestamp = event.timestamp ? new Date(event.timestamp).toLocaleString() : "unknown";
-          return { text: event.content, timestamp };
-        }
-      } catch {
-        continue;
-      }
-    }
-  } catch {
-    return;
-  }
-}
-function buildProgressUpdateGuidance() {
-  return `## Progress updates (human-style check-ins)
-
-You're talking to a human colleague on Telegram. Alongside the emoji status
-ladder, send a short \`progress_update\` at inflection points, the moments a
-senior colleague would ping the person who asked them to do something:
-
-- **Plan formed:** "Got it. Going to do X first, then Y, then Z."
-- **Pivot or blocker:** "First approach didn't work because <reason>. Trying
-  <alternative> instead."
-- **Chunk finished:** "Done with X. Starting Y now."
-
-Keep them short (one or two sentences). Don't narrate every step, the pinned
-progress card shows that for free. Don't send an update on a trivial one-shot
-task. Send them when a colleague would genuinely want to know what's happening.
-
-Final answers still go through \`reply\` as usual,
-\`progress_update\` is only for mid-turn check-ins.`;
-}
-function registerDebugCommand(program3) {
-  const cmd = program3.command("debug", { hidden: true }).description("Observability tools for inspecting agent prompt layering [advanced]");
-  cmd.command("turn <agent>").description("Dump the exact prompt layering the model saw on the most recent turn").option("--last <n>", "Show N-th most recent turn instead of latest", "1").action(withConfigError(async (agentName, opts) => {
-    const config = getConfig(program3);
-    const agentConfig = config.agents[agentName];
-    if (!agentConfig) {
-      console.error(`Agent '${agentName}' not found in switchroom.yaml`);
-      process.exit(1);
-    }
-    const agentsDir = resolveAgentsDir(config);
-    const agentDir = resolve57(agentsDir, agentName);
-    if (!existsSync107(agentDir)) {
-      console.error(`Agent directory not found: ${agentDir}`);
-      process.exit(1);
-    }
-    const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join111(agentDir, ".claude");
-    const claudeMdPath2 = join111(agentDir, "CLAUDE.md");
-    const soulMdPath = join111(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join111(workspaceDir, "SOUL.md");
-    const handoffPath = join111(agentDir, ".handoff.md");
-    const lastN = parseInt(opts.last, 10);
-    if (isNaN(lastN) || lastN < 1) {
-      console.error("--last must be a positive integer");
-      process.exit(1);
-    }
-    if (lastN > 1) {
-      console.error("Note: --last N where N > 1 not yet implemented (only latest turn supported)");
-      process.exit(1);
-    }
-    console.log(`=== Debug Turn Dump: ${agentName} ===
-`);
-    console.log(`=== Append System Prompt (stable) ===
-`);
-    const resolved = resolveAgentConfig(config.defaults, config.profiles, agentConfig);
-    const useHotReloadStable = resolved.channels?.telegram?.hotReloadStable === true;
-    const stableResult = await buildStableBootstrapPrompt({
-      workspaceDir,
-      budget: { warningMode: "off" }
-    });
-    if (useHotReloadStable) {
-      console.log(`-- Workspace Stable Render (not used \u2014 stable content is in per-turn hook) --`);
-      console.log();
-    } else if (stableResult.concatenated.trim().length > 0) {
-      console.log(`-- Workspace Stable Render (${formatBytes(stableResult.concatenated.length)}) --`);
-      console.log(stableResult.concatenated);
-      console.log();
-    } else {
-      console.log("-- Workspace Stable Render (0 bytes, not set up) --");
-      console.log();
-    }
-    const useSwitchroomPlugin = usesSwitchroomTelegramPlugin(resolved);
-    const progressGuidance = useSwitchroomPlugin ? buildProgressUpdateGuidance() : "";
-    if (progressGuidance.length > 0) {
-      console.log(`-- Progress Updates Guidance (${formatBytes(progressGuidance.length)}) --`);
-      console.log(progressGuidance);
-      console.log();
-    }
-    const baseSystemPromptAppend = resolved.system_prompt_append ?? "";
-    if (baseSystemPromptAppend.trim().length > 0) {
-      console.log(`-- User System Prompt Append (${formatBytes(baseSystemPromptAppend.length)}) --`);
-      console.log(baseSystemPromptAppend);
-      console.log();
-    }
-    console.log(`=== Append System Prompt (per-session) ===
-`);
-    const handoffContent = existsSync107(handoffPath) ? readFileSync96(handoffPath, "utf-8") : "";
-    if (handoffContent.trim().length > 0) {
-      console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
-      console.log(handoffContent);
-      console.log();
-    } else {
-      console.log("-- Handoff Briefing (0 bytes, no prior session) --");
-      console.log();
-    }
-    console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
-`);
-    const claudeMdContent = existsSync107(claudeMdPath2) ? readFileSync96(claudeMdPath2, "utf-8") : "";
-    if (claudeMdContent.trim().length > 0) {
-      console.log(`(${formatBytes(claudeMdContent.length)})`);
-      console.log(claudeMdContent);
-      console.log();
-    } else {
-      console.log("(0 bytes, not present)");
-      console.log();
-    }
-    console.log(`=== Persona (SOUL.md) ===
-`);
-    const soulMdContent = existsSync107(soulMdPath) ? readFileSync96(soulMdPath, "utf-8") : existsSync107(workspaceSoulMdPath) ? readFileSync96(workspaceSoulMdPath, "utf-8") : "";
-    if (soulMdContent.trim().length > 0) {
-      console.log(`(${formatBytes(soulMdContent.length)})`);
-      console.log(soulMdContent);
-      console.log();
-    } else {
-      console.log("(0 bytes, stale placeholder \u2014 Phase 2 item: single source of truth for persona)");
-      console.log();
-    }
-    console.log(`=== Per-Turn Injections (UserPromptSubmit) ===
-`);
-    if (useHotReloadStable) {
-      if (stableResult.concatenated.trim().length > 0) {
-        console.log(`-- Workspace Stable (hot-reload hook): ${formatBytes(stableResult.concatenated.length)} --`);
-        console.log(stableResult.concatenated);
-        console.log();
-      } else {
-        console.log("-- Workspace Stable (hot-reload hook): 0 bytes, not set up --");
-        console.log();
-      }
-    }
-    const dynamicResult = await buildDynamicBootstrapPrompt({
-      workspaceDir,
-      budget: { warningMode: "off" }
-    });
-    if (dynamicResult.concatenated.trim().length > 0) {
-      console.log(`-- Workspace Dynamic: fired, ${formatBytes(dynamicResult.concatenated.length)} --`);
-      console.log(dynamicResult.concatenated);
-      console.log();
-    } else {
-      console.log("-- Workspace Dynamic: no content (MEMORY.md and daily notes empty or missing) --");
-      console.log();
-    }
-    const hindsightEnabled = isHindsightEnabled(config) && agentConfig.memory?.auto_recall !== false;
-    if (hindsightEnabled) {
-      console.log("-- Hindsight Recall: enabled (exact content unavailable, check hindsight logs) --");
-      console.log();
-    } else {
-      console.log("-- Hindsight Recall: disabled --");
-      console.log();
-    }
-    console.log(`=== User Message (latest turn) ===
-`);
-    const transcriptPath = findLatestTranscriptJsonl(claudeConfigDir);
-    const userMessage = transcriptPath ? extractLatestUserMessage(transcriptPath) : undefined;
-    if (userMessage) {
-      console.log(`(Turn timestamp: ${userMessage.timestamp})`);
-      console.log(userMessage.text);
-      console.log();
-    } else {
-      console.log("(unavailable: no transcript found or transcript empty)");
-      console.log();
-    }
-    console.log(`=== Totals ===
-`);
-    const stableBytes = stableResult.concatenated.length + progressGuidance.length + baseSystemPromptAppend.length;
-    const perSessionBytes = handoffContent.length;
-    const claudeMdBytes = claudeMdContent.length;
-    const soulMdBytes = soulMdContent.length;
-    const perTurnBytes = dynamicResult.concatenated.length;
-    const userBytes = userMessage?.text.length ?? 0;
-    const fleetDir = join111(agentsDir, "..", "fleet");
-    const fleetInvPath = join111(fleetDir, "switchroom-invariants.md");
-    const fleetClaudePath = join111(fleetDir, "CLAUDE.md");
-    const fleetInvBytes = existsSync107(fleetInvPath) ? readFileSync96(fleetInvPath, "utf-8").length : 0;
-    const fleetClaudeBytes = existsSync107(fleetClaudePath) ? readFileSync96(fleetClaudePath, "utf-8").length : 0;
-    const fleetBytes = fleetInvBytes + fleetClaudeBytes;
-    const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
-    console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
-    console.log(`Per-session:       ${formatBytes(perSessionBytes).padEnd(20)} (cache-warm until next session)`);
-    console.log(`CLAUDE.md (cwd):   ${formatBytes(claudeMdBytes).padEnd(20)} (cache-hot)`);
-    console.log(`Fleet invariants:  ${formatBytes(fleetBytes).padEnd(20)} (--add-dir, cache-hot)`);
-    console.log(`Per-turn:          ${formatBytes(perTurnBytes).padEnd(20)} (never cached \u2014 the real per-turn $ cost)`);
-    console.log(`User message:      ${formatBytes(userBytes).padEnd(20)}`);
-    console.log(`Authored text:     ${formatBytes(totalBytes).padEnd(20)} (~${estimateTokens(totalBytes).toLocaleString()} tokens est.)`);
-    const mcpServers = readMcpServerNames(agentDir);
-    const mcpCount = mcpServers?.length ?? null;
-    const mcpEstK = mcpCount != null ? mcpCount * 3 : null;
-    const mcpLabel = mcpCount != null ? `${mcpCount} servers` : "(unreadable \u2014 agent-private .mcp.json)";
-    const mcpEstLabel = mcpEstK != null ? `~${mcpEstK.toLocaleString()}k tok` : "~30k tok (audit est.)";
-    console.log(`MCP tool surface:  ${mcpLabel.padEnd(20)} (NOT counted above; ~3k tok/server \u2248 ${mcpEstLabel} \u2014 deferred under tool search)`);
-    if (mcpServers && mcpServers.length > 0) {
-      console.log(`                   [${mcpServers.join(", ")}]`);
-    }
-    const floorMcp = mcpEstK != null ? `~${mcpEstK.toLocaleString()}k` : "~30k";
-    console.log(`Per-turn FLOOR:    ${`~${estimateTokens(totalBytes).toLocaleString()} + ${floorMcp} MCP + ~13k CLI-base`.padEnd(20)} tokens est. (before the user msg, recall, or tool results)`);
-    const stableCacheInput = stableResult.concatenated + progressGuidance + baseSystemPromptAppend;
-    const stableHash = sha2562(stableCacheInput);
-    console.log(`Cache stable hash: sha256:${stableHash}`);
-    console.log();
-  }));
-}
-
 // src/cli/worktree.ts
 init_source();
 init_claim();
@@ -126158,6 +126462,19 @@ function clampKnowledgeSearchLimit(limit) {
   }
   return Math.min(KNOWLEDGE_SEARCH_LIMIT_MAX, Math.max(KNOWLEDGE_SEARCH_LIMIT_MIN, Math.trunc(limit)));
 }
+
+class KnowledgeBankNotGrantedError extends Error {
+  requested;
+  ownBankId;
+  grantedBanks;
+  constructor(requested, ownBankId, grantedBanks) {
+    super(grantedBanks.length > 0 ? `bank_id '${requested}' is not a bank you can read. You may read your ` + `own bank ('${ownBankId}') or an operator-granted bank ` + `(${grantedBanks.map((b) => `'${b}'`).join(", ")}); '${requested}' ` + `is none of these. Omit bank_id to read your own memory bank.` : `bank_id '${requested}' is not your own bank ('${ownBankId}'), and ` + `this agent has not been granted any other bank to read. Omit ` + `bank_id to read your own memory bank.`);
+    this.requested = requested;
+    this.ownBankId = ownBankId;
+    this.grantedBanks = grantedBanks;
+    this.name = "KnowledgeBankNotGrantedError";
+  }
+}
 var KNOWLEDGE_ADMIN_TIMEOUT_MS = 15000;
 var KNOWLEDGE_PAGE_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
 
@@ -126169,11 +126486,22 @@ class KnowledgeAdmin {
   get fetchImpl() {
     return this.opts.fetchImpl ?? fetch;
   }
-  knowledgeBasePath() {
+  resolveBank(requested) {
+    const own = this.opts.bankId;
+    if (requested === undefined || requested === "" || requested === own) {
+      return own;
+    }
+    if ((this.opts.extraBanks ?? []).includes(requested))
+      return requested;
+    throw new KnowledgeBankNotGrantedError(requested, own, [
+      ...this.opts.extraBanks ?? []
+    ]);
+  }
+  knowledgeBasePath(bankId) {
     const base = this.opts.apiBaseUrl.replace(/\/+$/, "");
-    return `${base}/v1/default/banks/${encodeURIComponent(this.opts.bankId)}/knowledge-base`;
+    return `${base}/v1/default/banks/${encodeURIComponent(bankId)}/knowledge-base`;
   }
-  async get(url) {
+  async get(url, bankId) {
     const ctl = new AbortController;
     const timer = setTimeout(() => ctl.abort(), this.opts.timeoutMs ?? KNOWLEDGE_ADMIN_TIMEOUT_MS);
     try {
@@ -126181,7 +126509,7 @@ class KnowledgeAdmin {
         method: "GET",
         headers: {
           accept: "application/json",
-          ...this.opts.bankId ? { "X-Bank-Id": this.opts.bankId } : {}
+          ...bankId ? { "X-Bank-Id": bankId } : {}
         },
         signal: ctl.signal
       });
@@ -126190,13 +126518,14 @@ class KnowledgeAdmin {
     }
   }
   async search(args) {
+    const bank = this.resolveBank(args.bankId);
     const params = new URLSearchParams({
       q: args.query,
       limit: String(clampKnowledgeSearchLimit(args.limit))
     });
-    const res = await this.get(`${this.knowledgeBasePath()}/search?${params}`);
+    const res = await this.get(`${this.knowledgeBasePath(bank)}/search?${params}`, bank);
     if (!res.ok) {
-      throw new Error(`searching knowledge pages in bank '${this.opts.bankId}' failed: HTTP ${res.status}`);
+      throw new Error(`searching knowledge pages in bank '${bank}' failed: HTTP ${res.status}`);
     }
     const parsed = await res.json();
     const results = Array.isArray(parsed.results) ? parsed.results : [];
@@ -126209,23 +126538,25 @@ class KnowledgeAdmin {
     if (!KNOWLEDGE_PAGE_ID_PATTERN.test(args.page_id)) {
       throw new Error(`'${args.page_id}' is not a knowledge page id. Ids look like ` + `'kp-<hex>' (letters, digits, '-' and '_' only) and come from ` + `search_knowledge_pages or get_knowledge_tree.`);
     }
-    const res = await this.get(`${this.knowledgeBasePath()}/pages/${encodeURIComponent(args.page_id)}`);
+    const bank = this.resolveBank(args.bankId);
+    const res = await this.get(`${this.knowledgeBasePath(bank)}/pages/${encodeURIComponent(args.page_id)}`, bank);
     if (res.status === 404) {
-      throw new Error(`no knowledge page '${args.page_id}' in bank '${this.opts.bankId}'. ` + `Page ids come from search_knowledge_pages or get_knowledge_tree.`);
+      throw new Error(`no knowledge page '${args.page_id}' in bank '${bank}'. ` + `Page ids come from search_knowledge_pages or get_knowledge_tree.`);
     }
     if (!res.ok) {
-      throw new Error(`reading knowledge page '${args.page_id}' in bank ` + `'${this.opts.bankId}' failed: HTTP ${res.status}`);
+      throw new Error(`reading knowledge page '${args.page_id}' in bank ` + `'${bank}' failed: HTTP ${res.status}`);
     }
     const page = await res.json();
     if (typeof page.markdown !== "string") {
-      throw new Error(`knowledge page '${args.page_id}' in bank '${this.opts.bankId}' came ` + `back with no markdown body \u2014 the response had no string 'markdown' ` + `field, so there is nothing to read.`);
+      throw new Error(`knowledge page '${args.page_id}' in bank '${bank}' came ` + `back with no markdown body \u2014 the response had no string 'markdown' ` + `field, so there is nothing to read.`);
     }
     return page;
   }
-  async tree() {
-    const res = await this.get(`${this.knowledgeBasePath()}/tree`);
+  async tree(args = {}) {
+    const bank = this.resolveBank(args.bankId);
+    const res = await this.get(`${this.knowledgeBasePath(bank)}/tree`, bank);
     if (!res.ok) {
-      throw new Error(`listing the knowledge tree in bank '${this.opts.bankId}' failed: HTTP ${res.status}`);
+      throw new Error(`listing the knowledge tree in bank '${bank}' failed: HTTP ${res.status}`);
     }
     const parsed = await res.json();
     return { roots: Array.isArray(parsed.roots) ? parsed.roots : [] };
@@ -126278,6 +126609,10 @@ var FALLBACK_TOOL_TABLE = {
   update_memory: [["memory_id"], ["bank_id", "context", "entities", "fact_type", "memory_id", "occurred_end", "occurred_start", "text"]],
   update_mental_model: [["mental_model_id"], ["bank_id", "max_tokens", "mental_model_id", "name", "source_query", "tags", "trigger_refresh_after_consolidation"]]
 };
+var KNOWLEDGE_BANK_SELECTOR_PROP = {
+  type: "string",
+  description: "Optional. Which memory bank to read. Omit to read YOUR OWN bank (the " + "default). You may name another bank ONLY if your operator has granted " + "it to you (e.g. a shared repo knowledge bank); naming any other bank is " + "rejected."
+};
 var SYNTHESIZED_TOOL_TABLE = {
   deactivate_directive: {
     description: "Retire one of YOUR OWN standing directives by setting is_active=false, " + "so it stops being injected as a hard rule. Reversible with " + "reactivate_directive; the directive and its text are preserved. Pass " + "superseded_by when another directive replaces this one \u2014 both get " + "provenance tags recording the supersession. Operates only on your own " + "memory bank and changes nothing but the active flag and those tags.",
@@ -126304,7 +126639,7 @@ var SYNTHESIZED_TOOL_TABLE = {
     }
   },
   search_knowledge_pages: {
-    description: "Search YOUR OWN knowledge pages \u2014 the curated, continuously-refreshed " + "summaries of what this bank knows \u2014 with hybrid full-text + semantic " + "search. Reach for this before re-deriving a standing answer from raw " + "recall: a page is already synthesized, where recall returns fragments. " + "Returns ranked hits with a relevance snippet and a page id; read the " + "whole page with get_knowledge_page. Read-only, and only ever your own " + "memory bank. An empty knowledge base returns no results, not an error.",
+    description: "Search knowledge pages \u2014 the curated, continuously-refreshed " + "summaries of what a bank knows \u2014 with hybrid full-text + semantic " + "search. Reach for this before re-deriving a standing answer from raw " + "recall: a page is already synthesized, where recall returns fragments. " + "Returns ranked hits with a relevance snippet and a page id; read the " + "whole page with get_knowledge_page. Read-only. Defaults to your own " + "bank; pass bank_id to search an operator-granted bank. An empty " + "knowledge base returns no results, not an error.",
     required: ["query"],
     props: {
       query: {
@@ -126316,23 +126651,27 @@ var SYNTHESIZED_TOOL_TABLE = {
         minimum: KNOWLEDGE_SEARCH_LIMIT_MIN,
         maximum: KNOWLEDGE_SEARCH_LIMIT_MAX,
         description: `Maximum hits to return (${KNOWLEDGE_SEARCH_LIMIT_MIN}-` + `${KNOWLEDGE_SEARCH_LIMIT_MAX}, default ${KNOWLEDGE_SEARCH_LIMIT_DEFAULT}).`
-      }
+      },
+      bank_id: KNOWLEDGE_BANK_SELECTOR_PROP
     }
   },
   get_knowledge_page: {
-    description: "Read one of YOUR OWN knowledge pages in full, by the page id returned " + "by search_knowledge_pages or get_knowledge_tree. Returns the complete " + "markdown document (YAML frontmatter + synthesized body). Prefer this " + "over rebuilding the same understanding from scratch. Read-only: it " + "returns the page as it currently stands and never triggers a refresh.",
+    description: "Read one knowledge page in full, by the page id returned by " + "search_knowledge_pages or get_knowledge_tree. Returns the complete " + "markdown document (YAML frontmatter + synthesized body). Prefer this " + "over rebuilding the same understanding from scratch. Read-only: it " + "returns the page as it currently stands and never triggers a refresh. " + "Defaults to your own bank; pass bank_id (matching the tree/search call " + "the id came from) to read from an operator-granted bank.",
     required: ["page_id"],
     props: {
       page_id: {
         type: "string",
         description: "Id of the page to read, from search_knowledge_pages or " + "get_knowledge_tree."
-      }
+      },
+      bank_id: KNOWLEDGE_BANK_SELECTOR_PROP
     }
   },
   get_knowledge_tree: {
-    description: "List YOUR OWN knowledge base as a folder/page tree \u2014 every page's id, " + "name, source query, tags and staleness flag. Call this to see what " + "this bank already knows before reading anything else; is_stale=true " + "means the page MAY be behind newer memories, not that it is wrong. " + "Read-only, and only ever your own memory bank.",
+    description: "List a knowledge base as a folder/page tree \u2014 every page's id, " + "name, source query, tags and staleness flag. Call this to see what " + "a bank already knows before reading anything else; is_stale=true " + "means the page MAY be behind newer memories, not that it is wrong. " + "Read-only. Defaults to your own bank; pass bank_id to list an " + "operator-granted bank.",
     required: [],
-    props: {}
+    props: {
+      bank_id: KNOWLEDGE_BANK_SELECTOR_PROP
+    }
   }
 };
 var SYNTHESIZED_TOOL_NAMES = Object.keys(SYNTHESIZED_TOOL_TABLE);
@@ -126936,6 +127275,7 @@ class HindsightShim {
       this.knowledgeAdminCache = new KnowledgeAdmin({
         apiBaseUrl: this.opts.apiBaseUrl ?? this.opts.url.replace(/\/mcp\/?$/, ""),
         bankId: this.opts.bankId,
+        ...this.opts.extraBanks ? { extraBanks: this.opts.extraBanks } : {},
         ...this.opts.fetchImpl ? { fetchImpl: this.opts.fetchImpl } : {}
       });
     }
@@ -126979,6 +127319,15 @@ class HindsightShim {
     if (!this.opts.bankId) {
       return fail4(`${name} is unavailable: this agent has no HINDSIGHT_BANK_ID, so ` + "there is no bank to pin it to.");
     }
+    if (typeof clean3.bank_id === "string") {
+      const requested = clean3.bank_id;
+      const granted = requested === this.opts.bankId || (this.opts.extraBanks ?? []).includes(requested);
+      if (!granted) {
+        return fail4(new KnowledgeBankNotGrantedError(requested, this.opts.bankId, [
+          ...this.opts.extraBanks ?? []
+        ]).message);
+      }
+    }
     const preflight = await this.contractPin.preflight(name);
     if (!preflight.ok)
       return fail4(preflight.text);
@@ -126986,6 +127335,9 @@ class HindsightShim {
       const text = await this.runSynthesized(name, clean3);
       return { content: [{ type: "text", text }], isError: false };
     } catch (err) {
+      if (err instanceof KnowledgeBankNotGrantedError) {
+        return fail4(err.message);
+      }
       if (err instanceof DirectivePairInconsistentError) {
         this.log(`[hindsight-shim] ${err.message}`);
       }
@@ -127004,23 +127356,25 @@ class HindsightShim {
       case "search_knowledge_pages": {
         const res = await this.knowledgeAdmin.search({
           query: args.query,
-          ...typeof args.limit === "number" ? { limit: args.limit } : {}
+          ...typeof args.limit === "number" ? { limit: args.limit } : {},
+          ...typeof args.bank_id === "string" ? { bankId: args.bank_id } : {}
         });
         if (res.results.length === 0) {
-          return "No knowledge pages matched that query in your memory bank. " + "The bank may have no pages yet \u2014 get_knowledge_tree lists what " + "exists.";
+          return "No knowledge pages matched that query in " + (typeof args.bank_id === "string" ? `bank '${args.bank_id}'. ` : "your memory bank. ") + "The bank may have no pages yet \u2014 get_knowledge_tree lists what " + "exists.";
         }
         return capKnowledgeResponse(JSON.stringify({ total: res.total, results: res.results }, null, 2));
       }
       case "get_knowledge_page": {
         const page = await this.knowledgeAdmin.getPage({
-          page_id: args.page_id
+          page_id: args.page_id,
+          ...typeof args.bank_id === "string" ? { bankId: args.bank_id } : {}
         });
         return capKnowledgeResponse(page.markdown);
       }
       case "get_knowledge_tree": {
-        const tree = await this.knowledgeAdmin.tree();
+        const tree = await this.knowledgeAdmin.tree(typeof args.bank_id === "string" ? { bankId: args.bank_id } : {});
         if (tree.roots.length === 0) {
-          return "Your knowledge base has no pages yet. Pages are synthesized from " + "mental models \u2014 propose one to start it.";
+          return typeof args.bank_id === "string" ? `Bank '${args.bank_id}' has no knowledge pages yet.` : "Your knowledge base has no pages yet. Pages are synthesized " + "from mental models \u2014 propose one to start it.";
         }
         return renderKnowledgeTree(tree.roots);
       }
@@ -127134,9 +127488,11 @@ class HindsightShim {
 }
 function resolveShimOptionsFromEnv(env2) {
   const home2 = env2.HOME && env2.HOME !== "/" ? env2.HOME : tmpdir6();
+  const extraBanks = (env2.HINDSIGHT_KNOWLEDGE_EXTRA_BANKS ?? "").split(",").map((b) => b.trim()).filter((b) => b.length > 0 && b !== (env2.HINDSIGHT_BANK_ID || ""));
   return {
     url: env2.HINDSIGHT_MCP_URL || HINDSIGHT_DEFAULT_MCP_URL,
     bankId: env2.HINDSIGHT_BANK_ID || "",
+    ...extraBanks.length > 0 ? { extraBanks } : {},
     cacheDir: env2.HINDSIGHT_SHIM_CACHE_DIR || join117(home2, ".hindsight-shim")
   };
 }