@integrity-labs/agt-cli 0.19.14 → 0.19.15

package/dist/{chunk-KLNFWXOI.js → chunk-DVWBVANP.js}

@@ -2632,11 +2632,146 @@ function extractAllowedDomains(input) {
 registerFramework(nemoClawAdapter);
 
 // ../../packages/core/dist/provisioning/frameworks/claudecode/index.js
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync4, chmodSync as chmodSync4, readdirSync, rmSync, copyFileSync } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, existsSync as existsSync5, chmodSync as chmodSync4, readdirSync, rmSync, copyFileSync } from "fs";
 import { join as join4, relative, dirname as dirname4 } from "path";
 import { homedir as homedir3 } from "os";
 import { execFile as execFile3 } from "child_process";
 
+// ../../packages/core/dist/provisioning/mcp-config-guards.js
+import { existsSync as existsSync4, readFileSync as readFileSync4, renameSync as renameSync3, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3 } from "fs";
+var REQUIRED_ENV_RULES_BY_SERVER = {
+  "cloud-broker": [
+    { key: "AGT_HOST", mustBeConcrete: false },
+    { key: "AGT_API_KEY", mustBeConcrete: false },
+    // ENG-4744: this is the bug shape — writer used to omit this
+    // entirely, or render it as a literal `${AGT_AGENT_ID}` instead
+    // of the agent's real UUID. The broker has no way to substitute
+    // it post-spawn, so a placeholder here = silently broken agent.
+    { key: "AGT_AGENT_ID", mustBeConcrete: true }
+  ]
+};
+var PLACEHOLDER_RE = /\$\{[^}]+\}/;
+function validateRenderedMcpConfig(config) {
+  const errors = [];
+  if (typeof config !== "object" || config === null || Array.isArray(config)) {
+    return {
+      ok: false,
+      errors: [
+        {
+          kind: "invalid_json_shape",
+          server: "*",
+          message: "config root must be a non-null object"
+        }
+      ]
+    };
+  }
+  const root = config;
+  if (root.mcpServers === void 0) {
+    return { ok: true };
+  }
+  if (typeof root.mcpServers !== "object" || root.mcpServers === null) {
+    return {
+      ok: false,
+      errors: [
+        {
+          kind: "invalid_json_shape",
+          server: "*",
+          message: "mcpServers must be an object"
+        }
+      ]
+    };
+  }
+  if (Array.isArray(root.mcpServers)) {
+    return {
+      ok: false,
+      errors: [
+        {
+          kind: "invalid_json_shape",
+          server: "*",
+          message: "mcpServers must be an object"
+        }
+      ]
+    };
+  }
+  for (const [serverKey, raw] of Object.entries(root.mcpServers)) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+      errors.push({
+        kind: "invalid_json_shape",
+        server: serverKey,
+        message: `entry must be an object`
+      });
+      continue;
+    }
+    const entry = raw;
+    const rules = REQUIRED_ENV_RULES_BY_SERVER[serverKey];
+    if (rules) {
+      const env2 = entry.env ?? {};
+      for (const rule of rules) {
+        const value = env2[rule.key];
+        if (typeof value !== "string" || value.length === 0) {
+          errors.push({
+            kind: "missing_required_env",
+            server: serverKey,
+            message: `missing required env key: ${rule.key}`
+          });
+          continue;
+        }
+        if (rule.mustBeConcrete && PLACEHOLDER_RE.test(value)) {
+          errors.push({
+            kind: "unexpanded_placeholder",
+            server: serverKey,
+            message: `env.${rule.key} contains an unexpanded \${...} placeholder; expected a concrete value`
+          });
+        }
+      }
+    }
+  }
+  return errors.length === 0 ? { ok: true } : { ok: false, errors };
+}
+function formatValidationErrors(errors) {
+  return errors.map((e) => `${e.server}:${e.kind}=${e.message}`).join("; ");
+}
+function safeWriteJsonAtomic(path, content, opts = {}) {
+  const keepBackup = opts.keepBackup !== false;
+  const rename = opts.renamer ?? renameSync3;
+  const tmpPath = `${path}.new`;
+  const bakPath = `${path}.bak`;
+  let movedOriginalToBackup = false;
+  try {
+    writeFileSync4(tmpPath, content);
+  } catch (err) {
+    throw err;
+  }
+  try {
+    if (keepBackup && existsSync4(path)) {
+      rename(path, bakPath);
+      movedOriginalToBackup = true;
+    }
+    rename(tmpPath, path);
+  } catch (err) {
+    try {
+      if (existsSync4(tmpPath))
+        unlinkSync3(tmpPath);
+    } catch {
+    }
+    if (movedOriginalToBackup && !existsSync4(path) && existsSync4(bakPath)) {
+      try {
+        renameSync3(bakPath, path);
+      } catch {
+      }
+    }
+    throw err;
+  }
+}
+function safeWriteMcpJson(path, config) {
+  const validation = validateRenderedMcpConfig(config);
+  if (!validation.ok) {
+    return { written: false, errors: validation.errors };
+  }
+  safeWriteJsonAtomic(path, JSON.stringify(config, null, 2));
+  return { written: true, errors: [] };
+}
+
 // ../../packages/core/dist/provisioning/frameworks/claudecode/identity.js
 function buildMemorySection(hasQmd) {
   const recall = hasQmd ? `### Recall
@@ -3300,7 +3435,7 @@ function migrateLegacyClaudecodeDir(codeName, log) {
   if (migratedCodeNames.has(codeName))
     return;
   const legacyRoot = join4(getHomeDir3(), ".augmented", codeName, "claudecode");
-  if (!existsSync4(legacyRoot)) {
+  if (!existsSync5(legacyRoot)) {
     migratedCodeNames.add(codeName);
     return;
   }
@@ -3318,25 +3453,25 @@ function migrateLegacyClaudecodeDir(codeName, log) {
           walkAndMigrate(src, dest);
           continue;
         }
-        if (entry.name === ".mcp.json" && existsSync4(dest)) {
+        if (entry.name === ".mcp.json" && existsSync5(dest)) {
           try {
-            const oldCfg = JSON.parse(readFileSync4(src, "utf-8"));
-            const newCfg = JSON.parse(readFileSync4(dest, "utf-8"));
+            const oldCfg = JSON.parse(readFileSync5(src, "utf-8"));
+            const newCfg = JSON.parse(readFileSync5(dest, "utf-8"));
             const merged = { mcpServers: { ...oldCfg.mcpServers ?? {}, ...newCfg.mcpServers ?? {} } };
-            writeFileSync4(dest, JSON.stringify(merged, null, 2));
+            writeFileSync5(dest, JSON.stringify(merged, null, 2));
             emit(`[migrate] '${codeName}' merged .mcp.json (${Object.keys(merged.mcpServers).length} servers)`);
           } catch (err) {
             throw new Error(`Failed merging .mcp.json (${src} \u2192 ${dest}): ${err.message}`);
           }
           continue;
         }
-        if (!existsSync4(dest)) {
+        if (!existsSync5(dest)) {
           copyFileSync(src, dest);
           continue;
         }
         try {
-          const srcStat = readFileSync4(src);
-          const destStat = readFileSync4(dest);
+          const srcStat = readFileSync5(src);
+          const destStat = readFileSync5(dest);
           if (!srcStat.equals(destStat)) {
           }
         } catch (err) {
@@ -3362,38 +3497,69 @@ function syncMcpToProject(codeName) {
   const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
   const projectMcpPath = join4(projectDir, ".mcp.json");
   try {
-    const content = readFileSync4(provisionMcpPath, "utf-8");
+    const content = readFileSync5(provisionMcpPath, "utf-8");
     mkdirSync4(projectDir, { recursive: true });
-    writeFileSync4(projectMcpPath, content);
+    writeFileSync5(projectMcpPath, content);
   } catch {
   }
   renderChannelMessageHandlerForAgent(codeName);
 }
+var INTEGRATIONS_SUMMARY_FILE = "integrations-summary.json";
+function integrationsSummaryPath(codeName) {
+  return join4(getAgentDir(codeName), "provision", INTEGRATIONS_SUMMARY_FILE);
+}
+function writeIntegrationsSummaryForAgent(codeName, summaries) {
+  const target = integrationsSummaryPath(codeName);
+  try {
+    mkdirSync4(dirname4(target), { recursive: true });
+    writeFileSync5(target, JSON.stringify(summaries, null, 2));
+  } catch {
+  }
+}
+function readIntegrationsSummaryForAgent(codeName) {
+  try {
+    const raw = readFileSync5(integrationsSummaryPath(codeName), "utf-8");
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
 function renderChannelMessageHandlerForAgent(codeName) {
   const agentDir = getAgentDir(codeName);
   const projectDir = getProjectDir(codeName);
   const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
   let mcpServerKeys;
   try {
-    const config = JSON.parse(readFileSync4(provisionMcpPath, "utf-8"));
+    const config = JSON.parse(readFileSync5(provisionMcpPath, "utf-8"));
     mcpServerKeys = Object.keys(config.mcpServers ?? {});
   } catch {
     return;
   }
-  const content = buildChannelMessageHandlerAgent({ mcpServerKeys });
+  const integrations = readIntegrationsSummaryForAgent(codeName);
+  const content = buildChannelMessageHandlerAgent({ mcpServerKeys, integrations });
   for (const baseDir of [agentDir, projectDir]) {
     const target = join4(baseDir, ".claude", "agents", "channel-message-handler.md");
     try {
       mkdirSync4(dirname4(target), { recursive: true });
-      writeFileSync4(target, content);
+      writeFileSync5(target, content);
     } catch {
     }
   }
 }
+function writeMcpJsonGuarded(codeName, path, config) {
+  const result = safeWriteMcpJson(path, config);
+  if (!result.written) {
+    process.stderr.write(`[manager-worker] [mcp-validate] skipping write for '${codeName}': ${formatValidationErrors(result.errors)}
+`);
+    return false;
+  }
+  return true;
+}
 function readExistingMcpEnvVar(codeName, serverId, envKey) {
   const mcpJsonPath = join4(getAgentDir(codeName), "provision", ".mcp.json");
   try {
-    const raw = readFileSync4(mcpJsonPath, "utf-8");
+    const raw = readFileSync5(mcpJsonPath, "utf-8");
     const config = JSON.parse(raw);
     const server = config.mcpServers?.[serverId];
     if (!server || typeof server !== "object")
@@ -3408,6 +3574,18 @@ function readExistingMcpEnvVar(codeName, serverId, envKey) {
     return void 0;
   }
 }
+var PLACEHOLDER_LITERAL_RE = /\$\{[^}]+\}/;
+function resolveBrokerAgentId(codeName, fallback) {
+  const existing = readExistingMcpEnvVar(codeName, "cloud-broker", "AGT_AGENT_ID");
+  if (existing && !PLACEHOLDER_LITERAL_RE.test(existing))
+    return existing;
+  const fromAugmented = readExistingMcpEnvVar(codeName, "augmented", "AGT_AGENT_ID");
+  if (fromAugmented && !PLACEHOLDER_LITERAL_RE.test(fromAugmented))
+    return fromAugmented;
+  if (fallback && !PLACEHOLDER_LITERAL_RE.test(fallback))
+    return fallback;
+  return void 0;
+}
 function deployArtifactsToProject(codeName, provisionDir) {
   const projectDir = getProjectDir(codeName);
   mkdirSync4(projectDir, { recursive: true });
@@ -3418,27 +3596,27 @@ function deployArtifactsToProject(codeName, provisionDir) {
     const src = join4(provisionDir, file);
     const dest = join4(projectDir, file);
     try {
-      const srcContent = readFileSync4(src, "utf-8");
-      if (file === "CLAUDE.md" && existsSync4(dest)) {
-        const destContent = readFileSync4(dest, "utf-8");
+      const srcContent = readFileSync5(src, "utf-8");
+      if (file === "CLAUDE.md" && existsSync5(dest)) {
+        const destContent = readFileSync5(dest, "utf-8");
         const stripIndex = (s) => s.replace(new RegExp(`${SKILLS_START}[\\s\\S]*?${SKILLS_END}`), "").trimEnd();
         if (stripIndex(srcContent) === stripIndex(destContent))
           continue;
         const indexMatch = destContent.match(new RegExp(`${SKILLS_START}[\\s\\S]*?${SKILLS_END}`));
         if (indexMatch) {
-          writeFileSync4(dest, srcContent.trimEnd() + "\n\n" + indexMatch[0] + "\n");
+          writeFileSync5(dest, srcContent.trimEnd() + "\n\n" + indexMatch[0] + "\n");
           continue;
         }
       }
-      writeFileSync4(dest, srcContent);
+      writeFileSync5(dest, srcContent);
     } catch {
     }
   }
   const skillsDir = join4(provisionDir, ".claude", "skills");
   const destSkillsDir = join4(projectDir, ".claude", "skills");
   try {
-    if (existsSync4(destSkillsDir)) {
-      const srcFolders = existsSync4(skillsDir) ? new Set(readdirSync(skillsDir)) : /* @__PURE__ */ new Set();
+    if (existsSync5(destSkillsDir)) {
+      const srcFolders = existsSync5(skillsDir) ? new Set(readdirSync(skillsDir)) : /* @__PURE__ */ new Set();
       for (const folder of readdirSync(destSkillsDir)) {
         if (folder.startsWith("knowledge-") || folder === "core-knowledge" && !srcFolders.has(folder)) {
           try {
@@ -3448,21 +3626,21 @@ function deployArtifactsToProject(codeName, provisionDir) {
         }
       }
     }
-    if (existsSync4(skillsDir)) {
+    if (existsSync5(skillsDir)) {
       for (const skillFolder of readdirSync(skillsDir)) {
         const srcSkillFile = join4(skillsDir, skillFolder, "SKILL.md");
-        if (!existsSync4(srcSkillFile))
+        if (!existsSync5(srcSkillFile))
           continue;
         const destFolder = join4(destSkillsDir, skillFolder);
         const destFile = join4(destFolder, "SKILL.md");
-        const srcContent = readFileSync4(srcSkillFile, "utf-8");
+        const srcContent = readFileSync5(srcSkillFile, "utf-8");
         try {
-          if (existsSync4(destFile) && readFileSync4(destFile, "utf-8") === srcContent)
+          if (existsSync5(destFile) && readFileSync5(destFile, "utf-8") === srcContent)
             continue;
         } catch {
         }
         mkdirSync4(destFolder, { recursive: true });
-        writeFileSync4(destFile, srcContent);
+        writeFileSync5(destFile, srcContent);
       }
     }
   } catch {
@@ -3470,9 +3648,9 @@ function deployArtifactsToProject(codeName, provisionDir) {
   const agentsDir = join4(provisionDir, ".claude", "agents");
   const destAgentsDir = join4(projectDir, ".claude", "agents");
   try {
-    if (existsSync4(agentsDir)) {
+    if (existsSync5(agentsDir)) {
       const sourceAgentFiles = new Set(readdirSync(agentsDir).filter((f) => f.endsWith(".md")));
-      if (existsSync4(destAgentsDir)) {
+      if (existsSync5(destAgentsDir)) {
         for (const destFile of readdirSync(destAgentsDir)) {
           if (!destFile.endsWith(".md"))
             continue;
@@ -3487,14 +3665,14 @@ function deployArtifactsToProject(codeName, provisionDir) {
       for (const agentFile of sourceAgentFiles) {
         const srcPath = join4(agentsDir, agentFile);
         const destPath = join4(destAgentsDir, agentFile);
-        const srcContent = readFileSync4(srcPath, "utf-8");
+        const srcContent = readFileSync5(srcPath, "utf-8");
         try {
-          if (existsSync4(destPath) && readFileSync4(destPath, "utf-8") === srcContent)
+          if (existsSync5(destPath) && readFileSync5(destPath, "utf-8") === srcContent)
             continue;
         } catch {
         }
         mkdirSync4(destAgentsDir, { recursive: true });
-        writeFileSync4(destPath, srcContent);
+        writeFileSync5(destPath, srcContent);
       }
     }
   } catch {
@@ -3502,10 +3680,10 @@ function deployArtifactsToProject(codeName, provisionDir) {
   const agentMcpPath = join4(getAgentDir(codeName), "provision", ".mcp.json");
   const projectMcpPath = join4(projectDir, ".mcp.json");
   try {
-    const agentMcp = JSON.parse(readFileSync4(agentMcpPath, "utf-8"));
+    const agentMcp = JSON.parse(readFileSync5(agentMcpPath, "utf-8"));
     let projectMcp;
     try {
-      projectMcp = JSON.parse(readFileSync4(projectMcpPath, "utf-8"));
+      projectMcp = JSON.parse(readFileSync5(projectMcpPath, "utf-8"));
     } catch {
       projectMcp = { mcpServers: {} };
     }
@@ -3516,28 +3694,28 @@ function deployArtifactsToProject(codeName, provisionDir) {
       return !(entry && typeof entry["url"] === "string" && entry["url"].startsWith("/"));
     }));
     projectMcp["mcpServers"] = { ...stripRelativeUrls(projectServers), ...stripRelativeUrls(agentServers) };
-    writeFileSync4(projectMcpPath, JSON.stringify(projectMcp, null, 2));
+    writeFileSync5(projectMcpPath, JSON.stringify(projectMcp, null, 2));
   } catch {
   }
   const agentDir = getAgentDir(codeName);
   for (const envFile of [".env", ".env.integrations"]) {
     try {
-      const content = readFileSync4(join4(agentDir, envFile), "utf-8");
-      writeFileSync4(join4(projectDir, envFile), content);
+      const content = readFileSync5(join4(agentDir, envFile), "utf-8");
+      writeFileSync5(join4(projectDir, envFile), content);
     } catch {
     }
   }
   try {
     const gitDir = join4(projectDir, ".git");
     const hookSrc = join4(provisionDir, ".git-hooks", "pre-commit");
-    if (existsSync4(gitDir) && existsSync4(hookSrc)) {
+    if (existsSync5(gitDir) && existsSync5(hookSrc)) {
       const hooksDir = join4(gitDir, "hooks");
       mkdirSync4(hooksDir, { recursive: true });
       const hookDest = join4(hooksDir, "pre-commit");
-      const srcContent = readFileSync4(hookSrc, "utf-8");
-      const upToDate = existsSync4(hookDest) && readFileSync4(hookDest, "utf-8") === srcContent;
+      const srcContent = readFileSync5(hookSrc, "utf-8");
+      const upToDate = existsSync5(hookDest) && readFileSync5(hookDest, "utf-8") === srcContent;
       if (!upToDate)
-        writeFileSync4(hookDest, srcContent);
+        writeFileSync5(hookDest, srcContent);
       chmodSync4(hookDest, 493);
     }
   } catch {
@@ -3578,7 +3756,7 @@ function provisionStopHook(codeName) {
     "esac",
     "exit 0"
   ].join("\n") + "\n";
-  writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
+  writeFileSync5(hookScriptPath, hookScript, { mode: 493 });
   const ghostHookPath = join4(claudeDir, "agt-ghost-reply-hook.sh");
   const ghostHookScript = [
     "#!/bin/bash",
@@ -3698,11 +3876,11 @@ function provisionStopHook(codeName) {
     "fi",
     "exit 0"
   ].join("\n") + "\n";
-  writeFileSync4(ghostHookPath, ghostHookScript, { mode: 493 });
+  writeFileSync5(ghostHookPath, ghostHookScript, { mode: 493 });
   const settingsPath = join4(claudeDir, "settings.local.json");
   let settings = {};
   try {
-    settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
+    settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
   } catch {
   }
   const hooks = settings["hooks"] ?? {};
@@ -3715,7 +3893,7 @@ function provisionStopHook(codeName) {
     }
   ];
   settings["hooks"] = hooks;
-  writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
+  writeFileSync5(settingsPath, JSON.stringify(settings, null, 2));
 }
 function provisionIsolationHook(codeName) {
   const projectDir = getProjectDir(codeName);
@@ -3778,11 +3956,11 @@ function provisionIsolationHook(codeName) {
     "",
     "exit 0"
   ].join("\n") + "\n";
-  writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
+  writeFileSync5(hookScriptPath, hookScript, { mode: 493 });
   const settingsPath = join4(claudeDir, "settings.local.json");
   let settings = {};
   try {
-    settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
+    settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
   } catch {
   }
   const hooks = settings["hooks"] ?? {};
@@ -3797,13 +3975,13 @@ function provisionIsolationHook(codeName) {
     }
   ];
   settings["hooks"] = hooks;
-  writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
+  writeFileSync5(settingsPath, JSON.stringify(settings, null, 2));
 }
 function modifyJsonConfig(filePath, fn) {
   let originalContent;
   let config;
   try {
-    originalContent = readFileSync4(filePath, "utf-8");
+    originalContent = readFileSync5(filePath, "utf-8");
     config = JSON.parse(originalContent);
   } catch {
     return;
@@ -3814,7 +3992,7 @@ function modifyJsonConfig(filePath, fn) {
   const newContent = JSON.stringify(config, null, 2);
   if (newContent === originalContent)
     return;
-  writeFileSync4(filePath, newContent);
+  writeFileSync5(filePath, newContent);
 }
 var SECRETS_DENY_PERMISSIONS = [
   // Read blocks
@@ -3925,6 +4103,7 @@ function sanitizeMcpName(name) {
 }
 function buildChannelMessageHandlerAgent(args) {
   const mcpServerKeys = args?.mcpServerKeys ?? [];
+  const integrations = args?.integrations ?? [];
   const mcpWildcards = Array.from(new Set(mcpServerKeys.map((k) => `mcp__${sanitizeMcpName(k)}__*`)));
   const tools = [
     "Bash",
@@ -3937,6 +4116,19 @@ function buildChannelMessageHandlerAgent(args) {
     "Agent",
     ...mcpWildcards
   ].join(", ");
+  const integrationsBlock = integrations.length === 0 ? "" : `
+## Integrations available
+
+You inherit the parent agent's environment, including credentials for the integrations below. Env vars follow the convention \`<DEFINITION_ID>_ACCESS_TOKEN\` for OAuth and \`<DEFINITION_ID>_API_KEY\` for API-key integrations (e.g. \`GITHUB_ACCESS_TOKEN\`, \`POSTIZ_API_KEY\`). Where a CLI is listed, prefer it over raw curl \u2014 the CLI handles auth automatically.
+
+${integrations.map((i) => {
+    const cli = i.cliBinary ? ` \u2014 use the \`${i.cliBinary}\` CLI` : "";
+    const desc = i.description ? `. ${i.description}` : "";
+    return `- **${i.name}**${cli}${desc}`;
+  }).join("\n")}
+
+If asked about your capabilities, **check first** (run the CLI, echo the env var, or invoke an MCP tool) before answering. Do not claim a capability is absent without verifying \u2014 the parent's environment is yours.
+`;
   return `---
 name: channel-message-handler
 description: Handles a single inbound Slack/Telegram/Direct-Chat message end to end. Posts the reply itself via the matching channel tool. The parent agent dispatches to this subagent only for slow requests (\u2265 ~60s) so the parent's listener turn stays free for new inbound work.
@@ -3958,7 +4150,7 @@ Your job:
 3. End. Do not do additional follow-up work; if more is needed, the user will send another message.
 
 Do NOT post intermediate progress updates unless the work spans 5+ minutes \u2014 keep noise low. The parent already sent a single-line acknowledgement before dispatching you.
-`;
+${integrationsBlock}`;
 }
 function buildPostizMcpEntry(integration) {
   const rawBaseUrl = integration.config["base_url"];
@@ -4148,9 +4340,19 @@ var claudeCodeAdapter = {
       // turn return immediately on dispatch, so new inbound messages get a
       // fresh turn while the subagent does the work in parallel. Triggered
       // by the "Channel message triage" instruction in CLAUDE.md.
+      // ENG-4821: integrations are rendered into the subagent body so it
+      // stops claiming "no creds" for capabilities the parent has — and the
+      // sidecar JSON keeps incremental writeIntegrations syncs in lockstep.
       {
         relativePath: ".claude/agents/channel-message-handler.md",
-        content: buildChannelMessageHandlerAgent({ mcpServerKeys: initialMcpServerKeys })
+        content: buildChannelMessageHandlerAgent({
+          mcpServerKeys: initialMcpServerKeys,
+          integrations: integrationSummaries
+        })
+      },
+      {
+        relativePath: `provision/${INTEGRATIONS_SUMMARY_FILE}`,
+        content: JSON.stringify(integrationSummaries, null, 2)
       }
     ];
     const knowledgeEntries = input.knowledge ?? [];
@@ -4205,7 +4407,7 @@ ${sections}`
         } catch {
           continue;
         }
-        if (existsSync4(join4(agentRoot, "registration.json"))) {
+        if (existsSync5(join4(agentRoot, "registration.json"))) {
           agents.add(entry);
         }
       }
@@ -4219,14 +4421,14 @@ ${sections}`
       const projectDir = getProjectDir(codeName);
       mkdirSync4(agentDir, { recursive: true });
       mkdirSync4(projectDir, { recursive: true });
-      writeFileSync4(join4(agentDir, "registration.json"), JSON.stringify({
+      writeFileSync5(join4(agentDir, "registration.json"), JSON.stringify({
         code_name: codeName,
         team_dir: teamDir,
         project_dir: projectDir,
         framework: "claude-code",
         registered_at: (/* @__PURE__ */ new Date()).toISOString()
       }, null, 2));
-      if (existsSync4(teamDir)) {
+      if (existsSync5(teamDir)) {
         deployArtifactsToProject(codeName, teamDir);
       }
       return true;
@@ -4238,9 +4440,9 @@ ${sections}`
     try {
       const agentDir = getAgentDir(codeName);
       const regFile = join4(agentDir, "registration.json");
-      if (existsSync4(regFile)) {
-        const { unlinkSync: unlinkSync4 } = await import("fs");
-        unlinkSync4(regFile);
+      if (existsSync5(regFile)) {
+        const { unlinkSync: unlinkSync5 } = await import("fs");
+        unlinkSync5(regFile);
       }
       return true;
     } catch {
@@ -4264,7 +4466,7 @@ ${sections}`
     }
     if (envLines.length > 1) {
       const envPath = join4(agentDir, ".env");
-      writeFileSync4(envPath, envLines.join("\n") + "\n");
+      writeFileSync5(envPath, envLines.join("\n") + "\n");
       chmodSync4(envPath, SECRET_FILE_MODE);
     }
   },
@@ -4313,13 +4515,15 @@ ${sections}`
       mkdirSync4(dirname4(provisionMcpPath), { recursive: true });
       let mcpConfig2 = { mcpServers: {} };
       try {
-        mcpConfig2 = JSON.parse(readFileSync4(provisionMcpPath, "utf-8"));
+        mcpConfig2 = JSON.parse(readFileSync5(provisionMcpPath, "utf-8"));
         if (!mcpConfig2.mcpServers)
           mcpConfig2.mcpServers = {};
       } catch {
       }
       mcpConfig2.mcpServers["telegram"] = telegramEntry;
-      writeFileSync4(provisionMcpPath, JSON.stringify(mcpConfig2, null, 2));
+      if (!writeMcpJsonGuarded(codeName, provisionMcpPath, mcpConfig2)) {
+        return;
+      }
       syncMcpToProject(codeName);
       return;
     }
@@ -4330,7 +4534,7 @@ ${sections}`
       if (channelId === "discord") {
         const botToken = config["bot_token"];
         if (botToken) {
-          writeFileSync4(join4(channelDir, ".env"), `DISCORD_BOT_TOKEN=${botToken}
+          writeFileSync5(join4(channelDir, ".env"), `DISCORD_BOT_TOKEN=${botToken}
 `);
         }
       } else if (channelId === "slack") {
@@ -4353,8 +4557,8 @@ ${sections}`
         if (botToken) {
           const localSlackChannel = join4(getHomeDir3(), ".augmented", "_mcp", "slack-channel.js");
           const slackEntry = {
-            command: existsSync4(localSlackChannel) ? "node" : "npx",
-            args: existsSync4(localSlackChannel) ? [localSlackChannel] : ["-y", "@augmented/claude-code-channel-slack"],
+            command: existsSync5(localSlackChannel) ? "node" : "npx",
+            args: existsSync5(localSlackChannel) ? [localSlackChannel] : ["-y", "@augmented/claude-code-channel-slack"],
             env: {
               SLACK_BOT_TOKEN: botToken,
               ...appToken ? { SLACK_APP_TOKEN: appToken } : {},
@@ -4372,16 +4576,18 @@ ${sections}`
           mkdirSync4(dirname4(provisionMcpPath), { recursive: true });
           let mcpConfig2 = { mcpServers: {} };
           try {
-            mcpConfig2 = JSON.parse(readFileSync4(provisionMcpPath, "utf-8"));
+            mcpConfig2 = JSON.parse(readFileSync5(provisionMcpPath, "utf-8"));
             if (!mcpConfig2.mcpServers)
               mcpConfig2.mcpServers = {};
           } catch {
           }
           mcpConfig2.mcpServers["slack"] = slackEntry;
-          writeFileSync4(provisionMcpPath, JSON.stringify(mcpConfig2, null, 2));
+          if (!writeMcpJsonGuarded(codeName, provisionMcpPath, mcpConfig2)) {
+            return;
+          }
           syncMcpToProject(codeName);
           const staleChannelsPath = join4(getProjectDir(codeName), ".mcp-channels.json");
-          if (existsSync4(staleChannelsPath)) {
+          if (existsSync5(staleChannelsPath)) {
             try {
               rmSync(staleChannelsPath, { force: true });
             } catch {
@@ -4394,7 +4600,7 @@ ${sections}`
     const mcpJsonPath = join4(agentDir, "provision", ".mcp.json");
     let mcpConfig;
     try {
-      mcpConfig = JSON.parse(readFileSync4(mcpJsonPath, "utf-8"));
+      mcpConfig = JSON.parse(readFileSync5(mcpJsonPath, "utf-8"));
     } catch {
       mcpConfig = { mcpServers: {} };
     }
@@ -4430,7 +4636,7 @@ ${sections}`
         ...oneshotBlockKitAskUserEnabled && process.env["AGT_API_KEY"] ? { AGT_API_KEY: process.env["AGT_API_KEY"] } : {},
         ...oneshotBlockKitAskUserEnabled && options?.agentId ? { AGT_AGENT_ID: options.agentId } : {}
       } : {};
-      if (isPersistent && existsSync4(localSlackChannel)) {
+      if (isPersistent && existsSync5(localSlackChannel)) {
         mcpServers["slack"] = {
           command: "node",
           args: [localSlackChannel],
@@ -4456,15 +4662,16 @@ ${sections}`
         };
       }
     }
-    writeFileSync4(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
-    syncMcpToProject(codeName);
+    if (writeMcpJsonGuarded(codeName, mcpJsonPath, mcpConfig)) {
+      syncMcpToProject(codeName);
+    }
   },
   hasChannelCredentials(codeName, channelId) {
     const provisionMcpPath = join4(getAgentDir(codeName), "provision", ".mcp.json");
-    if (!existsSync4(provisionMcpPath))
+    if (!existsSync5(provisionMcpPath))
       return false;
     try {
-      const parsed = JSON.parse(readFileSync4(provisionMcpPath, "utf-8"));
+      const parsed = JSON.parse(readFileSync5(provisionMcpPath, "utf-8"));
       return Boolean(parsed.mcpServers?.[channelId]);
     } catch {
       return false;
@@ -4504,12 +4711,22 @@ ${sections}`
     const schedulesPath = join4(agentDir, "schedules.json");
     const mapped = mapScheduledTasks(tasks);
     mkdirSync4(agentDir, { recursive: true });
-    writeFileSync4(schedulesPath, JSON.stringify({ schedules: mapped }, null, 2));
+    writeFileSync5(schedulesPath, JSON.stringify({ schedules: mapped }, null, 2));
     return Promise.resolve();
   },
   writeIntegrations(codeName, integrations) {
     const agentDir = getAgentDir(codeName);
     mkdirSync4(agentDir, { recursive: true });
+    const summariesForSidecar = integrations.map((i) => {
+      const def = INTEGRATION_REGISTRY.find((d) => d.id === i.definition_id);
+      return {
+        id: i.definition_id,
+        name: def?.name || i.display_name || i.definition_id,
+        cliBinary: def?.cli_tool?.binary,
+        description: def?.description || (i.auth_type === "managed" ? "Managed integration via Composio" : void 0)
+      };
+    });
+    writeIntegrationsSummaryForAgent(codeName, summariesForSidecar);
     const decryptedIntegrations = integrations.map((integration) => ({
       ...integration,
       credentials: decryptIntegrationCredentials(integration.credentials)
@@ -4542,7 +4759,7 @@ ${sections}`
     }
     if (envLines.length > 1) {
       const envPath = join4(agentDir, ".env.integrations");
-      writeFileSync4(envPath, envLines.join("\n") + "\n");
+      writeFileSync5(envPath, envLines.join("\n") + "\n");
       chmodSync4(envPath, SECRET_FILE_MODE);
     }
     writeXurlStoreForIntegrations(decryptedIntegrations);
@@ -4574,53 +4791,50 @@ ${sections}`
     }
     const hasCloudBroker = integrations.some((i) => i.definition_id === "cloud-broker");
     if (hasCloudBroker) {
-      const existingAgentId = readExistingMcpEnvVar(codeName, "cloud-broker", "AGT_AGENT_ID");
-      this.writeMcpServer(codeName, "cloud-broker", {
-        command: "npx",
-        args: ["-y", "@integrity-labs/cloud-broker@latest"],
-        env: {
-          AGT_HOST: "${AGT_HOST}",
-          AGT_API_KEY: "${AGT_API_KEY}",
-          AGT_AGENT_ID: existingAgentId ?? "${AGT_AGENT_ID}",
-          // ENG-4788: cloud-broker@0.6+ exits at startup if AGT_RUN_ID
-          // is missing. Mirror buildMcpJson's entry on incremental sync
-          // so an agent that connects AWS post-provision boots cleanly.
-          AGT_RUN_ID: "${AGT_RUN_ID}",
-          PATH: process.env["PATH"] ?? "",
-          HOME: process.env["HOME"] ?? ""
-        }
-      });
+      const brokerAgentId = resolveBrokerAgentId(codeName);
+      if (!brokerAgentId) {
+        process.stderr.write(`[manager-worker] [cloud-broker] skipping write for '${codeName}': no real AGT_AGENT_ID available (no existing broker entry, no augmented entry to copy from). The full-provision artifact pipeline will recreate this on the next cycle.
+`);
+      } else {
+        this.writeMcpServer(codeName, "cloud-broker", {
+          command: "npx",
+          args: ["-y", "@integrity-labs/cloud-broker@latest"],
+          env: {
+            AGT_HOST: "${AGT_HOST}",
+            AGT_API_KEY: "${AGT_API_KEY}",
+            AGT_AGENT_ID: brokerAgentId,
+            // ENG-4788: cloud-broker@0.6+ exits at startup if AGT_RUN_ID
+            // is missing. Mirror buildMcpJson's entry on incremental sync
+            // so an agent that connects AWS post-provision boots cleanly.
+            AGT_RUN_ID: "${AGT_RUN_ID}",
+            PATH: process.env["PATH"] ?? "",
+            HOME: process.env["HOME"] ?? ""
+          }
+        });
+      }
     }
     const projectDir = getProjectDir(codeName);
     const claudeMdPath = join4(projectDir, "CLAUDE.md");
     try {
-      const existing = readFileSync4(claudeMdPath, "utf-8");
-      const summaries = integrations.map((i) => {
-        const def = INTEGRATION_REGISTRY.find((d) => d.id === i.definition_id);
-        return {
-          id: i.definition_id,
-          name: def?.name || i.display_name || i.definition_id,
-          cliBinary: def?.cli_tool?.binary,
-          description: def?.description || (i.auth_type === "managed" ? "Managed integration via Composio" : void 0)
-        };
-      });
-      const newSection = buildIntegrationsSection(summaries);
+      const existing = readFileSync5(claudeMdPath, "utf-8");
+      const newSection = buildIntegrationsSection(summariesForSidecar);
       let updated;
       if (existing.includes("## Integrations")) {
         updated = existing.replace(/## Integrations[\s\S]*?(?=## Rules)/, newSection);
       } else {
         updated = existing.replace("## Rules", `${newSection}## Rules`);
       }
-      writeFileSync4(claudeMdPath, updated);
+      writeFileSync5(claudeMdPath, updated);
       const agentDir2 = getAgentDir(codeName);
       const envSrc = join4(agentDir2, ".env.integrations");
       try {
-        const envContent = readFileSync4(envSrc, "utf-8");
-        writeFileSync4(join4(projectDir, ".env.integrations"), envContent);
+        const envContent = readFileSync5(envSrc, "utf-8");
+        writeFileSync5(join4(projectDir, ".env.integrations"), envContent);
       } catch {
       }
     } catch {
     }
+    renderChannelMessageHandlerForAgent(codeName);
   },
   writeMcpServer(codeName, serverId, config) {
     const agentDir = getAgentDir(codeName);
@@ -4628,7 +4842,7 @@ ${sections}`
     mkdirSync4(join4(agentDir, "provision"), { recursive: true });
     let mcpConfig;
     try {
-      mcpConfig = JSON.parse(readFileSync4(mcpJsonPath, "utf-8"));
+      mcpConfig = JSON.parse(readFileSync5(mcpJsonPath, "utf-8"));
     } catch {
       mcpConfig = { mcpServers: {} };
     }
@@ -4680,8 +4894,9 @@ ${sections}`
         serverEntry["env"] = config.env;
     }
     mcpServers[serverId] = serverEntry;
-    writeFileSync4(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
-    syncMcpToProject(codeName);
+    if (writeMcpJsonGuarded(codeName, mcpJsonPath, mcpConfig)) {
+      syncMcpToProject(codeName);
+    }
   },
   getMcpPath(codeName) {
     return join4(getAgentDir(codeName), "provision", ".mcp.json");
@@ -4691,7 +4906,7 @@ ${sections}`
     const mcpJsonPath = join4(agentDir, "provision", ".mcp.json");
     let mcpConfig;
     try {
-      mcpConfig = JSON.parse(readFileSync4(mcpJsonPath, "utf-8"));
+      mcpConfig = JSON.parse(readFileSync5(mcpJsonPath, "utf-8"));
     } catch {
       return;
     }
@@ -4699,8 +4914,9 @@ ${sections}`
     if (!mcpServers || !(serverId in mcpServers))
       return;
     delete mcpServers[serverId];
-    writeFileSync4(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
-    syncMcpToProject(codeName);
+    if (writeMcpJsonGuarded(codeName, mcpJsonPath, mcpConfig)) {
+      syncMcpToProject(codeName);
+    }
   },
   installSkillFiles(codeName, skillId, files) {
     assertValidCodeName(skillId);
@@ -4720,13 +4936,13 @@ ${sections}`
           throw new Error(`Path traversal detected: ${file.relativePath} resolves outside ${skillDir}`);
         }
         mkdirSync4(join4(filePath, ".."), { recursive: true });
-        if (isPluginManaged && existsSync4(filePath)) {
+        if (isPluginManaged && existsSync5(filePath)) {
           try {
             chmodSync4(filePath, READ_WRITE_MODE);
           } catch {
           }
         }
-        writeFileSync4(filePath, file.content);
+        writeFileSync5(filePath, file.content);
         if (isPluginManaged) {
           try {
             chmodSync4(filePath, READ_ONLY_MODE);
@@ -4742,7 +4958,7 @@ ${sections}`
     mkdirSync4(agentDir, { recursive: true });
     let pluginsConfig;
     try {
-      pluginsConfig = JSON.parse(readFileSync4(pluginsJsonPath, "utf-8"));
+      pluginsConfig = JSON.parse(readFileSync5(pluginsJsonPath, "utf-8"));
     } catch {
       pluginsConfig = { plugins: {} };
     }
@@ -4755,7 +4971,7 @@ ${sections}`
       installed_at: (/* @__PURE__ */ new Date()).toISOString(),
       ...pluginConfig ? { config: pluginConfig } : {}
     };
-    writeFileSync4(pluginsJsonPath, JSON.stringify(pluginsConfig, null, 2));
+    writeFileSync5(pluginsJsonPath, JSON.stringify(pluginsConfig, null, 2));
   },
   /**
    * Full plugin provisioning: install scripts, register hooks, apply permissions,
@@ -4790,7 +5006,7 @@ ${sections}`
       const settingsPath = join4(claudeDir, "settings.local.json");
       let settings = {};
       try {
-        settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
+        settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
       } catch {
       }
       const existingHooks = settings["hooks"] ?? {};
@@ -4824,13 +5040,13 @@ ${sections}`
         }
       }
       settings["hooks"] = existingHooks;
-      writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
+      writeFileSync5(settingsPath, JSON.stringify(settings, null, 2));
     }
     if (plugin.allowed_tools.length > 0) {
       const settingsPath = join4(claudeDir, "settings.local.json");
       let settings = {};
       try {
-        settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
+        settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
       } catch {
       }
       const existingPerms = settings["permissions"] ?? {};
@@ -4842,12 +5058,12 @@ ${sections}`
       }
       existingPerms["allow"] = allowList;
       settings["permissions"] = existingPerms;
-      writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
+      writeFileSync5(settingsPath, JSON.stringify(settings, null, 2));
     }
     if (contextValues && Object.keys(contextValues).length > 0) {
       const configDir = join4(projectDir, `.${plugin.slug}`);
       mkdirSync4(configDir, { recursive: true });
-      writeFileSync4(join4(configDir, "config.json"), JSON.stringify(contextValues, null, 2));
+      writeFileSync5(join4(configDir, "config.json"), JSON.stringify(contextValues, null, 2));
     }
   },
   executePluginHook(ctx) {
@@ -4909,7 +5125,7 @@ ${sections}`
     if (Object.keys(tokens).length === 0)
       return;
     const tokenPath = join4(agentDir, ".tokens.json");
-    writeFileSync4(tokenPath, JSON.stringify(tokens, null, 2));
+    writeFileSync5(tokenPath, JSON.stringify(tokens, null, 2));
     chmodSync4(tokenPath, SECRET_FILE_MODE);
   }
 };
@@ -5199,13 +5415,13 @@ function jsonOutput(data) {
 }
 
 // src/lib/config.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, existsSync as existsSync6 } from "fs";
 import { join as join6 } from "path";
 import { homedir as homedir5 } from "os";
 var AUGMENTED_DIR2 = join6(homedir5(), ".augmented");
 var CONFIG_PATH = join6(AUGMENTED_DIR2, "config.json");
 function ensureAugmentedDir() {
-  if (!existsSync5(AUGMENTED_DIR2)) {
+  if (!existsSync6(AUGMENTED_DIR2)) {
     mkdirSync5(AUGMENTED_DIR2, { recursive: true });
   }
 }
@@ -5219,7 +5435,7 @@ function loadFromShellProfile(force = false) {
   const candidates = shell.includes("zsh") ? [join6(home, ".zshrc"), join6(home, ".zprofile")] : shell.includes("fish") ? [join6(home, ".config", "fish", "config.fish")] : [join6(home, ".bashrc"), join6(home, ".bash_profile")];
   for (const profile of candidates) {
     try {
-      const content = readFileSync5(profile, "utf-8");
+      const content = readFileSync6(profile, "utf-8");
       for (const key of ["AGT_HOST", "AGT_API_KEY", "AGT_TEAM"]) {
         if (!force && process.env[key]) continue;
         const match = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map(
@@ -5244,7 +5460,7 @@ function getApiKey() {
 }
 function getConfig() {
   try {
-    const raw = readFileSync5(CONFIG_PATH, "utf-8");
+    const raw = readFileSync6(CONFIG_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -5252,7 +5468,7 @@ function getConfig() {
 }
 function saveConfig(config) {
   ensureAugmentedDir();
-  writeFileSync5(CONFIG_PATH, JSON.stringify(config, null, 2));
+  writeFileSync6(CONFIG_PATH, JSON.stringify(config, null, 2));
 }
 function getActiveTeam() {
   const envTeam = process.env["AGT_TEAM"];
@@ -5599,7 +5815,12 @@ var SLACK_SCOPE_REGISTRY = [
     name: "Write Bot Profile",
     description: "Update the bot's own profile (status emoji + status text). Used to surface live/offline state to operators without polling.",
     category: "users",
-    risk: "low"
+    risk: "low",
+    // ENG-4812: Slack rejects this scope under oauth_config.scopes.bot
+    // with `illegal_bot_scopes`. It must be granted via a user token —
+    // which is what `setBotStatus()` (calling users.profile.set in
+    // packages/mcp/src/slack-channel.ts) actually requires anyway.
+    token_type: "user"
   },
   // ── Channel Management ───────────────────────────────────────────────────
   {
@@ -5741,6 +5962,9 @@ function getScopesByCategory() {
   }
   return map;
 }
+function getSlackScopeDefinition(scope) {
+  return SLACK_SCOPE_REGISTRY.find((s) => s.scope === scope);
+}
 var SLACK_SCOPE_PRESETS = {
   minimal: [
     "app_mentions:read",
@@ -5826,9 +6050,23 @@ function generateSlackAppManifest(input) {
     },
     oauth_config: {
       ...redirect_urls && redirect_urls.length > 0 ? { redirect_urls } : {},
-      scopes: {
-        bot: [...scopes]
-      }
+      // ENG-4812: partition by token_type so user-only scopes
+      // (e.g. users.profile:write) don't end up under `bot` and
+      // trigger Slack's `illegal_bot_scopes` rejection. Scopes
+      // without an explicit token_type default to 'bot' — matches
+      // pre-fix behaviour for the registry's standard-token-set.
+      scopes: (() => {
+        const botScopes = [];
+        const userScopes = [];
+        for (const scope of scopes) {
+          const def = getSlackScopeDefinition(scope);
+          if (def?.token_type === "user")
+            userScopes.push(scope);
+          else
+            botScopes.push(scope);
+        }
+        return userScopes.length > 0 ? { bot: botScopes, user: userScopes } : { bot: botScopes };
+      })()
     },
     settings: {
       ...botEvents.size > 0 ? { event_subscriptions: { bot_events: [...botEvents].sort() } } : {},
@@ -7599,13 +7837,13 @@ function provision(input, frameworkId = "openclaw") {
 
 // src/commands/manager.ts
 import chalk3 from "chalk";
-import { existsSync as existsSync7, realpathSync } from "fs";
+import { existsSync as existsSync8, realpathSync } from "fs";
 import { join as join8 } from "path";
 import { homedir as homedir6, userInfo } from "os";
 import { spawn as spawn3 } from "child_process";
 
 // src/lib/watchdog.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync6, unlinkSync as unlinkSync3, existsSync as existsSync6, mkdirSync as mkdirSync6, openSync, closeSync, chmodSync as chmodSync5 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4, existsSync as existsSync7, mkdirSync as mkdirSync6, openSync, closeSync, chmodSync as chmodSync5 } from "fs";
 import { join as join7 } from "path";
 import { spawn as spawn2, execFileSync } from "child_process";
 var DEFAULT_CONFIG_DIR = join7(process.env["HOME"] ?? "/tmp", ".augmented");
@@ -7617,17 +7855,17 @@ function getManagerPaths(configDir) {
   };
 }
 function ensureDir2(configDir) {
-  if (!existsSync6(configDir)) {
+  if (!existsSync7(configDir)) {
     mkdirSync6(configDir, { recursive: true });
   }
 }
 function writePidFile(configDir, pid) {
   ensureDir2(configDir);
-  writeFileSync6(getManagerPaths(configDir).pidFile, String(pid), { mode: 384 });
+  writeFileSync7(getManagerPaths(configDir).pidFile, String(pid), { mode: 384 });
 }
 function readPidFile(configDir) {
   try {
-    const raw = readFileSync6(getManagerPaths(configDir).pidFile, "utf-8").trim();
+    const raw = readFileSync7(getManagerPaths(configDir).pidFile, "utf-8").trim();
     const pid = parseInt(raw, 10);
     return isNaN(pid) ? null : pid;
   } catch {
@@ -7636,7 +7874,7 @@ function readPidFile(configDir) {
 }
 function removePidFile(configDir) {
   try {
-    unlinkSync3(getManagerPaths(configDir).pidFile);
+    unlinkSync4(getManagerPaths(configDir).pidFile);
   } catch {
   }
 }
@@ -7665,7 +7903,7 @@ function defaultPgrep() {
 }
 function readStateFile(configDir) {
   try {
-    const raw = readFileSync6(getManagerPaths(configDir).stateFile, "utf-8");
+    const raw = readFileSync7(getManagerPaths(configDir).stateFile, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -7673,7 +7911,7 @@ function readStateFile(configDir) {
 }
 function removeStateFile(configDir) {
   try {
-    unlinkSync3(getManagerPaths(configDir).stateFile);
+    unlinkSync4(getManagerPaths(configDir).stateFile);
   } catch {
   }
 }
@@ -7721,7 +7959,7 @@ function startWatchdog(opts) {
     const deadline = Date.now() + 5e3;
     const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
     while (Date.now() < deadline) {
-      if (existsSync6(pidFile)) {
+      if (existsSync7(pidFile)) {
         return { pid: child.pid };
       }
       if (child.exitCode !== null) {
@@ -8045,7 +8283,7 @@ function resolveStableAgtBin(rawPath) {
   if (!prefix || !formula) return rawPath;
   const candidates = [`${prefix}/bin/${formula}`, `${prefix}/bin/agt`];
   for (const candidate of candidates) {
-    if (!existsSync7(candidate)) continue;
+    if (!existsSync8(candidate)) continue;
     try {
       realpathSync(candidate);
       return candidate;
@@ -8276,4 +8514,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-KLNFWXOI.js.map
+//# sourceMappingURL=chunk-DVWBVANP.js.map