@integrity-labs/agt-cli 0.10.1 → 0.10.3

package/dist/lib/manager-worker.js

@@ -6,10 +6,11 @@ import {
   getFramework,
   getHostId,
   provision,
+  provisionIsolationHook,
   provisionStopHook,
   requireHost,
   resolveChannels
-} from "../chunk-N7TRKQMT.js";
+} from "../chunk-6YGOQRAR.js";
 import {
   findTaskByTemplate,
   getProjectDir,
@@ -37,6 +38,38 @@ import { join, dirname } from "path";
 import { homedir } from "os";
 import { fileURLToPath } from "url";
 
+// src/lib/plugin-context-render.ts
+var PLUGIN_CONTEXT_PLACEHOLDER_RE = /\{\{\s*context\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
+var TEAM_OVERRIDES_HEADER = "## Team Overrides\n\n> **The following overrides anything you've read above.** If any rule here conflicts with earlier instructions in this skill, follow what is written here. These are user-supplied directives that take precedence over the plugin's default guidance.\n";
+function formatContextValue(value) {
+  if (value === null || value === void 0) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "boolean" || typeof value === "number") return String(value);
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return "";
+  }
+}
+function renderPluginSkillContent(raw, values, overrides, warn = () => {
+}) {
+  const substituted = raw.replace(PLUGIN_CONTEXT_PLACEHOLDER_RE, (_match, fieldName) => {
+    if (!(fieldName in values)) {
+      warn(`unresolved placeholder {{context.${fieldName}}} \u2014 substituting empty string`);
+      return "";
+    }
+    return formatContextValue(values[fieldName]);
+  });
+  const trimmedOverrides = overrides.trim();
+  if (!trimmedOverrides) return substituted;
+  const separator = substituted.endsWith("\n") ? "\n" : "\n\n";
+  return `${substituted}${separator}---
+
+${TEAM_OVERRIDES_HEADER}
+${trimmedOverrides}
+`;
+}
+
 // src/lib/gateway-client.ts
 import { EventEmitter } from "events";
 import WebSocket from "ws";
@@ -314,6 +347,7 @@ var driftChannel = null;
 var assignChannel = null;
 var configChannel = null;
 var kanbanChannel = null;
+var pluginContextChannel = null;
 var connected = false;
 var tearingDown = false;
 function ensureClient(config2) {
@@ -358,6 +392,7 @@ function startRealtimeChat(config2) {
       assignChannel = null;
       configChannel = null;
       kanbanChannel = null;
+      pluginContextChannel = null;
       if (client) {
         try {
           client.removeAllChannels();
@@ -489,6 +524,38 @@ function startRealtimeKanban(config2) {
   });
   log2(`[realtime] Subscribing to agent_kanban_items for ${agentIds.length} agent(s)`);
 }
+function startRealtimePluginContext(config2) {
+  const { agentIds, onContextChange, log: log2 } = config2;
+  if (agentIds.length === 0) return;
+  const sb = ensureClient(config2);
+  const filterStr = agentIds.length === 1 ? `agent_id=eq.${agentIds[0]}` : `agent_id=in.(${agentIds.join(",")})`;
+  pluginContextChannel = sb.channel("plugin-context-realtime").on("postgres_changes", {
+    event: "INSERT",
+    schema: "public",
+    table: "plugin_context",
+    filter: filterStr
+  }, (payload) => {
+    const row = payload.new;
+    log2(`[realtime] plugin_context INSERT for agent ${row.agent_id} (plugin ${row.plugin_id})`);
+    onContextChange(row);
+  }).on("postgres_changes", {
+    event: "UPDATE",
+    schema: "public",
+    table: "plugin_context",
+    filter: filterStr
+  }, (payload) => {
+    const row = payload.new;
+    log2(`[realtime] plugin_context UPDATE for agent ${row.agent_id} (plugin ${row.plugin_id})`);
+    onContextChange(row);
+  }).subscribe((status) => {
+    if (status === "SUBSCRIBED") {
+      log2("[realtime] Plugin context channel connected");
+    } else if (status === "CLOSED" || status === "CHANNEL_ERROR") {
+      log2(`[realtime] Plugin context channel: ${status}`);
+    }
+  });
+  log2(`[realtime] Subscribing to plugin_context for ${agentIds.length} agent(s)`);
+}
 function isRealtimeConnected() {
   return connected;
 }
@@ -531,6 +598,13 @@ function stopRealtimeChat() {
       }
       kanbanChannel = null;
     }
+    if (pluginContextChannel) {
+      try {
+        pluginContextChannel.unsubscribe();
+      } catch {
+      }
+      pluginContextChannel = null;
+    }
     if (client) {
       try {
         client.removeAllChannels();
@@ -818,6 +892,76 @@ function hashFile(filePath) {
     return null;
   }
 }
+var SKILLS_INDEX_START = "<!-- AGT:SKILLS_INDEX_START -->";
+var SKILLS_INDEX_END = "<!-- AGT:SKILLS_INDEX_END -->";
+function sanitizeSkillsIndexText(value) {
+  return value.replaceAll(SKILLS_INDEX_START, "").replaceAll(SKILLS_INDEX_END, "").replace(/<!--[\s\S]*?-->/g, "").replace(/\r?\n+/g, " ").trim();
+}
+function parseSkillFrontmatter(content) {
+  if (!content.startsWith("---")) return {};
+  const end = content.indexOf("\n---", 3);
+  if (end === -1) return {};
+  const block = content.slice(3, end);
+  const out = {};
+  for (const line of block.split("\n")) {
+    const m = line.match(/^(name|description)\s*:\s*(.*)$/);
+    if (m && m[1] && m[2] !== void 0) out[m[1]] = m[2].trim().replace(/^["']|["']$/g, "");
+  }
+  return out;
+}
+async function refreshSkillsIndexInClaudeMd(configDir, codeName, log2) {
+  const { readdirSync: readdirSync2, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync2 } = await import("fs");
+  const skillsDir = join(configDir, codeName, "project", ".claude", "skills");
+  const claudeMdPath = join(configDir, codeName, "project", "CLAUDE.md");
+  if (!ex(skillsDir) || !ex(claudeMdPath)) return;
+  const entries = [];
+  for (const dir of readdirSync2(skillsDir).sort()) {
+    const skillFile = join(skillsDir, dir, "SKILL.md");
+    if (!ex(skillFile)) continue;
+    try {
+      const { name, description } = parseSkillFrontmatter(rfs(skillFile, "utf-8"));
+      entries.push({
+        id: dir,
+        name: sanitizeSkillsIndexText(name ?? dir),
+        description: sanitizeSkillsIndexText(description ?? "(no description)")
+      });
+    } catch {
+    }
+  }
+  const body = entries.length ? entries.map((e) => `- **${e.name}** \u2014 ${e.description}`).join("\n") : "_(no skills installed)_";
+  const section = `${SKILLS_INDEX_START}
+## Available Skills
+
+The following skills are installed in \`.claude/skills/\`. Claude Code auto-activates them when relevant \u2014 you don't need to read them manually, but you should know they exist.
+
+${body}
+
+## Updating Plugins (ENG-4341)
+
+Plugin skills under \`.claude/skills/plugin-*/SKILL.md\` are **read-only** and managed by the platform. They are derived from the plugin's database row plus any per-agent context overrides, and are re-rendered every time the manager polls or a context change is broadcast over Supabase Realtime.
+
+**Never edit \`.claude/skills/plugin-*/SKILL.md\` files directly.** If you do, your edit will be silently overwritten on the next manager refresh, AND it won't propagate to other agents using the same plugin.
+
+To change a plugin's behavior (add a rule, update a default, tell the plugin not to do something), call the **\`plugin.improve\`** MCP tool with the user's request. The tool calls the platform API, which uses an LLM to translate the request into a structured update of the plugin's typed context fields and/or freeform overrides text. You'll get a diff back to show the user; on confirmation, call the tool again with \`auto_apply: true\` to apply.
+
+Examples of when to use \`plugin.improve\`:
+- *"Update the Coding plugin so we always use trunk instead of main"*
+- *"Add a rule to the Coding plugin: never merge directly to main, always open a PR"*
+- *"Tell the Knowledge Base plugin not to return results below 70% relevance"*
+- *"The Slack plugin should post incidents to #oncall, not #general"*
+${SKILLS_INDEX_END}`;
+  const current = rfs(claudeMdPath, "utf-8");
+  let next;
+  if (current.includes(SKILLS_INDEX_START) && current.includes(SKILLS_INDEX_END)) {
+    next = current.replace(new RegExp(`${SKILLS_INDEX_START}[\\s\\S]*?${SKILLS_INDEX_END}`), section);
+  } else {
+    next = current.trimEnd() + "\n\n" + section + "\n";
+  }
+  if (next !== current) {
+    writeFileSync2(claudeMdPath, next, "utf-8");
+    log2(`Refreshed skills index in CLAUDE.md for '${codeName}' (${entries.length} skills)`);
+  }
+}
 async function migrateToProfiles() {
   const homeDir = process.env["HOME"] ?? "/tmp";
   const sharedConfigPath = join(homeDir, ".openclaw", "openclaw.json");
@@ -1186,6 +1330,7 @@ async function pollCycle() {
     ensureRealtimeAssignStarted(agentStates);
     ensureRealtimeConfigStarted(agentStates);
     ensureRealtimeKanbanStarted(agentStates);
+    ensureRealtimePluginContextStarted(agentStates);
     try {
       const spawnData = await api.post("/host/kanban/recurring/spawn");
       if (spawnData.spawned > 0) {
@@ -1396,7 +1541,23 @@ async function processAgent(agent, agentStates) {
       const fileNames = changedFiles.map((f) => f.relativePath).join(", ");
       log(`${verb} '${agent.code_name}': ${fileNames}`);
       for (const file of changedFiles) {
-        writeFileSync(join(agentDir, file.relativePath), file.content);
+        const filePath = join(agentDir, file.relativePath);
+        mkdirSync(dirname(filePath), { recursive: true });
+        writeFileSync(filePath, file.content);
+      }
+      try {
+        const provSkillsDir = join(agentDir, ".claude", "skills");
+        if (existsSync(provSkillsDir)) {
+          for (const folder of readdirSync(provSkillsDir)) {
+            if (folder.startsWith("knowledge-")) {
+              try {
+                rmSync(join(provSkillsDir, folder), { recursive: true });
+              } catch {
+              }
+            }
+          }
+        }
+      } catch {
       }
       lastProvisionAt = (/* @__PURE__ */ new Date()).toISOString();
       knownVersions.set(agent.agent_id, { charterVersion, toolsVersion });
@@ -1527,6 +1688,36 @@ async function processAgent(agent, agentStates) {
       }
     }
   }
+  const agentSessionMode = refreshData.agent.session_mode;
+  if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? "openclaw") === "claude-code") {
+    try {
+      const projectDir = join(homedir(), ".augmented", agent.code_name, "project");
+      mkdirSync(projectDir, { recursive: true });
+      const channelsPath = join(projectDir, ".mcp-channels.json");
+      let channelsMcp = { mcpServers: {} };
+      try {
+        channelsMcp = JSON.parse(readFileSync(channelsPath, "utf-8"));
+        if (!channelsMcp.mcpServers) channelsMcp.mcpServers = {};
+      } catch {
+      }
+      const localDirectChatChannel = join(homedir(), ".augmented", "_mcp", "direct-chat-channel.js");
+      if (existsSync(localDirectChatChannel) && !channelsMcp.mcpServers["direct-chat"]) {
+        channelsMcp.mcpServers["direct-chat"] = {
+          command: "node",
+          args: [localDirectChatChannel],
+          env: {
+            AGT_HOST: requireHost(),
+            AGT_API_KEY: getApiKey() ?? "",
+            AGT_AGENT_ID: agent.agent_id
+          }
+        };
+        writeFileSync(channelsPath, JSON.stringify(channelsMcp, null, 2));
+        log(`Channel credentials written for '${agent.code_name}/direct-chat'`);
+      }
+    } catch (err) {
+      log(`Failed to provision direct-chat channel for '${agent.code_name}': ${err.message}`);
+    }
+  }
   let lastSecretsProvisionAt = state.agents.find((a) => a.agentId === agent.agent_id)?.lastSecretsProvisionAt ?? null;
   let secretsHash = knownSecretsHashes.get(agent.agent_id) ?? null;
   try {
@@ -1604,7 +1795,7 @@ async function processAgent(agent, agentStates) {
             const expectedServerIds = /* @__PURE__ */ new Set();
             for (const tk of toolkitData.toolkits) {
               if (tk.agent_id !== agent.agent_id) continue;
-              const serverId = tk.toolkit_id.replace(/\//g, "-");
+              const serverId = tk.toolkit_id.replace(/[^a-z0-9]/gi, "_").toLowerCase();
               expectedServerIds.add(serverId);
               const mcpUrl = tk.mcp_url;
               const mcpHeaders = tk.mcp_headers;
@@ -1621,7 +1812,19 @@ async function processAgent(agent, agentStates) {
                 const mcpPath = join2(homedir2(), ".augmented", "agents", agent.code_name, "provision", ".mcp.json");
                 const mcpConfig = JSON.parse(readFileSync2(mcpPath, "utf-8"));
                 if (mcpConfig.mcpServers) {
-                  const managedPrefixes = ["composio-", "one-", "nango-", "paragon-"];
+                  const managedPrefixes = [
+                    "composio_",
+                    "one_",
+                    "pipedream_",
+                    "nango_",
+                    "paragon_",
+                    // Legacy hyphenated format
+                    "composio-",
+                    "one-",
+                    "pipedream-",
+                    "nango-",
+                    "paragon-"
+                  ];
                   for (const key of Object.keys(mcpConfig.mcpServers)) {
                     if (managedPrefixes.some((p) => key.startsWith(p)) && !expectedServerIds.has(key)) {
                       frameworkAdapter.removeMcpServer(agent.code_name, key);
@@ -1657,93 +1860,6 @@ async function processAgent(agent, agentStates) {
           }, delay);
         }
       }
-      const resolvedDefIds = new Set(integrations.map((i) => i.definition_id));
-      for (const capId of resolvedDefIds) {
-        try {
-          const capData = await api.post("/host/capability-skill", { definition_id: capId });
-          const allSatisfied = capData.requiredIntegrations.every((reqId) => resolvedDefIds.has(reqId));
-          if (!allSatisfied) {
-            const missing = capData.requiredIntegrations.filter((reqId) => !resolvedDefIds.has(reqId));
-            log(`Capability '${capId}' skipped \u2014 missing integration(s): ${missing.join(", ")}`);
-            continue;
-          }
-          const skillContent = JSON.stringify(capData.skills.map((s) => s.files.map((f) => `${f.relativePath}:${f.content}`)));
-          const skillHash = createHash("sha256").update(skillContent).digest("hex").slice(0, 16);
-          const skillKey = `${agent.agent_id}:${capId}`;
-          const prevSkillHash = knownSkillHashes.get(skillKey);
-          if (skillHash !== prevSkillHash) {
-            const installedSkillNames = [];
-            if (frameworkAdapter.installSkillFiles && capData.skills) {
-              for (const skill of capData.skills) {
-                if (skill.files.length > 0) {
-                  frameworkAdapter.installSkillFiles(agent.code_name, skill.id, skill.files);
-                  installedSkillNames.push(skill.name || skill.id);
-                  log(`Installed skill '${skill.id}' for '${agent.code_name}' (${skill.files.length} file(s))`);
-                }
-              }
-            }
-            knownSkillHashes.set(skillKey, skillHash);
-            const agentFw2 = agentFrameworkCache.get(agent.code_name) ?? "openclaw";
-            if (agentFw2 === "claude-code" && installedSkillNames.length > 0 && isSessionHealthy(agent.code_name)) {
-              const names = installedSkillNames.join(", ");
-              injectMessage(
-                agent.code_name,
-                "system",
-                `New skills installed: ${names}. These are available immediately \u2014 Claude Code loads skills on demand from .claude/skills/.`,
-                { task_name: "skill-update" },
-                log
-              ).catch(() => {
-              });
-              log(`[hot-reload] Notified '${agent.code_name}' about new skills: ${names}`);
-            }
-          }
-          const ALLOWED_CLI_PACKAGES = /* @__PURE__ */ new Set([
-            "xero-cli",
-            "@openapitools/openapi-generator-cli",
-            "gh",
-            "@schpet/linear-cli",
-            "@googleworkspace/cli",
-            "@tobilu/qmd"
-          ]);
-          if (intHash !== prevIntHash) {
-            const { execFileSync } = await import("child_process");
-            for (const tool of capData.cliTools) {
-              if (!ALLOWED_CLI_PACKAGES.has(tool.package)) {
-                log(`Skipping CLI tool '${tool.package}' for '${agent.code_name}' \u2014 not on the allowed packages list`);
-                continue;
-              }
-              try {
-                execFileSync("which", [tool.binary], { stdio: "ignore" });
-              } catch {
-                log(`Installing CLI tool '${tool.package}' for '${agent.code_name}'...`);
-                try {
-                  execFileSync("npm", ["install", "-g", tool.package], { stdio: "ignore", timeout: 6e4 });
-                  log(`CLI tool '${tool.binary}' installed successfully`);
-                } catch (installErr) {
-                  log(`Failed to install CLI tool '${tool.package}': ${installErr.message}`);
-                }
-              }
-              if (tool.binary === "qmd") {
-                try {
-                  const agentDir2 = join(process.env["HOME"] ?? "/tmp", ".augmented", agent.code_name);
-                  execFileSync("qmd", ["collection", "add", agent.code_name, "project"], {
-                    stdio: "ignore",
-                    timeout: 3e4,
-                    cwd: agentDir2
-                  });
-                  log(`QMD collection '${agent.code_name}' configured`);
-                } catch {
-                }
-              }
-            }
-          }
-        } catch (skillErr) {
-          const msg = skillErr.message ?? "";
-          if (!msg.includes("404") && !msg.includes("Unknown capability")) {
-            log(`Capability fetch failed for '${capId}': ${msg}`);
-          }
-        }
-      }
     }
   } catch (err) {
     log(`Integration provisioning failed for '${agent.code_name}': ${err.message}`);
@@ -1808,6 +1924,107 @@ async function processAgent(agent, agentStates) {
         log(`Kanban skill install failed for '${agent.code_name}': ${err.message}`);
       }
     }
+    if (frameworkAdapter.installSkillFiles) {
+      const currentPluginSkillIds = /* @__PURE__ */ new Set();
+      const installedPluginSkills = [];
+      const { createHash: createHash2 } = await import("crypto");
+      const contextBySlug = /* @__PURE__ */ new Map();
+      for (const ctx of refreshData.plugin_contexts ?? []) {
+        contextBySlug.set(ctx.plugin_slug, { values: ctx.values ?? {}, overrides: (ctx.overrides ?? "").trim() });
+      }
+      for (const ps of refreshData.plugin_skills ?? []) {
+        try {
+          const skillId = `plugin-${ps.plugin_slug}-${ps.skill_id}`.replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+          currentPluginSkillIds.add(skillId);
+          const ctx = contextBySlug.get(ps.plugin_slug);
+          const renderedContent = renderPluginSkillContent(
+            ps.content,
+            ctx?.values ?? {},
+            ctx?.overrides ?? "",
+            (warning) => log(`[plugin-context] ${ps.plugin_slug}/${ps.skill_id}: ${warning}`)
+          );
+          const contentHash = createHash2("sha256").update(renderedContent).digest("hex").slice(0, 12);
+          const hashKey = `plugin-skill:${agent.code_name}:${skillId}`;
+          if (knownSkillHashes.get(hashKey) === contentHash) continue;
+          frameworkAdapter.installSkillFiles(agent.code_name, skillId, [
+            { relativePath: "SKILL.md", content: renderedContent }
+          ]);
+          knownSkillHashes.set(hashKey, contentHash);
+          installedPluginSkills.push(ps.skill_name);
+          log(`Installed plugin skill '${skillId}' for '${agent.code_name}'`);
+        } catch (err) {
+          log(`Plugin skill install failed for '${agent.code_name}' / '${ps.skill_id}': ${err.message}`);
+        }
+      }
+      try {
+        const agentSkillsDir = join(config.configDir, agent.code_name, "project", ".claude", "skills");
+        if (existsSync(agentSkillsDir)) {
+          const { readdirSync: readdirSync2, rmSync: rmSync2 } = await import("fs");
+          for (const entry of readdirSync2(agentSkillsDir)) {
+            if (entry.startsWith("plugin-") && !currentPluginSkillIds.has(entry)) {
+              const orphanPath = join(agentSkillsDir, entry);
+              rmSync2(orphanPath, { recursive: true, force: true });
+              log(`Removed orphaned plugin skill '${entry}' for '${agent.code_name}'`);
+              const provisionSkillPath = join(config.configDir, agent.code_name, "skills", entry);
+              if (existsSync(provisionSkillPath)) {
+                rmSync2(provisionSkillPath, { recursive: true, force: true });
+              }
+            }
+          }
+        }
+      } catch (err) {
+        log(`Plugin skill cleanup failed for '${agent.code_name}': ${err.message}`);
+      }
+      try {
+        const agentFwForIndex = agentFrameworkCache.get(agent.code_name) ?? "openclaw";
+        if (agentFwForIndex === "claude-code") {
+          await refreshSkillsIndexInClaudeMd(config.configDir, agent.code_name, log);
+        }
+      } catch (err) {
+        log(`Skills index refresh failed for '${agent.code_name}': ${err.message}`);
+      }
+      if (frameworkAdapter.executePluginHook && refreshData.plugin_install_hooks?.length) {
+        for (const hook of refreshData.plugin_install_hooks) {
+          try {
+            const scriptHash = createHash2("sha256").update(hook.script).digest("hex").slice(0, 12);
+            const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${hook.plugin_slug}:on_install`;
+            if (knownSkillHashes.get(hookKey) === scriptHash) continue;
+            const result = await frameworkAdapter.executePluginHook({
+              codeName: agent.code_name,
+              pluginSlug: hook.plugin_slug,
+              hookName: "on_install",
+              script: hook.script
+            });
+            if (result.exitCode === 0) {
+              knownSkillHashes.set(hookKey, scriptHash);
+              log(`Plugin hook on_install '${hook.plugin_slug}' succeeded for '${agent.code_name}' (${result.durationMs}ms)`);
+            } else if (result.timedOut) {
+              log(`Plugin hook on_install '${hook.plugin_slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
+            } else {
+              const stderrHash = createHash2("sha256").update(result.stderr).digest("hex").slice(0, 12);
+              log(
+                `Plugin hook on_install '${hook.plugin_slug}' exited ${result.exitCode} for '${agent.code_name}' [stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
+              );
+            }
+          } catch (err) {
+            log(`Plugin hook on_install failed for '${agent.code_name}' / '${hook.plugin_slug}': ${err.message}`);
+          }
+        }
+      }
+      const agentFw2 = agentFrameworkCache.get(agent.code_name) ?? "openclaw";
+      if (agentFw2 === "claude-code" && installedPluginSkills.length > 0 && isSessionHealthy(agent.code_name)) {
+        const names = installedPluginSkills.join(", ");
+        injectMessage(
+          agent.code_name,
+          "system",
+          `New plugin skills installed: ${names}. These are available immediately \u2014 Claude Code loads skills on demand from .claude/skills/.`,
+          { task_name: "plugin-skill-update" },
+          log
+        ).catch(() => {
+        });
+        log(`[hot-reload] Notified '${agent.code_name}' about new plugin skills: ${names}`);
+      }
+    }
   }
   let boardItems = [];
   const hasBoardTemplates = tasks.some((t) => BOARD_INJECT_TEMPLATES.has(t.template_id));
@@ -2291,6 +2508,7 @@ async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
       } catch {
       }
     }
+    delete childEnv.ANTHROPIC_API_KEY;
     const { stdout, stderr } = await execFilePromiseLong("claude", claudeArgs, {
       cwd: projectDir,
       timeout: 3e5,
@@ -2318,6 +2536,14 @@ async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
   } catch (err) {
     const errMsg = err instanceof Error ? err.message : String(err);
     log(`[claude-scheduler] Task '${task.name}' failed for '${codeName}': ${errMsg}`);
+    if (err instanceof ChildProcessError) {
+      if (err.stdout.trim()) {
+        log(`[claude-scheduler] Task '${task.name}' stdout for '${codeName}': ${err.stdout.trim().slice(0, 1e3)}`);
+      }
+      if (err.stderr.trim()) {
+        log(`[claude-scheduler] Task '${task.name}' stderr for '${codeName}': ${err.stderr.trim().slice(0, 1e3)}`);
+      }
+    }
     const updated = markTaskFired(codeName, task.taskId, "error");
     claudeSchedulerStates.set(codeName, updated);
   }
@@ -2408,6 +2634,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       devChannels.push("server:slack");
     }
   }
+  devChannels.push("server:direct-chat");
   if (!agentRuntimeAuthenticated) {
     const { execFileSync } = await import("child_process");
     agentRuntimeAuthenticated = checkClaudeAuth(execFileSync);
@@ -2425,6 +2652,11 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
     } catch (err) {
       log(`[persistent-session] Failed to provision Stop hook for '${codeName}': ${err.message}`);
     }
+    try {
+      provisionIsolationHook(codeName);
+    } catch (err) {
+      log(`[persistent-session] Failed to provision isolation hook for '${codeName}': ${err.message}`);
+    }
     startPersistentSession({
       codeName,
       agentId: agent.agent_id,
@@ -2514,6 +2746,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
 var realtimeStarted = false;
 var realtimeDriftStarted = false;
 var realtimeKanbanStarted = false;
+var realtimePluginContextStarted = false;
 var realtimeAssignStarted = false;
 var realtimeConfigStarted = false;
 var realtimeSubscribedAgentIds = /* @__PURE__ */ new Set();
@@ -2532,6 +2765,7 @@ function ensureRealtimeStarted(agentStates) {
     realtimeAssignStarted = false;
     realtimeConfigStarted = false;
     realtimeKanbanStarted = false;
+    realtimePluginContextStarted = false;
   }
   const activeAgentIds = agentStates.filter((a) => a.status === "active").map((a) => a.agentId);
   if (activeAgentIds.length === 0) return;
@@ -2698,6 +2932,51 @@ function ensureRealtimeKanbanStarted(agentStates) {
     log(`[realtime] Kanban subscription failed: ${err.message}`);
   });
 }
+function ensureRealtimePluginContextStarted(agentStates) {
+  if (realtimePluginContextStarted) return;
+  const activeAgentIds = agentStates.filter((a) => a.status === "active").map((a) => a.agentId);
+  if (activeAgentIds.length === 0) return;
+  const apiKey = process.env["AGT_API_KEY"];
+  if (!apiKey) return;
+  void exchangeApiKey(apiKey).then((exchange) => {
+    if (!exchange.supabaseUrl || !exchange.supabaseAnonKey) return;
+    startRealtimePluginContext({
+      supabaseUrl: exchange.supabaseUrl,
+      supabaseAnonKey: exchange.supabaseAnonKey,
+      token: exchange.token,
+      agentIds: activeAgentIds,
+      onContextChange: (payload) => {
+        const agent = agentStates.find((a) => a.agentId === payload.agent_id);
+        if (agent) {
+          for (const key of knownSkillHashes.keys()) {
+            if (key.startsWith(`plugin-skill:${agent.codeName}:`)) {
+              knownSkillHashes.delete(key);
+            }
+          }
+        }
+        triggerEarlyPoll(`plugin context changed for agent ${payload.agent_id}`);
+      },
+      log
+    });
+    realtimePluginContextStarted = true;
+    log(`[realtime] Plugin context subscription started for ${activeAgentIds.length} agent(s)`);
+  }).catch((err) => {
+    log(`[realtime] Plugin context subscription failed: ${err.message}`);
+  });
+}
+function triggerEarlyPoll(reason) {
+  if (!running) return;
+  if (pollTimer) {
+    clearTimeout(pollTimer);
+    pollTimer = null;
+  }
+  log(`[realtime] Triggering early poll: ${reason}`);
+  pollTimer = setTimeout(() => {
+    void pollCycle().then(() => {
+      scheduleNext();
+    });
+  }, 0);
+}
 var directChatInFlight = /* @__PURE__ */ new Set();
 async function pollDirectChatMessages(agentStates) {
   for (const agent of agentStates) {
@@ -2768,6 +3047,7 @@ async function processDirectChatMessage(agent, msg) {
         } catch {
         }
       }
+      delete childEnv.ANTHROPIC_API_KEY;
       const { stdout } = await execFilePromiseLong("claude", chatArgs, { cwd: projDir, stdin: "ignore", env: childEnv });
       reply = stdout.trim() || "[No response from agent]";
     } else {
@@ -2801,7 +3081,7 @@ async function processDirectChatMessage(agent, msg) {
   } catch (err) {
     const errMsg = err instanceof Error ? err.message : String(err);
     const errorId = createHash("sha256").update(errMsg).digest("hex").slice(0, 12);
-    log(`[direct-chat] Failed to process message for '${agent.codeName}': error_id=${errorId}`);
+    log(`[direct-chat] Failed to process message for '${agent.codeName}': error_id=${errorId} error=${errMsg.slice(0, 500)}`);
     try {
       await api.post("/host/direct-chat/reply", {
         agent_id: agent.agentId,
@@ -3166,6 +3446,21 @@ async function execFilePromise(cmd, args) {
     });
   });
 }
+var ChildProcessError = class extends Error {
+  code;
+  stdout;
+  stderr;
+  constructor(code, stdout, stderr) {
+    const stderrSnippet = stderr.trim().slice(0, 500);
+    const stdoutSnippet = stdout.trim().slice(0, 500);
+    const detail = stderrSnippet || stdoutSnippet || "(no output)";
+    super(`Exit code ${code}: ${detail}`);
+    this.name = "ChildProcessError";
+    this.code = code;
+    this.stdout = stdout;
+    this.stderr = stderr;
+  }
+};
 async function execFilePromiseLong(cmd, args, opts) {
   const { spawn: sp } = await import("child_process");
   return new Promise((resolve, reject) => {
@@ -3188,7 +3483,7 @@ async function execFilePromiseLong(cmd, args, opts) {
     }, opts?.timeout ?? 12e4);
     child.on("close", (code) => {
       clearTimeout(timer);
-      if (code !== 0) reject(new Error(`Exit code ${code}: ${stderr.slice(0, 500)}`));
+      if (code !== 0) reject(new ChildProcessError(code, stdout, stderr));
       else resolve({ stdout, stderr });
     });
     child.on("error", (err) => {
@@ -3445,8 +3740,9 @@ function generateArtifacts(agent, refreshData, adapter) {
   const teamTimezoneRaw = refreshData.team?.timezone;
   const teamTimezone = typeof teamTimezoneRaw === "string" && teamTimezoneRaw.trim().length > 0 ? teamTimezoneRaw.trim() : void 0;
   const agentTimezone = (taskTimezones.length === 1 ? taskTimezones[0] : void 0) ?? teamTimezone ?? "UTC";
+  const agentPersonalitySeed = refreshData.agent.personality_seed;
   const orgDefaults = refreshData.model_defaults;
-  const personalitySeed = orgDefaults?.org?.settings?.personality_seed;
+  const personalitySeed = agentPersonalitySeed || orgDefaults?.org?.settings?.personality_seed;
   let reportsTo;
   const agentData = refreshData.agent;
   const reportsToId = agentData.reports_to;
@@ -3476,7 +3772,8 @@ function generateArtifacts(agent, refreshData, adapter) {
     team: refreshData.team ?? void 0,
     timezone: agentTimezone,
     reportsTo,
-    personalitySeed
+    personalitySeed,
+    knowledge: (refreshData.knowledge ?? []).filter((k) => !!k.content)
   };
   const provisionOutput = provision(provisionInput, adapter.id);
   return provisionOutput.artifacts;
@@ -3573,7 +3870,8 @@ function startPolling() {
   void startCaffeinate();
   log(`Starting poll loop (interval=${config.intervalMs}ms, configDir=${config.configDir})`);
   checkAndUpdateCli().catch((err) => log(`[self-update] Check failed: ${err.message}`));
-  void migrateToProfiles().then(() => {
+  void killAllAgtTmuxSessions().catch(() => {
+  }).then(() => migrateToProfiles()).then(() => {
     startGatewayPool();
     return pollCycle();
   }).then(() => {
@@ -3617,18 +3915,19 @@ async function stopPolling() {
     pollTimer = null;
   }
   const shutdownTimer = setTimeout(() => {
-    log("Shutdown timeout exceeded (5s), forcing exit");
+    log("Shutdown timeout exceeded (15s), forcing exit");
     process.exit(1);
-  }, 5e3);
+  }, 15e3);
   shutdownTimer.unref();
   stopCaffeinate();
   stopRealtimeChat();
   stopGatewayPool();
+  log("Killing tmux sessions...");
+  await killAllAgtTmuxSessions();
   log("Stopping persistent sessions...");
   await stopAllSessionsAndWait(log, { timeoutMs: 4e3 });
   log("Stopping gateway processes...");
   await stopAllGateways();
-  await killAllAgtTmuxSessions();
   clearTimeout(shutdownTimer);
 }
 function startManager(opts) {
@@ -3656,7 +3955,7 @@ function deployMcpAssets() {
     log("[manager] MCP assets not found in CLI package \u2014 skipping deployment");
     return;
   }
-  for (const file of ["index.js", "slack-channel.js"]) {
+  for (const file of ["index.js", "slack-channel.js", "direct-chat-channel.js"]) {
     const src = join(mcpSourceDir, file);
     const dst = join(targetDir, file);
     if (!existsSync(src)) continue;
@@ -3697,8 +3996,14 @@ function deployMcpAssets() {
 async function stopManager() {
   await stopPolling();
 }
+var shuttingDown = false;
 for (const sig of ["SIGTERM", "SIGINT"]) {
   process.on(sig, () => {
+    if (shuttingDown) {
+      log(`Received ${sig} again during shutdown \u2014 ignoring (cleanup in progress)`);
+      return;
+    }
+    shuttingDown = true;
     log(`Received ${sig}, shutting down`);
     void stopPolling().then(() => {
       process.exit(0);
@@ -3712,6 +4017,7 @@ process.on("disconnect", () => {
   });
 });
 export {
+  ChildProcessError,
   startManager,
   stopManager
 };