@integrity-labs/agt-cli 0.26.2-eng5706.1 → 0.27.0

package/dist/bin/agt.js

@@ -26,7 +26,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-LBYU24PW.js";
+} from "../chunk-YWXPSVI5.js";
 import {
   CHANNEL_REGISTRY,
   DEPLOYMENT_TEMPLATES,
@@ -52,11 +52,11 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-U3HCB23E.js";
+} from "../chunk-BKLEFKUZ.js";
 
 // src/bin/agt.ts
-import { join as join10 } from "path";
-import { homedir as homedir3 } from "os";
+import { join as join12 } from "path";
+import { homedir as homedir5 } from "os";
 import { Command } from "commander";
 
 // src/commands/whoami.ts
@@ -1552,14 +1552,461 @@ async function provisionCommand(codeName, options) {
   info(`  agt drift check ${agentData.code_name}`);
 }
 
-// src/commands/drift.ts
+// src/commands/impersonate.ts
 import chalk10 from "chalk";
 import ora10 from "ora";
+import { spawn } from "child_process";
+import { writeFileSync as writeFileSync5 } from "fs";
+import { join as join7 } from "path";
+
+// src/lib/impersonate-flag.ts
+var ENV_VAR = "AGT_IMPERSONATE_ENABLED";
+function impersonateEnabled() {
+  const v = process.env[ENV_VAR];
+  if (!v) return false;
+  const trimmed = v.trim().toLowerCase();
+  return !(trimmed === "" || trimmed === "0" || trimmed === "false" || trimmed === "no");
+}
+function requireImpersonateEnabled() {
+  if (impersonateEnabled()) return;
+  process.stderr.write(
+    `
+The \`agt impersonate\` commands are gated behind a feature flag.
+
+To enable them, set ${ENV_VAR}=1 in your environment:
+
+  export ${ENV_VAR}=1
+
+These commands are part of the operator-impersonates-agent v0 flow
+(ENG-5687 / ENG-5688). The gating will be removed once the
+surrounding pieces (ENG-5689 channel-MCP refusal, ENG-5690 slash
+commands) land and the end-to-end smoke test has been run against
+production.
+
+`
+  );
+  process.exit(2);
+}
+
+// src/lib/impersonate-state.ts
+import {
+  chmodSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync2,
+  renameSync,
+  rmSync,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { homedir } from "os";
+import { join as join6 } from "path";
+var IMPERSONATE_ROOT = join6(homedir(), ".augmented-impersonate");
+var ACTIVE_DIR = join6(IMPERSONATE_ROOT, "active");
+var ACTIVE_MANIFEST_PATH = join6(ACTIVE_DIR, "manifest.json");
+var CODE_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function assertValidCodeName(codeName) {
+  if (!CODE_NAME_RE.test(codeName)) {
+    throw new Error(
+      `Invalid agent code_name "${codeName}" \u2014 must be lowercase kebab-case (a-z, 0-9, hyphens; no leading/trailing/consecutive hyphens).`
+    );
+  }
+}
+function getImpersonateCodeNameDir(codeName) {
+  assertValidCodeName(codeName);
+  return join6(IMPERSONATE_ROOT, codeName);
+}
+function ensureCodeNameDir(codeName) {
+  assertValidCodeName(codeName);
+  const dir = getImpersonateCodeNameDir(codeName);
+  mkdirSync4(dir, { recursive: true });
+  return dir;
+}
+function readActiveManifest() {
+  if (!existsSync2(ACTIVE_MANIFEST_PATH)) return null;
+  try {
+    const raw = readFileSync2(ACTIVE_MANIFEST_PATH, "utf-8");
+    const parsed = JSON.parse(raw);
+    const backupsOk = typeof parsed.backups === "object" && parsed.backups !== null && Object.values(parsed.backups).every(
+      (v) => v === "had-file" || v === "was-symlink" || v === "didnt-exist"
+    );
+    if (typeof parsed.code_name !== "string" || typeof parsed.agent_id !== "string" || typeof parsed.team_id !== "string" || typeof parsed.token !== "string" || typeof parsed.expires_at !== "number" || typeof parsed.session_id !== "string" || typeof parsed.minted_at !== "string" || typeof parsed.project_cwd !== "string" || // ENG-5688 (redesigned): host required so `exit` calls /stop against
+    // the right environment. Required, not optional, because writing the
+    // wrong host on an existing session would point exit at a server
+    // that has no record of the session — silently misleading.
+    typeof parsed.host !== "string" || parsed.host.length === 0 || !backupsOk) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function writeActiveManifest(manifest) {
+  mkdirSync4(ACTIVE_DIR, { recursive: true, mode: 448 });
+  const tmp = ACTIVE_MANIFEST_PATH + ".tmp";
+  writeFileSync4(tmp, JSON.stringify(manifest, null, 2), { mode: 384 });
+  chmodSync(tmp, 384);
+  renameSync(tmp, ACTIVE_MANIFEST_PATH);
+}
+function clearActiveManifest() {
+  if (existsSync2(ACTIVE_MANIFEST_PATH)) {
+    rmSync(ACTIVE_MANIFEST_PATH);
+  }
+}
+function isExpired(manifest, now = Date.now()) {
+  return manifest.expires_at * 1e3 <= now;
+}
+
+// src/lib/impersonate-fs-ops.ts
+import {
+  existsSync as existsSync3,
+  lstatSync,
+  readlinkSync,
+  realpathSync,
+  renameSync as renameSync2,
+  symlinkSync,
+  unlinkSync
+} from "fs";
+import { homedir as homedir2 } from "os";
+import { sep } from "path";
+var BACKUP_SUFFIX = ".pre-impersonate-backup";
+function swapInPersonaFile(projectPath, personaPath) {
+  let kind;
+  if (!lstatSafe(projectPath)) {
+    kind = "didnt-exist";
+  } else {
+    const stat = lstatSync(projectPath);
+    if (stat.isSymbolicLink()) {
+      const target = readlinkSync(projectPath);
+      const ourRoot = realpathSync(homedir2()) + sep + ".augmented-impersonate" + sep;
+      let resolvedTarget;
+      try {
+        resolvedTarget = realpathSync(projectPath);
+      } catch {
+        throw new Error(
+          `${projectPath} is a broken symlink (target ${target}). Resolve manually and retry.`
+        );
+      }
+      if (resolvedTarget.startsWith(ourRoot)) {
+        unlinkSync(projectPath);
+        kind = "was-symlink";
+      } else {
+        throw new Error(
+          `${projectPath} is a symlink to ${target} (resolved: ${resolvedTarget}). Refusing to replace it \u2014 it doesn't live under ${ourRoot}. Resolve manually and retry.`
+        );
+      }
+    } else {
+      const backupPath = projectPath + BACKUP_SUFFIX;
+      if (existsSync3(backupPath)) {
+        throw new Error(
+          `${backupPath} already exists from a previous run. Remove it manually if you're sure it's stale, then retry.`
+        );
+      }
+      renameSync2(projectPath, backupPath);
+      kind = "had-file";
+    }
+  }
+  symlinkSync(personaPath, projectPath, "file");
+  return kind;
+}
+function restoreSwapped(projectPath, kind) {
+  if (lstatSafe(projectPath)) {
+    const stat = lstatSync(projectPath);
+    if (stat.isSymbolicLink()) {
+      unlinkSync(projectPath);
+    } else {
+      return;
+    }
+  }
+  if (kind === "had-file") {
+    const backupPath = projectPath + BACKUP_SUFFIX;
+    if (existsSync3(backupPath)) {
+      renameSync2(backupPath, projectPath);
+    }
+  }
+}
+function lstatSafe(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/impersonate.ts
+var SWAP_FILES = ["CLAUDE.md", ".mcp.json"];
+var AGENT_IMPERSONATION_HEADER = "X-Agent-Impersonation";
+var REDEEM_TOKEN_RE = /^[A-HJ-NP-Z2-9]{4}-[A-HJ-NP-Z2-9]{4}$/i;
+async function impersonateConnectCommand(token, options = {}) {
+  requireImpersonateEnabled();
+  const json = isJsonMode();
+  const shouldLaunchClaude = !options.noLaunch && !json;
+  if (!REDEEM_TOKEN_RE.test(token)) {
+    const msg = "Token is not in the expected XXXX-XXXX format. Copy the full `agt impersonate connect <token>` command from the webapp.";
+    if (json) jsonOutput({ ok: false, error: msg });
+    else error(msg);
+    process.exitCode = 1;
+    return;
+  }
+  const existing = readActiveManifest();
+  if (existing) {
+    const msg = `An impersonation session is already active (${existing.code_name}). Run \`agt impersonate exit\` first.`;
+    if (json) jsonOutput({ ok: false, error: msg });
+    else error(msg);
+    process.exitCode = 1;
+    return;
+  }
+  if (!json) console.log(chalk10.bold("\nAugmented \u2014 Impersonate\n"));
+  const spinner = ora10({
+    text: "Redeeming token\u2026",
+    isSilent: json
+  });
+  spinner.start();
+  const host2 = getHost();
+  let bundle;
+  try {
+    const res = await fetch(`${host2}/impersonate/agent/redeem`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ redeem_token: token })
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      const detail = body["error"] ?? `HTTP ${res.status}`;
+      throw new Error(`${detail} (HTTP ${res.status})`);
+    }
+    bundle = await res.json();
+  } catch (err) {
+    spinner.fail("Failed to redeem token.");
+    const msg = err instanceof Error ? err.message : String(err);
+    if (json) jsonOutput({ ok: false, error: msg });
+    else error(msg);
+    process.exitCode = 1;
+    return;
+  }
+  spinner.text = "Writing persona files\u2026";
+  const personaDir = ensureCodeNameDir(bundle.agent.code_name);
+  writeFileSync5(
+    join7(personaDir, "CLAUDE.md"),
+    bundle.artifacts["CLAUDE.md"]
+  );
+  writeFileSync5(
+    join7(personaDir, ".mcp.json"),
+    bundle.artifacts[".mcp.json"]
+  );
+  spinner.text = "Swapping persona files\u2026";
+  const projectCwd = process.cwd();
+  const backups = {};
+  const swapped = [];
+  try {
+    for (const file of SWAP_FILES) {
+      const projectPath = join7(projectCwd, file);
+      const kind = swapInPersonaFile(projectPath, join7(personaDir, file));
+      backups[file] = kind;
+      swapped.push({ file, kind });
+    }
+    const manifest = {
+      code_name: bundle.agent.code_name,
+      agent_id: bundle.agent.agent_id,
+      team_id: bundle.agent.team_id,
+      token: bundle.token,
+      expires_at: bundle.expires_at,
+      session_id: bundle.session_id,
+      minted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      project_cwd: projectCwd,
+      host: host2,
+      backups
+    };
+    writeActiveManifest(manifest);
+  } catch (err) {
+    for (const { file, kind } of [...swapped].reverse()) {
+      try {
+        restoreSwapped(join7(projectCwd, file), kind);
+      } catch {
+      }
+    }
+    spinner.fail("Failed to enter impersonation; rolled back changes.");
+    throw err;
+  }
+  spinner.stop();
+  if (json) {
+    jsonOutput({
+      ok: true,
+      code_name: bundle.agent.code_name,
+      agent_id: bundle.agent.agent_id,
+      session_id: bundle.session_id,
+      expires_at: bundle.expires_at,
+      project_cwd: projectCwd,
+      host: host2,
+      swapped_files: SWAP_FILES
+    });
+    return;
+  }
+  success(`Impersonating ${chalk10.bold(bundle.agent.code_name)}`);
+  console.log();
+  console.log(`  Agent ID:   ${chalk10.dim(bundle.agent.agent_id)}`);
+  console.log(`  Team:       ${chalk10.dim(bundle.agent.team_id)}`);
+  console.log(`  Session:    ${chalk10.dim(bundle.session_id)}`);
+  console.log(
+    `  Expires:    ${chalk10.dim(new Date(bundle.expires_at * 1e3).toISOString())}`
+  );
+  console.log(`  Project:    ${chalk10.dim(projectCwd)}`);
+  console.log(`  Host:       ${chalk10.dim(host2)}`);
+  console.log(`  Swapped:    ${chalk10.dim(SWAP_FILES.join(", "))}`);
+  console.log();
+  if (!shouldLaunchClaude) {
+    info(
+      "Restart Claude Code to pick up the agent's persona + MCP server set. Claude Code 2.1.152 does not honour `tools/list_changed` in-session (spike PoC, ENG-4733)."
+    );
+    console.log();
+    info("When done: `agt impersonate exit`");
+    return;
+  }
+  info("Launching Claude Code\u2026 (use `--no-launch` next time to skip)");
+  console.log();
+  await new Promise((resolve2) => {
+    const child = spawn("claude", {
+      stdio: "inherit",
+      cwd: projectCwd
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") {
+        error(
+          `\`claude\` binary not found on PATH. Start Claude Code yourself from ${projectCwd}, or install the CLI from claude.ai/code.`
+        );
+        process.exitCode = 1;
+      } else {
+        error(`Failed to launch Claude Code: ${err.message}`);
+        process.exitCode = 1;
+      }
+      resolve2();
+    });
+    child.on("exit", (code, signal) => {
+      if (code !== null && code !== 0) process.exitCode = code;
+      if (signal) process.exitCode = 130;
+      resolve2();
+    });
+  });
+  console.log();
+  info("When done: `agt impersonate exit` (still active).");
+}
+async function impersonateCurrentCommand() {
+  requireImpersonateEnabled();
+  const json = isJsonMode();
+  const manifest = readActiveManifest();
+  if (!manifest) {
+    if (json) jsonOutput({ ok: true, active: null });
+    else info("No active impersonation.");
+    return;
+  }
+  const expired = isExpired(manifest);
+  if (json) {
+    jsonOutput({
+      ok: true,
+      active: {
+        code_name: manifest.code_name,
+        agent_id: manifest.agent_id,
+        team_id: manifest.team_id,
+        session_id: manifest.session_id,
+        minted_at: manifest.minted_at,
+        expires_at: manifest.expires_at,
+        expired,
+        project_cwd: manifest.project_cwd,
+        host: manifest.host
+      }
+    });
+    return;
+  }
+  console.log();
+  console.log(chalk10.bold(`Impersonating: ${manifest.code_name}`));
+  console.log(`  Agent ID:    ${chalk10.dim(manifest.agent_id)}`);
+  console.log(`  Team:        ${chalk10.dim(manifest.team_id)}`);
+  console.log(`  Session:     ${chalk10.dim(manifest.session_id)}`);
+  console.log(`  Minted at:   ${chalk10.dim(manifest.minted_at)}`);
+  console.log(
+    `  Expires at:  ${chalk10.dim(new Date(manifest.expires_at * 1e3).toISOString())} ` + (expired ? chalk10.red("(EXPIRED \u2014 run `agt impersonate exit`)") : "")
+  );
+  console.log(`  Project:     ${chalk10.dim(manifest.project_cwd)}`);
+  console.log(`  Host:        ${chalk10.dim(manifest.host)}`);
+  console.log();
+}
+async function impersonateExitCommand() {
+  requireImpersonateEnabled();
+  const json = isJsonMode();
+  const manifest = readActiveManifest();
+  if (!manifest) {
+    if (json) jsonOutput({ ok: true, was_active: false });
+    else info("No active impersonation to exit.");
+    return;
+  }
+  let stopOk = true;
+  let stopDetail = null;
+  try {
+    if (process.env["AGT_API_KEY"]) {
+      await api.post("/impersonate/agent/stop", void 0, {
+        [AGENT_IMPERSONATION_HEADER]: manifest.token
+      });
+    } else {
+      const res = await fetch(`${manifest.host}/impersonate/agent/stop`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          [AGENT_IMPERSONATION_HEADER]: manifest.token
+        }
+      });
+      if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        const detail = body["error"] ?? `HTTP ${res.status}`;
+        stopOk = false;
+        stopDetail = `${detail} (HTTP ${res.status})`;
+      }
+    }
+  } catch (err) {
+    stopOk = false;
+    stopDetail = err instanceof ApiError ? `${err.message} (HTTP ${err.status})` : err instanceof Error ? err.message : String(err);
+  }
+  const restored = [];
+  for (const [file, kind] of Object.entries(manifest.backups)) {
+    const projectPath = join7(manifest.project_cwd, file);
+    try {
+      restoreSwapped(projectPath, kind);
+      restored.push(file);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (!json) error(`Failed to restore ${file}: ${msg}`);
+    }
+  }
+  clearActiveManifest();
+  if (json) {
+    jsonOutput({
+      ok: true,
+      was_active: true,
+      session_id: manifest.session_id,
+      stop_acknowledged: stopOk,
+      stop_detail: stopDetail,
+      restored
+    });
+    return;
+  }
+  success(`Exited impersonation: ${manifest.code_name}`);
+  if (restored.length > 0) {
+    info(`Restored: ${restored.join(", ")}`);
+  }
+  if (!stopOk) {
+    info(`Note: server-side stop not acknowledged (${stopDetail}). Token will expire naturally.`);
+  }
+  info("Restart Claude Code to pick up your original persona.");
+}
+
+// src/commands/drift.ts
+import chalk11 from "chalk";
+import ora11 from "ora";
 
 // ../../packages/core/dist/drift/live-state-reader.js
 import { readFile } from "fs/promises";
 import { createHash } from "crypto";
-import { join as join6 } from "path";
+import { join as join8 } from "path";
 import JSON5 from "json5";
 async function hashFile(filePath) {
   try {
@@ -1583,8 +2030,8 @@ async function readLiveState(options) {
   const toolsFile = trackedFiles.find((f) => f.includes("TOOLS")) ?? "TOOLS.md";
   const [frameworkConfig, charterHash, toolsHash] = await Promise.all([
     readJsonFile(options.configPath),
-    hashFile(join6(options.teamDir, charterFile)),
-    hashFile(join6(options.teamDir, toolsFile))
+    hashFile(join8(options.teamDir, charterFile)),
+    hashFile(join8(options.teamDir, toolsFile))
   ]);
   return {
     frameworkConfig,
@@ -1599,15 +2046,15 @@ var KEBAB_CASE_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 function severityColor(severity) {
   switch (severity) {
     case "critical":
-      return chalk10.red(severity);
+      return chalk11.red(severity);
     case "warning":
-      return chalk10.yellow(severity);
+      return chalk11.yellow(severity);
     default:
-      return chalk10.dim(severity);
+      return chalk11.dim(severity);
   }
 }
 function printDriftReport(report) {
-  console.log(chalk10.bold(`
+  console.log(chalk11.bold(`
 Drift Report: ${report.codeName}
 `));
   info(`Agent ID:    ${report.agentId}`);
@@ -1636,7 +2083,7 @@ async function driftCheckCommand(codeName, opts) {
     return;
   }
   const useJson = opts.json || isJsonMode();
-  const spinner = ora10({ text: `Checking drift for "${codeName}"\u2026`, isSilent: useJson });
+  const spinner = ora11({ text: `Checking drift for "${codeName}"\u2026`, isSilent: useJson });
   spinner.start();
   try {
     const driftData = await api.get(`/agents/${encodeURIComponent(codeName)}/drift-data`);
@@ -1718,14 +2165,14 @@ async function driftWatchCommand(codeName, opts) {
   const trackedFiles = adapter.driftTrackedFiles();
   if (!useJson) {
     console.log(
-      chalk10.bold(`
+      chalk11.bold(`
 Watching drift for "${codeName}" every ${intervalSec}s. Press Ctrl+C to stop.
 `)
     );
   }
   let previousFindingCount = -1;
   const runCheck = async () => {
-    const spinner = ora10({ text: `Checking drift for "${codeName}"\u2026`, isSilent: useJson });
+    const spinner = ora11({ text: `Checking drift for "${codeName}"\u2026`, isSilent: useJson });
     spinner.start();
     try {
       const driftData = await api.get(`/agents/${encodeURIComponent(codeName)}/drift-data`);
@@ -1789,19 +2236,19 @@ Watching drift for "${codeName}" every ${intervalSec}s. Press Ctrl+C to stop.
   }, intervalSec * 1e3);
   process.on("SIGINT", () => {
     clearInterval(timer);
-    if (!useJson) console.log(chalk10.dim("\nStopped watching."));
+    if (!useJson) console.log(chalk11.dim("\nStopped watching."));
     process.exit(0);
   });
 }
 
 // src/commands/host.ts
-import chalk11 from "chalk";
-import ora11 from "ora";
+import chalk12 from "chalk";
+import ora12 from "ora";
 async function hostListCommand() {
   const teamSlug = requireTeam();
   if (!teamSlug) return;
   const json = isJsonMode();
-  const spinner = ora11({ text: "Fetching hosts\u2026", isSilent: json });
+  const spinner = ora12({ text: "Fetching hosts\u2026", isSilent: json });
   spinner.start();
   try {
     const data = await api.get("/hosts");
@@ -1819,10 +2266,10 @@ async function hostListCommand() {
       return;
     }
     const rows = data.hosts.map((h) => {
-      const status = h.status === "active" ? chalk11.green("active") : chalk11.red("decommissioned");
+      const status = h.status === "active" ? chalk12.green("active") : chalk12.red("decommissioned");
       const agents = String(h.agents);
-      const lastSeen = h.last_seen_at ? new Date(h.last_seen_at).toLocaleDateString() : chalk11.dim("never");
-      const prefix = h.key_prefix ? `tlk_${h.key_prefix}\u2026` : chalk11.dim("none");
+      const lastSeen = h.last_seen_at ? new Date(h.last_seen_at).toLocaleDateString() : chalk12.dim("never");
+      const prefix = h.key_prefix ? `tlk_${h.key_prefix}\u2026` : chalk12.dim("none");
       return [h.name, status, agents, lastSeen, prefix];
     });
     table(["Name", "Status", "Agents", "Last Seen", "Key"], rows);
@@ -1849,14 +2296,14 @@ async function hostAssignCommand(hostName, agentCodeNames, opts) {
     process.exitCode = 1;
     return;
   }
-  const spinner = ora11({ text: "Assigning agents\u2026", isSilent: json });
+  const spinner = ora12({ text: "Assigning agents\u2026", isSilent: json });
   spinner.start();
   try {
     await api.post(`/hosts/${encodeURIComponent(hostName)}/assign`, {
       agents: agentCodeNames,
       force: opts.force
     });
-    spinner.succeed(`Agents assigned to ${chalk11.bold(hostName)}.`);
+    spinner.succeed(`Agents assigned to ${chalk12.bold(hostName)}.`);
     if (json) {
       jsonOutput({ ok: true, host: hostName, assigned: agentCodeNames });
       return;
@@ -1887,13 +2334,13 @@ async function hostUnassignCommand(hostName, agentCodeNames) {
     process.exitCode = 1;
     return;
   }
-  const spinner = ora11({ text: "Unassigning agents\u2026", isSilent: json });
+  const spinner = ora12({ text: "Unassigning agents\u2026", isSilent: json });
   spinner.start();
   try {
     await api.post(`/hosts/${encodeURIComponent(hostName)}/unassign`, {
       agents: agentCodeNames
     });
-    spinner.succeed(`Agents unassigned from ${chalk11.bold(hostName)}.`);
+    spinner.succeed(`Agents unassigned from ${chalk12.bold(hostName)}.`);
     if (json) {
       jsonOutput({ ok: true, host: hostName, unassigned: agentCodeNames });
       return;
@@ -1913,7 +2360,7 @@ async function hostUnassignCommand(hostName, agentCodeNames) {
 }
 async function hostAgentsCommand(hostName) {
   const json = isJsonMode();
-  const spinner = ora11({ text: "Fetching host agents\u2026", isSilent: json });
+  const spinner = ora12({ text: "Fetching host agents\u2026", isSilent: json });
   spinner.start();
   try {
     const hostId = await getHostId();
@@ -1952,7 +2399,7 @@ async function hostAgentsCommand(hostName) {
       return;
     }
     const rows = agents.map((a) => {
-      const statusColor = a.status === "active" ? chalk11.green : chalk11.yellow;
+      const statusColor = a.status === "active" ? chalk12.green : chalk12.yellow;
       return [
         a.code_name,
         a.display_name,
@@ -1975,11 +2422,11 @@ async function hostRotateKeyCommand(hostName) {
   const teamSlug = requireTeam();
   if (!teamSlug) return;
   const json = isJsonMode();
-  const spinner = ora11({ text: "Rotating host key\u2026", isSilent: json });
+  const spinner = ora12({ text: "Rotating host key\u2026", isSilent: json });
   spinner.start();
   try {
     const data = await api.post(`/hosts/${encodeURIComponent(hostName)}/rotate-key`);
-    spinner.succeed(`Key rotated for ${chalk11.bold(hostName)}.`);
+    spinner.succeed(`Key rotated for ${chalk12.bold(hostName)}.`);
     if (json) {
       jsonOutput({
         ok: true,
@@ -1989,12 +2436,12 @@ async function hostRotateKeyCommand(hostName) {
       return;
     }
     console.log();
-    info(`Host:   ${chalk11.bold(hostName)}`);
+    info(`Host:   ${chalk12.bold(hostName)}`);
     info(`Prefix: ${data.key.prefix}`);
     console.log();
-    console.log(chalk11.yellow.bold("  Save this key now \u2014 it will not be shown again:"));
+    console.log(chalk12.yellow.bold("  Save this key now \u2014 it will not be shown again:"));
     console.log();
-    console.log(`  ${chalk11.green.bold(data.key.raw_key)}`);
+    console.log(`  ${chalk12.green.bold(data.key.raw_key)}`);
     console.log();
   } catch (err) {
     spinner.fail("Failed to rotate key.");
@@ -2010,11 +2457,11 @@ async function hostDecommissionCommand(hostName) {
   const teamSlug = requireTeam();
   if (!teamSlug) return;
   const json = isJsonMode();
-  const spinner = ora11({ text: "Decommissioning host\u2026", isSilent: json });
+  const spinner = ora12({ text: "Decommissioning host\u2026", isSilent: json });
   spinner.start();
   try {
     await api.post(`/hosts/${encodeURIComponent(hostName)}/decommission`);
-    spinner.succeed(`Host "${chalk11.bold(hostName)}" decommissioned.`);
+    spinner.succeed(`Host "${chalk12.bold(hostName)}" decommissioned.`);
     if (json) {
       jsonOutput({
         ok: true,
@@ -2024,7 +2471,7 @@ async function hostDecommissionCommand(hostName) {
       return;
     }
     info(`Host:   ${hostName}`);
-    info(`Status: ${chalk11.red("decommissioned")}`);
+    info(`Status: ${chalk12.red("decommissioned")}`);
     info("API key revoked. Agents remain assigned for audit visibility.");
     info("Reassign agents to another host with `agt host assign --force`.");
   } catch (err) {
@@ -2039,8 +2486,8 @@ async function hostDecommissionCommand(hostName) {
 }
 
 // src/commands/host-pair.ts
-import { spawn, spawnSync } from "child_process";
-import chalk12 from "chalk";
+import { spawn as spawn2, spawnSync } from "child_process";
+import chalk13 from "chalk";
 async function hostPairCommand(name, opts) {
   const teamSlug = requireTeam();
   if (!teamSlug) return;
@@ -2110,17 +2557,17 @@ async function hostPairCommand(name, opts) {
     });
     return;
   }
-  info(`Pairing Claude Code on ${chalk12.bold(name)} (${instanceId}, ${region})`);
-  info(`Local port ${chalk12.cyan(String(localPort))} will be forwarded to the host.`);
+  info(`Pairing Claude Code on ${chalk13.bold(name)} (${instanceId}, ${region})`);
+  info(`Local port ${chalk13.cyan(String(localPort))} will be forwarded to the host.`);
   console.log();
-  console.log(chalk12.dim("In the shell that opens, run:"));
-  console.log(`  ${chalk12.cyan(`CLAUDE_CODE_OAUTH_PORT=${localPort} claude /login`)}`);
-  console.log(chalk12.dim("Then click the printed URL on this machine. The OAuth callback"));
-  console.log(chalk12.dim(`will reach Claude Code via the port-forward tunnel.`));
+  console.log(chalk13.dim("In the shell that opens, run:"));
+  console.log(`  ${chalk13.cyan(`CLAUDE_CODE_OAUTH_PORT=${localPort} claude /login`)}`);
+  console.log(chalk13.dim("Then click the printed URL on this machine. The OAuth callback"));
+  console.log(chalk13.dim(`will reach Claude Code via the port-forward tunnel.`));
   console.log();
-  console.log(chalk12.dim("Exit the shell (Ctrl+D) when Claude Code reports successful login."));
+  console.log(chalk13.dim("Exit the shell (Ctrl+D) when Claude Code reports successful login."));
   console.log();
-  const tunnel = spawn(
+  const tunnel = spawn2(
     "aws",
     [
       "ssm",
@@ -2139,7 +2586,7 @@ async function hostPairCommand(name, opts) {
   tunnel.stderr?.on("data", (buf) => {
     const line = buf.toString().trim();
     if (line.startsWith("An error occurred")) {
-      console.error(chalk12.red(`[tunnel] ${line}`));
+      console.error(chalk13.red(`[tunnel] ${line}`));
     }
   });
   await new Promise((r) => setTimeout(r, 1500));
@@ -2149,7 +2596,7 @@ async function hostPairCommand(name, opts) {
     return;
   }
   if (opts.noShell) {
-    console.log(chalk12.dim("--no-shell set; tunnel is running. Press Ctrl+C to exit."));
+    console.log(chalk13.dim("--no-shell set; tunnel is running. Press Ctrl+C to exit."));
     await new Promise((resolve2) => {
       const onSignal = () => {
         terminate(tunnel);
@@ -2177,7 +2624,7 @@ function preflightAws() {
 }
 function runInteractive(cmd, args) {
   return new Promise((resolve2) => {
-    const child = spawn(cmd, args, { stdio: "inherit" });
+    const child = spawn2(cmd, args, { stdio: "inherit" });
     child.on("exit", (code) => resolve2(code ?? 0));
     child.on("error", () => resolve2(1));
   });
@@ -2193,15 +2640,15 @@ function terminate(child) {
 // src/commands/manager-watch.tsx
 import { useEffect, useState, useMemo } from "react";
 import { render, Box, Text, useApp, useInput } from "ink";
-import { existsSync as existsSync2, readFileSync as readFileSync2, statSync, openSync, readSync, closeSync } from "fs";
-import { homedir } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3, statSync, openSync, readSync, closeSync } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join9 } from "path";
 import { jsx, jsxs } from "react/jsx-runtime";
 var REFRESH_MS = 1e3;
 var LOG_TAIL_LINES = 200;
 var DETAIL_RECENT_LINES = 50;
 function managerWatchCommand(opts = {}) {
-  const configDir = opts.configDir ?? join7(homedir(), ".augmented");
+  const configDir = opts.configDir ?? join9(homedir3(), ".augmented");
   const paths = getManagerPaths(configDir);
   const isTty = process.stdout.isTTY === true && process.stdin.isTTY === true;
   if (opts.noTui || !isTty) {
@@ -2225,15 +2672,15 @@ function managerWatchCommand(opts = {}) {
 }
 function readState(stateFile) {
   try {
-    if (!existsSync2(stateFile)) return null;
-    const raw = readFileSync2(stateFile, "utf-8");
+    if (!existsSync4(stateFile)) return null;
+    const raw = readFileSync3(stateFile, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
   }
 }
 function tailLogFile(logFile, lines) {
-  if (!existsSync2(logFile)) return [];
+  if (!existsSync4(logFile)) return [];
   try {
     const fileSize = statSync(logFile).size;
     if (fileSize === 0) return [];
@@ -2474,7 +2921,7 @@ function truncate(s, max) {
   return s.length > max ? `${s.slice(0, Math.max(0, max - 1))}\u2026` : s;
 }
 function streamLogFile(logFile) {
-  if (!existsSync2(logFile)) {
+  if (!existsSync4(logFile)) {
     process.stderr.write(`No manager log found at ${logFile}.
 Start the manager first: agt manager start
 `);
@@ -2483,7 +2930,7 @@ Start the manager first: agt manager start
   }
   let lastSize = 0;
   try {
-    const initial = readFileSync2(logFile, "utf-8");
+    const initial = readFileSync3(logFile, "utf-8");
     process.stdout.write(initial);
     lastSize = statSync(logFile).size;
   } catch (err) {
@@ -2518,16 +2965,16 @@ Start the manager first: agt manager start
 }
 
 // src/commands/agent.ts
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 import JSON52 from "json5";
-import { readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
-import { join as join8 } from "path";
+import { readFileSync as readFileSync4, existsSync as existsSync5 } from "fs";
+import { join as join10 } from "path";
 async function agentShowCommand(codeName, opts) {
   const json = isJsonMode();
-  const unifiedDir = join8(opts.configDir, codeName, "provision");
-  const legacyDir = join8(opts.configDir, codeName, "claudecode", "provision");
-  const agentDir = existsSync3(unifiedDir) ? unifiedDir : legacyDir;
-  const hasLocalConfig = existsSync3(agentDir);
+  const unifiedDir = join10(opts.configDir, codeName, "provision");
+  const legacyDir = join10(opts.configDir, codeName, "claudecode", "provision");
+  const agentDir = existsSync5(unifiedDir) ? unifiedDir : legacyDir;
+  const hasLocalConfig = existsSync5(agentDir);
   let apiChannels = null;
   let apiAgent = null;
   if (getApiKey()) {
@@ -2560,34 +3007,34 @@ async function agentShowCommand(codeName, opts) {
   let openclawConfig = null;
   let agentState = null;
   if (hasLocalConfig) {
-    const charterPath = join8(agentDir, "CHARTER.md");
-    if (existsSync3(charterPath)) {
-      const raw = readFileSync3(charterPath, "utf-8");
+    const charterPath = join10(agentDir, "CHARTER.md");
+    if (existsSync5(charterPath)) {
+      const raw = readFileSync4(charterPath, "utf-8");
       const parsed = extractFrontmatter(raw);
       if (parsed.frontmatter) {
         charter = parsed.frontmatter;
       }
     }
-    const toolsPath = join8(agentDir, "TOOLS.md");
-    if (existsSync3(toolsPath)) {
-      const raw = readFileSync3(toolsPath, "utf-8");
+    const toolsPath = join10(agentDir, "TOOLS.md");
+    if (existsSync5(toolsPath)) {
+      const raw = readFileSync4(toolsPath, "utf-8");
       const parsed = extractFrontmatter(raw);
       if (parsed.frontmatter) {
         tools = parsed.frontmatter;
       }
     }
-    const openclawPath = join8(agentDir, "openclaw.json5");
-    if (existsSync3(openclawPath)) {
+    const openclawPath = join10(agentDir, "openclaw.json5");
+    if (existsSync5(openclawPath)) {
       try {
-        const raw = readFileSync3(openclawPath, "utf-8");
+        const raw = readFileSync4(openclawPath, "utf-8");
         openclawConfig = JSON52.parse(raw);
       } catch {
       }
     }
-    const statePath = join8(opts.configDir, "manager-state.json");
-    if (existsSync3(statePath)) {
+    const statePath = join10(opts.configDir, "manager-state.json");
+    if (existsSync5(statePath)) {
       try {
-        const raw = readFileSync3(statePath, "utf-8");
+        const raw = readFileSync4(statePath, "utf-8");
         const state = JSON.parse(raw);
         agentState = state.agents?.find((a) => a.codeName === codeName) ?? null;
       } catch {
@@ -2654,7 +3101,7 @@ async function agentShowCommand(codeName, opts) {
     return;
   }
   const displayName = apiAgent?.display_name ?? charter?.display_name ?? codeName;
-  console.log(chalk13.bold(`
+  console.log(chalk14.bold(`
 Agent: ${codeName}`) + (displayName !== codeName ? ` (${displayName})` : "") + "\n");
   if (charter || apiAgent) {
     const agentId = apiAgent?.agent_id ?? charter?.agent_id;
@@ -2686,7 +3133,7 @@ Agent: ${codeName}`) + (displayName !== codeName ? ` (${displayName})` : "") + "
     info("No agent metadata available");
   }
   const filtered = opts.allChannels ? channelRows : channelRows.filter((c) => c.enabled);
-  console.log(chalk13.bold("\nChannels:"));
+  console.log(chalk14.bold("\nChannels:"));
   if (filtered.length === 0) {
     info("(none enabled)");
   } else {
@@ -2702,7 +3149,7 @@ Agent: ${codeName}`) + (displayName !== codeName ? ` (${displayName})` : "") + "
     );
   }
   if (tools) {
-    console.log(chalk13.bold("\nTools:"));
+    console.log(chalk14.bold("\nTools:"));
     if (tools.tools.length === 0) {
       info("(none configured)");
     } else {
@@ -2713,7 +3160,7 @@ Agent: ${codeName}`) + (displayName !== codeName ? ` (${displayName})` : "") + "
     }
     if (tools.global_controls) {
       const gc = tools.global_controls;
-      console.log(chalk13.bold("\nGlobal Controls:"));
+      console.log(chalk14.bold("\nGlobal Controls:"));
       info(`Network:   ${gc.default_network_policy === "deny" ? "deny-by-default" : "allow-by-default"}`);
       info(`Timeout:   ${gc.default_timeout_ms}ms`);
       info(`Rate:      ${gc.default_rate_limit_rpm} rpm`);
@@ -2729,8 +3176,8 @@ function formatTimestamp(iso) {
 }
 
 // src/commands/kanban-recurring.ts
-import chalk14 from "chalk";
-import ora12 from "ora";
+import chalk15 from "chalk";
+import ora13 from "ora";
 async function resolveAgentId(codeName) {
   try {
     const data = await api.get(`/agents/${codeName}`);
@@ -2741,10 +3188,10 @@ async function resolveAgentId(codeName) {
   }
 }
 function priorityLabel(p) {
-  return p === 1 ? chalk14.red("HIGH") : p === 3 ? chalk14.dim("LOW") : chalk14.yellow("MED");
+  return p === 1 ? chalk15.red("HIGH") : p === 3 ? chalk15.dim("LOW") : chalk15.yellow("MED");
 }
 function formatSpawnTime(isoDate, timezone) {
-  if (!isoDate) return chalk14.dim("\u2014");
+  if (!isoDate) return chalk15.dim("\u2014");
   try {
     return new Intl.DateTimeFormat("en-AU", {
       dateStyle: "medium",
@@ -2785,7 +3232,7 @@ async function kanbanRecurringAddCommand(title, opts) {
       return;
     }
   }
-  const spinner = ora12({ text: "Creating recurring template\u2026", isSilent: json });
+  const spinner = ora13({ text: "Creating recurring template\u2026", isSilent: json });
   spinner.start();
   const agentId = await resolveAgentId(opts.agent);
   if (!agentId) {
@@ -2809,8 +3256,8 @@ async function kanbanRecurringAddCommand(title, opts) {
       jsonOutput({ ok: true, template: data.template });
       return;
     }
-    success(`Recurring task created: ${chalk14.bold(title)}`);
-    info(`Schedule:   ${chalk14.cyan(data.template.natural_language ?? data.template.expression ?? data.template.every_interval ?? "")}`);
+    success(`Recurring task created: ${chalk15.bold(title)}`);
+    info(`Schedule:   ${chalk15.cyan(data.template.natural_language ?? data.template.expression ?? data.template.every_interval ?? "")}`);
     info(`Next spawn: ${formatSpawnTime(data.template.next_spawn_at, data.template.timezone)}`);
     info(`Timezone:   ${data.template.timezone}`);
   } catch (err) {
@@ -2827,7 +3274,7 @@ async function kanbanRecurringListCommand(opts) {
   const teamSlug = requireTeam();
   if (!teamSlug) return;
   const json = isJsonMode();
-  const spinner = ora12({ text: "Fetching recurring templates\u2026", isSilent: json });
+  const spinner = ora13({ text: "Fetching recurring templates\u2026", isSilent: json });
   spinner.start();
   const agentId = await resolveAgentId(opts.agent);
   if (!agentId) {
@@ -2853,7 +3300,7 @@ async function kanbanRecurringListCommand(opts) {
       t.title,
       t.natural_language ?? t.expression ?? t.every_interval ?? "\u2014",
       priorityLabel(t.priority),
-      t.enabled ? chalk14.green("Active") : chalk14.dim("Disabled"),
+      t.enabled ? chalk15.green("Active") : chalk15.dim("Disabled"),
       formatSpawnTime(t.next_spawn_at, t.timezone),
       String(t.spawn_count)
     ]);
@@ -2875,7 +3322,7 @@ async function kanbanRecurringDisableCommand(titleOrId, opts) {
   const teamSlug = requireTeam();
   if (!teamSlug) return;
   const json = isJsonMode();
-  const spinner = ora12({ text: "Disabling recurring template\u2026", isSilent: json });
+  const spinner = ora13({ text: "Disabling recurring template\u2026", isSilent: json });
   spinner.start();
   const agentId = await resolveAgentId(opts.agent);
   if (!agentId) {
@@ -2910,7 +3357,7 @@ async function kanbanRecurringDisableCommand(titleOrId, opts) {
     if (json) {
       jsonOutput({ ok: true, id: match.id, title: match.title, enabled: false });
     } else {
-      success(`Disabled: ${chalk14.bold(match.title)}`);
+      success(`Disabled: ${chalk15.bold(match.title)}`);
     }
   } catch (err) {
     spinner.fail("Failed to disable recurring template");
@@ -2924,24 +3371,24 @@ async function kanbanRecurringDisableCommand(titleOrId, opts) {
 }
 
 // src/commands/setup.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, accessSync, constants as fsConstants } from "fs";
-import { join as join9, dirname } from "path";
-import { homedir as homedir2 } from "os";
-import chalk15 from "chalk";
-import ora13 from "ora";
+import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync6, mkdirSync as mkdirSync5, accessSync, constants as fsConstants } from "fs";
+import { join as join11, dirname } from "path";
+import { homedir as homedir4 } from "os";
+import chalk16 from "chalk";
+import ora14 from "ora";
 function detectShellProfile() {
   const shell = process.env["SHELL"] ?? "";
-  const home = homedir2();
+  const home = homedir4();
   if (shell.includes("zsh")) {
-    return join9(home, ".zshrc");
+    return join11(home, ".zshrc");
   }
   if (shell.includes("fish")) {
-    const fishConfig = join9(home, ".config", "fish", "config.fish");
+    const fishConfig = join11(home, ".config", "fish", "config.fish");
     return fishConfig;
   }
-  const bashrc = join9(home, ".bashrc");
-  if (existsSync4(bashrc)) return bashrc;
-  return join9(home, ".bash_profile");
+  const bashrc = join11(home, ".bashrc");
+  if (existsSync6(bashrc)) return bashrc;
+  return join11(home, ".bash_profile");
 }
 function maybeWriteSystemWideEnv(apiUrl, apiKey, consoleUrl) {
   const empty = { etcEnvironment: false, profileD: false, bashrc: false };
@@ -2967,14 +3414,14 @@ function quoteForFishShell(value) {
 }
 function writeEtcEnvironment(apiUrl, apiKey, consoleUrl) {
   const envPath = "/etc/environment";
-  if (!existsSync4(envPath)) return false;
+  if (!existsSync6(envPath)) return false;
   try {
     accessSync(envPath, fsConstants.W_OK);
   } catch {
     return false;
   }
   try {
-    const current = readFileSync4(envPath, "utf-8");
+    const current = readFileSync5(envPath, "utf-8");
     const stripped = current.split(/\r?\n/).filter((line) => !/^\s*(?:export\s+)?AGT_(?:HOST|API_KEY|CONSOLE_URL)=/.test(line)).join("\n");
     const base = stripped.endsWith("\n") || stripped.length === 0 ? stripped : `${stripped}
 `;
@@ -2985,7 +3432,7 @@ function writeEtcEnvironment(apiUrl, apiKey, consoleUrl) {
     if (consoleUrl) lines.push(`AGT_CONSOLE_URL=${quoteForEtcEnvironment(consoleUrl)}`);
     const appended = `${base}${lines.join("\n")}
 `;
-    writeFileSync4(envPath, appended, { mode: 420 });
+    writeFileSync6(envPath, appended, { mode: 420 });
     return true;
   } catch {
     return false;
@@ -2993,7 +3440,7 @@ function writeEtcEnvironment(apiUrl, apiKey, consoleUrl) {
 }
 function writeProfileDScript(apiUrl, apiKey, consoleUrl) {
   const profileD = "/etc/profile.d";
-  if (!existsSync4(profileD)) return false;
+  if (!existsSync6(profileD)) return false;
   try {
     accessSync(profileD, fsConstants.W_OK);
   } catch {
@@ -3008,7 +3455,7 @@ function writeProfileDScript(apiUrl, apiKey, consoleUrl) {
     ];
     if (consoleUrl) lines.push(`export AGT_CONSOLE_URL=${quoteForPosixShell(consoleUrl)}`);
     lines.push("");
-    writeFileSync4(scriptPath, lines.join("\n"), { mode: 420 });
+    writeFileSync6(scriptPath, lines.join("\n"), { mode: 420 });
     return true;
   } catch {
     return false;
@@ -3016,14 +3463,14 @@ function writeProfileDScript(apiUrl, apiKey, consoleUrl) {
 }
 function ensureBashrcSourcesProfileD() {
   const bashrc = "/etc/bashrc";
-  if (!existsSync4(bashrc)) return false;
+  if (!existsSync6(bashrc)) return false;
   try {
     accessSync(bashrc, fsConstants.W_OK);
   } catch {
     return false;
   }
   try {
-    const current = readFileSync4(bashrc, "utf-8");
+    const current = readFileSync5(bashrc, "utf-8");
     const marker = "# Augmented (agt) \u2014 source system-wide AGT env";
     if (current.includes(marker)) return true;
     const snippet = [
@@ -3034,7 +3481,7 @@ function ensureBashrcSourcesProfileD() {
       "fi",
       ""
     ].join("\n");
-    writeFileSync4(bashrc, current + snippet);
+    writeFileSync6(bashrc, current + snippet);
     return true;
   } catch {
     return false;
@@ -3081,10 +3528,10 @@ async function setupCommand(token) {
   if (!apiUrl) {
     apiUrl = "https://api.augmented.team";
     if (!json) {
-      info(`No AGT_HOST set \u2014 using default: ${chalk15.bold(apiUrl)}`);
+      info(`No AGT_HOST set \u2014 using default: ${chalk16.bold(apiUrl)}`);
     }
   }
-  const spinner = ora13({ text: "Exchanging provisioning token\u2026", isSilent: json });
+  const spinner = ora14({ text: "Exchanging provisioning token\u2026", isSilent: json });
   spinner.start();
   let setupResult;
   try {
@@ -3112,17 +3559,17 @@ async function setupCommand(token) {
   const finalApiUrl = setupResult.api_url || apiUrl;
   process.env["AGT_HOST"] = finalApiUrl;
   process.env["AGT_API_KEY"] = setupResult.api_key;
-  const verifySpinner = ora13({ text: "Verifying connection\u2026", isSilent: json });
+  const verifySpinner = ora14({ text: "Verifying connection\u2026", isSilent: json });
   verifySpinner.start();
   try {
     const exchange = await exchangeApiKey(setupResult.api_key);
     verifySpinner.succeed("Connection verified");
     if (!json) {
-      info(`Host:       ${chalk15.bold(setupResult.host_name)}`);
+      info(`Host:       ${chalk16.bold(setupResult.host_name)}`);
       info(`Host ID:    ${exchange.hostId}`);
-      info(`Team:       ${chalk15.bold(exchange.teamSlug ?? setupResult.team_slug ?? "unknown")}`);
+      info(`Team:       ${chalk16.bold(exchange.teamSlug ?? setupResult.team_slug ?? "unknown")}`);
       if (exchange.userEmail) {
-        info(`User:       ${chalk15.bold(exchange.userEmail)}`);
+        info(`User:       ${chalk16.bold(exchange.userEmail)}`);
       }
     }
   } catch (err) {
@@ -3150,11 +3597,11 @@ async function setupCommand(token) {
   }
   const exportLines = buildExportLines(shell, finalApiUrl, setupResult.api_key, consoleUrl);
   const profileDir = dirname(profilePath);
-  if (!existsSync4(profileDir)) {
-    mkdirSync4(profileDir, { recursive: true });
+  if (!existsSync6(profileDir)) {
+    mkdirSync5(profileDir, { recursive: true });
   }
   const marker = "# Augmented (agt) host configuration";
-  const current = existsSync4(profilePath) ? readFileSync4(profilePath, "utf-8") : "";
+  const current = existsSync6(profilePath) ? readFileSync5(profilePath, "utf-8") : "";
   let updated;
   if (current.includes(marker)) {
     updated = current.replace(
@@ -3167,10 +3614,10 @@ async function setupCommand(token) {
   } else {
     updated = current + exportLines;
   }
-  writeFileSync4(profilePath, updated.endsWith("\n") ? updated : `${updated}
+  writeFileSync6(profilePath, updated.endsWith("\n") ? updated : `${updated}
 `);
   if (!json) {
-    success(`Environment variables written to ${chalk15.bold(profilePath)}`);
+    success(`Environment variables written to ${chalk16.bold(profilePath)}`);
   }
   const sys = maybeWriteSystemWideEnv(finalApiUrl, setupResult.api_key, consoleUrl);
   const valueChannelsWritten = sys.etcEnvironment || sys.profileD;
@@ -3182,10 +3629,10 @@ async function setupCommand(token) {
     ].filter(Boolean).join(" + ");
     success(`System-wide env updated: ${channels2}`);
   }
-  const managerSpinner = ora13({ text: "Starting manager daemon\u2026", isSilent: json });
+  const managerSpinner = ora14({ text: "Starting manager daemon\u2026", isSilent: json });
   managerSpinner.start();
   try {
-    const configDir = join9(homedir2(), ".augmented");
+    const configDir = join11(homedir4(), ".augmented");
     const { pid } = startWatchdog({ intervalMs: 1e4, configDir, detached: true });
     managerSpinner.succeed(`Manager started (PID ${pid})`);
   } catch (err) {
@@ -3210,21 +3657,21 @@ async function setupCommand(token) {
     process.exit(0);
   } else {
     console.log();
-    console.log(chalk15.green.bold("  Setup complete!"));
+    console.log(chalk16.green.bold("  Setup complete!"));
     console.log();
     if (setupResult.agents.length > 0) {
-      info(`Agents:     ${setupResult.agents.map((a) => chalk15.cyan(a)).join(", ")}`);
+      info(`Agents:     ${setupResult.agents.map((a) => chalk16.cyan(a)).join(", ")}`);
     } else {
       info("No agents assigned yet. Assign agents in the dashboard or with: agt host assign");
     }
     console.log();
-    info(`Restart your shell or run: ${chalk15.bold(`source ${profilePath}`)}`);
+    info(`Restart your shell or run: ${chalk16.bold(`source ${profilePath}`)}`);
   }
 }
 
 // src/commands/kanban.ts
-import chalk16 from "chalk";
-import ora14 from "ora";
+import chalk17 from "chalk";
+import ora15 from "ora";
 async function resolveAgentId2(codeName) {
   try {
     const data = await api.get(`/agents/${codeName}`);
@@ -3234,14 +3681,14 @@ async function resolveAgentId2(codeName) {
   }
 }
 function priorityLabel2(p) {
-  return p === 1 ? chalk16.red("HIGH") : p === 3 ? chalk16.dim("LOW") : chalk16.yellow("MED");
+  return p === 1 ? chalk17.red("HIGH") : p === 3 ? chalk17.dim("LOW") : chalk17.yellow("MED");
 }
 function statusLabel(s) {
   const map = {
-    in_progress: chalk16.blue("In Progress"),
-    todo: chalk16.green("To Do"),
-    backlog: chalk16.dim("Backlog"),
-    done: chalk16.gray("Done")
+    in_progress: chalk17.blue("In Progress"),
+    todo: chalk17.green("To Do"),
+    backlog: chalk17.dim("Backlog"),
+    done: chalk17.gray("Done")
   };
   return map[s] ?? s;
 }
@@ -3249,7 +3696,7 @@ async function kanbanListCommand(opts) {
   const teamSlug = requireTeam();
   if (!teamSlug) return;
   const json = isJsonMode();
-  const spinner = ora14({ text: "Fetching kanban board\u2026", isSilent: json });
+  const spinner = ora15({ text: "Fetching kanban board\u2026", isSilent: json });
   spinner.start();
   const agentId = await resolveAgentId2(opts.agent);
   if (!agentId) {
@@ -3277,7 +3724,7 @@ async function kanbanListCommand(opts) {
       item.estimated_minutes ? `~${item.estimated_minutes}min` : "",
       item.id.slice(0, 8)
     ]);
-    console.log(chalk16.bold(`
+    console.log(chalk17.bold(`
 Kanban: ${opts.agent}
 `));
     table(["Pri", "Status", "Title", "Est", "ID"], rows);
@@ -3517,7 +3964,7 @@ function getAcpAgent(name) {
 }
 
 // ../../packages/core/dist/acp/client.js
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 function resolveAgentCommand(agentName) {
   const adapter = getAcpAgent(agentName);
   if (adapter) {
@@ -3533,7 +3980,7 @@ function resolveAgentCommand(agentName) {
 }
 async function runAcpx(args, options = {}) {
   return new Promise((resolve2) => {
-    const child = spawn2("acpx", args, {
+    const child = spawn3("acpx", args, {
       cwd: options.cwd,
       stdio: ["pipe", "pipe", "pipe"],
       env: { ...process.env }
@@ -3733,10 +4180,10 @@ async function acpxCloseCommand(agent2, _opts, cmd) {
 
 // src/commands/update.ts
 import { execFileSync, execSync } from "child_process";
-import { existsSync as existsSync5, realpathSync } from "fs";
-import chalk17 from "chalk";
-import ora15 from "ora";
-var cliVersion = true ? "0.26.2-eng5706.1" : "dev";
+import { existsSync as existsSync7, realpathSync as realpathSync2 } from "fs";
+import chalk18 from "chalk";
+import ora16 from "ora";
+var cliVersion = true ? "0.27.0" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -3800,7 +4247,7 @@ function detectActiveSessions() {
 }
 function detectInstallSource() {
   try {
-    const resolved = realpathSync(process.argv[1] ?? "");
+    const resolved = realpathSync2(process.argv[1] ?? "");
     if (/\/Cellar\/[^/]+\//.test(resolved)) {
       return "brew";
     }
@@ -3840,7 +4287,7 @@ function performUpdate(version) {
 function detectBrewOwner() {
   for (const prefix of ["/home/linuxbrew/.linuxbrew", "/opt/homebrew", "/usr/local"]) {
     const cellar = `${prefix}/Cellar`;
-    if (!existsSync5(cellar)) continue;
+    if (!existsSync7(cellar)) continue;
     try {
       return execSync(`stat -c %U "${cellar}" 2>/dev/null || stat -f %Su "${cellar}"`, { encoding: "utf-8" }).trim() || null;
     } catch {
@@ -3850,7 +4297,7 @@ function detectBrewOwner() {
 }
 async function updateCommand(opts = {}) {
   const json = isJsonMode();
-  const spinner = ora15({ text: "Checking for updates\u2026", isSilent: json });
+  const spinner = ora16({ text: "Checking for updates\u2026", isSilent: json });
   spinner.start();
   const versionInfo = await fetchLatestVersion();
   if (!versionInfo) {
@@ -3869,13 +4316,13 @@ async function updateCommand(opts = {}) {
     if (json) {
       jsonOutput({ ok: true, current: cliVersion, latest: versionInfo.latest, update_available: false });
     } else {
-      success(`You're on the latest version (${chalk17.bold(cliVersion)})`);
+      success(`You're on the latest version (${chalk18.bold(cliVersion)})`);
     }
     return;
   }
   spinner.stop();
   if (!json) {
-    info(`Update available: ${chalk17.dim(cliVersion)} \u2192 ${chalk17.bold.green(versionInfo.latest)}`);
+    info(`Update available: ${chalk18.dim(cliVersion)} \u2192 ${chalk18.bold.green(versionInfo.latest)}`);
     if (versionInfo.changelog_url) {
       info(`Changelog: ${versionInfo.changelog_url}`);
     }
@@ -3886,16 +4333,16 @@ async function updateCommand(opts = {}) {
       if (!json) {
         warn("Active processes detected:");
         if (managerPid) {
-          console.error(chalk17.yellow(`  \u2022 Manager process running (PID ${managerPid})`));
+          console.error(chalk18.yellow(`  \u2022 Manager process running (PID ${managerPid})`));
         }
         if (tmuxSessions.length > 0) {
-          console.error(chalk17.yellow(`  \u2022 ${tmuxSessions.length} active agent session(s): ${tmuxSessions.join(", ")}`));
+          console.error(chalk18.yellow(`  \u2022 ${tmuxSessions.length} active agent session(s): ${tmuxSessions.join(", ")}`));
         }
         console.error();
         warn("Updating while the manager is running will leave it on the old version until restarted.");
         warn("Active agent sessions will continue with stale MCP servers.");
         console.error();
-        info(`Run ${chalk17.bold("agt update --force")} to update anyway, then restart the manager.`);
+        info(`Run ${chalk18.bold("agt update --force")} to update anyway, then restart the manager.`);
       } else {
         jsonOutput({
           ok: false,
@@ -3913,7 +4360,7 @@ async function updateCommand(opts = {}) {
       return;
     }
   }
-  const updateSpinner = ora15({ text: "Installing update\u2026", isSilent: json });
+  const updateSpinner = ora16({ text: "Installing update\u2026", isSilent: json });
   updateSpinner.start();
   try {
     performUpdate(versionInfo.latest);
@@ -3927,8 +4374,8 @@ async function updateCommand(opts = {}) {
         updated: true
       });
     } else {
-      success(`Updated to ${chalk17.bold(versionInfo.latest)}`);
-      info(`If you have a running manager, restart it: ${chalk17.bold("agt manager stop && agt manager start")}`);
+      success(`Updated to ${chalk18.bold(versionInfo.latest)}`);
+      info(`If you have a running manager, restart it: ${chalk18.bold("agt manager stop && agt manager start")}`);
     }
   } catch (err) {
     updateSpinner.fail("Update failed");
@@ -3959,8 +4406,8 @@ async function checkForUpdateOnStartup() {
     if (!versionInfo) return;
     if (isNewerVersion(cliVersion, versionInfo.latest)) {
       console.error(
-        chalk17.yellow(`
-  Update available: ${cliVersion} \u2192 ${versionInfo.latest}. Run ${chalk17.bold("agt update")} to install.`) + chalk17.dim("\n  Note: Restart the manager after updating.\n")
+        chalk18.yellow(`
+  Update available: ${cliVersion} \u2192 ${versionInfo.latest}. Run ${chalk18.bold("agt update")} to install.`) + chalk18.dim("\n  Note: Restart the manager after updating.\n")
       );
     }
   } catch {
@@ -3968,11 +4415,11 @@ async function checkForUpdateOnStartup() {
 }
 
 // src/commands/integration.ts
-import chalk18 from "chalk";
-import ora16 from "ora";
+import chalk19 from "chalk";
+import ora17 from "ora";
 async function integrationListCommand() {
   const json = isJsonMode();
-  const spinner = ora16({ text: "Fetching integrations\u2026", isSilent: json }).start();
+  const spinner = ora17({ text: "Fetching integrations\u2026", isSilent: json }).start();
   try {
     const data = await api.get("/integrations/bindings");
     spinner.stop();
@@ -3984,11 +4431,11 @@ async function integrationListCommand() {
       info("No integrations found for this team.");
       return;
     }
-    console.log(chalk18.bold("\nAvailable Integrations:\n"));
+    console.log(chalk19.bold("\nAvailable Integrations:\n"));
     for (const p of data) {
-      const statusColor = p.status === "published" ? chalk18.green : p.status === "archived" ? chalk18.gray : chalk18.yellow;
+      const statusColor = p.status === "published" ? chalk19.green : p.status === "archived" ? chalk19.gray : chalk19.yellow;
       console.log(
-        `  ${chalk18.bold(p.name)} ${chalk18.dim(`(${p.slug})`)}  ${statusColor(p.status)} v${p.version}  ${chalk18.dim(`${p.skills?.length ?? 0} skills, ${p.defined_scopes?.length ?? 0} scopes`)}`
+        `  ${chalk19.bold(p.name)} ${chalk19.dim(`(${p.slug})`)}  ${statusColor(p.status)} v${p.version}  ${chalk19.dim(`${p.skills?.length ?? 0} skills, ${p.defined_scopes?.length ?? 0} scopes`)}`
       );
     }
     console.log();
@@ -3999,7 +4446,7 @@ async function integrationListCommand() {
 }
 async function integrationShowCommand(slug) {
   const json = isJsonMode();
-  const spinner = ora16({ text: "Fetching integration\u2026", isSilent: json }).start();
+  const spinner = ora17({ text: "Fetching integration\u2026", isSilent: json }).start();
   try {
     const all = await api.get("/integrations/bindings");
     const integration2 = all.find((p) => p.slug === slug);
@@ -4015,21 +4462,21 @@ async function integrationShowCommand(slug) {
       jsonOutput({ integration: integration2, scopes });
       return;
     }
-    console.log(chalk18.bold(`
-${integration2.name}`), chalk18.dim(`(${integration2.slug})`));
-    if (integration2.description) console.log(chalk18.dim(integration2.description));
+    console.log(chalk19.bold(`
+${integration2.name}`), chalk19.dim(`(${integration2.slug})`));
+    if (integration2.description) console.log(chalk19.dim(integration2.description));
     console.log();
     console.log(`  Status:    ${integration2.status} v${integration2.version}`);
     console.log(`  Category:  ${integration2.category}`);
     console.log(`  Toolkits:  ${integration2.required_toolkits.join(", ") || "none"}`);
     console.log(`  Skills:    ${integration2.skills?.length ?? 0}`);
     if (scopes.length > 0) {
-      console.log(chalk18.bold("\n  Permission Scopes:\n"));
+      console.log(chalk19.bold("\n  Permission Scopes:\n"));
       for (const s of scopes) {
-        const roleColor = s.can_grant ? chalk18.green : chalk18.red;
-        const overrideTag = s.is_overridden ? chalk18.cyan(" [team override]") : "";
+        const roleColor = s.can_grant ? chalk19.green : chalk19.red;
+        const overrideTag = s.is_overridden ? chalk19.cyan(" [team override]") : "";
         console.log(
-          `    ${chalk18.bold(s.id)}  ${s.name}  min: ${roleColor(s.effective_min_role)}${overrideTag}  ${s.can_grant ? chalk18.green("\u2713 grantable") : chalk18.red("\u2717 needs approval")}`
+          `    ${chalk19.bold(s.id)}  ${s.name}  min: ${roleColor(s.effective_min_role)}${overrideTag}  ${s.can_grant ? chalk19.green("\u2713 grantable") : chalk19.red("\u2717 needs approval")}`
         );
       }
     }
@@ -4041,7 +4488,7 @@ ${integration2.name}`), chalk18.dim(`(${integration2.slug})`));
 }
 async function integrationInstallCommand(slug, options) {
   const json = isJsonMode();
-  const spinner = ora16({ text: "Installing integration\u2026", isSilent: json }).start();
+  const spinner = ora17({ text: "Installing integration\u2026", isSilent: json }).start();
   try {
     const all = await api.get("/integrations/bindings");
     const integration2 = all.find((p) => p.slug === slug);
@@ -4080,7 +4527,7 @@ async function integrationInstallCommand(slug, options) {
       const needsApproval = err.body["needs_approval"];
       error("Some scopes exceed your role ceiling:");
       for (const s of needsApproval) {
-        console.log(chalk18.yellow(`  - ${s}`));
+        console.log(chalk19.yellow(`  - ${s}`));
       }
       info("To request elevated scopes, use the web dashboard or contact your team admin.");
       process.exitCode = 1;
@@ -4091,7 +4538,7 @@ async function integrationInstallCommand(slug, options) {
 }
 async function integrationUninstallCommand(slug, options) {
   const json = isJsonMode();
-  const spinner = ora16({ text: "Uninstalling integration\u2026", isSilent: json }).start();
+  const spinner = ora17({ text: "Uninstalling integration\u2026", isSilent: json }).start();
   try {
     const all = await api.get("/integrations/bindings");
     const integration2 = all.find((p) => p.slug === slug);
@@ -4122,7 +4569,7 @@ async function integrationUninstallCommand(slug, options) {
 }
 async function integrationRequestsCommand() {
   const json = isJsonMode();
-  const spinner = ora16({ text: "Fetching scope requests\u2026", isSilent: json }).start();
+  const spinner = ora17({ text: "Fetching scope requests\u2026", isSilent: json }).start();
   try {
     const requests = await api.get("/integrations/bindings/scope-requests");
     spinner.stop();
@@ -4134,10 +4581,10 @@ async function integrationRequestsCommand() {
       info("No pending scope requests.");
       return;
     }
-    console.log(chalk18.bold("\nPending Scope Requests:\n"));
+    console.log(chalk19.bold("\nPending Scope Requests:\n"));
     for (const r of requests) {
-      console.log(`  ${chalk18.bold(r.id)}  scopes: ${r.requested_scopes.join(", ")}`);
-      if (r.reason) console.log(`    reason: ${chalk18.dim(r.reason)}`);
+      console.log(`  ${chalk19.bold(r.id)}  scopes: ${r.requested_scopes.join(", ")}`);
+      if (r.reason) console.log(`    reason: ${chalk19.dim(r.reason)}`);
       console.log(`    status: ${r.status}  requested: ${r.created_at}`);
       console.log();
     }
@@ -4148,7 +4595,7 @@ async function integrationRequestsCommand() {
 }
 async function integrationApproveCommand(requestId, options) {
   const json = isJsonMode();
-  const spinner = ora16({ text: "Approving request\u2026", isSilent: json }).start();
+  const spinner = ora17({ text: "Approving request\u2026", isSilent: json }).start();
   try {
     const result = await api.put(`/integrations/bindings/scope-requests/${requestId}`, {
       status: "approved",
@@ -4167,7 +4614,7 @@ async function integrationApproveCommand(requestId, options) {
 }
 async function integrationDenyCommand(requestId, options) {
   const json = isJsonMode();
-  const spinner = ora16({ text: "Denying request\u2026", isSilent: json }).start();
+  const spinner = ora17({ text: "Denying request\u2026", isSilent: json }).start();
   try {
     const result = await api.put(`/integrations/bindings/scope-requests/${requestId}`, {
       status: "denied",
@@ -4209,7 +4656,7 @@ async function integrationEnrolCommand(options) {
   const [secretKey, secretValue] = secrets[0];
   const credentials = { [secretKey]: secretValue };
   const authType = options.authType ?? (options.webhookSecret ? "webhook" : options.apiKey ? "api_key" : "oauth2");
-  const spinner = ora16({ text: `Enrolling ${options.def} at ${apiScope} scope\u2026`, isSilent: json }).start();
+  const spinner = ora17({ text: `Enrolling ${options.def} at ${apiScope} scope\u2026`, isSilent: json }).start();
   try {
     let agentId;
     if (apiScope === "agent") {
@@ -4268,7 +4715,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.26.2-eng5706.1" : "dev";
+var cliVersion2 = true ? "0.27.0" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", (thisCommand) => {
@@ -4283,6 +4730,24 @@ var team = program.command("team").description("Manage teams");
 team.command("list").description("List teams you belong to").action(teamListCommand);
 team.command("create <name>").description("Create a new team and set it as active").action(teamCreateCommand);
 team.command("switch <slug>").description("Switch the active team").action(teamSwitchCommand);
+var impersonate = program.command("impersonate").description(
+  "Operate as a managed agent locally (experimental, gated by AGT_IMPERSONATE_ENABLED)"
+);
+impersonate.command("connect <token>").description(
+  "Redeem a XXXX-XXXX token from the webapp, render the agent's CLAUDE.md + .mcp.json, swap them into the current project, and launch Claude Code (use --no-launch to skip the launch)"
+).option(
+  "--no-launch",
+  "Skip launching Claude Code after the swap (operator manages their own session)"
+).action(
+  (token, opts) => (
+    // Commander negates --no-FLAG into opts.flag, so --no-launch arrives
+    // as opts.launch === false. Translate to the command's noLaunch
+    // option, defaulting to launching when the flag isn't passed.
+    impersonateConnectCommand(token, { noLaunch: opts.launch === false })
+  )
+);
+impersonate.command("current").description('Print the active impersonation (or "none")').action(impersonateCurrentCommand);
+impersonate.command("exit").description("End the active impersonation, restore project files, and notify the server").action(impersonateExitCommand);
 program.command("init").description("Create a new agent (interactive wizard, or non-interactive with --name)").option("--name <display-name>", "Agent display name (triggers non-interactive mode)").option("--code-name <code-name>", "Agent code name (kebab-case, derived from --name if omitted)").option("--description <text>", "Short agent description").option("--env <environment>", "Environment: dev | stage | prod", "dev").option("--risk-tier <tier>", "Risk tier: Low | Medium | High", "Low").option("--budget-type <type>", "Budget type: tokens | dollars | both", "tokens").option("--budget-tokens <number>", "Token budget limit", "10000").option("--budget-dollars <number>", "Dollar budget limit", "10").option("--budget-window <window>", "Budget window: daily | weekly | monthly", "daily").option("--budget-enforcement <mode>", "Budget enforcement: block | throttle | alert | degrade", "block").option("--channels <list>", "Comma-separated channel IDs").option("--logging <mode>", "Logging mode: redacted | hash-only | full-local", "redacted").action(initCommand);
 program.command("lint").argument("[path]", "Path to agent directory (default: all agents in .augmented/)").description("Lint CHARTER.md and TOOLS.md files").action(lintCommand);
 var channels = program.command("channels").description("Manage and inspect channel configuration");
@@ -4315,16 +4780,16 @@ host.command("pair <host-name>").description("Start an SSM port-forward + shell
   })
 );
 var manager = program.command("manager").description("Host config sync daemon \u2014 keeps local agent files in sync with API");
-manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join10(homedir3(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
-manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join10(homedir3(), ".augmented")).action(managerStopCommand);
-manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join10(homedir3(), ".augmented")).action(managerStatusCommand);
-manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join10(homedir3(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
-manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join10(homedir3(), ".augmented")).action(managerInstallCommand);
+manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join12(homedir5(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
+manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join12(homedir5(), ".augmented")).action(managerStopCommand);
+manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join12(homedir5(), ".augmented")).action(managerStatusCommand);
+manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join12(homedir5(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
+manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join12(homedir5(), ".augmented")).action(managerInstallCommand);
 manager.command("uninstall").description("Remove the OS-level supervisor (launchctl unload + delete plist on macOS). Idempotent.").action(managerUninstallCommand);
 manager.command("install-system-unit").description("Install a system-level systemd unit (Linux, root) so the manager auto-starts on every boot. For headless EC2 hosts \u2014 survives reboot without `loginctl enable-linger`. (ENG-4706)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files (defaults to /root/.augmented or /home/<user>/.augmented)").option("--user <name>", "Unix user the manager runs as", "root").action(managerInstallSystemUnitCommand);
 manager.command("uninstall-system-unit").description("Remove the system-level systemd unit (Linux, root). Idempotent. (ENG-4706)").action(managerUninstallSystemUnitCommand);
 var agent = program.command("agent").description("Inspect and manage agents");
-agent.command("show <code-name>").description("Display an agent's provisioned OpenClaw configuration").option("--config-dir <dir>", "Config directory", join10(homedir3(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
+agent.command("show <code-name>").description("Display an agent's provisioned OpenClaw configuration").option("--config-dir <dir>", "Config directory", join12(homedir5(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
 var kanban = program.command("kanban").description("Manage agent kanban boards");
 kanban.command("list").description("List kanban board items for an agent").requiredOption("--agent <code-name>", "Agent code name").action(kanbanListCommand);
 kanban.command("add <title>").description("Add a new item to an agent kanban board").requiredOption("--agent <code-name>", "Agent code name").option("--priority <1|2|3>", "Priority: 1=high, 2=medium, 3=low", "2").option("--status <status>", "Initial status: backlog | todo | in_progress", "todo").option("--description <text>", "Item description").option("--estimate <minutes>", "Estimated time in minutes").option("--deliverable <text>", "Expected output/deliverable").action(kanbanAddCommand);