@integrity-labs/agt-cli 0.19.14 → 0.19.16

package/dist/{claude-pair-runtime-VXN4NVGR.js → claude-pair-runtime-UF4OMFCA.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-CFDGW7QE.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-M2GVL6Z6.js");
   const claudeBin = resolveClaudeBinary();
   try {
     await execFileAsync("tmux", [
@@ -357,4 +357,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-VXN4NVGR.js.map
+//# sourceMappingURL=claude-pair-runtime-UF4OMFCA.js.map

package/dist/lib/manager-worker.js

@@ -22,7 +22,7 @@ import {
   resolveChannels,
   resolveDmTarget,
   wrapScheduledTaskPrompt
-} from "../chunk-KLNFWXOI.js";
+} from "../chunk-NT26H4DO.js";
 import {
   findTaskByTemplate,
   getProjectDir,
@@ -39,6 +39,7 @@ import {
   isAgentIdle,
   isSessionHealthy,
   isStaleForToday,
+  parsePsRows,
   peekCurrentSession,
   prepareForRespawn,
   reapOrphanChannelMcps,
@@ -48,7 +49,7 @@ import {
   startPersistentSession,
   stopAllSessionsAndWait,
   stopPersistentSession
-} from "../chunk-HA4IUBVC.js";
+} from "../chunk-3K3RO5NS.js";
 
 // src/lib/manager-worker.ts
 import { createHash } from "crypto";
@@ -59,6 +60,220 @@ import { join as join4, dirname } from "path";
 import { homedir as homedir3 } from "os";
 import { fileURLToPath } from "url";
 
+// src/lib/mcp-config-drift.ts
+function decideMcpDriftAction(currentHash, knownHash) {
+  if (!currentHash) return { kind: "no-config" };
+  if (!knownHash) return { kind: "baseline", hash: currentHash };
+  if (knownHash === currentHash) return { kind: "no-drift" };
+  return { kind: "drift", previous: knownHash, current: currentHash };
+}
+
+// src/lib/stale-mcp-reaper.ts
+import { execFileSync } from "child_process";
+function parseEnvIntegrationsEntries(content) {
+  const entries = /* @__PURE__ */ new Map();
+  for (const raw of content.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const name = line.slice(0, eq).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) continue;
+    const value = line.slice(eq + 1);
+    entries.set(name, value);
+  }
+  return entries;
+}
+function diffEnvIntegrations(oldContent, newContent) {
+  const oldEntries = oldContent === void 0 ? /* @__PURE__ */ new Map() : parseEnvIntegrationsEntries(oldContent);
+  const newEntries = parseEnvIntegrationsEntries(newContent);
+  const changed = /* @__PURE__ */ new Set();
+  for (const [name, value] of newEntries) {
+    if (oldEntries.get(name) !== value) changed.add(name);
+  }
+  for (const name of oldEntries.keys()) {
+    if (!newEntries.has(name)) changed.add(name);
+  }
+  return [...changed];
+}
+function findMcpServersUsingVars(mcp, changedVars) {
+  const changedSet = new Set(changedVars);
+  if (!mcp?.mcpServers || changedSet.size === 0) return [];
+  const result = [];
+  for (const [serverKey, entry] of Object.entries(mcp.mcpServers)) {
+    if (!entry || typeof entry !== "object") continue;
+    const env = entry.env;
+    if (!env || typeof env !== "object") continue;
+    let matches = false;
+    for (const value of Object.values(env)) {
+      if (typeof value !== "string") continue;
+      const placeholderMatches = value.match(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g);
+      if (placeholderMatches) {
+        for (const ph of placeholderMatches) {
+          const name = ph.slice(2, -1);
+          if (changedSet.has(name)) {
+            matches = true;
+            break;
+          }
+        }
+      }
+      if (matches) break;
+    }
+    if (matches) result.push(serverKey);
+  }
+  return result;
+}
+function buildArgvMatchersForEntry(key, entry) {
+  const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const patterns = [];
+  const args = entry?.args ?? [];
+  for (let i = args.length - 1; i >= 0; i--) {
+    const arg = args[i];
+    if (typeof arg !== "string" || !arg) continue;
+    if (arg.startsWith("-")) continue;
+    const stripped = arg.replace(
+      /@[^/@]*$/,
+      (m) => (
+        // @latest, @1.2.3, etc. — drop. But @scope at the START of a
+        // package spec must NOT be stripped, so we only strip a tail
+        // `@...` if it doesn't itself start with a slash inside.
+        // The regex above only matches a single trailing `@...`
+        // segment after the last `/`, so this is safe for `@scope/pkg`.
+        m.includes("/") ? m : ""
+      )
+    );
+    const tail = "(?![A-Za-z0-9_-])";
+    if (/^@?[a-z0-9]([a-z0-9._-]*\/)?[a-z0-9._-]+$/i.test(stripped)) {
+      patterns.push(new RegExp(`${escapeRe(stripped)}${tail}`));
+      const basename = stripped.split("/").pop();
+      if (basename && basename !== stripped) {
+        patterns.push(new RegExp(`${escapeRe(basename)}${tail}`));
+      }
+      break;
+    }
+    if (stripped.includes("/")) {
+      const basename = stripped.split("/").pop();
+      if (basename) {
+        patterns.push(new RegExp(`${escapeRe(basename)}${tail}`));
+        break;
+      }
+    }
+  }
+  if (patterns.length === 0) {
+    const safe = escapeRe(key);
+    patterns.push(new RegExp(`(?<![A-Za-z0-9_])${safe}(?![A-Za-z0-9_])`));
+    if (safe.includes("_")) {
+      const dashed = safe.replace(/_/g, "-");
+      patterns.push(new RegExp(`(?<![A-Za-z0-9_])${dashed}(?![A-Za-z0-9_])`));
+    }
+  }
+  return patterns;
+}
+function buildClaudeAgentMatcher(codeName) {
+  const safe = codeName.replace(/[^A-Za-z0-9_-]/g, "");
+  return new RegExp(`\\bclaude\\b.*--name\\s+agt-${safe}(?=\\s|$)`);
+}
+function findMcpChildrenForAgent(args) {
+  const { rows, codeName, serverKeys, mcpJson } = args;
+  const maxDepth = args.maxDepth ?? 8;
+  if (serverKeys.length === 0 || rows.length === 0) return [];
+  const claudeMatcher = buildClaudeAgentMatcher(codeName);
+  const argvMatchers = [];
+  for (const key of serverKeys) {
+    const entry = mcpJson?.mcpServers?.[key];
+    argvMatchers.push(...buildArgvMatchersForEntry(key, entry));
+  }
+  const byPid = new Map(rows.map((r) => [r.pid, r]));
+  const matched = [];
+  for (const row of rows) {
+    if (!argvMatchers.some((re) => re.test(row.args))) continue;
+    if (/\bclaude\b/.test(row.args) && row.args.includes(`--name agt-${codeName}`)) continue;
+    let cur = byPid.get(row.ppid);
+    let belongs = false;
+    for (let depth = 0; depth < maxDepth && cur; depth++) {
+      if (claudeMatcher.test(cur.args)) {
+        belongs = true;
+        break;
+      }
+      if (cur.pid === 1) break;
+      cur = byPid.get(cur.ppid);
+    }
+    if (belongs) matched.push(row.pid);
+  }
+  return matched;
+}
+function reapStaleMcpChildren(args) {
+  const { log: log2, codeName, serverKeys, mcpJson, graceMs = 5e3 } = args;
+  if (serverKeys.length === 0) return [];
+  const runPs = args.runPs ?? (() => execFileSync("ps", ["-eo", "pid,ppid,args"], { encoding: "utf-8", timeout: 5e3 }));
+  const killProcess = args.killProcess ?? ((pid, signal) => {
+    try {
+      process.kill(pid, signal);
+    } catch {
+    }
+  });
+  const isAlive = args.isAlive ?? ((pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  let psOutput;
+  try {
+    psOutput = runPs();
+  } catch (err) {
+    log2(`[stale-mcp-reaper] ps invocation failed for '${codeName}': ${err.message} \u2014 skipping reap`);
+    return [];
+  }
+  const rows = parsePsRows(psOutput);
+  const targets = findMcpChildrenForAgent({ rows, codeName, serverKeys, mcpJson });
+  if (targets.length === 0) return [];
+  const byPid = new Map(rows.map((r) => [r.pid, r]));
+  const describe = (pid) => {
+    const argv = byPid.get(pid)?.args ?? "";
+    const pkgMatch = argv.match(/(@[a-z0-9_-]+\/[a-z0-9_-]+|[a-z0-9_-]+-mcp-server|[a-z0-9_-]+-mcp\b)/i);
+    return pkgMatch ? `${pkgMatch[1]} (pid ${pid})` : `pid ${pid}`;
+  };
+  log2(
+    `[stale-mcp-reaper] '${codeName}': rotating ${targets.length} stale MCP child(ren) for [${serverKeys.join(", ")}]: ${targets.map(describe).join(", ")}`
+  );
+  for (const pid of targets) {
+    killProcess(pid, "SIGTERM");
+  }
+  setTimeout(() => {
+    try {
+      let freshPsOutput;
+      try {
+        freshPsOutput = runPs();
+      } catch (err) {
+        log2(`[stale-mcp-reaper] '${codeName}': fresh ps for SIGKILL re-verify failed: ${err.message} \u2014 skipping SIGKILL pass`);
+        return;
+      }
+      const stillOwned = new Set(
+        findMcpChildrenForAgent({
+          rows: parsePsRows(freshPsOutput),
+          codeName,
+          serverKeys,
+          mcpJson
+        })
+      );
+      const stragglers = targets.filter((pid) => isAlive(pid) && stillOwned.has(pid));
+      if (stragglers.length === 0) return;
+      log2(
+        `[stale-mcp-reaper] '${codeName}': ${stragglers.length} child(ren) survived SIGTERM; sending SIGKILL: ${stragglers.map(describe).join(", ")}`
+      );
+      for (const pid of stragglers) {
+        killProcess(pid, "SIGKILL");
+      }
+    } catch (err) {
+      log2(`[stale-mcp-reaper] '${codeName}': error in SIGKILL pass: ${err.message}`);
+    }
+  }, graceMs).unref();
+  return targets;
+}
+
 // src/lib/channel-restart-decision.ts
 function launchableChannelIds(channelConfigs) {
   if (!channelConfigs) return /* @__PURE__ */ new Set();
@@ -649,7 +864,7 @@ function saveChannelHashCache(source, configDir) {
 }
 
 // src/lib/channel-sweep.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 var CHANNEL_BASENAMES = [
   "slack-channel",
   "direct-chat-channel",
@@ -812,7 +1027,7 @@ function resolveLiveAnchorPids(agentCodeNames) {
   for (const codeName of agentCodeNames) {
     const pids = /* @__PURE__ */ new Set();
     try {
-      const out = execFileSync("tmux", ["list-panes", "-t", `agt-${codeName}`, "-F", "#{pane_pid}"], {
+      const out = execFileSync2("tmux", ["list-panes", "-t", `agt-${codeName}`, "-F", "#{pane_pid}"], {
         encoding: "utf-8",
         timeout: 2e3,
         stdio: ["ignore", "pipe", "ignore"]
@@ -832,7 +1047,7 @@ async function sweepChannelProcesses(opts) {
   const kill = opts.killFn ?? defaultKill;
   let psOutput = "";
   try {
-    psOutput = execFileSync("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
+    psOutput = execFileSync2("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
       encoding: "utf-8",
       timeout: 5e3,
       maxBuffer: 10 * 1024 * 1024
@@ -869,7 +1084,7 @@ function defaultKillSignal(pid, signal) {
   }
 }
 function defaultPs() {
-  return execFileSync("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
+  return execFileSync2("ps", ["eww", "-o", "pid=,ppid=,etime=,command="], {
     encoding: "utf-8",
     timeout: 5e3,
     maxBuffer: 10 * 1024 * 1024
@@ -1593,6 +1808,7 @@ function scheduleSessionRestart(codeName, delayMs, reason) {
   const timer = setTimeout(() => {
     pendingSessionRestarts.delete(codeName);
     stopPersistentSession(codeName, log);
+    runningMcpHashes.delete(codeName);
     log(`[hot-reload] Session stopped for '${codeName}' \u2014 will respawn with ${reason}`);
   }, delayMs);
   timer.unref?.();
@@ -1607,6 +1823,38 @@ function cancelPendingSessionRestart(codeName) {
 }
 var writtenHashes = /* @__PURE__ */ new Map();
 var knownSecretsHashes = /* @__PURE__ */ new Map();
+var runningMcpHashes = /* @__PURE__ */ new Map();
+function projectMcpHash(codeName, projectDir) {
+  try {
+    return createHash("sha256").update(readFileSync3(join4(projectDir, ".mcp.json"))).digest("hex");
+  } catch {
+    return null;
+  }
+}
+function stopPersistentSessionAndForgetMcpBaseline(codeName) {
+  cancelPendingSessionRestart(codeName);
+  stopPersistentSession(codeName, log);
+  runningMcpHashes.delete(codeName);
+}
+function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
+  const currentHash = projectMcpHash(codeName, projectDir);
+  const action = decideMcpDriftAction(currentHash, runningMcpHashes.get(codeName));
+  switch (action.kind) {
+    case "no-config":
+    case "no-drift":
+      return;
+    case "baseline":
+      runningMcpHashes.set(codeName, action.hash);
+      return;
+    case "drift":
+      log(
+        `[hot-reload] .mcp.json content changed for '${codeName}' (${action.previous.slice(0, 12)} \u2192 ${action.current.slice(0, 12)}); scheduling restart (ENG-4897)`
+      );
+      scheduleSessionRestart(codeName, 0, ".mcp.json content change (ENG-4897)");
+      runningMcpHashes.delete(codeName);
+      return;
+  }
+}
 var knownChannelConfigHashes = /* @__PURE__ */ new Map();
 var knownModels = /* @__PURE__ */ new Map();
 var knownTasksHashes = /* @__PURE__ */ new Map();
@@ -1681,10 +1929,10 @@ function clearAgentCaches(agentId, codeName) {
 var cachedFrameworkVersion = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
-var agtCliVersion = true ? "0.19.14" : "dev";
-function resolveBrewPath(execFileSync2) {
+var agtCliVersion = true ? "0.19.16" : "dev";
+function resolveBrewPath(execFileSync3) {
   try {
-    const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
+    const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
     if (out) return out;
   } catch {
   }
@@ -1726,9 +1974,9 @@ async function ensureToolkitCli(toolkitSlug) {
   }
   const { binary, installer, package: pkg, script } = integration.cli_tool;
   const resolvedInstaller = installer ?? "manual";
-  const { execFileSync: execFileSync2, execSync } = await import("child_process");
+  const { execFileSync: execFileSync3, execSync } = await import("child_process");
   try {
-    execFileSync2("which", [binary], { timeout: 5e3, stdio: "pipe" });
+    execFileSync3("which", [binary], { timeout: 5e3, stdio: "pipe" });
     toolkitCliEnsured.add(toolkitSlug);
     toolkitCliRetryAfter.delete(toolkitSlug);
     toolkitCliFailureCount.delete(toolkitSlug);
@@ -1749,14 +1997,14 @@ async function ensureToolkitCli(toolkitSlug) {
         return;
       }
       log(`[toolkit-install] ${toolkitSlug}: installing via npm (${pkg})\u2026`);
-      execFileSync2("npm", ["install", "-g", pkg], { timeout: 18e4, stdio: "pipe" });
+      execFileSync3("npm", ["install", "-g", pkg], { timeout: 18e4, stdio: "pipe" });
     } else if (resolvedInstaller === "brew") {
       if (!pkg) {
         log(`[toolkit-install] ${toolkitSlug}: installer=brew but no package declared`);
         toolkitCliEnsured.add(toolkitSlug);
         return;
       }
-      const brewPath = resolveBrewPath(execFileSync2);
+      const brewPath = resolveBrewPath(execFileSync3);
       if (!brewPath) {
         log(`[toolkit-install] ${toolkitSlug}: installer=brew but Homebrew not available \u2014 install manually: brew install ${pkg}`);
         toolkitCliEnsured.add(toolkitSlug);
@@ -1766,9 +2014,9 @@ async function ensureToolkitCli(toolkitSlug) {
       const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
       log(`[toolkit-install] ${toolkitSlug}: installing via brew (${pkg})\u2026`);
       if (isRoot) {
-        execFileSync2("sudo", ["-u", "ec2-user", "-H", brewPath, "install", pkg], { timeout: 18e4, stdio: "pipe", cwd: "/tmp" });
+        execFileSync3("sudo", ["-u", "ec2-user", "-H", brewPath, "install", pkg], { timeout: 18e4, stdio: "pipe", cwd: "/tmp" });
       } else {
-        execFileSync2(brewPath, ["install", pkg], { timeout: 18e4, stdio: "pipe" });
+        execFileSync3(brewPath, ["install", pkg], { timeout: 18e4, stdio: "pipe" });
       }
     } else if (resolvedInstaller === "script") {
       if (!script) {
@@ -1788,7 +2036,7 @@ async function ensureToolkitCli(toolkitSlug) {
     process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
   }
   try {
-    execFileSync2("which", [binary], { timeout: 5e3, stdio: "pipe" });
+    execFileSync3("which", [binary], { timeout: 5e3, stdio: "pipe" });
     log(`[toolkit-install] ${toolkitSlug}: installed \u2014 ${binary} now on PATH`);
     toolkitCliEnsured.add(toolkitSlug);
     toolkitCliRetryAfter.delete(toolkitSlug);
@@ -1841,8 +2089,8 @@ async function ensureFrameworkBinary(frameworkId) {
   if (frameworkId !== "claude-code") return;
   if (frameworkBinaryChecked.has(frameworkId)) return;
   frameworkBinaryChecked.add(frameworkId);
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) {
     log("Homebrew not found (no `brew` on PATH, no /home/linuxbrew/.linuxbrew/bin/brew). Cannot auto-install Claude Code. Install manually: https://claude.ai/download");
     return;
@@ -1858,7 +2106,7 @@ async function ensureFrameworkBinary(frameworkId) {
   let claudeExists = existsSync3("/home/linuxbrew/.linuxbrew/bin/claude");
   if (!claudeExists) {
     try {
-      execFileSync2("which", ["claude"], { timeout: 5e3 });
+      execFileSync3("which", ["claude"], { timeout: 5e3 });
       claudeExists = true;
     } catch {
     }
@@ -1950,16 +2198,16 @@ async function checkAndUpdateCli() {
   }
 }
 async function checkAndUpdateCliViaBrew() {
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) return;
   try {
-    execFileSync2(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
+    execFileSync3(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
   } catch (err) {
     log(`[self-update] brew update failed (continuing with stale cache): ${err.message}`);
   }
   try {
-    const outdated = execFileSync2(brewPath, ["outdated", "--json=v2"], {
+    const outdated = execFileSync3(brewPath, ["outdated", "--json=v2"], {
       timeout: 3e4,
       encoding: "utf-8"
     });
@@ -1970,7 +2218,7 @@ async function checkAndUpdateCliViaBrew() {
       const latest = agtOutdated.current_version ?? "unknown";
       log(`[self-update] agt CLI update available: ${installed} \u2192 ${latest}. Upgrading via brew...`);
       try {
-        execFileSync2(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
+        execFileSync3(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
           timeout: 12e4,
           stdio: "pipe"
         });
@@ -1989,7 +2237,7 @@ async function checkAndUpdateCliViaBrew() {
   }
 }
 async function checkAndUpdateCliViaNpm() {
-  const { execFileSync: execFileSync2 } = await import("child_process");
+  const { execFileSync: execFileSync3 } = await import("child_process");
   if (agtCliVersion === "dev") return;
   let latest;
   try {
@@ -2038,7 +2286,7 @@ async function checkAndUpdateCliViaNpm() {
     "--registry=https://registry.npmjs.org"
   ];
   try {
-    execFileSync2(cmd, args, { timeout: 18e4, stdio: "pipe" });
+    execFileSync3(cmd, args, { timeout: 18e4, stdio: "pipe" });
     log(`[self-update] agt CLI upgraded to ${latest}. Scheduling manager restart so the new binary takes effect.`);
     restartAfterUpgrade = true;
     pendingUpgradeVersion = latest;
@@ -2524,8 +2772,7 @@ async function pollCycle() {
       log,
       resolveFramework: (codeName) => agentFrameworkCache.get(codeName) ?? null,
       stopSession: (codeName) => {
-        cancelPendingSessionRestart(codeName);
-        stopPersistentSession(codeName, log);
+        stopPersistentSessionAndForgetMcpBaseline(codeName);
         persistentSessionAgents.delete(codeName);
         claudeAuthTupleBySession.delete(codeName);
       },
@@ -2585,7 +2832,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-CFDGW7QE.js");
+      const { collectDiagnostics } = await import("../persistent-session-M2GVL6Z6.js");
       const diagCodeNames = [...persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -2685,8 +2932,7 @@ async function pollCycle() {
         log(`Agent '${prev.codeName}' removed from host (deleted or unassigned)`);
         const adapter = resolveAgentFramework(prev.codeName);
         await stopGatewayIfRunning(prev.codeName, adapter);
-        cancelPendingSessionRestart(prev.codeName);
-        stopPersistentSession(prev.codeName, log);
+        stopPersistentSessionAndForgetMcpBaseline(prev.codeName);
         try {
           const { execSync: es } = await import("child_process");
           es(`tmux kill-session -t agt-${prev.codeName} 2>/dev/null`, { stdio: "ignore" });
@@ -2823,8 +3069,7 @@ async function processAgent(agent, agentStates) {
   if (agent.status === "draft" || agent.status === "paused") {
     log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
     await stopGatewayIfRunning(agent.code_name, adapter);
-    cancelPendingSessionRestart(agent.code_name);
-    stopPersistentSession(agent.code_name, log);
+    stopPersistentSessionAndForgetMcpBaseline(agent.code_name);
     try {
       const { execSync: es } = await import("child_process");
       es(`tmux kill-session -t agt-${agent.code_name} 2>/dev/null`, { stdio: "ignore" });
@@ -2852,8 +3097,7 @@ async function processAgent(agent, agentStates) {
   if (agent.status === "revoked") {
     log(`Agent '${agent.code_name}' is revoked, cleaning up`);
     await stopGatewayIfRunning(agent.code_name, adapter);
-    cancelPendingSessionRestart(agent.code_name);
-    stopPersistentSession(agent.code_name, log);
+    stopPersistentSessionAndForgetMcpBaseline(agent.code_name);
     try {
       const { execSync: es } = await import("child_process");
       es(`tmux kill-session -t agt-${agent.code_name} 2>/dev/null`, { stdio: "ignore" });
@@ -3326,19 +3570,50 @@ async function processAgent(agent, agentStates) {
       const intHash = createHash("sha256").update(JSON.stringify(integrations.map((i) => `${i.definition_id}:${JSON.stringify(i.credentials)}`))).digest("hex").slice(0, 16);
       const prevIntHash = knownIntegrationHashes.get(agent.agent_id);
       if (intHash !== prevIntHash) {
+        const projectDir = join4(homedir3(), ".augmented", agent.code_name, "project");
+        const envIntPath = join4(projectDir, ".env.integrations");
+        let preWriteEnv;
+        try {
+          preWriteEnv = readFileSync3(envIntPath, "utf-8");
+        } catch {
+          preWriteEnv = void 0;
+        }
         if (frameworkAdapter.writeIntegrations) {
           frameworkAdapter.writeIntegrations(agent.code_name, integrations);
         }
-        knownIntegrationHashes.set(agent.agent_id, intHash);
         log(`Integrations provisioned for '${agent.code_name}' (${integrations.length} integration(s))`);
         const fw = agentFrameworkCache.get(agent.code_name) ?? "openclaw";
+        let rotationHandled = true;
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
-          const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
-          injectMessage(agent.code_name, "system", `Your integrations have been updated. You now have access to: ${names}. Your .env.integrations and CLAUDE.md have been refreshed \u2014 credentials are available immediately via environment variables.`, {
-            task_name: "integration-update"
-          }, log).catch(() => {
-          });
-          log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${names}`);
+          try {
+            const projectMcpPath = join4(projectDir, ".mcp.json");
+            const postWriteEnv = readFileSync3(envIntPath, "utf-8");
+            const mcpContent = readFileSync3(projectMcpPath, "utf-8");
+            const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
+            const mcpJsonForReap = JSON.parse(mcpContent);
+            const affectedServerKeys = findMcpServersUsingVars(mcpJsonForReap, changedVars);
+            if (affectedServerKeys.length > 0) {
+              reapStaleMcpChildren({
+                log,
+                codeName: agent.code_name,
+                serverKeys: affectedServerKeys,
+                mcpJson: mcpJsonForReap
+              });
+            }
+            const names = integrations.map((i) => i.display_name || i.definition_id).join(", ");
+            const reapNote = affectedServerKeys.length > 0 ? ` The MCP servers that depend on rotating credentials (${affectedServerKeys.join(", ")}) have been signalled to reconnect.` : "";
+            injectMessage(agent.code_name, "system", `Your integrations have been refreshed. You have access to: ${names}.${reapNote}`, {
+              task_name: "integration-update"
+            }, log).catch(() => {
+            });
+            log(`[hot-reload] Notified '${agent.code_name}' about integration update: ${names} (reaped ${affectedServerKeys.length} stale MCP server(s))`);
+          } catch (err) {
+            rotationHandled = false;
+            log(`[hot-reload] Failed to compute / reap affected MCP servers for '${agent.code_name}': ${err.message} \u2014 will retry next tick`);
+          }
+        }
+        if (rotationHandled) {
+          knownIntegrationHashes.set(agent.agent_id, intHash);
         }
         needsGatewayRestart = true;
       }
@@ -3656,6 +3931,11 @@ async function processAgent(agent, agentStates) {
   const sessionMode = refreshData.agent.session_mode ?? "oneshot";
   if (agentFw === "claude-code" && sessionMode === "persistent") {
     await ensurePersistentSession(agent, tasks, boardItems, refreshData);
+    try {
+      checkMcpConfigDriftAndScheduleRestart(agent.code_name, getProjectDir2(agent.code_name));
+    } catch (err) {
+      log(`[hot-reload] .mcp.json drift check failed for '${agent.code_name}': ${err.message}`);
+    }
   } else if (agentFw === "claude-code" && tasks.length > 0) {
     await syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData);
   } else if (frameworkAdapter.syncScheduledTasks && gatewayRunning && gatewayPort) {
@@ -4407,8 +4687,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
     const msg = err.message;
     log(`[persistent-session] Failed to resolve auth for '${codeName}': ${msg} \u2014 refusing to spawn`);
     if (isSessionHealthy(codeName)) {
-      cancelPendingSessionRestart(codeName);
-      stopPersistentSession(codeName, log);
+      stopPersistentSessionAndForgetMcpBaseline(codeName);
       persistentSessionAgents.delete(codeName);
       claudeAuthTupleBySession.delete(codeName);
     }
@@ -4430,8 +4709,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   const recordedAuthTuple = claudeAuthTupleBySession.get(codeName);
   if (recordedAuthTuple && recordedAuthTuple !== currentAuthTuple && isSessionHealthy(codeName)) {
     log(`[persistent-session] Auth config changed for '${codeName}' (${recordedAuthTuple} \u2192 ${currentAuthTuple}) \u2014 restarting session`);
-    cancelPendingSessionRestart(codeName);
-    stopPersistentSession(codeName, log);
+    stopPersistentSessionAndForgetMcpBaseline(codeName);
     persistentSessionAgents.delete(codeName);
   }
   if (isStaleForToday(codeName) && isSessionHealthy(codeName)) {
@@ -4442,8 +4720,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
         log(
           `[persistent-session] Day rollover for '${codeName}' (yesterday=${current.date}) \u2014 agent idle, restarting to mint fresh session`
         );
-        cancelPendingSessionRestart(codeName);
-        stopPersistentSession(codeName, log);
+        stopPersistentSessionAndForgetMcpBaseline(codeName);
         persistentSessionAgents.delete(codeName);
       } else {
         log(
@@ -5822,7 +6099,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-VXN4NVGR.js");
+  } = await import("../claude-pair-runtime-UF4OMFCA.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));