@integrity-labs/agt-cli 0.19.13 → 0.19.15

package/dist/{claude-pair-runtime-SJDLJNYF.js → claude-pair-runtime-UF4OMFCA.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-XBRQN7XE.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-M2GVL6Z6.js");
   const claudeBin = resolveClaudeBinary();
   try {
     await execFileAsync("tmux", [
@@ -357,4 +357,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-SJDLJNYF.js.map
+//# sourceMappingURL=claude-pair-runtime-UF4OMFCA.js.map

package/dist/lib/manager-worker.js

@@ -22,7 +22,7 @@ import {
   resolveChannels,
   resolveDmTarget,
   wrapScheduledTaskPrompt
-} from "../chunk-SUUTWC6M.js";
+} from "../chunk-DVWBVANP.js";
 import {
   findTaskByTemplate,
   getProjectDir,
@@ -39,15 +39,17 @@ import {
   isAgentIdle,
   isSessionHealthy,
   isStaleForToday,
+  parsePsRows,
   peekCurrentSession,
   prepareForRespawn,
+  reapOrphanChannelMcps,
   resetRestartCount,
   resolveClaudeBinary,
   sanitizeMcpJson,
   startPersistentSession,
   stopAllSessionsAndWait,
   stopPersistentSession
-} from "../chunk-QFWR2NV5.js";
+} from "../chunk-3K3RO5NS.js";
 
 // src/lib/manager-worker.ts
 import { createHash } from "crypto";
@@ -58,6 +60,188 @@ import { join as join4, dirname } from "path";
 import { homedir as homedir3 } from "os";
 import { fileURLToPath } from "url";
 
+// src/lib/stale-mcp-reaper.ts
+import { execFileSync } from "child_process";
+function parseEnvIntegrationsVars(content) {
+  const names = /* @__PURE__ */ new Set();
+  for (const raw of content.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const name = line.slice(0, eq).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) continue;
+    names.add(name);
+  }
+  return [...names];
+}
+function findMcpServersUsingVars(mcp, changedVars) {
+  const changedSet = new Set(changedVars);
+  if (!mcp?.mcpServers || changedSet.size === 0) return [];
+  const result = [];
+  for (const [serverKey, entry] of Object.entries(mcp.mcpServers)) {
+    if (!entry || typeof entry !== "object") continue;
+    const env = entry.env;
+    if (!env || typeof env !== "object") continue;
+    let matches = false;
+    for (const value of Object.values(env)) {
+      if (typeof value !== "string") continue;
+      const placeholderMatches = value.match(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g);
+      if (placeholderMatches) {
+        for (const ph of placeholderMatches) {
+          const name = ph.slice(2, -1);
+          if (changedSet.has(name)) {
+            matches = true;
+            break;
+          }
+        }
+      }
+      if (matches) break;
+    }
+    if (matches) result.push(serverKey);
+  }
+  return result;
+}
+function buildArgvMatchers(serverKeys) {
+  const patterns = [];
+  for (const key of serverKeys) {
+    const safe = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    patterns.push(new RegExp(`\\b${safe}\\b`));
+    if (safe.includes("_")) {
+      const dashed = safe.replace(/_/g, "-");
+      patterns.push(new RegExp(`\\b${dashed}\\b`));
+    }
+  }
+  return patterns;
+}
+function buildClaudeAgentMatcher(codeName) {
+  const safe = codeName.replace(/[^A-Za-z0-9_-]/g, "");
+  return new RegExp(`\\bclaude\\b.*--name\\s+agt-${safe}(?=\\s|$)`);
+}
+function findMcpChildrenForAgent(args) {
+  const { rows, codeName, serverKeys } = args;
+  const maxDepth = args.maxDepth ?? 8;
+  if (serverKeys.length === 0 || rows.length === 0) return [];
+  const claudeMatcher = buildClaudeAgentMatcher(codeName);
+  const argvMatchers = buildArgvMatchers(serverKeys);
+  const byPid = new Map(rows.map((r) => [r.pid, r]));
+  const matched = [];
+  for (const row of rows) {
+    if (!argvMatchers.some((re) => re.test(row.args))) continue;
+    if (/\bclaude\b/.test(row.args) && row.args.includes(`--name agt-${codeName}`)) continue;
+    let cur = byPid.get(row.ppid);
+    let belongs = false;
+    for (let depth = 0; depth < maxDepth && cur; depth++) {
+      if (claudeMatcher.test(cur.args)) {
+        belongs = true;
+        break;
+      }
+      if (cur.pid === 1) break;
+      cur = byPid.get(cur.ppid);
+    }
+    if (belongs) matched.push(row.pid);
+  }
+  return matched;
+}
+function reapStaleMcpChildren(args) {
+  const { log: log2, codeName, serverKeys, graceMs = 5e3 } = args;
+  if (serverKeys.length === 0) return [];
+  const runPs = args.runPs ?? (() => execFileSync("ps", ["-eo", "pid,ppid,args"], { encoding: "utf-8", timeout: 5e3 }));
+  const killProcess = args.killProcess ?? ((pid, signal) => {
+    try {
+      process.kill(pid, signal);
+    } catch {
+    }
+  });
+  const isAlive = args.isAlive ?? ((pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  let psOutput;
+  try {
+    psOutput = runPs();
+  } catch (err) {
+    log2(`[stale-mcp-reaper] ps invocation failed for '${codeName}': ${err.message} \u2014 skipping reap`);
+    return [];
+  }
+  const rows = parsePsRows(psOutput);
+  const targets = findMcpChildrenForAgent({ rows, codeName, serverKeys });
+  if (targets.length === 0) return [];
+  const byPid = new Map(rows.map((r) => [r.pid, r]));
+  const describe = (pid) => {
+    const argv = byPid.get(pid)?.args ?? "";
+    const pkgMatch = argv.match(/(@[a-z0-9_-]+\/[a-z0-9_-]+|[a-z0-9_-]+-mcp-server|[a-z0-9_-]+-mcp\b)/i);
+    return pkgMatch ? `${pkgMatch[1]} (pid ${pid})` : `pid ${pid}`;
+  };
+  log2(
+    `[stale-mcp-reaper] '${codeName}': rotating ${targets.length} stale MCP child(ren) for [${serverKeys.join(", ")}]: ${targets.map(describe).join(", ")}`
+  );
+  for (const pid of targets) {
+    killProcess(pid, "SIGTERM");
+  }
+  setTimeout(() => {
+    try {
+      let freshPsOutput;
+      try {
+        freshPsOutput = runPs();
+      } catch (err) {
+        log2(`[stale-mcp-reaper] '${codeName}': fresh ps for SIGKILL re-verify failed: ${err.message} \u2014 skipping SIGKILL pass`);
+        return;
+      }
+      const stillOwned = new Set(
+        findMcpChildrenForAgent({
+          rows: parsePsRows(freshPsOutput),
+          codeName,
+          serverKeys
+        })
+      );
+      const stragglers = targets.filter((pid) => isAlive(pid) && stillOwned.has(pid));
+      if (stragglers.length === 0) return;
+      log2(
+        `[stale-mcp-reaper] '${codeName}': ${stragglers.length} child(ren) survived SIGTERM; sending SIGKILL: ${stragglers.map(describe).join(", ")}`
+      );
+      for (const pid of stragglers) {
+        killProcess(pid, "SIGKILL");
+      }
+    } catch (err) {
+      log2(`[stale-mcp-reaper] '${codeName}': error in SIGKILL pass: ${err.message}`);
+    }
+  }, graceMs).unref();
+  return targets;
+}
+
+// src/lib/channel-restart-decision.ts
+function launchableChannelIds(channelConfigs) {
+  if (!channelConfigs) return /* @__PURE__ */ new Set();
+  const result = /* @__PURE__ */ new Set();
+  for (const [channelId, entry] of Object.entries(channelConfigs)) {
+    if (!entry) continue;
+    if (entry.config == null) continue;
+    if (entry.status !== "active" && entry.status !== "pending") continue;
+    result.add(channelId);
+  }
+  return result;
+}
+function decideChannelRestart(input) {
+  const { previousChannelIds, currentChannelIds, sessionMode, framework, sessionHealthy } = input;
+  if (previousChannelIds === void 0) {
+    return { restart: false, added: [], removed: [] };
+  }
+  const added = [...currentChannelIds].filter((c) => !previousChannelIds.has(c));
+  const removed = [...previousChannelIds].filter((c) => !currentChannelIds.has(c));
+  if (added.length === 0 && removed.length === 0) {
+    return { restart: false, added, removed };
+  }
+  if (sessionMode !== "persistent") return { restart: false, added, removed };
+  if (framework !== "claude-code") return { restart: false, added, removed };
+  if (!sessionHealthy) return { restart: false, added, removed };
+  return { restart: true, added, removed };
+}
+
 // src/lib/integration-context-render.ts
 var PLUGIN_CONTEXT_PLACEHOLDER_RE = /\{\{\s*context\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
 var TEAM_OVERRIDES_HEADER = "## Team Overrides\n\n> **The following overrides anything you've read above.** If any rule here conflicts with earlier instructions in this skill, follow what is written here. These are user-supplied directives that take precedence over the plugin's default guidance.\n";
@@ -620,7 +804,7 @@ function saveChannelHashCache(source, configDir) {
 }
 
 // src/lib/channel-sweep.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 var CHANNEL_BASENAMES = [
   "slack-channel",
   "direct-chat-channel",
@@ -783,7 +967,7 @@ function resolveLiveAnchorPids(agentCodeNames) {
   for (const codeName of agentCodeNames) {
     const pids = /* @__PURE__ */ new Set();
     try {
-      const out = execFileSync("tmux", ["list-panes", "-t", `agt-${codeName}`, "-F", "#{pane_pid}"], {
+      const out = execFileSync2("tmux", ["list-panes", "-t", `agt-${codeName}`, "-F", "#{pane_pid}"], {
         encoding: "utf-8",
         timeout: 2e3,
         stdio: ["ignore", "pipe", "ignore"]
@@ -803,7 +987,7 @@ async function sweepChannelProcesses(opts) {
   const kill = opts.killFn ?? defaultKill;
   let psOutput = "";
   try {
-    psOutput = execFileSync("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
+    psOutput = execFileSync2("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
       encoding: "utf-8",
       timeout: 5e3,
       maxBuffer: 10 * 1024 * 1024
@@ -840,7 +1024,7 @@ function defaultKillSignal(pid, signal) {
   }
 }
 function defaultPs() {
-  return execFileSync("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
+  return execFileSync2("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
     encoding: "utf-8",
     timeout: 5e3,
     maxBuffer: 10 * 1024 * 1024
@@ -1554,6 +1738,28 @@ var KNOWN_SAFE_TAIL_SIGNATURES = /* @__PURE__ */ new Set(["session_id_in_use"]);
 var knownVersions = /* @__PURE__ */ new Map();
 var knownStatuses = /* @__PURE__ */ new Map();
 var knownChannels = /* @__PURE__ */ new Map();
+var pendingSessionRestarts = /* @__PURE__ */ new Map();
+function scheduleSessionRestart(codeName, delayMs, reason) {
+  const existing = pendingSessionRestarts.get(codeName);
+  if (existing) {
+    clearTimeout(existing);
+    log(`[hot-reload] Coalesced restart for '${codeName}': replacing pending timer with ${reason}`);
+  }
+  const timer = setTimeout(() => {
+    pendingSessionRestarts.delete(codeName);
+    stopPersistentSession(codeName, log);
+    log(`[hot-reload] Session stopped for '${codeName}' \u2014 will respawn with ${reason}`);
+  }, delayMs);
+  timer.unref?.();
+  pendingSessionRestarts.set(codeName, timer);
+}
+function cancelPendingSessionRestart(codeName) {
+  const existing = pendingSessionRestarts.get(codeName);
+  if (!existing) return;
+  clearTimeout(existing);
+  pendingSessionRestarts.delete(codeName);
+  log(`[hot-reload] Cancelled pending restart timer for '${codeName}' (another teardown path is handling it)`);
+}
 var writtenHashes = /* @__PURE__ */ new Map();
 var knownSecretsHashes = /* @__PURE__ */ new Map();
 var knownChannelConfigHashes = /* @__PURE__ */ new Map();
@@ -1630,10 +1836,10 @@ function clearAgentCaches(agentId, codeName) {
 var cachedFrameworkVersion = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
-var agtCliVersion = true ? "0.19.13" : "dev";
-function resolveBrewPath(execFileSync2) {
+var agtCliVersion = true ? "0.19.15" : "dev";
+function resolveBrewPath(execFileSync3) {
   try {
-    const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
+    const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
     if (out) return out;
   } catch {
   }
@@ -1675,9 +1881,9 @@ async function ensureToolkitCli(toolkitSlug) {
   }
   const { binary, installer, package: pkg, script } = integration.cli_tool;
   const resolvedInstaller = installer ?? "manual";
-  const { execFileSync: execFileSync2, execSync } = await import("child_process");
+  const { execFileSync: execFileSync3, execSync } = await import("child_process");
   try {
-    execFileSync2("which", [binary], { timeout: 5e3, stdio: "pipe" });
+    execFileSync3("which", [binary], { timeout: 5e3, stdio: "pipe" });
     toolkitCliEnsured.add(toolkitSlug);
     toolkitCliRetryAfter.delete(toolkitSlug);
     toolkitCliFailureCount.delete(toolkitSlug);
@@ -1698,14 +1904,14 @@ async function ensureToolkitCli(toolkitSlug) {
         return;
       }
       log(`[toolkit-install] ${toolkitSlug}: installing via npm (${pkg})\u2026`);
-      execFileSync2("npm", ["install", "-g", pkg], { timeout: 18e4, stdio: "pipe" });
+      execFileSync3("npm", ["install", "-g", pkg], { timeout: 18e4, stdio: "pipe" });
     } else if (resolvedInstaller === "brew") {
       if (!pkg) {
         log(`[toolkit-install] ${toolkitSlug}: installer=brew but no package declared`);
         toolkitCliEnsured.add(toolkitSlug);
         return;
       }
-      const brewPath = resolveBrewPath(execFileSync2);
+      const brewPath = resolveBrewPath(execFileSync3);
       if (!brewPath) {
         log(`[toolkit-install] ${toolkitSlug}: installer=brew but Homebrew not available \u2014 install manually: brew install ${pkg}`);
         toolkitCliEnsured.add(toolkitSlug);
@@ -1715,9 +1921,9 @@ async function ensureToolkitCli(toolkitSlug) {
       const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
       log(`[toolkit-install] ${toolkitSlug}: installing via brew (${pkg})\u2026`);
       if (isRoot) {
-        execFileSync2("sudo", ["-u", "ec2-user", "-H", brewPath, "install", pkg], { timeout: 18e4, stdio: "pipe", cwd: "/tmp" });
+        execFileSync3("sudo", ["-u", "ec2-user", "-H", brewPath, "install", pkg], { timeout: 18e4, stdio: "pipe", cwd: "/tmp" });
       } else {
-        execFileSync2(brewPath, ["install", pkg], { timeout: 18e4, stdio: "pipe" });
+        execFileSync3(brewPath, ["install", pkg], { timeout: 18e4, stdio: "pipe" });
       }
     } else if (resolvedInstaller === "script") {
       if (!script) {
@@ -1737,7 +1943,7 @@ async function ensureToolkitCli(toolkitSlug) {
     process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
   }
   try {
-    execFileSync2("which", [binary], { timeout: 5e3, stdio: "pipe" });
+    execFileSync3("which", [binary], { timeout: 5e3, stdio: "pipe" });
     log(`[toolkit-install] ${toolkitSlug}: installed \u2014 ${binary} now on PATH`);
     toolkitCliEnsured.add(toolkitSlug);
     toolkitCliRetryAfter.delete(toolkitSlug);
@@ -1790,8 +1996,8 @@ async function ensureFrameworkBinary(frameworkId) {
   if (frameworkId !== "claude-code") return;
   if (frameworkBinaryChecked.has(frameworkId)) return;
   frameworkBinaryChecked.add(frameworkId);
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) {
     log("Homebrew not found (no `brew` on PATH, no /home/linuxbrew/.linuxbrew/bin/brew). Cannot auto-install Claude Code. Install manually: https://claude.ai/download");
     return;
@@ -1807,7 +2013,7 @@ async function ensureFrameworkBinary(frameworkId) {
   let claudeExists = existsSync3("/home/linuxbrew/.linuxbrew/bin/claude");
   if (!claudeExists) {
     try {
-      execFileSync2("which", ["claude"], { timeout: 5e3 });
+      execFileSync3("which", ["claude"], { timeout: 5e3 });
       claudeExists = true;
     } catch {
     }
@@ -1899,16 +2105,16 @@ async function checkAndUpdateCli() {
   }
 }
 async function checkAndUpdateCliViaBrew() {
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) return;
   try {
-    execFileSync2(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
+    execFileSync3(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
   } catch (err) {
     log(`[self-update] brew update failed (continuing with stale cache): ${err.message}`);
   }
   try {
-    const outdated = execFileSync2(brewPath, ["outdated", "--json=v2"], {
+    const outdated = execFileSync3(brewPath, ["outdated", "--json=v2"], {
       timeout: 3e4,
       encoding: "utf-8"
     });
@@ -1919,7 +2125,7 @@ async function checkAndUpdateCliViaBrew() {
       const latest = agtOutdated.current_version ?? "unknown";
       log(`[self-update] agt CLI update available: ${installed} \u2192 ${latest}. Upgrading via brew...`);
       try {
-        execFileSync2(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
+        execFileSync3(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
           timeout: 12e4,
           stdio: "pipe"
         });
@@ -1938,7 +2144,7 @@ async function checkAndUpdateCliViaBrew() {
   }
 }
 async function checkAndUpdateCliViaNpm() {
-  const { execFileSync: execFileSync2 } = await import("child_process");
+  const { execFileSync: execFileSync3 } = await import("child_process");
   if (agtCliVersion === "dev") return;
   let latest;
   try {
@@ -1987,7 +2193,7 @@ async function checkAndUpdateCliViaNpm() {
     "--registry=https://registry.npmjs.org"
   ];
   try {
-    execFileSync2(cmd, args, { timeout: 18e4, stdio: "pipe" });
+    execFileSync3(cmd, args, { timeout: 18e4, stdio: "pipe" });
     log(`[self-update] agt CLI upgraded to ${latest}. Scheduling manager restart so the new binary takes effect.`);
     restartAfterUpgrade = true;
     pendingUpgradeVersion = latest;
@@ -2473,6 +2679,7 @@ async function pollCycle() {
       log,
       resolveFramework: (codeName) => agentFrameworkCache.get(codeName) ?? null,
       stopSession: (codeName) => {
+        cancelPendingSessionRestart(codeName);
         stopPersistentSession(codeName, log);
         persistentSessionAgents.delete(codeName);
         claudeAuthTupleBySession.delete(codeName);
@@ -2533,7 +2740,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-XBRQN7XE.js");
+      const { collectDiagnostics } = await import("../persistent-session-M2GVL6Z6.js");
       const diagCodeNames = [...persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -2633,6 +2840,7 @@ async function pollCycle() {
         log(`Agent '${prev.codeName}' removed from host (deleted or unassigned)`);
         const adapter = resolveAgentFramework(prev.codeName);
         await stopGatewayIfRunning(prev.codeName, adapter);
+        cancelPendingSessionRestart(prev.codeName);
         stopPersistentSession(prev.codeName, log);
         try {
           const { execSync: es } = await import("child_process");
@@ -2770,6 +2978,7 @@ async function processAgent(agent, agentStates) {
   if (agent.status === "draft" || agent.status === "paused") {
     log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
     await stopGatewayIfRunning(agent.code_name, adapter);
+    cancelPendingSessionRestart(agent.code_name);
     stopPersistentSession(agent.code_name, log);
     try {
       const { execSync: es } = await import("child_process");
@@ -2798,6 +3007,7 @@ async function processAgent(agent, agentStates) {
   if (agent.status === "revoked") {
     log(`Agent '${agent.code_name}' is revoked, cleaning up`);
     await stopGatewayIfRunning(agent.code_name, adapter);
+    cancelPendingSessionRestart(agent.code_name);
     stopPersistentSession(agent.code_name, log);
     try {
       const { execSync: es } = await import("child_process");
@@ -2905,9 +3115,10 @@ async function processAgent(agent, agentStates) {
   const toolsVersion = refreshData.tools.version;
   const known = knownVersions.get(agent.agent_id);
   let lastProvisionAt = state.agents.find((a) => a.agentId === agent.agent_id)?.lastProvisionAt ?? null;
-  const currentChannelIds = new Set(Object.keys(refreshData.channel_configs ?? {}));
+  const currentChannelIds = launchableChannelIds(refreshData.channel_configs);
   const previousChannelIds = knownChannels.get(agent.agent_id);
   const channelsChanged = !previousChannelIds || currentChannelIds.size !== previousChannelIds.size || [...currentChannelIds].some((ch) => !previousChannelIds.has(ch)) || [...previousChannelIds].some((ch) => !currentChannelIds.has(ch));
+  let channelConfigConverged = true;
   if (previousChannelIds && channelsChanged && frameworkAdapter.removeChannelCredentials) {
     for (const ch of previousChannelIds) {
       if (!currentChannelIds.has(ch)) {
@@ -2915,12 +3126,12 @@ async function processAgent(agent, agentStates) {
           frameworkAdapter.removeChannelCredentials(agent.code_name, ch);
           log(`Removed ${ch} credentials for '${agent.code_name}'`);
         } catch (err) {
+          channelConfigConverged = false;
           log(`Failed to remove ${ch} credentials for '${agent.code_name}': ${err.message}`);
         }
       }
     }
   }
-  knownChannels.set(agent.agent_id, currentChannelIds);
   try {
     const artifacts = generateArtifacts(agent, refreshData, frameworkAdapter);
     const changedFiles = [];
@@ -3133,6 +3344,7 @@ async function processAgent(agent, agentStates) {
             saveChannelHashCache2();
             log(`Channel credentials written for '${agent.code_name}/${channelId}' (reason=${reason}, hash=${configHash.slice(0, 8)}${prevHash ? `, prev=${prevHash.slice(0, 8)}` : ""})`);
           } catch (err) {
+            channelConfigConverged = false;
             log(`Failed to write channel credentials for '${agent.code_name}/${channelId}': ${err.message}`);
           }
         }
@@ -3145,6 +3357,32 @@ async function processAgent(agent, agentStates) {
       }
     }
   }
+  if (channelConfigConverged) {
+    knownChannels.set(agent.agent_id, currentChannelIds);
+  } else {
+    log(`[channels] Credential sync did not converge for '${agent.code_name}' \u2014 leaving diff live for next tick retry`);
+  }
+  const restartDecision = channelConfigConverged ? decideChannelRestart({
+    previousChannelIds,
+    currentChannelIds,
+    sessionMode: refreshData.agent.session_mode,
+    framework: agentFrameworkCache.get(agent.code_name) ?? "openclaw",
+    sessionHealthy: isSessionHealthy(agent.code_name)
+  }) : { restart: false, added: [], removed: [] };
+  if (restartDecision.restart) {
+    const reasonParts = [];
+    if (restartDecision.added.length > 0) reasonParts.push(`added=${restartDecision.added.join(",")}`);
+    if (restartDecision.removed.length > 0) reasonParts.push(`removed=${restartDecision.removed.join(",")}`);
+    const reason = reasonParts.join(" ");
+    log(`[hot-reload] Channel set changed for '${agent.code_name}' (${reason}) \u2014 restarting session`);
+    const restartNotice = restartDecision.added.length > 0 ? `New channels have been wired up (${restartDecision.added.join(", ")}). Note: channels require a session restart to attach their MCP servers as channel listeners. Your manager will restart your session shortly.` : `Channels were removed (${restartDecision.removed.join(", ")}). Your manager will restart your session shortly so the launch flags drop those channels.`;
+    const delivered = await injectMessage(agent.code_name, "system", restartNotice, { task_name: "channel-update" }, log).catch(() => false);
+    const delay = delivered ? 8e3 : 3e3;
+    if (!delivered) {
+      log(`[hot-reload] Inject notification unconfirmed for '${agent.code_name}' \u2014 proceeding with shorter delay`);
+    }
+    scheduleSessionRestart(agent.code_name, delay, "new channel set");
+  }
   const agentSessionMode = refreshData.agent.session_mode;
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? "openclaw") === "claude-code") {
     try {
@@ -3250,12 +3488,33 @@ async function processAgent(agent, agentStates) {
         log(`Integrations provisioned for '${agent.code_name}' (${integrations.length} integration(s))`);
         const fw = agentFrameworkCache.get(agent.code_name) ?? "openclaw";
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
+          let affectedServerKeys = [];
+          try {
+            const projectDir = join4(homedir3(), ".augmented", agent.code_name, "project");
+            const envIntPath = join4(projectDir, ".env.integrations");
+            const projectMcpPath = join4(projectDir, ".mcp.json");
+            const envContent = readFileSync3(envIntPath, "utf-8");
+            const mcpContent = readFileSync3(projectMcpPath, "utf-8");
+            const changedVars = parseEnvIntegrationsVars(envContent);
+            const mcpJson = JSON.parse(mcpContent);
+            affectedServerKeys = findMcpServersUsingVars(mcpJson, changedVars);
+          } catch (err) {
+            log(`[hot-reload] Failed to compute affected MCP servers for '${agent.code_name}': ${err.message}`);
+          }
+          if (affectedServerKeys.length > 0) {
+            reapStaleMcpChildren({
+              log,
+              codeName: agent.code_name,
+              serverKeys: affectedServerKeys
+            });
+          }
           const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
-          injectMessage(agent.code_name, "system", `Your integrations have been updated. You now have access to: ${names}. Your .env.integrations and CLAUDE.md have been refreshed \u2014 credentials are available immediately via environment variables.`, {
+          const reapNote = affectedServerKeys.length > 0 ? ` The MCP servers that depend on rotating credentials (${affectedServerKeys.join(", ")}) have been signalled to reconnect.` : "";
+          injectMessage(agent.code_name, "system", `Your integrations have been refreshed. You have access to: ${names}.${reapNote}`, {
             task_name: "integration-update"
           }, log).catch(() => {
           });
-          log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${names}`);
+          log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${names} (reaped ${affectedServerKeys.length} stale MCP server(s))`);
         }
         needsGatewayRestart = true;
       }
@@ -3334,10 +3593,7 @@ async function processAgent(agent, agentStates) {
             if (!delivered) {
               log(`[hot-reload] Inject notification unconfirmed for '${agent.code_name}' \u2014 proceeding with shorter delay`);
             }
-            setTimeout(() => {
-              stopPersistentSession(agent.code_name, log);
-              log(`[hot-reload] Session stopped for '${agent.code_name}' \u2014 will respawn with new MCP servers`);
-            }, delay);
+            scheduleSessionRestart(agent.code_name, delay, "new MCP servers");
           }
         }
       } catch (err) {
@@ -4327,6 +4583,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
     const msg = err.message;
     log(`[persistent-session] Failed to resolve auth for '${codeName}': ${msg} \u2014 refusing to spawn`);
     if (isSessionHealthy(codeName)) {
+      cancelPendingSessionRestart(codeName);
       stopPersistentSession(codeName, log);
       persistentSessionAgents.delete(codeName);
       claudeAuthTupleBySession.delete(codeName);
@@ -4349,6 +4606,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   const recordedAuthTuple = claudeAuthTupleBySession.get(codeName);
   if (recordedAuthTuple && recordedAuthTuple !== currentAuthTuple && isSessionHealthy(codeName)) {
     log(`[persistent-session] Auth config changed for '${codeName}' (${recordedAuthTuple} \u2192 ${currentAuthTuple}) \u2014 restarting session`);
+    cancelPendingSessionRestart(codeName);
     stopPersistentSession(codeName, log);
     persistentSessionAgents.delete(codeName);
   }
@@ -4360,6 +4618,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
         log(
           `[persistent-session] Day rollover for '${codeName}' (yesterday=${current.date}) \u2014 agent idle, restarting to mint fresh session`
         );
+        cancelPendingSessionRestart(codeName);
         stopPersistentSession(codeName, log);
         persistentSessionAgents.delete(codeName);
       } else {
@@ -5739,7 +5998,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-SJDLJNYF.js");
+  } = await import("../claude-pair-runtime-UF4OMFCA.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -6301,6 +6560,7 @@ function startManager(opts) {
     `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join4(homedir3(), ".augmented", "manager.log")}`
   );
   deployMcpAssets();
+  reapOrphanChannelMcps({ log });
   void ensureHostFrameworkBinaries();
   startPolling();
 }