@integrity-labs/agt-cli 0.27.7-test.7 → 0.27.8-test.10

package/dist/lib/manager-worker.js

@@ -15,7 +15,7 @@ import {
   provisionOrientHook,
   provisionStopHook,
   requireHost
-} from "../chunk-2G35ES7G.js";
+} from "../chunk-2E5OABKX.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -46,7 +46,7 @@ import {
   stopAllSessionsAndWait,
   stopPersistentSession,
   takeZombieDetection
-} from "../chunk-GN4XPQWJ.js";
+} from "../chunk-JIETOJQV.js";
 import {
   KANBAN_CHECK_COMMAND,
   appendDmFooter,
@@ -69,7 +69,7 @@ import {
   resolveConnectivityProbe,
   resolveDmTarget,
   wrapScheduledTaskPrompt
-} from "../chunk-YSBGIXJG.js";
+} from "../chunk-6HFXSNNY.js";
 import {
   parsePsRows,
   reapOrphanChannelMcps
@@ -77,10 +77,10 @@ import {
 
 // src/lib/manager-worker.ts
 import { createHash as createHash3 } from "crypto";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, appendFileSync, mkdirSync as mkdirSync2, chmodSync, existsSync as existsSync4, rmSync as rmSync2, readdirSync as readdirSync3, statSync as statSync2, unlinkSync, copyFileSync } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, appendFileSync, mkdirSync as mkdirSync4, chmodSync, existsSync as existsSync5, rmSync as rmSync2, readdirSync as readdirSync3, statSync as statSync2, unlinkSync, copyFileSync } from "fs";
 import https from "https";
 import { execFileSync as syncExecFile } from "child_process";
-import { join as join6, dirname } from "path";
+import { join as join6, dirname as dirname3 } from "path";
 import { homedir as homedir4 } from "os";
 import { fileURLToPath } from "url";
 
@@ -578,6 +578,37 @@ function decideChannelRestart(input) {
   return { restart: true, added, removed };
 }
 
+// src/lib/sender-policy-restart-decision.ts
+function decideSenderPolicyRestart(input) {
+  const {
+    previousHash,
+    currentHash,
+    sessionMode,
+    framework,
+    sessionHealthy,
+    channelSetRestartAlreadyScheduled
+  } = input;
+  if (previousHash === void 0) {
+    return { restart: false, firstPoll: true, changed: false };
+  }
+  if (previousHash === currentHash) {
+    return { restart: false, firstPoll: false, changed: false };
+  }
+  if (sessionMode !== "persistent") {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  if (framework !== "claude-code") {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  if (!sessionHealthy) {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  if (channelSetRestartAlreadyScheduled) {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  return { restart: true, firstPoll: false, changed: true };
+}
+
 // src/lib/restart-breaker.ts
 function reaperRestartBreakerReason(activeKeys) {
   return activeKeys.length >= 2 ? "mcp-presence-reaper" : void 0;
@@ -910,6 +941,142 @@ function runCliProbe(binary, args, opts = {}) {
   });
 }
 
+// src/lib/self-update-coalesce.ts
+import { readFileSync, writeFileSync, mkdirSync } from "fs";
+import { dirname } from "path";
+var DEFAULT_SELF_UPDATE_COALESCE_MS = 30 * 60 * 1e3;
+function resolveCoalesceWindowMs(env = process.env) {
+  const raw = env.AGT_SELF_UPDATE_COALESCE_MS;
+  if (raw == null || raw === "") return DEFAULT_SELF_UPDATE_COALESCE_MS;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed < 0) return DEFAULT_SELF_UPDATE_COALESCE_MS;
+  return Math.trunc(parsed);
+}
+function readLastSelfUpdateAppliedMs(markerPath, now = Date.now(), read = (p) => readFileSync(p, "utf-8")) {
+  let raw;
+  try {
+    raw = read(markerPath);
+  } catch {
+    return null;
+  }
+  const v = parseInt(raw.trim(), 10);
+  if (!Number.isFinite(v) || v <= 0) return null;
+  if (v > now) return null;
+  return v;
+}
+function stampLastSelfUpdateApplied(markerPath, now = Date.now(), write = (p, v) => {
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, v);
+}) {
+  try {
+    write(markerPath, String(now));
+  } catch {
+  }
+}
+function decideSelfUpdateCoalesce(inputs) {
+  const { windowMs, lastAppliedMs, now } = inputs;
+  if (windowMs <= 0) return { proceed: true, remainingMs: 0, lastAppliedMs: null };
+  if (lastAppliedMs == null) return { proceed: true, remainingMs: 0, lastAppliedMs: null };
+  const elapsed = now - lastAppliedMs;
+  if (elapsed < 0) return { proceed: true, remainingMs: 0, lastAppliedMs: null };
+  if (elapsed >= windowMs) return { proceed: true, remainingMs: 0, lastAppliedMs: null };
+  return { proceed: false, remainingMs: windowMs - elapsed, lastAppliedMs };
+}
+function formatCoalesceDeferLogLine(opts) {
+  const remainingSec = Math.ceil(opts.remainingMs / 1e3);
+  const windowMin = Math.round(opts.windowMs / 6e4);
+  return `[self-update] coalescing \u2014 ${opts.installed} \u2192 ${opts.latest} (${opts.channelLabel}) available, deferring for ${remainingSec}s (last restart inside ${windowMin}min window). See ENG-5862. Override with AGT_SELF_UPDATE_COALESCE_MS=0 during incident response.`;
+}
+
+// src/lib/atomic-write.ts
+import { closeSync, fsyncSync, openSync, writeSync, renameSync, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname2 } from "path";
+function atomicWriteFileSync(path, data) {
+  const dirPath = dirname2(path);
+  const tmpPath = `${path}.tmp.${process.pid}.${Math.random().toString(36).slice(2, 8)}`;
+  try {
+    mkdirSync2(dirPath, { recursive: true });
+  } catch {
+  }
+  const fd = openSync(tmpPath, "w", 420);
+  try {
+    writeSync(fd, data);
+    try {
+      fsyncSync(fd);
+    } catch {
+    }
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(tmpPath, path);
+  try {
+    const dirFd = openSync(dirPath, "r");
+    try {
+      fsyncSync(dirFd);
+    } finally {
+      closeSync(dirFd);
+    }
+  } catch {
+  }
+}
+
+// src/lib/claude-pid-tracker.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+function readPidFile(path) {
+  if (!existsSync(path)) return { version: 1, spawns: [] };
+  try {
+    const raw = JSON.parse(readFileSync2(path, "utf-8"));
+    if (raw.version !== 1 || !Array.isArray(raw.spawns)) return { version: 1, spawns: [] };
+    const spawns = raw.spawns.filter(
+      (s) => !!s && typeof s.pid === "number" && Number.isFinite(s.pid) && s.pid > 0
+    );
+    return { version: 1, spawns };
+  } catch {
+    return { version: 1, spawns: [] };
+  }
+}
+function writePidFile(path, file) {
+  atomicWriteFileSync(path, JSON.stringify(file, null, 2));
+}
+function addSpawn(path, record) {
+  const file = readPidFile(path);
+  const filtered = file.spawns.filter((s) => s.pid !== record.pid);
+  writePidFile(path, { version: 1, spawns: [...filtered, record] });
+}
+function removeSpawn(path, pid) {
+  const file = readPidFile(path);
+  const next = file.spawns.filter((s) => s.pid !== pid);
+  if (next.length !== file.spawns.length) writePidFile(path, { version: 1, spawns: next });
+}
+function decideReaperActions(file, isAlive, looksLikeClaude = () => true) {
+  const toKill = [];
+  const alreadyDead = [];
+  const pidReusedSkipped = [];
+  for (const s of file.spawns) {
+    if (!isAlive(s.pid)) {
+      alreadyDead.push(s);
+      continue;
+    }
+    if (!looksLikeClaude(s.pid)) {
+      pidReusedSkipped.push(s);
+      continue;
+    }
+    toKill.push(s);
+  }
+  const toResetKanban = toKill.filter(
+    (s) => s.kind === "kanban-work" && typeof s.kanban_card_id === "string" && s.kanban_card_id.length > 0
+  );
+  return { toKill, alreadyDead, pidReusedSkipped, toResetKanban };
+}
+function formatDrainShutdownLine(opts) {
+  const killed = opts.killedPids && opts.killedPids.length > 0 ? ` killed_pids=${opts.killedPids.join(",")}` : "";
+  const note = opts.note ? ` note="${opts.note.replace(/"/g, '\\"')}"` : "";
+  return `[drain] step=${opts.step} elapsed_ms=${opts.elapsedMs}${killed}${note}`;
+}
+function formatReaperBootLine(opts) {
+  return `[drain] step=boot-reaper total=${opts.totalRecorded} killed=${opts.killed} already_dead=${opts.alreadyDead} pid_reused_skipped=${opts.pidReusedSkipped} kanban_reset=${opts.kanbanReset}`;
+}
+
 // src/lib/usage-banner-monitor.ts
 var MIN_CHECK_INTERVAL_MS = 6e4;
 var PANE_TAIL_LINES_FOR_BANNER = 200;
@@ -966,7 +1133,7 @@ async function maybeReportUsageBanner(args) {
 }
 
 // src/lib/token-usage-monitor.ts
-import { readdirSync, readFileSync, statSync } from "fs";
+import { readdirSync, readFileSync as readFileSync3, statSync } from "fs";
 import { join } from "path";
 var MIN_CHECK_INTERVAL_MS2 = 6e4;
 var TRANSCRIPT_MTIME_WINDOW_MS = 2 * 24 * 60 * 60 * 1e3;
@@ -1012,7 +1179,7 @@ async function maybeReportTokenUsage(args) {
     }
     let content;
     try {
-      content = readFileSync(path, "utf-8");
+      content = readFileSync3(path, "utf-8");
     } catch (err) {
       log2(`[token-usage] read failed for '${codeName}/${name}': ${err.message}`);
       continue;
@@ -1093,7 +1260,7 @@ async function maybeReportTokenUsage(args) {
 }
 
 // src/lib/activity-cache-monitor.ts
-import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
 import { homedir } from "os";
 import { join as join2 } from "path";
 var MIN_CHECK_INTERVAL_MS3 = 6e4;
@@ -1140,12 +1307,12 @@ async function maybeReportActivityCache(args) {
   const nowMs = now.getTime();
   if (nowMs - state3.lastCheckedAt < MIN_CHECK_INTERVAL_MS3) return;
   state3.lastCheckedAt = nowMs;
-  if (!existsSync(STATS_CACHE_PATH)) {
+  if (!existsSync2(STATS_CACHE_PATH)) {
     return;
   }
   let raw;
   try {
-    raw = readFileSync2(STATS_CACHE_PATH, "utf-8");
+    raw = readFileSync4(STATS_CACHE_PATH, "utf-8");
   } catch (err) {
     log2(`[activity-cache] readFileSync failed: ${err.message}`);
     return;
@@ -1712,7 +1879,7 @@ function normalize(value) {
 }
 
 // src/lib/channel-hash-cache.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
 import { join as join4 } from "path";
 var CACHE_FILENAME = "channel-hash-cache.json";
 function getChannelHashCacheFile(configDir) {
@@ -1720,10 +1887,10 @@ function getChannelHashCacheFile(configDir) {
 }
 function loadChannelHashCache(target, configDir) {
   const path = getChannelHashCacheFile(configDir);
-  if (!existsSync2(path)) return;
+  if (!existsSync3(path)) return;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync3(path, "utf-8"));
+    parsed = JSON.parse(readFileSync5(path, "utf-8"));
   } catch {
     return;
   }
@@ -1737,7 +1904,7 @@ function saveChannelHashCache(source, configDir) {
   const obj = {};
   for (const [key, value] of source) obj[key] = value;
   try {
-    writeFileSync(path, JSON.stringify(obj, null, 2));
+    writeFileSync2(path, JSON.stringify(obj, null, 2));
   } catch {
   }
 }
@@ -2210,6 +2377,16 @@ var agentState = {
   knownIntegrationHashes: /* @__PURE__ */ new Map(),
   knownManagedMcpHashes: /* @__PURE__ */ new Map(),
   knownManagedMcpStructure: /* @__PURE__ */ new Map(),
+  /**
+   * ENG-5858: hash of the effective sender_policy returned by
+   * /host/refresh for this agent. Tracked separately from
+   * `knownChannelConfigHashes` because the channel-cred hash is
+   * per-channel (cleared/rewritten per channel) whereas sender_policy is
+   * agent-wide. A change here triggers a session restart so the
+   * slack-channel / teams-channel MCP children pick up the new env vars
+   * (they read SLACK_SENDER_POLICY / MSTEAMS_SENDER_POLICY only at boot).
+   */
+  knownSenderPolicyHashes: /* @__PURE__ */ new Map(),
   // ---------------------------------------------------------------------------
   // codeName-keyed
   // ---------------------------------------------------------------------------
@@ -2239,6 +2416,7 @@ function clearAgentState(agentId, codeName) {
   agentState.knownIntegrationHashes.delete(agentId);
   agentState.knownManagedMcpHashes.delete(agentId);
   agentState.knownManagedMcpStructure.delete(agentId);
+  agentState.knownSenderPolicyHashes.delete(agentId);
   agentState.agentDisplayNames.delete(codeName);
   agentState.codeNameToAgentId.delete(codeName);
   let channelCacheMutated = false;
@@ -2257,7 +2435,7 @@ function clearAgentState(agentId, codeName) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync4, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync6, renameSync as renameSync2, rmSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join5 } from "path";
 import { randomUUID } from "crypto";
@@ -2269,12 +2447,12 @@ function flagPath(codeName) {
 }
 function readRestartFlags() {
   const dir = restartFlagsDir();
-  if (!existsSync3(dir)) return [];
+  if (!existsSync4(dir)) return [];
   const out = [];
   for (const entry of readdirSync2(dir)) {
     if (!entry.endsWith(".flag")) continue;
     try {
-      const raw = readFileSync4(join5(dir, entry), "utf8");
+      const raw = readFileSync6(join5(dir, entry), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.codeName !== "string" || parsed.codeName.length === 0) {
         parsed.codeName = entry.replace(/\.flag$/, "");
@@ -2292,7 +2470,7 @@ function readRestartFlags() {
 }
 function deleteRestartFlag(codeName) {
   const path = flagPath(codeName);
-  if (existsSync3(path)) {
+  if (existsSync4(path)) {
     rmSync(path, { force: true });
   }
 }
@@ -2973,7 +3151,7 @@ var runningMcpHashes = /* @__PURE__ */ new Map();
 var runningMcpServerKeys = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
-    const raw = readFileSync5(join6(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync7(join6(projectDir, ".mcp.json"), "utf-8");
     return createHash3("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
@@ -2981,7 +3159,7 @@ function projectMcpHash(_codeName, projectDir) {
 }
 function projectMcpKeys(_codeName, projectDir) {
   try {
-    const raw = readFileSync5(join6(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync7(join6(projectDir, ".mcp.json"), "utf-8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers;
     if (!servers || typeof servers !== "object") return /* @__PURE__ */ new Set();
@@ -2992,7 +3170,7 @@ function projectMcpKeys(_codeName, projectDir) {
 }
 function readMcpHttpServerConfig(projectDir, serverKey) {
   try {
-    const raw = readFileSync5(join6(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync7(join6(projectDir, ".mcp.json"), "utf-8");
     const servers = JSON.parse(raw).mcpServers ?? {};
     const entry = servers[serverKey];
     if (entry && typeof entry.url === "string" && (entry.type === "http" || entry.type === void 0)) {
@@ -3166,7 +3344,7 @@ var cachedFrameworkVersion = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.7-test.7" : "dev";
+var agtCliVersion = true ? "0.27.8-test.10" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -3179,7 +3357,7 @@ function resolveBrewPath(execFileSync4) {
     "/usr/local/bin/brew"
   ];
   for (const path of fallbacks) {
-    if (existsSync4(path)) return path;
+    if (existsSync5(path)) return path;
   }
   return null;
 }
@@ -3189,7 +3367,7 @@ function claudeBinaryInstalled(execFileSync4) {
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude"
   ];
-  if (canonical.some((path) => existsSync4(path))) return true;
+  if (canonical.some((path) => existsSync5(path))) return true;
   try {
     execFileSync4("which", ["claude"], { timeout: 5e3 });
     return true;
@@ -3261,7 +3439,7 @@ async function ensureToolkitCli(toolkitSlug) {
         toolkitCliEnsured.add(toolkitSlug);
         return;
       }
-      brewBinDir = dirname(brewPath);
+      brewBinDir = dirname3(brewPath);
       const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
       log(`[toolkit-install] ${toolkitSlug}: installing via brew (${pkg})\u2026`);
       if (isRoot) {
@@ -3342,8 +3520,8 @@ function claudeManagedSettingsPath() {
 function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
   try {
     let settings = {};
-    if (existsSync4(path)) {
-      const raw = readFileSync5(path, "utf-8").trim();
+    if (existsSync5(path)) {
+      const raw = readFileSync7(path, "utf-8").trim();
       if (raw) {
         let parsed;
         try {
@@ -3359,8 +3537,8 @@ function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
     }
     if (settings.channelsEnabled === true) return;
     settings.channelsEnabled = true;
-    mkdirSync2(dirname(path), { recursive: true });
-    writeFileSync3(path, `${JSON.stringify(settings, null, 2)}
+    mkdirSync4(dirname3(path), { recursive: true });
+    writeFileSync4(path, `${JSON.stringify(settings, null, 2)}
 `);
     log(`[managed-settings] set channelsEnabled:true in ${path} (ENG-5786 \u2014 unblocks Claude Code channels)`);
   } catch (err) {
@@ -3399,11 +3577,11 @@ async function ensureFrameworkBinary(frameworkId) {
       log(`Claude Code install failed: ${err.message}`);
       return;
     }
-    const brewBinDir = dirname(brewPath);
+    const brewBinDir = dirname3(brewPath);
     if (!process.env.PATH?.split(":").includes(brewBinDir)) {
       process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
     }
-    if (existsSync4("/home/linuxbrew/.linuxbrew/bin/claude")) {
+    if (existsSync5("/home/linuxbrew/.linuxbrew/bin/claude")) {
       log("Claude Code installed successfully");
     } else {
       log("Claude Code install completed but binary not found at expected path \u2014 check brew logs");
@@ -3419,13 +3597,13 @@ function claudeCodeUpgradeMarkerPath() {
 }
 function stampClaudeCodeUpgradeMarker() {
   try {
-    writeFileSync3(claudeCodeUpgradeMarkerPath(), String(Date.now()));
+    writeFileSync4(claudeCodeUpgradeMarkerPath(), String(Date.now()));
   } catch {
   }
 }
 function claudeCodeUpgradeThrottled() {
   try {
-    const lastCheck = parseInt(readFileSync5(claudeCodeUpgradeMarkerPath(), "utf-8").trim(), 10);
+    const lastCheck = parseInt(readFileSync7(claudeCodeUpgradeMarkerPath(), "utf-8").trim(), 10);
     if (!Number.isFinite(lastCheck)) return false;
     return Date.now() - lastCheck < CLAUDE_CODE_UPGRADE_CHECK_INTERVAL_MS;
   } catch {
@@ -3474,6 +3652,9 @@ ${r.stderr}`;
   });
 }
 var UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
+function selfUpdateAppliedMarkerPath() {
+  return join6(homedir4(), ".augmented", ".last-self-update-applied");
+}
 var selfUpdateUpToDateLogged = false;
 var restartAfterUpgrade = false;
 var pendingUpgradeVersion = null;
@@ -3537,6 +3718,22 @@ async function checkAndUpdateCliViaBrew() {
     if (agtOutdated) {
       const installed = agtOutdated.installed_versions?.[0] ?? "unknown";
       const latest = agtOutdated.current_version ?? "unknown";
+      const coalesceWindowMs = resolveCoalesceWindowMs();
+      const coalesce = decideSelfUpdateCoalesce({
+        windowMs: coalesceWindowMs,
+        lastAppliedMs: readLastSelfUpdateAppliedMs(selfUpdateAppliedMarkerPath()),
+        now: Date.now()
+      });
+      if (!coalesce.proceed) {
+        log(formatCoalesceDeferLogLine({
+          installed,
+          latest,
+          channelLabel: "brew",
+          remainingMs: coalesce.remainingMs,
+          windowMs: coalesceWindowMs
+        }));
+        return;
+      }
       log(`[self-update] agt CLI update available: ${installed} \u2192 ${latest}. Upgrading via brew...`);
       try {
         execFileSync4(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
@@ -3544,6 +3741,7 @@ async function checkAndUpdateCliViaBrew() {
           stdio: "pipe"
         });
         log(`[self-update] agt CLI upgraded to ${latest}. Scheduling manager restart so the new binary takes effect.`);
+        stampLastSelfUpdateApplied(selfUpdateAppliedMarkerPath());
         restartAfterUpgrade = true;
         pendingUpgradeVersion = latest;
       } catch (err) {
@@ -3604,6 +3802,22 @@ async function checkAndUpdateCliViaNpm() {
     }
     return;
   }
+  const coalesceWindowMs = resolveCoalesceWindowMs();
+  const coalesce = decideSelfUpdateCoalesce({
+    windowMs: coalesceWindowMs,
+    lastAppliedMs: readLastSelfUpdateAppliedMs(selfUpdateAppliedMarkerPath()),
+    now: Date.now()
+  });
+  if (!coalesce.proceed) {
+    log(formatCoalesceDeferLogLine({
+      installed: agtCliVersion,
+      latest,
+      channelLabel: `npm, channel=${channel}`,
+      remainingMs: coalesce.remainingMs,
+      windowMs: coalesceWindowMs
+    }));
+    return;
+  }
   log(`[self-update] agt CLI update available: ${agtCliVersion} \u2192 ${latest} (channel=${channel}). Upgrading via npm...`);
   const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
   const cmd = isRoot ? "npm" : "sudo";
@@ -3623,6 +3837,7 @@ async function checkAndUpdateCliViaNpm() {
   try {
     execFileSync4(cmd, args, { timeout: 18e4, stdio: "pipe" });
     log(`[self-update] agt CLI upgraded to ${latest}. Scheduling manager restart so the new binary takes effect.`);
+    stampLastSelfUpdateApplied(selfUpdateAppliedMarkerPath());
     restartAfterUpgrade = true;
     pendingUpgradeVersion = latest;
   } catch (err) {
@@ -3685,7 +3900,7 @@ async function applyClaudeAuthToEnv(childEnv, label) {
     const claudeDir = join6(homedir4(), ".claude");
     for (const filename of [".credentials.json", "credentials.json"]) {
       const p = join6(claudeDir, filename);
-      if (existsSync4(p)) {
+      if (existsSync5(p)) {
         try {
           rmSync2(p, { force: true });
           log(`[${label}] Removed ${p} (api_key mode \u2014 preventing OAuth fallback)`);
@@ -3699,14 +3914,14 @@ async function applyClaudeAuthToEnv(childEnv, label) {
 }
 function loadGatewayPorts() {
   try {
-    return JSON.parse(readFileSync5(GATEWAY_PORTS_FILE, "utf-8"));
+    return JSON.parse(readFileSync7(GATEWAY_PORTS_FILE, "utf-8"));
   } catch {
     return {};
   }
 }
 function saveGatewayPorts(ports) {
-  mkdirSync2(AUGMENTED_DIR, { recursive: true });
-  writeFileSync3(GATEWAY_PORTS_FILE, JSON.stringify(ports, null, 2));
+  mkdirSync4(AUGMENTED_DIR, { recursive: true });
+  writeFileSync4(GATEWAY_PORTS_FILE, JSON.stringify(ports, null, 2));
 }
 function allocatePort(codeName) {
   const ports = loadGatewayPorts();
@@ -3743,7 +3958,7 @@ function saveChannelHashCache2() {
 function send(msg) {
   if (msg.type === "state-update") {
     try {
-      writeFileSync3(getStateFile(), JSON.stringify(msg.state, null, 2));
+      atomicWriteFileSync(getStateFile(), JSON.stringify(msg.state, null, 2));
     } catch {
     }
   }
@@ -3775,8 +3990,8 @@ function log(msg) {
   if (!managerLogPath) {
     try {
       managerLogPath = join6(homedir4(), ".augmented", "manager.log");
-      mkdirSync2(dirname(managerLogPath), { recursive: true });
-      if (existsSync4(managerLogPath)) {
+      mkdirSync4(dirname3(managerLogPath), { recursive: true });
+      if (existsSync5(managerLogPath)) {
         chmodSync(managerLogPath, 384);
       }
     } catch {
@@ -3804,7 +4019,7 @@ function sha256(content) {
 }
 function hashFile(filePath) {
   try {
-    const content = readFileSync5(filePath, "utf-8");
+    const content = readFileSync7(filePath, "utf-8");
     return sha256(content);
   } catch {
     return null;
@@ -3828,7 +4043,7 @@ function parseSkillFrontmatter(content) {
   return out;
 }
 async function refreshSkillsIndexInClaudeMd(configDir, codeName, log2) {
-  const { readdirSync: readdirSync4, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync4 } = await import("fs");
+  const { readdirSync: readdirSync4, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync5 } = await import("fs");
   const skillsDir = join6(configDir, codeName, "project", ".claude", "skills");
   const claudeMdPath = join6(configDir, codeName, "project", "CLAUDE.md");
   if (!ex(skillsDir) || !ex(claudeMdPath)) return;
@@ -3876,7 +4091,7 @@ ${SKILLS_INDEX_END}`;
     next = current.trimEnd() + "\n\n" + section + "\n";
   }
   if (next !== current) {
-    writeFileSync4(claudeMdPath, next, "utf-8");
+    writeFileSync5(claudeMdPath, next, "utf-8");
     log2(`Refreshed skills index in CLAUDE.md for '${codeName}' (${entries.length} skills)`);
   }
 }
@@ -3885,7 +4100,7 @@ async function migrateToProfiles() {
   const sharedConfigPath = join6(homeDir, ".openclaw", "openclaw.json");
   let sharedConfig;
   try {
-    sharedConfig = JSON.parse(readFileSync5(sharedConfigPath, "utf-8"));
+    sharedConfig = JSON.parse(readFileSync7(sharedConfigPath, "utf-8"));
   } catch {
     return;
   }
@@ -3899,7 +4114,7 @@ async function migrateToProfiles() {
     if (!codeName) continue;
     if (codeName === "main") continue;
     const profileDir = join6(homeDir, `.openclaw-${codeName}`);
-    if (existsSync4(join6(profileDir, "openclaw.json"))) continue;
+    if (existsSync5(join6(profileDir, "openclaw.json"))) continue;
     log(`Migrating agent '${codeName}' to per-agent profile`);
     if (adapter.seedProfileConfig) {
       adapter.seedProfileConfig(codeName);
@@ -3907,10 +4122,10 @@ async function migrateToProfiles() {
     const sharedAuthDir = join6(homeDir, ".openclaw", "agents", codeName, "agent");
     const profileAuthDir = join6(profileDir, "agents", codeName, "agent");
     const authFile = join6(sharedAuthDir, "auth-profiles.json");
-    if (existsSync4(authFile)) {
-      mkdirSync2(profileAuthDir, { recursive: true });
-      const authContent = readFileSync5(authFile, "utf-8");
-      writeFileSync3(join6(profileAuthDir, "auth-profiles.json"), authContent);
+    if (existsSync5(authFile)) {
+      mkdirSync4(profileAuthDir, { recursive: true });
+      const authContent = readFileSync7(authFile, "utf-8");
+      writeFileSync4(join6(profileAuthDir, "auth-profiles.json"), authContent);
     }
     allocatePort(codeName);
     migrated++;
@@ -3948,7 +4163,7 @@ function readGatewayToken(codeName) {
   }
   const homeDir = process.env["HOME"] ?? "/tmp";
   try {
-    const cfg = JSON.parse(readFileSync5(join6(homeDir, `.openclaw-${codeName}`, "openclaw.json"), "utf-8"));
+    const cfg = JSON.parse(readFileSync7(join6(homeDir, `.openclaw-${codeName}`, "openclaw.json"), "utf-8"));
     return cfg?.gateway?.auth?.token;
   } catch {
     return void 0;
@@ -3958,9 +4173,9 @@ var GATEWAY_HUNG_TIMEOUT_MS = 5 * 6e4;
 function isGatewayHung(codeName) {
   const homeDir = process.env["HOME"] ?? "/tmp";
   const jobsPath = join6(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
-  if (!existsSync4(jobsPath)) return false;
+  if (!existsSync5(jobsPath)) return false;
   try {
-    const data = JSON.parse(readFileSync5(jobsPath, "utf-8"));
+    const data = JSON.parse(readFileSync7(jobsPath, "utf-8"));
     const jobs = data.jobs ?? data;
     if (!Array.isArray(jobs)) return false;
     const now = Date.now();
@@ -4000,12 +4215,12 @@ async function ensureGatewayRunning(codeName, adapter) {
         try {
           const homeDir = process.env["HOME"] ?? "/tmp";
           const configPath = join6(homeDir, `.openclaw-${codeName}`, "openclaw.json");
-          if (existsSync4(configPath)) {
-            const cfg = JSON.parse(readFileSync5(configPath, "utf-8"));
+          if (existsSync5(configPath)) {
+            const cfg = JSON.parse(readFileSync7(configPath, "utf-8"));
             if (cfg.gateway?.port !== status.port) {
               if (!cfg.gateway) cfg.gateway = {};
               cfg.gateway.port = status.port;
-              writeFileSync3(configPath, JSON.stringify(cfg, null, 2));
+              writeFileSync4(configPath, JSON.stringify(cfg, null, 2));
             }
           }
         } catch {
@@ -4026,11 +4241,11 @@ async function ensureGatewayRunning(codeName, adapter) {
     try {
       const homeDir = process.env["HOME"] ?? "/tmp";
       const configPath = join6(homeDir, `.openclaw-${codeName}`, "openclaw.json");
-      if (existsSync4(configPath)) {
-        const cfg = JSON.parse(readFileSync5(configPath, "utf-8"));
+      if (existsSync5(configPath)) {
+        const cfg = JSON.parse(readFileSync7(configPath, "utf-8"));
         if (!cfg.gateway) cfg.gateway = {};
         cfg.gateway.port = port;
-        writeFileSync3(configPath, JSON.stringify(cfg, null, 2));
+        writeFileSync4(configPath, JSON.stringify(cfg, null, 2));
       }
     } catch {
     }
@@ -4180,7 +4395,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-ICYFLUAM.js");
+      const { collectDiagnostics } = await import("../persistent-session-HSHIZC2Q.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -4248,7 +4463,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-WZNQ2762.js");
+      } = await import("../responsiveness-probe-RYKS5TRP.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -4363,7 +4578,7 @@ async function pollCycle() {
     if (restartAckStateChanged) {
       try {
         const ackedState = { ...state4, agents: agentStates };
-        writeFileSync3(getStateFile(), JSON.stringify(ackedState, null, 2));
+        atomicWriteFileSync(getStateFile(), JSON.stringify(ackedState, null, 2));
       } catch (err) {
         log(`[restart] failed to persist ack immediately: ${err.message}`);
       }
@@ -4583,7 +4798,7 @@ async function processAgent(agent, agentStates) {
       const residuals = {
         gatewayRunning: gatewayLiveness.running,
         portAllocated: Object.prototype.hasOwnProperty.call(ports, agent.code_name),
-        provisionDirExists: existsSync4(agentDir)
+        provisionDirExists: existsSync5(agentDir)
       };
       if (!hasRevokedResiduals(residuals)) {
         agentStates.push({
@@ -4742,7 +4957,7 @@ async function processAgent(agent, agentStates) {
   try {
     const artifacts = generateArtifacts(agent, refreshData, frameworkAdapter);
     const changedFiles = [];
-    mkdirSync2(agentDir, { recursive: true });
+    mkdirSync4(agentDir, { recursive: true });
     for (const artifact of artifacts) {
       const filePath = join6(agentDir, artifact.relativePath);
       let existingHash;
@@ -4764,7 +4979,7 @@ async function processAgent(agent, agentStates) {
         newHash = sha256(stripDynamicSections(artifact.content));
         try {
           const projectClaudeMd = join6(config.configDir, agent.code_name, "project", "CLAUDE.md");
-          const existing = readFileSync5(projectClaudeMd, "utf-8");
+          const existing = readFileSync7(projectClaudeMd, "utf-8");
           existingHash = sha256(stripDynamicSections(existing));
         } catch {
           existingHash = null;
@@ -4782,7 +4997,7 @@ async function processAgent(agent, agentStates) {
         const generatorKeys = Object.keys(generatorServers);
         let existingRaw = "";
         try {
-          existingRaw = readFileSync5(filePath, "utf-8");
+          existingRaw = readFileSync7(filePath, "utf-8");
         } catch {
         }
         const existingServers = parseMcp(existingRaw);
@@ -4804,18 +5019,18 @@ async function processAgent(agent, agentStates) {
       }
     }
     if (changedFiles.length > 0) {
-      const isFirst = !existsSync4(join6(agentDir, "CHARTER.md"));
+      const isFirst = !existsSync5(join6(agentDir, "CHARTER.md"));
       const verb = isFirst ? "Provisioning" : "Updating";
       const fileNames = changedFiles.map((f) => f.relativePath).join(", ");
       log(`${verb} '${agent.code_name}': ${fileNames}`);
       for (const file of changedFiles) {
         const filePath = join6(agentDir, file.relativePath);
-        mkdirSync2(dirname(filePath), { recursive: true });
-        writeFileSync3(filePath, file.content);
+        mkdirSync4(dirname3(filePath), { recursive: true });
+        writeFileSync4(filePath, file.content);
       }
       try {
         const provSkillsDir = join6(agentDir, ".claude", "skills");
-        if (existsSync4(provSkillsDir)) {
+        if (existsSync5(provSkillsDir)) {
           for (const folder of readdirSync3(provSkillsDir)) {
             if (folder.startsWith("knowledge-")) {
               try {
@@ -4897,7 +5112,7 @@ async function processAgent(agent, agentStates) {
   }
   let lastDriftCheckAt = now;
   const written = agentState.writtenHashes.get(agent.agent_id);
-  if (written && existsSync4(agentDir)) {
+  if (written && existsSync5(agentDir)) {
     const driftedFiles = [];
     for (const [file, expectedHash] of written) {
       const localHash = hashFile(join6(agentDir, file));
@@ -4975,14 +5190,16 @@ async function processAgent(agent, agentStates) {
           } : void 0;
           const peersForHash = channelId === "telegram" ? extractCharterTelegramPeers(refreshData.charter?.raw_content ?? "", gateContext) : channelId === "slack" ? extractCharterSlackPeers(refreshData.charter?.raw_content ?? "", gateContext) : null;
           const sessionModeForHash = refreshData.agent.session_mode;
-          const CHANNEL_WRITE_VERSION = 5;
+          const senderPolicyForHash = refreshData.sender_policy ?? null;
+          const CHANNEL_WRITE_VERSION = 8;
           const configHash = createHash3("sha256").update(
             canonicalJson({
               writeVersion: CHANNEL_WRITE_VERSION,
               config: entry.config,
               team: teamSettingsForHash,
               peers: peersForHash,
-              sessionMode: sessionModeForHash ?? null
+              sessionMode: sessionModeForHash ?? null,
+              senderPolicy: senderPolicyForHash
             })
           ).digest("hex");
           const cacheKey = `${agent.agent_id}:${channelId}`;
@@ -5008,6 +5225,7 @@ async function processAgent(agent, agentStates) {
             const telegramPeerDisabled = channelId === "telegram" ? peerDisabledMode === "all" : void 0;
             const telegramPeers = channelId === "telegram" ? extractCharterTelegramPeers(refreshData.charter?.raw_content ?? "", gateContext) : void 0;
             const slackPeers = channelId === "slack" ? extractCharterSlackPeers(refreshData.charter?.raw_content ?? "", gateContext) : void 0;
+            const senderPolicyForCall = channelId === "slack" || channelId === "msteams" ? refreshData.sender_policy ?? void 0 : void 0;
             frameworkAdapter.writeChannelCredentials(
               agent.code_name,
               channelId,
@@ -5019,7 +5237,8 @@ async function processAgent(agent, agentStates) {
                 peerDisabled,
                 telegramPeers,
                 slackPeers,
-                agentTimezone
+                agentTimezone,
+                senderPolicy: senderPolicyForCall
               }
             );
             agentState.knownChannelConfigHashes.set(cacheKey, configHash);
@@ -5065,18 +5284,58 @@ async function processAgent(agent, agentStates) {
     }
     scheduleSessionRestart(agent.code_name, delay, "new channel set");
   }
+  if (channelConfigConverged) {
+    const hasSenderPolicyChannel = currentChannelIds.has("slack") || currentChannelIds.has("msteams");
+    const senderPolicyForRestartHash = refreshData.sender_policy ?? null;
+    const senderPolicyHash = createHash3("sha256").update(canonicalJson({ senderPolicy: senderPolicyForRestartHash })).digest("hex");
+    const prevSenderPolicyHash = agentState.knownSenderPolicyHashes.get(agent.agent_id);
+    const senderPolicyDecision = hasSenderPolicyChannel ? decideSenderPolicyRestart({
+      previousHash: prevSenderPolicyHash,
+      currentHash: senderPolicyHash,
+      sessionMode: refreshData.agent.session_mode,
+      framework: agentFrameworkCache.get(agent.code_name) ?? "openclaw",
+      sessionHealthy: isSessionHealthy(agent.code_name),
+      channelSetRestartAlreadyScheduled: restartDecision.restart
+    }) : { restart: false, firstPoll: prevSenderPolicyHash === void 0, changed: false };
+    if (senderPolicyDecision.restart) {
+      log(
+        `[hot-reload] sender_policy changed for '${agent.code_name}' (${prevSenderPolicyHash?.slice(0, 8) ?? "first"} \u2192 ${senderPolicyHash.slice(0, 8)}) \u2014 restarting session`
+      );
+      const notice = "Your sender_policy has been updated. Restarting session shortly so the channel MCP servers pick up the new gate.";
+      const delivered = await injectMessage(
+        agent.code_name,
+        "system",
+        notice,
+        { task_name: "sender-policy-update" },
+        log
+      ).catch(() => false);
+      const delay = delivered ? 8e3 : 3e3;
+      if (!delivered) {
+        log(
+          `[hot-reload] Inject notification unconfirmed for '${agent.code_name}' \u2014 proceeding with shorter delay`
+        );
+      }
+      scheduleSessionRestart(
+        agent.code_name,
+        delay,
+        "sender_policy change",
+        "sender-policy-change"
+      );
+    }
+    agentState.knownSenderPolicyHashes.set(agent.agent_id, senderPolicyHash);
+  }
   const agentSessionMode = refreshData.agent.session_mode;
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? "openclaw") === "claude-code") {
     try {
       const agentProvisionDir = agentDir;
       const projectDir = join6(homedir4(), ".augmented", agent.code_name, "project");
-      mkdirSync2(agentProvisionDir, { recursive: true });
-      mkdirSync2(projectDir, { recursive: true });
+      mkdirSync4(agentProvisionDir, { recursive: true });
+      mkdirSync4(projectDir, { recursive: true });
       const provisionMcpPath = join6(agentProvisionDir, ".mcp.json");
       const projectMcpPath = join6(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
       try {
-        mcpConfig = JSON.parse(readFileSync5(provisionMcpPath, "utf-8"));
+        mcpConfig = JSON.parse(readFileSync7(provisionMcpPath, "utf-8"));
         if (!mcpConfig.mcpServers) mcpConfig.mcpServers = {};
       } catch {
       }
@@ -5086,7 +5345,7 @@ async function processAgent(agent, agentStates) {
         const tz = directChatTeamSettings?.["timezone"];
         return typeof tz === "string" && tz.trim() !== "" ? tz.trim() : void 0;
       })();
-      if (existsSync4(localDirectChatChannel) && !mcpConfig.mcpServers["direct-chat"]) {
+      if (existsSync5(localDirectChatChannel) && !mcpConfig.mcpServers["direct-chat"]) {
         mcpConfig.mcpServers["direct-chat"] = {
           command: "node",
           args: [localDirectChatChannel],
@@ -5098,12 +5357,12 @@ async function processAgent(agent, agentStates) {
           }
         };
         const serialized = JSON.stringify(mcpConfig, null, 2);
-        writeFileSync3(provisionMcpPath, serialized);
-        writeFileSync3(projectMcpPath, serialized);
+        writeFileSync4(provisionMcpPath, serialized);
+        writeFileSync4(projectMcpPath, serialized);
         log(`Channel credentials written for '${agent.code_name}/direct-chat'`);
       }
       const staleChannelsPath = join6(projectDir, ".mcp-channels.json");
-      if (existsSync4(staleChannelsPath)) {
+      if (existsSync5(staleChannelsPath)) {
         try {
           rmSync2(staleChannelsPath, { force: true });
         } catch {
@@ -5181,7 +5440,7 @@ async function processAgent(agent, agentStates) {
         const envIntPath = join6(projectDir, ".env.integrations");
         let preWriteEnv;
         try {
-          preWriteEnv = readFileSync5(envIntPath, "utf-8");
+          preWriteEnv = readFileSync7(envIntPath, "utf-8");
         } catch {
           preWriteEnv = void 0;
         }
@@ -5194,8 +5453,8 @@ async function processAgent(agent, agentStates) {
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
             const projectMcpPath = join6(projectDir, ".mcp.json");
-            const postWriteEnv = readFileSync5(envIntPath, "utf-8");
-            const mcpContent = readFileSync5(projectMcpPath, "utf-8");
+            const postWriteEnv = readFileSync7(envIntPath, "utf-8");
+            const mcpContent = readFileSync7(projectMcpPath, "utf-8");
             const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
             const mcpJsonForReap = JSON.parse(mcpContent);
             const affectedServerKeys = findMcpServersUsingVars(mcpJsonForReap, changedVars);
@@ -5263,8 +5522,8 @@ async function processAgent(agent, agentStates) {
             const mcpPath = frameworkAdapter.getMcpPath(agent.code_name);
             if (mcpPath) {
               try {
-                const { readFileSync: readFileSync6 } = await import("fs");
-                const mcpConfig = JSON.parse(readFileSync6(mcpPath, "utf-8"));
+                const { readFileSync: readFileSync8 } = await import("fs");
+                const mcpConfig = JSON.parse(readFileSync8(mcpPath, "utf-8"));
                 if (mcpConfig.mcpServers) {
                   const managedPrefixes = [
                     "composio_",
@@ -5361,7 +5620,7 @@ async function processAgent(agent, agentStates) {
     if (frameworkAdapter.installPlugin) {
       try {
         const pluginPath = join6(process.cwd(), "packages", "openclaw-plugin-augmented", "src", "index.ts");
-        if (existsSync4(pluginPath)) {
+        if (existsSync5(pluginPath)) {
           frameworkAdapter.installPlugin(agent.code_name, "augmented", pluginPath, {
             agtHost: requireHost(),
             agtApiKey: getApiKey() ?? void 0,
@@ -5440,7 +5699,7 @@ async function processAgent(agent, agentStates) {
           // install target but cheap to sweep.
           join6(agentDir, ".claude", "skills")
         ];
-        const existingDirs = candidateSkillDirs.filter((d) => existsSync4(d));
+        const existingDirs = candidateSkillDirs.filter((d) => existsSync5(d));
         const discoveredEntries = /* @__PURE__ */ new Set();
         for (const dir of existingDirs) {
           try {
@@ -5455,7 +5714,7 @@ async function processAgent(agent, agentStates) {
         const removeSkillFolder = (entry, reason) => {
           for (const dir of existingDirs) {
             const p = join6(dir, entry);
-            if (existsSync4(p)) {
+            if (existsSync5(p)) {
               rmSync3(p, { recursive: true, force: true });
             }
           }
@@ -5617,7 +5876,7 @@ async function processAgent(agent, agentStates) {
       let mcpJsonParsed = null;
       try {
         const mcpPath = join6(getProjectDir(agent.code_name), ".mcp.json");
-        mcpJsonParsed = JSON.parse(readFileSync5(mcpPath, "utf-8"));
+        mcpJsonParsed = JSON.parse(readFileSync7(mcpPath, "utf-8"));
       } catch {
       }
       reapMissingMcpSessions({
@@ -5772,9 +6031,9 @@ async function processAgent(agent, agentStates) {
         if (agentFw === "openclaw" && gatewayRunning && gatewayPort) {
           const homeDir = process.env["HOME"] ?? "/tmp";
           const jobsPath = join6(homeDir, `.openclaw-${agent.code_name}`, "cron", "jobs.json");
-          if (existsSync4(jobsPath)) {
+          if (existsSync5(jobsPath)) {
             try {
-              const jobsData = JSON.parse(readFileSync5(jobsPath, "utf-8"));
+              const jobsData = JSON.parse(readFileSync7(jobsPath, "utf-8"));
               const kanbanJob = (jobsData.jobs ?? []).find(
                 (j) => typeof j.name === "string" && j.name.includes("kanban-work")
               );
@@ -5908,7 +6167,7 @@ In progress for ${age} minutes \u2014 auto-failed`).catch(() => {
     }
   }
   const trackedFiles = frameworkAdapter.driftTrackedFiles();
-  if (trackedFiles.length > 0 && existsSync4(agentDir)) {
+  if (trackedFiles.length > 0 && existsSync5(agentDir)) {
     const hashes = /* @__PURE__ */ new Map();
     for (const file of trackedFiles) {
       const h = hashFile(join6(agentDir, file));
@@ -5955,9 +6214,9 @@ function cleanupStaleSessions(codeName) {
 }
 function cleanupCronSessions(sessionsDir, keepCount) {
   const indexPath = join6(sessionsDir, "sessions.json");
-  if (!existsSync4(indexPath)) return;
+  if (!existsSync5(indexPath)) return;
   try {
-    const raw = readFileSync5(indexPath, "utf-8");
+    const raw = readFileSync7(indexPath, "utf-8");
     const index = JSON.parse(raw);
     const cronRunKeys = Object.keys(index).filter((k) => k.includes(":cron:") && k.includes(":run:")).map((k) => ({
       key: k,
@@ -5972,7 +6231,7 @@ function cleanupCronSessions(sessionsDir, keepCount) {
       if (entry.sessionId) {
         const sessionFile = join6(sessionsDir, `${entry.sessionId}.jsonl`);
         try {
-          if (existsSync4(sessionFile)) {
+          if (existsSync5(sessionFile)) {
             unlinkSync(sessionFile);
             deletedFiles++;
           }
@@ -5993,7 +6252,7 @@ function cleanupCronSessions(sessionsDir, keepCount) {
         if (parentSessionId) {
           try {
             const f = join6(sessionsDir, `${parentSessionId}.jsonl`);
-            if (existsSync4(f)) {
+            if (existsSync5(f)) {
               unlinkSync(f);
               deletedFiles++;
             }
@@ -6002,7 +6261,7 @@ function cleanupCronSessions(sessionsDir, keepCount) {
         }
       }
     }
-    writeFileSync3(indexPath, JSON.stringify(index));
+    writeFileSync4(indexPath, JSON.stringify(index));
     if (toDelete.length > 0) {
       log(`Cleaned ${toDelete.length} cron session(s) and ${deletedFiles} file(s) from ${sessionsDir}`);
     }
@@ -6011,9 +6270,9 @@ function cleanupCronSessions(sessionsDir, keepCount) {
 }
 var STALE_RUN_TIMEOUT_MS = 5 * 6e4;
 function clearStaleCronRunState(jobsPath) {
-  if (!existsSync4(jobsPath)) return;
+  if (!existsSync5(jobsPath)) return;
   try {
-    const raw = readFileSync5(jobsPath, "utf-8");
+    const raw = readFileSync7(jobsPath, "utf-8");
     const data = JSON.parse(raw);
     const jobs = data.jobs ?? data;
     if (!Array.isArray(jobs)) return;
@@ -6038,13 +6297,13 @@ function clearStaleCronRunState(jobsPath) {
       }
     }
     if (changed) {
-      writeFileSync3(jobsPath, JSON.stringify(data, null, 2));
+      writeFileSync4(jobsPath, JSON.stringify(data, null, 2));
     }
   } catch {
   }
 }
 function cleanupOldFiles(dir, maxAgeDays, ext) {
-  if (!existsSync4(dir)) return;
+  if (!existsSync5(dir)) return;
   const cutoff = Date.now() - maxAgeDays * 24 * 60 * 60 * 1e3;
   let removed = 0;
   try {
@@ -6069,6 +6328,25 @@ function cleanupOldFiles(dir, maxAgeDays, ext) {
 var inFlightClaudeTasks = /* @__PURE__ */ new Set();
 var claudeTaskConcurrency = /* @__PURE__ */ new Map();
 var MAX_CLAUDE_CONCURRENCY = 2;
+function claudePidFilePath() {
+  return join6(homedir4(), ".augmented", "manager-claude-pids.json");
+}
+var inFlightClaudePids = /* @__PURE__ */ new Map();
+function registerClaudeSpawn(record) {
+  inFlightClaudePids.set(record.pid, record);
+  try {
+    addSpawn(claudePidFilePath(), record);
+  } catch (err) {
+    log(`[drain] pid-file write failed: ${err.message}`);
+  }
+}
+function unregisterClaudeSpawn(pid) {
+  inFlightClaudePids.delete(pid);
+  try {
+    removeSpawn(claudePidFilePath(), pid);
+  } catch {
+  }
+}
 var claudeSchedulerStates = /* @__PURE__ */ new Map();
 async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
@@ -6340,9 +6618,9 @@ async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
   try {
     const claudeMdPath = join6(projectDir, "CLAUDE.md");
     const serverNames = [];
-    if (existsSync4(mcpConfigPath)) {
+    if (existsSync5(mcpConfigPath)) {
       try {
-        const d = JSON.parse(readFileSync5(mcpConfigPath, "utf-8"));
+        const d = JSON.parse(readFileSync7(mcpConfigPath, "utf-8"));
         if (d.mcpServers) serverNames.push(...Object.keys(d.mcpServers));
       } catch {
       }
@@ -6361,14 +6639,14 @@ async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
       "--allowedTools",
       allowedTools
     ];
-    if (existsSync4(claudeMdPath)) {
+    if (existsSync5(claudeMdPath)) {
       claudeArgs.push("--system-prompt-file", claudeMdPath);
     }
     const childEnv = { ...process.env };
     const envIntPath = join6(projectDir, ".env.integrations");
-    if (existsSync4(envIntPath)) {
+    if (existsSync5(envIntPath)) {
       try {
-        for (const line of readFileSync5(envIntPath, "utf-8").split("\n")) {
+        for (const line of readFileSync7(envIntPath, "utf-8").split("\n")) {
           if (!line || line.startsWith("#") || !line.includes("=")) continue;
           const eqIdx = line.indexOf("=");
           childEnv[line.slice(0, eqIdx)] = line.slice(eqIdx + 1);
@@ -6392,11 +6670,21 @@ async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
     runId = startResult.run_id;
     kanbanItemId = startResult.kanban_item_id;
     if (runId) childEnv["AGT_RUN_ID"] = runId;
+    const claudeKind = task.templateId === "kanban-work" ? "kanban-work" : "scheduled-task";
     const { stdout, stderr } = await execFilePromiseLong(resolveClaudeBinary(), claudeArgs, {
       cwd: projectDir,
       timeout: 3e5,
       stdin: "ignore",
-      env: childEnv
+      env: childEnv,
+      onSpawn: (pid) => registerClaudeSpawn({
+        pid,
+        started_at: Date.now(),
+        kind: claudeKind,
+        agent_id: agentId,
+        agent_code_name: codeName,
+        kanban_card_id: kanbanItemId ?? void 0
+      }),
+      onExit: (pid) => unregisterClaudeSpawn(pid)
     });
     if (stderr) {
       log(`[claude-scheduler] Task '${task.name}' stderr for '${codeName}': ${stderr.slice(0, 500)}`);
@@ -7170,9 +7458,9 @@ ${escapeXml(msg.content)}
       const projDir = ccProjectDir(agent.codeName);
       const mcpConfigPath = join6(projDir, ".mcp.json");
       const serverNames = [];
-      if (existsSync4(mcpConfigPath)) {
+      if (existsSync5(mcpConfigPath)) {
         try {
-          const d = JSON.parse(readFileSync5(mcpConfigPath, "utf-8"));
+          const d = JSON.parse(readFileSync7(mcpConfigPath, "utf-8"));
           if (d.mcpServers) serverNames.push(...Object.keys(d.mcpServers));
         } catch {
         }
@@ -7192,14 +7480,14 @@ ${escapeXml(msg.content)}
         allowedTools
       ];
       const chatClaudeMd = join6(projDir, "CLAUDE.md");
-      if (existsSync4(chatClaudeMd)) {
+      if (existsSync5(chatClaudeMd)) {
         chatArgs.push("--system-prompt-file", chatClaudeMd);
       }
       const envIntPath = join6(projDir, ".env.integrations");
       const childEnv = { ...process.env };
-      if (existsSync4(envIntPath)) {
+      if (existsSync5(envIntPath)) {
         try {
-          for (const line of readFileSync5(envIntPath, "utf-8").split("\n")) {
+          for (const line of readFileSync7(envIntPath, "utf-8").split("\n")) {
             if (!line || line.startsWith("#") || !line.includes("=")) continue;
             const eqIdx = line.indexOf("=");
             childEnv[line.slice(0, eqIdx)] = line.slice(eqIdx + 1);
@@ -7212,7 +7500,19 @@ ${escapeXml(msg.content)}
       } catch (err) {
         throw new Error(`Auth resolve failed for '${agent.codeName}': ${err.message}`);
       }
-      const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), chatArgs, { cwd: projDir, stdin: "ignore", env: childEnv });
+      const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), chatArgs, {
+        cwd: projDir,
+        stdin: "ignore",
+        env: childEnv,
+        onSpawn: (pid) => registerClaudeSpawn({
+          pid,
+          started_at: Date.now(),
+          kind: "direct-chat",
+          agent_id: agent.agentId,
+          agent_code_name: agent.codeName
+        }),
+        onExit: (pid) => unregisterClaudeSpawn(pid)
+      });
       reply = stdout.trim() || "[No response from agent]";
     } else {
       const { stdout } = await execFilePromiseLong("openclaw", [
@@ -7564,8 +7864,8 @@ function getBuiltInSkillContent(skillId) {
       join6(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "skills", skillId, "SKILL.md")
     ];
     for (const candidate of candidates) {
-      if (existsSync4(candidate)) {
-        const content = readFileSync5(candidate, "utf-8");
+      if (existsSync5(candidate)) {
+        const content = readFileSync7(candidate, "utf-8");
         const files = [{ relativePath: "SKILL.md", content }];
         builtInSkillCache.set(skillId, files);
         return files;
@@ -7736,6 +8036,12 @@ async function execFilePromiseLong(cmd, args, opts) {
       stdio: [opts?.stdin === "ignore" ? "ignore" : "pipe", "pipe", "pipe"],
       ...opts?.env ? { env: opts.env } : {}
     });
+    if (opts?.onSpawn && typeof child.pid === "number") {
+      try {
+        opts.onSpawn(child.pid);
+      } catch {
+      }
+    }
     let stdout = "";
     let stderr = "";
     child.stdout?.on("data", (d) => {
@@ -7750,6 +8056,12 @@ async function execFilePromiseLong(cmd, args, opts) {
     }, opts?.timeout ?? 12e4);
     child.on("close", (code) => {
       clearTimeout(timer);
+      if (opts?.onExit && typeof child.pid === "number") {
+        try {
+          opts.onExit(child.pid);
+        } catch {
+        }
+      }
       if (code !== 0) reject(new ChildProcessError(code, stdout, stderr));
       else resolve({ stdout, stderr });
     });
@@ -8196,7 +8508,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-ZBQKBBMT.js");
+  } = await import("../claude-pair-runtime-3UHTNKZ4.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -8518,14 +8830,14 @@ async function syncMemories(agent, configDir, log2) {
     }
     pendingFreshMemorySync.delete(agent.agent_id);
   }
-  if (existsSync4(memoryDir)) {
+  if (existsSync5(memoryDir)) {
     const prevHashes = memoryFileHashes.get(agent.agent_id) ?? /* @__PURE__ */ new Map();
     const currentHashes = /* @__PURE__ */ new Map();
     const changedMemories = [];
     for (const file of readdirSync3(memoryDir)) {
       if (!file.endsWith(".md")) continue;
       try {
-        const raw = readFileSync5(join6(memoryDir, file), "utf-8");
+        const raw = readFileSync7(join6(memoryDir, file), "utf-8");
         const fileHash = createHash3("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
@@ -8550,7 +8862,7 @@ async function syncMemories(agent, configDir, log2) {
       } catch (err) {
         for (const mem of changedMemories) {
           for (const [file] of currentHashes) {
-            const parsed = parseMemoryFile(readFileSync5(join6(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
+            const parsed = parseMemoryFile(readFileSync7(join6(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
             if (parsed?.name === mem.name) currentHashes.delete(file);
           }
         }
@@ -8563,7 +8875,7 @@ async function syncMemories(agent, configDir, log2) {
   }
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
-  const localFiles = existsSync4(memoryDir) ? readdirSync3(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
+  const localFiles = existsSync5(memoryDir) ? readdirSync3(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
   const localListHash = createHash3("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
@@ -8578,7 +8890,7 @@ async function downloadMemories(agent, memoryDir, log2, { force }) {
     lastDownloadHash.set(agent.agent_id, responseHash);
     lastLocalFileHash.set(agent.agent_id, localListHash);
     if (dbMemories.memories?.length) {
-      mkdirSync2(memoryDir, { recursive: true });
+      mkdirSync4(memoryDir, { recursive: true });
       let written = 0;
       let overwritten = 0;
       for (let i = 0; i < dbMemories.memories.length; i++) {
@@ -8594,17 +8906,17 @@ description: ${JSON.stringify(mem.content.slice(0, 200))}
 
 ${mem.content}
 `;
-        if (existsSync4(filePath)) {
+        if (existsSync5(filePath)) {
           let existing = "";
           try {
-            existing = readFileSync5(filePath, "utf-8");
+            existing = readFileSync7(filePath, "utf-8");
           } catch {
           }
           if (existing === desired) continue;
-          writeFileSync3(filePath, desired);
+          writeFileSync4(filePath, desired);
           overwritten++;
         } else {
-          writeFileSync3(filePath, desired);
+          writeFileSync4(filePath, desired);
           written++;
         }
       }
@@ -8621,7 +8933,7 @@ ${mem.content}
   }
 }
 async function cleanupAgentFiles(codeName, agentDir) {
-  if (existsSync4(agentDir)) {
+  if (existsSync5(agentDir)) {
     try {
       rmSync2(agentDir, { recursive: true, force: true });
       log(`Removed provision directory for '${codeName}'`);
@@ -8777,9 +9089,24 @@ async function stopPolling(opts = {}) {
     process.exit(opts.forcedExitCode ?? 1);
   }, 15e3);
   shutdownTimer.unref();
+  const drainStartedAt = Date.now();
+  const livePids = [...inFlightClaudePids.keys()];
+  if (livePids.length > 0) {
+    for (const pid of livePids) {
+      try {
+        process.kill(pid, "SIGTERM");
+      } catch {
+      }
+    }
+    log(formatDrainShutdownLine({ step: "sigterm-claude-pids", elapsedMs: Date.now() - drainStartedAt, killedPids: livePids }));
+  } else {
+    log(formatDrainShutdownLine({ step: "sigterm-claude-pids", elapsedMs: 0, note: "no in-flight claude -p children" }));
+  }
+  const subsysStartedAt = Date.now();
   stopCaffeinate();
   stopRealtimeChat();
   stopGatewayPool();
+  log(formatDrainShutdownLine({ step: "stop-subsystems", elapsedMs: Date.now() - subsysStartedAt }));
   for (const codeName of [...scheduledRunsByCode.keys()]) {
     closeScheduledRunsForCode(codeName, "cancelled", "manager shutdown");
   }
@@ -8795,8 +9122,8 @@ function startManager(opts) {
   config = opts;
   try {
     const stateFile = getStateFile();
-    if (existsSync4(stateFile)) {
-      const raw = readFileSync5(stateFile, "utf-8");
+    if (existsSync5(stateFile)) {
+      const raw = readFileSync7(stateFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.agents)) {
         state4.agents = parsed.agents;
@@ -8816,8 +9143,77 @@ function startManager(opts) {
   );
   deployMcpAssets();
   reapOrphanChannelMcps({ log });
-  void ensureHostFrameworkBinaries();
-  startPolling();
+  void (async () => {
+    try {
+      await reapOrphanedClaudePids();
+    } catch (err) {
+      log(`[drain] boot reaper failed: ${err.message}`);
+    }
+    void ensureHostFrameworkBinaries();
+    startPolling();
+  })();
+}
+async function reapOrphanedClaudePids() {
+  const path = claudePidFilePath();
+  const file = readPidFile(path);
+  if (file.spawns.length === 0) return;
+  const looksLikeClaude = (pid) => {
+    if (process.platform !== "linux") return true;
+    try {
+      const comm = readFileSync7(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
+      return comm.includes("claude");
+    } catch {
+      return false;
+    }
+  };
+  const decision = decideReaperActions(
+    file,
+    (pid) => {
+      try {
+        process.kill(pid, 0);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    looksLikeClaude
+  );
+  for (const spawn of decision.toKill) {
+    try {
+      process.kill(spawn.pid, "SIGKILL");
+    } catch (err) {
+      log(`[drain] reaper SIGKILL pid=${spawn.pid} failed: ${err.message}`);
+    }
+  }
+  for (const spawn of decision.pidReusedSkipped) {
+    log(
+      `[drain] reaper skipped pid=${spawn.pid} agent=${spawn.agent_code_name} card=${spawn.kanban_card_id ?? "none"} \u2014 PID reuse suspected (identity probe rejected)`
+    );
+  }
+  let kanbanReset = 0;
+  for (const spawn of decision.toResetKanban) {
+    try {
+      await api.post("/host/kanban", {
+        agent_id: spawn.agent_id,
+        update: [{ id: spawn.kanban_card_id, status: "backlog" }]
+      });
+      kanbanReset += 1;
+    } catch (err) {
+      log(`[drain] reaper kanban-reset failed for card=${spawn.kanban_card_id} agent=${spawn.agent_code_name}: ${err.message}`);
+    }
+  }
+  log(formatReaperBootLine({
+    totalRecorded: file.spawns.length,
+    killed: decision.toKill.length,
+    alreadyDead: decision.alreadyDead.length,
+    pidReusedSkipped: decision.pidReusedSkipped.length,
+    kanbanReset
+  }));
+  try {
+    writePidFile(path, { version: 1, spawns: [] });
+  } catch (err) {
+    log(`[drain] reaper file truncate failed: ${err.message}`);
+  }
 }
 async function ensureHostFrameworkBinaries() {
   const apiKey = getApiKey();
@@ -8875,17 +9271,17 @@ function restartRunningChannelMcps(basenames) {
 }
 function deployMcpAssets() {
   const targetDir = join6(homedir4(), ".augmented", "_mcp");
-  mkdirSync2(targetDir, { recursive: true });
-  const moduleDir = dirname(fileURLToPath(import.meta.url));
+  mkdirSync4(targetDir, { recursive: true });
+  const moduleDir = dirname3(fileURLToPath(import.meta.url));
   let mcpSourceDir = "";
   let dir = moduleDir;
   for (let i = 0; i < 6; i++) {
     const candidate = join6(dir, "dist", "mcp");
-    if (existsSync4(join6(candidate, "index.js"))) {
+    if (existsSync5(join6(candidate, "index.js"))) {
       mcpSourceDir = candidate;
       break;
     }
-    const parent = dirname(dir);
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -8896,8 +9292,8 @@ function deployMcpAssets() {
   const changedBasenames = [];
   const fileHash = (p) => {
     try {
-      if (!existsSync4(p)) return null;
-      return createHash3("sha256").update(readFileSync5(p)).digest("hex");
+      if (!existsSync5(p)) return null;
+      return createHash3("sha256").update(readFileSync7(p)).digest("hex");
     } catch {
       return null;
     }
@@ -8910,7 +9306,7 @@ function deployMcpAssets() {
   for (const file of ["index.js", "slack-channel.js", "direct-chat-channel.js", "telegram-channel.js"]) {
     const src = join6(mcpSourceDir, file);
     const dst = join6(targetDir, file);
-    if (!existsSync4(src)) continue;
+    if (!existsSync5(src)) continue;
     const before = fileHash(dst);
     try {
       copyFileSync(src, dst);
@@ -8930,20 +9326,20 @@ function deployMcpAssets() {
   const localMcpPath = join6(targetDir, "index.js");
   try {
     const agentsDir = join6(homedir4(), ".augmented", "agents");
-    if (existsSync4(agentsDir)) {
+    if (existsSync5(agentsDir)) {
       for (const entry of readdirSync3(agentsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         for (const subdir of ["provision", "project"]) {
           const mcpJsonPath = join6(agentsDir, entry.name, subdir, ".mcp.json");
           try {
-            const raw = readFileSync5(mcpJsonPath, "utf-8");
+            const raw = readFileSync7(mcpJsonPath, "utf-8");
             if (!raw.includes("@integrity-labs/augmented-mcp")) continue;
             const mcpConfig = JSON.parse(raw);
             const augServer = mcpConfig.mcpServers?.["augmented"];
             if (!augServer) continue;
             augServer.command = "node";
             augServer.args = [localMcpPath];
-            writeFileSync3(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
+            writeFileSync4(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
             log(`[manager] Patched ${entry.name}/${subdir}/.mcp.json: npx \u2192 node`);
           } catch {
           }