switchroom 0.21.17 → 0.21.19

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.21.17", COMMIT_SHA = "ac61272c", COMMIT_DATE = "2026-08-17T16:42:58Z";
+var VERSION = "0.21.19", COMMIT_SHA = "7e7061ba", COMMIT_DATE = "2026-08-18T15:36:04Z";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -21340,6 +21340,60 @@ function renderHindsightHooksOverrides(raw, tunables) {
   return JSON.stringify(root, null, 2) + `
 `;
 }
+function readHooksPrefetchAsyncTimeout(raw) {
+  const absent = { present: false, async: false, timeout: null };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return absent;
+  }
+  const hooks = parsed?.hooks;
+  if (hooks == null || typeof hooks !== "object")
+    return absent;
+  const matchers = hooks.Stop;
+  if (!Array.isArray(matchers))
+    return absent;
+  for (const matcher of matchers) {
+    const inner = matcher?.hooks;
+    if (!Array.isArray(inner))
+      continue;
+    for (const hook of inner) {
+      const h = hook;
+      if (h == null || typeof h.command !== "string")
+        continue;
+      if (!h.command.includes(PREFETCH_HOOK_COMMAND_MARKER))
+        continue;
+      return {
+        present: true,
+        async: h.async === true,
+        timeout: typeof h.timeout === "number" ? h.timeout : null
+      };
+    }
+  }
+  return absent;
+}
+function validatePrefetchAsyncTimeout(shape, prefetchRecallTimeoutSeconds) {
+  const problems = [];
+  if (!shape.present) {
+    problems.push("hooks/hooks.json registers no Stop hook for prefetch.py (the async " + "recall-prefetch producer)");
+    return problems;
+  }
+  if (!shape.async) {
+    problems.push('the prefetch.py Stop hook is not marked `"async": true` \u2014 a synchronous ' + "prefetch blocks every turn's completion for up to its timeout");
+  }
+  if (shape.timeout === null || shape.timeout <= 0) {
+    problems.push("the prefetch.py Stop hook has no positive `timeout` (async ceiling) \u2014 a " + "wedged producer would never be reaped");
+    return problems;
+  }
+  if (shape.timeout > MAX_PREFETCH_ASYNC_TIMEOUT_SECONDS) {
+    problems.push(`the prefetch.py async ceiling is ${shape.timeout}s, above the ` + `${MAX_PREFETCH_ASYNC_TIMEOUT_SECONDS}s maximum \u2014 a wedged producer holds a ` + `background slot for that long`);
+  }
+  if (prefetchRecallTimeoutSeconds >= shape.timeout) {
+    problems.push(`memoryPrefetchTimeoutSeconds ${prefetchRecallTimeoutSeconds}s is >= the ` + `${shape.timeout}s async hook ceiling \u2014 the producer's own recall can outlive ` + `its hook and be SIGKILLed mid buffer-write, leaving a torn buffer`);
+  }
+  return problems;
+}
 function readHooksRecallTimeout(raw) {
   let parsed;
   try {
@@ -21368,7 +21422,7 @@ function readHooksRecallTimeout(raw) {
   }
   return null;
 }
-var DEFAULT_RECALL_HOOK_TIMEOUT_SECONDS = 12, DEFAULT_RECALL_MAX_MEMORIES = 8, RECALL_DEADLINE_HEADROOM_SECONDS = 2, MIN_RECALL_HOOK_TIMEOUT_SECONDS, DEFAULT_RECALL_REQUEST_TIMEOUT_SECONDS = 12, MANAGED_HOOK_EVENT = "UserPromptSubmit", RECALL_HOOK_COMMAND_MARKER = "recall.py";
+var DEFAULT_RECALL_HOOK_TIMEOUT_SECONDS = 12, DEFAULT_RECALL_MAX_MEMORIES = 8, RECALL_DEADLINE_HEADROOM_SECONDS = 2, MIN_RECALL_HOOK_TIMEOUT_SECONDS, DEFAULT_RECALL_REQUEST_TIMEOUT_SECONDS = 12, MANAGED_HOOK_EVENT = "UserPromptSubmit", RECALL_HOOK_COMMAND_MARKER = "recall.py", PREFETCH_HOOK_COMMAND_MARKER = "prefetch.py", MAX_PREFETCH_ASYNC_TIMEOUT_SECONDS = 30;
 var init_hindsight_recall_tunables = __esm(() => {
   init_hindsight_recall_passthrough();
   MIN_RECALL_HOOK_TIMEOUT_SECONDS = RECALL_DEADLINE_HEADROOM_SECONDS + 1;
@@ -28559,6 +28613,25 @@ class DirectiveAdmin {
     });
     return `Deactivated directive '${target.name}' (id ${target.id}) in bank ` + `'${this.opts.bankId}', tagged ${args.tag}.`;
   }
+  async deactivateAllActiveByName(args) {
+    const all = await this.list();
+    const named = all.filter((d) => d.name === args.name);
+    if (named.length === 0) {
+      const known = all.map((d) => d.name).sort().join(", ");
+      throw new Error(`no directive named '${args.name}' in bank '${this.opts.bankId}' ` + `(the directive to deactivate). Known directives: ${known || "(none)"}`);
+    }
+    const active = named.filter((d) => d.is_active !== false);
+    const alreadyInactive = named.filter((d) => d.is_active === false).map((d) => ({ id: d.id, name: d.name, priority: d.priority }));
+    for (const d of active)
+      this.refuseIfRulesBlock(d);
+    const deactivated = [];
+    for (const d of active) {
+      if (!args.dryRun)
+        await this.deactivateResolved(all, d);
+      deactivated.push({ id: d.id, name: d.name, priority: d.priority });
+    }
+    return { deactivated, alreadyInactive, dryRun: args.dryRun ?? false };
+  }
   async reactivate(args) {
     const all = await this.list();
     const target = this.resolve(all, args.name, "the directive to reactivate");
@@ -63701,6 +63774,49 @@ function detectHindsightRecallTunableDrift(name, agentConfig, agentDir, config)
   }
   return findings;
 }
+function detectPrefetchAsyncTimeoutDrift(name, agentConfig, agentDir, config) {
+  if (!isHindsightEnabled(config))
+    return [];
+  const resolved = resolveAgentConfig(config.defaults, config.profiles, agentConfig);
+  if (resolved.memory?.auto_recall === false)
+    return [];
+  const pluginDir = join66(agentDir, ".claude", "plugins", "hindsight-memory");
+  if (!existsSync69(pluginDir))
+    return [];
+  const settingsPath = join66(pluginDir, "settings.json");
+  if (!existsSync69(settingsPath))
+    return [];
+  let settings = null;
+  try {
+    settings = JSON.parse(readFileSync62(settingsPath, "utf-8"));
+  } catch {
+    return [];
+  }
+  if (settings?.memoryPrefetchEnabled !== true)
+    return [];
+  const hooksPath = join66(pluginDir, "hooks", "hooks.json");
+  if (!existsSync69(hooksPath))
+    return [];
+  let shape;
+  try {
+    shape = readHooksPrefetchAsyncTimeout(readFileSync62(hooksPath, "utf-8"));
+  } catch {
+    return [];
+  }
+  const rawPrefetchTimeout = settings.memoryPrefetchTimeoutSeconds;
+  const prefetchRecallTimeout = typeof rawPrefetchTimeout === "number" && Number.isFinite(rawPrefetchTimeout) && rawPrefetchTimeout > 0 ? rawPrefetchTimeout : 5;
+  const problems = validatePrefetchAsyncTimeout(shape, prefetchRecallTimeout);
+  if (problems.length === 0)
+    return [];
+  return [
+    {
+      surface: "memory-prefetch",
+      agent: name,
+      detail: `async recall-prefetch (memoryPrefetchEnabled) is ON but its async-timeout ` + `config is unsafe: ${problems.join("; ")}`,
+      fix: "Re-stamp the plugin (`switchroom apply`) so hooks.json carries the " + '`prefetch.py` Stop hook with `"async": true` and a timeout above ' + "memoryPrefetchTimeoutSeconds, or set memoryPrefetchEnabled off until the " + "async ceiling is corrected \u2014 a wedged prefetch either blocks the turn or " + "is killed mid buffer-write."
+    }
+  ];
+}
 function writeDriftReport(agentDir, findings) {
   try {
     const report = {
@@ -63724,6 +63840,7 @@ function detectAgentDrift(name, agentConfigRaw, agentsDir, config, configPath, o
   }));
   findings.push(...detectSkillsDrift(name, agentDir));
   findings.push(...detectHindsightRecallTunableDrift(name, agentConfig, agentDir, config));
+  findings.push(...detectPrefetchAsyncTimeoutDrift(name, agentConfig, agentDir, config));
   if (!opts.skipContainerProbes) {
     findings.push(...detectHookScriptDrift(name, {
       binDir: opts.binDir,
@@ -71736,11 +71853,11 @@ var init_apply = __esm(() => {
 });
 
 // src/host-control/audit-reader.ts
-import { closeSync as closeSync15, existsSync as existsSync83, openSync as openSync15, readSync as readSync5, statSync as statSync49 } from "node:fs";
+import { closeSync as closeSync15, existsSync as existsSync84, openSync as openSync15, readSync as readSync5, statSync as statSync50 } from "node:fs";
 import { homedir as homedir43 } from "node:os";
-import { join as join90 } from "node:path";
+import { join as join91 } from "node:path";
 function defaultAuditLogPath2(home2 = homedir43()) {
-  return join90(home2, ".switchroom", "host-control-audit.log");
+  return join91(home2, ".switchroom", "host-control-audit.log");
 }
 function auditRotation() {
   return resolveRotationConfig({
@@ -71757,14 +71874,14 @@ function auditReadFullWindowBytes() {
 function auditReadMaxGenerations() {
   return auditRotation().maxFiles;
 }
-function tailBytes(path7, n, strict = false) {
+function tailBytes(path9, n, strict = false) {
   if (n <= 0)
     return "";
   let fd;
   let size;
   try {
-    size = statSync49(path7).size;
-    fd = openSync15(path7, "r");
+    size = statSync50(path9).size;
+    fd = openSync15(path9, "r");
   } catch (err) {
     if (strict && err.code !== "ENOENT")
       throw err;
@@ -71809,7 +71926,7 @@ function readAuditRaw(logPath, opts = {}) {
   budget -= Buffer.byteLength(active, "utf-8");
   for (let n = 1;n <= maxFiles && budget > 0; n++) {
     const gen = `${logPath}.${n}`;
-    if (!existsSync83(gen))
+    if (!existsSync84(gen))
       break;
     const chunk2 = tailBytes(gen, budget, strict);
     if (chunk2.length === 0)
@@ -71987,16 +72104,16 @@ var init_audit_reader = __esm(() => {
 });
 
 // src/web/fleet-health-read.ts
-import { readFileSync as readFileSync78 } from "node:fs";
-import { resolve as resolve45 } from "node:path";
+import { readFileSync as readFileSync79 } from "node:fs";
+import { resolve as resolve46 } from "node:path";
 import { homedir as homedir46 } from "node:os";
 function fleetHealthLedgerPath(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir46()) {
-  return resolve45(home2, ".switchroom", "fleet-health", "ledger.json");
+  return resolve46(home2, ".switchroom", "fleet-health", "ledger.json");
 }
-function readFleetHealth(path7) {
+function readFleetHealth(path9) {
   let ledger;
   try {
-    ledger = JSON.parse(readFileSync78(path7, "utf-8"));
+    ledger = JSON.parse(readFileSync79(path9, "utf-8"));
   } catch {
     return {
       owner_agent: null,
@@ -72022,8 +72139,8 @@ function readFleetHealth(path7) {
     ...ranked.length === 0 ? { reason: EMPTY_REASON } : {}
   };
 }
-function handleGetFleetHealth(path7 = fleetHealthLedgerPath()) {
-  return readFleetHealth(path7);
+function handleGetFleetHealth(path9 = fleetHealthLedgerPath()) {
+  return readFleetHealth(path9);
 }
 var EMPTY_REASON;
 var init_fleet_health_read = __esm(() => {
@@ -110258,8 +110375,8 @@ init_loader();
 init_hindsight();
 var import_yaml16 = __toESM(require_dist(), 1);
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync82, readFileSync as readFileSync74, statSync as statSync48 } from "node:fs";
-import { join as join88 } from "node:path";
+import { existsSync as existsSync83, readFileSync as readFileSync75, statSync as statSync49 } from "node:fs";
+import { join as join89 } from "node:path";
 
 // src/cli/memory-rules.ts
 init_source();
@@ -110495,6 +110612,37 @@ function registerMemoryDirectiveCommand(memory, program3) {
       process.exit(1);
     }
   }));
+  directive.command("deactivate <agent> <name>").description("Deactivate every ACTIVE directive named <name> in <agent>'s bank by " + "flipping is_active=false \u2014 the M3 directive-placement campaign entry " + "point for retiring a guardrail's in-bank copy once it has been " + "relocated to the agent's always-loaded CLAUDE.md. Matches by NAME " + "(mirrors reconcile's 'every ACTIVE directive named <name>' selection); " + "if multiple active copies share the name, all are deactivated. " + "REVERSIBLE \u2014 only is_active is touched, never a delete or a " + "content/priority rewrite, so it can be reactivated. Idempotent: a " + "re-run over already-inactive copies is a clean no-op, not an error. " + "REFUSES any directive carrying the rules-block marker tag (that stays " + "active until an M3-flip removes the marker) \u2014 the whole call is " + "refused if even one active copy carries it, mutating nothing.").option("--dry-run", "Print what WOULD deactivate without mutating anything").option("--json", "Machine-readable output").action(withConfigError(async (agent, name, opts) => {
+    const admin = resolveDirectiveAdmin(program3, agent);
+    try {
+      const result = await admin.deactivateAllActiveByName({
+        name,
+        ...opts.dryRun ? { dryRun: true } : {}
+      });
+      if (opts.json) {
+        console.log(JSON.stringify({ ok: true, agent, name, ...result }));
+        return;
+      }
+      const verb = result.dryRun ? "would deactivate" : "deactivated";
+      if (result.deactivated.length === 0) {
+        console.log(source_default.yellow(`\u2022 no-op: no ACTIVE directive named "${name}" in ${agent}'s bank ` + `(${result.alreadyInactive.length} already-inactive ` + `cop${result.alreadyInactive.length === 1 ? "y" : "ies"} left ` + `untouched). Nothing to do.`));
+        return;
+      }
+      for (const d of result.deactivated) {
+        console.log(source_default.green(`  ${result.dryRun ? "[dry-run] " : "\u2713 "}${verb} "${d.name}" ` + `(id ${d.id}, prior priority ${d.priority ?? "unset"})`));
+      }
+      const n = result.deactivated.length;
+      console.log(source_default.green(`${result.dryRun ? "[dry-run] " : "\u2713 "}${verb} ${n} directive` + `${n === 1 ? "" : "s"} named "${name}" in ${agent}'s bank` + (result.alreadyInactive.length > 0 ? ` (${result.alreadyInactive.length} already-inactive ` + `cop${result.alreadyInactive.length === 1 ? "y" : "ies"} skipped)` : "") + (result.dryRun ? " \u2014 nothing was mutated" : ". Reverse with reactivate.")));
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      if (opts.json) {
+        console.log(JSON.stringify({ ok: false, error: msg }));
+      } else {
+        console.error(source_default.red(`\u2717 ${msg}`));
+      }
+      process.exit(1);
+    }
+  }));
   directive.command("mark-rules-block <agent> <id>").description("Stamp the persisted rules-block marker tag on directive <id> in " + "<agent>'s bank \u2014 the SAME DirectiveAdmin.markRulesBlock write path " + "the batch triage executor uses. Once stamped, deactivate_directive " + "(and every other DirectiveAdmin deactivation path) refuses this " + "directive unconditionally until an M3-flip action removes the " + "marker. This is the real entry point the mental-model-curator " + "skill's interactive triage pass calls for every directive it " + "classifies rules-block, BEFORE presenting the card \u2014 that skill " + "has no other write path to this marker (no MCP tool exposes it), " + "so without this call the code-level refusal never actually " + "arms itself on the interactive path (PR #4760 review follow-up).").option("--json", "Machine-readable output").action(withConfigError(async (agent, id, opts) => {
     const selfAgent = process.env.SWITCHROOM_AGENT_NAME;
     if (selfAgent && selfAgent !== agent) {
@@ -110526,305 +110674,1227 @@ function registerMemoryDirectiveCommand(memory, program3) {
   }));
 }
 
-// src/cli/memory.ts
-function persistMemoryConfigUrl(configPath, provider, url) {
-  if (!existsSync82(configPath))
-    return false;
-  const raw = readFileSync74(configPath, "utf-8");
-  const doc = import_yaml16.default.parseDocument(raw);
-  if (!doc.has("memory")) {
-    doc.set("memory", { backend: "hindsight", shared_collection: "shared", config: { provider, url } });
-  } else {
-    const memNode = doc.get("memory");
-    if (!memNode.has("config")) {
-      memNode.set("config", { provider, url });
-    } else {
-      const configNode = memNode.get("config");
-      configNode.set("url", url);
-      if (!configNode.has("provider")) {
-        configNode.set("provider", provider);
-      }
-    }
+// src/cli/memory-flip.ts
+init_source();
+init_helpers();
+init_hindsight2();
+init_hindsight();
+init_hindsight_directive_admin();
+
+// src/memory/directive-triage.ts
+init_hindsight_directive_admin();
+var SUPERSEDED_BY_TAG_RE = /^superseded-by:(.+)$/;
+function classifyDirective(directive, override) {
+  const isActive = directive.is_active !== false;
+  const overrideSignal = override?.signal.trim();
+  if (hasRulesBlockMarker(directive.tags)) {
+    return {
+      category: "rules-block",
+      signal: "carries the rules-block marker tag \u2014 staged for M3, never retired",
+      action: "stage-for-m3"
+    };
   }
-  let mode = 420;
-  try {
-    mode = statSync48(configPath).mode & 511;
-  } catch {}
-  writeConfigFileSync(configPath, doc.toString(), mode);
-  return true;
-}
-function resolveMemorySetupTag(input) {
-  const explicit = input.explicitTag?.trim();
-  if (explicit) {
-    if (explicit.toLowerCase() === "latest") {
-      return { tag: undefined, reason: "explicit-latest" };
+  if (override && override.category === "rules-block") {
+    return {
+      category: "rules-block",
+      signal: overrideSignal || "rules-block override with no signal text \u2014 staged for M3, never retired",
+      action: "stage-for-m3"
+    };
+  }
+  const supersessionTag = (directive.tags ?? []).map((t) => SUPERSEDED_BY_TAG_RE.exec(t)).find((m) => m !== null);
+  if (supersessionTag) {
+    const winner = supersessionTag[1];
+    return {
+      category: "retire",
+      signal: isActive ? `superseded by '${winner}' (superseded-by tag)` : `superseded by '${winner}' (superseded-by tag) \u2014 already inactive, nothing to retire`,
+      action: isActive ? "retire" : "keep",
+      supersededBy: winner
+    };
+  }
+  if (override && overrideSignal) {
+    if (override.category === "reflect-directive") {
+      return { category: "reflect-directive", signal: overrideSignal, action: "keep" };
     }
-    const normalized = normalizeHindsightVersionTag(explicit);
-    if (!normalized)
-      return { tag: explicit, reason: "invalid" };
-    return { tag: normalized, reason: "explicit" };
+    return {
+      category: override.category,
+      signal: isActive ? overrideSignal : `${overrideSignal} \u2014 already inactive, nothing to retire`,
+      action: isActive ? "retire" : "keep"
+    };
   }
-  const pin = normalizeHindsightVersionTag(input.releasePin);
-  if (pin)
-    return { tag: pin, reason: "pin" };
-  return { tag: undefined, reason: "latest" };
-}
-function hindsightSecretValues(input) {
-  const out = [];
-  const push = (v) => {
-    if (typeof v === "string" && v.trim().length > 0)
-      out.push(v.trim());
+  return {
+    category: "reflect-directive",
+    signal: "no deterministic signal \u2014 defaults to KEEP",
+    action: "keep"
   };
-  push(input.cpAccessKey);
-  push(input.llm?.api_key);
-  for (const op of ["retain", "reflect", "consolidation"]) {
-    push(input.llm?.[op]?.api_key);
-  }
-  return out;
 }
-function hasUnresolvedHindsightVaultRef(config) {
-  const hindsight = config.hindsight;
-  return hindsightSecretValues({
-    llm: hindsight?.llm,
-    cpAccessKey: hindsight?.cp_access_key
-  }).some((v) => isVaultReference(v));
+function buildDirectiveTriageRows(directives, overrides) {
+  return directives.map((d) => {
+    const classified = classifyDirective(d, overrides?.get(d.id));
+    return {
+      id: d.id,
+      name: d.name,
+      priority: d.priority ?? 0,
+      isActive: d.is_active !== false,
+      ...classified
+    };
+  });
 }
-function emitsCleartextHindsightSecret(input) {
-  return hindsightSecretValues(input).some((v) => !isVaultReference(v));
+
+// src/cli/debug.ts
+init_helpers();
+init_loader();
+import { existsSync as existsSync82, readFileSync as readFileSync74, readdirSync as readdirSync30, statSync as statSync48 } from "node:fs";
+import { resolve as resolve43, join as join88 } from "node:path";
+import { createHash as createHash15 } from "node:crypto";
+
+// src/agents/workspace.ts
+import { readFile as readFile2, stat } from "node:fs/promises";
+import path8 from "node:path";
+
+// src/agents/bootstrap-budget.ts
+import path7 from "node:path";
+var DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO = 0.85;
+var DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES = 3;
+var DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX = 32;
+
+class BootstrapBudgetExceededError extends Error {
+  analysis;
+  constructor(analysis, message) {
+    super(message);
+    this.analysis = analysis;
+    this.name = "BootstrapBudgetExceededError";
+  }
 }
-var HINDSIGHT_COMPOSE_CLEARTEXT_SECRETS_WARNING = "This snippet embeds secrets in CLEARTEXT (LLM api_key and/or cp_access_key)." + " Treat the output as sensitive \u2014 do not paste it into shared channels or" + " commit it unredacted.";
-async function resolveLiteLLMForHindsight(config) {
-  return resolveHindsightLiteLlm(config);
+function normalizePositiveLimit(value) {
+  if (!Number.isFinite(value) || value <= 0) {
+    return 1;
+  }
+  return Math.floor(value);
 }
-function readRecallLog(agentDir, limit) {
-  const path7 = join88(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
-  if (!existsSync82(path7))
-    return [];
-  let raw;
-  try {
-    raw = readFileSync74(path7, "utf-8");
-  } catch {
+function formatWarningCause(cause) {
+  return cause === "per-file-limit" ? "max/file" : "max/total";
+}
+function normalizeSeenSignatures(signatures) {
+  if (!Array.isArray(signatures) || signatures.length === 0) {
     return [];
   }
-  const lines = raw.split(`
-`).filter((l) => l.trim().length > 0);
-  const tail = lines.slice(-limit);
-  const out = [];
-  for (const line of tail) {
-    try {
-      out.push(JSON.parse(line));
-    } catch {}
+  const seen = new Set;
+  const result = [];
+  for (const signature of signatures) {
+    const value = typeof signature === "string" ? signature.trim() : "";
+    if (!value || seen.has(value)) {
+      continue;
+    }
+    seen.add(value);
+    result.push(value);
   }
-  return out;
+  return result;
 }
-function formatRecallLogView(name, entries) {
-  const lines = [source_default.bold(`
-${name}:`)];
-  const total = entries.length;
-  const hits = entries.filter((e) => e.cache_hit).length;
-  const cappedTurns = entries.filter((e) => e.capped).length;
-  const omittedTurns = entries.filter((e) => typeof e.directives_omitted === "number" && e.directives_omitted > 0).length;
-  const memCounts = entries.map((e) => e.result_count).filter((n) => typeof n === "number");
-  const avg = memCounts.length > 0 ? Math.round(memCounts.reduce((s, n) => s + n, 0) / memCounts.length * 10) / 10 : null;
-  const max = memCounts.length > 0 ? Math.max(...memCounts) : null;
-  const medians = entries.map((e) => e.injected_score_median).filter((n) => typeof n === "number");
-  const avgScore = medians.length > 0 ? Math.round(medians.reduce((s, n) => s + n, 0) / medians.length * 100) / 100 : null;
-  const collapseTurns = entries.filter((e) => typeof e.injected_own_bank_count === "number" && e.injected_own_bank_count === 0 && typeof e.injected_additional_bank_count === "number" && e.injected_additional_bank_count > 0).length;
-  lines.push(source_default.gray(`  last ${total} turn${total === 1 ? "" : "s"}: ` + `avg=${avg ?? "\u2014"} max=${max ?? "\u2014"} ` + `avg_score=${avgScore ?? "\u2014"} ` + `cache_hits=${hits} capped=${cappedTurns}` + (omittedTurns > 0 ? ` directives_omitted_turns=${omittedTurns}` : "") + (collapseTurns > 0 ? source_default.red(` own_bank_collapse_turns=${collapseTurns}`) : "")));
-  for (const e of entries) {
-    const flag = e.cache_hit ? source_default.cyan("CACHE") : e.capped ? source_default.yellow("CAP") : source_default.green("OK");
-    const dem = e.demoted_count && e.demoted_count > 0 ? source_default.dim(` -${e.demoted_count}d`) : "";
-    const omitted = typeof e.directives_omitted === "number" && e.directives_omitted > 0 ? source_default.yellow(` +${e.directives_omitted}omitted`) : "";
-    const ids = e.memory_ids && e.memory_ids.length > 0 ? source_default.dim(` ids=${e.memory_ids.slice(0, 3).join(",")}${e.memory_ids.length > 3 ? `\u2026+${e.memory_ids.length - 3}` : ""}`) : "";
-    const own = e.injected_own_bank_count;
-    const additional = e.injected_additional_bank_count;
-    const composition = typeof own === "number" || typeof additional === "number" ? (() => {
-      const text = ` own/add=${own ?? "\u2014"}/${additional ?? "\u2014"}`;
-      return own === 0 && typeof additional === "number" && additional > 0 ? source_default.red(text) : source_default.dim(text);
-    })() : "";
-    const score = typeof e.injected_score_min === "number" && typeof e.injected_score_median === "number" && typeof e.injected_score_max === "number" ? source_default.dim(` score=${e.injected_score_min.toFixed(2)}/` + `${e.injected_score_median.toFixed(2)}/` + `${e.injected_score_max.toFixed(2)}`) : "";
-    lines.push(`  ${source_default.gray(e.ts)} ${flag} ` + `n=${e.result_count ?? "\u2014"}${e.pre_cap_count != null && e.pre_cap_count !== e.result_count ? `/${e.pre_cap_count}` : ""}` + `${dem}${omitted}${score}${composition}${ids}`);
+function appendSeenSignature(signatures, signature) {
+  if (!signature.trim()) {
+    return signatures;
   }
-  return lines;
+  if (signatures.includes(signature)) {
+    return signatures;
+  }
+  const next = [...signatures, signature];
+  if (next.length <= DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX) {
+    return next;
+  }
+  return next.slice(-DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX);
 }
-function registerMemoryCommand(program3) {
-  const memory = program3.command("memory").description("Hindsight memory operations");
-  memory.command("search <query>").description("Search agent memories via Hindsight").option("-a, --agent <name>", "Search a specific agent's collection").action(withConfigError(async (query, opts) => {
-    const config = getConfig(program3);
-    if (opts.agent) {
-      if (!config.agents[opts.agent]) {
-        console.error(source_default.red(`Agent "${opts.agent}" is not defined in switchroom.yaml`));
-        process.exit(1);
-      }
-      const collection = getCollectionForAgent(opts.agent, config);
-      console.log(source_default.bold(`
-Search: ${opts.agent} (collection: ${collection})
-`));
-      console.log(source_default.gray(`  $ ${searchMemory(query, collection)}`));
-      console.log();
-      return;
-    }
-    const agentNames = Object.keys(config.agents);
-    console.log(source_default.bold(`
-Searching all eligible collections:
-`));
-    for (const name of agentNames) {
-      const collection = getCollectionForAgent(name, config);
-      if (isStrictIsolation(name, config)) {
-        console.log(source_default.gray(`  ${name} (${collection}) \u2014 skipped (strict isolation)`));
-        continue;
-      }
-      console.log(source_default.cyan(`  ${name} (${collection}):`));
-      console.log(source_default.gray(`    $ ${searchMemory(query, collection)}`));
-    }
-    console.log();
-  }));
-  memory.command("stats").description("List agents with their collection names and isolation mode").action(withConfigError(async () => {
-    const config = getConfig(program3);
-    const agentNames = Object.keys(config.agents);
-    if (agentNames.length === 0) {
-      console.log(source_default.yellow("No agents defined in switchroom.yaml"));
-      return;
-    }
-    const headers = ["Agent", "Collection", "Isolation", "Auto-recall"];
-    const widths = [20, 20, 12, 12];
-    const headerLine = headers.map((h, i2) => source_default.bold(h.padEnd(widths[i2]))).join("  ");
-    console.log(`
-  ${headerLine}`);
-    for (const name of agentNames) {
-      const collection = getCollectionForAgent(name, config);
-      const isolation = isStrictIsolation(name, config) ? "strict" : "default";
-      const autoRecall = config.agents[name].memory?.auto_recall ?? true;
-      const row = [
-        name.padEnd(widths[0]),
-        collection.padEnd(widths[1]),
-        isolation.padEnd(widths[2]),
-        (autoRecall ? "yes" : "no").padEnd(widths[3])
-      ].join("  ");
-      console.log(`  ${row}`);
+function buildBootstrapInjectionStats(params) {
+  const injectedByPath = new Map;
+  const injectedByBaseName = new Map;
+  for (const file of params.injectedFiles) {
+    const pathValue = typeof file.path === "string" ? file.path.trim() : "";
+    if (!pathValue) {
+      continue;
     }
-    console.log();
-    const profileBanks = collectProfileBanks(config);
-    if (profileBanks.size > 0) {
-      const owners = new Map;
-      for (const [uname, u] of Object.entries(config.users ?? {})) {
-        if (u.profile_bank) {
-          owners.set(u.profile_bank, [
-            ...owners.get(u.profile_bank) ?? [],
-            uname
-          ]);
-        }
-      }
-      console.log(source_default.bold(`  Profile banks (per-user / shared):
-`));
-      for (const bank of [...profileBanks].sort()) {
-        const who = owners.get(bank);
-        const label = who ? `user: ${who.join(", ")}` : "shared";
-        console.log(`  ${bank.padEnd(widths[1])}  ${source_default.gray(label)}`);
-      }
-      console.log();
+    if (!injectedByPath.has(pathValue)) {
+      injectedByPath.set(pathValue, file.content);
     }
-    console.log(source_default.bold(`  Hindsight CLI commands:
-`));
-    for (const name of agentNames) {
-      const collection = getCollectionForAgent(name, config);
-      console.log(source_default.gray(`    $ ${getMemoryStats(collection)}`));
+    const normalizedPath = pathValue.replace(/\\/g, "/");
+    const baseName = path7.posix.basename(normalizedPath);
+    if (!injectedByBaseName.has(baseName)) {
+      injectedByBaseName.set(baseName, file.content);
     }
-    console.log();
-  }));
-  memory.command("reflect").description("Show cross-agent reflection plan").action(withConfigError(async () => {
-    const config = getConfig(program3);
-    const { eligible, excluded, commands } = reflectAcrossAgents(config);
-    console.log(source_default.bold(`
-Cross-agent reflection plan
-`));
-    if (eligible.length > 0) {
-      console.log(source_default.green("  Eligible collections:"));
-      for (const { agent, collection } of eligible) {
-        console.log(source_default.white(`    ${agent} -> ${collection}`));
-      }
+  }
+  return params.bootstrapFiles.map((file) => {
+    const pathValue = typeof file.path === "string" ? file.path.trim() : "";
+    const rawChars = file.missing ? 0 : (file.content ?? "").trimEnd().length;
+    const injected = (pathValue ? injectedByPath.get(pathValue) : undefined) ?? injectedByPath.get(file.name) ?? injectedByBaseName.get(file.name);
+    const injectedChars = injected ? injected.length : 0;
+    const truncated = !file.missing && injectedChars < rawChars;
+    return {
+      name: file.name,
+      path: pathValue || file.name,
+      missing: file.missing,
+      rawChars,
+      injectedChars,
+      truncated
+    };
+  });
+}
+function analyzeBootstrapBudget(params) {
+  const bootstrapMaxChars = normalizePositiveLimit(params.bootstrapMaxChars);
+  const bootstrapTotalMaxChars = normalizePositiveLimit(params.bootstrapTotalMaxChars);
+  const nearLimitRatio = typeof params.nearLimitRatio === "number" && Number.isFinite(params.nearLimitRatio) && params.nearLimitRatio > 0 && params.nearLimitRatio < 1 ? params.nearLimitRatio : DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO;
+  const nonMissing = params.files.filter((file) => !file.missing);
+  const rawChars = nonMissing.reduce((sum, file) => sum + file.rawChars, 0);
+  const injectedChars = nonMissing.reduce((sum, file) => sum + file.injectedChars, 0);
+  const totalNearLimit = injectedChars >= Math.ceil(bootstrapTotalMaxChars * nearLimitRatio);
+  const totalOverLimit = injectedChars >= bootstrapTotalMaxChars;
+  const files = params.files.map((file) => {
+    if (file.missing) {
+      return { ...file, nearLimit: false, causes: [] };
     }
-    if (excluded.length > 0) {
-      console.log(source_default.red(`
-  Excluded (strict isolation):`));
-      for (const { agent, collection } of excluded) {
-        console.log(source_default.gray(`    ${agent} -> ${collection}`));
+    const perFileOverLimit = file.rawChars > bootstrapMaxChars;
+    const nearLimit = file.rawChars >= Math.ceil(bootstrapMaxChars * nearLimitRatio);
+    const causes = [];
+    if (file.truncated) {
+      if (perFileOverLimit) {
+        causes.push("per-file-limit");
       }
-    }
-    if (commands.length > 0) {
-      console.log(source_default.bold(`
-  Hindsight CLI commands:
-`));
-      for (const cmd of commands) {
-        console.log(source_default.gray(`    $ ${cmd}`));
+      if (totalOverLimit) {
+        causes.push("total-limit");
       }
-    } else {
-      console.log(source_default.yellow(`
-  No eligible collections for reflection.`));
     }
-    console.log();
-  }));
-  memory.command("setup").description("Manage the Hindsight Docker container").option("--stop", "Stop and remove the Hindsight container").option("--status", "Show Hindsight container status").option("--recreate", "Pull the latest image and recreate the container (reusing its current port). Used by `switchroom update` to keep the hindsight singleton current. Also required after any `hindsight.llm` model/provider config change \u2014 env is only re-derived on recreate, a plain docker restart is not enough (see docs/operators/hindsight-model-change.md).").option("--tag <version>", "Pin the hindsight image tag to pull + run (e.g. v0.15.18), overriding the " + "default floating `:latest`. Threaded through by `switchroom rollout` so a " + "version-pinned roll recreates hindsight on the SAME tag as the rest of the " + "fleet. Omit for `:latest` (the standalone default).").option("--provider <provider>", "LLM provider (ollama, openai, anthropic)").option("--strict-env", "Refuse the recreate (before the running container is touched) if it would drop " + "env vars that are live on the container but declared in neither `hindsight.env` " + "nor switchroom's managed defaults. Default is to warn loudly and proceed, so a " + "rollout is never wedged half-way with memory down.").option("--gpu", "Force GPU passthrough on for this launch, overriding host autodetection. " + "Use when `~/.switchroom/host-capabilities.json` is wrong or unreadable and " + "you know the host has a working nvidia container toolkit (`docker run --gpus " + "all` hard-fails container create without one). Beats `hindsight.gpu`.").option("--no-gpu", "Force GPU passthrough off for this launch, overriding host autodetection. " + "Also the explicit opt-out for the recreate GPU drop guard.").option("--allow-gpu-drop", "Proceed with a --recreate that would take GPU passthrough away from the " + "running container. Without this the recreate refuses, because that drop " + "moves the embedding model and cross-encoder reranker to CPU on the " + "interactive recall path with no other signal.").action(async (opts) => {
-    if (opts.status) {
-      if (!isDockerAvailable()) {
-        console.log(source_default.red("  Docker is not available."));
-        process.exit(1);
-      }
-      const status = getHindsightStatus();
-      if (status) {
-        console.log(source_default.bold(`
-  Hindsight container status:`));
-        console.log(`  ${source_default.cyan("switchroom-hindsight")}: ${status}
-`);
-      } else {
-        console.log(source_default.yellow(`
-  Hindsight container not found.
-`));
-        console.log(source_default.gray("  Run 'switchroom memory setup' to start it."));
-      }
-      return;
+    return { ...file, nearLimit, causes };
+  });
+  const truncatedFiles = files.filter((file) => file.truncated);
+  const nearLimitFiles = files.filter((file) => file.nearLimit);
+  return {
+    files,
+    truncatedFiles,
+    nearLimitFiles,
+    totalNearLimit,
+    hasTruncation: truncatedFiles.length > 0,
+    totals: {
+      rawChars,
+      injectedChars,
+      truncatedChars: Math.max(0, rawChars - injectedChars),
+      bootstrapMaxChars,
+      bootstrapTotalMaxChars,
+      nearLimitRatio
     }
-    if (opts.stop) {
-      if (!isDockerAvailable()) {
-        console.log(source_default.red("  Docker is not available."));
-        process.exit(1);
-      }
-      if (!isHindsightContainerExists()) {
-        console.log(source_default.yellow("  No switchroom-hindsight container found."));
-        return;
-      }
-      console.log(source_default.gray("  Stopping switchroom-hindsight..."));
-      stopHindsightRecallPool();
-      stopHindsight();
-      console.log(source_default.green("  Hindsight container stopped and removed."));
-      return;
+  };
+}
+function buildBootstrapTruncationSignature(analysis) {
+  if (!analysis.hasTruncation) {
+    return;
+  }
+  const files = analysis.truncatedFiles.map((file) => ({
+    path: file.path || file.name,
+    rawChars: file.rawChars,
+    injectedChars: file.injectedChars,
+    causes: [...file.causes].sort()
+  })).sort((a, b) => {
+    const pathCmp = a.path.localeCompare(b.path);
+    if (pathCmp !== 0) {
+      return pathCmp;
     }
-    if (!isDockerAvailable()) {
-      console.log(source_default.red(`
-  Docker is not available.`));
-      console.log(source_default.gray(`  Install Docker: https://docs.docker.com/get-docker/
-`));
-      process.exit(1);
+    if (a.rawChars !== b.rawChars) {
+      return a.rawChars - b.rawChars;
     }
-    const recreate = opts.recreate === true;
-    let resolvedLlmPromise;
-    const getResolvedLlm = () => {
-      if (!resolvedLlmPromise) {
-        resolvedLlmPromise = resolveHindsightLlmSecrets(getConfig(program3).hindsight?.llm);
-      }
-      return resolvedLlmPromise;
-    };
-    let releasePin;
-    try {
-      releasePin = getConfig(program3).release?.pin ?? undefined;
-    } catch {
-      releasePin = undefined;
+    if (a.injectedChars !== b.injectedChars) {
+      return a.injectedChars - b.injectedChars;
     }
-    const { tag: effectiveTag, reason: tagReason } = resolveMemorySetupTag({
-      explicitTag: opts.tag,
-      releasePin
-    });
-    switch (tagReason) {
+    return a.causes.join("+").localeCompare(b.causes.join("+"));
+  });
+  return JSON.stringify({
+    bootstrapMaxChars: analysis.totals.bootstrapMaxChars,
+    bootstrapTotalMaxChars: analysis.totals.bootstrapTotalMaxChars,
+    files
+  });
+}
+function formatBootstrapTruncationWarningLines(params) {
+  if (!params.analysis.hasTruncation) {
+    return [];
+  }
+  const maxFiles = typeof params.maxFiles === "number" && Number.isFinite(params.maxFiles) && params.maxFiles > 0 ? Math.floor(params.maxFiles) : DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES;
+  const lines = [];
+  const duplicateNameCounts = params.analysis.truncatedFiles.reduce((acc, file) => {
+    acc.set(file.name, (acc.get(file.name) ?? 0) + 1);
+    return acc;
+  }, new Map);
+  const topFiles = params.analysis.truncatedFiles.slice(0, maxFiles);
+  for (const file of topFiles) {
+    const pct = file.rawChars > 0 ? Math.round((file.rawChars - file.injectedChars) / file.rawChars * 100) : 0;
+    const causeText = file.causes.length > 0 ? file.causes.map((cause) => formatWarningCause(cause)).join(", ") : "";
+    const nameLabel = (duplicateNameCounts.get(file.name) ?? 0) > 1 && file.path.trim().length > 0 ? `${file.name} (${file.path})` : file.name;
+    lines.push(`${nameLabel}: ${file.rawChars} raw -> ${file.injectedChars} injected (~${Math.max(0, pct)}% removed${causeText ? `; ${causeText}` : ""}).`);
+  }
+  if (params.analysis.truncatedFiles.length > topFiles.length) {
+    lines.push(`+${params.analysis.truncatedFiles.length - topFiles.length} more truncated file(s).`);
+  }
+  lines.push("If unintentional, raise switchroom workspace bootstrapMaxChars and/or bootstrapTotalMaxChars config.");
+  return lines;
+}
+function buildBootstrapPromptWarning(params) {
+  const signature = buildBootstrapTruncationSignature(params.analysis);
+  let seenSignatures = normalizeSeenSignatures(params.seenSignatures);
+  if (params.previousSignature && !seenSignatures.includes(params.previousSignature)) {
+    seenSignatures = appendSeenSignature(seenSignatures, params.previousSignature);
+  }
+  const hasSeenSignature = Boolean(signature && seenSignatures.includes(signature));
+  const warningShown = params.mode !== "off" && Boolean(signature) && (params.mode === "always" || !hasSeenSignature);
+  const warningSignaturesSeen = signature && params.mode !== "off" ? appendSeenSignature(seenSignatures, signature) : seenSignatures;
+  return {
+    signature,
+    warningShown,
+    lines: warningShown ? formatBootstrapTruncationWarningLines({
+      analysis: params.analysis,
+      maxFiles: params.maxFiles
+    }) : [],
+    warningSignaturesSeen
+  };
+}
+
+// src/agents/bootstrap-types.ts
+var DEFAULT_AGENTS_FILENAME = "AGENTS.md";
+var DEFAULT_SOUL_DEFAULT_FILENAME = "SOUL.default.md";
+var DEFAULT_SOUL_FILENAME = "SOUL.md";
+var DEFAULT_TOOLS_FILENAME = "TOOLS.md";
+var DEFAULT_IDENTITY_FILENAME = "IDENTITY.md";
+var DEFAULT_USER_FILENAME = "USER.md";
+var DEFAULT_BOOTSTRAP_FILENAME = "BOOTSTRAP.md";
+var DEFAULT_MEMORY_FILENAME = "MEMORY.md";
+
+// src/agents/workspace.ts
+var DEFAULT_WORKSPACE_DIR_NAME = "workspace";
+var DEFAULT_MEMORY_SUBDIR = "memory";
+var STABLE_BOOTSTRAP_FILENAMES = [
+  DEFAULT_AGENTS_FILENAME,
+  DEFAULT_SOUL_DEFAULT_FILENAME,
+  DEFAULT_SOUL_FILENAME,
+  DEFAULT_IDENTITY_FILENAME,
+  DEFAULT_USER_FILENAME,
+  DEFAULT_TOOLS_FILENAME,
+  DEFAULT_BOOTSTRAP_FILENAME
+];
+var DYNAMIC_BOOTSTRAP_FILENAMES = [
+  DEFAULT_MEMORY_FILENAME
+];
+var DEFAULT_BOOTSTRAP_MAX_CHARS = 12000;
+var DEFAULT_BOOTSTRAP_TOTAL_MAX_CHARS = 64000;
+var DEFAULT_DYNAMIC_TOTAL_MAX_CHARS = 24000;
+function resolveAgentWorkspaceDir(agentDir) {
+  return path8.join(agentDir, DEFAULT_WORKSPACE_DIR_NAME);
+}
+async function readOptionalFile(filePath) {
+  try {
+    const content = await readFile2(filePath, "utf8");
+    return content;
+  } catch (err) {
+    if (isErrnoException(err) && (err.code === "ENOENT" || err.code === "EISDIR")) {
+      return;
+    }
+    throw err;
+  }
+}
+function isErrnoException(value) {
+  return value instanceof Error && typeof value.code === "string";
+}
+async function loadNamedFile(workspaceDir, name, relativePath) {
+  const filePath = path8.join(workspaceDir, relativePath ?? name);
+  const content = await readOptionalFile(filePath);
+  if (content === undefined) {
+    return { name, path: filePath, missing: true };
+  }
+  return { name, path: filePath, content, missing: false };
+}
+async function loadStableBootstrapFiles(workspaceDir, options) {
+  const defaultFiles = await Promise.all(STABLE_BOOTSTRAP_FILENAMES.map((name) => loadNamedFile(workspaceDir, name)));
+  const extras = options?.extraStableFiles ?? [];
+  if (extras.length === 0) {
+    return defaultFiles;
+  }
+  const extraFiles = await Promise.all(extras.map((name) => loadNamedFile(workspaceDir, name)));
+  return [...defaultFiles, ...extraFiles];
+}
+async function loadDynamicBootstrapFiles(workspaceDir, options) {
+  const now2 = options?.now ?? new Date;
+  const includeYesterday = options?.includeYesterday ?? true;
+  const files = await Promise.all(DYNAMIC_BOOTSTRAP_FILENAMES.map((name) => loadNamedFile(workspaceDir, name)));
+  const todayRelative = dailyMemoryRelativePath(now2);
+  const todayName = DEFAULT_MEMORY_FILENAME;
+  const today = await loadNamedFile(workspaceDir, todayName, todayRelative);
+  today.path = path8.join(workspaceDir, todayRelative);
+  files.push(today);
+  if (includeYesterday) {
+    const yesterdayRelative = dailyMemoryRelativePath(addDays(now2, -1));
+    const yesterday = await loadNamedFile(workspaceDir, todayName, yesterdayRelative);
+    yesterday.path = path8.join(workspaceDir, yesterdayRelative);
+    files.push(yesterday);
+  }
+  return files;
+}
+function pad22(n) {
+  return n < 10 ? `0${n}` : String(n);
+}
+function dailyMemoryRelativePath(date) {
+  const y = date.getFullYear();
+  const m = pad22(date.getMonth() + 1);
+  const d = pad22(date.getDate());
+  return path8.join(DEFAULT_MEMORY_SUBDIR, `${y}-${m}-${d}.md`);
+}
+function addDays(date, days) {
+  const out = new Date(date.getTime());
+  out.setDate(out.getDate() + days);
+  return out;
+}
+function truncateContent(name, content, maxChars) {
+  if (content.length <= maxChars) {
+    return content;
+  }
+  if (maxChars < 200) {
+    return content.slice(0, Math.max(0, maxChars));
+  }
+  const headRoomInitial = Math.floor(maxChars * 0.7);
+  const sampleMarker = `
+\u2026(truncated ${name}: kept ${headRoomInitial}+${Math.max(0, maxChars - headRoomInitial - 96)} chars of ${content.length})\u2026
+`;
+  const markerReserve = Math.max(64, sampleMarker.length + 8);
+  const headRoom = Math.min(headRoomInitial, Math.max(0, maxChars - markerReserve - 8));
+  const tailRoom = Math.max(0, maxChars - headRoom - markerReserve);
+  const head = content.slice(0, Math.max(0, headRoom));
+  const tail = tailRoom > 0 ? content.slice(content.length - tailRoom) : "";
+  const result = `${head}
+\u2026(truncated ${name}: kept ${headRoom}+${tailRoom} chars of ${content.length})\u2026
+${tail}`;
+  return result.length <= maxChars ? result : result.slice(0, maxChars);
+}
+function projectBootstrapFiles(params) {
+  const {
+    files,
+    heading,
+    budget,
+    seenSignatures,
+    warningMode = "error",
+    warningMaxFiles = DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES
+  } = params;
+  const perFileCap = budget.bootstrapMaxChars;
+  let remainingTotal = budget.bootstrapTotalMaxChars;
+  const injectedFiles = [];
+  const parts = [];
+  for (const file of files) {
+    if (file.missing || typeof file.content !== "string") {
+      continue;
+    }
+    const raw = file.content.trimEnd();
+    if (raw.length === 0) {
+      continue;
+    }
+    const perFileAllowed = Math.min(perFileCap, remainingTotal);
+    if (perFileAllowed <= 0) {
+      break;
+    }
+    const injected = truncateContent(file.name, raw, perFileAllowed);
+    const relativePath = file.path;
+    injectedFiles.push({ path: relativePath, content: injected });
+    parts.push(`## ${relativePath}`);
+    parts.push(injected);
+    remainingTotal -= injected.length;
+    if (remainingTotal <= 0) {
+      break;
+    }
+  }
+  const concatenated = parts.length > 0 ? [heading.trim().length > 0 ? `# ${heading}` : null, ...parts].filter((p) => p !== null).join(`
+
+`) : "";
+  const stats = buildBootstrapInjectionStats({
+    bootstrapFiles: files,
+    injectedFiles
+  });
+  const analysis = analyzeBootstrapBudget({
+    files: stats,
+    bootstrapMaxChars: budget.bootstrapMaxChars,
+    bootstrapTotalMaxChars: budget.bootstrapTotalMaxChars,
+    nearLimitRatio: budget.nearLimitRatio ?? DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO
+  });
+  const warning = buildBootstrapPromptWarning({
+    analysis,
+    mode: warningMode,
+    seenSignatures,
+    maxFiles: warningMaxFiles
+  });
+  if (warningMode === "error" && analysis.hasTruncation) {
+    const errorLines = [
+      "Bootstrap budget exceeded. The following files exceed limits:",
+      ""
+    ];
+    for (const file of analysis.truncatedFiles) {
+      const excessChars = file.rawChars - file.injectedChars;
+      const causes = file.causes.map((c) => c === "per-file-limit" ? `per-file limit (${analysis.totals.bootstrapMaxChars.toLocaleString()} chars)` : `total limit (${analysis.totals.bootstrapTotalMaxChars.toLocaleString()} chars)`);
+      errorLines.push(`  ${file.name}: ${file.rawChars.toLocaleString()} bytes (exceeds ${causes.join(", ")})`);
+      errorLines.push(`    Trim ${excessChars.toLocaleString()} bytes, or pass --warning-mode warn to proceed with truncation.`);
+    }
+    throw new BootstrapBudgetExceededError(analysis, errorLines.join(`
+`));
+  }
+  return { files, injectedFiles, concatenated, analysis, warning };
+}
+async function buildStableBootstrapPrompt(params) {
+  const files = await loadStableBootstrapFiles(params.workspaceDir, {
+    extraStableFiles: params.extraStableFiles
+  });
+  const budget = {
+    bootstrapMaxChars: params.budget?.bootstrapMaxChars ?? DEFAULT_BOOTSTRAP_MAX_CHARS,
+    bootstrapTotalMaxChars: params.budget?.bootstrapTotalMaxChars ?? DEFAULT_BOOTSTRAP_TOTAL_MAX_CHARS,
+    nearLimitRatio: params.budget?.nearLimitRatio
+  };
+  return projectBootstrapFiles({
+    files,
+    heading: "Project Context (stable workspace files)",
+    budget,
+    seenSignatures: params.seenSignatures,
+    warningMode: params.budget?.warningMode,
+    warningMaxFiles: params.budget?.warningMaxFiles
+  });
+}
+async function buildDynamicBootstrapPrompt(params) {
+  const files = await loadDynamicBootstrapFiles(params.workspaceDir, {
+    now: params.now,
+    includeYesterday: params.includeYesterday
+  });
+  const budget = {
+    bootstrapMaxChars: params.budget?.bootstrapMaxChars ?? DEFAULT_BOOTSTRAP_MAX_CHARS,
+    bootstrapTotalMaxChars: params.budget?.bootstrapTotalMaxChars ?? DEFAULT_DYNAMIC_TOTAL_MAX_CHARS,
+    nearLimitRatio: params.budget?.nearLimitRatio
+  };
+  return projectBootstrapFiles({
+    files,
+    heading: "Project Context (dynamic workspace files)",
+    budget,
+    seenSignatures: params.seenSignatures,
+    warningMode: params.budget?.warningMode,
+    warningMaxFiles: params.budget?.warningMaxFiles
+  });
+}
+
+// src/cli/debug.ts
+init_merge();
+init_hindsight2();
+function formatBytes(bytes) {
+  return `${bytes.toLocaleString()} bytes`;
+}
+function estimateTokens(bytes) {
+  return Math.round(bytes / 3.7);
+}
+function readMcpServerNames(agentDir) {
+  const mcpPath = join88(agentDir, ".mcp.json");
+  if (!existsSync82(mcpPath))
+    return [];
+  try {
+    const parsed = JSON.parse(readFileSync74(mcpPath, "utf-8"));
+    return Object.keys(parsed.mcpServers ?? {});
+  } catch {
+    return null;
+  }
+}
+function sha2562(content) {
+  return createHash15("sha256").update(content).digest("hex").slice(0, 16);
+}
+function findLatestTranscriptJsonl(claudeConfigDir) {
+  const projectsDir = join88(claudeConfigDir, "projects");
+  if (!existsSync82(projectsDir))
+    return;
+  try {
+    const entries = readdirSync30(projectsDir, { withFileTypes: true });
+    let latest;
+    for (const entry of entries) {
+      if (!entry.isDirectory())
+        continue;
+      const projectPath = join88(projectsDir, entry.name);
+      const transcriptPath = join88(projectPath, "transcript.jsonl");
+      if (!existsSync82(transcriptPath))
+        continue;
+      const stat2 = statSync48(transcriptPath);
+      if (!latest || stat2.mtimeMs > latest.mtime) {
+        latest = { path: transcriptPath, mtime: stat2.mtimeMs };
+      }
+    }
+    return latest?.path;
+  } catch {
+    return;
+  }
+}
+function extractLatestUserMessage(transcriptPath) {
+  try {
+    const content = readFileSync74(transcriptPath, "utf-8");
+    const lines = content.trim().split(`
+`).filter(Boolean);
+    for (let i2 = lines.length - 1;i2 >= 0; i2--) {
+      const line = lines[i2];
+      try {
+        const event = JSON.parse(line);
+        if (event.type === "message" && event.role === "user" && typeof event.content === "string") {
+          const timestamp = event.timestamp ? new Date(event.timestamp).toLocaleString() : "unknown";
+          return { text: event.content, timestamp };
+        }
+      } catch {
+        continue;
+      }
+    }
+  } catch {
+    return;
+  }
+}
+function buildProgressUpdateGuidance() {
+  return `## Progress updates (human-style check-ins)
+
+You're talking to a human colleague on Telegram. Alongside the emoji status
+ladder, send a short \`progress_update\` at inflection points, the moments a
+senior colleague would ping the person who asked them to do something:
+
+- **Plan formed:** "Got it. Going to do X first, then Y, then Z."
+- **Pivot or blocker:** "First approach didn't work because <reason>. Trying
+  <alternative> instead."
+- **Chunk finished:** "Done with X. Starting Y now."
+
+Keep them short (one or two sentences). Don't narrate every step, the pinned
+progress card shows that for free. Don't send an update on a trivial one-shot
+task. Send them when a colleague would genuinely want to know what's happening.
+
+Final answers still go through \`reply\` as usual,
+\`progress_update\` is only for mid-turn check-ins.`;
+}
+function registerDebugCommand(program3) {
+  const cmd = program3.command("debug", { hidden: true }).description("Observability tools for inspecting agent prompt layering [advanced]");
+  cmd.command("turn <agent>").description("Dump the exact prompt layering the model saw on the most recent turn").option("--last <n>", "Show N-th most recent turn instead of latest", "1").action(withConfigError(async (agentName, opts) => {
+    const config = getConfig(program3);
+    const agentConfig = config.agents[agentName];
+    if (!agentConfig) {
+      console.error(`Agent '${agentName}' not found in switchroom.yaml`);
+      process.exit(1);
+    }
+    const agentsDir = resolveAgentsDir(config);
+    const agentDir = resolve43(agentsDir, agentName);
+    if (!existsSync82(agentDir)) {
+      console.error(`Agent directory not found: ${agentDir}`);
+      process.exit(1);
+    }
+    const workspaceDir = resolveAgentWorkspaceDir(agentDir);
+    const claudeConfigDir = join88(agentDir, ".claude");
+    const claudeMdPath2 = join88(agentDir, "CLAUDE.md");
+    const soulMdPath = join88(agentDir, "SOUL.md");
+    const workspaceSoulMdPath = join88(workspaceDir, "SOUL.md");
+    const handoffPath = join88(agentDir, ".handoff.md");
+    const lastN = parseInt(opts.last, 10);
+    if (isNaN(lastN) || lastN < 1) {
+      console.error("--last must be a positive integer");
+      process.exit(1);
+    }
+    if (lastN > 1) {
+      console.error("Note: --last N where N > 1 not yet implemented (only latest turn supported)");
+      process.exit(1);
+    }
+    console.log(`=== Debug Turn Dump: ${agentName} ===
+`);
+    console.log(`=== Append System Prompt (stable) ===
+`);
+    const resolved = resolveAgentConfig(config.defaults, config.profiles, agentConfig);
+    const useHotReloadStable = resolved.channels?.telegram?.hotReloadStable === true;
+    const stableResult = await buildStableBootstrapPrompt({
+      workspaceDir,
+      budget: { warningMode: "off" }
+    });
+    if (useHotReloadStable) {
+      console.log(`-- Workspace Stable Render (not used \u2014 stable content is in per-turn hook) --`);
+      console.log();
+    } else if (stableResult.concatenated.trim().length > 0) {
+      console.log(`-- Workspace Stable Render (${formatBytes(stableResult.concatenated.length)}) --`);
+      console.log(stableResult.concatenated);
+      console.log();
+    } else {
+      console.log("-- Workspace Stable Render (0 bytes, not set up) --");
+      console.log();
+    }
+    const useSwitchroomPlugin = usesSwitchroomTelegramPlugin(resolved);
+    const progressGuidance = useSwitchroomPlugin ? buildProgressUpdateGuidance() : "";
+    if (progressGuidance.length > 0) {
+      console.log(`-- Progress Updates Guidance (${formatBytes(progressGuidance.length)}) --`);
+      console.log(progressGuidance);
+      console.log();
+    }
+    const baseSystemPromptAppend = resolved.system_prompt_append ?? "";
+    if (baseSystemPromptAppend.trim().length > 0) {
+      console.log(`-- User System Prompt Append (${formatBytes(baseSystemPromptAppend.length)}) --`);
+      console.log(baseSystemPromptAppend);
+      console.log();
+    }
+    console.log(`=== Append System Prompt (per-session) ===
+`);
+    const handoffContent = existsSync82(handoffPath) ? readFileSync74(handoffPath, "utf-8") : "";
+    if (handoffContent.trim().length > 0) {
+      console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
+      console.log(handoffContent);
+      console.log();
+    } else {
+      console.log("-- Handoff Briefing (0 bytes, no prior session) --");
+      console.log();
+    }
+    console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
+`);
+    const claudeMdContent = existsSync82(claudeMdPath2) ? readFileSync74(claudeMdPath2, "utf-8") : "";
+    if (claudeMdContent.trim().length > 0) {
+      console.log(`(${formatBytes(claudeMdContent.length)})`);
+      console.log(claudeMdContent);
+      console.log();
+    } else {
+      console.log("(0 bytes, not present)");
+      console.log();
+    }
+    console.log(`=== Persona (SOUL.md) ===
+`);
+    const soulMdContent = existsSync82(soulMdPath) ? readFileSync74(soulMdPath, "utf-8") : existsSync82(workspaceSoulMdPath) ? readFileSync74(workspaceSoulMdPath, "utf-8") : "";
+    if (soulMdContent.trim().length > 0) {
+      console.log(`(${formatBytes(soulMdContent.length)})`);
+      console.log(soulMdContent);
+      console.log();
+    } else {
+      console.log("(0 bytes, stale placeholder \u2014 Phase 2 item: single source of truth for persona)");
+      console.log();
+    }
+    console.log(`=== Per-Turn Injections (UserPromptSubmit) ===
+`);
+    if (useHotReloadStable) {
+      if (stableResult.concatenated.trim().length > 0) {
+        console.log(`-- Workspace Stable (hot-reload hook): ${formatBytes(stableResult.concatenated.length)} --`);
+        console.log(stableResult.concatenated);
+        console.log();
+      } else {
+        console.log("-- Workspace Stable (hot-reload hook): 0 bytes, not set up --");
+        console.log();
+      }
+    }
+    const dynamicResult = await buildDynamicBootstrapPrompt({
+      workspaceDir,
+      budget: { warningMode: "off" }
+    });
+    if (dynamicResult.concatenated.trim().length > 0) {
+      console.log(`-- Workspace Dynamic: fired, ${formatBytes(dynamicResult.concatenated.length)} --`);
+      console.log(dynamicResult.concatenated);
+      console.log();
+    } else {
+      console.log("-- Workspace Dynamic: no content (MEMORY.md and daily notes empty or missing) --");
+      console.log();
+    }
+    const hindsightEnabled = isHindsightEnabled(config) && agentConfig.memory?.auto_recall !== false;
+    if (hindsightEnabled) {
+      console.log("-- Hindsight Recall: enabled (exact content unavailable, check hindsight logs) --");
+      console.log();
+    } else {
+      console.log("-- Hindsight Recall: disabled --");
+      console.log();
+    }
+    console.log(`=== User Message (latest turn) ===
+`);
+    const transcriptPath = findLatestTranscriptJsonl(claudeConfigDir);
+    const userMessage = transcriptPath ? extractLatestUserMessage(transcriptPath) : undefined;
+    if (userMessage) {
+      console.log(`(Turn timestamp: ${userMessage.timestamp})`);
+      console.log(userMessage.text);
+      console.log();
+    } else {
+      console.log("(unavailable: no transcript found or transcript empty)");
+      console.log();
+    }
+    console.log(`=== Totals ===
+`);
+    const stableBytes = stableResult.concatenated.length + progressGuidance.length + baseSystemPromptAppend.length;
+    const perSessionBytes = handoffContent.length;
+    const claudeMdBytes = claudeMdContent.length;
+    const soulMdBytes = soulMdContent.length;
+    const perTurnBytes = dynamicResult.concatenated.length;
+    const userBytes = userMessage?.text.length ?? 0;
+    const fleetDir = join88(agentsDir, "..", "fleet");
+    const fleetInvPath = join88(fleetDir, "switchroom-invariants.md");
+    const fleetClaudePath = join88(fleetDir, "CLAUDE.md");
+    const fleetInvBytes = existsSync82(fleetInvPath) ? readFileSync74(fleetInvPath, "utf-8").length : 0;
+    const fleetClaudeBytes = existsSync82(fleetClaudePath) ? readFileSync74(fleetClaudePath, "utf-8").length : 0;
+    const fleetBytes = fleetInvBytes + fleetClaudeBytes;
+    const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
+    console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
+    console.log(`Per-session:       ${formatBytes(perSessionBytes).padEnd(20)} (cache-warm until next session)`);
+    console.log(`CLAUDE.md (cwd):   ${formatBytes(claudeMdBytes).padEnd(20)} (cache-hot)`);
+    console.log(`Fleet invariants:  ${formatBytes(fleetBytes).padEnd(20)} (--add-dir, cache-hot)`);
+    console.log(`Per-turn:          ${formatBytes(perTurnBytes).padEnd(20)} (never cached \u2014 the real per-turn $ cost)`);
+    console.log(`User message:      ${formatBytes(userBytes).padEnd(20)}`);
+    console.log(`Authored text:     ${formatBytes(totalBytes).padEnd(20)} (~${estimateTokens(totalBytes).toLocaleString()} tokens est.)`);
+    const mcpServers = readMcpServerNames(agentDir);
+    const mcpCount = mcpServers?.length ?? null;
+    const mcpEstK = mcpCount != null ? mcpCount * 3 : null;
+    const mcpLabel = mcpCount != null ? `${mcpCount} servers` : "(unreadable \u2014 agent-private .mcp.json)";
+    const mcpEstLabel = mcpEstK != null ? `~${mcpEstK.toLocaleString()}k tok` : "~30k tok (audit est.)";
+    console.log(`MCP tool surface:  ${mcpLabel.padEnd(20)} (NOT counted above; ~3k tok/server \u2248 ${mcpEstLabel} \u2014 deferred under tool search)`);
+    if (mcpServers && mcpServers.length > 0) {
+      console.log(`                   [${mcpServers.join(", ")}]`);
+    }
+    const floorMcp = mcpEstK != null ? `~${mcpEstK.toLocaleString()}k` : "~30k";
+    console.log(`Per-turn FLOOR:    ${`~${estimateTokens(totalBytes).toLocaleString()} + ${floorMcp} MCP + ~13k CLI-base`.padEnd(20)} tokens est. (before the user msg, recall, or tool results)`);
+    const stableCacheInput = stableResult.concatenated + progressGuidance + baseSystemPromptAppend;
+    const stableHash = sha2562(stableCacheInput);
+    console.log(`Cache stable hash: sha256:${stableHash}`);
+    console.log();
+  }));
+}
+
+// src/memory/directive-residue.ts
+var RESIDUE_CATEGORIES = new Set([
+  "rules-block",
+  "reflect-directive"
+]);
+function renderInjectedLine(index, directive) {
+  const priority = directive.priority ?? 0;
+  const name = (directive.name ?? "").trim() || "(unnamed)";
+  const content = (directive.content ?? "").trim();
+  return `${index}. [P${priority}] ${name}: ${content}`;
+}
+function measureDirectiveResidue(agent, rows, directivesById) {
+  const residueRows = rows.filter((r) => r.isActive && RESIDUE_CATEGORIES.has(r.category));
+  const lines = residueRows.map((row, i2) => {
+    const directive = directivesById.get(row.id);
+    if (!directive) {
+      throw new Error(`measureDirectiveResidue: row '${row.name}' (id ${row.id}) has no ` + "matching directive in directivesById \u2014 pass the SAME list the " + "rows were built from.");
+    }
+    return renderInjectedLine(i2 + 1, directive);
+  });
+  const residueBytes = lines.reduce((sum, line) => sum + Buffer.byteLength(line, "utf8") + 1, 0);
+  return {
+    agent,
+    residueDirectiveCount: residueRows.length,
+    totalDirectiveCount: rows.length,
+    residueBytes,
+    residueTokensEstimate: estimateTokens(residueBytes)
+  };
+}
+
+// src/memory/directive-flip.ts
+init_rules_block();
+function evaluateFlipReadiness(measurement, opts) {
+  const reasons = [];
+  if (!opts.rulesBlockEnabled) {
+    reasons.push("memory.rules_block (M1) is not enabled \u2014 enable the rules-block " + "toolchain and migrate the directives into the block BEFORE flipping " + "inject_directives off (two-flag ordering; flipping first strips every " + "guardrail).");
+  }
+  if (measurement.residueBytes > RULES_BLOCK_BUDGET_BYTES) {
+    reasons.push(`directive residue is ${measurement.residueBytes}B, over the ` + `${RULES_BLOCK_BUDGET_BYTES}B rules-block budget (` + `${measurement.residueDirectiveCount} active residue directive(s)). ` + "Triage the directive set down \u2014 retire stale rules or shorten bodies \u2014 " + "until the residue fits, then re-check. The budget, not MAX_DIRECTIVES, " + "is the binding gate.");
+  }
+  return {
+    agent: measurement.agent,
+    ready: reasons.length === 0,
+    reasons,
+    residueBytes: measurement.residueBytes,
+    budgetBytes: RULES_BLOCK_BUDGET_BYTES,
+    residueDirectiveCount: measurement.residueDirectiveCount
+  };
+}
+async function measureLiveResidue(admin, agent) {
+  const directives = await admin.list();
+  const rows = buildDirectiveTriageRows(directives);
+  const byId = new Map(directives.map((d) => [d.id, d]));
+  return measureDirectiveResidue(agent, rows, byId);
+}
+function flipConfigStanza(agent) {
+  return [
+    `# ${agent} \u2014 Memory v2 M3 Surface-A flip (suppress <active_directives>)`,
+    "memory:",
+    "  rules_block: true        # M1 must already be on (checked)",
+    "  inject_directives: false # M3: stop re-injecting migrated directives"
+  ].join(`
+`);
+}
+
+// src/cli/memory-flip.ts
+function resolveFlipAdmin(program3, agent) {
+  const config = getConfig(program3);
+  if (!config.agents[agent]) {
+    console.error(source_default.red(`Agent "${agent}" is not defined in switchroom.yaml`));
+    process.exit(1);
+  }
+  if (!isHindsightEnabled(config)) {
+    console.error(source_default.red("Hindsight memory is not enabled in this switchroom.yaml."));
+    process.exit(1);
+  }
+  const agentConfig = config.agents[agent];
+  const mcpBaseUrl = config.memory?.config?.url ?? HINDSIGHT_DEFAULT_MCP_URL;
+  const apiBaseUrl = mcpBaseUrl.replace(/\/mcp\/?$/, "").replace(/\/+$/, "");
+  const bankId = agentConfig?.memory?.collection ?? agent;
+  return new DirectiveAdmin({ apiBaseUrl, bankId });
+}
+function readRulesBlockEnabled(program3, agent) {
+  const config = getConfig(program3);
+  return config.agents[agent]?.memory?.rules_block === true;
+}
+function buildFlipPreflightJson(readiness, rulesBlockEnabled) {
+  return {
+    ok: true,
+    agent: readiness.agent,
+    ready: readiness.ready,
+    rules_block: rulesBlockEnabled,
+    residue_bytes: readiness.residueBytes,
+    budget_bytes: readiness.budgetBytes,
+    fits_budget: readiness.residueBytes <= readiness.budgetBytes,
+    residue_directive_count: readiness.residueDirectiveCount,
+    reasons: readiness.reasons
+  };
+}
+function renderFlipPreflight(readiness, rulesBlockEnabled) {
+  const fits = readiness.residueBytes <= readiness.budgetBytes;
+  const lines = [];
+  const verdict = readiness.ready ? source_default.green("READY") : source_default.red("NOT-READY");
+  lines.push(`${verdict} \u2014 ${readiness.agent} M3 flip preflight`);
+  lines.push("");
+  lines.push(`  residue:      ${readiness.residueBytes}B / ${readiness.budgetBytes}B budget ` + `(${readiness.residueDirectiveCount} active residue directive(s)) ` + (fits ? source_default.green("fits") : source_default.red("OVER budget")));
+  lines.push(`  rules_block:  ${rulesBlockEnabled ? source_default.green("on") : source_default.red("off")}`);
+  if (readiness.ready) {
+    lines.push("");
+    lines.push("  Apply this per-agent stanza to switchroom.yaml, then restart:");
+    lines.push("");
+    for (const l of flipConfigStanza(readiness.agent).split(`
+`)) {
+      lines.push(`    ${l}`);
+    }
+  } else {
+    lines.push("");
+    lines.push(source_default.red("  Blocked:"));
+    for (const reason of readiness.reasons) {
+      lines.push(`    - ${reason}`);
+    }
+  }
+  return lines.join(`
+`);
+}
+function registerMemoryFlipCommand(memory, program3, deps = {}) {
+  const makeAdmin = deps.makeAdmin ?? resolveFlipAdmin;
+  memory.command("flip-preflight <agent>").description("Deterministic M3 (Surface-A) flip-readiness gate for <agent>: measure " + "the live post-triage directive residue, check it fits the 6144B " + "rules-block budget AND that memory.rules_block is already on, and " + "print READY + the exact switchroom.yaml stanza, or NOT-READY + why. " + "Never mutates config \u2014 the flip itself is an operator-gated edit.").option("--json", "Machine-readable output").action(withConfigError(async (agent, opts) => {
+    const admin = makeAdmin(program3, agent);
+    const rulesBlockEnabled = readRulesBlockEnabled(program3, agent);
+    let ready;
+    try {
+      const measurement = await measureLiveResidue(admin, agent);
+      const readiness = evaluateFlipReadiness(measurement, { rulesBlockEnabled });
+      ready = readiness.ready;
+      if (opts.json) {
+        console.log(JSON.stringify(buildFlipPreflightJson(readiness, rulesBlockEnabled)));
+      } else {
+        console.log(renderFlipPreflight(readiness, rulesBlockEnabled));
+      }
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      if (opts.json) {
+        console.log(JSON.stringify({ ok: false, error: msg }));
+      } else {
+        console.error(source_default.red(`\u2717 flip preflight for ${agent} failed: ${msg}`));
+      }
+      process.exit(1);
+      return;
+    }
+    if (!ready)
+      process.exit(2);
+  }));
+}
+
+// src/cli/memory.ts
+function persistMemoryConfigUrl(configPath, provider, url) {
+  if (!existsSync83(configPath))
+    return false;
+  const raw = readFileSync75(configPath, "utf-8");
+  const doc = import_yaml16.default.parseDocument(raw);
+  if (!doc.has("memory")) {
+    doc.set("memory", { backend: "hindsight", shared_collection: "shared", config: { provider, url } });
+  } else {
+    const memNode = doc.get("memory");
+    if (!memNode.has("config")) {
+      memNode.set("config", { provider, url });
+    } else {
+      const configNode = memNode.get("config");
+      configNode.set("url", url);
+      if (!configNode.has("provider")) {
+        configNode.set("provider", provider);
+      }
+    }
+  }
+  let mode = 420;
+  try {
+    mode = statSync49(configPath).mode & 511;
+  } catch {}
+  writeConfigFileSync(configPath, doc.toString(), mode);
+  return true;
+}
+function resolveMemorySetupTag(input) {
+  const explicit = input.explicitTag?.trim();
+  if (explicit) {
+    if (explicit.toLowerCase() === "latest") {
+      return { tag: undefined, reason: "explicit-latest" };
+    }
+    const normalized = normalizeHindsightVersionTag(explicit);
+    if (!normalized)
+      return { tag: explicit, reason: "invalid" };
+    return { tag: normalized, reason: "explicit" };
+  }
+  const pin = normalizeHindsightVersionTag(input.releasePin);
+  if (pin)
+    return { tag: pin, reason: "pin" };
+  return { tag: undefined, reason: "latest" };
+}
+function hindsightSecretValues(input) {
+  const out = [];
+  const push = (v) => {
+    if (typeof v === "string" && v.trim().length > 0)
+      out.push(v.trim());
+  };
+  push(input.cpAccessKey);
+  push(input.llm?.api_key);
+  for (const op of ["retain", "reflect", "consolidation"]) {
+    push(input.llm?.[op]?.api_key);
+  }
+  return out;
+}
+function hasUnresolvedHindsightVaultRef(config) {
+  const hindsight = config.hindsight;
+  return hindsightSecretValues({
+    llm: hindsight?.llm,
+    cpAccessKey: hindsight?.cp_access_key
+  }).some((v) => isVaultReference(v));
+}
+function emitsCleartextHindsightSecret(input) {
+  return hindsightSecretValues(input).some((v) => !isVaultReference(v));
+}
+var HINDSIGHT_COMPOSE_CLEARTEXT_SECRETS_WARNING = "This snippet embeds secrets in CLEARTEXT (LLM api_key and/or cp_access_key)." + " Treat the output as sensitive \u2014 do not paste it into shared channels or" + " commit it unredacted.";
+async function resolveLiteLLMForHindsight(config) {
+  return resolveHindsightLiteLlm(config);
+}
+function readRecallLog(agentDir, limit) {
+  const path9 = join89(agentDir, ".claude", "plugins", "data", "hindsight-memory-inline", "state", "recall_log.jsonl");
+  if (!existsSync83(path9))
+    return [];
+  let raw;
+  try {
+    raw = readFileSync75(path9, "utf-8");
+  } catch {
+    return [];
+  }
+  const lines = raw.split(`
+`).filter((l) => l.trim().length > 0);
+  const tail = lines.slice(-limit);
+  const out = [];
+  for (const line of tail) {
+    try {
+      out.push(JSON.parse(line));
+    } catch {}
+  }
+  return out;
+}
+function formatRecallLogView(name, entries) {
+  const lines = [source_default.bold(`
+${name}:`)];
+  const total = entries.length;
+  const hits = entries.filter((e) => e.cache_hit).length;
+  const cappedTurns = entries.filter((e) => e.capped).length;
+  const omittedTurns = entries.filter((e) => typeof e.directives_omitted === "number" && e.directives_omitted > 0).length;
+  const memCounts = entries.map((e) => e.result_count).filter((n) => typeof n === "number");
+  const avg = memCounts.length > 0 ? Math.round(memCounts.reduce((s, n) => s + n, 0) / memCounts.length * 10) / 10 : null;
+  const max = memCounts.length > 0 ? Math.max(...memCounts) : null;
+  const medians = entries.map((e) => e.injected_score_median).filter((n) => typeof n === "number");
+  const avgScore = medians.length > 0 ? Math.round(medians.reduce((s, n) => s + n, 0) / medians.length * 100) / 100 : null;
+  const collapseTurns = entries.filter((e) => typeof e.injected_own_bank_count === "number" && e.injected_own_bank_count === 0 && typeof e.injected_additional_bank_count === "number" && e.injected_additional_bank_count > 0).length;
+  lines.push(source_default.gray(`  last ${total} turn${total === 1 ? "" : "s"}: ` + `avg=${avg ?? "\u2014"} max=${max ?? "\u2014"} ` + `avg_score=${avgScore ?? "\u2014"} ` + `cache_hits=${hits} capped=${cappedTurns}` + (omittedTurns > 0 ? ` directives_omitted_turns=${omittedTurns}` : "") + (collapseTurns > 0 ? source_default.red(` own_bank_collapse_turns=${collapseTurns}`) : "")));
+  for (const e of entries) {
+    const flag = e.cache_hit ? source_default.cyan("CACHE") : e.capped ? source_default.yellow("CAP") : source_default.green("OK");
+    const dem = e.demoted_count && e.demoted_count > 0 ? source_default.dim(` -${e.demoted_count}d`) : "";
+    const omitted = typeof e.directives_omitted === "number" && e.directives_omitted > 0 ? source_default.yellow(` +${e.directives_omitted}omitted`) : "";
+    const ids = e.memory_ids && e.memory_ids.length > 0 ? source_default.dim(` ids=${e.memory_ids.slice(0, 3).join(",")}${e.memory_ids.length > 3 ? `\u2026+${e.memory_ids.length - 3}` : ""}`) : "";
+    const own = e.injected_own_bank_count;
+    const additional = e.injected_additional_bank_count;
+    const composition = typeof own === "number" || typeof additional === "number" ? (() => {
+      const text = ` own/add=${own ?? "\u2014"}/${additional ?? "\u2014"}`;
+      return own === 0 && typeof additional === "number" && additional > 0 ? source_default.red(text) : source_default.dim(text);
+    })() : "";
+    const score = typeof e.injected_score_min === "number" && typeof e.injected_score_median === "number" && typeof e.injected_score_max === "number" ? source_default.dim(` score=${e.injected_score_min.toFixed(2)}/` + `${e.injected_score_median.toFixed(2)}/` + `${e.injected_score_max.toFixed(2)}`) : "";
+    lines.push(`  ${source_default.gray(e.ts)} ${flag} ` + `n=${e.result_count ?? "\u2014"}${e.pre_cap_count != null && e.pre_cap_count !== e.result_count ? `/${e.pre_cap_count}` : ""}` + `${dem}${omitted}${score}${composition}${ids}`);
+  }
+  return lines;
+}
+function registerMemoryCommand(program3) {
+  const memory = program3.command("memory").description("Hindsight memory operations");
+  memory.command("search <query>").description("Search agent memories via Hindsight").option("-a, --agent <name>", "Search a specific agent's collection").action(withConfigError(async (query, opts) => {
+    const config = getConfig(program3);
+    if (opts.agent) {
+      if (!config.agents[opts.agent]) {
+        console.error(source_default.red(`Agent "${opts.agent}" is not defined in switchroom.yaml`));
+        process.exit(1);
+      }
+      const collection = getCollectionForAgent(opts.agent, config);
+      console.log(source_default.bold(`
+Search: ${opts.agent} (collection: ${collection})
+`));
+      console.log(source_default.gray(`  $ ${searchMemory(query, collection)}`));
+      console.log();
+      return;
+    }
+    const agentNames = Object.keys(config.agents);
+    console.log(source_default.bold(`
+Searching all eligible collections:
+`));
+    for (const name of agentNames) {
+      const collection = getCollectionForAgent(name, config);
+      if (isStrictIsolation(name, config)) {
+        console.log(source_default.gray(`  ${name} (${collection}) \u2014 skipped (strict isolation)`));
+        continue;
+      }
+      console.log(source_default.cyan(`  ${name} (${collection}):`));
+      console.log(source_default.gray(`    $ ${searchMemory(query, collection)}`));
+    }
+    console.log();
+  }));
+  memory.command("stats").description("List agents with their collection names and isolation mode").action(withConfigError(async () => {
+    const config = getConfig(program3);
+    const agentNames = Object.keys(config.agents);
+    if (agentNames.length === 0) {
+      console.log(source_default.yellow("No agents defined in switchroom.yaml"));
+      return;
+    }
+    const headers = ["Agent", "Collection", "Isolation", "Auto-recall"];
+    const widths = [20, 20, 12, 12];
+    const headerLine = headers.map((h, i2) => source_default.bold(h.padEnd(widths[i2]))).join("  ");
+    console.log(`
+  ${headerLine}`);
+    for (const name of agentNames) {
+      const collection = getCollectionForAgent(name, config);
+      const isolation = isStrictIsolation(name, config) ? "strict" : "default";
+      const autoRecall = config.agents[name].memory?.auto_recall ?? true;
+      const row = [
+        name.padEnd(widths[0]),
+        collection.padEnd(widths[1]),
+        isolation.padEnd(widths[2]),
+        (autoRecall ? "yes" : "no").padEnd(widths[3])
+      ].join("  ");
+      console.log(`  ${row}`);
+    }
+    console.log();
+    const profileBanks = collectProfileBanks(config);
+    if (profileBanks.size > 0) {
+      const owners = new Map;
+      for (const [uname, u] of Object.entries(config.users ?? {})) {
+        if (u.profile_bank) {
+          owners.set(u.profile_bank, [
+            ...owners.get(u.profile_bank) ?? [],
+            uname
+          ]);
+        }
+      }
+      console.log(source_default.bold(`  Profile banks (per-user / shared):
+`));
+      for (const bank of [...profileBanks].sort()) {
+        const who = owners.get(bank);
+        const label = who ? `user: ${who.join(", ")}` : "shared";
+        console.log(`  ${bank.padEnd(widths[1])}  ${source_default.gray(label)}`);
+      }
+      console.log();
+    }
+    console.log(source_default.bold(`  Hindsight CLI commands:
+`));
+    for (const name of agentNames) {
+      const collection = getCollectionForAgent(name, config);
+      console.log(source_default.gray(`    $ ${getMemoryStats(collection)}`));
+    }
+    console.log();
+  }));
+  memory.command("reflect").description("Show cross-agent reflection plan").action(withConfigError(async () => {
+    const config = getConfig(program3);
+    const { eligible, excluded, commands } = reflectAcrossAgents(config);
+    console.log(source_default.bold(`
+Cross-agent reflection plan
+`));
+    if (eligible.length > 0) {
+      console.log(source_default.green("  Eligible collections:"));
+      for (const { agent, collection } of eligible) {
+        console.log(source_default.white(`    ${agent} -> ${collection}`));
+      }
+    }
+    if (excluded.length > 0) {
+      console.log(source_default.red(`
+  Excluded (strict isolation):`));
+      for (const { agent, collection } of excluded) {
+        console.log(source_default.gray(`    ${agent} -> ${collection}`));
+      }
+    }
+    if (commands.length > 0) {
+      console.log(source_default.bold(`
+  Hindsight CLI commands:
+`));
+      for (const cmd of commands) {
+        console.log(source_default.gray(`    $ ${cmd}`));
+      }
+    } else {
+      console.log(source_default.yellow(`
+  No eligible collections for reflection.`));
+    }
+    console.log();
+  }));
+  memory.command("setup").description("Manage the Hindsight Docker container").option("--stop", "Stop and remove the Hindsight container").option("--status", "Show Hindsight container status").option("--recreate", "Pull the latest image and recreate the container (reusing its current port). Used by `switchroom update` to keep the hindsight singleton current. Also required after any `hindsight.llm` model/provider config change \u2014 env is only re-derived on recreate, a plain docker restart is not enough (see docs/operators/hindsight-model-change.md).").option("--tag <version>", "Pin the hindsight image tag to pull + run (e.g. v0.15.18), overriding the " + "default floating `:latest`. Threaded through by `switchroom rollout` so a " + "version-pinned roll recreates hindsight on the SAME tag as the rest of the " + "fleet. Omit for `:latest` (the standalone default).").option("--provider <provider>", "LLM provider (ollama, openai, anthropic)").option("--strict-env", "Refuse the recreate (before the running container is touched) if it would drop " + "env vars that are live on the container but declared in neither `hindsight.env` " + "nor switchroom's managed defaults. Default is to warn loudly and proceed, so a " + "rollout is never wedged half-way with memory down.").option("--gpu", "Force GPU passthrough on for this launch, overriding host autodetection. " + "Use when `~/.switchroom/host-capabilities.json` is wrong or unreadable and " + "you know the host has a working nvidia container toolkit (`docker run --gpus " + "all` hard-fails container create without one). Beats `hindsight.gpu`.").option("--no-gpu", "Force GPU passthrough off for this launch, overriding host autodetection. " + "Also the explicit opt-out for the recreate GPU drop guard.").option("--allow-gpu-drop", "Proceed with a --recreate that would take GPU passthrough away from the " + "running container. Without this the recreate refuses, because that drop " + "moves the embedding model and cross-encoder reranker to CPU on the " + "interactive recall path with no other signal.").action(async (opts) => {
+    if (opts.status) {
+      if (!isDockerAvailable()) {
+        console.log(source_default.red("  Docker is not available."));
+        process.exit(1);
+      }
+      const status = getHindsightStatus();
+      if (status) {
+        console.log(source_default.bold(`
+  Hindsight container status:`));
+        console.log(`  ${source_default.cyan("switchroom-hindsight")}: ${status}
+`);
+      } else {
+        console.log(source_default.yellow(`
+  Hindsight container not found.
+`));
+        console.log(source_default.gray("  Run 'switchroom memory setup' to start it."));
+      }
+      return;
+    }
+    if (opts.stop) {
+      if (!isDockerAvailable()) {
+        console.log(source_default.red("  Docker is not available."));
+        process.exit(1);
+      }
+      if (!isHindsightContainerExists()) {
+        console.log(source_default.yellow("  No switchroom-hindsight container found."));
+        return;
+      }
+      console.log(source_default.gray("  Stopping switchroom-hindsight..."));
+      stopHindsightRecallPool();
+      stopHindsight();
+      console.log(source_default.green("  Hindsight container stopped and removed."));
+      return;
+    }
+    if (!isDockerAvailable()) {
+      console.log(source_default.red(`
+  Docker is not available.`));
+      console.log(source_default.gray(`  Install Docker: https://docs.docker.com/get-docker/
+`));
+      process.exit(1);
+    }
+    const recreate = opts.recreate === true;
+    let resolvedLlmPromise;
+    const getResolvedLlm = () => {
+      if (!resolvedLlmPromise) {
+        resolvedLlmPromise = resolveHindsightLlmSecrets(getConfig(program3).hindsight?.llm);
+      }
+      return resolvedLlmPromise;
+    };
+    let releasePin;
+    try {
+      releasePin = getConfig(program3).release?.pin ?? undefined;
+    } catch {
+      releasePin = undefined;
+    }
+    const { tag: effectiveTag, reason: tagReason } = resolveMemorySetupTag({
+      explicitTag: opts.tag,
+      releasePin
+    });
+    switch (tagReason) {
       case "invalid":
         console.error(source_default.red(`
   Invalid hindsight image tag: ${effectiveTag}
@@ -111366,9 +112436,9 @@ Repairing vector index coverage for ${target}${opts.dryRun ? source_default.yell
       captured += chunk2.toString();
       process.stdout.write(chunk2);
     });
-    const childExit = await new Promise((resolve43) => {
-      child.on("error", () => resolve43(127));
-      child.on("close", (c) => resolve43(c ?? 1));
+    const childExit = await new Promise((resolve44) => {
+      child.on("error", () => resolve44(127));
+      child.on("close", (c) => resolve44(c ?? 1));
     });
     const outcome = classifyRepairOutcome({
       childExit,
@@ -111393,7 +112463,7 @@ Repairing vector index coverage for ${target}${opts.dryRun ? source_default.yell
       process.exit(1);
     })() : Object.keys(config.agents);
     for (const name of targets) {
-      const agentDir = join88(agentsDir, name);
+      const agentDir = join89(agentsDir, name);
       const entries = readRecallLog(agentDir, limit);
       if (opts.json) {
         for (const e of entries) {
@@ -111586,11 +112656,12 @@ Observation-scope cleanup \u2014 DRY RUN (no writes)
   }));
   registerMemoryRuleCommand(memory, program3);
   registerMemoryDirectiveCommand(memory, program3);
+  registerMemoryFlipCommand(memory, program3);
 }
 
 // src/cli/web.ts
 init_source();
-import { join as join100 } from "node:path";
+import { join as join101 } from "node:path";
 import { homedir as homedir50 } from "node:os";
 
 // src/web/server.ts
@@ -111598,8 +112669,8 @@ init_merge();
 init_loader();
 init_client();
 import {
-  readFileSync as readFileSync82,
-  existsSync as existsSync90,
+  readFileSync as readFileSync83,
+  existsSync as existsSync91,
   realpathSync as realpathSync7,
   mkdirSync as mkdirSync50,
   openSync as openSync17,
@@ -111607,7 +112678,7 @@ import {
   writeSync as writeSync8,
   constants as fsConstants6
 } from "node:fs";
-import { resolve as resolve47, extname, join as join99, relative as relative5, dirname as dirname36 } from "node:path";
+import { resolve as resolve48, extname, join as join100, relative as relative5, dirname as dirname36 } from "node:path";
 import { homedir as homedir49 } from "node:os";
 import { timingSafeEqual as timingSafeEqual3, randomBytes as randomBytes15 } from "node:crypto";
 
@@ -111616,8 +112687,8 @@ init_lifecycle();
 init_manager();
 init_hindsight2();
 import { spawnSync as spawnSync17 } from "node:child_process";
-import { existsSync as existsSync86, readFileSync as readFileSync77, statSync as statSync51 } from "node:fs";
-import { resolve as resolve44, join as join95 } from "node:path";
+import { existsSync as existsSync87, readFileSync as readFileSync78, statSync as statSync52 } from "node:fs";
+import { resolve as resolve45, join as join96 } from "node:path";
 
 // src/web/memory-remediation.ts
 init_hindsight2();
@@ -111685,15 +112756,15 @@ async function buildUserProfile(mcpUrl, bank, opts) {
 init_hindsight();
 
 // src/web/blocked-approvals-read.ts
-import { readFileSync as readFileSync75, readdirSync as readdirSync30 } from "node:fs";
-import { resolve as resolve43, join as join89 } from "node:path";
+import { readFileSync as readFileSync76, readdirSync as readdirSync31 } from "node:fs";
+import { resolve as resolve44, join as join90 } from "node:path";
 import { homedir as homedir42 } from "node:os";
 function blockedApprovalsDir(home2 = process.env.SWITCHROOM_HOME ?? process.env.HOME ?? homedir42()) {
-  return resolve43(home2, ".switchroom", "blocked-approvals");
+  return resolve44(home2, ".switchroom", "blocked-approvals");
 }
 var FALLBACK_RECORD_NAME = "blocked-approval.json";
 function agentStateRoot(sharedDir) {
-  return resolve43(sharedDir, "..", "agents");
+  return resolve44(sharedDir, "..", "agents");
 }
 function finiteOrNull(v) {
   const n = Number(v);
@@ -111732,7 +112803,7 @@ function readBlockedApprovalsWithErrors(dir, agentsRoot = agentStateRoot(dir)) {
 function readSharedRecords(dir) {
   let entries;
   try {
-    entries = readdirSync30(dir);
+    entries = readdirSync31(dir);
   } catch (err) {
     if (err?.code === "ENOENT") {
       return { blocked: [], unreadable: 0 };
@@ -111746,7 +112817,7 @@ function readSharedRecords(dir) {
       continue;
     let text;
     try {
-      text = readFileSync75(join89(dir, name), "utf-8");
+      text = readFileSync76(join90(dir, name), "utf-8");
     } catch {
       unreadable++;
       continue;
@@ -111765,7 +112836,7 @@ function readSharedRecords(dir) {
 function readFallbackRecords(agentsRoot, alreadySeen) {
   let agents;
   try {
-    agents = readdirSync30(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    agents = readdirSync31(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch (err) {
     if (err?.code === "ENOENT") {
       return { blocked: [], unreadable: 0 };
@@ -111779,7 +112850,7 @@ function readFallbackRecords(agentsRoot, alreadySeen) {
       continue;
     let text;
     try {
-      text = readFileSync75(join89(agentsRoot, agent, FALLBACK_RECORD_NAME), "utf-8");
+      text = readFileSync76(join90(agentsRoot, agent, FALLBACK_RECORD_NAME), "utf-8");
     } catch (err) {
       if (err?.code !== "ENOENT")
         unreadable++;
@@ -111826,7 +112897,7 @@ init_audit_reader();
 // src/scheduler/dispatch.ts
 init_merge();
 init_overlay_loader();
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 function collectScheduleEntries(config) {
   const out = [];
   const agentNames = Object.keys(config.agents).sort();
@@ -111846,7 +112917,7 @@ function collectScheduleEntries(config) {
         cron: entry.cron,
         ...typeof title === "string" && title.length > 0 ? { name: title } : {},
         ...entry.prompt !== undefined ? { prompt: entry.prompt } : {},
-        promptKey: createHash15("sha256").update(auditMaterial).digest("hex").slice(0, 12),
+        promptKey: createHash16("sha256").update(auditMaterial).digest("hex").slice(0, 12),
         ...entry.topic !== undefined ? { topic: entry.topic } : {},
         ...entry.kind !== undefined ? { kind: entry.kind } : {},
         ...entry.model !== undefined ? { model: entry.model } : {},
@@ -111895,7 +112966,7 @@ import { homedir as homedir45 } from "node:os";
 // src/web/config-edit-plan.ts
 init_schema();
 var import_yaml17 = __toESM(require_dist(), 1);
-import { readFileSync as readFileSync76 } from "node:fs";
+import { readFileSync as readFileSync77 } from "node:fs";
 
 class ConfigPlanError extends Error {
 }
@@ -111905,7 +112976,7 @@ function composeTransforms(...transforms) {
 function planConfigEdit(configPath, transform) {
   let before;
   try {
-    before = readFileSync76(configPath, "utf-8");
+    before = readFileSync77(configPath, "utf-8");
   } catch (err) {
     throw new ConfigPlanError(`could not read config: ${err.message}`);
   }
@@ -111940,19 +113011,19 @@ import {
 } from "node:fs";
 import { spawnSync as spawnSync16 } from "node:child_process";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join91 } from "node:path";
+import { join as join92 } from "node:path";
 
 class ConfigDiffError extends Error {
 }
 function generateUnifiedDiff(before, after, name = "switchroom.yaml", gitBin = "git") {
   if (before === after)
     return "";
-  const dir = mkdtemp(join91(tmpdir5(), "switchroom-config-diff-"));
+  const dir = mkdtemp(join92(tmpdir5(), "switchroom-config-diff-"));
   try {
-    mkdirSync47(join91(dir, "cur"), { recursive: true });
-    mkdirSync47(join91(dir, "new"), { recursive: true });
-    writeFileSync32(join91(dir, "cur", name), before);
-    writeFileSync32(join91(dir, "new", name), after);
+    mkdirSync47(join92(dir, "cur"), { recursive: true });
+    mkdirSync47(join92(dir, "new"), { recursive: true });
+    writeFileSync32(join92(dir, "cur", name), before);
+    writeFileSync32(join92(dir, "new", name), after);
     const r = spawnSync16(gitBin, ["diff", "--no-index", "--no-color", "--", `cur/${name}`, `new/${name}`], { cwd: dir, encoding: "utf-8", timeout: 1e4 });
     if (r.status === 0)
       return "";
@@ -111984,9 +113055,9 @@ function generateUnifiedDiff(before, after, name = "switchroom.yaml", gitBin = "
 
 // src/web/hostd-config-propose.ts
 init_client5();
-import { existsSync as existsSync84 } from "node:fs";
+import { existsSync as existsSync85 } from "node:fs";
 import { homedir as homedir44 } from "node:os";
-import { join as join92 } from "node:path";
+import { join as join93 } from "node:path";
 var PROPOSE_TIMEOUT_MS = 61 * 60 * 1000;
 function resolveHostdOperatorSocket(env2 = process.env) {
   const override = env2.SWITCHROOM_HOSTD_OPERATOR_SOCKET;
@@ -111994,10 +113065,10 @@ function resolveHostdOperatorSocket(env2 = process.env) {
     return override;
   const candidates = [
     "/host-home/.switchroom/hostd/operator/sock",
-    join92(homedir44(), ".switchroom", "hostd", "operator", "sock")
+    join93(homedir44(), ".switchroom", "hostd", "operator", "sock")
   ];
   for (const c of candidates) {
-    if (existsSync84(c))
+    if (existsSync85(c))
       return c;
   }
   return null;
@@ -112205,7 +113276,7 @@ init_client2();
 
 // telegram-plugin/registry/turns-schema.ts
 import { chmodSync as chmodSync15 } from "fs";
-import { join as join94 } from "path";
+import { join as join95 } from "path";
 
 // src/util/state-owner.ts
 init_atomic();
@@ -112213,28 +113284,28 @@ import {
   appendFileSync as appendFileSync4,
   closeSync as closeSync16,
   constants as constants2,
-  existsSync as existsSync85,
+  existsSync as existsSync86,
   fchownSync as fchownSync2,
   fstatSync as fstatSync5,
   mkdirSync as mkdirSync48,
   openSync as openSync16,
-  readdirSync as readdirSync31,
-  statSync as statSync50,
+  readdirSync as readdirSync32,
+  statSync as statSync51,
   writeFileSync as writeFileSync33
 } from "node:fs";
-import { dirname as dirname35, join as join93, relative as relative4, sep as sep6 } from "node:path";
+import { dirname as dirname35, join as join94, relative as relative4, sep as sep6 } from "node:path";
 var NOFOLLOW = constants2.O_NOFOLLOW ?? 0;
 var ownerCache = new Map;
 var loggedFailure = false;
 function defaultLog(line) {
   process.stderr.write(line);
 }
-function noteFailure(op, path7, err, log) {
+function noteFailure(op, path9, err, log) {
   if (loggedFailure)
     return;
   loggedFailure = true;
   const code = err.code ?? "";
-  log(`switchroom state-owner: ${op} could not adopt directory ownership for ${path7}` + `${code ? ` (${code})` : ""}: ${err.message}. ` + `Continuing; state files may stay owned by the writing uid. ` + `Further ownership warnings this process are suppressed.
+  log(`switchroom state-owner: ${op} could not adopt directory ownership for ${path9}` + `${code ? ` (${code})` : ""}: ${err.message}. ` + `Continuing; state files may stay owned by the writing uid. ` + `Further ownership warnings this process are suppressed.
 `);
 }
 function isMultiplyLinked(st) {
@@ -112248,7 +113319,7 @@ function resolveStateOwner(dir) {
     return cached;
   let owner = null;
   try {
-    const st = statSync50(dir);
+    const st = statSync51(dir);
     owner = st.uid === 0 && st.gid === 0 ? null : { uid: st.uid, gid: st.gid };
   } catch {
     owner = null;
@@ -112256,13 +113327,13 @@ function resolveStateOwner(dir) {
   ownerCache.set(dir, owner);
   return owner;
 }
-function adoptStateOwnership(path7, owner, log = defaultLog) {
-  const target = owner === undefined ? resolveStateOwner(dirname35(path7)) : owner;
+function adoptStateOwnership(path9, owner, log = defaultLog) {
+  const target = owner === undefined ? resolveStateOwner(dirname35(path9)) : owner;
   if (!target)
     return;
   let fd = null;
   try {
-    fd = openSync16(path7, constants2.O_RDONLY | NOFOLLOW);
+    fd = openSync16(path9, constants2.O_RDONLY | NOFOLLOW);
     const st = fstatSync5(fd);
     if (st.uid === target.uid && st.gid === target.gid)
       return;
@@ -112271,7 +113342,7 @@ function adoptStateOwnership(path7, owner, log = defaultLog) {
     fchownSync2(fd, target.uid, target.gid);
   } catch (err) {
     if (err.code !== "ENOENT") {
-      noteFailure("adopt", path7, err, log);
+      noteFailure("adopt", path9, err, log);
     }
   } finally {
     if (fd !== null) {
@@ -112289,8 +113360,8 @@ function adoptSqliteOwnership(dbPath, log = defaultLog) {
     adoptStateOwnership(dbPath + suffix, owner, log);
   }
 }
-function mkdirStateSync(path7, options = { recursive: true }, log = defaultLog) {
-  const first = mkdirSync48(path7, { ...options, recursive: true });
+function mkdirStateSync(path9, options = { recursive: true }, log = defaultLog) {
+  const first = mkdirSync48(path9, { ...options, recursive: true });
   if (first === undefined)
     return;
   const owner = resolveStateOwner(dirname35(first));
@@ -112298,13 +113369,13 @@ function mkdirStateSync(path7, options = { recursive: true }, log = defaultLog)
     return;
   let current = first;
   adoptStateOwnership(current, owner, log);
-  const tail = relative4(first, path7);
+  const tail = relative4(first, path9);
   if (tail === "" || tail.startsWith(".."))
     return;
   for (const part of tail.split(sep6)) {
     if (part === "")
       continue;
-    current = join93(current, part);
+    current = join94(current, part);
     adoptStateOwnership(current, owner, log);
   }
 }
@@ -112381,20 +113452,20 @@ function applySchema(db) {
 }
 function openTurnsDb(agentDir) {
   const Database2 = loadDatabaseClass();
-  const dir = join94(agentDir, "telegram");
+  const dir = join95(agentDir, "telegram");
   mkdirStateSync(dir, { recursive: true, mode: 448 });
-  const path7 = join94(dir, "registry.db");
-  const db = new Database2(path7, { create: true });
+  const path9 = join95(dir, "registry.db");
+  const db = new Database2(path9, { create: true });
   applySchema(db);
   try {
-    chmodSync15(path7, 420);
+    chmodSync15(path9, 420);
     for (const suffix of ["-shm", "-wal"]) {
       try {
-        chmodSync15(path7 + suffix, 420);
+        chmodSync15(path9 + suffix, 420);
       } catch {}
     }
   } catch {}
-  adoptSqliteOwnership(path7);
+  adoptSqliteOwnership(path9);
   return db;
 }
 function mapRow(row) {
@@ -112596,7 +113667,7 @@ var DASHBOARD_CACHE_TTL = {
 };
 function readContextOccupancy(agentsDir, name) {
   try {
-    const raw = readFileSync77(resolve44(agentsDir, name, "context-occupancy.json"), "utf-8");
+    const raw = readFileSync78(resolve45(agentsDir, name, "context-occupancy.json"), "utf-8");
     const s = JSON.parse(raw);
     if (typeof s?.occupancy !== "number")
       return null;
@@ -112607,7 +113678,7 @@ function readContextOccupancy(agentsDir, name) {
 }
 function readLastTurnAt(agentsDir, name) {
   try {
-    const db = openTurnsDb(resolve44(agentsDir, name));
+    const db = openTurnsDb(resolve45(agentsDir, name));
     try {
       const turns = listTurnsForAgent(db, { limit: 1 });
       return turns.length > 0 ? turns[0].started_at : null;
@@ -112620,8 +113691,8 @@ function readLastTurnAt(agentsDir, name) {
 }
 function agentBridgeAlive(agentsDir, name, maxAgeMs = 30000, now2 = Date.now()) {
   try {
-    const f = resolve44(agentsDir, name, "telegram", ".bridge-alive");
-    return now2 - statSync51(f).mtimeMs <= maxAgeMs;
+    const f = resolve45(agentsDir, name, "telegram", ".bridge-alive");
+    return now2 - statSync52(f).mtimeMs <= maxAgeMs;
   } catch {
     return false;
   }
@@ -112719,7 +113790,7 @@ function handleGetTurns(config, sessionId, limit) {
     const agentName = parsed.agentName;
     const hasThread = "threadId" in parsed;
     const agentsDir = resolveAgentsDir(config);
-    const agentDir = resolve44(agentsDir, agentName);
+    const agentDir = resolve45(agentsDir, agentName);
     const chatId = config.agents?.[agentName]?.channels?.telegram?.chat_id ?? undefined;
     const db = openTurnsDb(agentDir);
     try {
@@ -112742,7 +113813,7 @@ function handleListThreadIds(config, agentName) {
     if (!chatId)
       return [];
     const agentsDir = resolveAgentsDir(config);
-    const db = openTurnsDb(resolve44(agentsDir, agentName));
+    const db = openTurnsDb(resolve45(agentsDir, agentName));
     try {
       return listDistinctThreadIds(db, chatId);
     } finally {
@@ -112755,7 +113826,7 @@ function handleListThreadIds(config, agentName) {
 function handleGetSubagents(config, agentName, status) {
   try {
     const agentsDir = resolveAgentsDir(config);
-    const agentDir = resolve44(agentsDir, agentName);
+    const agentDir = resolve45(agentsDir, agentName);
     const db = openTurnsDb(agentDir);
     try {
       applySubagentsSchema(db);
@@ -113012,7 +114083,7 @@ async function handleGetSystemHealth(config, home2) {
   };
   try {
     const logPath = defaultAuditLogPath2(home2);
-    if (existsSync86(logPath)) {
+    if (existsSync87(logPath)) {
       hostd.auditLogPresent = true;
       const raw = readAuditRaw(logPath);
       hostd.recent = readAndFilter(raw, {}, 1000).filter((e) => !HOSTD_NOISE_OPS.has(e.op)).slice(-10);
@@ -113321,7 +114392,7 @@ async function handleGetSchedule(config, deps = {}) {
   const recentByAgent = {};
   const agents = new Set(entries.map((e) => e.agent));
   for (const agent of agents) {
-    const rows = readRecentFires(resolve44(agentsDir, agent, "scheduler.jsonl"));
+    const rows = readRecentFires(resolve45(agentsDir, agent, "scheduler.jsonl"));
     if (rows.length > 0)
       recentByAgent[agent] = rows.slice(-10);
   }
@@ -113353,11 +114424,11 @@ async function handleGetApprovals() {
   return { reachable: true, decisions: sorted };
 }
 function brokerOperatorSocketPath(home2 = process.env.HOME || homedir45()) {
-  return join95(home2, ".switchroom", "broker-operator", "sock");
+  return join96(home2, ".switchroom", "broker-operator", "sock");
 }
 function resolveBrokerOperatorSocket(home2 = process.env.HOME || homedir45()) {
   const p = brokerOperatorSocketPath(home2);
-  return existsSync86(p) ? p : null;
+  return existsSync87(p) ? p : null;
 }
 async function handleGetGrants(deps = {}) {
   const socket = "socketPath" in deps ? deps.socketPath : resolveBrokerOperatorSocket();
@@ -113748,8 +114819,8 @@ async function handleGetSummary(deps, now2 = Date.now()) {
 init_fleet_health_read();
 
 // src/web/webhook-handler.ts
-import { appendFileSync as appendFileSync5, existsSync as existsSync88, mkdirSync as mkdirSync49, readFileSync as readFileSync80, writeFileSync as writeFileSync34 } from "fs";
-import { join as join97 } from "path";
+import { appendFileSync as appendFileSync5, existsSync as existsSync89, mkdirSync as mkdirSync49, readFileSync as readFileSync81, writeFileSync as writeFileSync34 } from "fs";
+import { join as join98 } from "path";
 import { homedir as homedir48 } from "os";
 
 // src/web/webhook-verify.ts
@@ -113917,7 +114988,7 @@ init_log_rotation();
 import net4 from "node:net";
 function forwardToGateway(socketPath, req, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 5000;
-  return new Promise((resolve46) => {
+  return new Promise((resolve47) => {
     let settled = false;
     let buf = "";
     const done = (value) => {
@@ -113927,7 +114998,7 @@ function forwardToGateway(socketPath, req, opts = {}) {
       try {
         conn.destroy();
       } catch {}
-      resolve46(value);
+      resolve47(value);
     };
     const conn = net4.createConnection(socketPath);
     conn.setEncoding("utf8");
@@ -113958,20 +115029,20 @@ function forwardToGateway(socketPath, req, opts = {}) {
 }
 
 // src/web/webhook-edge.ts
-import { existsSync as existsSync87, readFileSync as readFileSync79 } from "fs";
-import { join as join96 } from "path";
+import { existsSync as existsSync88, readFileSync as readFileSync80 } from "fs";
+import { join as join97 } from "path";
 import { homedir as homedir47 } from "os";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var EDGE_HEADER = "x-switchroom-edge";
 function edgeSecretPath() {
-  return join96(homedir47(), ".switchroom", "webhook-edge-secret");
+  return join97(homedir47(), ".switchroom", "webhook-edge-secret");
 }
-function loadEdgeSecret(path7) {
-  const p = path7 ?? edgeSecretPath();
+function loadEdgeSecret(path9) {
+  const p = path9 ?? edgeSecretPath();
   try {
-    if (!existsSync87(p))
+    if (!existsSync88(p))
       return null;
-    const raw = readFileSync79(p, "utf-8").trim();
+    const raw = readFileSync80(p, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -114020,17 +115091,17 @@ function jsonReply(status, body, extraHeaders) {
 }
 var DEDUP_MAX = 1000;
 var DEDUP_TTL_MS = 24 * 60 * 60 * 1000;
-function loadDedupFile(path7) {
+function loadDedupFile(path9) {
   try {
-    if (!existsSync88(path7))
+    if (!existsSync89(path9))
       return {};
-    const raw = JSON.parse(readFileSync80(path7, "utf-8"));
+    const raw = JSON.parse(readFileSync81(path9, "utf-8"));
     return typeof raw.deliveries === "object" && raw.deliveries !== null ? raw.deliveries : {};
   } catch {
     return {};
   }
 }
-function saveDedupFile(path7, deliveries, now2) {
+function saveDedupFile(path9, deliveries, now2) {
   const pruned = {};
   for (const [id, ts] of Object.entries(deliveries)) {
     if (now2 - ts < DEDUP_TTL_MS)
@@ -114038,7 +115109,7 @@ function saveDedupFile(path7, deliveries, now2) {
   }
   const sorted = Object.entries(pruned).sort((a, b) => b[1] - a[1]).slice(0, DEDUP_MAX);
   const final = Object.fromEntries(sorted);
-  writeFileSync34(path7, JSON.stringify({ deliveries: final }), {
+  writeFileSync34(path9, JSON.stringify({ deliveries: final }), {
     mode: 384
   });
 }
@@ -114046,8 +115117,8 @@ var agentDedupCache = new Map;
 function createFileDedupStore(resolveAgentDir2) {
   return {
     check(agent, deliveryId, now2) {
-      const telegramDir = join97(resolveAgentDir2(agent), "telegram");
-      const filePath = join97(telegramDir, "webhook-dedup.json");
+      const telegramDir = join98(resolveAgentDir2(agent), "telegram");
+      const filePath = join98(telegramDir, "webhook-dedup.json");
       if (!agentDedupCache.has(agent)) {
         agentDedupCache.set(agent, loadDedupFile(filePath));
       }
@@ -114099,7 +115170,7 @@ function shouldWriteThrottleIssue(agent, source, now2, windowMap) {
   return true;
 }
 function writeThrottleIssue(agent, source, now2, telegramDir, log) {
-  const issuesPath = join97(telegramDir, "issues.jsonl");
+  const issuesPath = join98(telegramDir, "issues.jsonl");
   try {
     mkdirSync49(telegramDir, { recursive: true });
     const record = {
@@ -114124,7 +115195,7 @@ function writeThrottleIssue(agent, source, now2, telegramDir, log) {
 async function handleWebhookIngest(args, deps = {}) {
   const log = deps.log ?? ((s) => process.stderr.write(s));
   const now2 = (deps.now ?? Date.now)();
-  const resolveAgentDir2 = deps.resolveAgentDir ?? ((a) => join97(homedir48(), ".switchroom", "agents", a));
+  const resolveAgentDir2 = deps.resolveAgentDir ?? ((a) => join98(homedir48(), ".switchroom", "agents", a));
   const rateLimiter = deps.rateLimiter ?? defaultRateLimiter;
   const dedupStore = deps.dedupStore ?? createFileDedupStore(resolveAgentDir2);
   if (!args.agentExists) {
@@ -114191,7 +115262,7 @@ async function handleWebhookIngest(args, deps = {}) {
   if (retryAfter !== null) {
     if (!args.viaGateway) {
       const agentDir2 = resolveAgentDir2(args.agent);
-      const telegramDir2 = join97(agentDir2, "telegram");
+      const telegramDir2 = join98(agentDir2, "telegram");
       if (shouldWriteThrottleIssue(args.agent, source, now2)) {
         writeThrottleIssue(args.agent, source, now2, telegramDir2, log);
       }
@@ -114211,7 +115282,7 @@ async function handleWebhookIngest(args, deps = {}) {
   const eventType = source === "github" ? args.headers.get("x-github-event") ?? "unknown" : source === "linear" ? String(payload.type ?? "unknown").toLowerCase() : args.source;
   const rendered = source === "github" ? renderGithubEvent(eventType, payload) : source === "linear" ? renderLinearEvent(eventType, payload) : renderGenericEvent(args.source, payload);
   if (args.viaGateway) {
-    const socketPath = join97(resolveAgentDir2(args.agent), "telegram", "webhook.sock");
+    const socketPath = join98(resolveAgentDir2(args.agent), "telegram", "webhook.sock");
     const forward = deps.forwardFn ?? forwardToGateway;
     const deliveryId = source === "github" ? args.headers.get("x-github-delivery") ?? undefined : undefined;
     let resp;
@@ -114250,8 +115321,8 @@ async function handleWebhookIngest(args, deps = {}) {
     return jsonReply(202, { ok: true, recorded: true, ts: resp.ts });
   }
   const agentDir = resolveAgentDir2(args.agent);
-  const telegramDir = join97(agentDir, "telegram");
-  const logPath = join97(telegramDir, "webhook-events.jsonl");
+  const telegramDir = join98(agentDir, "telegram");
+  const logPath = join98(telegramDir, "webhook-events.jsonl");
   try {
     mkdirSync49(telegramDir, { recursive: true });
     rotateWebhookLogIfNeeded(logPath);
@@ -114280,9 +115351,9 @@ init_shipped_assets();
 // src/web/hermes-adapter.ts
 init_loader();
 import { createConnection as createConnection3 } from "node:net";
-import { createHash as createHash16 } from "node:crypto";
-import { join as join98, resolve as resolve46 } from "node:path";
-import { existsSync as existsSync89, readFileSync as readFileSync81 } from "node:fs";
+import { createHash as createHash17 } from "node:crypto";
+import { join as join99, resolve as resolve47 } from "node:path";
+import { existsSync as existsSync90, readFileSync as readFileSync82 } from "node:fs";
 
 // src/agent-scheduler/channel-target.ts
 init_merge();
@@ -114326,8 +115397,8 @@ function agentLiveness(config, agentName) {
   const agentsDir = resolveAgentsDir(config);
   if (agentBridgeAlive(agentsDir, agentName))
     return "active";
-  const alive = join98(agentsDir, agentName, "telegram", ".bridge-alive");
-  if (existsSync89(alive))
+  const alive = join99(agentsDir, agentName, "telegram", ".bridge-alive");
+  if (existsSync90(alive))
     return "idle";
   return "offline";
 }
@@ -114435,11 +115506,11 @@ function resolveAgentChat(config, sessionId, agentsDir) {
     const threadId = topicId !== undefined ? topicId === null ? undefined : parseInt(topicId, 10) || undefined : channel.threadId;
     return { chatId: channel.chatId, threadId };
   }
-  const accessPath = resolve46(agentsDir, agentName, "telegram", "access.json");
-  if (!existsSync89(accessPath))
+  const accessPath = resolve47(agentsDir, agentName, "telegram", "access.json");
+  if (!existsSync90(accessPath))
     return null;
   try {
-    const raw = readFileSync81(accessPath, "utf-8");
+    const raw = readFileSync82(accessPath, "utf-8");
     const access = JSON.parse(raw);
     const chatId = access.allowFrom?.[0];
     if (!chatId)
@@ -114450,8 +115521,8 @@ function resolveAgentChat(config, sessionId, agentsDir) {
   }
 }
 async function injectInbound(agentsDir, agentName, chatId, threadId, text, promptKey) {
-  const socketPath = resolve46(agentsDir, agentName, "telegram", "gateway.sock");
-  if (!existsSync89(socketPath)) {
+  const socketPath = resolve47(agentsDir, agentName, "telegram", "gateway.sock");
+  if (!existsSync90(socketPath)) {
     return { ok: false, error: `agent ${agentName} gateway socket not found \u2014 is it running?` };
   }
   const ts = Date.now();
@@ -114498,8 +115569,8 @@ async function injectInbound(agentsDir, agentName, chatId, threadId, text, promp
   });
 }
 function readHistoryDb(agentsDir, agentName, limit) {
-  const dbPath = resolve46(agentsDir, agentName, "telegram", "history.db");
-  if (!existsSync89(dbPath))
+  const dbPath = resolve47(agentsDir, agentName, "telegram", "history.db");
+  if (!existsSync90(dbPath))
     return null;
   try {
     let SqliteDatabase;
@@ -114528,7 +115599,7 @@ function readHistoryDb(agentsDir, agentName, limit) {
   }
 }
 function startHistoryPoll(ctx, agentsDir, agentName, sessionId, pollIntervalMs = 2000) {
-  const dbPath = resolve46(agentsDir, agentName, "telegram", "history.db");
+  const dbPath = resolve47(agentsDir, agentName, "telegram", "history.db");
   let SqliteDatabase = null;
   try {
     const meta = import.meta;
@@ -114538,7 +115609,7 @@ function startHistoryPoll(ctx, agentsDir, agentName, sessionId, pollIntervalMs =
     }
   } catch {}
   let cursor = 0;
-  if (SqliteDatabase && existsSync89(dbPath)) {
+  if (SqliteDatabase && existsSync90(dbPath)) {
     try {
       const db = new SqliteDatabase(dbPath, { readonly: true });
       try {
@@ -114550,7 +115621,7 @@ function startHistoryPoll(ctx, agentsDir, agentName, sessionId, pollIntervalMs =
     } catch {}
   }
   const timer = setInterval(() => {
-    if (!SqliteDatabase || !existsSync89(dbPath))
+    if (!SqliteDatabase || !existsSync90(dbPath))
       return;
     try {
       const db = new SqliteDatabase(dbPath, { readonly: true });
@@ -115213,7 +116284,7 @@ async function onHermesMessage(ctx, raw) {
         sendResponse(ctx, rpcErr(id, -32603, `Could not resolve chat for ${sessionId} \u2014 ensure the agent has telegram.forum_chat_id or channels.telegram.chat_id configured.`));
         break;
       }
-      const promptKey = createHash16("sha256").update(`${sessionId}:${Date.now()}:${content}`).digest("hex").slice(0, 12);
+      const promptKey = createHash17("sha256").update(`${sessionId}:${Date.now()}:${content}`).digest("hex").slice(0, 12);
       sendEvent(ctx, "message.start", sessionId, { prompt_key: promptKey });
       pendingPromptKeys(ctx).set(sessionId, promptKey);
       const result = await injectInbound(agentsDir, submitAgent, chat.chatId, chat.threadId, content, promptKey);
@@ -115409,9 +116480,9 @@ function resolveWebToken() {
   if (fromEnv && fromEnv.length > 0)
     return fromEnv;
   const home2 = process.env.HOME ?? homedir49();
-  const tokenPath = join99(home2, ".switchroom", "web-token");
-  if (existsSync90(tokenPath)) {
-    const existing = readFileSync82(tokenPath, "utf8").trim();
+  const tokenPath = join100(home2, ".switchroom", "web-token");
+  if (existsSync91(tokenPath)) {
+    const existing = readFileSync83(tokenPath, "utf8").trim();
     if (existing.length > 0)
       return existing;
   }
@@ -115428,7 +116499,7 @@ function resolveWebToken() {
     return token;
   } catch (err) {
     if (err.code === "EEXIST") {
-      const existing = readFileSync82(tokenPath, "utf8").trim();
+      const existing = readFileSync83(tokenPath, "utf8").trim();
       if (existing.length > 0)
         return existing;
     }
@@ -115501,14 +116572,14 @@ function checkWsAuth(req, token, server) {
   return presented !== null && constantTimeEqual(presented, token);
 }
 function loadWebhookSecrets() {
-  const path7 = join99(homedir49(), ".switchroom", "webhook-secrets.json");
-  if (!existsSync90(path7))
+  const path9 = join100(homedir49(), ".switchroom", "webhook-secrets.json");
+  if (!existsSync91(path9))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync82(path7, "utf-8"));
+    const parsed = JSON.parse(readFileSync83(path9, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (err) {
-    process.stderr.write(`webhook-ingest: failed to parse ${path7}: ${err.message} \u2014 webhooks will return 401 until fixed
+    process.stderr.write(`webhook-ingest: failed to parse ${path9}: ${err.message} \u2014 webhooks will return 401 until fixed
 `);
     return {};
   }
@@ -115695,11 +116766,11 @@ function resolveUiDir(probe2 = {
   bundleDir: import.meta.dirname,
   execPath: process.execPath
 }) {
-  return resolveShippedAsset(WEB_UI_ASSET, probe2).path ?? resolve47(probe2.bundleDir, WEB_UI_ASSET.asset);
+  return resolveShippedAsset(WEB_UI_ASSET, probe2).path ?? resolve48(probe2.bundleDir, WEB_UI_ASSET.asset);
 }
 function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
   const uiDirRaw = resolveUiDir();
-  const uiDir = existsSync90(uiDirRaw) ? realpathSync7(uiDirRaw) : uiDirRaw;
+  const uiDir = existsSync91(uiDirRaw) ? realpathSync7(uiDirRaw) : uiDirRaw;
   const token = resolveWebToken();
   const freshConfig = () => {
     if (!configPath)
@@ -115999,8 +117070,8 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         })();
       }
       const filePath = resolveDashboardFilePath(pathname);
-      const fullPath = join99(uiDir, filePath);
-      if (!existsSync90(fullPath)) {
+      const fullPath = join100(uiDir, filePath);
+      if (!existsSync91(fullPath)) {
         return new Response("Not Found", { status: 404 });
       }
       let realFullPath;
@@ -116010,12 +117081,12 @@ function startWebServer(config, port, hostname = "127.0.0.1", configPath) {
         return new Response("Not Found", { status: 404 });
       }
       const rel = relative5(uiDir, realFullPath);
-      if (rel.startsWith("..") || resolve47(uiDir, rel) !== realFullPath) {
+      if (rel.startsWith("..") || resolve48(uiDir, rel) !== realFullPath) {
         return new Response("Forbidden", { status: 403 });
       }
       const ext = extname(realFullPath);
       const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
-      const content = readFileSync82(realFullPath);
+      const content = readFileSync83(realFullPath);
       const headers = { "Content-Type": contentType };
       const cacheControl = dashboardCacheControl(ext);
       if (cacheControl)
@@ -116138,13 +117209,13 @@ init_helpers();
 init_loader();
 
 // src/web/startup-guard.ts
-import { existsSync as existsSync91, readFileSync as readFileSync83, writeFileSync as writeFileSync35, mkdirSync as mkdirSync51, statSync as statSync52, unlinkSync as unlinkSync18 } from "node:fs";
+import { existsSync as existsSync92, readFileSync as readFileSync84, writeFileSync as writeFileSync35, mkdirSync as mkdirSync51, statSync as statSync53, unlinkSync as unlinkSync18 } from "node:fs";
 import { dirname as dirname37 } from "node:path";
 function detectConfigMountFault(configPath, deps = {}) {
-  const stat = deps.stat ?? ((p) => statSync52(p));
+  const stat2 = deps.stat ?? ((p) => statSync53(p));
   let st;
   try {
-    st = stat(configPath);
+    st = stat2(configPath);
   } catch {
     return null;
   }
@@ -116174,9 +117245,9 @@ function nextCrashBackoff(prior, now2, options = {}) {
 }
 function readCrashState(statePath) {
   try {
-    if (!existsSync91(statePath))
+    if (!existsSync92(statePath))
       return null;
-    const raw = JSON.parse(readFileSync83(statePath, "utf-8"));
+    const raw = JSON.parse(readFileSync84(statePath, "utf-8"));
     if (typeof raw.count !== "number" || typeof raw.lastTs !== "number")
       return null;
     return { count: raw.count, lastTs: raw.lastTs };
@@ -116192,7 +117263,7 @@ function writeCrashState(statePath, state) {
 }
 function clearCrashState(statePath) {
   try {
-    if (existsSync91(statePath))
+    if (existsSync92(statePath))
       unlinkSync18(statePath);
   } catch {}
 }
@@ -116215,7 +117286,7 @@ async function handleWebStartupFailure(err, configPath, stateFile) {
   throw err;
 }
 function webCrashStatePath() {
-  return join100(homedir50(), ".switchroom", "web", ".crashloop-state.json");
+  return join101(homedir50(), ".switchroom", "web", ".crashloop-state.json");
 }
 function registerWebCommand(program3) {
   program3.command("web").description("Start the web dashboard for monitoring agents").option("-p, --port <port>", "Port to listen on", "8080").option("-b, --bind <host>", "Host/IP to bind to (default: 127.0.0.1, localhost-only)", "127.0.0.1").action(withConfigError(async (opts) => {
@@ -116282,9 +117353,9 @@ init_embedded_examples();
 init_atomic();
 init_loader();
 init_scaffold();
-import { existsSync as existsSync93, readFileSync as readFileSync84, mkdirSync as mkdirSync52, statSync as statSync53, writeFileSync as writeFileSync36 } from "node:fs";
+import { existsSync as existsSync94, readFileSync as readFileSync85, mkdirSync as mkdirSync52, statSync as statSync54, writeFileSync as writeFileSync36 } from "node:fs";
 import { execFileSync as execFileSync29 } from "node:child_process";
-import { resolve as resolve48, dirname as dirname38 } from "node:path";
+import { resolve as resolve49, dirname as dirname38 } from "node:path";
 init_state();
 init_vault();
 init_manager();
@@ -116699,7 +117770,7 @@ ${status} ${source_default.bold(`Step ${num3}:`)} ${title}`);
 init_source();
 init_loader();
 init_hindsight();
-import { existsSync as existsSync92 } from "node:fs";
+import { existsSync as existsSync93 } from "node:fs";
 var HINDSIGHT_READY_RETRIES = 5;
 var HINDSIGHT_READY_INTERVAL_MS = 1000;
 async function resolveLiteLLMForHindsight2(config, deps = {}) {
@@ -116736,7 +117807,7 @@ async function stepMemoryBackend(config, nonInteractive, switchroomConfigPath, d
   try {
     const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
     const passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
-    if (passphrase && existsSync92(vaultPath)) {
+    if (passphrase && existsSync93(vaultPath)) {
       const { getStringSecret: getStringSecret2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
       const existing = getStringSecret2(passphrase, vaultPath, "hindsight-api-key");
       if (existing) {
@@ -117006,7 +118077,7 @@ async function stepMemoryBackend(config, nonInteractive, switchroomConfigPath, d
 function writeSwitchroomYaml(configPath, text) {
   let mode = 420;
   try {
-    mode = statSync53(configPath).mode & 511;
+    mode = statSync54(configPath).mode & 511;
   } catch {}
   writeConfigFileSync(configPath, text, mode);
 }
@@ -117105,7 +118176,7 @@ async function stepConfigFile(configPath, nonInteractive) {
       existingConfig = null;
     }
   }
-  if (existingConfig && existsSync93(existingConfig)) {
+  if (existingConfig && existsSync94(existingConfig)) {
     if (!nonInteractive) {
       const useExisting = await askYesNo(`  Found ${source_default.cyan(existingConfig)}. Use it?`, true);
       if (!useExisting) {
@@ -117117,9 +118188,9 @@ async function stepConfigFile(configPath, nonInteractive) {
     console.log(source_default.green(`  ${STEP_DONE} Config loaded`) + source_default.gray(` (${Object.keys(config.agents).length} agents)`));
     const hasExplicitTimezone = config.switchroom?.timezone !== undefined || config.defaults?.timezone !== undefined;
     if (!hasExplicitTimezone) {
-      await writeDetectedTimezone(resolve48(existingConfig), nonInteractive);
+      await writeDetectedTimezone(resolve49(existingConfig), nonInteractive);
     }
-    return { config, configPath: resolve48(existingConfig) };
+    return { config, configPath: resolve49(existingConfig) };
   }
   return await copyExampleConfig2(nonInteractive);
 }
@@ -117146,12 +118217,12 @@ async function copyExampleConfig2(nonInteractive) {
   await writeDetectedTimezone(destFile, nonInteractive);
   const config = loadConfig(destFile);
   console.log(source_default.green(`  ${STEP_DONE} Config loaded`) + source_default.gray(` (${Object.keys(config.agents).length} agents)`));
-  return { config, configPath: resolve48(destFile) };
+  return { config, configPath: resolve49(destFile) };
 }
 async function writeDetectedTimezone(destFile, nonInteractive, detect = detectServerTimezone, prompt = ask) {
   const detected = detect();
   if (detected !== undefined && detected !== "UTC" && isValidTimezone(detected)) {
-    const before2 = readFileSync84(destFile, "utf-8");
+    const before2 = readFileSync85(destFile, "utf-8");
     const after2 = setSwitchroomTimezone(before2, detected);
     if (after2 !== before2)
       writeSwitchroomYaml(destFile, after2);
@@ -117172,7 +118243,7 @@ async function writeDetectedTimezone(destFile, nonInteractive, detect = detectSe
     console.error(source_default.yellow(`  \u26a0 "${zone}" is not a valid IANA zone (expected Region/City like ` + '"Australia/Melbourne"). Skipping \u2014 agents will use UTC. ' + "Edit switchroom.timezone in switchroom.yaml by hand."));
     return;
   }
-  const before = readFileSync84(destFile, "utf-8");
+  const before = readFileSync85(destFile, "utf-8");
   const after = setSwitchroomTimezone(before, zone);
   if (after !== before)
     writeSwitchroomYaml(destFile, after);
@@ -117251,7 +118322,7 @@ async function resolveOrPromptToken(rawToken, label, config, nonInteractive) {
       try {
         const { openVault: openVault2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
         const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-        if (existsSync93(vaultPath)) {
+        if (existsSync94(vaultPath)) {
           const secrets = openVault2(passphrase, vaultPath);
           const key = rawToken.replace("vault:", "");
           const entry = secrets[key];
@@ -117279,7 +118350,7 @@ async function resolveOrPromptToken(rawToken, label, config, nonInteractive) {
 async function storeTokenInVault(config, vaultRef, token) {
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
   const key = vaultRef.replace("vault:", "");
-  if (!existsSync93(vaultPath)) {
+  if (!existsSync94(vaultPath)) {
     console.log(source_default.gray("  Creating encrypted vault..."));
     let passphrase = process.env.SWITCHROOM_VAULT_PASSPHRASE;
     if (!passphrase) {
@@ -117562,13 +118633,13 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
     return;
   }
   const vaultPath = resolvePath(config.vault?.path ?? "~/.switchroom/vault.enc");
-  if (!existsSync93(vaultPath)) {
+  if (!existsSync94(vaultPath)) {
     console.log(source_default.gray("  Skipping (vault not created yet)."));
     return;
   }
   const credPathRaw = config.vault?.broker?.autoUnlockCredentialPath ?? "~/.switchroom/vault-auto-unlock";
   const credPath = resolvePath(credPathRaw);
-  if (config.vault?.broker?.autoUnlock === true && existsSync93(credPath)) {
+  if (config.vault?.broker?.autoUnlock === true && existsSync94(credPath)) {
     console.log(source_default.green(`  ${STEP_DONE} Already configured (${credPath})`));
     return;
   }
@@ -117646,10 +118717,10 @@ async function stepAutoUnlock(config, switchroomConfigPath, nonInteractive) {
   }
 }
 function persistApprovalAuthTelegramId(configPath) {
-  if (!existsSync93(configPath)) {
+  if (!existsSync94(configPath)) {
     throw new ConfigError(`Cannot persist vault.broker.approvalAuth: config not found at ${configPath}`);
   }
-  const content = readFileSync84(configPath, "utf-8");
+  const content = readFileSync85(configPath, "utf-8");
   const result = insertVaultBrokerApprovalAuth(content, "telegram-id");
   if (result.kind === "rewritten") {
     writeSwitchroomYaml(configPath, result.content);
@@ -117657,10 +118728,10 @@ function persistApprovalAuthTelegramId(configPath) {
   return result.kind;
 }
 function persistDangerousMode(config, configPath) {
-  if (!existsSync93(configPath)) {
+  if (!existsSync94(configPath)) {
     throw new ConfigError(`Cannot persist dangerous_mode: config not found at ${configPath}`);
   }
-  let content = readFileSync84(configPath, "utf-8");
+  let content = readFileSync85(configPath, "utf-8");
   const agentNames = Object.keys(config.agents);
   for (const name of agentNames) {
     const agentPattern = new RegExp(`(^  ${name}:\\s*\\n)`, "m");
@@ -117700,7 +118771,7 @@ async function stepOnboardingGuidance(config, nonInteractive) {
   const agentNames = Object.keys(config.agents);
   let allAuthenticated = true;
   for (const name of agentNames) {
-    const agentDir = resolve48(agentsDir, name);
+    const agentDir = resolve49(agentsDir, name);
     const status = getAuthStatus(name, agentDir);
     if (status.authenticated) {
       console.log(`  ${source_default.green("OK")} ${source_default.bold(name)}` + source_default.gray(` - authenticated (expires: ${status.timeUntilExpiry ?? "unknown"})`));
@@ -117796,7 +118867,7 @@ async function stepVerification(config, nonInteractive, deps = {}, expect = {})
   const findings = [];
   let applyPending = false;
   if (!nonInteractive && agentNames.length > 0) {
-    const composeExists = (deps.composeFileExists ?? (() => existsSync93(composeFilePath())))();
+    const composeExists = (deps.composeFileExists ?? (() => existsSync94(composeFilePath())))();
     if (!composeExists) {
       applyPending = true;
       log(source_default.gray("  Not started: `switchroom apply` has not generated the compose file yet."));
@@ -117893,9 +118964,9 @@ init_source();
 init_loader();
 init_lifecycle();
 init_compose_env();
-import { existsSync as existsSync97, mkdirSync as mkdirSync56, readFileSync as readFileSync88, realpathSync as realpathSync8, statSync as statSync56, chownSync as chownSync13 } from "node:fs";
+import { existsSync as existsSync98, mkdirSync as mkdirSync56, readFileSync as readFileSync89, realpathSync as realpathSync8, statSync as statSync57, chownSync as chownSync13 } from "node:fs";
 import { spawnSync as spawnSync20 } from "node:child_process";
-import { join as join101, dirname as dirname42 } from "node:path";
+import { join as join102, dirname as dirname42 } from "node:path";
 import { homedir as homedir51 } from "node:os";
 
 // src/cli/release-yaml.ts
@@ -117956,7 +119027,7 @@ init_operator_uid();
 init_atomic();
 
 // src/cli/preflight-mounts.ts
-import { statSync as statSync54 } from "node:fs";
+import { statSync as statSync55 } from "node:fs";
 function parseHostBindSources(composeText) {
   const out = [];
   const FILE_HINT = /\.(ya?ml|db|log|toml|json|token|id)$|\/\.vault-token$|machine-id$|localtime$|vault-auto-unlock$|\/webkite$/;
@@ -117983,7 +119054,7 @@ function parseHostBindSources(composeText) {
   return out;
 }
 function validateBindSources(composeText, deps = {}) {
-  const stat = deps.stat ?? ((p) => statSync54(p));
+  const stat2 = deps.stat ?? ((p) => statSync55(p));
   const sources = parseHostBindSources(composeText);
   const issues = [];
   const seen = new Set;
@@ -117995,7 +119066,7 @@ function validateBindSources(composeText, deps = {}) {
     checked++;
     let st = null;
     try {
-      st = stat(source);
+      st = stat2(source);
     } catch {
       st = null;
     }
@@ -118029,18 +119100,18 @@ init_self_update();
 init_shipped_assets();
 
 // src/cli/self-update-io.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 import {
   chmodSync as chmodSync16,
   closeSync as closeSync18,
   copyFileSync as copyFileSync12,
   createWriteStream,
-  existsSync as existsSync94,
+  existsSync as existsSync95,
   lstatSync as lstatSync13,
   mkdirSync as mkdirSync53,
   openSync as openSync18,
-  readdirSync as readdirSync32,
-  readFileSync as readFileSync85,
+  readdirSync as readdirSync33,
+  readFileSync as readFileSync86,
   readSync as readSync6,
   renameSync as renameSync23,
   rmSync as rmSync18,
@@ -118079,9 +119150,9 @@ function defaultSelfUpdateIO() {
         throw new Error(`empty response body for ${url}`);
       await pipeline(Readable.fromWeb(res.body), createWriteStream(dest));
     },
-    sha256File(path7) {
-      const hash2 = createHash17("sha256");
-      const fd = openSync18(path7, "r");
+    sha256File(path9) {
+      const hash2 = createHash18("sha256");
+      const fd = openSync18(path9, "r");
       try {
         const buf = Buffer.allocUnsafe(1 << 20);
         for (;; ) {
@@ -118095,8 +119166,8 @@ function defaultSelfUpdateIO() {
       }
       return hash2.digest("hex");
     },
-    probeBinary(path7) {
-      const r = spawnSync18(path7, ["--version"], {
+    probeBinary(path9) {
+      const r = spawnSync18(path9, ["--version"], {
         encoding: "utf-8",
         timeout: 30000,
         env: { ...process.env, SWITCHROOM_SELF_UPDATED: "" }
@@ -118136,24 +119207,24 @@ function defaultSelfUpdateIO() {
     copyFile(src, dest) {
       copyFileSync12(src, dest);
     },
-    chmodExec(path7) {
-      chmodSync16(path7, 493);
+    chmodExec(path9) {
+      chmodSync16(path9, 493);
     },
     rename(src, dest) {
       renameSync23(src, dest);
     },
-    remove(path7) {
-      rmSync18(path7, { force: true });
+    remove(path9) {
+      rmSync18(path9, { force: true });
     },
-    exists(path7) {
-      return existsSync94(path7);
+    exists(path9) {
+      return existsSync95(path9);
     },
-    dirname(path7) {
-      return dirname39(path7);
+    dirname(path9) {
+      return dirname39(path9);
     },
-    readText(path7) {
+    readText(path9) {
       try {
-        return readFileSync85(path7, "utf-8");
+        return readFileSync86(path9, "utf-8");
       } catch {
         return null;
       }
@@ -118173,19 +119244,19 @@ function defaultSelfUpdateIO() {
     symlink(target, linkPath) {
       symlinkSync5(target, linkPath);
     },
-    isSymlink(path7) {
+    isSymlink(path9) {
       try {
-        return lstatSync13(path7).isSymbolicLink();
+        return lstatSync13(path9).isSymbolicLink();
       } catch {
         return false;
       }
     },
-    removeTree(path7) {
-      rmSync18(path7, { recursive: true, force: true });
+    removeTree(path9) {
+      rmSync18(path9, { recursive: true, force: true });
     },
     listDir(dir) {
       try {
-        return readdirSync32(dir);
+        return readdirSync33(dir);
       } catch {
         return [];
       }
@@ -118200,7 +119271,7 @@ init_install_cron();
 
 // src/memory/mm-refresh-cron.ts
 import { execFileSync as execFileSync30 } from "node:child_process";
-import { chownSync as chownSync12, existsSync as existsSync95, mkdirSync as mkdirSync54, readFileSync as readFileSync86, renameSync as renameSync24, statSync as statSync55, writeFileSync as writeFileSync37 } from "node:fs";
+import { chownSync as chownSync12, existsSync as existsSync96, mkdirSync as mkdirSync54, readFileSync as readFileSync87, renameSync as renameSync24, statSync as statSync56, writeFileSync as writeFileSync37 } from "node:fs";
 import { dirname as dirname40 } from "node:path";
 var CRON_PATH3 = "/etc/cron.d/mental-model-refresh";
 var CRON_SCHEDULE2 = "27 4 * * *";
@@ -118217,20 +119288,20 @@ function renderCron3(opts) {
 `;
 }
 function installCron3(opts) {
-  const path7 = opts.path ?? CRON_PATH3;
+  const path9 = opts.path ?? CRON_PATH3;
   const content = renderCron3(opts);
-  if (existsSync95(path7)) {
+  if (existsSync96(path9)) {
     try {
-      if (readFileSync86(path7, "utf8") === content) {
-        return { status: "unchanged", path: path7, content };
+      if (readFileSync87(path9, "utf8") === content) {
+        return { status: "unchanged", path: path9, content };
       }
     } catch {}
   }
-  mkdirSync54(dirname40(path7), { recursive: true });
-  const tmp = `${path7}.${process.pid}.tmp`;
+  mkdirSync54(dirname40(path9), { recursive: true });
+  const tmp = `${path9}.${process.pid}.tmp`;
   writeFileSync37(tmp, content, { mode: 420 });
-  renameSync24(tmp, path7);
-  return { status: "installed", path: path7, content };
+  renameSync24(tmp, path9);
+  return { status: "installed", path: path9, content };
 }
 var defaultIdResolver3 = (user) => {
   const uid = Number(execFileSync30("id", ["-u", user], { encoding: "utf8" }).trim());
@@ -118241,27 +119312,27 @@ var defaultIdResolver3 = (user) => {
   return { uid, gid };
 };
 function ensureLogFile3(opts) {
-  const path7 = opts.path ?? CRON_LOG_PATH3;
-  if (existsSync95(path7))
-    return { status: "unchanged", path: path7 };
+  const path9 = opts.path ?? CRON_LOG_PATH3;
+  if (existsSync96(path9))
+    return { status: "unchanged", path: path9 };
   const { uid, gid } = (opts.resolveIds ?? defaultIdResolver3)(opts.user);
-  mkdirSync54(dirname40(path7), { recursive: true });
-  writeFileSync37(path7, "", { mode: 420, flag: "a" });
+  mkdirSync54(dirname40(path9), { recursive: true });
+  writeFileSync37(path9, "", { mode: 420, flag: "a" });
   const isRoot = process.getuid?.() === 0;
   let alreadyOwned = false;
   try {
-    const st = statSync55(path7);
+    const st = statSync56(path9);
     alreadyOwned = st.uid === uid && st.gid === gid;
   } catch {}
   if (isRoot && !alreadyOwned) {
     try {
-      chownSync12(path7, uid, gid);
+      chownSync12(path9, uid, gid);
     } catch (e) {
       if (e.code !== "EPERM")
         throw e;
     }
   }
-  return { status: "created", path: path7 };
+  return { status: "created", path: path9 };
 }
 function renderLogrotate3(opts) {
   return `${opts.logPath} {
@@ -118277,20 +119348,20 @@ function renderLogrotate3(opts) {
 `;
 }
 function installLogrotate3(opts) {
-  const path7 = opts.path ?? LOGROTATE_PATH3;
+  const path9 = opts.path ?? LOGROTATE_PATH3;
   const content = renderLogrotate3({ logPath: opts.logPath ?? CRON_LOG_PATH3, user: opts.user });
-  if (existsSync95(path7)) {
+  if (existsSync96(path9)) {
     try {
-      if (readFileSync86(path7, "utf8") === content) {
-        return { status: "unchanged", path: path7, content };
+      if (readFileSync87(path9, "utf8") === content) {
+        return { status: "unchanged", path: path9, content };
       }
     } catch {}
   }
-  mkdirSync54(dirname40(path7), { recursive: true });
-  const tmp = `${path7}.${process.pid}.tmp`;
+  mkdirSync54(dirname40(path9), { recursive: true });
+  const tmp = `${path9}.${process.pid}.tmp`;
   writeFileSync37(tmp, content, { mode: 420 });
-  renameSync24(tmp, path7);
-  return { status: "installed", path: path7, content };
+  renameSync24(tmp, path9);
+  return { status: "installed", path: path9, content };
 }
 function parseCronUser3(content) {
   for (const line of content.split(`
@@ -118307,20 +119378,20 @@ function parseCronUser3(content) {
   return null;
 }
 function reconcileCron3(opts) {
-  const path7 = opts.path ?? CRON_PATH3;
-  if (!existsSync95(path7))
-    return { status: "absent", path: path7 };
+  const path9 = opts.path ?? CRON_PATH3;
+  if (!existsSync96(path9))
+    return { status: "absent", path: path9 };
   let user = opts.fallbackUser;
   try {
-    user = parseCronUser3(readFileSync86(path7, "utf8")) ?? opts.fallbackUser;
+    user = parseCronUser3(readFileSync87(path9, "utf8")) ?? opts.fallbackUser;
   } catch {}
   if (!user) {
-    throw new Error(`cannot reconcile ${path7}: no cron-user parseable from the existing fragment and no fallback user available`);
+    throw new Error(`cannot reconcile ${path9}: no cron-user parseable from the existing fragment and no fallback user available`);
   }
-  const r = installCron3({ user, binary: opts.binary, path: path7 });
+  const r = installCron3({ user, binary: opts.binary, path: path9 });
   return {
     status: r.status === "installed" ? "reconciled" : "unchanged",
-    path: path7,
+    path: path9,
     content: r.content
   };
 }
@@ -118330,7 +119401,7 @@ init_install_cron2();
 
 // src/host-cli-self-heal/install-timer.ts
 import { spawnSync as spawnSync19 } from "node:child_process";
-import { existsSync as existsSync96, mkdirSync as mkdirSync55, readFileSync as readFileSync87, renameSync as renameSync25, writeFileSync as writeFileSync38 } from "node:fs";
+import { existsSync as existsSync97, mkdirSync as mkdirSync55, readFileSync as readFileSync88, renameSync as renameSync25, writeFileSync as writeFileSync38 } from "node:fs";
 import { dirname as dirname41 } from "node:path";
 var SERVICE_PATH = "/etc/systemd/system/switchroom-self-heal.service";
 var TIMER_PATH = "/etc/systemd/system/switchroom-self-heal.timer";
@@ -118376,22 +119447,22 @@ function renderTimer() {
 ` + `WantedBy=timers.target
 `;
 }
-function writeUnitIdempotent(path7, content) {
-  if (existsSync96(path7)) {
+function writeUnitIdempotent(path9, content) {
+  if (existsSync97(path9)) {
     try {
-      if (readFileSync87(path7, "utf8") === content)
+      if (readFileSync88(path9, "utf8") === content)
         return "unchanged";
     } catch {}
   }
-  mkdirSync55(dirname41(path7), { recursive: true });
-  const tmp = `${path7}.${process.pid}.tmp`;
+  mkdirSync55(dirname41(path9), { recursive: true });
+  const tmp = `${path9}.${process.pid}.tmp`;
   writeFileSync38(tmp, content, { mode: 420 });
-  renameSync25(tmp, path7);
+  renameSync25(tmp, path9);
   return "written";
 }
 function homeFromPasswd2(user) {
   try {
-    for (const line of readFileSync87("/etc/passwd", "utf8").split(`
+    for (const line of readFileSync88("/etc/passwd", "utf8").split(`
 `)) {
       const f = line.split(":");
       if (f[0] === user && f[5])
@@ -118408,7 +119479,7 @@ function resolveOperatorUser(env2) {
 }
 function installSelfHealTimer(deps = {}) {
   const env2 = deps.env ?? process.env;
-  const systemdBooted = deps.systemdBooted ?? (() => existsSync96(SYSTEMD_MARKER));
+  const systemdBooted = deps.systemdBooted ?? (() => existsSync97(SYSTEMD_MARKER));
   const geteuid = deps.geteuid ?? (() => typeof process.geteuid === "function" ? process.geteuid() : undefined);
   const homeForUser = deps.homeForUser ?? homeFromPasswd2;
   const servicePath = deps.servicePath ?? SERVICE_PATH;
@@ -118469,22 +119540,22 @@ function installSelfHealTimer(deps = {}) {
 // src/cli/update.ts
 function defaultPersistPin(configPath) {
   return (pin) => {
-    const path7 = configPath ?? findConfigFile();
-    const before = readFileSync88(path7, "utf8");
+    const path9 = configPath ?? findConfigFile();
+    const before = readFileSync89(path9, "utf8");
     const after = setReleasePinInConfig(before, pin);
     if (after === before)
       return;
-    writeConfigFileSync(path7, after, statSync56(path7).mode & 511);
+    writeConfigFileSync(path9, after, statSync57(path9).mode & 511);
     try {
       if (typeof process.geteuid === "function" && process.geteuid() === 0) {
         const uid = resolveOperatorUid();
         if (uid !== undefined)
-          chownSync13(path7, uid, uid);
+          chownSync13(path9, uid, uid);
       }
     } catch {}
   };
 }
-var DEFAULT_COMPOSE_PATH2 = join101(homedir51(), ".switchroom", "compose", "docker-compose.yml");
+var DEFAULT_COMPOSE_PATH2 = join102(homedir51(), ".switchroom", "compose", "docker-compose.yml");
 var PACKAGED_INSTALL_KINDS = new Set([
   "static-binary",
   "npm-global",
@@ -118493,9 +119564,9 @@ var PACKAGED_INSTALL_KINDS = new Set([
 function runningFromSwitchroomCheckout(scriptPath) {
   let dir = dirname42(scriptPath);
   for (let i2 = 0;i2 < 12; i2++) {
-    if (existsSync97(join101(dir, ".git"))) {
+    if (existsSync98(join102(dir, ".git"))) {
       try {
-        const pkg = JSON.parse(readFileSync88(join101(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync89(join102(dir, "package.json"), "utf-8"));
         if (pkg.name === "switchroom")
           return true;
       } catch {}
@@ -118562,7 +119633,7 @@ function planUpdate(opts) {
         bundleDir: import.meta.dirname,
         execPath: process.execPath,
         scriptPath,
-        inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync97("/.dockerenv")
+        inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync98("/.dockerenv")
       });
       if (detection.kind !== "static-binary") {
         say(source_default.gray(`  host CLI not self-updated: ${detection.reason}
@@ -118645,7 +119716,7 @@ function planUpdate(opts) {
   steps.push({
     name: "pull-images",
     description: "Pull broker / kernel / agent images from GHCR",
-    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync97(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
+    skipReason: opts.skipImages ? "--skip-images flag set" : !existsSync98(composePath) ? `compose file not found at ${composePath} (run \`switchroom apply --compose-only\` first)` : undefined,
     run: () => {
       const r = runner("docker", [
         "compose",
@@ -118902,13 +119973,13 @@ function planUpdate(opts) {
         bundleDir: import.meta.dirname,
         execPath: process.execPath
       });
-      const dest = join101(homedir51(), ".switchroom", "skills", "_bundled");
+      const dest = join102(homedir51(), ".switchroom", "skills", "_bundled");
       if (resolution.path === null) {
         const detection = detectInstallKind(opts.installProbe ?? {
           bundleDir: import.meta.dirname,
           execPath: process.execPath,
           scriptPath,
-          inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync97("/.dockerenv")
+          inContainer: process.env.SWITCHROOM_HOSTD_CONTEXT === "1" || existsSync98("/.dockerenv")
         });
         const detail = `no shipped skills/ payload found for this install ` + `(${detection.kind}; ${describeShippedAssetSearch(resolution)})`;
         if (PACKAGED_INSTALL_KINDS.has(detection.kind)) {
@@ -118947,11 +120018,11 @@ function planUpdate(opts) {
     run: () => {
       if (opts.syncBundledSkillsFn)
         return;
-      const dest = join101(homedir51(), ".switchroom", "skills", "_bundled");
-      if (!existsSync97(dest)) {
+      const dest = join102(homedir51(), ".switchroom", "skills", "_bundled");
+      if (!existsSync98(dest)) {
         return;
       }
-      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync97(join101(dest, key)));
+      const missing = getBuiltinDefaultSkillEntries().map((e) => e.key).filter((key) => !existsSync98(join102(dest, key)));
       if (missing.length > 0) {
         throw new Error(`verify-bundled-skills: builtin default skill(s) missing from the pool after sync: ` + `${missing.join(", ")}. These ship in the CLI package and must exist in ${dest}. ` + `This is a broken sync or a packaging regression \u2014 the pool is not converged.`);
       }
@@ -118986,7 +120057,7 @@ function planUpdate(opts) {
     description: "docker compose up -d --remove-orphans (recreates services with new images / compose)",
     run: () => {
       try {
-        const composeText = readFileSync88(composePath, "utf8");
+        const composeText = readFileSync89(composePath, "utf8");
         const pf = validateBindSources(composeText);
         if (!pf.ok)
           throw new Error(formatPreflightError(pf));
@@ -119061,14 +120132,14 @@ function defaultStatusProbe(composePath) {
     } catch {}
     if (scriptPath) {
       try {
-        cliBuiltAt = new Date(statSync56(scriptPath).mtimeMs).toISOString();
+        cliBuiltAt = new Date(statSync57(scriptPath).mtimeMs).toISOString();
       } catch {}
       let dir = dirname42(scriptPath);
       for (let i2 = 0;i2 < 8; i2++) {
-        const pkgPath = join101(dir, "package.json");
-        if (existsSync97(pkgPath)) {
+        const pkgPath = join102(dir, "package.json");
+        if (existsSync98(pkgPath)) {
           try {
-            const pkg = JSON.parse(readFileSync88(pkgPath, "utf-8"));
+            const pkg = JSON.parse(readFileSync89(pkgPath, "utf-8"));
             if (typeof pkg.version === "string")
               cliVersion = pkg.version;
           } catch (err) {
@@ -119089,7 +120160,7 @@ function defaultStatusProbe(composePath) {
     warnings.push("could not resolve CLI version (no package.json found above the resolved script path)");
   }
   const services = [];
-  if (!existsSync97(composePath)) {
+  if (!existsSync98(composePath)) {
     warnings.push(`compose file not found at ${composePath}; service status unknown`);
     return { cliVersion, cliBuiltAt, services, warnings };
   }
@@ -119352,22 +120423,22 @@ function registerUpdateCommand(program3) {
 // src/cli/rollout.ts
 init_helpers();
 import { spawnSync as spawnSync22 } from "node:child_process";
-import { readFileSync as readFileSync90, chownSync as chownSync14, statSync as statSync59 } from "node:fs";
+import { readFileSync as readFileSync91, chownSync as chownSync14, statSync as statSync60 } from "node:fs";
 import { homedir as homedir53 } from "node:os";
 
 // src/cli/rollout-pin-journal.ts
 import {
-  existsSync as existsSync98,
-  readFileSync as readFileSync89,
+  existsSync as existsSync99,
+  readFileSync as readFileSync90,
   writeFileSync as writeFileSync39,
   renameSync as renameSync26,
   unlinkSync as unlinkSync19,
-  statSync as statSync57,
+  statSync as statSync58,
   mkdirSync as mkdirSync57
 } from "node:fs";
 import { homedir as homedir52 } from "node:os";
-import { createHash as createHash18 } from "node:crypto";
-import { join as join102, basename as basename9, resolve as resolve50, dirname as dirname43 } from "node:path";
+import { createHash as createHash19 } from "node:crypto";
+import { join as join103, basename as basename9, resolve as resolve51, dirname as dirname43 } from "node:path";
 init_flock();
 var PIN_JOURNAL_MAX_AGE_MS = 15 * 60 * 1000;
 var STATE_DIR_NAME = ".switchroom";
@@ -119376,16 +120447,16 @@ function pinJournalDir(configPath) {
   if (override && override.trim().length > 0)
     return override.trim();
   if (configPath) {
-    const dir = dirname43(resolve50(configPath));
+    const dir = dirname43(resolve51(configPath));
     if (basename9(dir) === STATE_DIR_NAME)
       return dir;
   }
-  return join102(homedir52(), STATE_DIR_NAME);
+  return join103(homedir52(), STATE_DIR_NAME);
 }
 function pinJournalPath(configPath) {
-  const abs = resolve50(configPath);
-  const key = createHash18("sha256").update(abs).digest("hex").slice(0, 12);
-  return join102(pinJournalDir(abs), `.rollout-pin-journal.${basename9(abs)}.${key}.json`);
+  const abs = resolve51(configPath);
+  const key = createHash19("sha256").update(abs).digest("hex").slice(0, 12);
+  return join103(pinJournalDir(abs), `.rollout-pin-journal.${basename9(abs)}.${key}.json`);
 }
 function isPidAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0)
@@ -119419,9 +120490,9 @@ function readPinJournal(configPath, warn = (m) => process.stderr.write(m)) {
   const p = pinJournalPath(configPath);
   let raw;
   try {
-    raw = readFileSync89(p, "utf8");
+    raw = readFileSync90(p, "utf8");
   } catch (e) {
-    if (existsSync98(p)) {
+    if (existsSync99(p)) {
       warn(`\u26a0\ufe0f  rollout pin journal: ${p} exists but could not be read ` + `(${e.message}). A provisional \`release.pin\` may be ` + `uncommitted \u2014 verify it host-side before the next reconcile.
 `);
     }
@@ -119472,7 +120543,7 @@ function beginPinPersist(configPath, pin, opts = {}) {
     warn(`\u26a0\ufe0f  rollout pin journal: overwriting an ABANDONED journal at ${p} ` + `(pid ${existing.pid} recorded ${existing.at}, provisional pin ` + `${existing.pin}). Its roll never committed or reverted; \`release.pin\` ` + `in ${configPath} may still name that unproven build \u2014 verify it.
 `);
   }
-  const priorPin = getReleasePinFromConfig(readFileSync89(configPath, "utf8"));
+  const priorPin = getReleasePinFromConfig(readFileSync90(configPath, "utf8"));
   const journal = {
     v: 1,
     configPath,
@@ -119493,7 +120564,7 @@ function commitPinPersist(configPath) {
     unlinkSync19(p);
     return null;
   } catch (e) {
-    if (!existsSync98(p))
+    if (!existsSync99(p))
       return null;
     return `rollout pin journal: FAILED to clear ${p} after a SUCCESSFUL roll ` + `(${e.message}). Delete it host-side \u2014 while it exists, ` + `recovery may revert a proven \`release.pin\`.`;
   }
@@ -119515,11 +120586,11 @@ function rollbackPinPersist(configPath, opts = {}) {
     }
   }
   try {
-    const current = readFileSync89(configPath, "utf8");
+    const current = readFileSync90(configPath, "utf8");
     const next = journal.priorPin ? setReleasePinInConfig(current, journal.priorPin) : deleteReleasePinInConfig(current);
     let mode = 384;
     try {
-      mode = statSync57(configPath).mode & 511;
+      mode = statSync58(configPath).mode & 511;
     } catch {}
     if (opts.writeConfig) {
       opts.writeConfig(configPath, next, mode);
@@ -119569,8 +120640,8 @@ init_host_cli_stamp();
 
 // src/cli/host-cli-upgrade.ts
 init_self_update();
-import { lchownSync, lstatSync as lstatSync14, readdirSync as readdirSync33, statSync as statSync58 } from "node:fs";
-import { basename as basename10, dirname as dirname44, join as join103 } from "node:path";
+import { lchownSync, lstatSync as lstatSync14, readdirSync as readdirSync34, statSync as statSync59 } from "node:fs";
+import { basename as basename10, dirname as dirname44, join as join104 } from "node:path";
 init_shipped_assets();
 var HOST_CLI_UPGRADE_SENTINEL = "SWITCHROOM_HOST_CLI_UPGRADE:";
 function encodeHostCliUpgradeResult(r) {
@@ -119606,7 +120677,7 @@ function defaultIo() {
   return {
     isFile: (p) => {
       try {
-        return statSync58(p).isFile();
+        return statSync59(p).isFile();
       } catch {
         return false;
       }
@@ -119636,7 +120707,7 @@ function defaultIo() {
     chown: (p, uid, gid) => lchownSync(p, uid, gid),
     list: (d) => {
       try {
-        return readdirSync33(d);
+        return readdirSync34(d);
       } catch {
         return [];
       }
@@ -119667,7 +120738,7 @@ function handBackOwnership(paths, owner, io) {
     if (kind !== "dir")
       continue;
     for (const child of io.list(p))
-      stack.push(join103(p, child));
+      stack.push(join104(p, child));
   }
   return failures;
 }
@@ -119706,7 +120777,7 @@ async function runHostCliUpgrade(opts, io = defaultIo(), log = () => {}) {
       const installRoot = payloadInstallRoot(binary);
       const failures = handBackOwnership([
         binary,
-        join103(dirname44(binary), ".switchroom-versions"),
+        join104(dirname44(binary), ".switchroom-versions"),
         dirname44(installRoot),
         installRoot,
         payloadVersionDir(installRoot, pin)
@@ -119802,21 +120873,21 @@ function planHostCliHeal(opts) {
       reason: `the host CLI is a ${stamp.installKind} install \u2014 only a static-binary ` + `install can be replaced by swapping one file, so an operator must run ` + `the upgrade host-side`
     };
   }
-  const path7 = stamp.path;
-  if (!path7.startsWith("/") || path7.includes("/..")) {
-    return { action: "skip", reason: `recorded host CLI path "${path7}" is not a plain absolute path` };
+  const path9 = stamp.path;
+  if (!path9.startsWith("/") || path9.includes("/..")) {
+    return { action: "skip", reason: `recorded host CLI path "${path9}" is not a plain absolute path` };
   }
-  const installDir = path7.slice(0, path7.lastIndexOf("/"));
-  const name = path7.slice(path7.lastIndexOf("/") + 1);
+  const installDir = path9.slice(0, path9.lastIndexOf("/"));
+  const name = path9.slice(path9.lastIndexOf("/") + 1);
   if (name !== "switchroom") {
-    return { action: "skip", reason: `recorded host CLI path "${path7}" is not named \`switchroom\`` };
+    return { action: "skip", reason: `recorded host CLI path "${path9}" is not named \`switchroom\`` };
   }
   const prefixHostPath = installDir.slice(0, installDir.lastIndexOf("/"));
   const dirName = installDir.slice(installDir.lastIndexOf("/") + 1);
   if (prefixHostPath.length === 0 || dirName.length === 0) {
     return {
       action: "skip",
-      reason: `recorded host CLI path "${path7}" has no install prefix to bind \u2014 ` + `refusing to mount the host root`
+      reason: `recorded host CLI path "${path9}" has no install prefix to bind \u2014 ` + `refusing to mount the host root`
     };
   }
   return {
@@ -120501,13 +121572,13 @@ function createRolloutDeps(params) {
     }
     return { ok: r.status === 0, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
   };
-  const writeConfigPreservingOwnership = (path7, text, mode) => {
-    writeConfigFileSync(path7, text, mode);
+  const writeConfigPreservingOwnership = (path9, text, mode) => {
+    writeConfigFileSync(path9, text, mode);
     try {
       if (typeof process.geteuid === "function" && process.geteuid() === 0) {
         const uid = resolveOperatorUid();
         if (uid !== undefined) {
-          chownSync14(path7, uid, uid);
+          chownSync14(path9, uid, uid);
         } else if (hostdCtx) {
           warn("\u26a0\ufe0f  rollout (hostd path): could not resolve operator uid; " + "skipping config chown-back to avoid leaving switchroom.yaml " + "root-owned. Verify ownership host-side if other yaml verbs " + `EACCES.
 `);
@@ -120566,12 +121637,12 @@ function createRolloutDeps(params) {
       return stamp ? { hostCli: stamp } : {};
     })(),
     persistPin: (pin) => {
-      const before = readFileSync90(configPath, "utf8");
+      const before = readFileSync91(configPath, "utf8");
       const after = setReleasePinInConfig(before, pin);
       if (after === before)
         return false;
       beginPinPersist(configPath, pin);
-      writeConfigPreservingOwnership(configPath, after, statSync59(configPath).mode & 511);
+      writeConfigPreservingOwnership(configPath, after, statSync60(configPath).mode & 511);
       return true;
     },
     commitPin: () => {
@@ -120847,7 +121918,7 @@ init_source();
 init_helpers();
 init_loader();
 init_lifecycle();
-import { resolve as resolve51 } from "node:path";
+import { resolve as resolve52 } from "node:path";
 
 // src/cli/version.ts
 init_source();
@@ -120855,8 +121926,8 @@ init_helpers();
 init_lifecycle();
 init_resolve_version();
 import { execSync as execSync3 } from "node:child_process";
-import { existsSync as existsSync99, readFileSync as readFileSync91 } from "node:fs";
-import { dirname as dirname45, join as join104 } from "node:path";
+import { existsSync as existsSync100, readFileSync as readFileSync92 } from "node:fs";
+import { dirname as dirname45, join as join105 } from "node:path";
 function getClaudeCodeVersion() {
   try {
     const out = execSync3("claude --version 2>/dev/null", {
@@ -120906,11 +121977,11 @@ function formatUptime3(timestamp) {
 function locateSwitchroomInstallDir() {
   let dir = import.meta.dirname;
   for (let i2 = 0;i2 < 10 && dir && dir !== "/"; i2++) {
-    const pkgPath = join104(dir, "package.json");
-    if (existsSync99(pkgPath)) {
+    const pkgPath = join105(dir, "package.json");
+    if (existsSync100(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync91(pkgPath, "utf-8"));
-        if (pkg.name === "switchroom" && existsSync99(join104(dir, ".git"))) {
+        const pkg = JSON.parse(readFileSync92(pkgPath, "utf-8"));
+        if (pkg.name === "switchroom" && existsSync100(join105(dir, ".git"))) {
           return dir;
         }
       } catch {}
@@ -121003,7 +122074,7 @@ function registerRestartCommand(program3) {
         }
         const didRestart = res.restarted || !graceful;
         if (didRestart) {
-          const agentDir = resolve51(agentsDir, name);
+          const agentDir = resolve52(agentsDir, name);
           const converged = waitForAuthConverge(name, agentDir);
           if (!converged) {
             console.log(source_default.yellow(`  ${name}: agent is up but auth status didn't converge in 30s \u2014 check logs`));
@@ -121086,37 +122157,37 @@ Dependency manifest`));
 // src/cli/handoff.ts
 init_helpers();
 init_loader();
-import { resolve as resolve52 } from "node:path";
+import { resolve as resolve53 } from "node:path";
 init_merge();
 
 // src/agents/session-retention.ts
 import {
-  existsSync as existsSync100,
-  readdirSync as readdirSync34,
-  statSync as statSync60,
+  existsSync as existsSync101,
+  readdirSync as readdirSync35,
+  statSync as statSync61,
   unlinkSync as unlinkSync20
 } from "node:fs";
-import { join as join105 } from "node:path";
+import { join as join106 } from "node:path";
 var DEFAULT_SESSION_RETENTION_MAX_COUNT = 20;
 var DEFAULT_SESSION_RETENTION_MAX_AGE_DAYS = 30;
 var MIN_KEEP = 2;
 function collectSessionJsonl(claudeConfigDir) {
-  const projects = join105(claudeConfigDir, "projects");
-  if (!existsSync100(projects))
+  const projects = join106(claudeConfigDir, "projects");
+  if (!existsSync101(projects))
     return [];
   const found = [];
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync34(dir);
+      entries = readdirSync35(dir);
     } catch {
       return;
     }
     for (const name of entries) {
-      const full = join105(dir, name);
+      const full = join106(dir, name);
       let st;
       try {
-        st = statSync60(full);
+        st = statSync61(full);
       } catch {
         continue;
       }
@@ -121187,7 +122258,7 @@ function registerHandoffCommand(program3) {
       }
       agentConfig = resolveAgentConfig(config.defaults, config.profiles, rawAgent);
       const agentsDir = resolveAgentsDir(config);
-      agentDir = resolve52(agentsDir, agentName);
+      agentDir = resolve53(agentsDir, agentName);
     } catch (err) {
       if (!(err instanceof ConfigError))
         throw err;
@@ -121202,7 +122273,7 @@ function registerHandoffCommand(program3) {
 `);
       return;
     }
-    const claudeConfigDir = resolve52(agentDir, ".claude");
+    const claudeConfigDir = resolve53(agentDir, ".claude");
     const jsonl = findLatestSessionJsonl(claudeConfigDir);
     if (!jsonl) {
       process.stderr.write(`handoff: no session JSONL under ${claudeConfigDir}/projects; skipping
@@ -121234,18 +122305,18 @@ function registerHandoffCommand(program3) {
 // src/issues/store.ts
 import {
   closeSync as closeSync19,
-  existsSync as existsSync101,
+  existsSync as existsSync102,
   mkdirSync as mkdirSync58,
   openSync as openSync19,
-  readdirSync as readdirSync35,
-  readFileSync as readFileSync92,
+  readdirSync as readdirSync36,
+  readFileSync as readFileSync93,
   renameSync as renameSync27,
-  statSync as statSync61,
+  statSync as statSync62,
   unlinkSync as unlinkSync21,
   writeFileSync as writeFileSync40,
   writeSync as writeSync9
 } from "node:fs";
-import { join as join106 } from "node:path";
+import { join as join107 } from "node:path";
 import { randomBytes as randomBytes16 } from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
 
@@ -121272,12 +122343,12 @@ function computeFingerprint(source, code) {
 var ISSUES_FILE = "issues.jsonl";
 var ISSUES_LOCK = "issues.lock";
 function readAll(stateDir) {
-  const path7 = join106(stateDir, ISSUES_FILE);
-  if (!existsSync101(path7))
+  const path9 = join107(stateDir, ISSUES_FILE);
+  if (!existsSync102(path9))
     return [];
   let raw;
   try {
-    raw = readFileSync92(path7, "utf-8");
+    raw = readFileSync93(path9, "utf-8");
   } catch {
     return [];
   }
@@ -121349,8 +122420,8 @@ function record(stateDir, input, nowFn = Date.now) {
     return result;
   });
 }
-function resolve53(stateDir, fingerprint, nowFn = Date.now) {
-  if (!existsSync101(join106(stateDir, ISSUES_FILE)))
+function resolve54(stateDir, fingerprint, nowFn = Date.now) {
+  if (!existsSync102(join107(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -121368,7 +122439,7 @@ function resolve53(stateDir, fingerprint, nowFn = Date.now) {
   });
 }
 function resolveAllBySource(stateDir, source, nowFn = Date.now) {
-  if (!existsSync101(join106(stateDir, ISSUES_FILE)))
+  if (!existsSync102(join107(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -121386,7 +122457,7 @@ function resolveAllBySource(stateDir, source, nowFn = Date.now) {
   });
 }
 function prune(stateDir, opts = {}) {
-  if (!existsSync101(join106(stateDir, ISSUES_FILE)))
+  if (!existsSync102(join107(stateDir, ISSUES_FILE)))
     return 0;
   return withLock(stateDir, () => {
     const all = readAll(stateDir);
@@ -121419,21 +122490,21 @@ function ensureDir2(stateDir) {
   mkdirSync58(stateDir, { recursive: true });
 }
 function writeAll(stateDir, events) {
-  const path7 = join106(stateDir, ISSUES_FILE);
+  const path9 = join107(stateDir, ISSUES_FILE);
   sweepOrphanTmpFiles(stateDir);
-  const tmp = `${path7}.tmp-${process.pid}-${randomBytes16(4).toString("hex")}`;
+  const tmp = `${path9}.tmp-${process.pid}-${randomBytes16(4).toString("hex")}`;
   const body = events.length === 0 ? "" : events.map((e) => JSON.stringify(e)).join(`
 `) + `
 `;
   writeFileSync40(tmp, body, "utf-8");
-  renameSync27(tmp, path7);
+  renameSync27(tmp, path9);
 }
 var ORPHAN_TMP_TTL_MS = 60000;
 var TMP_PREFIX = `${ISSUES_FILE}.tmp-`;
 function sweepOrphanTmpFiles(stateDir) {
   let entries;
   try {
-    entries = readdirSync35(stateDir);
+    entries = readdirSync36(stateDir);
   } catch {
     return;
   }
@@ -121441,10 +122512,10 @@ function sweepOrphanTmpFiles(stateDir) {
   for (const entry of entries) {
     if (!entry.startsWith(TMP_PREFIX))
       continue;
-    const tmpPath = join106(stateDir, entry);
+    const tmpPath = join107(stateDir, entry);
     try {
-      const stat = statSync61(tmpPath);
-      if (stat.mtimeMs < cutoff) {
+      const stat2 = statSync62(tmpPath);
+      if (stat2.mtimeMs < cutoff) {
         unlinkSync21(tmpPath);
       }
     } catch {}
@@ -121453,7 +122524,7 @@ function sweepOrphanTmpFiles(stateDir) {
 var LOCK_RETRY_MS = 25;
 var LOCK_TIMEOUT_MS = 1e4;
 function withLock(stateDir, fn) {
-  const lockPath = join106(stateDir, ISSUES_LOCK);
+  const lockPath = join107(stateDir, ISSUES_LOCK);
   const startedAt = Date.now();
   let fd = null;
   while (fd === null) {
@@ -121488,7 +122559,7 @@ function withLock(stateDir, fn) {
 function tryStealStaleLock(lockPath) {
   let pidStr;
   try {
-    pidStr = readFileSync92(lockPath, "utf-8").trim();
+    pidStr = readFileSync93(lockPath, "utf-8").trim();
   } catch {
     return true;
   }
@@ -121637,11 +122708,11 @@ function registerIssuesCommand(program3) {
       const stateDir = resolveStateDir2(opts);
       let flipped;
       if (opts.source && opts.code) {
-        flipped = resolve53(stateDir, computeFingerprint(opts.source, opts.code));
+        flipped = resolve54(stateDir, computeFingerprint(opts.source, opts.code));
       } else if (opts.source && !fingerprint) {
         flipped = resolveAllBySource(stateDir, opts.source);
       } else if (fingerprint) {
-        flipped = resolve53(stateDir, fingerprint);
+        flipped = resolve54(stateDir, fingerprint);
       } else {
         process.stderr.write(`issues resolve: need either <fingerprint>, --source, or --source + --code
 `);
@@ -121736,20 +122807,20 @@ function relTime(deltaMs) {
 
 // src/cli/deps.ts
 init_source();
-import { existsSync as existsSync104 } from "node:fs";
+import { existsSync as existsSync105 } from "node:fs";
 import { homedir as homedir56 } from "node:os";
-import { join as join109, resolve as resolve54 } from "node:path";
+import { join as join110, resolve as resolve55 } from "node:path";
 
 // src/deps/python.ts
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 import {
-  existsSync as existsSync102,
+  existsSync as existsSync103,
   mkdirSync as mkdirSync59,
-  readFileSync as readFileSync93,
+  readFileSync as readFileSync94,
   rmSync as rmSync19,
   writeFileSync as writeFileSync41
 } from "node:fs";
-import { dirname as dirname46, join as join107 } from "node:path";
+import { dirname as dirname46, join as join108 } from "node:path";
 import { homedir as homedir54 } from "node:os";
 import { execFileSync as execFileSync31 } from "node:child_process";
 
@@ -121762,26 +122833,26 @@ class PythonEnvError extends Error {
   }
 }
 function defaultPythonCacheRoot() {
-  return join107(homedir54(), ".switchroom", "deps", "python");
+  return join108(homedir54(), ".switchroom", "deps", "python");
 }
-function hashFile(path7) {
-  return createHash19("sha256").update(readFileSync93(path7)).digest("hex");
+function hashFile(path9) {
+  return createHash20("sha256").update(readFileSync94(path9)).digest("hex");
 }
 function ensurePythonEnv(opts) {
   const { skillName, requirementsPath, force = false } = opts;
   const cacheRoot = opts.cacheRoot ?? defaultPythonCacheRoot();
   const hostPython = opts.pythonBin ?? "python3";
-  if (!existsSync102(requirementsPath)) {
+  if (!existsSync103(requirementsPath)) {
     throw new PythonEnvError(`requirements file not found: ${requirementsPath}`);
   }
-  const venvDir = join107(cacheRoot, skillName);
-  const stampPath = join107(venvDir, ".requirements.sha256");
-  const binDir = join107(venvDir, "bin");
-  const pythonBin = join107(binDir, "python");
-  const pipBin = join107(binDir, "pip");
+  const venvDir = join108(cacheRoot, skillName);
+  const stampPath = join108(venvDir, ".requirements.sha256");
+  const binDir = join108(venvDir, "bin");
+  const pythonBin = join108(binDir, "python");
+  const pipBin = join108(binDir, "pip");
   const targetHash = hashFile(requirementsPath);
-  if (!force && existsSync102(stampPath) && existsSync102(pythonBin)) {
-    const existingHash = readFileSync93(stampPath, "utf8").trim();
+  if (!force && existsSync103(stampPath) && existsSync103(pythonBin)) {
+    const existingHash = readFileSync94(stampPath, "utf8").trim();
     if (existingHash === targetHash) {
       return {
         skillName,
@@ -121793,7 +122864,7 @@ function ensurePythonEnv(opts) {
       };
     }
   }
-  if (existsSync102(venvDir)) {
+  if (existsSync103(venvDir)) {
     rmSync19(venvDir, { recursive: true, force: true });
   }
   mkdirSync59(dirname46(venvDir), { recursive: true });
@@ -121828,16 +122899,16 @@ function ensurePythonEnv(opts) {
 }
 
 // src/deps/node.ts
-import { createHash as createHash20 } from "node:crypto";
+import { createHash as createHash21 } from "node:crypto";
 import {
   copyFileSync as copyFileSync13,
-  existsSync as existsSync103,
+  existsSync as existsSync104,
   mkdirSync as mkdirSync60,
-  readFileSync as readFileSync94,
+  readFileSync as readFileSync95,
   rmSync as rmSync20,
   writeFileSync as writeFileSync42
 } from "node:fs";
-import { dirname as dirname47, join as join108 } from "node:path";
+import { dirname as dirname47, join as join109 } from "node:path";
 import { homedir as homedir55 } from "node:os";
 import { execFileSync as execFileSync32 } from "node:child_process";
 
@@ -121845,614 +122916,188 @@ class NodeEnvError extends Error {
   stderr;
   constructor(message, stderr) {
     super(message);
-    this.name = "NodeEnvError";
-    this.stderr = stderr;
-  }
-}
-var ALL_LOCKFILES = [
-  "bun.lock",
-  "bun.lockb",
-  "package-lock.json",
-  "pnpm-lock.yaml",
-  "yarn.lock"
-];
-var LOCKFILES_FOR = {
-  bun: ["bun.lock", "bun.lockb"],
-  npm: ["package-lock.json"]
-};
-function defaultNodeCacheRoot() {
-  return join108(homedir55(), ".switchroom", "deps", "node");
-}
-function hashDepInputs(packageJsonPath) {
-  const sourceDir = dirname47(packageJsonPath);
-  const hasher = createHash20("sha256");
-  hasher.update(`package.json
-`);
-  hasher.update(readFileSync94(packageJsonPath));
-  for (const lockName of ALL_LOCKFILES) {
-    const lockPath = join108(sourceDir, lockName);
-    if (existsSync103(lockPath)) {
-      hasher.update(`
-`);
-      hasher.update(lockName);
-      hasher.update(`
-`);
-      hasher.update(readFileSync94(lockPath));
-    }
-  }
-  return hasher.digest("hex");
-}
-function ensureNodeEnv(opts) {
-  const { skillName, packageJsonPath, force = false } = opts;
-  const cacheRoot = opts.cacheRoot ?? defaultNodeCacheRoot();
-  const installer = opts.installer ?? "bun";
-  if (!existsSync103(packageJsonPath)) {
-    throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
-  }
-  const sourceDir = dirname47(packageJsonPath);
-  const envDir = join108(cacheRoot, skillName);
-  const stampPath = join108(envDir, ".package.sha256");
-  const nodeModulesDir = join108(envDir, "node_modules");
-  const binDir = join108(nodeModulesDir, ".bin");
-  const targetHash = hashDepInputs(packageJsonPath);
-  if (!force && existsSync103(stampPath) && existsSync103(nodeModulesDir)) {
-    const existingHash = readFileSync94(stampPath, "utf8").trim();
-    if (existingHash === targetHash) {
-      return {
-        skillName,
-        dir: envDir,
-        nodeModulesDir,
-        binDir,
-        rebuilt: false
-      };
-    }
-  }
-  if (existsSync103(envDir)) {
-    rmSync20(envDir, { recursive: true, force: true });
-  }
-  mkdirSync60(envDir, { recursive: true });
-  copyFileSync13(packageJsonPath, join108(envDir, "package.json"));
-  let copiedLockfile = false;
-  for (const lockName of LOCKFILES_FOR[installer]) {
-    const lockPath = join108(sourceDir, lockName);
-    if (existsSync103(lockPath)) {
-      copyFileSync13(lockPath, join108(envDir, lockName));
-      copiedLockfile = true;
-    }
-  }
-  try {
-    if (installer === "bun") {
-      const args = copiedLockfile ? ["install", "--frozen-lockfile"] : ["install"];
-      execFileSync32("bun", args, { cwd: envDir, stdio: "pipe" });
-    } else {
-      const args = copiedLockfile ? ["ci"] : ["install"];
-      execFileSync32("npm", args, { cwd: envDir, stdio: "pipe" });
-    }
-  } catch (err) {
-    const e = err;
-    throw new NodeEnvError(`Failed to install node deps for skill "${skillName}" with ${installer}: ${e.message}`, e.stderr?.toString());
-  }
-  writeFileSync42(stampPath, targetHash + `
-`);
-  return {
-    skillName,
-    dir: envDir,
-    nodeModulesDir,
-    binDir,
-    rebuilt: true
-  };
-}
-
-// src/cli/deps.ts
-function builtinSkillsRoot() {
-  return resolve54(homedir56(), ".switchroom/skills/_bundled");
-}
-function registerDepsCommand(program3) {
-  const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
-  deps.command("rebuild <skill>").description("Rebuild the Python venv and/or Node node_modules cache for a skill").option("-p, --python", "Rebuild only the Python env").option("-n, --node", "Rebuild only the Node env").action(async (skill, opts) => {
-    const skillsRoot = builtinSkillsRoot();
-    if (!existsSync104(skillsRoot)) {
-      console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
-      process.exit(1);
-    }
-    const skillDir = join109(skillsRoot, skill);
-    if (!existsSync104(skillDir)) {
-      console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
-      process.exit(1);
-    }
-    const requirementsPath = join109(skillDir, "requirements.txt");
-    const packageJsonPath = join109(skillDir, "package.json");
-    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync104(requirementsPath));
-    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync104(packageJsonPath));
-    let did = 0;
-    if (wantPython) {
-      if (!existsSync104(requirementsPath)) {
-        console.error(source_default.red(`Skill "${skill}" has no requirements.txt at ${requirementsPath}`));
-        process.exit(1);
-      }
-      try {
-        console.log(source_default.gray(`Rebuilding Python env for ${skill}...`));
-        const env2 = ensurePythonEnv({
-          skillName: skill,
-          requirementsPath,
-          force: true
-        });
-        console.log(source_default.green(`  \u2713 Python env at ${env2.venvDir} (python: ${env2.pythonBin})`));
-        did++;
-      } catch (err) {
-        if (err instanceof PythonEnvError) {
-          console.error(source_default.red(`  Python env failed: ${err.message}`));
-          if (err.stderr)
-            console.error(source_default.dim(err.stderr));
-          process.exit(1);
-        }
-        throw err;
-      }
-    }
-    if (wantNode) {
-      if (!existsSync104(packageJsonPath)) {
-        console.error(source_default.red(`Skill "${skill}" has no package.json at ${packageJsonPath}`));
-        process.exit(1);
-      }
-      try {
-        console.log(source_default.gray(`Rebuilding Node env for ${skill}...`));
-        const env2 = ensureNodeEnv({
-          skillName: skill,
-          packageJsonPath,
-          force: true
-        });
-        console.log(source_default.green(`  \u2713 Node env at ${env2.dir} (node_modules: ${env2.nodeModulesDir})`));
-        did++;
-      } catch (err) {
-        if (err instanceof NodeEnvError) {
-          console.error(source_default.red(`  Node env failed: ${err.message}`));
-          if (err.stderr)
-            console.error(source_default.dim(err.stderr));
-          process.exit(1);
-        }
-        throw err;
-      }
-    }
-    if (did === 0) {
-      console.error(source_default.yellow(`Skill "${skill}" has neither requirements.txt nor package.json \u2014 nothing to rebuild.`));
-      process.exit(1);
-    }
-  });
-}
-
-// src/cli/workspace.ts
-init_helpers();
-init_loader();
-import { existsSync as existsSync105 } from "node:fs";
-import { resolve as resolve55, sep as sep7 } from "node:path";
-import { spawnSync as spawnSync23 } from "node:child_process";
-
-// src/agents/workspace.ts
-import { readFile as readFile2, stat } from "node:fs/promises";
-import path8 from "node:path";
-
-// src/agents/bootstrap-budget.ts
-import path7 from "node:path";
-var DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO = 0.85;
-var DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES = 3;
-var DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX = 32;
-
-class BootstrapBudgetExceededError extends Error {
-  analysis;
-  constructor(analysis, message) {
-    super(message);
-    this.analysis = analysis;
-    this.name = "BootstrapBudgetExceededError";
-  }
-}
-function normalizePositiveLimit(value) {
-  if (!Number.isFinite(value) || value <= 0) {
-    return 1;
-  }
-  return Math.floor(value);
-}
-function formatWarningCause(cause) {
-  return cause === "per-file-limit" ? "max/file" : "max/total";
-}
-function normalizeSeenSignatures(signatures) {
-  if (!Array.isArray(signatures) || signatures.length === 0) {
-    return [];
-  }
-  const seen = new Set;
-  const result = [];
-  for (const signature of signatures) {
-    const value = typeof signature === "string" ? signature.trim() : "";
-    if (!value || seen.has(value)) {
-      continue;
-    }
-    seen.add(value);
-    result.push(value);
-  }
-  return result;
-}
-function appendSeenSignature(signatures, signature) {
-  if (!signature.trim()) {
-    return signatures;
-  }
-  if (signatures.includes(signature)) {
-    return signatures;
-  }
-  const next = [...signatures, signature];
-  if (next.length <= DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX) {
-    return next;
-  }
-  return next.slice(-DEFAULT_BOOTSTRAP_PROMPT_WARNING_SIGNATURE_HISTORY_MAX);
-}
-function buildBootstrapInjectionStats(params) {
-  const injectedByPath = new Map;
-  const injectedByBaseName = new Map;
-  for (const file of params.injectedFiles) {
-    const pathValue = typeof file.path === "string" ? file.path.trim() : "";
-    if (!pathValue) {
-      continue;
-    }
-    if (!injectedByPath.has(pathValue)) {
-      injectedByPath.set(pathValue, file.content);
-    }
-    const normalizedPath = pathValue.replace(/\\/g, "/");
-    const baseName = path7.posix.basename(normalizedPath);
-    if (!injectedByBaseName.has(baseName)) {
-      injectedByBaseName.set(baseName, file.content);
-    }
-  }
-  return params.bootstrapFiles.map((file) => {
-    const pathValue = typeof file.path === "string" ? file.path.trim() : "";
-    const rawChars = file.missing ? 0 : (file.content ?? "").trimEnd().length;
-    const injected = (pathValue ? injectedByPath.get(pathValue) : undefined) ?? injectedByPath.get(file.name) ?? injectedByBaseName.get(file.name);
-    const injectedChars = injected ? injected.length : 0;
-    const truncated = !file.missing && injectedChars < rawChars;
-    return {
-      name: file.name,
-      path: pathValue || file.name,
-      missing: file.missing,
-      rawChars,
-      injectedChars,
-      truncated
-    };
-  });
-}
-function analyzeBootstrapBudget(params) {
-  const bootstrapMaxChars = normalizePositiveLimit(params.bootstrapMaxChars);
-  const bootstrapTotalMaxChars = normalizePositiveLimit(params.bootstrapTotalMaxChars);
-  const nearLimitRatio = typeof params.nearLimitRatio === "number" && Number.isFinite(params.nearLimitRatio) && params.nearLimitRatio > 0 && params.nearLimitRatio < 1 ? params.nearLimitRatio : DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO;
-  const nonMissing = params.files.filter((file) => !file.missing);
-  const rawChars = nonMissing.reduce((sum, file) => sum + file.rawChars, 0);
-  const injectedChars = nonMissing.reduce((sum, file) => sum + file.injectedChars, 0);
-  const totalNearLimit = injectedChars >= Math.ceil(bootstrapTotalMaxChars * nearLimitRatio);
-  const totalOverLimit = injectedChars >= bootstrapTotalMaxChars;
-  const files = params.files.map((file) => {
-    if (file.missing) {
-      return { ...file, nearLimit: false, causes: [] };
-    }
-    const perFileOverLimit = file.rawChars > bootstrapMaxChars;
-    const nearLimit = file.rawChars >= Math.ceil(bootstrapMaxChars * nearLimitRatio);
-    const causes = [];
-    if (file.truncated) {
-      if (perFileOverLimit) {
-        causes.push("per-file-limit");
-      }
-      if (totalOverLimit) {
-        causes.push("total-limit");
-      }
-    }
-    return { ...file, nearLimit, causes };
-  });
-  const truncatedFiles = files.filter((file) => file.truncated);
-  const nearLimitFiles = files.filter((file) => file.nearLimit);
-  return {
-    files,
-    truncatedFiles,
-    nearLimitFiles,
-    totalNearLimit,
-    hasTruncation: truncatedFiles.length > 0,
-    totals: {
-      rawChars,
-      injectedChars,
-      truncatedChars: Math.max(0, rawChars - injectedChars),
-      bootstrapMaxChars,
-      bootstrapTotalMaxChars,
-      nearLimitRatio
-    }
-  };
-}
-function buildBootstrapTruncationSignature(analysis) {
-  if (!analysis.hasTruncation) {
-    return;
-  }
-  const files = analysis.truncatedFiles.map((file) => ({
-    path: file.path || file.name,
-    rawChars: file.rawChars,
-    injectedChars: file.injectedChars,
-    causes: [...file.causes].sort()
-  })).sort((a, b) => {
-    const pathCmp = a.path.localeCompare(b.path);
-    if (pathCmp !== 0) {
-      return pathCmp;
-    }
-    if (a.rawChars !== b.rawChars) {
-      return a.rawChars - b.rawChars;
-    }
-    if (a.injectedChars !== b.injectedChars) {
-      return a.injectedChars - b.injectedChars;
-    }
-    return a.causes.join("+").localeCompare(b.causes.join("+"));
-  });
-  return JSON.stringify({
-    bootstrapMaxChars: analysis.totals.bootstrapMaxChars,
-    bootstrapTotalMaxChars: analysis.totals.bootstrapTotalMaxChars,
-    files
-  });
-}
-function formatBootstrapTruncationWarningLines(params) {
-  if (!params.analysis.hasTruncation) {
-    return [];
-  }
-  const maxFiles = typeof params.maxFiles === "number" && Number.isFinite(params.maxFiles) && params.maxFiles > 0 ? Math.floor(params.maxFiles) : DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES;
-  const lines = [];
-  const duplicateNameCounts = params.analysis.truncatedFiles.reduce((acc, file) => {
-    acc.set(file.name, (acc.get(file.name) ?? 0) + 1);
-    return acc;
-  }, new Map);
-  const topFiles = params.analysis.truncatedFiles.slice(0, maxFiles);
-  for (const file of topFiles) {
-    const pct = file.rawChars > 0 ? Math.round((file.rawChars - file.injectedChars) / file.rawChars * 100) : 0;
-    const causeText = file.causes.length > 0 ? file.causes.map((cause) => formatWarningCause(cause)).join(", ") : "";
-    const nameLabel = (duplicateNameCounts.get(file.name) ?? 0) > 1 && file.path.trim().length > 0 ? `${file.name} (${file.path})` : file.name;
-    lines.push(`${nameLabel}: ${file.rawChars} raw -> ${file.injectedChars} injected (~${Math.max(0, pct)}% removed${causeText ? `; ${causeText}` : ""}).`);
-  }
-  if (params.analysis.truncatedFiles.length > topFiles.length) {
-    lines.push(`+${params.analysis.truncatedFiles.length - topFiles.length} more truncated file(s).`);
-  }
-  lines.push("If unintentional, raise switchroom workspace bootstrapMaxChars and/or bootstrapTotalMaxChars config.");
-  return lines;
-}
-function buildBootstrapPromptWarning(params) {
-  const signature = buildBootstrapTruncationSignature(params.analysis);
-  let seenSignatures = normalizeSeenSignatures(params.seenSignatures);
-  if (params.previousSignature && !seenSignatures.includes(params.previousSignature)) {
-    seenSignatures = appendSeenSignature(seenSignatures, params.previousSignature);
-  }
-  const hasSeenSignature = Boolean(signature && seenSignatures.includes(signature));
-  const warningShown = params.mode !== "off" && Boolean(signature) && (params.mode === "always" || !hasSeenSignature);
-  const warningSignaturesSeen = signature && params.mode !== "off" ? appendSeenSignature(seenSignatures, signature) : seenSignatures;
-  return {
-    signature,
-    warningShown,
-    lines: warningShown ? formatBootstrapTruncationWarningLines({
-      analysis: params.analysis,
-      maxFiles: params.maxFiles
-    }) : [],
-    warningSignaturesSeen
-  };
-}
-
-// src/agents/bootstrap-types.ts
-var DEFAULT_AGENTS_FILENAME = "AGENTS.md";
-var DEFAULT_SOUL_DEFAULT_FILENAME = "SOUL.default.md";
-var DEFAULT_SOUL_FILENAME = "SOUL.md";
-var DEFAULT_TOOLS_FILENAME = "TOOLS.md";
-var DEFAULT_IDENTITY_FILENAME = "IDENTITY.md";
-var DEFAULT_USER_FILENAME = "USER.md";
-var DEFAULT_BOOTSTRAP_FILENAME = "BOOTSTRAP.md";
-var DEFAULT_MEMORY_FILENAME = "MEMORY.md";
-
-// src/agents/workspace.ts
-var DEFAULT_WORKSPACE_DIR_NAME = "workspace";
-var DEFAULT_MEMORY_SUBDIR = "memory";
-var STABLE_BOOTSTRAP_FILENAMES = [
-  DEFAULT_AGENTS_FILENAME,
-  DEFAULT_SOUL_DEFAULT_FILENAME,
-  DEFAULT_SOUL_FILENAME,
-  DEFAULT_IDENTITY_FILENAME,
-  DEFAULT_USER_FILENAME,
-  DEFAULT_TOOLS_FILENAME,
-  DEFAULT_BOOTSTRAP_FILENAME
-];
-var DYNAMIC_BOOTSTRAP_FILENAMES = [
-  DEFAULT_MEMORY_FILENAME
-];
-var DEFAULT_BOOTSTRAP_MAX_CHARS = 12000;
-var DEFAULT_BOOTSTRAP_TOTAL_MAX_CHARS = 64000;
-var DEFAULT_DYNAMIC_TOTAL_MAX_CHARS = 24000;
-function resolveAgentWorkspaceDir(agentDir) {
-  return path8.join(agentDir, DEFAULT_WORKSPACE_DIR_NAME);
-}
-async function readOptionalFile(filePath) {
-  try {
-    const content = await readFile2(filePath, "utf8");
-    return content;
-  } catch (err) {
-    if (isErrnoException(err) && (err.code === "ENOENT" || err.code === "EISDIR")) {
-      return;
-    }
-    throw err;
-  }
-}
-function isErrnoException(value) {
-  return value instanceof Error && typeof value.code === "string";
-}
-async function loadNamedFile(workspaceDir, name, relativePath) {
-  const filePath = path8.join(workspaceDir, relativePath ?? name);
-  const content = await readOptionalFile(filePath);
-  if (content === undefined) {
-    return { name, path: filePath, missing: true };
-  }
-  return { name, path: filePath, content, missing: false };
-}
-async function loadStableBootstrapFiles(workspaceDir, options) {
-  const defaultFiles = await Promise.all(STABLE_BOOTSTRAP_FILENAMES.map((name) => loadNamedFile(workspaceDir, name)));
-  const extras = options?.extraStableFiles ?? [];
-  if (extras.length === 0) {
-    return defaultFiles;
-  }
-  const extraFiles = await Promise.all(extras.map((name) => loadNamedFile(workspaceDir, name)));
-  return [...defaultFiles, ...extraFiles];
-}
-async function loadDynamicBootstrapFiles(workspaceDir, options) {
-  const now2 = options?.now ?? new Date;
-  const includeYesterday = options?.includeYesterday ?? true;
-  const files = await Promise.all(DYNAMIC_BOOTSTRAP_FILENAMES.map((name) => loadNamedFile(workspaceDir, name)));
-  const todayRelative = dailyMemoryRelativePath(now2);
-  const todayName = DEFAULT_MEMORY_FILENAME;
-  const today = await loadNamedFile(workspaceDir, todayName, todayRelative);
-  today.path = path8.join(workspaceDir, todayRelative);
-  files.push(today);
-  if (includeYesterday) {
-    const yesterdayRelative = dailyMemoryRelativePath(addDays(now2, -1));
-    const yesterday = await loadNamedFile(workspaceDir, todayName, yesterdayRelative);
-    yesterday.path = path8.join(workspaceDir, yesterdayRelative);
-    files.push(yesterday);
+    this.name = "NodeEnvError";
+    this.stderr = stderr;
   }
-  return files;
-}
-function pad22(n) {
-  return n < 10 ? `0${n}` : String(n);
-}
-function dailyMemoryRelativePath(date) {
-  const y = date.getFullYear();
-  const m = pad22(date.getMonth() + 1);
-  const d = pad22(date.getDate());
-  return path8.join(DEFAULT_MEMORY_SUBDIR, `${y}-${m}-${d}.md`);
 }
-function addDays(date, days) {
-  const out = new Date(date.getTime());
-  out.setDate(out.getDate() + days);
-  return out;
+var ALL_LOCKFILES = [
+  "bun.lock",
+  "bun.lockb",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock"
+];
+var LOCKFILES_FOR = {
+  bun: ["bun.lock", "bun.lockb"],
+  npm: ["package-lock.json"]
+};
+function defaultNodeCacheRoot() {
+  return join109(homedir55(), ".switchroom", "deps", "node");
 }
-function truncateContent(name, content, maxChars) {
-  if (content.length <= maxChars) {
-    return content;
-  }
-  if (maxChars < 200) {
-    return content.slice(0, Math.max(0, maxChars));
+function hashDepInputs(packageJsonPath) {
+  const sourceDir = dirname47(packageJsonPath);
+  const hasher = createHash21("sha256");
+  hasher.update(`package.json
+`);
+  hasher.update(readFileSync95(packageJsonPath));
+  for (const lockName of ALL_LOCKFILES) {
+    const lockPath = join109(sourceDir, lockName);
+    if (existsSync104(lockPath)) {
+      hasher.update(`
+`);
+      hasher.update(lockName);
+      hasher.update(`
+`);
+      hasher.update(readFileSync95(lockPath));
+    }
   }
-  const headRoomInitial = Math.floor(maxChars * 0.7);
-  const sampleMarker = `
-\u2026(truncated ${name}: kept ${headRoomInitial}+${Math.max(0, maxChars - headRoomInitial - 96)} chars of ${content.length})\u2026
-`;
-  const markerReserve = Math.max(64, sampleMarker.length + 8);
-  const headRoom = Math.min(headRoomInitial, Math.max(0, maxChars - markerReserve - 8));
-  const tailRoom = Math.max(0, maxChars - headRoom - markerReserve);
-  const head = content.slice(0, Math.max(0, headRoom));
-  const tail = tailRoom > 0 ? content.slice(content.length - tailRoom) : "";
-  const result = `${head}
-\u2026(truncated ${name}: kept ${headRoom}+${tailRoom} chars of ${content.length})\u2026
-${tail}`;
-  return result.length <= maxChars ? result : result.slice(0, maxChars);
+  return hasher.digest("hex");
 }
-function projectBootstrapFiles(params) {
-  const {
-    files,
-    heading,
-    budget,
-    seenSignatures,
-    warningMode = "error",
-    warningMaxFiles = DEFAULT_BOOTSTRAP_PROMPT_WARNING_MAX_FILES
-  } = params;
-  const perFileCap = budget.bootstrapMaxChars;
-  let remainingTotal = budget.bootstrapTotalMaxChars;
-  const injectedFiles = [];
-  const parts = [];
-  for (const file of files) {
-    if (file.missing || typeof file.content !== "string") {
-      continue;
-    }
-    const raw = file.content.trimEnd();
-    if (raw.length === 0) {
-      continue;
-    }
-    const perFileAllowed = Math.min(perFileCap, remainingTotal);
-    if (perFileAllowed <= 0) {
-      break;
+function ensureNodeEnv(opts) {
+  const { skillName, packageJsonPath, force = false } = opts;
+  const cacheRoot = opts.cacheRoot ?? defaultNodeCacheRoot();
+  const installer = opts.installer ?? "bun";
+  if (!existsSync104(packageJsonPath)) {
+    throw new NodeEnvError(`package.json not found: ${packageJsonPath}`);
+  }
+  const sourceDir = dirname47(packageJsonPath);
+  const envDir = join109(cacheRoot, skillName);
+  const stampPath = join109(envDir, ".package.sha256");
+  const nodeModulesDir = join109(envDir, "node_modules");
+  const binDir = join109(nodeModulesDir, ".bin");
+  const targetHash = hashDepInputs(packageJsonPath);
+  if (!force && existsSync104(stampPath) && existsSync104(nodeModulesDir)) {
+    const existingHash = readFileSync95(stampPath, "utf8").trim();
+    if (existingHash === targetHash) {
+      return {
+        skillName,
+        dir: envDir,
+        nodeModulesDir,
+        binDir,
+        rebuilt: false
+      };
     }
-    const injected = truncateContent(file.name, raw, perFileAllowed);
-    const relativePath = file.path;
-    injectedFiles.push({ path: relativePath, content: injected });
-    parts.push(`## ${relativePath}`);
-    parts.push(injected);
-    remainingTotal -= injected.length;
-    if (remainingTotal <= 0) {
-      break;
+  }
+  if (existsSync104(envDir)) {
+    rmSync20(envDir, { recursive: true, force: true });
+  }
+  mkdirSync60(envDir, { recursive: true });
+  copyFileSync13(packageJsonPath, join109(envDir, "package.json"));
+  let copiedLockfile = false;
+  for (const lockName of LOCKFILES_FOR[installer]) {
+    const lockPath = join109(sourceDir, lockName);
+    if (existsSync104(lockPath)) {
+      copyFileSync13(lockPath, join109(envDir, lockName));
+      copiedLockfile = true;
     }
   }
-  const concatenated = parts.length > 0 ? [heading.trim().length > 0 ? `# ${heading}` : null, ...parts].filter((p) => p !== null).join(`
-
-`) : "";
-  const stats = buildBootstrapInjectionStats({
-    bootstrapFiles: files,
-    injectedFiles
-  });
-  const analysis = analyzeBootstrapBudget({
-    files: stats,
-    bootstrapMaxChars: budget.bootstrapMaxChars,
-    bootstrapTotalMaxChars: budget.bootstrapTotalMaxChars,
-    nearLimitRatio: budget.nearLimitRatio ?? DEFAULT_BOOTSTRAP_NEAR_LIMIT_RATIO
-  });
-  const warning = buildBootstrapPromptWarning({
-    analysis,
-    mode: warningMode,
-    seenSignatures,
-    maxFiles: warningMaxFiles
-  });
-  if (warningMode === "error" && analysis.hasTruncation) {
-    const errorLines = [
-      "Bootstrap budget exceeded. The following files exceed limits:",
-      ""
-    ];
-    for (const file of analysis.truncatedFiles) {
-      const excessChars = file.rawChars - file.injectedChars;
-      const causes = file.causes.map((c) => c === "per-file-limit" ? `per-file limit (${analysis.totals.bootstrapMaxChars.toLocaleString()} chars)` : `total limit (${analysis.totals.bootstrapTotalMaxChars.toLocaleString()} chars)`);
-      errorLines.push(`  ${file.name}: ${file.rawChars.toLocaleString()} bytes (exceeds ${causes.join(", ")})`);
-      errorLines.push(`    Trim ${excessChars.toLocaleString()} bytes, or pass --warning-mode warn to proceed with truncation.`);
+  try {
+    if (installer === "bun") {
+      const args = copiedLockfile ? ["install", "--frozen-lockfile"] : ["install"];
+      execFileSync32("bun", args, { cwd: envDir, stdio: "pipe" });
+    } else {
+      const args = copiedLockfile ? ["ci"] : ["install"];
+      execFileSync32("npm", args, { cwd: envDir, stdio: "pipe" });
     }
-    throw new BootstrapBudgetExceededError(analysis, errorLines.join(`
-`));
+  } catch (err) {
+    const e = err;
+    throw new NodeEnvError(`Failed to install node deps for skill "${skillName}" with ${installer}: ${e.message}`, e.stderr?.toString());
   }
-  return { files, injectedFiles, concatenated, analysis, warning };
-}
-async function buildStableBootstrapPrompt(params) {
-  const files = await loadStableBootstrapFiles(params.workspaceDir, {
-    extraStableFiles: params.extraStableFiles
-  });
-  const budget = {
-    bootstrapMaxChars: params.budget?.bootstrapMaxChars ?? DEFAULT_BOOTSTRAP_MAX_CHARS,
-    bootstrapTotalMaxChars: params.budget?.bootstrapTotalMaxChars ?? DEFAULT_BOOTSTRAP_TOTAL_MAX_CHARS,
-    nearLimitRatio: params.budget?.nearLimitRatio
+  writeFileSync42(stampPath, targetHash + `
+`);
+  return {
+    skillName,
+    dir: envDir,
+    nodeModulesDir,
+    binDir,
+    rebuilt: true
   };
-  return projectBootstrapFiles({
-    files,
-    heading: "Project Context (stable workspace files)",
-    budget,
-    seenSignatures: params.seenSignatures,
-    warningMode: params.budget?.warningMode,
-    warningMaxFiles: params.budget?.warningMaxFiles
-  });
 }
-async function buildDynamicBootstrapPrompt(params) {
-  const files = await loadDynamicBootstrapFiles(params.workspaceDir, {
-    now: params.now,
-    includeYesterday: params.includeYesterday
-  });
-  const budget = {
-    bootstrapMaxChars: params.budget?.bootstrapMaxChars ?? DEFAULT_BOOTSTRAP_MAX_CHARS,
-    bootstrapTotalMaxChars: params.budget?.bootstrapTotalMaxChars ?? DEFAULT_DYNAMIC_TOTAL_MAX_CHARS,
-    nearLimitRatio: params.budget?.nearLimitRatio
-  };
-  return projectBootstrapFiles({
-    files,
-    heading: "Project Context (dynamic workspace files)",
-    budget,
-    seenSignatures: params.seenSignatures,
-    warningMode: params.budget?.warningMode,
-    warningMaxFiles: params.budget?.warningMaxFiles
+
+// src/cli/deps.ts
+function builtinSkillsRoot() {
+  return resolve55(homedir56(), ".switchroom/skills/_bundled");
+}
+function registerDepsCommand(program3) {
+  const deps = program3.command("deps").description("Manage cached per-skill dependency environments");
+  deps.command("rebuild <skill>").description("Rebuild the Python venv and/or Node node_modules cache for a skill").option("-p, --python", "Rebuild only the Python env").option("-n, --node", "Rebuild only the Node env").action(async (skill, opts) => {
+    const skillsRoot = builtinSkillsRoot();
+    if (!existsSync105(skillsRoot)) {
+      console.error(source_default.red(`Bundled skills pool dir not found at ${skillsRoot} \u2014 run \`switchroom update\` to install it.`));
+      process.exit(1);
+    }
+    const skillDir = join110(skillsRoot, skill);
+    if (!existsSync105(skillDir)) {
+      console.error(source_default.red(`Unknown skill: ${skill} (no dir at ${skillDir})`));
+      process.exit(1);
+    }
+    const requirementsPath = join110(skillDir, "requirements.txt");
+    const packageJsonPath = join110(skillDir, "package.json");
+    const wantPython = opts.python ?? (!opts.python && !opts.node && existsSync105(requirementsPath));
+    const wantNode = opts.node ?? (!opts.python && !opts.node && existsSync105(packageJsonPath));
+    let did = 0;
+    if (wantPython) {
+      if (!existsSync105(requirementsPath)) {
+        console.error(source_default.red(`Skill "${skill}" has no requirements.txt at ${requirementsPath}`));
+        process.exit(1);
+      }
+      try {
+        console.log(source_default.gray(`Rebuilding Python env for ${skill}...`));
+        const env2 = ensurePythonEnv({
+          skillName: skill,
+          requirementsPath,
+          force: true
+        });
+        console.log(source_default.green(`  \u2713 Python env at ${env2.venvDir} (python: ${env2.pythonBin})`));
+        did++;
+      } catch (err) {
+        if (err instanceof PythonEnvError) {
+          console.error(source_default.red(`  Python env failed: ${err.message}`));
+          if (err.stderr)
+            console.error(source_default.dim(err.stderr));
+          process.exit(1);
+        }
+        throw err;
+      }
+    }
+    if (wantNode) {
+      if (!existsSync105(packageJsonPath)) {
+        console.error(source_default.red(`Skill "${skill}" has no package.json at ${packageJsonPath}`));
+        process.exit(1);
+      }
+      try {
+        console.log(source_default.gray(`Rebuilding Node env for ${skill}...`));
+        const env2 = ensureNodeEnv({
+          skillName: skill,
+          packageJsonPath,
+          force: true
+        });
+        console.log(source_default.green(`  \u2713 Node env at ${env2.dir} (node_modules: ${env2.nodeModulesDir})`));
+        did++;
+      } catch (err) {
+        if (err instanceof NodeEnvError) {
+          console.error(source_default.red(`  Node env failed: ${err.message}`));
+          if (err.stderr)
+            console.error(source_default.dim(err.stderr));
+          process.exit(1);
+        }
+        throw err;
+      }
+    }
+    if (did === 0) {
+      console.error(source_default.yellow(`Skill "${skill}" has neither requirements.txt nor package.json \u2014 nothing to rebuild.`));
+      process.exit(1);
+    }
   });
 }
 
+// src/cli/workspace.ts
+init_helpers();
+init_loader();
+import { existsSync as existsSync106 } from "node:fs";
+import { resolve as resolve56, sep as sep7 } from "node:path";
+import { spawnSync as spawnSync23 } from "node:child_process";
+
 // src/agents/memory-search.ts
 import { readFile as readFile3, readdir, realpath, stat as stat2 } from "node:fs/promises";
 import path9 from "node:path";
@@ -122730,8 +123375,8 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const resolvedWorkspace = resolve55(dir);
-    const target = resolve55(resolvedWorkspace, file ?? "AGENTS.md");
+    const resolvedWorkspace = resolve56(dir);
+    const target = resolve56(resolvedWorkspace, file ?? "AGENTS.md");
     if (!isInsideWorkspace(resolvedWorkspace, target)) {
       process.stderr.write(`workspace edit: refusing path traversal outside workspace dir (${target})
 `);
@@ -122799,8 +123444,8 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const gitDir = resolve55(dir, ".git");
-    if (!existsSync105(gitDir)) {
+    const gitDir = resolve56(dir, ".git");
+    if (!existsSync106(gitDir)) {
       process.stdout.write(`Workspace is not a git repository. Re-run \`switchroom agent create ${agentName}\` ` + `or manually \`git init\` in ${dir} to enable versioning.
 `);
       return;
@@ -122853,8 +123498,8 @@ function registerWorkspaceCommand(program3) {
     const dir = resolveAgentWorkspaceDirOrExit(program3, agentName);
     if (!dir)
       return;
-    const gitDir = resolve55(dir, ".git");
-    if (!existsSync105(gitDir)) {
+    const gitDir = resolve56(dir, ".git");
+    if (!existsSync106(gitDir)) {
       process.stdout.write(`Workspace is not a git repository.
 `);
       return;
@@ -122877,9 +123522,9 @@ function resolveAgentWorkspaceDirOrExit(program3, agentName) {
     return;
   }
   const agentsDir = resolveAgentsDir(config);
-  const agentDir = resolve55(agentsDir, agentName);
+  const agentDir = resolve56(agentsDir, agentName);
   const dir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync105(dir)) {
+  if (!existsSync106(dir)) {
     process.stderr.write(`workspace: ${dir} does not exist yet. Run \`switchroom setup\` or \`switchroom agent scaffold ${agentName}\` to seed it.
 `);
     return;
@@ -122915,8 +123560,8 @@ function safeParseInt(value, fallback) {
 init_helpers();
 init_loader();
 init_merge();
-import { copyFileSync as copyFileSync14, existsSync as existsSync106, readFileSync as readFileSync95, writeFileSync as writeFileSync43 } from "node:fs";
-import { join as join110, resolve as resolve56 } from "node:path";
+import { copyFileSync as copyFileSync14, existsSync as existsSync107, readFileSync as readFileSync96, writeFileSync as writeFileSync43 } from "node:fs";
+import { join as join111, resolve as resolve57 } from "node:path";
 init_scaffold();
 init_profiles();
 init_schema();
@@ -122931,9 +123576,9 @@ function resolveSoulTargetOrExit(program3, agentName) {
   const profileName = merged.extends ?? DEFAULT_PROFILE;
   const profilePath = getProfilePath(profileName);
   const agentsDir = resolveAgentsDir(config);
-  const agentDir = resolve56(agentsDir, agentName);
+  const agentDir = resolve57(agentsDir, agentName);
   const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-  if (!existsSync106(workspaceDir)) {
+  if (!existsSync107(workspaceDir)) {
     console.error(`soul: ${workspaceDir} does not exist yet. Run \`switchroom setup\` ` + `or \`switchroom agent scaffold ${agentName}\` to seed it.`);
     process.exit(1);
   }
@@ -122942,7 +123587,7 @@ function resolveSoulTargetOrExit(program3, agentName) {
     profileName,
     profilePath,
     workspaceDir,
-    soulPath: join110(workspaceDir, "SOUL.md"),
+    soulPath: join111(workspaceDir, "SOUL.md"),
     soul: merged.soul
   };
 }
@@ -122959,11 +123604,11 @@ function registerSoulCommand(program3) {
     const t = resolveSoulTargetOrExit(program3, agentName);
     if (!t)
       return;
-    if (!existsSync106(t.soulPath)) {
+    if (!existsSync107(t.soulPath)) {
       console.error(`soul: ${t.soulPath} does not exist yet \u2014 run ` + `\`switchroom soul reset ${agentName}\` to seed it.`);
       process.exit(1);
     }
-    process.stdout.write(readFileSync95(t.soulPath, "utf-8"));
+    process.stdout.write(readFileSync96(t.soulPath, "utf-8"));
   }));
   cmd.command("reset <agent>").description("Re-seed SOUL.md from the agent's current profile " + "(backs the existing file up to SOUL.md.bak first)").option("-y, --yes", "Skip the confirmation prompt").action(withConfigError(async (agentName, opts) => {
     const t = resolveSoulTargetOrExit(program3, agentName);
@@ -122974,7 +123619,7 @@ function registerSoulCommand(program3) {
       console.error(`soul: profile "${t.profileName}" ships no SOUL.md.hbs \u2014 ` + `nothing to re-seed from.`);
       process.exit(1);
     }
-    const exists = existsSync106(t.soulPath);
+    const exists = existsSync107(t.soulPath);
     if (exists && !opts.yes) {
       if (!isInteractive()) {
         console.error(`soul: ${t.soulPath} already exists. Re-run with --yes to ` + `replace it (the current file is backed up to SOUL.md.bak).`);
@@ -122989,7 +123634,7 @@ function registerSoulCommand(program3) {
     let backupPath;
     if (exists) {
       backupPath = `${t.soulPath}.bak`;
-      if (existsSync106(backupPath)) {
+      if (existsSync107(backupPath)) {
         backupPath = `${t.soulPath}.bak.${Date.now()}`;
       }
       copyFileSync14(t.soulPath, backupPath);
@@ -123005,279 +123650,6 @@ function registerSoulCommand(program3) {
   }));
 }
 
-// src/cli/debug.ts
-init_helpers();
-init_loader();
-import { existsSync as existsSync107, readFileSync as readFileSync96, readdirSync as readdirSync36, statSync as statSync62 } from "node:fs";
-import { resolve as resolve57, join as join111 } from "node:path";
-import { createHash as createHash21 } from "node:crypto";
-init_merge();
-init_hindsight2();
-function formatBytes(bytes) {
-  return `${bytes.toLocaleString()} bytes`;
-}
-function estimateTokens(bytes) {
-  return Math.round(bytes / 3.7);
-}
-function readMcpServerNames(agentDir) {
-  const mcpPath = join111(agentDir, ".mcp.json");
-  if (!existsSync107(mcpPath))
-    return [];
-  try {
-    const parsed = JSON.parse(readFileSync96(mcpPath, "utf-8"));
-    return Object.keys(parsed.mcpServers ?? {});
-  } catch {
-    return null;
-  }
-}
-function sha2562(content) {
-  return createHash21("sha256").update(content).digest("hex").slice(0, 16);
-}
-function findLatestTranscriptJsonl(claudeConfigDir) {
-  const projectsDir = join111(claudeConfigDir, "projects");
-  if (!existsSync107(projectsDir))
-    return;
-  try {
-    const entries = readdirSync36(projectsDir, { withFileTypes: true });
-    let latest;
-    for (const entry of entries) {
-      if (!entry.isDirectory())
-        continue;
-      const projectPath = join111(projectsDir, entry.name);
-      const transcriptPath = join111(projectPath, "transcript.jsonl");
-      if (!existsSync107(transcriptPath))
-        continue;
-      const stat3 = statSync62(transcriptPath);
-      if (!latest || stat3.mtimeMs > latest.mtime) {
-        latest = { path: transcriptPath, mtime: stat3.mtimeMs };
-      }
-    }
-    return latest?.path;
-  } catch {
-    return;
-  }
-}
-function extractLatestUserMessage(transcriptPath) {
-  try {
-    const content = readFileSync96(transcriptPath, "utf-8");
-    const lines = content.trim().split(`
-`).filter(Boolean);
-    for (let i2 = lines.length - 1;i2 >= 0; i2--) {
-      const line = lines[i2];
-      try {
-        const event = JSON.parse(line);
-        if (event.type === "message" && event.role === "user" && typeof event.content === "string") {
-          const timestamp = event.timestamp ? new Date(event.timestamp).toLocaleString() : "unknown";
-          return { text: event.content, timestamp };
-        }
-      } catch {
-        continue;
-      }
-    }
-  } catch {
-    return;
-  }
-}
-function buildProgressUpdateGuidance() {
-  return `## Progress updates (human-style check-ins)
-
-You're talking to a human colleague on Telegram. Alongside the emoji status
-ladder, send a short \`progress_update\` at inflection points, the moments a
-senior colleague would ping the person who asked them to do something:
-
-- **Plan formed:** "Got it. Going to do X first, then Y, then Z."
-- **Pivot or blocker:** "First approach didn't work because <reason>. Trying
-  <alternative> instead."
-- **Chunk finished:** "Done with X. Starting Y now."
-
-Keep them short (one or two sentences). Don't narrate every step, the pinned
-progress card shows that for free. Don't send an update on a trivial one-shot
-task. Send them when a colleague would genuinely want to know what's happening.
-
-Final answers still go through \`reply\` as usual,
-\`progress_update\` is only for mid-turn check-ins.`;
-}
-function registerDebugCommand(program3) {
-  const cmd = program3.command("debug", { hidden: true }).description("Observability tools for inspecting agent prompt layering [advanced]");
-  cmd.command("turn <agent>").description("Dump the exact prompt layering the model saw on the most recent turn").option("--last <n>", "Show N-th most recent turn instead of latest", "1").action(withConfigError(async (agentName, opts) => {
-    const config = getConfig(program3);
-    const agentConfig = config.agents[agentName];
-    if (!agentConfig) {
-      console.error(`Agent '${agentName}' not found in switchroom.yaml`);
-      process.exit(1);
-    }
-    const agentsDir = resolveAgentsDir(config);
-    const agentDir = resolve57(agentsDir, agentName);
-    if (!existsSync107(agentDir)) {
-      console.error(`Agent directory not found: ${agentDir}`);
-      process.exit(1);
-    }
-    const workspaceDir = resolveAgentWorkspaceDir(agentDir);
-    const claudeConfigDir = join111(agentDir, ".claude");
-    const claudeMdPath2 = join111(agentDir, "CLAUDE.md");
-    const soulMdPath = join111(agentDir, "SOUL.md");
-    const workspaceSoulMdPath = join111(workspaceDir, "SOUL.md");
-    const handoffPath = join111(agentDir, ".handoff.md");
-    const lastN = parseInt(opts.last, 10);
-    if (isNaN(lastN) || lastN < 1) {
-      console.error("--last must be a positive integer");
-      process.exit(1);
-    }
-    if (lastN > 1) {
-      console.error("Note: --last N where N > 1 not yet implemented (only latest turn supported)");
-      process.exit(1);
-    }
-    console.log(`=== Debug Turn Dump: ${agentName} ===
-`);
-    console.log(`=== Append System Prompt (stable) ===
-`);
-    const resolved = resolveAgentConfig(config.defaults, config.profiles, agentConfig);
-    const useHotReloadStable = resolved.channels?.telegram?.hotReloadStable === true;
-    const stableResult = await buildStableBootstrapPrompt({
-      workspaceDir,
-      budget: { warningMode: "off" }
-    });
-    if (useHotReloadStable) {
-      console.log(`-- Workspace Stable Render (not used \u2014 stable content is in per-turn hook) --`);
-      console.log();
-    } else if (stableResult.concatenated.trim().length > 0) {
-      console.log(`-- Workspace Stable Render (${formatBytes(stableResult.concatenated.length)}) --`);
-      console.log(stableResult.concatenated);
-      console.log();
-    } else {
-      console.log("-- Workspace Stable Render (0 bytes, not set up) --");
-      console.log();
-    }
-    const useSwitchroomPlugin = usesSwitchroomTelegramPlugin(resolved);
-    const progressGuidance = useSwitchroomPlugin ? buildProgressUpdateGuidance() : "";
-    if (progressGuidance.length > 0) {
-      console.log(`-- Progress Updates Guidance (${formatBytes(progressGuidance.length)}) --`);
-      console.log(progressGuidance);
-      console.log();
-    }
-    const baseSystemPromptAppend = resolved.system_prompt_append ?? "";
-    if (baseSystemPromptAppend.trim().length > 0) {
-      console.log(`-- User System Prompt Append (${formatBytes(baseSystemPromptAppend.length)}) --`);
-      console.log(baseSystemPromptAppend);
-      console.log();
-    }
-    console.log(`=== Append System Prompt (per-session) ===
-`);
-    const handoffContent = existsSync107(handoffPath) ? readFileSync96(handoffPath, "utf-8") : "";
-    if (handoffContent.trim().length > 0) {
-      console.log(`-- Handoff Briefing (${formatBytes(handoffContent.length)}) --`);
-      console.log(handoffContent);
-      console.log();
-    } else {
-      console.log("-- Handoff Briefing (0 bytes, no prior session) --");
-      console.log();
-    }
-    console.log(`=== CLAUDE.md (auto-loaded by Claude Code) ===
-`);
-    const claudeMdContent = existsSync107(claudeMdPath2) ? readFileSync96(claudeMdPath2, "utf-8") : "";
-    if (claudeMdContent.trim().length > 0) {
-      console.log(`(${formatBytes(claudeMdContent.length)})`);
-      console.log(claudeMdContent);
-      console.log();
-    } else {
-      console.log("(0 bytes, not present)");
-      console.log();
-    }
-    console.log(`=== Persona (SOUL.md) ===
-`);
-    const soulMdContent = existsSync107(soulMdPath) ? readFileSync96(soulMdPath, "utf-8") : existsSync107(workspaceSoulMdPath) ? readFileSync96(workspaceSoulMdPath, "utf-8") : "";
-    if (soulMdContent.trim().length > 0) {
-      console.log(`(${formatBytes(soulMdContent.length)})`);
-      console.log(soulMdContent);
-      console.log();
-    } else {
-      console.log("(0 bytes, stale placeholder \u2014 Phase 2 item: single source of truth for persona)");
-      console.log();
-    }
-    console.log(`=== Per-Turn Injections (UserPromptSubmit) ===
-`);
-    if (useHotReloadStable) {
-      if (stableResult.concatenated.trim().length > 0) {
-        console.log(`-- Workspace Stable (hot-reload hook): ${formatBytes(stableResult.concatenated.length)} --`);
-        console.log(stableResult.concatenated);
-        console.log();
-      } else {
-        console.log("-- Workspace Stable (hot-reload hook): 0 bytes, not set up --");
-        console.log();
-      }
-    }
-    const dynamicResult = await buildDynamicBootstrapPrompt({
-      workspaceDir,
-      budget: { warningMode: "off" }
-    });
-    if (dynamicResult.concatenated.trim().length > 0) {
-      console.log(`-- Workspace Dynamic: fired, ${formatBytes(dynamicResult.concatenated.length)} --`);
-      console.log(dynamicResult.concatenated);
-      console.log();
-    } else {
-      console.log("-- Workspace Dynamic: no content (MEMORY.md and daily notes empty or missing) --");
-      console.log();
-    }
-    const hindsightEnabled = isHindsightEnabled(config) && agentConfig.memory?.auto_recall !== false;
-    if (hindsightEnabled) {
-      console.log("-- Hindsight Recall: enabled (exact content unavailable, check hindsight logs) --");
-      console.log();
-    } else {
-      console.log("-- Hindsight Recall: disabled --");
-      console.log();
-    }
-    console.log(`=== User Message (latest turn) ===
-`);
-    const transcriptPath = findLatestTranscriptJsonl(claudeConfigDir);
-    const userMessage = transcriptPath ? extractLatestUserMessage(transcriptPath) : undefined;
-    if (userMessage) {
-      console.log(`(Turn timestamp: ${userMessage.timestamp})`);
-      console.log(userMessage.text);
-      console.log();
-    } else {
-      console.log("(unavailable: no transcript found or transcript empty)");
-      console.log();
-    }
-    console.log(`=== Totals ===
-`);
-    const stableBytes = stableResult.concatenated.length + progressGuidance.length + baseSystemPromptAppend.length;
-    const perSessionBytes = handoffContent.length;
-    const claudeMdBytes = claudeMdContent.length;
-    const soulMdBytes = soulMdContent.length;
-    const perTurnBytes = dynamicResult.concatenated.length;
-    const userBytes = userMessage?.text.length ?? 0;
-    const fleetDir = join111(agentsDir, "..", "fleet");
-    const fleetInvPath = join111(fleetDir, "switchroom-invariants.md");
-    const fleetClaudePath = join111(fleetDir, "CLAUDE.md");
-    const fleetInvBytes = existsSync107(fleetInvPath) ? readFileSync96(fleetInvPath, "utf-8").length : 0;
-    const fleetClaudeBytes = existsSync107(fleetClaudePath) ? readFileSync96(fleetClaudePath, "utf-8").length : 0;
-    const fleetBytes = fleetInvBytes + fleetClaudeBytes;
-    const totalBytes = stableBytes + perSessionBytes + claudeMdBytes + fleetBytes + perTurnBytes + userBytes;
-    console.log(`Stable prefix:     ${formatBytes(stableBytes).padEnd(20)} (cache-hot; includes SOUL.md ${soulMdBytes.toLocaleString()}B)`);
-    console.log(`Per-session:       ${formatBytes(perSessionBytes).padEnd(20)} (cache-warm until next session)`);
-    console.log(`CLAUDE.md (cwd):   ${formatBytes(claudeMdBytes).padEnd(20)} (cache-hot)`);
-    console.log(`Fleet invariants:  ${formatBytes(fleetBytes).padEnd(20)} (--add-dir, cache-hot)`);
-    console.log(`Per-turn:          ${formatBytes(perTurnBytes).padEnd(20)} (never cached \u2014 the real per-turn $ cost)`);
-    console.log(`User message:      ${formatBytes(userBytes).padEnd(20)}`);
-    console.log(`Authored text:     ${formatBytes(totalBytes).padEnd(20)} (~${estimateTokens(totalBytes).toLocaleString()} tokens est.)`);
-    const mcpServers = readMcpServerNames(agentDir);
-    const mcpCount = mcpServers?.length ?? null;
-    const mcpEstK = mcpCount != null ? mcpCount * 3 : null;
-    const mcpLabel = mcpCount != null ? `${mcpCount} servers` : "(unreadable \u2014 agent-private .mcp.json)";
-    const mcpEstLabel = mcpEstK != null ? `~${mcpEstK.toLocaleString()}k tok` : "~30k tok (audit est.)";
-    console.log(`MCP tool surface:  ${mcpLabel.padEnd(20)} (NOT counted above; ~3k tok/server \u2248 ${mcpEstLabel} \u2014 deferred under tool search)`);
-    if (mcpServers && mcpServers.length > 0) {
-      console.log(`                   [${mcpServers.join(", ")}]`);
-    }
-    const floorMcp = mcpEstK != null ? `~${mcpEstK.toLocaleString()}k` : "~30k";
-    console.log(`Per-turn FLOOR:    ${`~${estimateTokens(totalBytes).toLocaleString()} + ${floorMcp} MCP + ~13k CLI-base`.padEnd(20)} tokens est. (before the user msg, recall, or tool results)`);
-    const stableCacheInput = stableResult.concatenated + progressGuidance + baseSystemPromptAppend;
-    const stableHash = sha2562(stableCacheInput);
-    console.log(`Cache stable hash: sha256:${stableHash}`);
-    console.log();
-  }));
-}
-
 // src/cli/worktree.ts
 init_source();
 init_claim();