@integrity-labs/agt-cli 0.24.3 → 0.24.4

package/dist/bin/agt.js

@@ -26,7 +26,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-KVIKKWXB.js";
+} from "../chunk-3TYBPBDA.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -3736,7 +3736,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync5, realpathSync } from "fs";
 import chalk17 from "chalk";
 import ora15 from "ora";
-var cliVersion = true ? "0.24.3" : "dev";
+var cliVersion = true ? "0.24.4" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -4268,7 +4268,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.24.3" : "dev";
+var cliVersion2 = true ? "0.24.4" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", (thisCommand) => {

package/dist/{chunk-KVIKKWXB.js → chunk-3TYBPBDA.js}

@@ -6717,4 +6717,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-KVIKKWXB.js.map
+//# sourceMappingURL=chunk-3TYBPBDA.js.map

package/dist/lib/manager-worker.js

@@ -12,7 +12,7 @@ import {
   provisionOrientHook,
   provisionStopHook,
   requireHost
-} from "../chunk-KVIKKWXB.js";
+} from "../chunk-3TYBPBDA.js";
 import {
   findTaskByTemplate,
   getProjectDir as getProjectDir2,
@@ -69,7 +69,7 @@ import {
 } from "../chunk-ECDTRQLA.js";
 
 // src/lib/manager-worker.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, appendFileSync, mkdirSync as mkdirSync2, chmodSync, existsSync as existsSync4, rmSync as rmSync2, readdirSync as readdirSync3, statSync as statSync2, unlinkSync, copyFileSync } from "fs";
 import https from "https";
 import { execFileSync as syncExecFile } from "child_process";
@@ -78,15 +78,30 @@ import { homedir as homedir4 } from "os";
 import { fileURLToPath } from "url";
 
 // src/lib/mcp-config-drift.ts
+import { createHash } from "crypto";
 function decideMcpDriftAction(currentHash, knownHash) {
   if (!currentHash) return { kind: "no-config" };
   if (!knownHash) return { kind: "baseline", hash: currentHash };
   if (knownHash === currentHash) return { kind: "no-drift" };
   return { kind: "drift", previous: knownHash, current: currentHash };
 }
+function decideMcpRestartOnDrift(previousKeys, currentKeys) {
+  if (!previousKeys || !currentKeys) {
+    return { restart: true, membershipUnknown: true, addedOrRemoved: [] };
+  }
+  const addedOrRemoved = [];
+  for (const k of currentKeys) if (!previousKeys.has(k)) addedOrRemoved.push(k);
+  for (const k of previousKeys) if (!currentKeys.has(k)) addedOrRemoved.push(k);
+  addedOrRemoved.sort();
+  return { restart: addedOrRemoved.length > 0, membershipUnknown: false, addedOrRemoved };
+}
+function managedMcpStructureHash(entries) {
+  const basis = entries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => `${e.serverId}|${Object.keys(e.headers ?? {}).sort().join(",")}`).join("\n");
+  return createHash("sha256").update(basis).digest("hex").slice(0, 16);
+}
 
 // src/lib/integration-hash.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function canonicalize(value) {
   if (Array.isArray(value)) return value.map(canonicalize);
   if (value && typeof value === "object") {
@@ -103,7 +118,7 @@ function computeIntegrationsHash(integrations) {
   const payload = integrations.map(
     (i) => `${i.definition_id}:${JSON.stringify(canonicalize(i.credentials ?? {}))}:${JSON.stringify(canonicalize(i.config ?? {}))}`
   );
-  return createHash("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
+  return createHash2("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
 }
 
 // src/lib/stale-mcp-reaper.ts
@@ -2627,7 +2642,7 @@ var runningMcpServerKeys = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
     const raw = readFileSync5(join6(projectDir, ".mcp.json"), "utf-8");
-    return createHash2("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
+    return createHash3("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
   }
@@ -2671,33 +2686,34 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
     }
     case "drift": {
       log(
-        `[hot-reload] .mcp.json content changed for '${codeName}' (${action.previous.slice(0, 12)} \u2192 ${action.current.slice(0, 12)}); scheduling restart (ENG-4897)`
+        `[hot-reload] .mcp.json content changed for '${codeName}' (${action.previous.slice(0, 12)} \u2192 ${action.current.slice(0, 12)}) (ENG-4897)`
       );
       const previousKeys = runningMcpServerKeys.get(codeName);
       const currentKeys = projectMcpKeys(codeName, projectDir);
-      if (!previousKeys || !currentKeys) {
+      const decision = decideMcpRestartOnDrift(previousKeys, currentKeys);
+      if (decision.membershipUnknown) {
         clearPresenceReaperState(codeName);
         log(
-          `[hot-reload] .mcp.json key membership unavailable for '${codeName}' \u2014 clearing full presence-reaper state (ENG-5285)`
+          `[hot-reload] .mcp.json key membership unavailable for '${codeName}' \u2014 clearing full presence-reaper state and restarting (ENG-5285/ENG-5537)`
+        );
+      } else if (decision.restart) {
+        clearPresenceReaperStateForKeys(codeName, new Set(decision.addedOrRemoved));
+        log(
+          `[hot-reload] .mcp.json membership changed for '${codeName}': ${decision.addedOrRemoved.length} key(s) added/removed [${decision.addedOrRemoved.join(", ")}] \u2014 reaper state cleared for those keys only (ENG-5285)`
         );
       } else {
-        const addedOrRemoved = /* @__PURE__ */ new Set();
-        for (const k of currentKeys) if (!previousKeys.has(k)) addedOrRemoved.add(k);
-        for (const k of previousKeys) if (!currentKeys.has(k)) addedOrRemoved.add(k);
-        if (addedOrRemoved.size > 0) {
-          clearPresenceReaperStateForKeys(codeName, addedOrRemoved);
-          log(
-            `[hot-reload] .mcp.json membership changed for '${codeName}': ${addedOrRemoved.size} key(s) added/removed [${Array.from(addedOrRemoved).sort().join(", ")}] \u2014 reaper state cleared for those keys only (ENG-5285)`
-          );
-        } else {
-          log(
-            `[hot-reload] .mcp.json value-only drift for '${codeName}' \u2014 preserving presence-reaper state for the unchanged declared key set (ENG-5285)`
-          );
-        }
+        log(
+          `[hot-reload] .mcp.json value-only drift for '${codeName}' \u2014 preserving presence-reaper state and NOT restarting (ENG-5285/ENG-5537)`
+        );
+      }
+      if (decision.restart) {
+        scheduleSessionRestart(codeName, 0, ".mcp.json content change (ENG-4897)");
+        runningMcpHashes.delete(codeName);
+        runningMcpServerKeys.delete(codeName);
+      } else {
+        runningMcpHashes.set(codeName, action.current);
+        if (currentKeys) runningMcpServerKeys.set(codeName, currentKeys);
       }
-      scheduleSessionRestart(codeName, 0, ".mcp.json content change (ENG-4897)");
-      runningMcpHashes.delete(codeName);
-      runningMcpServerKeys.delete(codeName);
       return;
     }
   }
@@ -2707,6 +2723,7 @@ var knownModels = /* @__PURE__ */ new Map();
 var knownTasksHashes = /* @__PURE__ */ new Map();
 var knownIntegrationHashes = /* @__PURE__ */ new Map();
 var knownManagedMcpHashes = /* @__PURE__ */ new Map();
+var knownManagedMcpStructure = /* @__PURE__ */ new Map();
 var knownSkillHashes = /* @__PURE__ */ new Map();
 var managedToolkitIdByAgentAndServerId = /* @__PURE__ */ new Map();
 function managedToolkitMapKey(agentId, serverId) {
@@ -2758,6 +2775,7 @@ function clearAgentCaches(agentId, codeName) {
   knownTasksHashes.delete(agentId);
   knownIntegrationHashes.delete(agentId);
   knownManagedMcpHashes.delete(agentId);
+  knownManagedMcpStructure.delete(agentId);
   agentDisplayNames.delete(codeName);
   codeNameToAgentId.delete(codeName);
   agentFrameworkCache.delete(codeName);
@@ -2788,7 +2806,7 @@ var cachedFrameworkVersion = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.24.3" : "dev";
+var agtCliVersion = true ? "0.24.4" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -3367,7 +3385,7 @@ function log(msg) {
   }
 }
 function sha256(content) {
-  return createHash2("sha256").update(content, "utf8").digest("hex");
+  return createHash3("sha256").update(content, "utf8").digest("hex");
 }
 function hashFile(filePath) {
   try {
@@ -3777,7 +3795,7 @@ async function pollCycle() {
         claudeAuth = await detectClaudeAuth();
       } catch (err) {
         const errText = err instanceof Error ? err.message : String(err);
-        const errId = createHash2("sha256").update(errText).digest("hex").slice(0, 12);
+        const errId = createHash3("sha256").update(errText).digest("hex").slice(0, 12);
         log(`Claude auth detection failed (error_id=${errId})`);
       }
       await api.post("/host/heartbeat", {
@@ -4497,7 +4515,7 @@ async function processAgent(agent, agentStates) {
           const peersForHash = channelId === "telegram" ? extractCharterTelegramPeers(refreshData.charter?.raw_content ?? "", gateContext) : channelId === "slack" ? extractCharterSlackPeers(refreshData.charter?.raw_content ?? "", gateContext) : null;
           const sessionModeForHash = refreshData.agent.session_mode;
           const CHANNEL_WRITE_VERSION = 5;
-          const configHash = createHash2("sha256").update(
+          const configHash = createHash3("sha256").update(
             canonicalJson({
               writeVersion: CHANNEL_WRITE_VERSION,
               config: entry.config,
@@ -4759,15 +4777,17 @@ async function processAgent(agent, agentStates) {
           desiredEntries.push({ serverId, url, headers: mcpHeaders, name: tk.toolkit_name });
         }
         const hashBasis = desiredEntries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => {
-          const headersHash = createHash2("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
+          const headersHash = createHash3("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
           return `${e.serverId}|${e.url}|${headersHash}`;
         }).join("\n");
-        const mcpHash = createHash2("sha256").update(hashBasis).digest("hex").slice(0, 16);
+        const mcpHash = createHash3("sha256").update(hashBasis).digest("hex").slice(0, 16);
         const prevMcpHash = knownManagedMcpHashes.get(agent.agent_id);
+        const structureHash = managedMcpStructureHash(desiredEntries);
+        const prevStructureHash = knownManagedMcpStructure.get(agent.agent_id);
         if (mcpHash !== prevMcpHash) {
           for (const e of desiredEntries) {
             frameworkAdapter.writeMcpServer(agent.code_name, e.serverId, { url: e.url, headers: e.headers });
-            const urlHash = createHash2("sha256").update(e.url).digest("hex").slice(0, 12);
+            const urlHash = createHash3("sha256").update(e.url).digest("hex").slice(0, 12);
             log(`[managed-toolkit] ${agent.code_name}: wrote '${e.name}' (serverId=${e.serverId}, url_hash=${urlHash})`);
           }
           if (frameworkAdapter.removeMcpServer && frameworkAdapter.getMcpPath) {
@@ -4801,7 +4821,8 @@ async function processAgent(agent, agentStates) {
             }
           }
           knownManagedMcpHashes.set(agent.agent_id, mcpHash);
-          if (prevMcpHash !== void 0 && fwForMcp === "claude-code" && isSessionHealthy(agent.code_name)) {
+          knownManagedMcpStructure.set(agent.agent_id, structureHash);
+          if (prevStructureHash !== void 0 && structureHash !== prevStructureHash && fwForMcp === "claude-code" && isSessionHealthy(agent.code_name)) {
             const mcpNames = agentToolkits.map((tk) => tk.toolkit_name).join(", ") || "none (all removed)";
             log(`[hot-reload] MCP servers changed for '${agent.code_name}': ${mcpNames} \u2014 restarting session`);
             const restartNotice = agentToolkits.length > 0 ? `New MCP tool servers have been configured: ${mcpNames}. Note: MCP servers require a session restart to connect. Your manager will restart your session shortly.` : "Managed MCP tool servers were removed. Your manager will restart your session shortly so the session drops those tools.";
@@ -4889,7 +4910,7 @@ async function processAgent(agent, agentStates) {
     if (frameworkAdapter.installSkillFiles) {
       const currentIntegrationSkillIds = /* @__PURE__ */ new Set();
       const installedIntegrationSkills = [];
-      const { createHash: createHash3 } = await import("crypto");
+      const { createHash: createHash4 } = await import("crypto");
       const refreshAny = refreshData;
       const contexts = refreshAny.integration_contexts ?? refreshAny.plugin_contexts ?? [];
       const contextBySlug = /* @__PURE__ */ new Map();
@@ -4918,7 +4939,7 @@ async function processAgent(agent, agentStates) {
             )
           }));
           const bundle = buildIntegrationBundle(renderedScopes);
-          const contentHash = createHash3("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
+          const contentHash = createHash4("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
           const hashKey = `plugin-skill:${agent.agent_id}:${integrationSkillId}`;
           if (knownSkillHashes.get(hashKey) === contentHash) continue;
           frameworkAdapter.installSkillFiles(agent.code_name, integrationSkillId, bundle.files);
@@ -4987,7 +5008,7 @@ async function processAgent(agent, agentStates) {
           const slug = hook.integration_slug ?? hook.plugin_slug;
           if (!slug) continue;
           try {
-            const scriptHash = createHash3("sha256").update(hook.script).digest("hex").slice(0, 12);
+            const scriptHash = createHash4("sha256").update(hook.script).digest("hex").slice(0, 12);
             const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${slug}:on_install`;
             if (knownSkillHashes.get(hookKey) === scriptHash) continue;
             const result = await frameworkAdapter.executePluginHook({
@@ -5002,9 +5023,9 @@ async function processAgent(agent, agentStates) {
             } else if (result.timedOut) {
               log(`Integration hook on_install '${slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
             } else {
-              const stderrHash = createHash3("sha256").update(result.stderr).digest("hex").slice(0, 12);
+              const stderrHash = createHash4("sha256").update(result.stderr).digest("hex").slice(0, 12);
               const missingCmd = result.exitCode === 127 ? extractCommandNotFound(result.stderr) : null;
-              const missingCmdHash = missingCmd ? createHash3("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
+              const missingCmdHash = missingCmd ? createHash4("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
               log(
                 `Integration hook on_install '${slug}' exited ${result.exitCode} for '${agent.code_name}' ` + (missingCmdHash ? `[missing_command_hash=${missingCmdHash}] ` : "") + `[stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
               );
@@ -5194,10 +5215,10 @@ async function processAgent(agent, agentStates) {
   } else if (agentFw === "claude-code" && tasks.length > 0) {
     await syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData);
   } else if (frameworkAdapter.syncScheduledTasks && gatewayRunning && gatewayPort) {
-    const stableTasksHash = createHash2("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
-    const boardHash = boardItems.length > 0 ? createHash2("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
+    const stableTasksHash = createHash3("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+    const boardHash = boardItems.length > 0 ? createHash3("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
     const resolvedModels = resolveModelChain(refreshData);
-    const modelsHash = createHash2("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
+    const modelsHash = createHash3("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
     const combinedHash = `${stableTasksHash}:${boardHash}:${modelsHash}`;
     const prevTasksHash = knownTasksHashes.get(agent.agent_id);
     if (combinedHash !== prevTasksHash) {
@@ -5577,10 +5598,10 @@ var MAX_CLAUDE_CONCURRENCY = 2;
 var claudeSchedulerStates = /* @__PURE__ */ new Map();
 async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
-  const stableTasksHash = createHash2("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
-  const boardHash = boardItems.length > 0 ? createHash2("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
+  const stableTasksHash = createHash3("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const boardHash = boardItems.length > 0 ? createHash3("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
   const resolvedModels = resolveModelChain(refreshData);
-  const modelsHash = createHash2("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
+  const modelsHash = createHash3("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
   const combinedHash = `${stableTasksHash}:${boardHash}:${modelsHash}`;
   const prevHash = knownTasksHashes.get(agent.agent_id);
   if (combinedHash !== prevHash) {
@@ -5658,7 +5679,7 @@ async function startRun(opts) {
     return { run_id: res.run_id ?? null, kanban_item_id: res.kanban_item_id ?? null };
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash2("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash3("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] start failed for agent_id=${opts.agent_id} source_type=${opts.source_type} error_id=${errId}`);
     return { run_id: null, kanban_item_id: null };
   }
@@ -5675,7 +5696,7 @@ async function finishRun(runId, outcome, options = {}) {
     });
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash2("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash3("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] finish failed for run_id=${runId} outcome=${outcome} error_id=${errId}`);
   }
 }
@@ -5692,7 +5713,7 @@ async function fetchPriorScheduledRuns(agentId, taskId) {
     return rows.filter((r) => typeof r.output_text === "string" && r.output_text.length > 0).map((r) => ({ startedAt: r.started_at, output: r.output_text }));
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash2("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash3("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] prior-runs lookup failed for task_id=${taskId} error_id=${errId}`);
     return [];
   }
@@ -5826,10 +5847,10 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
     const classification = classifyOutput(rawOutput);
     if (classification.action === "suppress") {
       const trimmed = (rawOutput ?? "").trim();
-      const outputHash = trimmed.length === 0 ? "empty" : createHash2("sha256").update(trimmed).digest("hex").slice(0, 12);
+      const outputHash = trimmed.length === 0 ? "empty" : createHash3("sha256").update(trimmed).digest("hex").slice(0, 12);
       log(`[claude-scheduler] Suppressing delivery for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 output_len=${trimmed.length} output_hash=${outputHash}`);
       if (classification.suppressedNotes) {
-        const notesHash = createHash2("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
+        const notesHash = createHash3("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
         log(`[claude-scheduler] Suppressed notes for '${codeName}' (task=${delivery?.taskId ?? "n/a"}) \u2014 notes_len=${classification.suppressedNotes.length} notes_hash=${notesHash}`);
       }
       if (delivery?.mode === "announce" && delivery.to) {
@@ -6051,7 +6072,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       const ctx = getLastFailureContext(codeName);
       const recovery = prepareForRespawn(codeName);
       const tailSummary = !ctx.tail ? "" : KNOWN_SAFE_TAIL_SIGNATURES.has(ctx.signature) ? `; last pane output (${PANE_TAIL_PREVIEW_LINES} of ~20 lines):
-${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash2("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
+${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash3("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
       const sigSummary = ctx.signature !== "unknown" ? `; signature=${ctx.signature}` : "";
       const recoverySummary = recovery ? `; recovery=${recovery}` : "";
       log(
@@ -6065,7 +6086,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash2("sha256").
       );
       getHostId().then((hostId) => {
         if (!hostId) return;
-        const paneTailHash = zombie.paneTail ? `sha256:${createHash2("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
+        const paneTailHash = zombie.paneTail ? `sha256:${createHash3("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
         return api.post("/host/events", {
           host_id: hostId,
           agent_code_name: codeName,
@@ -6132,7 +6153,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash2("sha256").
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
   }
-  const stableTasksHash = createHash2("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const stableTasksHash = createHash3("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   const prevHash = knownTasksHashes.get(agent.agent_id);
   if (stableTasksHash !== prevHash) {
     const taskInputs = tasks.map((t) => ({
@@ -6616,7 +6637,7 @@ ${escapeXml(msg.content)}
     log(`[direct-chat] Reply sent for '${agent.codeName}'`);
   } catch (err) {
     const errMsg = err instanceof Error ? err.message : String(err);
-    const errorId = createHash2("sha256").update(errMsg).digest("hex").slice(0, 12);
+    const errorId = createHash3("sha256").update(errMsg).digest("hex").slice(0, 12);
     log(`[direct-chat] Failed to process message for '${agent.codeName}': error_id=${errorId} error=${errMsg.slice(0, 500)}`);
     try {
       await api.post("/host/direct-chat/reply", {
@@ -7847,7 +7868,7 @@ async function syncMemories(agent, configDir, log2) {
       if (!file.endsWith(".md")) continue;
       try {
         const raw = readFileSync5(join6(memoryDir, file), "utf-8");
-        const fileHash = createHash2("sha256").update(raw).digest("hex").slice(0, 16);
+        const fileHash = createHash3("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
         const parsed = parseMemoryFile(raw, file.replace(/\.md$/, ""));
@@ -7885,14 +7906,14 @@ async function syncMemories(agent, configDir, log2) {
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
   const localFiles = existsSync4(memoryDir) ? readdirSync3(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
-  const localListHash = createHash2("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
+  const localListHash = createHash3("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
   try {
     const dbMemories = await api.post("/host/memories", {
       agent_id: agent.agent_id
     });
-    const responseHash = createHash2("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
+    const responseHash = createHash3("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
     if (!force && prevDownload && prevLocalHash === localListHash && lastDownloadHash.get(agent.agent_id) === responseHash) {
       return true;
     }
@@ -7931,7 +7952,7 @@ ${mem.content}
       }
       if (written > 0 || overwritten > 0) {
         const updatedFiles = readdirSync3(memoryDir).filter((f) => f.endsWith(".md")).sort();
-        lastLocalFileHash.set(agent.agent_id, createHash2("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
+        lastLocalFileHash.set(agent.agent_id, createHash3("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
         log2(`Memory download for '${agent.code_name}': wrote ${written} new, overwrote ${overwritten} stale`);
       }
     }
@@ -8216,7 +8237,7 @@ function deployMcpAssets() {
   const fileHash = (p) => {
     try {
       if (!existsSync4(p)) return null;
-      return createHash2("sha256").update(readFileSync5(p)).digest("hex");
+      return createHash3("sha256").update(readFileSync5(p)).digest("hex");
     } catch {
       return null;
     }