@integrity-labs/agt-cli 0.15.37 → 0.16.0

package/dist/{claude-pair-runtime-GLO2D7WP.js → claude-pair-runtime-GS6AOYHS.js}

@@ -180,7 +180,7 @@ async function startClaudePair(opts) {
       return {
         kind: "error",
         error: {
-          kind: "unknown",
+          kind: "oauth-retry-stuck",
           message: "claude is stuck on a previous failed-login retry prompt. SSH to the host and clear ~/.claude/.credentials.json (and any *.json next to it), then retry pair-via-browser."
         }
       };
@@ -318,4 +318,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-GLO2D7WP.js.map
+//# sourceMappingURL=claude-pair-runtime-GS6AOYHS.js.map

package/dist/claude-pair-runtime-GS6AOYHS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/claude-pair-runtime.ts","../src/lib/claude-pair-parser.ts"],"sourcesContent":["/**\n * ENG-4580: manager-side runtime for the Claude Code OAuth pairing flow.\n *\n * These functions own the actual tmux dance — sending `/login`,\n * polling the pane until Claude Code prints the OAuth URL, sending\n * the auth code, and detecting success/failure. They are the\n * counterpart to the pure parser in `claude-pair-parser.ts`.\n *\n * The API surface in ENG-4581 will wrap these — they don't include\n * any HTTP / DB code so the unit tests can target the parser layer\n * without spinning up a fake API. Errors are classified into the\n * `SessionError` shape so the API can translate them into structured\n * 4xx responses (e.g. `session_missing`).\n *\n * Architectural note: tmux capture-pane on a session that doesn't\n * exist exits non-zero with `can't find session`. Same goes for tmux\n * not being installed. classifyTmuxError covers both.\n */\n\nimport { execFile } from 'node:child_process';\nimport { promisify } from 'node:util';\n\nimport {\n  classifyTmuxError,\n  detectAuthOutcome,\n  extractOAuthUrl,\n  isUrlPromptReady,\n  type AuthOutcome,\n  type SessionError,\n} from './claude-pair-parser.js';\n\nconst execFileAsync = promisify(execFile);\n\n// Pair-scoped tmux session name. The pairing flow runs inside a\n// throwaway `claude` instance — never inside an agent's persistent\n// session — so first-time auth on a fresh host works (no chicken-and-\n// egg) and re-auth doesn't disrupt an in-flight agent conversation.\nexport function pairTmuxSession(pairId: string): string {\n  return `agt-pair-${pairId.slice(0, 12)}`;\n}\n\n// ---------------------------------------------------------------------------\n// Low-level helpers\n// ---------------------------------------------------------------------------\n\ninterface CapturePaneOpts {\n  /** How many lines of scrollback to include (negative = lines back). Default -200. */\n  scrollback?: number;\n}\n\nasync function capturePane(session: string, opts: CapturePaneOpts = {}): Promise<string> {\n  const scrollback = opts.scrollback ?? -200;\n  const { stdout } = await execFileAsync('tmux', [\n    'capture-pane',\n    '-t',\n    session,\n    '-p',\n    '-S',\n    String(scrollback),\n  ]);\n  return stdout;\n}\n\nasync function sendKeys(session: string, ...keys: string[]): Promise<void> {\n  await execFileAsync('tmux', ['send-keys', '-t', session, ...keys]);\n}\n\nasync function sleep(ms: number): Promise<void> {\n  return new Promise((r) => setTimeout(r, ms));\n}\n\n// ---------------------------------------------------------------------------\n// Pair-scoped tmux session lifecycle\n// ---------------------------------------------------------------------------\n\n/**\n * Spawn a throwaway tmux session running `claude` for the pairing flow.\n * Idempotent — if the session already exists, returns success silently.\n * Caller is responsible for `killPairSession` once the pair reaches a\n * terminal state.\n *\n * Uses an absolute path to the claude binary so we don't depend on the\n * inherited PATH (the manager runs with cloud-init's minimal env on\n * EC2). resolveClaudeBinary checks CLAUDE_PATH, then `which`, then\n * canonical Linux/macOS Homebrew install dirs.\n */\nexport async function spawnPairSession(session: string): Promise<{ ok: true } | { ok: false; error: SessionError }> {\n  try {\n    await execFileAsync('tmux', ['has-session', '-t', session]);\n    return { ok: true };\n  } catch {\n    // session doesn't exist yet — fall through to create it\n  }\n\n  const { resolveClaudeBinary } = await import('./persistent-session.js');\n  const claudeBin = resolveClaudeBinary();\n\n  try {\n    // -x 240 -y 50 — wide enough that Claude Code's OAuth URL (~350\n    // chars after PKCE expansion) doesn't soft-wrap. The dewrap pass in\n    // extractOAuthUrl handles any leftover wrapping, but giving the URL\n    // a single line in the first place is more robust against future\n    // claude UI changes.\n    await execFileAsync('tmux', [\n      'new-session',\n      '-d',\n      '-x',\n      '240',\n      '-y',\n      '50',\n      '-s',\n      session,\n      claudeBin,\n    ]);\n  } catch (err) {\n    return { ok: false, error: classifyTmuxError(err) };\n  }\n\n  // `tmux new-session` returns 0 even if the command exited immediately\n  // (binary missing, claude crashed, etc.) — the session is created and\n  // then torn down. Without this verification we'd propagate a generic\n  // `session_missing` to the operator on the next has-session call,\n  // hiding the real failure. Sleep briefly to give claude a beat to\n  // crash-or-stay-alive, then check.\n  await sleep(500);\n  try {\n    await execFileAsync('tmux', ['has-session', '-t', session]);\n  } catch {\n    return {\n      ok: false,\n      error: {\n        kind: 'unknown',\n        message: `claude exited immediately after launch (binary at ${claudeBin}). Run \\`${claudeBin}\\` manually on the host to see why — likely missing TTY, missing HOME, or a startup error.`,\n      },\n    };\n  }\n  return { ok: true };\n}\n\n/**\n * Returns true if the session is gone afterwards (either kill succeeded\n * or it was already missing). Returns false only if `kill-session`\n * failed for a non-missing-session reason — caller should treat this\n * as \"still tracked, will retry next poll\".\n */\nexport async function killPairSession(session: string): Promise<boolean> {\n  try {\n    await execFileAsync('tmux', ['kill-session', '-t', session]);\n    return true;\n  } catch (err) {\n    // \"can't find session\" is success-equivalent — the desired end state\n    // is \"this session does not exist\" and that's already true.\n    if (classifyTmuxError(err).kind === 'no-session') return true;\n    return false;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Result shapes\n// ---------------------------------------------------------------------------\n\nexport type ClaudePairStartResult =\n  | { kind: 'url'; url: string }\n  | { kind: 'timeout' }\n  | { kind: 'error'; error: SessionError };\n\nexport type ClaudePairSubmitResult =\n  | { kind: 'success'; rawMatch: string }\n  | { kind: 'failure'; rawMatch: string }\n  | { kind: 'timeout' }\n  | { kind: 'error'; error: SessionError };\n\nexport type ClaudePairStatusResult =\n  | { kind: 'idle' }\n  | { kind: 'awaiting-code'; url: string }\n  | { kind: 'success' }\n  | { kind: 'failure'; rawMatch: string }\n  | { kind: 'session-missing' }\n  | { kind: 'error'; error: SessionError };\n\n// ---------------------------------------------------------------------------\n// start — send `/login`, wait for the OAuth URL prompt\n// ---------------------------------------------------------------------------\n\nexport interface ClaudePairStartOpts {\n  /** Pair-scoped tmux session name (see pairTmuxSession). */\n  session: string;\n  /** Total time to wait for Claude Code to print the URL prompt. Default 60s. */\n  timeoutMs?: number;\n  /** How often to re-capture and check the pane. Default 500ms. */\n  pollIntervalMs?: number;\n}\n\nexport async function startClaudePair(opts: ClaudePairStartOpts): Promise<ClaudePairStartResult> {\n  const { session } = opts;\n  // Pair sessions cold-start `claude` from scratch — first-run on a fresh\n  // host can take 10-30s before the prompt is interactive enough to\n  // accept `/login`. Stay generous.\n  const timeoutMs = opts.timeoutMs ?? 60_000;\n  const pollIntervalMs = opts.pollIntervalMs ?? 500;\n\n  // Quick precheck — fail fast if the tmux session doesn't exist\n  // rather than blasting `/login` into an unrelated pane.\n  try {\n    await execFileAsync('tmux', ['has-session', '-t', session]);\n  } catch (err) {\n    return { kind: 'error', error: classifyTmuxError(err) };\n  }\n\n  // Drive claude through its first-run onboarding to reach a state\n  // where the OAuth URL is on screen. Possible paths:\n  //\n  //  • Fresh host: theme picker → \"Trust folder?\" → login method picker\n  //    (option 1 = Claude subscription, already highlighted) → OAuth URL.\n  //    No `/login` needed — option 1 IS the login.\n  //  • Already onboarded: regular prompt → we send `/login` ourselves →\n  //    login method picker → OAuth URL.\n  //\n  // Auto-advance every onboarding screen we recognize. Keep going until\n  // we either see the URL prompt or hit the deadline.\n  const onboardingDeadline = Date.now() + Math.min(45_000, timeoutMs);\n  let lastDispatchAt = 0;\n  let loginCommandSent = false;\n  const dispatchEnter = async (): Promise<void> => {\n    if (Date.now() - lastDispatchAt < 1_500) return;\n    lastDispatchAt = Date.now();\n    try { await sendKeys(session, 'C-m'); } catch { /* keep polling */ }\n  };\n\n  while (Date.now() < onboardingDeadline) {\n    await sleep(pollIntervalMs);\n    let pane: string;\n    try {\n      // VIEWPORT ONLY (no scrollback). With scrollback included, the\n      // theme picker / login picker text lingers in the buffer after\n      // claude advances to the URL-paste prompt. The match would then\n      // dispatch Enter on the empty paste field — submitting an empty\n      // code and triggering \"OAuth error: Invalid code\". Visible-only\n      // capture ensures we only react to what's actually on screen.\n      pane = await capturePane(session, { scrollback: 0 });\n    } catch (err) {\n      return { kind: 'error', error: classifyTmuxError(err) };\n    }\n\n    // Already at the URL prompt — done driving onboarding, fall through\n    // to the URL-extraction loop below.\n    if (isUrlPromptReady(pane)) {\n      const url = extractOAuthUrl(pane);\n      if (url) return { kind: 'url', url };\n    }\n\n    // Stuck on \"OAuth error: Invalid code. Press Enter to retry\" — usually\n    // because claude has cached partial state from a previous failed login\n    // attempt on this host. Pressing Enter would just resubmit the bad\n    // code and loop forever, so bail with an actionable error.\n    //\n    // Capture WITH scrollback for this check: claude's TUI sometimes\n    // re-renders the splash/banner over the OAuth error so the viewport\n    // alone misses it (we'd then time out instead of giving the operator\n    // an actionable error). OAuth-retry is a sticky state — claude waits\n    // for input — so checking recent scrollback is safe; a false positive\n    // from stale scrollback would only fire if a previous attempt actually\n    // failed, in which case bailing is the right call.\n    let scrollPane = pane;\n    try {\n      scrollPane = await capturePane(session, { scrollback: -50 });\n    } catch { /* fall back to viewport-only check */ }\n    const hasOAuthInvalidCode = /OAuth error[\\s\\S]*Invalid code/i.test(scrollPane);\n    const hasOAuthRetryPrompt = /OAuth error/i.test(scrollPane) && /Press Enter to retry/i.test(scrollPane);\n    if (hasOAuthInvalidCode || hasOAuthRetryPrompt) {\n      return {\n        kind: 'error',\n        error: {\n          kind: 'oauth-retry-stuck',\n          message:\n            'claude is stuck on a previous failed-login retry prompt. SSH to the host and clear ~/.claude/.credentials.json (and any *.json next to it), then retry pair-via-browser.',\n        },\n      };\n    }\n\n    // Login method picker — option 1 (Claude subscription) is already\n    // highlighted, Enter selects it.\n    if (/Select login method:/i.test(pane)) {\n      await dispatchEnter();\n      continue;\n    }\n    // First-run theme picker. Accept the highlighted default; operator\n    // can change it later via /theme.\n    if (/\\bDark mode\\b/.test(pane) && /\\bLight mode\\b/.test(pane)) {\n      await dispatchEnter();\n      continue;\n    }\n    // \"Trust this folder?\" — Enter accepts the default (Yes).\n    if (/Do you trust the files in this folder\\?/i.test(pane)) {\n      await dispatchEnter();\n      continue;\n    }\n    // Onboarding \"Press Enter to continue\" splashes.\n    if (/press\\s+enter\\s+to\\s+continue/i.test(pane)) {\n      await dispatchEnter();\n      continue;\n    }\n    // Regular interactive prompt — this means claude was already\n    // onboarded. Send `/login` once to surface the login picker, then\n    // the next iteration handles it via the picker branch above.\n    const promptVisible =\n      /[│|]\\s*>\\s/.test(pane) || /Try .+ to .+/.test(pane) || /^\\s*>\\s*$/m.test(pane);\n    if (promptVisible && !loginCommandSent) {\n      loginCommandSent = true;\n      try {\n        await sendKeys(session, '/login', 'C-m');\n      } catch (err) {\n        return { kind: 'error', error: classifyTmuxError(err) };\n      }\n      continue;\n    }\n  }\n\n  // Onboarding deadline hit without seeing a URL — surface the pane so\n  // operators can see what was on screen when we gave up.\n  let lastPane = '';\n  try { lastPane = await capturePane(session); } catch { /* best-effort */ }\n  return {\n    kind: 'error',\n    error: {\n      kind: 'unknown',\n      message: `claude never reached OAuth URL prompt within ${timeoutMs}ms. Last pane: ${lastPane.slice(-500)}`,\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// submit-code — paste the auth code, wait for outcome\n// ---------------------------------------------------------------------------\n\nexport interface ClaudePairSubmitOpts {\n  /** Pair-scoped tmux session name (see pairTmuxSession). */\n  session: string;\n  code: string;\n  /** Total time to wait for the success/failure marker. Default 30s. */\n  timeoutMs?: number;\n  pollIntervalMs?: number;\n}\n\nexport async function submitClaudePairCode(\n  opts: ClaudePairSubmitOpts,\n): Promise<ClaudePairSubmitResult> {\n  const { session } = opts;\n  const timeoutMs = opts.timeoutMs ?? 30_000;\n  const pollIntervalMs = opts.pollIntervalMs ?? 500;\n\n  // Validate code shape minimally — Claude Code's auth codes are\n  // alphanumeric with dashes, ~40-80 chars. Accept anything within\n  // that envelope; reject blank or whitespace-only to avoid\n  // accidentally submitting an empty buffer.\n  if (!opts.code || !opts.code.trim()) {\n    return {\n      kind: 'error',\n      error: { kind: 'unknown', message: 'empty auth code' },\n    };\n  }\n  if (opts.code.length > 1024) {\n    return {\n      kind: 'error',\n      error: { kind: 'unknown', message: 'auth code suspiciously long' },\n    };\n  }\n\n  // Send the code + Enter. We use the literal value as one send-keys\n  // argument; tmux handles spaces fine, but newlines would terminate\n  // early so reject those as well.\n  if (/[\\r\\n]/.test(opts.code)) {\n    return {\n      kind: 'error',\n      error: { kind: 'unknown', message: 'auth code contains newline' },\n    };\n  }\n\n  // Send the code as LITERAL text (-l) so tmux doesn't try to interpret\n  // any chars as key tokens. Then a 250ms breather so claude's\n  // ink/React render loop finishes processing the paste before Enter\n  // lands. Without that wait the Enter often gets swallowed mid-render\n  // and the code stays in the input box unsubmitted.\n  try {\n    await execFileAsync('tmux', ['send-keys', '-t', session, '-l', opts.code.trim()]);\n  } catch (err) {\n    return { kind: 'error', error: classifyTmuxError(err) };\n  }\n  await sleep(250);\n  try {\n    // Use Enter (semantic) plus a fallback C-m on the next iteration if\n    // claude still hasn't moved.\n    await sendKeys(session, 'Enter');\n  } catch (err) {\n    return { kind: 'error', error: classifyTmuxError(err) };\n  }\n\n  const deadline = Date.now() + timeoutMs;\n  let enterRetried = false;\n  let lastPane = '';\n  while (Date.now() < deadline) {\n    await sleep(pollIntervalMs);\n    try {\n      lastPane = await capturePane(session);\n    } catch (err) {\n      return { kind: 'error', error: classifyTmuxError(err) };\n    }\n    const outcome: AuthOutcome = detectAuthOutcome(lastPane);\n    if (outcome.kind === 'success') return { kind: 'success', rawMatch: outcome.rawMatch };\n    if (outcome.kind === 'failure') return { kind: 'failure', rawMatch: outcome.rawMatch };\n\n    // After ~5s with no outcome, retry Enter once — covers the case\n    // where the first Enter landed mid-render and claude swallowed it.\n    // The \"Paste code here\" prompt is still on screen if submission\n    // didn't take; if it advanced, we'd already have an outcome above.\n    if (!enterRetried && Date.now() - (deadline - timeoutMs) > 5_000 && /Paste code here/i.test(lastPane)) {\n      enterRetried = true;\n      try { await sendKeys(session, 'C-m'); } catch { /* keep polling */ }\n    }\n  }\n  // Include pane snippet in the error path so operators can see what\n  // claude was actually showing — outcome detection is brittle and the\n  // session is killed immediately after this returns, so this is our\n  // only chance to capture state for debugging regex updates.\n  return {\n    kind: 'error',\n    error: {\n      kind: 'unknown',\n      message: `submit timed out after ${timeoutMs}ms — outcome regex didn't match. Last pane: ${lastPane.slice(-600)}`,\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// status — non-mutating peek at the pane state\n// ---------------------------------------------------------------------------\n\nexport async function getClaudePairStatus(session: string): Promise<ClaudePairStatusResult> {\n  try {\n    await execFileAsync('tmux', ['has-session', '-t', session]);\n  } catch (err) {\n    const classified = classifyTmuxError(err);\n    if (classified.kind === 'no-session') return { kind: 'session-missing' };\n    return { kind: 'error', error: classified };\n  }\n\n  let pane: string;\n  try {\n    pane = await capturePane(session);\n  } catch (err) {\n    return { kind: 'error', error: classifyTmuxError(err) };\n  }\n\n  // Outcome takes priority — if the pane already shows success/failure\n  // from a recent submission, the API can short-circuit without\n  // restarting the flow.\n  const outcome = detectAuthOutcome(pane);\n  if (outcome.kind === 'success') return { kind: 'success' };\n  if (outcome.kind === 'failure') return { kind: 'failure', rawMatch: outcome.rawMatch };\n\n  if (isUrlPromptReady(pane)) {\n    const url = extractOAuthUrl(pane);\n    if (url) return { kind: 'awaiting-code', url };\n  }\n  return { kind: 'idle' };\n}\n","/**\n * ENG-4580: pane-scrape parser for Claude Code's `/login` OAuth flow.\n *\n * The manager drives the flow by sending `/login` into the agent's\n * persistent tmux session, capturing the pane after a short poll, and\n * extracting the OAuth URL Claude Code prints. After the operator\n * pastes the auth code via the UI, the manager sends it back into the\n * pane and polls for a success / failure marker.\n *\n * Everything in this module is pure — no tmux calls, no fs I/O. The\n * runtime side (apps/cli/src/lib/manager-worker.ts) shells out and\n * feeds the captured pane string through these functions.\n *\n * Why a dedicated module: pane scraping is fragile across Claude Code\n * versions, terminal widths, and locale changes. Centralising the\n * regexes + the ANSI stripper makes them easy to fixture-test and\n * iterate on without touching the runtime path.\n */\n\n// ---------------------------------------------------------------------------\n// ANSI escape sequence stripper\n// ---------------------------------------------------------------------------\n\n/**\n * Strip the ANSI escape sequences a terminal emits for colour, cursor\n * movement, screen clears, and bracketed paste mode. The pattern below\n * covers:\n *\n *   - CSI sequences: `ESC [ ... <final byte>` where the final byte is\n *     in the 0x40-0x7E range (covers SGR colour, cursor-position,\n *     erase-in-line/display, etc.)\n *   - OSC sequences: `ESC ] ... BEL` or `ESC ] ... ESC \\` (used for\n *     window titles and hyperlinks)\n *   - Single-character `ESC <char>` two-byte escapes (e.g. `ESC =`,\n *     `ESC >`, the `ESC c` reset)\n *\n * We keep newlines and printable text intact so pane content remains\n * matchable after stripping.\n *\n * The regex uses Unicode-friendly character classes; we explicitly\n * avoid `\\x1b` named escapes in source to keep the file ASCII-safe.\n */\nconst ANSI_ESC = String.fromCharCode(0x1b);\nconst ANSI_BEL = String.fromCharCode(0x07);\n\nconst CSI_RE = new RegExp(`${ANSI_ESC}\\\\[[0-?]*[ -/]*[@-~]`, 'g');\nconst OSC_RE = new RegExp(\n  `${ANSI_ESC}\\\\][^${ANSI_BEL}${ANSI_ESC}]*(?:${ANSI_BEL}|${ANSI_ESC}\\\\\\\\)`,\n  'g',\n);\nconst TWO_BYTE_RE = new RegExp(`${ANSI_ESC}[=>cM78]`, 'g');\n\nexport function stripAnsi(text: string): string {\n  return text.replace(CSI_RE, '').replace(OSC_RE, '').replace(TWO_BYTE_RE, '');\n}\n\n// ---------------------------------------------------------------------------\n// OAuth URL extraction\n// ---------------------------------------------------------------------------\n\n/**\n * Anchored to Anthropic-owned domains that Claude Code's `/login`\n * actually prints. Adding more hosts is fine — keep them allowlisted\n * rather than matching arbitrary `https://` to avoid pulling random\n * URLs from the user's previous shell output.\n *\n * Note: Claude Code currently emits URLs at `claude.com/cai/oauth/...`\n * (the consumer-facing domain), but `claude.ai` and the console hosts\n * have appeared historically and are kept here for tolerance.\n */\nconst OAUTH_URL_RE =\n  /https:\\/\\/(?:claude\\.com|claude\\.ai|platform\\.claude\\.com|console\\.anthropic\\.com|auth\\.anthropic\\.com)\\/[^\\s)\\]]*/;\n\n/**\n * Strip ANSI + reassemble URLs that were soft-wrapped across terminal\n * lines. tmux capture-pane emits hard newlines for wrapped lines, and\n * Claude Code's OAuth URL routinely runs >300 chars — much wider than\n * the manager's default tmux window. Iteratively strip newlines that\n * fall inside what looks like a URL until convergence (a single URL\n * can wrap 5+ times).\n *\n * Shared between extractOAuthUrl and isUrlPromptReady so the readiness\n * check sees the same string the extractor would.\n */\nfunction dewrapPane(rawPane: string): string {\n  const stripped = stripAnsi(rawPane);\n  let dewrapped = stripped;\n  let prev = '';\n  while (prev !== dewrapped) {\n    prev = dewrapped;\n    dewrapped = dewrapped.replace(/(https?:\\/\\/\\S+?)\\n(?=\\S)/, (_m, head: string) => head);\n  }\n  return dewrapped;\n}\n\nexport function extractOAuthUrl(rawPane: string): string | null {\n  const match = OAUTH_URL_RE.exec(dewrapPane(rawPane));\n  if (!match) return null;\n  // Trim trailing punctuation that often clings to URLs in TUIs.\n  return match[0].replace(/[.,;:!?]+$/, '');\n}\n\n// ---------------------------------------------------------------------------\n// Prompt readiness — \"we've printed the URL, now waiting for a code\"\n// ---------------------------------------------------------------------------\n\nconst URL_PROMPT_RE =\n  /(?:Paste code here|Paste your code|Enter (?:the )?code|Authorization code)/i;\n\nexport function isUrlPromptReady(rawPane: string): boolean {\n  const dewrapped = dewrapPane(rawPane);\n  // Both anchors must be present: the URL itself AND the paste-code\n  // prompt. The prompt alone could appear during a stale screen redraw;\n  // the URL alone could be a stray match in command history. Use the\n  // dewrapped pane so a wrapped URL still matches OAUTH_URL_RE.\n  return OAUTH_URL_RE.test(dewrapped) && URL_PROMPT_RE.test(dewrapped);\n}\n\n// ---------------------------------------------------------------------------\n// Outcome detection after submitting the code\n// ---------------------------------------------------------------------------\n\n// Claude Code's success/failure copy has drifted across versions\n// (\"Logged in\" → \"Login successful\" → \"Signed in as ...\" → etc.).\n// Keep the alternations broad-but-specific — phrases that only appear\n// after a real auth roundtrip, never in welcome / tutorial text.\n// \"Welcome back\" was tried and rejected: it shows up in onboarding\n// help blurbs and produced false positives.\nconst SUCCESS_RE =\n  /(?:Logged in|Login successful|Successfully (?:logged in|authenticated|signed in)|Authentication successful|Sign-?in (?:complete|successful)|You(?:'|’)?re signed in|Signed in as)/i;\nconst FAILURE_RE =\n  /(?:Invalid (?:code|authorization code)|OAuth error|Authentication failed|Error (?:logging in|during authentication)|Login failed|Sign-?in failed|Failed to (?:authenticate|sign in|log in))/i;\n\nexport type AuthOutcome =\n  | { kind: 'success'; rawMatch: string }\n  | { kind: 'failure'; rawMatch: string }\n  | { kind: 'pending' };\n\nexport function detectAuthOutcome(rawPane: string): AuthOutcome {\n  const stripped = stripAnsi(rawPane);\n  // Failure first — Claude Code sometimes prints a stale \"logged in\" from\n  // a previous successful session above the new failure banner. The\n  // most-recent line wins, so we scan from the end of the pane.\n  const failureMatch = lastMatch(stripped, FAILURE_RE);\n  const successMatch = lastMatch(stripped, SUCCESS_RE);\n\n  if (failureMatch && successMatch) {\n    // Whichever is later on the pane is the live state.\n    if (failureMatch.index > successMatch.index) {\n      return { kind: 'failure', rawMatch: failureMatch.match };\n    }\n    return { kind: 'success', rawMatch: successMatch.match };\n  }\n  if (failureMatch) return { kind: 'failure', rawMatch: failureMatch.match };\n  if (successMatch) return { kind: 'success', rawMatch: successMatch.match };\n  return { kind: 'pending' };\n}\n\nfunction lastMatch(haystack: string, re: RegExp): { match: string; index: number } | null {\n  // Construct a sticky/global variant if needed. Most of our REs are\n  // anchored to small phrases; iterating with a `g`-flagged RegExp is\n  // cheap and correct.\n  const globalRe = new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`);\n  let last: RegExpExecArray | null = null;\n  let m: RegExpExecArray | null;\n  while ((m = globalRe.exec(haystack)) !== null) {\n    last = m;\n    // Prevent zero-length matches from looping.\n    if (m.index === globalRe.lastIndex) globalRe.lastIndex++;\n  }\n  return last ? { match: last[0], index: last.index } : null;\n}\n\n// ---------------------------------------------------------------------------\n// \"Session not running / tmux missing\" — surface as a structured signal\n// ---------------------------------------------------------------------------\n\n/**\n * The runtime path will throw when `tmux capture-pane` fails. This\n * helper classifies the failure for the API layer so the UI can show\n * \"start a session first\" rather than a generic 500.\n */\nexport type SessionError =\n  | { kind: 'no-session' }\n  | { kind: 'tmux-missing' }\n  | { kind: 'pane-empty' }\n  /** Claude is sitting on the \"OAuth error: Invalid code. Press Enter to\n   *  retry.\" prompt from a previous failed login — pressing Enter would\n   *  resubmit the bad code, so the runtime bails with operator-actionable\n   *  guidance instead. Distinct from `unknown` so telemetry / UI can\n   *  surface a specific message rather than a generic 500. */\n  | { kind: 'oauth-retry-stuck'; message: string }\n  | { kind: 'unknown'; message: string };\n\nexport function classifyTmuxError(err: unknown): SessionError {\n  const msg = err instanceof Error ? err.message : String(err);\n  if (/can't find session|no server running/i.test(msg)) return { kind: 'no-session' };\n  if (/command not found.*tmux|ENOENT.*tmux/i.test(msg)) return { kind: 'tmux-missing' };\n  return { kind: 'unknown', message: msg };\n}\n"],"mappings":";AAmBA,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;;;ACsB1B,IAAM,WAAW,OAAO,aAAa,EAAI;AACzC,IAAM,WAAW,OAAO,aAAa,CAAI;AAEzC,IAAM,SAAS,IAAI,OAAO,GAAG,QAAQ,wBAAwB,GAAG;AAChE,IAAM,SAAS,IAAI;AAAA,EACjB,GAAG,QAAQ,QAAQ,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,IAAI,QAAQ;AAAA,EAClE;AACF;AACA,IAAM,cAAc,IAAI,OAAO,GAAG,QAAQ,YAAY,GAAG;AAElD,SAAS,UAAU,MAAsB;AAC9C,SAAO,KAAK,QAAQ,QAAQ,EAAE,EAAE,QAAQ,QAAQ,EAAE,EAAE,QAAQ,aAAa,EAAE;AAC7E;AAgBA,IAAM,eACJ;AAaF,SAAS,WAAW,SAAyB;AAC3C,QAAM,WAAW,UAAU,OAAO;AAClC,MAAI,YAAY;AAChB,MAAI,OAAO;AACX,SAAO,SAAS,WAAW;AACzB,WAAO;AACP,gBAAY,UAAU,QAAQ,6BAA6B,CAAC,IAAI,SAAiB,IAAI;AAAA,EACvF;AACA,SAAO;AACT;AAEO,SAAS,gBAAgB,SAAgC;AAC9D,QAAM,QAAQ,aAAa,KAAK,WAAW,OAAO,CAAC;AACnD,MAAI,CAAC,MAAO,QAAO;AAEnB,SAAO,MAAM,CAAC,EAAE,QAAQ,cAAc,EAAE;AAC1C;AAMA,IAAM,gBACJ;AAEK,SAAS,iBAAiB,SAA0B;AACzD,QAAM,YAAY,WAAW,OAAO;AAKpC,SAAO,aAAa,KAAK,SAAS,KAAK,cAAc,KAAK,SAAS;AACrE;AAYA,IAAM,aACJ;AACF,IAAM,aACJ;AAOK,SAAS,kBAAkB,SAA8B;AAC9D,QAAM,WAAW,UAAU,OAAO;AAIlC,QAAM,eAAe,UAAU,UAAU,UAAU;AACnD,QAAM,eAAe,UAAU,UAAU,UAAU;AAEnD,MAAI,gBAAgB,cAAc;AAEhC,QAAI,aAAa,QAAQ,aAAa,OAAO;AAC3C,aAAO,EAAE,MAAM,WAAW,UAAU,aAAa,MAAM;AAAA,IACzD;AACA,WAAO,EAAE,MAAM,WAAW,UAAU,aAAa,MAAM;AAAA,EACzD;AACA,MAAI,aAAc,QAAO,EAAE,MAAM,WAAW,UAAU,aAAa,MAAM;AACzE,MAAI,aAAc,QAAO,EAAE,MAAM,WAAW,UAAU,aAAa,MAAM;AACzE,SAAO,EAAE,MAAM,UAAU;AAC3B;AAEA,SAAS,UAAU,UAAkB,IAAqD;AAIxF,QAAM,WAAW,IAAI,OAAO,GAAG,QAAQ,GAAG,MAAM,SAAS,GAAG,IAAI,GAAG,QAAQ,GAAG,GAAG,KAAK,GAAG;AACzF,MAAI,OAA+B;AACnC,MAAI;AACJ,UAAQ,IAAI,SAAS,KAAK,QAAQ,OAAO,MAAM;AAC7C,WAAO;AAEP,QAAI,EAAE,UAAU,SAAS,UAAW,UAAS;AAAA,EAC/C;AACA,SAAO,OAAO,EAAE,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,MAAM,IAAI;AACxD;AAuBO,SAAS,kBAAkB,KAA4B;AAC5D,QAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,MAAI,wCAAwC,KAAK,GAAG,EAAG,QAAO,EAAE,MAAM,aAAa;AACnF,MAAI,wCAAwC,KAAK,GAAG,EAAG,QAAO,EAAE,MAAM,eAAe;AACrF,SAAO,EAAE,MAAM,WAAW,SAAS,IAAI;AACzC;;;ADxKA,IAAM,gBAAgB,UAAU,QAAQ;AAMjC,SAAS,gBAAgB,QAAwB;AACtD,SAAO,YAAY,OAAO,MAAM,GAAG,EAAE,CAAC;AACxC;AAWA,eAAe,YAAY,SAAiB,OAAwB,CAAC,GAAoB;AACvF,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,EAAE,OAAO,IAAI,MAAM,cAAc,QAAQ;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,UAAU;AAAA,EACnB,CAAC;AACD,SAAO;AACT;AAEA,eAAe,SAAS,YAAoB,MAA+B;AACzE,QAAM,cAAc,QAAQ,CAAC,aAAa,MAAM,SAAS,GAAG,IAAI,CAAC;AACnE;AAEA,eAAe,MAAM,IAA2B;AAC9C,SAAO,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC7C;AAiBA,eAAsB,iBAAiB,SAA6E;AAClH,MAAI;AACF,UAAM,cAAc,QAAQ,CAAC,eAAe,MAAM,OAAO,CAAC;AAC1D,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB,QAAQ;AAAA,EAER;AAEA,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,kCAAyB;AACtE,QAAM,YAAY,oBAAoB;AAEtC,MAAI;AAMF,UAAM,cAAc,QAAQ;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE;AAAA,EACpD;AAQA,QAAM,MAAM,GAAG;AACf,MAAI;AACF,UAAM,cAAc,QAAQ,CAAC,eAAe,MAAM,OAAO,CAAC;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,qDAAqD,SAAS,YAAY,SAAS;AAAA,MAC9F;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;AAQA,eAAsB,gBAAgB,SAAmC;AACvE,MAAI;AACF,UAAM,cAAc,QAAQ,CAAC,gBAAgB,MAAM,OAAO,CAAC;AAC3D,WAAO;AAAA,EACT,SAAS,KAAK;AAGZ,QAAI,kBAAkB,GAAG,EAAE,SAAS,aAAc,QAAO;AACzD,WAAO;AAAA,EACT;AACF;AAsCA,eAAsB,gBAAgB,MAA2D;AAC/F,QAAM,EAAE,QAAQ,IAAI;AAIpB,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,iBAAiB,KAAK,kBAAkB;AAI9C,MAAI;AACF,UAAM,cAAc,QAAQ,CAAC,eAAe,MAAM,OAAO,CAAC;AAAA,EAC5D,SAAS,KAAK;AACZ,WAAO,EAAE,MAAM,SAAS,OAAO,kBAAkB,GAAG,EAAE;AAAA,EACxD;AAaA,QAAM,qBAAqB,KAAK,IAAI,IAAI,KAAK,IAAI,MAAQ,SAAS;AAClE,MAAI,iBAAiB;AACrB,MAAI,mBAAmB;AACvB,QAAM,gBAAgB,YAA2B;AAC/C,QAAI,KAAK,IAAI,IAAI,iBAAiB,KAAO;AACzC,qBAAiB,KAAK,IAAI;AAC1B,QAAI;AAAE,YAAM,SAAS,SAAS,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAqB;AAAA,EACrE;AAEA,SAAO,KAAK,IAAI,IAAI,oBAAoB;AACtC,UAAM,MAAM,cAAc;AAC1B,QAAI;AACJ,QAAI;AAOF,aAAO,MAAM,YAAY,SAAS,EAAE,YAAY,EAAE,CAAC;AAAA,IACrD,SAAS,KAAK;AACZ,aAAO,EAAE,MAAM,SAAS,OAAO,kBAAkB,GAAG,EAAE;AAAA,IACxD;AAIA,QAAI,iBAAiB,IAAI,GAAG;AAC1B,YAAM,MAAM,gBAAgB,IAAI;AAChC,UAAI,IAAK,QAAO,EAAE,MAAM,OAAO,IAAI;AAAA,IACrC;AAcA,QAAI,aAAa;AACjB,QAAI;AACF,mBAAa,MAAM,YAAY,SAAS,EAAE,YAAY,IAAI,CAAC;AAAA,IAC7D,QAAQ;AAAA,IAAyC;AACjD,UAAM,sBAAsB,kCAAkC,KAAK,UAAU;AAC7E,UAAM,sBAAsB,eAAe,KAAK,UAAU,KAAK,wBAAwB,KAAK,UAAU;AACtG,QAAI,uBAAuB,qBAAqB;AAC9C,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SACE;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAIA,QAAI,wBAAwB,KAAK,IAAI,GAAG;AACtC,YAAM,cAAc;AACpB;AAAA,IACF;AAGA,QAAI,gBAAgB,KAAK,IAAI,KAAK,iBAAiB,KAAK,IAAI,GAAG;AAC7D,YAAM,cAAc;AACpB;AAAA,IACF;AAEA,QAAI,2CAA2C,KAAK,IAAI,GAAG;AACzD,YAAM,cAAc;AACpB;AAAA,IACF;AAEA,QAAI,iCAAiC,KAAK,IAAI,GAAG;AAC/C,YAAM,cAAc;AACpB;AAAA,IACF;AAIA,UAAM,gBACJ,aAAa,KAAK,IAAI,KAAK,eAAe,KAAK,IAAI,KAAK,aAAa,KAAK,IAAI;AAChF,QAAI,iBAAiB,CAAC,kBAAkB;AACtC,yBAAmB;AACnB,UAAI;AACF,cAAM,SAAS,SAAS,UAAU,KAAK;AAAA,MACzC,SAAS,KAAK;AACZ,eAAO,EAAE,MAAM,SAAS,OAAO,kBAAkB,GAAG,EAAE;AAAA,MACxD;AACA;AAAA,IACF;AAAA,EACF;AAIA,MAAI,WAAW;AACf,MAAI;AAAE,eAAW,MAAM,YAAY,OAAO;AAAA,EAAG,QAAQ;AAAA,EAAoB;AACzE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,gDAAgD,SAAS,kBAAkB,SAAS,MAAM,IAAI,CAAC;AAAA,IAC1G;AAAA,EACF;AACF;AAeA,eAAsB,qBACpB,MACiC;AACjC,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,iBAAiB,KAAK,kBAAkB;AAM9C,MAAI,CAAC,KAAK,QAAQ,CAAC,KAAK,KAAK,KAAK,GAAG;AACnC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO,EAAE,MAAM,WAAW,SAAS,kBAAkB;AAAA,IACvD;AAAA,EACF;AACA,MAAI,KAAK,KAAK,SAAS,MAAM;AAC3B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO,EAAE,MAAM,WAAW,SAAS,8BAA8B;AAAA,IACnE;AAAA,EACF;AAKA,MAAI,SAAS,KAAK,KAAK,IAAI,GAAG;AAC5B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO,EAAE,MAAM,WAAW,SAAS,6BAA6B;AAAA,IAClE;AAAA,EACF;AAOA,MAAI;AACF,UAAM,cAAc,QAAQ,CAAC,aAAa,MAAM,SAAS,MAAM,KAAK,KAAK,KAAK,CAAC,CAAC;AAAA,EAClF,SAAS,KAAK;AACZ,WAAO,EAAE,MAAM,SAAS,OAAO,kBAAkB,GAAG,EAAE;AAAA,EACxD;AACA,QAAM,MAAM,GAAG;AACf,MAAI;AAGF,UAAM,SAAS,SAAS,OAAO;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,EAAE,MAAM,SAAS,OAAO,kBAAkB,GAAG,EAAE;AAAA,EACxD;AAEA,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,MAAI,eAAe;AACnB,MAAI,WAAW;AACf,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,UAAM,MAAM,cAAc;AAC1B,QAAI;AACF,iBAAW,MAAM,YAAY,OAAO;AAAA,IACtC,SAAS,KAAK;AACZ,aAAO,EAAE,MAAM,SAAS,OAAO,kBAAkB,GAAG,EAAE;AAAA,IACxD;AACA,UAAM,UAAuB,kBAAkB,QAAQ;AACvD,QAAI,QAAQ,SAAS,UAAW,QAAO,EAAE,MAAM,WAAW,UAAU,QAAQ,SAAS;AACrF,QAAI,QAAQ,SAAS,UAAW,QAAO,EAAE,MAAM,WAAW,UAAU,QAAQ,SAAS;AAMrF,QAAI,CAAC,gBAAgB,KAAK,IAAI,KAAK,WAAW,aAAa,OAAS,mBAAmB,KAAK,QAAQ,GAAG;AACrG,qBAAe;AACf,UAAI;AAAE,cAAM,SAAS,SAAS,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAqB;AAAA,IACrE;AAAA,EACF;AAKA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,0BAA0B,SAAS,oDAA+C,SAAS,MAAM,IAAI,CAAC;AAAA,IACjH;AAAA,EACF;AACF;AAMA,eAAsB,oBAAoB,SAAkD;AAC1F,MAAI;AACF,UAAM,cAAc,QAAQ,CAAC,eAAe,MAAM,OAAO,CAAC;AAAA,EAC5D,SAAS,KAAK;AACZ,UAAM,aAAa,kBAAkB,GAAG;AACxC,QAAI,WAAW,SAAS,aAAc,QAAO,EAAE,MAAM,kBAAkB;AACvE,WAAO,EAAE,MAAM,SAAS,OAAO,WAAW;AAAA,EAC5C;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,YAAY,OAAO;AAAA,EAClC,SAAS,KAAK;AACZ,WAAO,EAAE,MAAM,SAAS,OAAO,kBAAkB,GAAG,EAAE;AAAA,EACxD;AAKA,QAAM,UAAU,kBAAkB,IAAI;AACtC,MAAI,QAAQ,SAAS,UAAW,QAAO,EAAE,MAAM,UAAU;AACzD,MAAI,QAAQ,SAAS,UAAW,QAAO,EAAE,MAAM,WAAW,UAAU,QAAQ,SAAS;AAErF,MAAI,iBAAiB,IAAI,GAAG;AAC1B,UAAM,MAAM,gBAAgB,IAAI;AAChC,QAAI,IAAK,QAAO,EAAE,MAAM,iBAAiB,IAAI;AAAA,EAC/C;AACA,SAAO,EAAE,MAAM,OAAO;AACxB;","names":[]}

package/dist/lib/manager-worker.js

@@ -22,7 +22,7 @@ import {
   resolveChannels,
   resolveDmTarget,
   wrapScheduledTaskPrompt
-} from "../chunk-XB7IGF3K.js";
+} from "../chunk-LU6L2J32.js";
 import {
   findTaskByTemplate,
   getProjectDir,
@@ -53,7 +53,7 @@ import { join as join3, dirname } from "path";
 import { homedir as homedir3 } from "os";
 import { fileURLToPath } from "url";
 
-// src/lib/plugin-context-render.ts
+// src/lib/integration-context-render.ts
 var PLUGIN_CONTEXT_PLACEHOLDER_RE = /\{\{\s*context\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
 var TEAM_OVERRIDES_HEADER = "## Team Overrides\n\n> **The following overrides anything you've read above.** If any rule here conflicts with earlier instructions in this skill, follow what is written here. These are user-supplied directives that take precedence over the plugin's default guidance.\n";
 function formatContextValue(value) {
@@ -66,7 +66,7 @@ function formatContextValue(value) {
     return "";
   }
 }
-function renderPluginSkillContent(raw, values, overrides, warn = () => {
+function renderIntegrationSkillContent(raw, values, overrides, warn = () => {
 }) {
   const substituted = raw.replace(PLUGIN_CONTEXT_PLACEHOLDER_RE, (_match, fieldName) => {
     if (!(fieldName in values)) {
@@ -85,7 +85,7 @@ ${trimmedOverrides}
 `;
 }
 
-// src/lib/plugin-skill-layout.ts
+// src/lib/integration-skill-layout.ts
 function extractDescription(content) {
   const match = content.match(/^---\s*([\s\S]*?)---/);
   if (!match) return null;
@@ -98,20 +98,20 @@ function extractDescription(content) {
   }
   return descMatch[2]?.trim() ?? null;
 }
-function sanitizeScopeSlug(skillId, pluginSlug) {
+function sanitizeScopeSlug(skillId, integrationSlug) {
   const normalized = skillId.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-");
-  const prefix = pluginSlug.replace(/-/g, "");
+  const prefix = integrationSlug.replace(/-/g, "");
   const stripped = normalized.startsWith(`${prefix}-`) ? normalized.slice(prefix.length + 1) : normalized;
   return stripped.replace(/^-|-$/g, "") || normalized || "scope";
 }
-function buildPluginBundle(skills) {
+function buildIntegrationBundle(skills) {
   if (skills.length === 0) {
-    throw new Error("buildPluginBundle: empty skills list");
+    throw new Error("buildIntegrationBundle: empty skills list");
   }
-  const pluginSlug = skills[0].plugin_slug;
+  const integrationSlug = skills[0].plugin_slug;
   const ordered = [...skills].sort((a, b) => a.skill_id.localeCompare(b.skill_id));
   const entries = ordered.map((s) => {
-    const scopeSlug = sanitizeScopeSlug(s.skill_id, pluginSlug);
+    const scopeSlug = sanitizeScopeSlug(s.skill_id, integrationSlug);
     const description = extractDescription(s.content);
     return {
       skillId: s.skill_id,
@@ -132,11 +132,11 @@ function buildPluginBundle(skills) {
     if (group.length > 1) {
       const conflicts = group.map((e) => `${e.skillId} (${e.skillName})`).join(", ");
       throw new Error(
-        `buildPluginBundle: duplicate scope path '${scopePath}' for plugin '${pluginSlug}' \u2014 conflicting skills: ${conflicts}`
+        `buildIntegrationBundle: duplicate scope path '${scopePath}' for integration '${integrationSlug}' \u2014 conflicting skills: ${conflicts}`
       );
     }
   }
-  const pluginName = slugToTitle(pluginSlug);
+  const integrationName = slugToTitle(integrationSlug);
   const umbrellaDescription = entries.map((e) => e.description ?? `Use for ${e.skillName}.`).join(" ");
   const scopeList = entries.map((e) => {
     const label = e.skillName || slugToTitle(e.scopeSlug);
@@ -145,13 +145,13 @@ function buildPluginBundle(skills) {
   }).join("\n");
   const umbrella = [
     "---",
-    `name: "${pluginName}"`,
+    `name: "${integrationName}"`,
     `description: "${escapeYamlDouble(umbrellaDescription)}"`,
     "---",
     "",
-    `# ${pluginName}`,
+    `# ${integrationName}`,
     "",
-    `This skill bundles ${entries.length === 1 ? "one scope" : `${entries.length} scopes`} for the ${pluginSlug} plugin. Each scope has a dedicated reference under \`scopes/\` that you should load on demand when the user's intent maps to it.`,
+    `This skill bundles ${entries.length === 1 ? "one scope" : `${entries.length} scopes`} for the ${integrationSlug} integration. Each scope has a dedicated reference under \`scopes/\` that you should load on demand when the user's intent maps to it.`,
     "",
     "## Scopes",
     "",
@@ -170,7 +170,7 @@ function buildPluginBundle(skills) {
     }))
   ];
   return {
-    pluginSlug,
+    integrationSlug,
     files,
     scopePaths: entries.map((e) => e.scopePath)
   };
@@ -181,7 +181,7 @@ function slugToTitle(slug) {
 function escapeYamlDouble(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
-function groupSkillsByPlugin(skills) {
+function groupSkillsByIntegration(skills) {
   const map = /* @__PURE__ */ new Map();
   for (const s of skills) {
     const bucket = map.get(s.plugin_slug);
@@ -1033,7 +1033,7 @@ var driftChannel = null;
 var assignChannel = null;
 var configChannel = null;
 var kanbanChannel = null;
-var pluginContextChannel = null;
+var integrationContextChannel = null;
 var connected = false;
 var tearingDown = false;
 function ensureClient(config2) {
@@ -1078,7 +1078,7 @@ function startRealtimeChat(config2) {
       assignChannel = null;
       configChannel = null;
       kanbanChannel = null;
-      pluginContextChannel = null;
+      integrationContextChannel = null;
       if (client) {
         try {
           client.removeAllChannels();
@@ -1251,12 +1251,12 @@ function startRealtimeKanban(config2) {
   log2(`[realtime] Subscribing to agent_kanban_items for ${agentIds.length} agent(s)`);
   void formatActorId;
 }
-function startRealtimePluginContext(config2) {
+function startRealtimeIntegrationContext(config2) {
   const { agentIds, onContextChange, log: log2 } = config2;
   if (agentIds.length === 0) return;
   const sb = ensureClient(config2);
   const filterStr = agentIds.length === 1 ? `agent_id=eq.${agentIds[0]}` : `agent_id=in.(${agentIds.join(",")})`;
-  pluginContextChannel = sb.channel("plugin-context-realtime").on("postgres_changes", {
+  integrationContextChannel = sb.channel("plugin-context-realtime").on("postgres_changes", {
     event: "INSERT",
     schema: "public",
     table: "plugin_context",
@@ -1276,9 +1276,9 @@ function startRealtimePluginContext(config2) {
     onContextChange(row);
   }).subscribe((status) => {
     if (status === "SUBSCRIBED") {
-      log2("[realtime] Plugin context channel connected");
+      log2("[realtime] Integration context channel connected");
     } else if (status === "CLOSED" || status === "CHANNEL_ERROR") {
-      log2(`[realtime] Plugin context channel: ${status}`);
+      log2(`[realtime] Integration context channel: ${status}`);
     }
   });
   log2(`[realtime] Subscribing to plugin_context for ${agentIds.length} agent(s)`);
@@ -1325,12 +1325,12 @@ function stopRealtimeChat() {
       }
       kanbanChannel = null;
     }
-    if (pluginContextChannel) {
+    if (integrationContextChannel) {
       try {
-        pluginContextChannel.unsubscribe();
+        integrationContextChannel.unsubscribe();
       } catch {
       }
-      pluginContextChannel = null;
+      integrationContextChannel = null;
     }
     if (client) {
       try {
@@ -1435,15 +1435,21 @@ function clearAgentCaches(agentId, codeName) {
 var cachedFrameworkVersion = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
-var agtCliVersion = true ? "0.15.37" : "dev";
+var agtCliVersion = true ? "0.16.0" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
     if (out) return out;
   } catch {
   }
-  const fallback = "/home/linuxbrew/.linuxbrew/bin/brew";
-  if (existsSync2(fallback)) return fallback;
+  const fallbacks = [
+    "/home/linuxbrew/.linuxbrew/bin/brew",
+    "/opt/homebrew/bin/brew",
+    "/usr/local/bin/brew"
+  ];
+  for (const path of fallbacks) {
+    if (existsSync2(path)) return path;
+  }
   return null;
 }
 var toolkitCliEnsured = /* @__PURE__ */ new Set();
@@ -1656,44 +1662,51 @@ var UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var selfUpdateUpToDateLogged = false;
 var restartAfterUpgrade = false;
 var pendingUpgradeVersion = null;
+var selfUpdateInFlight = false;
 async function checkAndUpdateCli() {
-  const cliPath = process.argv[1] ?? "";
-  const isDevMode = cliPath.includes("/src/") || cliPath.includes("tsx");
-  if (isDevMode) return;
-  let resolvedPath = cliPath;
-  try {
-    const { realpathSync } = await import("fs");
-    resolvedPath = realpathSync(cliPath);
-  } catch {
-  }
-  const isBrewFormula = /\/Cellar\/[^/]+\//.test(resolvedPath);
-  const isNpmGlobal = !isBrewFormula && resolvedPath.includes("node_modules");
-  if (!isBrewFormula && !isNpmGlobal) return;
-  const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
-  const markerPath = join3(homedir3(), ".augmented", ".last-update-check");
-  try {
-    const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
-    if (Date.now() - lastCheck < UPDATE_CHECK_INTERVAL_MS) return;
-  } catch {
-  }
-  if (isBrewFormula) {
-    await checkAndUpdateCliViaBrew();
-  } else {
-    await checkAndUpdateCliViaNpm();
-  }
+  if (selfUpdateInFlight) return;
+  selfUpdateInFlight = true;
   try {
-    writeF(markerPath, String(Date.now()));
-  } catch {
+    const cliPath = process.argv[1] ?? "";
+    const isDevMode = cliPath.includes("/src/") || cliPath.includes("tsx");
+    if (isDevMode) return;
+    let resolvedPath = cliPath;
+    try {
+      const { realpathSync } = await import("fs");
+      resolvedPath = realpathSync(cliPath);
+    } catch {
+    }
+    const isBrewFormula = /\/Cellar\/[^/]+\//.test(resolvedPath);
+    const isNpmGlobal = !isBrewFormula && resolvedPath.includes("node_modules");
+    if (!isBrewFormula && !isNpmGlobal) return;
+    const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
+    const markerPath = join3(homedir3(), ".augmented", ".last-update-check");
+    try {
+      const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
+      if (Date.now() - lastCheck < UPDATE_CHECK_INTERVAL_MS) return;
+    } catch {
+    }
+    try {
+      writeF(markerPath, String(Date.now()));
+    } catch {
+    }
+    if (isBrewFormula) {
+      await checkAndUpdateCliViaBrew();
+    } else {
+      await checkAndUpdateCliViaNpm();
+    }
+    try {
+      writeF(markerPath, String(Date.now()));
+    } catch {
+    }
+  } finally {
+    selfUpdateInFlight = false;
   }
 }
 async function checkAndUpdateCliViaBrew() {
   const { execFileSync: execFileSync2 } = await import("child_process");
-  let brewPath;
-  try {
-    brewPath = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
-  } catch {
-    return;
-  }
+  const brewPath = resolveBrewPath(execFileSync2);
+  if (!brewPath) return;
   try {
     execFileSync2(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
   } catch (err) {
@@ -2442,7 +2455,7 @@ async function pollCycle() {
     ensureRealtimeAssignStarted(agentStates);
     ensureRealtimeConfigStarted(agentStates);
     ensureRealtimeKanbanStarted(agentStates);
-    ensureRealtimePluginContextStarted(agentStates);
+    ensureRealtimeIntegrationContextStarted(agentStates);
     try {
       const spawnData = await api.post("/host/kanban/recurring/spawn");
       if (spawnData.spawned > 0) {
@@ -3123,42 +3136,46 @@ async function processAgent(agent, agentStates) {
       }
     }
     if (frameworkAdapter.installSkillFiles) {
-      const currentPluginSkillIds = /* @__PURE__ */ new Set();
-      const installedPluginSkills = [];
+      const currentIntegrationSkillIds = /* @__PURE__ */ new Set();
+      const installedIntegrationSkills = [];
       const { createHash: createHash2 } = await import("crypto");
+      const refreshAny = refreshData;
+      const contexts = refreshAny.integration_contexts ?? refreshAny.plugin_contexts ?? [];
       const contextBySlug = /* @__PURE__ */ new Map();
-      for (const ctx of refreshData.plugin_contexts ?? []) {
-        contextBySlug.set(ctx.plugin_slug, { values: ctx.values ?? {}, overrides: (ctx.overrides ?? "").trim() });
+      for (const ctx of contexts) {
+        const slug = ctx.integration_slug ?? ctx.plugin_slug;
+        if (!slug) continue;
+        contextBySlug.set(slug, { values: ctx.values ?? {}, overrides: (ctx.overrides ?? "").trim() });
       }
-      const pluginGroups = groupSkillsByPlugin(
-        refreshData.plugin_skills ?? []
+      const integrationGroups = groupSkillsByIntegration(
+        refreshAny.integration_skills ?? refreshAny.plugin_skills ?? []
       );
-      for (const [pluginSlug, scopes] of pluginGroups) {
+      for (const [integrationSlug, scopes] of integrationGroups) {
         try {
-          const pluginSkillId = `integration-${pluginSlug}`.replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
-          currentPluginSkillIds.add(pluginSkillId);
-          const ctx = contextBySlug.get(pluginSlug);
+          const integrationSkillId = `integration-${integrationSlug}`.replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+          currentIntegrationSkillIds.add(integrationSkillId);
+          const ctx = contextBySlug.get(integrationSlug);
           const renderedScopes = scopes.map((s) => ({
             plugin_slug: s.plugin_slug,
             skill_id: s.skill_id,
             skill_name: s.skill_name,
-            content: renderPluginSkillContent(
+            content: renderIntegrationSkillContent(
               s.content,
               ctx?.values ?? {},
               ctx?.overrides ?? "",
               (warning) => log(`[plugin-context] ${s.plugin_slug}/${s.skill_id}: ${warning}`)
             )
           }));
-          const bundle = buildPluginBundle(renderedScopes);
+          const bundle = buildIntegrationBundle(renderedScopes);
           const contentHash = createHash2("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
-          const hashKey = `plugin-skill:${agent.agent_id}:${pluginSkillId}`;
+          const hashKey = `plugin-skill:${agent.agent_id}:${integrationSkillId}`;
           if (knownSkillHashes.get(hashKey) === contentHash) continue;
-          frameworkAdapter.installSkillFiles(agent.code_name, pluginSkillId, bundle.files);
+          frameworkAdapter.installSkillFiles(agent.code_name, integrationSkillId, bundle.files);
           knownSkillHashes.set(hashKey, contentHash);
-          for (const s of scopes) installedPluginSkills.push(s.skill_name);
-          log(`Installed plugin '${pluginSkillId}' for '${agent.code_name}' (${scopes.length} scope(s))`);
+          for (const s of scopes) installedIntegrationSkills.push(s.skill_name);
+          log(`Installed integration skill bundle '${integrationSkillId}' for '${agent.code_name}' (${scopes.length} scope(s))`);
         } catch (err) {
-          log(`Plugin install failed for '${agent.code_name}' / '${pluginSlug}': ${err.message}`);
+          log(`Integration skill install failed for '${agent.code_name}' / '${integrationSlug}': ${err.message}`);
         }
       }
       try {
@@ -3198,12 +3215,12 @@ async function processAgent(agent, agentStates) {
           log(`Removed ${reason} '${entry}' for '${agent.code_name}' (framework=${frameworkId2})`);
         };
         for (const entry of discoveredEntries) {
-          if (!currentPluginSkillIds.has(entry)) {
+          if (!currentIntegrationSkillIds.has(entry)) {
             removeSkillFolder(entry, "orphaned skill folder");
           }
         }
       } catch (err) {
-        log(`Plugin skill cleanup failed for '${agent.code_name}': ${err.message}`);
+        log(`Integration skill cleanup failed for '${agent.code_name}': ${err.message}`);
       }
       try {
         const agentFwForIndex = agentFrameworkCache.get(agent.code_name) ?? "openclaw";
@@ -3213,40 +3230,44 @@ async function processAgent(agent, agentStates) {
       } catch (err) {
         log(`Skills index refresh failed for '${agent.code_name}': ${err.message}`);
       }
-      if (frameworkAdapter.executePluginHook && refreshData.plugin_install_hooks?.length) {
-        for (const hook of refreshData.plugin_install_hooks) {
+      const installHooks = refreshAny.integration_install_hooks ?? refreshAny.plugin_install_hooks ?? [];
+      if (frameworkAdapter.executePluginHook && installHooks.length) {
+        for (const hook of installHooks) {
+          const slug = hook.integration_slug ?? hook.plugin_slug;
+          if (!slug) continue;
           try {
             const scriptHash = createHash2("sha256").update(hook.script).digest("hex").slice(0, 12);
-            const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${hook.plugin_slug}:on_install`;
+            const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${slug}:on_install`;
             if (knownSkillHashes.get(hookKey) === scriptHash) continue;
             const result = await frameworkAdapter.executePluginHook({
               codeName: agent.code_name,
-              pluginSlug: hook.plugin_slug,
+              pluginSlug: slug,
               hookName: "on_install",
               script: hook.script
             });
             if (result.exitCode === 0) {
               knownSkillHashes.set(hookKey, scriptHash);
-              log(`Plugin hook on_install '${hook.plugin_slug}' succeeded for '${agent.code_name}' (${result.durationMs}ms)`);
+              log(`Integration hook on_install '${slug}' succeeded for '${agent.code_name}' (${result.durationMs}ms)`);
             } else if (result.timedOut) {
-              log(`Plugin hook on_install '${hook.plugin_slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
+              log(`Integration hook on_install '${slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
             } else {
               const stderrHash = createHash2("sha256").update(result.stderr).digest("hex").slice(0, 12);
               const missingCmd = result.exitCode === 127 ? extractCommandNotFound(result.stderr) : null;
               const missingCmdHash = missingCmd ? createHash2("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
               log(
-                `Plugin hook on_install '${hook.plugin_slug}' exited ${result.exitCode} for '${agent.code_name}' ` + (missingCmdHash ? `[missing_command_hash=${missingCmdHash}] ` : "") + `[stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
+                `Integration hook on_install '${slug}' exited ${result.exitCode} for '${agent.code_name}' ` + (missingCmdHash ? `[missing_command_hash=${missingCmdHash}] ` : "") + `[stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
               );
             }
           } catch (err) {
-            log(`Plugin hook on_install failed for '${agent.code_name}' / '${hook.plugin_slug}': ${err.message}`);
+            log(`Integration hook on_install failed for '${agent.code_name}' / '${slug}': ${err.message}`);
           }
         }
       }
       const agentFwForToolkits = agentFrameworkCache.get(agent.code_name) ?? "openclaw";
-      if (agentFwForToolkits === "claude-code" && refreshData.plugin_toolkits?.length) {
+      const toolkitsList = refreshAny.integration_toolkits ?? refreshAny.plugin_toolkits ?? [];
+      if (agentFwForToolkits === "claude-code" && toolkitsList.length) {
         const toolkitUnion = /* @__PURE__ */ new Set();
-        for (const { toolkits } of refreshData.plugin_toolkits) {
+        for (const { toolkits } of toolkitsList) {
           for (const t of toolkits) toolkitUnion.add(t);
         }
         for (const toolkitSlug of toolkitUnion) {
@@ -3254,17 +3275,17 @@ async function processAgent(agent, agentStates) {
         }
       }
       const agentFw2 = agentFrameworkCache.get(agent.code_name) ?? "openclaw";
-      if (agentFw2 === "claude-code" && installedPluginSkills.length > 0 && isSessionHealthy(agent.code_name)) {
-        const names = installedPluginSkills.join(", ");
+      if (agentFw2 === "claude-code" && installedIntegrationSkills.length > 0 && isSessionHealthy(agent.code_name)) {
+        const names = installedIntegrationSkills.join(", ");
         injectMessage(
           agent.code_name,
           "system",
-          `New plugin skills installed: ${names}. These are available immediately \u2014 Claude Code loads skills on demand from .claude/skills/.`,
+          `New integration skills installed: ${names}. These are available immediately \u2014 Claude Code loads skills on demand from .claude/skills/.`,
           { task_name: "plugin-skill-update" },
           log
         ).catch(() => {
         });
-        log(`[hot-reload] Notified '${agent.code_name}' about new plugin skills: ${names}`);
+        log(`[hot-reload] Notified '${agent.code_name}' about new integration skills: ${names}`);
       }
     }
   }
@@ -4155,7 +4176,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
 var realtimeStarted = false;
 var realtimeDriftStarted = false;
 var realtimeKanbanStarted = false;
-var realtimePluginContextStarted = false;
+var realtimeIntegrationContextStarted = false;
 var realtimeAssignStarted = false;
 var realtimeConfigStarted = false;
 var realtimeSubscribedAgentIds = /* @__PURE__ */ new Set();
@@ -4174,7 +4195,7 @@ function ensureRealtimeStarted(agentStates) {
     realtimeAssignStarted = false;
     realtimeConfigStarted = false;
     realtimeKanbanStarted = false;
-    realtimePluginContextStarted = false;
+    realtimeIntegrationContextStarted = false;
   }
   const activeAgentIds = agentStates.filter((a) => a.status === "active").map((a) => a.agentId);
   if (activeAgentIds.length === 0) return;
@@ -4214,6 +4235,7 @@ function ensureRealtimeStarted(agentStates) {
           realtimeAssignStarted = false;
           realtimeConfigStarted = false;
           realtimeKanbanStarted = false;
+          realtimeIntegrationContextStarted = false;
         }
       },
       log
@@ -4353,15 +4375,15 @@ function ensureRealtimeKanbanStarted(agentStates) {
     log(`[realtime] Kanban subscription failed: ${err.message}`);
   });
 }
-function ensureRealtimePluginContextStarted(agentStates) {
-  if (realtimePluginContextStarted) return;
+function ensureRealtimeIntegrationContextStarted(agentStates) {
+  if (realtimeIntegrationContextStarted) return;
   const activeAgentIds = agentStates.filter((a) => a.status === "active").map((a) => a.agentId);
   if (activeAgentIds.length === 0) return;
   const apiKey = process.env["AGT_API_KEY"];
   if (!apiKey) return;
   void exchangeApiKey(apiKey).then((exchange) => {
     if (!exchange.supabaseUrl || !exchange.supabaseAnonKey) return;
-    startRealtimePluginContext({
+    startRealtimeIntegrationContext({
       supabaseUrl: exchange.supabaseUrl,
       supabaseAnonKey: exchange.supabaseAnonKey,
       token: exchange.token,
@@ -4375,14 +4397,14 @@ function ensureRealtimePluginContextStarted(agentStates) {
             }
           }
         }
-        triggerEarlyPoll(`plugin context changed for agent ${payload.agent_id}`);
+        triggerEarlyPoll(`integration context changed for agent ${payload.agent_id}`);
       },
       log
     });
-    realtimePluginContextStarted = true;
-    log(`[realtime] Plugin context subscription started for ${activeAgentIds.length} agent(s)`);
+    realtimeIntegrationContextStarted = true;
+    log(`[realtime] Integration context subscription started for ${activeAgentIds.length} agent(s)`);
   }).catch((err) => {
-    log(`[realtime] Plugin context subscription failed: ${err.message}`);
+    log(`[realtime] Integration context subscription failed: ${err.message}`);
   });
 }
 function triggerEarlyPoll(reason) {
@@ -5353,7 +5375,7 @@ async function processClaudePairSessions(agents) {
     spawnPairSession,
     killPairSession,
     pairTmuxSession
-  } = await import("../claude-pair-runtime-GLO2D7WP.js");
+  } = await import("../claude-pair-runtime-GS6AOYHS.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -5414,10 +5436,11 @@ async function processClaudePairSessions(agents) {
           });
         } else {
           const errKind = result.error.kind;
+          const errMessage = "message" in result.error ? result.error.message : void 0;
           await reportAndCleanup(session.pair_id, {
             status: errKind === "no-session" ? "session_missing" : "failure",
             error_code: errKind,
-            error_message: errKind === "unknown" ? result.error.message : void 0
+            error_message: errMessage
           });
         }
       } else if (session.status === "code_submitted" && session.code) {
@@ -5442,10 +5465,11 @@ async function processClaudePairSessions(agents) {
           });
         } else {
           const errKind = result.error.kind;
+          const errMessage = "message" in result.error ? result.error.message : void 0;
           await reportAndCleanup(session.pair_id, {
             status: errKind === "no-session" ? "session_missing" : "failure",
             error_code: errKind,
-            error_message: errKind === "unknown" ? result.error.message : void 0
+            error_message: errMessage
           });
         }
       }