@integrity-labs/agt-cli 0.27.8 → 0.27.9-test.11

package/dist/{chunk-IB655E5U.js → chunk-N2EBL4PZ.js}

@@ -9,7 +9,7 @@ import {
   parseDeliveryTarget,
   registerFramework,
   wrapScheduledTaskPrompt
-} from "./chunk-YSBGIXJG.js";
+} from "./chunk-45I2X4M7.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -136,6 +136,40 @@ var INTEGRATION_REGISTRY = [
     docs_url: "https://docs.granola.ai/docs/api/mcp",
     beta: true
   },
+  {
+    id: "anchor-browser",
+    name: "Anchor Browser",
+    category: "workspace-productivity",
+    description: "Cloud browser for agents \u2014 drive any website that lacks an API (LinkedIn, Sales Navigator, supplier portals) via a hosted, stealth Chromium with persistent-login profiles. Wired as Anchor's HOSTED streamable-HTTP MCP at https://api.anchorbrowser.io/mcp.",
+    // ENG-5855: api-key header auth (NOT OAuth, NOT a local stdio package).
+    // The manager writes ANCHOR_BROWSER_API_KEY to .env.integrations from the
+    // stored api_key credential; the hosted MCP authenticates on the
+    // `anchor-api-key` header. The `anchor-session-id` header binds an
+    // authenticated profile session — its value is minted per-session by the
+    // manager (ENG-5857); until then `envDefaults` seeds it empty so
+    // stateless browsing works and no literal `${...}` placeholder ships.
+    // Tool surface (25 `anchor_*` tools) is the hosted MCP's, validated in
+    // the ENG-5854 spike (docs/spikes/eng-5854-anchor-browser-persistent-login.md).
+    supported_auth_types: ["api_key"],
+    capabilities: [
+      { id: "anchor-browser:browse", name: "Browse & Read", description: "Navigate and read pages \u2014 snapshot, screenshot, page HTML, tabs, console, network requests, wait (anchor_navigate, anchor_snapshot, anchor_take_screenshot, anchor_get_body_html, anchor_tab_list, anchor_console_messages, anchor_network_requests, anchor_wait_for, anchor_navigate_back/forward)", access: "read" },
+      { id: "anchor-browser:interact", name: "Interact", description: "Act on pages \u2014 click, type, hover, drag, select options, press keys, handle dialogs, upload files, resize, manage tabs (anchor_click, anchor_type, anchor_hover, anchor_drag, anchor_select_option, anchor_press_key, anchor_handle_dialog, anchor_file_upload, anchor_resize, anchor_tab_new/select/close, anchor_close)", access: "write" },
+      { id: "anchor-browser:export", name: "Export & Codegen", description: "Save the current page as PDF and generate Playwright code for a scenario (anchor_pdf_save, anchor_generate_playwright_code)", access: "write" }
+    ],
+    docs_url: "https://docs.anchorbrowser.io/introduction",
+    beta: true,
+    remoteMcp: {
+      type: "http",
+      url: "https://api.anchorbrowser.io/mcp",
+      headers: {
+        "anchor-api-key": "${ANCHOR_BROWSER_API_KEY}",
+        "anchor-session-id": "${ANCHOR_BROWSER_SESSION_ID}"
+      },
+      // ENG-5857 mints the real session id; default empty so the header
+      // resolves cleanly (no profile bound → ephemeral session) until then.
+      envDefaults: { ANCHOR_BROWSER_SESSION_ID: "" }
+    }
+  },
   {
     id: "postiz",
     name: "Postiz",
@@ -174,7 +208,15 @@ var INTEGRATION_REGISTRY = [
       { id: "qmd:search", name: "Search Memory", description: "Semantic + keyword search over indexed memory files", access: "read" },
       { id: "qmd:get", name: "Get Memory", description: "Read memory files by path and line range", access: "read" }
     ],
-    beta: true
+    beta: true,
+    // ENG-5815: migrated from buildMcpJson's hardcoded if-block. qmd is
+    // the simplest of the four pre-data-driven entries — no env, no
+    // conditional logic, just `qmd mcp`. The byte-identical render is
+    // pinned by claudecode-qmd-data-driven.test.ts.
+    nativeMcp: {
+      command: "qmd",
+      args: ["mcp"]
+    }
   },
   {
     id: "v0",
@@ -310,6 +352,35 @@ var INTEGRATION_REGISTRY = [
     },
     docs_url: "https://www.coderabbit.ai/cli"
   },
+  {
+    id: "aws",
+    name: "AWS",
+    category: "infrastructure",
+    description: "Amazon Web Services \u2014 query AWS APIs (EC2, S3, IAM, Lambda, etc.) via AWS Labs' official AWS API MCP server",
+    supported_auth_types: ["api_key", "managed", "none"],
+    capabilities: [
+      { id: "aws:read", name: "Read AWS Resources", description: "List and describe AWS resources across services (EC2, S3, IAM, Lambda, \u2026)", access: "read" },
+      { id: "aws:write", name: "Write AWS Resources", description: "Create and update AWS resources. Pair with an aws-no-destructive-ops guardrail.", access: "write" }
+    ],
+    docs_url: "https://github.com/awslabs/mcp/tree/main/src/aws-api-mcp-server",
+    beta: true,
+    // ENG-5815: first integration shipped purely via the data-driven
+    // path — buildMcpJson never grew an `aws` if-block. The AWS Labs
+    // AWS API MCP server runs through uvx (Python tooling), which the
+    // host bootstrap installs alongside python3. Credentials are
+    // resolved via the standard AWS_* env / shared credentials file
+    // chain on the host; the spec doesn't override them.
+    nativeMcp: {
+      command: "uvx",
+      args: ["awslabs.aws-api-mcp-server@latest"],
+      env: {
+        AWS_REGION: "{{empty_if_no_env.AWS_REGION}}",
+        AWS_PROFILE: "{{empty_if_no_env.AWS_PROFILE}}",
+        PATH: "{{process_env.PATH}}",
+        HOME: "{{process_env.HOME}}"
+      }
+    }
+  },
   {
     id: "custom",
     name: "Custom Integration",
@@ -2285,6 +2356,299 @@ function extractAllowedDomains(input) {
 }
 registerFramework(nemoClawAdapter);
 
+// ../../packages/core/dist/provisioning/mcp-config-guards.js
+import { chmodSync as chmodSync4, existsSync as existsSync4, readFileSync as readFileSync4, renameSync as renameSync3, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3 } from "fs";
+
+// ../../packages/core/dist/provisioning/mcp-secret-lint.js
+var LITERAL_SECRET_PATTERNS = [
+  // Slack bot token — `xoxb-<workspace>-<...>`
+  { name: "slack_bot_token", re: /^xoxb-/ },
+  // Slack app-level token (Socket Mode) — `xapp-<...>`
+  { name: "slack_app_token", re: /^xapp-/ },
+  // AGT host API key — `tlk_<...>` (see claudecode-plugin-augmented README).
+  { name: "agt_host_api_key", re: /^tlk_/ },
+  // Composio / generic api-key prefix — `ak_<...>`
+  { name: "composio_api_key", re: /^ak_/ },
+  // Telegram bot token — `<bot id>:AA<...>` (BotFather format). ENG-5901
+  // PR 4: the original `\d{10}:AAE` (from the issue AC) was too narrow —
+  // live tokens on agt-aws-1 carry `AA` + a varying third character
+  // (don/scout/stirling all had AA-not-E tokens the lint and migration
+  // missed). Bot ids are 8–12 digits; the token part always starts `AA`.
+  { name: "telegram_bot_token", re: /^\d{8,12}:AA[A-Za-z0-9_-]/ },
+  // ENG-5901 extension beyond the original AC's five patterns: a literal
+  // JWT (`eyJ...`) is the shape of a leaked AGT_API_KEY, which the
+  // value-prefix patterns above would otherwise miss. Header values often
+  // carry it behind `Bearer ` (or a copy-pasted `Authorization: Bearer `),
+  // so those prefixes are optionally consumed (CodeRabbit #1731).
+  // Templates (`Bearer ${AGT_API_KEY}`) and concrete non-secret values
+  // (UUIDs, hosts) never put `eyJ` after the prefix, so this stays
+  // false-positive-safe inside .mcp.json.
+  { name: "jwt_agt_api_key", re: /^(?:authorization:\s*)?(?:bearer\s+)?eyJ[A-Za-z0-9_-]+\./i }
+];
+function matchLiteralSecret(value) {
+  for (const { name, re } of LITERAL_SECRET_PATTERNS) {
+    if (re.test(value))
+      return name;
+  }
+  return null;
+}
+function scanRecord(server, record, location, findings) {
+  if (!record)
+    return;
+  for (const [field, value] of Object.entries(record)) {
+    if (typeof value !== "string")
+      continue;
+    const pattern = matchLiteralSecret(value);
+    if (pattern)
+      findings.push({ server, field, location, pattern });
+  }
+}
+function scanConfigForLiteralSecrets(config) {
+  const findings = [];
+  if (typeof config !== "object" || config === null)
+    return findings;
+  const servers = config.mcpServers;
+  if (typeof servers !== "object" || servers === null)
+    return findings;
+  for (const [server, raw] of Object.entries(servers)) {
+    if (typeof raw !== "object" || raw === null)
+      continue;
+    const entry = raw;
+    scanRecord(server, entry.env, "env", findings);
+    scanRecord(server, entry.headers, "header", findings);
+  }
+  return findings;
+}
+function formatLiteralSecretRejection(f) {
+  return `[mcp-write] [literal-secret-rejected] field=${f.field} server=${f.server} location=${f.location} pattern=${f.pattern}`;
+}
+
+// ../../packages/core/dist/provisioning/mcp-config-guards.js
+var MCP_FILE_MODE = 384;
+var lastRejectionFingerprintByPath = /* @__PURE__ */ new Map();
+var REQUIRED_ENV_RULES_BY_SERVER = {
+  "cloud-broker": [
+    { key: "AGT_HOST", mustBeConcrete: false },
+    { key: "AGT_API_KEY", mustBeConcrete: false },
+    // ENG-4744: this is the bug shape — writer used to omit this
+    // entirely, or render it as a literal `${AGT_AGENT_ID}` instead
+    // of the agent's real UUID. The broker has no way to substitute
+    // it post-spawn, so a placeholder here = silently broken agent.
+    { key: "AGT_AGENT_ID", mustBeConcrete: true }
+  ]
+};
+var PLACEHOLDER_RE = /\$\{[^}]+\}/;
+function validateRenderedMcpConfig(config) {
+  const errors = [];
+  if (typeof config !== "object" || config === null || Array.isArray(config)) {
+    return {
+      ok: false,
+      errors: [
+        {
+          kind: "invalid_json_shape",
+          server: "*",
+          message: "config root must be a non-null object"
+        }
+      ]
+    };
+  }
+  const root = config;
+  if (root.mcpServers === void 0) {
+    return { ok: true };
+  }
+  if (typeof root.mcpServers !== "object" || root.mcpServers === null) {
+    return {
+      ok: false,
+      errors: [
+        {
+          kind: "invalid_json_shape",
+          server: "*",
+          message: "mcpServers must be an object"
+        }
+      ]
+    };
+  }
+  if (Array.isArray(root.mcpServers)) {
+    return {
+      ok: false,
+      errors: [
+        {
+          kind: "invalid_json_shape",
+          server: "*",
+          message: "mcpServers must be an object"
+        }
+      ]
+    };
+  }
+  for (const [serverKey, raw] of Object.entries(root.mcpServers)) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+      errors.push({
+        kind: "invalid_json_shape",
+        server: serverKey,
+        message: `entry must be an object`
+      });
+      continue;
+    }
+    const entry = raw;
+    const entryRecord = entry;
+    if (typeof entryRecord["url"] === "string") {
+      const type = entryRecord["type"];
+      if (type !== "http" && type !== "sse") {
+        errors.push({
+          kind: "remote_mcp_missing_type",
+          server: serverKey,
+          message: `url-based entry must include \`type: "http"\` or \`type: "sse"\` (Claude Code MCP schema requires it)`
+        });
+      }
+    }
+    const rules = REQUIRED_ENV_RULES_BY_SERVER[serverKey];
+    if (rules) {
+      const env = entry.env ?? {};
+      for (const rule of rules) {
+        const value = env[rule.key];
+        if (typeof value !== "string" || value.length === 0) {
+          errors.push({
+            kind: "missing_required_env",
+            server: serverKey,
+            message: `missing required env key: ${rule.key}`
+          });
+          continue;
+        }
+        if (rule.mustBeConcrete && PLACEHOLDER_RE.test(value)) {
+          errors.push({
+            kind: "unexpanded_placeholder",
+            server: serverKey,
+            message: `env.${rule.key} contains an unexpanded \${...} placeholder; expected a concrete value`
+          });
+        }
+      }
+    }
+  }
+  return errors.length === 0 ? { ok: true } : { ok: false, errors };
+}
+function formatValidationErrors(errors) {
+  return errors.map((e) => `${e.server}:${e.kind}=${e.message}`).join("; ");
+}
+function safeWriteJsonAtomic(path, content, opts = {}) {
+  const keepBackup = opts.keepBackup !== false;
+  const rename = opts.renamer ?? renameSync3;
+  const tmpPath = `${path}.new`;
+  const bakPath = `${path}.bak`;
+  let movedOriginalToBackup = false;
+  try {
+    writeFileSync4(tmpPath, content);
+    if (opts.mode !== void 0) {
+      chmodSync4(tmpPath, opts.mode);
+    }
+  } catch (err) {
+    try {
+      if (existsSync4(tmpPath))
+        unlinkSync3(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+  try {
+    if (keepBackup && existsSync4(path)) {
+      rename(path, bakPath);
+      movedOriginalToBackup = true;
+    }
+    rename(tmpPath, path);
+  } catch (err) {
+    try {
+      if (existsSync4(tmpPath))
+        unlinkSync3(tmpPath);
+    } catch {
+    }
+    if (movedOriginalToBackup && !existsSync4(path) && existsSync4(bakPath)) {
+      try {
+        renameSync3(bakPath, path);
+      } catch {
+      }
+    }
+    throw err;
+  }
+}
+function safeWriteMcpJson(path, config) {
+  const validation = validateRenderedMcpConfig(config);
+  if (!validation.ok) {
+    return { written: false, errors: validation.errors };
+  }
+  const secretFindings = scanConfigForLiteralSecrets(config);
+  if (secretFindings.length > 0) {
+    const fingerprint = secretFindings.map((f) => `${f.server}.${f.field}.${f.location}`).sort().join("|");
+    if (lastRejectionFingerprintByPath.get(path) !== fingerprint) {
+      lastRejectionFingerprintByPath.set(path, fingerprint);
+      for (const f of secretFindings) {
+        process.stderr.write(`${formatLiteralSecretRejection(f)}
+`);
+      }
+    }
+    return {
+      written: false,
+      errors: secretFindings.map((f) => ({
+        kind: "literal_secret",
+        server: f.server,
+        message: `literal secret in ${f.location} field '${f.field}' (pattern ${f.pattern}); expected a \${VAR} template`
+      }))
+    };
+  }
+  lastRejectionFingerprintByPath.delete(path);
+  safeWriteJsonAtomic(path, JSON.stringify(config, null, 2), { mode: MCP_FILE_MODE });
+  return { written: true, errors: [] };
+}
+var SECRET_FIELD_NAME_RE = /TOKEN|KEY|SECRET|BEARER|PASSWORD/i;
+function collectSecretFields(config) {
+  const out = /* @__PURE__ */ new Map();
+  if (typeof config !== "object" || config === null)
+    return out;
+  const servers = config.mcpServers;
+  if (typeof servers !== "object" || servers === null)
+    return out;
+  for (const [server, raw] of Object.entries(servers)) {
+    if (typeof raw !== "object" || raw === null)
+      continue;
+    const entry = raw;
+    for (const [block, location] of [
+      [entry.env, "env"],
+      [entry.headers, "header"]
+    ]) {
+      if (!block)
+        continue;
+      for (const [field, value] of Object.entries(block)) {
+        if (typeof value !== "string")
+          continue;
+        if (!SECRET_FIELD_NAME_RE.test(field))
+          continue;
+        out.set(`${server}\0${field}`, { location, value });
+      }
+    }
+  }
+  return out;
+}
+function mcpMirrorParityErrors(provision2, project) {
+  const a = collectSecretFields(provision2);
+  const b = collectSecretFields(project);
+  const mismatches = [];
+  const keys = /* @__PURE__ */ new Set([...a.keys(), ...b.keys()]);
+  for (const key of keys) {
+    const [server, field] = key.split("\0");
+    const pv = a.get(key);
+    const pj = b.get(key);
+    if (pv && !pj) {
+      mismatches.push({ server, field, location: pv.location, reason: "missing-in-project" });
+    } else if (!pv && pj) {
+      mismatches.push({ server, field, location: pj.location, reason: "missing-in-provision" });
+    } else if (pv && pj && pv.value !== pj.value) {
+      mismatches.push({ server, field, location: pv.location, reason: "value-diverges" });
+    }
+  }
+  return mismatches;
+}
+function formatMirrorMismatch(m) {
+  return `[mcp-mirror] [parity-violation] server=${m.server} field=${m.field} location=${m.location} reason=${m.reason}`;
+}
+
 // ../../packages/core/dist/provisioning/frameworks/claudecode/identity.js
 function buildMemorySection(hasQmd) {
   const recall = hasQmd ? `### Recall
@@ -2533,15 +2897,15 @@ later tick:
   - For long-form output (>500 chars), lead with a one-line summary,
     then a blank line, then the full content. Channel formatters
     truncate gracefully but the lede always lands.
-- **\`kanban_fail\` with a reason** when something went wrong
-  (missing access, credential failure, tool error). The work was
-  attempted but failed.
-- **\`kanban_cancel\` with a reason** when you started, then realised
-  the work isn't actually needed (precondition no longer holds,
-  duplicate of another task, asker changed their mind, data was
-  already current). This is distinct from \`kanban_fail\`: nothing
-  went wrong; you wisely didn't bother. Use this generously \u2014 it's
-  cheaper than running unneeded work to a forced "done".
+- **\`kanban_move\` with \`status="failed"\`** (pass a \`notes\` reason)
+  when something went wrong \u2014 missing access, credential failure, tool
+  error. The work was attempted but couldn't complete.
+- **No-longer-needed work**: there is no "cancelled" status, so close it
+  with **\`kanban_done\`** and a \`result\` that says why it wasn't
+  needed (precondition no longer holds, duplicate of another task, asker
+  changed their mind, data was already current). Do this generously \u2014
+  it's cheaper than running unneeded work, and the result line tells the
+  user you consciously stood it down rather than silently dropping it.
 - **\`kanban_update\` with notes** if you're blocked but might unblock
   later; leave the row in \`in_progress\` and pick up other work.
 
@@ -2644,42 +3008,6 @@ If your charter doesn't authorise team-scope skill writes
 refused server-side \u2014 surface that error to the user rather than
 falling back to a local-disk write.
 
-`;
-}
-function buildProgressHeartbeatSection(resolvedChannels) {
-  const hasSlack = !!resolvedChannels?.includes("slack");
-  const hasDirectChat = !!resolvedChannels?.includes("direct-chat");
-  if (!hasSlack && !hasDirectChat)
-    return "";
-  const bullets = [];
-  if (hasSlack) {
-    bullets.push("- **Slack threads:** `slack_progress_start` (channel + thread_ts from the inbound `<channel>` tag, label = short task name) \u2192 `slack_progress_update` between steps (pass `step_label`, optional `step_current`/`step_total`) \u2192 `slack_progress_complete` (summary) or `slack_progress_fail` (one-sentence reason).");
-  }
-  if (hasDirectChat) {
-    bullets.push("- **Direct Chat sessions:** `direct_chat_progress_start` (session_id from the inbound tag, label) \u2192 `direct_chat_progress_update` \u2192 `direct_chat_progress_complete` / `_fail`.");
-  }
-  return `
-## Progress heartbeats during multi-step work
-
-When a task involves **\u22653 tool calls or is likely to take >5 seconds**
-of tool work, open an in-place progress anchor instead of streaming
-"working on\u2026" / "still working\u2026" / "done" messages. The operator sees
-one message that ticks forward as you advance, not a thread flooded
-with status pings.
-
-${bullets.join("\n")}
-
-The state machine debounces updates to roughly one API call per second
-per channel, so it's safe to call \`_update\` after every step rather
-than batching. Always end with \`_complete\` or \`_fail\` \u2014 leaving an
-anchor in the "working" state means a future stale-state sweep flips it
-to \u26A0\uFE0F "agent unresponsive" once the heartbeat goes cold.
-
-**Skip the heartbeat for one-shot replies.** A single \`slack.reply\` /
-\`direct_chat.reply\` is still the right pattern when there's no
-multi-step work to surface. Heartbeats are for the case where you'd
-otherwise emit several intermediate messages.
-
 `;
 }
 function buildPersonalitySection(seed) {
@@ -2900,6 +3228,37 @@ function formatConfigLines(config) {
     return `  - ${k}: ${rendered}`;
   });
 }
+var EMAIL_DOMAIN_RESTRICT_DEF = "email.domain_restrict";
+function stringList(value) {
+  return Array.isArray(value) ? value.filter((d) => typeof d === "string") : [];
+}
+function formatEmailDomainConfigLines(config) {
+  const mode = typeof config.mode === "string" ? config.mode : void 0;
+  const lines = [];
+  if (mode)
+    lines.push(`  - mode: ${mode}`);
+  if (mode === "allowlist") {
+    const allowed = stringList(config.allowed_domains);
+    lines.push(`  - allowed_domains: ${allowed.length ? allowed.join(", ") : "(none \u2014 no external email permitted)"}`);
+  } else if (mode === "blocklist") {
+    const blocked = stringList(config.blocked_domains);
+    lines.push(`  - blocked_domains: ${blocked.length ? blocked.join(", ") : "(none)"}`);
+  } else if (mode === "internal_only") {
+    lines.push(`  - only your organization's own email domain is permitted`);
+  }
+  lines.push(`  *Advisory: honor this restriction \u2014 it is guidance in your instructions, not a hard block at send time.*`);
+  return lines;
+}
+var CALENDAR_CONFIDENTIALITY_DEF = "calendar.confidentiality";
+function formatCalendarConfidentialityLines(config) {
+  const stage = typeof config.stage === "string" ? config.stage : "shadow";
+  const lines = [`  - stage: ${stage}`];
+  lines.push(`  *Cross-turn re-query: when answering a different person about your principal's calendar, ALWAYS re-query the calendar tool \u2014 never reuse meeting details remembered from an earlier turn that involved a different recipient. The tool's response is filtered per-recipient at the API layer; relying on memory bypasses the filter.*`);
+  if (stage !== "enforce") {
+    lines.push(`  *Currently observe-only \u2014 the API records redaction decisions to guardrail_audit_log but returns calendar responses unchanged. Treat the policy as authoritative anyway; the runtime flip is operator-side.*`);
+  }
+  return lines;
+}
 function renderGuardrailBullet(g) {
   const lines = [];
   const header = `- **${g.displayName}** (${g.category}, from ${g.source})`;
@@ -2907,16 +3266,26 @@ function renderGuardrailBullet(g) {
   if (g.description?.trim()) {
     lines.push(`  ${g.description.trim()}`);
   }
-  lines.push(...formatConfigLines(g.config));
+  lines.push(...g.definitionId === EMAIL_DOMAIN_RESTRICT_DEF ? formatEmailDomainConfigLines(g.config) : g.definitionId === CALENDAR_CONFIDENTIALITY_DEF ? formatCalendarConfidentialityLines(g.config) : formatConfigLines(g.config));
   if (g.overrideApplied && g.overrideReason?.trim()) {
     lines.push(`  *Override applied: ${g.overrideReason.trim()}*`);
   }
   return lines.join("\n");
 }
+function effectiveCalendarEnforcement(g) {
+  if (g.definitionId !== CALENDAR_CONFIDENTIALITY_DEF)
+    return g.enforcement;
+  const stage = typeof g.config?.["stage"] === "string" ? g.config["stage"] : "shadow";
+  if (stage === "enforce")
+    return "enforce";
+  if (stage === "warn" && g.enforcement !== "enforce")
+    return "warn";
+  return g.enforcement;
+}
 function buildGuardrailsSection(guardrails) {
   if (!guardrails || guardrails.length === 0)
     return "";
-  const active = guardrails.filter((g) => g.enforcement !== "disabled");
+  const active = guardrails.map((g) => ({ ...g, enforcement: effectiveCalendarEnforcement(g) })).filter((g) => g.enforcement !== "disabled");
   if (active.length === 0)
     return "";
   const enforce = active.filter((g) => g.enforcement === "enforce");
@@ -2992,34 +3361,73 @@ acknowledge before you start.
 - **FAST (< 60s):** handle inline. Reply via the channel tool
   (slack.reply / telegram.reply / directchat.reply) and end your turn.
 
-- **SLOW (\u2265 60s):** dispatch.
+- **SLOW (\u2265 60s):** acknowledge first, then handle inline.
   1. Send a one-line acknowledgement via the channel tool \u2014 short, warm,
      and tell the user you'll come back. Example shape (don't copy verbatim,
      match your voice): "On it \u2014 this'll take a minute or two, I'll ping
      when it's done."
-  2. Invoke the \`channel-message-handler\` subagent (Task tool, with
-     \`subagent_type: channel-message-handler\`) with the full original
-     message text plus the **channel-specific routing keys** the reply
-     tool needs: Slack threads \u2192 \`{ channel_id, thread_ts }\`; Slack
-     non-thread DMs \u2192 \`{ channel_id }\`; Telegram \u2192 \`{ chat_id, message_id }\`;
-     Direct Chat \u2192 \`{ conversation_id }\`. Pass these verbatim from the
-     inbound \`<channel>\` tag \u2014 don't substitute a generic \`message_ts\`,
-     since only Slack threads use it. The subagent will do the actual
-     work and post the real reply itself.
-  3. End your turn. **Do NOT call slack.reply / telegram.reply with the
-     full result yourself** \u2014 that's the subagent's job.
-
-**Why this matters more than any other instruction below:** if you handle
-slow requests inline, you go silent for 60+ seconds while operators send
-follow-up messages that queue behind you. Dispatching keeps you free to
-acknowledge new pings. The kanban-tracking-link convention, work-management
-"create a task" guidance, and Slack reply patterns ALL apply to fast
-inline replies \u2014 they do NOT replace this dispatch decision.
-
-If the work turns out to be unexpectedly slow after you started inline,
-finish the current sub-step, then dispatch the rest. Don't apologise for
-mid-task switching \u2014 operators care about responsiveness, not consistency.
-${buildProgressHeartbeatSection(resolvedChannels)}
+  2. Do the work yourself in this same session. Use whatever tools you
+     need (MCP, skills, file reads, etc.) \u2014 your parent session has the
+     full MCP surface bound.
+  3. Reply with the result via the channel tool (\`slack.reply\` /
+     \`telegram.reply\` / \`directchat.reply\`), addressing the same thread
+     / chat / conversation you acknowledged in step 1.
+
+> **Why inline and not sub-agent dispatch right now:** there is an
+> upstream Claude Code bug
+> ([anthropics/claude-code#64909](https://github.com/anthropics/claude-code/issues/64909))
+> where sub-agents dispatched via the Task tool with an explicit
+> \`tools:\` allowlist (which is the shape \`channel-message-handler\`
+> uses) get an **empty MCP tool registry** \u2014 every \`mcp__*\` call
+> returns "No such tool available", including the channel reply tools.
+> Dispatching a slow channel reply to \`channel-message-handler\` will
+> therefore silently fail to land: you'd post the one-line ack, the
+> sub-agent would do the analysis fine, but its \`slack.reply\` call
+> would error and the user would never see the substantive reply.
+> Empirically confirmed 2026-06-03 with a 6-tool probe: 0/6 MCP tools
+> bound inside \`channel-message-handler\`. Until Anthropic ships the
+> fix, handling slow channel replies inline is the only working path.
+
+**Why this triage decision still matters more than any other instruction
+below:** if you skip the acknowledgement and just dive into slow work
+silently, operators send follow-up messages that queue behind you
+wondering whether you got the original. The ack-first-then-work pattern
+keeps users oriented. The kanban-tracking-link convention,
+work-management "create a task" guidance, and Slack reply patterns ALL
+apply to whatever you post \u2014 the ack and the eventual full reply alike.
+
+If the work turns out to be unexpectedly slow after you started inline
+without acknowledging (because you thought it was a FAST request), post
+a quick "this is taking longer than I expected, still working" line
+rather than going silent. Operators care about responsiveness, not
+consistency.
+
+## Background dispatch for non-channel work
+
+For background tool work that **isn't** a channel reply \u2014 multi-step data
+pulls, CRM enrichments, research workflows, cross-MCP orchestration \u2014 use
+\`subagent_type: general-purpose\` (Anthropic's built-in). It inherits the
+full MCP tool surface from this session and reliably binds every
+\`mcp__*\` server you have available.
+
+**Why not \`augmented-worker\` for now:** there is an upstream Claude Code
+bug ([anthropics/claude-code#64909](https://github.com/anthropics/claude-code/issues/64909))
+where sub-agents with an explicit \`tools:\` allowlist get an empty MCP
+tool registry \u2014 every \`mcp__*\` call returns "No such tool available."
+\`general-purpose\` uses \`tools: *\` (inherit-all) and escapes the bug.
+Once Anthropic ships the fix, \`augmented-worker\` becomes preferred again
+(restricted tool surface for safety + working MCP binding); the dispatch
+recommendation here will flip back automatically.
+
+For slow **channel** replies, see \xA7 FIRST ACTION above \u2014 those are
+currently handled inline (not dispatched) because \`channel-message-handler\`
+shares the explicit-allowlist shape and so suffers the same upstream
+bug. Empirically confirmed 2026-06-03 on agt-aws-1 with a 6-tool probe:
+0/6 MCP tools bound inside \`channel-message-handler\` (matching the
+\`augmented-worker\` result). When Anthropic ships the upstream fix, both
+named sub-agents will work again and the FIRST ACTION triage will switch
+back to dispatch.
+
 ${activeTasksSection}${personalitySection}## Identity
 
 - Code Name: ${frontmatter.code_name}
@@ -3028,13 +3436,30 @@ ${activeTasksSection}${personalitySection}## Identity
 - Risk Tier: ${frontmatter.risk_tier}
 - Timezone: ${timezone?.trim() || "UTC"}
 - Channels: ${channelList}
+
+> **What the Channels list above means** (ENG-5851): \`Channels:\`
+> enumerates the messaging **protocols** you may use \u2014 \`slack\`,
+> \`telegram\`, \`msteams\`, etc. It is **not** a list of specific
+> Slack channels / Telegram chats / Teams threads you're approved to
+> post in. There is no per-recipient "approved channels" allowlist
+> anywhere in this platform; you decide where to post based on the
+> task and the conversation context. If you call a send tool and the
+> target channel rejects it (e.g. Slack returns \`not_in_channel\` /
+> \`channel_not_found\`, or Teams returns \`team_not_allowed\`), surface
+> the error to the user with the recovery action \u2014 typically asking
+> them to run \`/invite @<your bot handle>\` in the channel so you can
+> post there next time. Do **not** refuse a posting request on the
+> grounds that the channel "isn't on the allowlist" \u2014 that conflation
+> is the bug ENG-5851 was filed to fix.
 ${resolvedChannels?.includes("slack") ? `
 ## Slack
 
 You have a Slack MCP server connected. **First, see \xA7 FIRST ACTION on
 every channel message: triage** at the top of this document \u2014 decide
-fast vs slow before anything else, and dispatch slow work via
-\`channel-message-handler\` rather than handling it inline.
+fast vs slow before anything else, then acknowledge inline before
+diving into slow work (sub-agent dispatch for channel replies is
+currently disabled due to an upstream Claude Code bug; see the FIRST
+ACTION section for the full rationale).
 
 For fast requests, respond directly in the conversation. You can also
 proactively use:
@@ -3192,15 +3617,21 @@ When you receive a request via any channel (Slack, Telegram, direct chat):
 3. **Create the kanban task** with kanban.add. Title should be specific
    enough to be self-explanatory \u2014 "Pull Linear ENG sprint velocity for
    this fortnight" beats "Linear stats".
-4. Reply in the channel thread: "On it \u2014 tracking here: ${kanbanUrl ?? "my kanban board"}" (include the created task title)
+4. Reply in the channel thread with a brief acknowledgement that names the
+   created task: "On it \u2014 <task title>".
+   - **On Slack, do NOT paste the kanban URL.** A progress card with an
+     **Open card** button is posted into the thread automatically when the
+     task is channel-sourced \u2014 a pasted link on top of it is duplicate noise.
+   - On channels without a progress card (Telegram, direct chat), include
+     the tracking link: "On it \u2014 tracking here: ${kanbanUrl ?? "my kanban board"}".
 5. Move the task to in_progress with kanban.move
 6. Do the work
 7. Mark done with kanban.done including a result summary
 8. Reply in the channel thread with the result
 
 Everything that isn't exempt gets a task \u2014 but only after the request is
-clear. Don't bury a clarifying question underneath a "tracking here" reply;
-ask the question alone, no kanban link, and let the user answer before
+clear. Don't bury a clarifying question underneath an "on it" acknowledgement;
+ask the question alone, no task created yet, and let the user answer before
 anything goes on the board.
 
 When asked about existing work, tasks, or what you've been doing \u2014 call kanban.list
@@ -3325,163 +3756,90 @@ The marginal cost of completeness is near zero. Do the whole thing.
 ${frontmatter.environment === "prod" ? "- Production environment: exercise extra caution with all operations.\n" : ""}`;
 }
 
+// ../../packages/core/dist/provisioning/env-integrations-file.js
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+var CHANNEL_SECRET_ENV_KEYS = [
+  "SLACK_BOT_TOKEN",
+  "SLACK_APP_TOKEN",
+  "TELEGRAM_BOT_TOKEN",
+  "MSTEAMS_CLIENT_SECRET"
+];
+var MCP_SERVER_SECRET_ENV_KEYS = [
+  "COMPOSIO_API_KEY",
+  "PIPEDREAM_CLIENT_SECRET"
+];
+var PRESERVED_ENV_KEYS = [
+  ...CHANNEL_SECRET_ENV_KEYS,
+  ...MCP_SERVER_SECRET_ENV_KEYS
+];
+var HEADER = "# Augmented integrations \u2014 auto-generated, do not edit";
+function parseEnvFileEntries(content) {
+  const out = /* @__PURE__ */ new Map();
+  for (const line of content.split("\n")) {
+    if (!line || line.startsWith("#") || !line.includes("="))
+      continue;
+    const eqIdx = line.indexOf("=");
+    out.set(line.slice(0, eqIdx), line.slice(eqIdx + 1));
+  }
+  return out;
+}
+function renderEnvIntegrations(entries) {
+  const lines = [HEADER];
+  for (const [key, rendered] of entries)
+    lines.push(`${key}=${rendered}`);
+  return lines.join("\n") + "\n";
+}
+function mergeEnvIntegrationsContent(existing, args) {
+  const current = existing === null ? /* @__PURE__ */ new Map() : parseEnvFileEntries(existing);
+  let next;
+  if (args.mode === "upsert") {
+    next = new Map(current);
+    for (const [key, raw] of Object.entries(args.updates)) {
+      if (raw === null)
+        next.delete(key);
+      else
+        next.set(key, shellQuote(raw));
+    }
+  } else {
+    next = /* @__PURE__ */ new Map();
+    for (const [key, raw] of Object.entries(args.updates)) {
+      if (raw !== null)
+        next.set(key, shellQuote(raw));
+    }
+    const preserve = args.preserveKeys ?? PRESERVED_ENV_KEYS;
+    for (const key of preserve) {
+      if (key in args.updates)
+        continue;
+      if (!next.has(key) && current.has(key)) {
+        next.set(key, current.get(key));
+      }
+    }
+  }
+  return renderEnvIntegrations(next);
+}
+
 // ../../packages/core/dist/provisioning/frameworks/claudecode/index.js
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, existsSync as existsSync5, chmodSync as chmodSync4, readdirSync, rmSync, copyFileSync } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, existsSync as existsSync5, chmodSync as chmodSync5, readdirSync, rmSync, copyFileSync } from "fs";
 import { join as join4, relative, dirname as dirname4 } from "path";
 import { homedir as homedir3 } from "os";
 import { execFile as execFile3 } from "child_process";
 
-// ../../packages/core/dist/provisioning/mcp-config-guards.js
-import { existsSync as existsSync4, readFileSync as readFileSync4, renameSync as renameSync3, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3 } from "fs";
-var REQUIRED_ENV_RULES_BY_SERVER = {
-  "cloud-broker": [
-    { key: "AGT_HOST", mustBeConcrete: false },
-    { key: "AGT_API_KEY", mustBeConcrete: false },
-    // ENG-4744: this is the bug shape — writer used to omit this
-    // entirely, or render it as a literal `${AGT_AGENT_ID}` instead
-    // of the agent's real UUID. The broker has no way to substitute
-    // it post-spawn, so a placeholder here = silently broken agent.
-    { key: "AGT_AGENT_ID", mustBeConcrete: true }
-  ]
-};
-var PLACEHOLDER_RE = /\$\{[^}]+\}/;
-function validateRenderedMcpConfig(config) {
-  const errors = [];
-  if (typeof config !== "object" || config === null || Array.isArray(config)) {
-    return {
-      ok: false,
-      errors: [
-        {
-          kind: "invalid_json_shape",
-          server: "*",
-          message: "config root must be a non-null object"
-        }
-      ]
-    };
-  }
-  const root = config;
-  if (root.mcpServers === void 0) {
-    return { ok: true };
-  }
-  if (typeof root.mcpServers !== "object" || root.mcpServers === null) {
-    return {
-      ok: false,
-      errors: [
-        {
-          kind: "invalid_json_shape",
-          server: "*",
-          message: "mcpServers must be an object"
-        }
-      ]
-    };
-  }
-  if (Array.isArray(root.mcpServers)) {
-    return {
-      ok: false,
-      errors: [
-        {
-          kind: "invalid_json_shape",
-          server: "*",
-          message: "mcpServers must be an object"
-        }
-      ]
-    };
-  }
-  for (const [serverKey, raw] of Object.entries(root.mcpServers)) {
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-      errors.push({
-        kind: "invalid_json_shape",
-        server: serverKey,
-        message: `entry must be an object`
-      });
-      continue;
-    }
-    const entry = raw;
-    const entryRecord = entry;
-    if (typeof entryRecord["url"] === "string") {
-      const type = entryRecord["type"];
-      if (type !== "http" && type !== "sse") {
-        errors.push({
-          kind: "remote_mcp_missing_type",
-          server: serverKey,
-          message: `url-based entry must include \`type: "http"\` or \`type: "sse"\` (Claude Code MCP schema requires it)`
-        });
-      }
-    }
-    const rules = REQUIRED_ENV_RULES_BY_SERVER[serverKey];
-    if (rules) {
-      const env = entry.env ?? {};
-      for (const rule of rules) {
-        const value = env[rule.key];
-        if (typeof value !== "string" || value.length === 0) {
-          errors.push({
-            kind: "missing_required_env",
-            server: serverKey,
-            message: `missing required env key: ${rule.key}`
-          });
-          continue;
-        }
-        if (rule.mustBeConcrete && PLACEHOLDER_RE.test(value)) {
-          errors.push({
-            kind: "unexpanded_placeholder",
-            server: serverKey,
-            message: `env.${rule.key} contains an unexpanded \${...} placeholder; expected a concrete value`
-          });
-        }
-      }
-    }
-  }
-  return errors.length === 0 ? { ok: true } : { ok: false, errors };
-}
-function formatValidationErrors(errors) {
-  return errors.map((e) => `${e.server}:${e.kind}=${e.message}`).join("; ");
-}
-function safeWriteJsonAtomic(path, content, opts = {}) {
-  const keepBackup = opts.keepBackup !== false;
-  const rename = opts.renamer ?? renameSync3;
-  const tmpPath = `${path}.new`;
-  const bakPath = `${path}.bak`;
-  let movedOriginalToBackup = false;
-  try {
-    writeFileSync4(tmpPath, content);
-  } catch (err) {
-    throw err;
-  }
-  try {
-    if (keepBackup && existsSync4(path)) {
-      rename(path, bakPath);
-      movedOriginalToBackup = true;
-    }
-    rename(tmpPath, path);
-  } catch (err) {
-    try {
-      if (existsSync4(tmpPath))
-        unlinkSync3(tmpPath);
-    } catch {
-    }
-    if (movedOriginalToBackup && !existsSync4(path) && existsSync4(bakPath)) {
-      try {
-        renameSync3(bakPath, path);
-      } catch {
-      }
-    }
-    throw err;
-  }
-}
-function safeWriteMcpJson(path, config) {
-  const validation = validateRenderedMcpConfig(config);
-  if (!validation.ok) {
-    return { written: false, errors: validation.errors };
-  }
-  safeWriteJsonAtomic(path, JSON.stringify(config, null, 2));
-  return { written: true, errors: [] };
-}
-
 // ../../packages/core/dist/provisioning/remote-mcp.js
 function envVarForToken(definitionId) {
   return `${definitionId.replace(/-/g, "_").toUpperCase()}_ACCESS_TOKEN`;
 }
 function buildRemoteMcpEntry(definitionId) {
+  const def = INTEGRATION_REGISTRY.find((d) => d.id === definitionId);
+  if (def?.remoteMcp) {
+    const spec = def.remoteMcp;
+    return {
+      type: spec.type ?? "http",
+      url: spec.url,
+      ...spec.headers ? { headers: { ...spec.headers } } : {}
+    };
+  }
   const provider = OAUTH_PROVIDERS[definitionId];
   if (!provider?.mcpUrl)
     return null;
@@ -3494,11 +3852,158 @@ function buildRemoteMcpEntry(definitionId) {
   };
 }
 
+// ../../packages/core/dist/provisioning/native-mcp.js
+function buildNativeMcpEntry(spec, ctx) {
+  const resolvedCommand = resolveTemplate(spec.command, ctx);
+  if (resolvedCommand.omit) {
+    throw new Error("NativeMcpSpec: empty_if_no_env is only valid in env values (not in `command`)");
+  }
+  const command = resolvedCommand.value;
+  const args = spec.args.map((a, i) => {
+    const resolved = resolveTemplate(a, ctx);
+    if (resolved.omit) {
+      throw new Error(`NativeMcpSpec: empty_if_no_env is only valid in env values (not in args[${i}])`);
+    }
+    return resolved.value;
+  });
+  if (spec.env === void 0) {
+    return { command, args };
+  }
+  const env = {};
+  for (const [k, raw] of Object.entries(spec.env)) {
+    const { value, omit } = resolveTemplate(raw, ctx);
+    if (omit)
+      continue;
+    env[k] = value;
+  }
+  return { command, args, env };
+}
+function resolveTemplate(input, ctx) {
+  const TOKEN = /\{\{([^}]+)\}\}/g;
+  const hasEmptyIfNoEnv = /\{\{\s*empty_if_no_env\./.test(input);
+  const isWholeValueEmptyIfNoEnv = /^\{\{\s*empty_if_no_env\.[^}]+\}\}$/.test(input);
+  if (hasEmptyIfNoEnv && !isWholeValueEmptyIfNoEnv) {
+    throw new Error(`NativeMcpSpec: empty_if_no_env must be the sole content of the value, never mixed with literal text or other tokens (value: ${JSON.stringify(input)})`);
+  }
+  let omit = false;
+  const value = input.replace(TOKEN, (whole, expr) => {
+    const trimmed = expr.trim();
+    if (trimmed === "agent_id")
+      return ctx.agentId;
+    if (trimmed === "agent_code_name")
+      return ctx.agentCodeName;
+    if (trimmed === "integration_id")
+      return ctx.integration?.id ?? "";
+    if (trimmed.startsWith("process_env.")) {
+      const name = trimmed.slice("process_env.".length);
+      return process.env[name] ?? "";
+    }
+    if (trimmed.startsWith("empty_if_no_env.")) {
+      const name = trimmed.slice("empty_if_no_env.".length);
+      const v = process.env[name] ?? "";
+      if (v.length === 0) {
+        omit = true;
+        return "";
+      }
+      return v;
+    }
+    return whole;
+  });
+  return { value, omit };
+}
+
 // ../../packages/core/dist/provisioning/frameworks/claudecode/index.js
 var VALID_CODE_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var SECRET_FILE_MODE = 384;
-function shellQuote(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
+function writeEnvIntegrationsForAgent(codeName, args) {
+  const agentDir = getAgentDir(codeName);
+  const envPath = join4(agentDir, ".env.integrations");
+  let existing = null;
+  try {
+    existing = readFileSync5(envPath, "utf-8");
+  } catch {
+  }
+  if (existing === null && Object.keys(args.updates).length === 0)
+    return;
+  const content = mergeEnvIntegrationsContent(existing, args);
+  writeFileSync5(envPath, content, { mode: SECRET_FILE_MODE });
+  try {
+    chmodSync5(envPath, SECRET_FILE_MODE);
+  } catch {
+  }
+  try {
+    const projectDir = getProjectDir(codeName);
+    mkdirSync4(projectDir, { recursive: true });
+    const dest = join4(projectDir, ".env.integrations");
+    writeFileSync5(dest, content, { mode: SECRET_FILE_MODE });
+    try {
+      chmodSync5(dest, SECRET_FILE_MODE);
+    } catch {
+    }
+  } catch (err) {
+    process.stderr.write(`[env-integrations] [mirror-write-failed] agent=${codeName} error=${err.message}
+`);
+  }
+}
+var MIGRATABLE_FIELD_TO_ENV_VAR = {
+  SLACK_BOT_TOKEN: "SLACK_BOT_TOKEN",
+  SLACK_APP_TOKEN: "SLACK_APP_TOKEN",
+  TELEGRAM_BOT_TOKEN: "TELEGRAM_BOT_TOKEN",
+  MSTEAMS_CLIENT_SECRET: "MSTEAMS_CLIENT_SECRET",
+  PIPEDREAM_CLIENT_SECRET: "PIPEDREAM_CLIENT_SECRET",
+  "x-api-key": "COMPOSIO_API_KEY",
+  AGT_API_KEY: "AGT_API_KEY"
+};
+function migrateExistingLiteralSecrets(codeName) {
+  const mcpJsonPath = join4(getAgentDir(codeName), "provision", ".mcp.json");
+  let config;
+  try {
+    config = JSON.parse(readFileSync5(mcpJsonPath, "utf-8"));
+  } catch {
+    return;
+  }
+  let existingEnvKeys = /* @__PURE__ */ new Set();
+  try {
+    existingEnvKeys = new Set(parseEnvFileEntries(readFileSync5(join4(getAgentDir(codeName), ".env.integrations"), "utf-8")).keys());
+  } catch {
+  }
+  const updates = {};
+  let hoisted = 0;
+  for (const raw of Object.values(config.mcpServers ?? {})) {
+    if (typeof raw !== "object" || raw === null)
+      continue;
+    const entry = raw;
+    for (const block of [entry.env, entry.headers]) {
+      if (!block)
+        continue;
+      for (const [field, envVar] of Object.entries(MIGRATABLE_FIELD_TO_ENV_VAR)) {
+        const value = block[field];
+        if (typeof value !== "string" || value.length === 0 || value.includes("${"))
+          continue;
+        if (envVar !== "AGT_API_KEY" && !existingEnvKeys.has(envVar)) {
+          updates[envVar] = value;
+        }
+        block[field] = `\${${envVar}}`;
+        hoisted++;
+      }
+    }
+  }
+  const unmapped = scanConfigForLiteralSecrets(config).map((f) => `${f.server}.${f.field}`);
+  if (hoisted === 0 && unmapped.length === 0)
+    return;
+  if (hoisted === 0) {
+    process.stderr.write(`[mcp-migrate] [no-mappable-literals] agent=${codeName} unmapped=${unmapped.join(",")}
+`);
+    return;
+  }
+  if (Object.keys(updates).length > 0) {
+    writeEnvIntegrationsForAgent(codeName, { mode: "upsert", updates });
+  }
+  if (writeMcpJsonGuarded(codeName, mcpJsonPath, config)) {
+    syncMcpToProject(codeName);
+    process.stderr.write(`[mcp-migrate] [literals-hoisted] agent=${codeName} hoisted=${hoisted}${unmapped.length > 0 ? ` unmapped=${unmapped.join(",")}` : ""}
+`);
+  }
 }
 function assertValidCodeName(codeName) {
   if (!VALID_CODE_NAME.test(codeName)) {
@@ -3587,10 +4092,23 @@ function syncMcpToProject(codeName) {
   try {
     const content = readFileSync5(provisionMcpPath, "utf-8");
     mkdirSync4(projectDir, { recursive: true });
-    writeFileSync5(projectMcpPath, content);
+    writeFileSync5(projectMcpPath, content, { mode: MCP_FILE_MODE });
+    try {
+      chmodSync5(projectMcpPath, MCP_FILE_MODE);
+    } catch {
+    }
+    try {
+      const mismatches = mcpMirrorParityErrors(JSON.parse(content), JSON.parse(readFileSync5(projectMcpPath, "utf-8")));
+      for (const m of mismatches) {
+        process.stderr.write(`${formatMirrorMismatch(m)} agent=${codeName}
+`);
+      }
+    } catch {
+    }
   } catch {
   }
   renderChannelMessageHandlerForAgent(codeName);
+  renderAugmentedWorkerForAgent(codeName);
 }
 var INTEGRATIONS_SUMMARY_FILE = "integrations-summary.json";
 function integrationsSummaryPath(codeName) {
@@ -3696,7 +4214,15 @@ function deployArtifactsToProject(codeName, provisionDir) {
           continue;
         }
       }
-      writeFileSync5(dest, srcContent);
+      if (file === ".mcp.json") {
+        writeFileSync5(dest, srcContent, { mode: MCP_FILE_MODE });
+        try {
+          chmodSync5(dest, MCP_FILE_MODE);
+        } catch {
+        }
+      } else {
+        writeFileSync5(dest, srcContent);
+      }
     } catch {
     }
   }
@@ -3782,14 +4308,23 @@ function deployArtifactsToProject(codeName, provisionDir) {
       return !(entry && typeof entry["url"] === "string" && entry["url"].startsWith("/"));
     }));
     projectMcp["mcpServers"] = { ...stripRelativeUrls(projectServers), ...stripRelativeUrls(agentServers) };
-    writeFileSync5(projectMcpPath, JSON.stringify(projectMcp, null, 2));
+    writeFileSync5(projectMcpPath, JSON.stringify(projectMcp, null, 2), { mode: MCP_FILE_MODE });
+    try {
+      chmodSync5(projectMcpPath, MCP_FILE_MODE);
+    } catch {
+    }
   } catch {
   }
   const agentDir = getAgentDir(codeName);
   for (const envFile of [".env", ".env.integrations"]) {
     try {
       const content = readFileSync5(join4(agentDir, envFile), "utf-8");
-      writeFileSync5(join4(projectDir, envFile), content);
+      const envDest = join4(projectDir, envFile);
+      writeFileSync5(envDest, content, { mode: SECRET_FILE_MODE });
+      try {
+        chmodSync5(envDest, SECRET_FILE_MODE);
+      } catch {
+      }
     } catch {
     }
   }
@@ -3804,7 +4339,7 @@ function deployArtifactsToProject(codeName, provisionDir) {
       const upToDate = existsSync5(hookDest) && readFileSync5(hookDest, "utf-8") === srcContent;
       if (!upToDate)
         writeFileSync5(hookDest, srcContent);
-      chmodSync4(hookDest, 493);
+      chmodSync5(hookDest, 493);
     }
   } catch {
   }
@@ -4321,6 +4856,7 @@ function buildChannelMessageHandlerAgent(args) {
     "Glob",
     "Skill",
     "Agent",
+    "ToolSearch",
     ...mcpWildcards
   ].join(", ");
   const integrationsBlock = integrations.length === 0 ? "" : `
@@ -4353,12 +4889,88 @@ The parent passes you in the task description:
 Your job:
 
 1. Do the work the message asks for (Xero pull, research, multi-step skill, etc.). Use whichever tools you need.
-2. Post the reply yourself via the matching channel tool \u2014 slack.reply for Slack, telegram.reply for Telegram, teams.reply for Microsoft Teams, directchat.reply for Direct Chat. Use the metadata the parent gave you to address the right thread/conversation.
+2. Post the reply yourself via the matching channel tool \u2014 slack.reply for Slack, telegram.reply for Telegram, teams.reply for Microsoft Teams, direct_chat.reply for Direct Chat. Use the metadata the parent gave you to address the right thread/conversation.
 3. End. Do not do additional follow-up work; if more is needed, the user will send another message.
 
 Do NOT post intermediate progress updates unless the work spans 5+ minutes \u2014 keep noise low. The parent already sent a single-line acknowledgement before dispatching you.
 ${integrationsBlock}`;
 }
+function buildAugmentedWorkerAgent(args) {
+  const mcpServerKeys = args?.mcpServerKeys ?? [];
+  const integrations = args?.integrations ?? [];
+  const mcpWildcards = Array.from(new Set(mcpServerKeys.map((k) => `mcp__${sanitizeMcpName(k)}__*`)));
+  const tools = [
+    "Bash",
+    "Read",
+    "Write",
+    "Edit",
+    "Grep",
+    "Glob",
+    "Skill",
+    "Agent",
+    "ToolSearch",
+    ...mcpWildcards
+  ].join(", ");
+  const integrationsBlock = integrations.length === 0 ? "" : `
+## Integrations available
+
+You inherit the parent agent's environment, including credentials for the integrations below. Env vars follow the convention \`<DEFINITION_ID>_ACCESS_TOKEN\` for OAuth and \`<DEFINITION_ID>_API_KEY\` for API-key integrations (e.g. \`GITHUB_ACCESS_TOKEN\`, \`POSTIZ_API_KEY\`). Where a CLI is listed, prefer it over raw curl \u2014 the CLI handles auth automatically.
+
+${integrations.map((i) => {
+    const cli = i.cliBinary ? ` \u2014 use the \`${i.cliBinary}\` CLI` : "";
+    const desc = i.description ? `. ${i.description}` : "";
+    return `- **${i.name}**${cli}${desc}`;
+  }).join("\n")}
+
+If a capability seems missing, **check first** \u2014 run the CLI, list tools (\`mcp__augmented__list_tools\` or equivalent), or confirm the relevant env var is set **without printing its value** (e.g. \`[ -n "$POSTIZ_API_KEY" ] && echo present || echo absent\`, never \`echo $POSTIZ_API_KEY\`). Do not claim a capability is absent without verifying \u2014 the parent's environment is yours.
+`;
+  return `---
+name: augmented-worker
+description: Background worker for multi-step tool tasks the parent doesn't want to inline (data pulls, multi-API workflows, CRM enrichments, research that needs MCP tools). Carries an explicit \`mcp__*\` wildcard allowlist for every server the parent has wired. **Until [anthropics/claude-code#64909](https://github.com/anthropics/claude-code/issues/64909) ships an upstream fix, prefer \`subagent_type: general-purpose\` for MCP-tool dispatch** \u2014 the bug is in Claude Code's sub-agent dispatch path: sub-agents with an explicit \`tools:\` allowlist get an empty MCP tool registry (every \`mcp__*\` call returns "No such tool available."), while \`general-purpose\` (\`tools: *\` inherit-all) correctly binds the full MCP surface. This subagent's allowlist is correct and will work the moment Anthropic lands the fix; until then it is retained for the eventual structural fix and the rare case where you specifically need a restricted tool surface AND can accept the MCP gap. See [[ENG-5938]] for the workaround tracker.
+background: true
+tools: ${tools}
+---
+
+You are dispatched by the parent agent to do a multi-step task in the background while the parent's listener turn stays free.
+
+## What you can do
+
+Your \`tools:\` allowlist (above) names every MCP server the parent has connected \u2014 Granola, Composio toolkits, Slack/Telegram/Direct-Chat channel tools, the platform \`mcp__augmented__*\` bridge, native integrations (Xero / Postiz / qmd / AWS), etc. \u2014 plus the built-ins (\`Bash\`, \`Read\`, \`Write\`, \`Edit\`, \`Grep\`, \`Glob\`, \`Skill\`, \`Agent\`). All environment variables the parent has are yours: OAuth access tokens (\`GITHUB_ACCESS_TOKEN\`), API keys (\`POSTIZ_API_KEY\`), native-CLI binaries (\`gh\`, \`aws\`, \`xero\`).
+
+## Hard rules \u2014 Credential Access Control
+
+1. **Never** read raw secrets out of \`.mcp.json\`, \`~/.augmented/*/provision/.mcp.json\`, \`.env.integrations\`, or any agent config file. Those files contain bot tokens, API keys, and OAuth credentials. The Credential Access Control guardrail (\`block_read: true\` on secrets) treats reads of those values as a violation regardless of intent. As **defence-in-depth (not structural enforcement)**, the plugin's \`settings.json\` also denies \`Bash(cat:*/.mcp.json)\`, \`Bash(cat:*/.env.integrations)\`, and \`Bash(jq:*/.mcp.json)\` (ENG-5901 / ADR-0018) \u2014 these block the obvious copy-paste paths but a determined in-process reader can still reach the values; the durable fix is Phase 2/3 of ADR-0018.
+2. **Never** post Slack messages via raw \`chat.postMessage\` + a bot token lifted from config. Use the channel MCP's reply tool (\`mcp__slack-channel__slack_reply\`, \`mcp__telegram-channel__telegram_reply\`, \`mcp__direct-chat__direct_chat_reply\`, etc.) so the call goes through the audited path.
+3. If an \`mcp__*\` tool you expect to be available returns "No such tool available.", **stop and surface the gap to the parent** in your summary rather than working around it. A missing MCP binding is a platform bug worth fixing \u2014 it's the exact failure shape this sub-agent was added to prevent (see ENG-5897 / ENG-5905).
+4. When verifying a capability is wired, confirm the relevant env var exists **without printing its value** \u2014 use \`[ -n "$POSTIZ_API_KEY" ] && echo present || echo absent\`, never \`echo $POSTIZ_API_KEY\`. The Credential Access Control guardrail covers tool-call output as well as file reads.
+
+## What to return
+
+Hand the parent a tight summary of what you did, what you found, and any follow-ups it should know about. Do not echo intermediate tool transcripts \u2014 keep the parent's context window clean. If you produced an artifact (a file, a draft, a record ID), name it and where it lives.
+${integrationsBlock}`;
+}
+function renderAugmentedWorkerForAgent(codeName) {
+  const agentDir = getAgentDir(codeName);
+  const projectDir = getProjectDir(codeName);
+  const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
+  let mcpServerKeys;
+  try {
+    const config = JSON.parse(readFileSync5(provisionMcpPath, "utf-8"));
+    mcpServerKeys = Object.keys(config.mcpServers ?? {});
+  } catch {
+    return;
+  }
+  const integrations = readIntegrationsSummaryForAgent(codeName);
+  const content = buildAugmentedWorkerAgent({ mcpServerKeys, integrations });
+  for (const baseDir of [agentDir, projectDir]) {
+    const target = join4(baseDir, ".claude", "agents", "augmented-worker.md");
+    try {
+      mkdirSync4(dirname4(target), { recursive: true });
+      writeFileSync5(target, content);
+    } catch {
+    }
+  }
+}
 function buildPostizMcpEntry(integration) {
   const rawBaseUrl = integration.config["base_url"];
   const postizBaseUrl = typeof rawBaseUrl === "string" ? rawBaseUrl.trim() : "";
@@ -4386,7 +4998,13 @@ function buildMcpJson(input) {
     args: [localMcpPath],
     env: {
       AGT_HOST: process.env["AGT_HOST"] ?? "",
-      AGT_API_KEY: process.env["AGT_API_KEY"] ?? "",
+      // ENG-5901 Track D: templated — the manager exports AGT_API_KEY to
+      // every spawn env (getApiKey()), and Claude Code substitutes at
+      // MCP-launch (same contract as AGT_RUN_ID below). The impersonation
+      // redeem path renders this server-side with no AGT_API_KEY in env;
+      // impersonate-mcp-rewrite.ts treats the literal `${AGT_API_KEY}`
+      // placeholder as fillable and swaps in the operator token.
+      AGT_API_KEY: "${AGT_API_KEY}",
       AGT_AGENT_ID: input.agent.agent_id,
       AGT_AGENT_CODE_NAME: input.agent.code_name,
       // ENG-4561: Claude Code substitutes `${VAR}` in .mcp.json env values
@@ -4405,12 +5023,16 @@ function buildMcpJson(input) {
       HOME: process.env["HOME"] ?? ""
     }
   };
-  const hasQmd = input.integrations?.some((i) => i.definition_id === "qmd");
-  if (hasQmd) {
-    mcpServers["qmd"] = {
-      command: "qmd",
-      args: ["mcp"]
-    };
+  for (const integration of input.integrations ?? []) {
+    const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
+    if (!def?.nativeMcp)
+      continue;
+    const key = def.nativeMcp.key ?? integration.definition_id;
+    mcpServers[key] = buildNativeMcpEntry(def.nativeMcp, {
+      agentId: input.agent.agent_id,
+      agentCodeName: input.agent.code_name,
+      integration
+    });
   }
   const xeroIntegration = input.integrations?.find((i) => i.definition_id === "xero");
   if (xeroIntegration) {
@@ -4505,7 +5127,7 @@ function mapScheduledTasks(tasks) {
     };
   });
 }
-function buildUrlMcpServerEntry(url, headers) {
+function buildUrlMcpServerEntry(url, headers, type = "http") {
   const hasHeaders = !!headers && Object.keys(headers).length > 0;
   if (url.includes("composio.dev") && hasHeaders) {
     return { type: "http", url, headers };
@@ -4528,7 +5150,7 @@ function buildUrlMcpServerEntry(url, headers) {
     };
   }
   if (hasHeaders) {
-    return { type: "http", url, headers };
+    return { type, url, headers };
   }
   return { command: "npx", args: ["-y", "mcp-remote", url, "--allow-http"] };
 }
@@ -4609,6 +5231,18 @@ var claudeCodeAdapter = {
           integrations: integrationSummaries
         })
       },
+      // ENG-5905: project-scope augmented-worker sub-agent — sibling of
+      // channel-message-handler, same dynamic render shape, used by the
+      // parent for general multi-step background work that doesn't
+      // require a channel reply. Closes the gap ENG-5897 left open
+      // (the plugin-scope static file never reached the runtime).
+      {
+        relativePath: ".claude/agents/augmented-worker.md",
+        content: buildAugmentedWorkerAgent({
+          mcpServerKeys: initialMcpServerKeys,
+          integrations: integrationSummaries
+        })
+      },
       {
         relativePath: `provision/${INTEGRATIONS_SUMMARY_FILE}`,
         content: JSON.stringify(integrationSummaries, null, 2)
@@ -4726,7 +5360,7 @@ ${sections}`
     if (envLines.length > 1) {
       const envPath = join4(agentDir, ".env");
       writeFileSync5(envPath, envLines.join("\n") + "\n");
-      chmodSync4(envPath, SECRET_FILE_MODE);
+      chmodSync5(envPath, SECRET_FILE_MODE);
     }
   },
   // Claude Code has no gateway process — methods intentionally omitted
@@ -4750,6 +5384,14 @@ ${sections}`
   },
   writeChannelCredentials(codeName, channelId, config, options) {
     const tzEnv = options?.agentTimezone && options.agentTimezone.trim() !== "" ? { TZ: options.agentTimezone.trim() } : {};
+    const senderPolicyMode = options?.senderPolicy?.mode;
+    const senderPolicyTeamId = options?.senderPolicy?.mode === "team_agents_only" || options?.senderPolicy?.mode === "manager_only" || options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_id : void 0;
+    const slackPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.slack_user_id : void 0;
+    const teamsPrincipalId = options?.senderPolicy?.mode === "manager_only" ? options.senderPolicy.principal?.teams_aad_object_id : void 0;
+    const slackTeamPrincipalIds = options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_principals?.slack_user_ids?.join(",") : void 0;
+    const teamsTeamPrincipalIds = options?.senderPolicy?.mode === "team_only" ? options.senderPolicy.team_principals?.teams_aad_object_ids?.join(",") : void 0;
+    const senderPolicyInternalOnly = options?.senderPolicy?.internal_only === true;
+    const senderPolicyEnv = senderPolicyTeamId ? { AGT_TEAM_ID: senderPolicyTeamId } : {};
     const agentDir = getAgentDir(codeName);
     mkdirSync4(agentDir, { recursive: true });
     const isPersistent = options?.sessionMode === "persistent";
@@ -4762,17 +5404,28 @@ ${sections}`
       const localTelegramChannel = join4(getHomeDir3(), ".augmented", "_mcp", "telegram-channel.js");
       const resolvedAgtHostForTelegram = process.env["AGT_HOST"]?.trim() || "https://api.augmented.team";
       const resolvedAgtApiKeyForTelegram = process.env["AGT_API_KEY"]?.trim();
+      writeEnvIntegrationsForAgent(codeName, {
+        mode: "upsert",
+        updates: { TELEGRAM_BOT_TOKEN: botToken }
+      });
       const telegramEnv = {
-        TELEGRAM_BOT_TOKEN: botToken,
+        TELEGRAM_BOT_TOKEN: "${TELEGRAM_BOT_TOKEN}",
         AGT_AGENT_CODE_NAME: codeName,
         AGT_HOST: resolvedAgtHostForTelegram,
-        ...resolvedAgtApiKeyForTelegram ? { AGT_API_KEY: resolvedAgtApiKeyForTelegram } : {},
+        ...resolvedAgtApiKeyForTelegram ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
         ...options?.agentId ? { AGT_AGENT_ID: options.agentId } : {},
         ...tzEnv
       };
       if (allowedChats && allowedChats.length > 0) {
         telegramEnv.TELEGRAM_ALLOWED_CHATS = allowedChats.join(",");
       }
+      const rawDiagnosticChatIds = config["diagnostic_chat_ids"];
+      if (Array.isArray(rawDiagnosticChatIds)) {
+        const diagnosticChatIds = rawDiagnosticChatIds.map((v) => typeof v === "string" || typeof v === "number" ? String(v).trim() : "").filter((v) => v.length > 0);
+        if (diagnosticChatIds.length > 0) {
+          telegramEnv.TELEGRAM_DIAGNOSTIC_CHAT_IDS = diagnosticChatIds.join(",");
+        }
+      }
       const rawPeerAgentMode = config["peer_agent_mode"];
       if (rawPeerAgentMode === "listen" || rawPeerAgentMode === "respond") {
         telegramEnv.TELEGRAM_PEER_AGENT_MODE = rawPeerAgentMode;
@@ -4837,6 +5490,7 @@ ${sections}`
         const appToken = config["app_token"];
         const threadAutoFollow = config["thread_auto_follow"];
         const channelResponseMode = config["channel_response_mode"];
+        const allowedUsers = Array.isArray(config["allowed_users"]) ? config["allowed_users"].filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : [];
         const blockKitEnabled = config["block_kit_enabled"] === true;
         const blockKitAskUserEnabled = config["block_kit_ask_user_enabled"] === true;
         const blockKitDisabled = process.env["SLACK_BLOCK_KIT_DISABLED"] === "true";
@@ -4846,7 +5500,9 @@ ${sections}`
           ...blockKitAskUserEnabled ? { SLACK_BLOCK_KIT_ASK_USER_ENABLED: "true" } : {},
           ...blockKitDisabled ? { SLACK_BLOCK_KIT_DISABLED: "true" } : {},
           ...blockKitAskUserEnabled ? { AGT_HOST: resolvedAgtHost } : {},
-          ...blockKitAskUserEnabled && process.env["AGT_API_KEY"] ? { AGT_API_KEY: process.env["AGT_API_KEY"] } : {},
+          // ENG-5901 Track D: template (manager exports the real value
+          // to every spawn env); gate unchanged.
+          ...blockKitAskUserEnabled && process.env["AGT_API_KEY"] ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
           ...blockKitAskUserEnabled && options?.agentId ? { AGT_AGENT_ID: options.agentId } : {}
         } : {};
         if (botToken) {
@@ -4875,16 +5531,26 @@ ${sections}`
           const slackResolvedAgtApiKey = process.env["AGT_API_KEY"]?.trim();
           const slackAgtAuthEnv = {
             AGT_HOST: resolvedAgtHost,
-            ...slackResolvedAgtApiKey ? { AGT_API_KEY: slackResolvedAgtApiKey } : {},
+            // ENG-5901 Track D: template — manager exports AGT_API_KEY to
+            // every spawn env (getApiKey()); the gate still keys off the
+            // manager actually having one.
+            ...slackResolvedAgtApiKey ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
             ...options?.agentId ? { AGT_AGENT_ID: options.agentId } : {}
           };
+          writeEnvIntegrationsForAgent(codeName, {
+            mode: "upsert",
+            updates: {
+              SLACK_BOT_TOKEN: botToken,
+              ...appToken ? { SLACK_APP_TOKEN: appToken } : {}
+            }
+          });
           const localSlackChannel = join4(getHomeDir3(), ".augmented", "_mcp", "slack-channel.js");
           const slackEntry = {
             command: existsSync5(localSlackChannel) ? "node" : "npx",
             args: existsSync5(localSlackChannel) ? [localSlackChannel] : ["-y", "@augmented/claude-code-channel-slack"],
             env: {
-              SLACK_BOT_TOKEN: botToken,
-              ...appToken ? { SLACK_APP_TOKEN: appToken } : {},
+              SLACK_BOT_TOKEN: "${SLACK_BOT_TOKEN}",
+              ...appToken ? { SLACK_APP_TOKEN: "${SLACK_APP_TOKEN}" } : {},
               ...threadAutoFollow && threadAutoFollow !== "off" ? { SLACK_THREAD_AUTO_FOLLOW: threadAutoFollow } : {},
               // ENG-4464: only emit when non-default — `mention_only` is the
               // default in slack-response-mode.ts, so omitting keeps the env
@@ -4901,7 +5567,45 @@ ${sections}`
               // (ENG-4936) honours PEER_DISABLED with identical
               // semantics. Only emit when non-default so the env block
               // stays clean for the common case.
-              ...peerDisabledMode !== "off" ? { PEER_DISABLED: peerDisabledMode } : {}
+              ...peerDisabledMode !== "off" ? { PEER_DISABLED: peerDisabledMode } : {},
+              // ENG-5841: SLACK_SENDER_POLICY drives slack-inbound-filter.ts.
+              // Only emitted when the effective mode is restrictive (default
+              // 'all' is the absence of the env var — same convention the
+              // MCP filter uses on its own end).
+              ...senderPolicyMode ? { SLACK_SENDER_POLICY: senderPolicyMode } : {},
+              ...senderPolicyEnv,
+              // AGT_TEAM_ID when team_agents_only
+              // ENG-5842: principal ID for manager_only — Slack user_id from
+              // people.contact_preferences.slack_user_id. Omitted when the
+              // principal has no Slack ID; MCP filter fails closed on the
+              // missing env var by dropping all human inbound.
+              ...slackPrincipalId ? { SLACK_SENDER_POLICY_PRINCIPAL_ID: slackPrincipalId } : {},
+              // ENG-5871: team_only mode injects a comma-separated list of
+              // team-member Slack user_ids. Absent/empty = MCP filter drops
+              // humans on Slack but still admits same-team agents via label.
+              // No additional shape parsing on the MCP side — `.split(',')`
+              // works because Slack user_ids are `[A-Z0-9]+` (no commas).
+              ...slackTeamPrincipalIds ? { SLACK_SENDER_POLICY_TEAM_PRINCIPAL_IDS: slackTeamPrincipalIds } : {},
+              // ENG-5843: org-boundary gate. SLACK_INTERNAL_ONLY signals the
+              // filter to check sender's workspace against SLACK_HOME_TEAM_ID
+              // (sourced from the bot install's team_id, populated by
+              // auth.test at install / first-run). Omitted unless explicitly
+              // enabled — the consumer's env-absent default is "no gate".
+              // When INTERNAL_ONLY is true but home team_id can't be
+              // resolved (config['team_id'] not set on the install), the
+              // MCP boot guard fails closed at startup rather than admitting
+              // every sender as "internal".
+              ...senderPolicyInternalOnly ? { SLACK_INTERNAL_ONLY: "true" } : {},
+              ...senderPolicyInternalOnly && typeof config["team_id"] === "string" && config["team_id"].length > 0 ? { SLACK_HOME_TEAM_ID: config["team_id"] } : {},
+              // ENG-6035: per-agent diagnostic/restart allowlist. Gates
+              // /investigate-<code-name> (fail-closed: command disabled when
+              // unset) and /restart-<code-name> (open when unset). An explicit
+              // env entry here overrides any host-level systemd value, which
+              // is the point — the host-wide drop-in pattern wrongly scoped
+              // the allowlist to every agent on the host. Omitted when empty
+              // so the host fallback (and the fail-closed /investigate
+              // default) still apply to unconfigured agents.
+              ...allowedUsers.length > 0 ? { SLACK_ALLOWED_USERS: allowedUsers.join(",") } : {}
             }
           };
           const provisionMcpPath = join4(agentDir, "provision", ".mcp.json");
@@ -4957,6 +5661,8 @@ ${sections}`
       const slackAutoFollowEnv = slackThreadAutoFollow && slackThreadAutoFollow !== "off" ? { SLACK_THREAD_AUTO_FOLLOW: slackThreadAutoFollow } : {};
       const slackChannelResponseMode = config["channel_response_mode"];
       const slackResponseModeEnv = slackChannelResponseMode && slackChannelResponseMode !== "mention_only" ? { SLACK_CHANNEL_RESPONSE_MODE: slackChannelResponseMode } : {};
+      const slackAllowedUsersList = Array.isArray(config["allowed_users"]) ? config["allowed_users"].filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : [];
+      const slackAllowedUsersEnv = slackAllowedUsersList.length > 0 ? { SLACK_ALLOWED_USERS: slackAllowedUsersList.join(",") } : {};
       const oneshotBlockKitEnabled = config["block_kit_enabled"] === true;
       const oneshotBlockKitAskUserEnabled = config["block_kit_ask_user_enabled"] === true;
       const oneshotBlockKitDisabled = process.env["SLACK_BLOCK_KIT_DISABLED"] === "true";
@@ -4966,7 +5672,8 @@ ${sections}`
         ...oneshotBlockKitAskUserEnabled ? { SLACK_BLOCK_KIT_ASK_USER_ENABLED: "true" } : {},
         ...oneshotBlockKitDisabled ? { SLACK_BLOCK_KIT_DISABLED: "true" } : {},
         ...oneshotBlockKitAskUserEnabled ? { AGT_HOST: oneshotResolvedAgtHost } : {},
-        ...oneshotBlockKitAskUserEnabled && process.env["AGT_API_KEY"] ? { AGT_API_KEY: process.env["AGT_API_KEY"] } : {},
+        // ENG-5901 Track D: template; manager spawn env carries the value.
+        ...oneshotBlockKitAskUserEnabled && process.env["AGT_API_KEY"] ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
         ...oneshotBlockKitAskUserEnabled && options?.agentId ? { AGT_AGENT_ID: options.agentId } : {}
       } : {};
       const slackPeerEnv = {};
@@ -4999,18 +5706,27 @@ ${sections}`
       const slackAgtAuthEnv = {
         AGT_HOST: process.env["AGT_HOST"]?.trim() || "https://api.augmented.team",
         AGT_AGENT_CODE_NAME: codeName,
-        ...slackResolvedAgtApiKey ? { AGT_API_KEY: slackResolvedAgtApiKey } : {},
+        // ENG-5901 Track D: template; manager spawn env carries the value.
+        ...slackResolvedAgtApiKey ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
         ...options?.agentId ? { AGT_AGENT_ID: options.agentId } : {}
       };
+      writeEnvIntegrationsForAgent(codeName, {
+        mode: "upsert",
+        updates: {
+          SLACK_BOT_TOKEN: botToken,
+          ...appToken ? { SLACK_APP_TOKEN: appToken } : {}
+        }
+      });
       if (isPersistent && existsSync5(localSlackChannel)) {
         mcpServers["slack"] = {
           command: "node",
           args: [localSlackChannel],
           env: {
-            SLACK_BOT_TOKEN: botToken,
-            ...appToken ? { SLACK_APP_TOKEN: appToken } : {},
+            SLACK_BOT_TOKEN: "${SLACK_BOT_TOKEN}",
+            ...appToken ? { SLACK_APP_TOKEN: "${SLACK_APP_TOKEN}" } : {},
             ...slackAutoFollowEnv,
             ...slackResponseModeEnv,
+            ...slackAllowedUsersEnv,
             ...oneshotBlockKitEnv,
             ...slackPeerEnv,
             ...slackAgtAuthEnv,
@@ -5022,10 +5738,11 @@ ${sections}`
           command: "npx",
           args: ["-y", "@augmented/claude-code-channel-slack"],
           env: {
-            SLACK_BOT_TOKEN: botToken,
-            ...appToken ? { SLACK_APP_TOKEN: appToken } : {},
+            SLACK_BOT_TOKEN: "${SLACK_BOT_TOKEN}",
+            ...appToken ? { SLACK_APP_TOKEN: "${SLACK_APP_TOKEN}" } : {},
             ...slackAutoFollowEnv,
             ...slackResponseModeEnv,
+            ...slackAllowedUsersEnv,
             ...oneshotBlockKitEnv,
             ...slackPeerEnv,
             ...slackAgtAuthEnv,
@@ -5060,12 +5777,17 @@ ${sections}`
       const msteamsAgtAuthEnv = {
         AGT_HOST: process.env["AGT_HOST"]?.trim() || "https://api.augmented.team",
         AGT_AGENT_CODE_NAME: codeName,
-        ...msResolvedAgtApiKey ? { AGT_API_KEY: msResolvedAgtApiKey } : {},
+        // ENG-5901 Track D: template; manager spawn env carries the value.
+        ...msResolvedAgtApiKey ? { AGT_API_KEY: "${AGT_API_KEY}" } : {},
         ...options?.agentId ? { AGT_AGENT_ID: options.agentId } : {}
       };
+      writeEnvIntegrationsForAgent(codeName, {
+        mode: "upsert",
+        updates: { MSTEAMS_CLIENT_SECRET: clientSecret }
+      });
       const teamsEnv = {
         MSTEAMS_APP_ID: appId,
-        MSTEAMS_CLIENT_SECRET: clientSecret,
+        MSTEAMS_CLIENT_SECRET: "${MSTEAMS_CLIENT_SECRET}",
         MSTEAMS_TENANT_ID: tenantId,
         ...botObjectId ? { MSTEAMS_BOT_OBJECT_ID: botObjectId } : {},
         ...allowedTeamIds.length > 0 ? { MSTEAMS_ALLOWED_TEAMS: allowedTeamIds.join(",") } : {},
@@ -5077,7 +5799,28 @@ ${sections}`
         ...peerTeamIds.length > 0 ? { MSTEAMS_PEER_TEAM_IDS: peerTeamIds.join(",") } : {},
         ...knownPeerBotIds.length > 0 ? { MSTEAMS_KNOWN_PEER_BOT_IDS: knownPeerBotIds.join(",") } : {},
         ...msteamsAgtAuthEnv,
-        ...tzEnv
+        ...tzEnv,
+        // ENG-5841: MSTEAMS_SENDER_POLICY drives teams-inbound-filter.ts.
+        // Mirrors the Slack branch above — only emitted when restrictive.
+        ...senderPolicyMode ? { MSTEAMS_SENDER_POLICY: senderPolicyMode } : {},
+        ...senderPolicyEnv,
+        // AGT_TEAM_ID when team_agents_only
+        // ENG-5842: principal ID for manager_only — Teams AAD object id from
+        // people.contact_preferences.teams_aad_object_id. Same fail-closed
+        // contract as the Slack branch above.
+        ...teamsPrincipalId ? { MSTEAMS_SENDER_POLICY_PRINCIPAL_ID: teamsPrincipalId } : {},
+        // ENG-5871: team_only mode injects a comma-separated list of team-
+        // member Teams AAD object IDs. Same fail-closed contract as Slack.
+        // AAD IDs are UUIDs (no commas), so .split(',') is safe.
+        ...teamsTeamPrincipalIds ? { MSTEAMS_SENDER_POLICY_TEAM_PRINCIPAL_IDS: teamsTeamPrincipalIds } : {},
+        // ENG-5843: org-boundary gate. MSTEAMS_INTERNAL_ONLY + MSTEAMS_HOME_TENANT_ID
+        // mirror the Slack pair. Source is the same tenantId the existing
+        // MSTEAMS_TENANT_ID env var already carries — defaulting to "common"
+        // would be wrong here (it'd admit any tenant), so we skip the
+        // SLACK_HOME_TEAM_ID-equivalent emission when the install hasn't
+        // pinned a real tenant. MCP boot guard fails closed.
+        ...senderPolicyInternalOnly ? { MSTEAMS_INTERNAL_ONLY: "true" } : {},
+        ...senderPolicyInternalOnly && tenantId !== "common" ? { MSTEAMS_HOME_TENANT_ID: tenantId } : {}
       };
       if (isPersistent && existsSync5(localTeamsChannel)) {
         mcpServers["msteams"] = {
@@ -5131,6 +5874,12 @@ ${sections}`
     });
     return changed;
   },
+  // ENG-5901 PR 3: hoist pre-Track-D literal secrets out of the on-disk
+  // .mcp.json so the armed lint stops rejecting every incremental write.
+  // See migrateExistingLiteralSecrets for the full story.
+  migrateSecretStorage(codeName) {
+    migrateExistingLiteralSecrets(codeName);
+  },
   seedProfileConfig(codeName) {
     const agentDir = getAgentDir(codeName);
     const projectDir = getProjectDir(codeName);
@@ -5162,19 +5911,19 @@ ${sections}`
       ...integration,
       credentials: decryptIntegrationCredentials(integration.credentials)
     }));
-    const envLines = ["# Augmented integrations \u2014 auto-generated, do not edit"];
+    const envUpdates = {};
     for (const integration of decryptedIntegrations) {
       const prefix = integration.definition_id.toUpperCase().replace(/[^A-Z0-9]/g, "_");
       const creds = integration.credentials;
       if (integration.auth_type === "oauth2") {
         const accessToken = creds.access_token;
         if (accessToken) {
-          envLines.push(`${prefix}_ACCESS_TOKEN=${shellQuote(accessToken)}`);
+          envUpdates[`${prefix}_ACCESS_TOKEN`] = accessToken;
         }
       } else if (integration.auth_type === "api_key") {
         const apiKey = creds.api_key;
         if (apiKey) {
-          envLines.push(`${prefix}_API_KEY=${shellQuote(apiKey)}`);
+          envUpdates[`${prefix}_API_KEY`] = apiKey;
         }
       }
       if (integration.config) {
@@ -5183,20 +5932,37 @@ ${sections}`
           if (typeof value === "string" && value) {
             const upperKey = key.toUpperCase();
             const envKey = upperKey.startsWith(`${prefix}_`) ? upperKey : `${prefix}_${upperKey}`;
-            envLines.push(`${envKey}=${shellQuote(value)}`);
+            envUpdates[envKey] = value;
           }
         }
       }
     }
-    if (envLines.length > 1) {
-      const envPath = join4(agentDir, ".env.integrations");
-      writeFileSync5(envPath, envLines.join("\n") + "\n");
-      chmodSync4(envPath, SECRET_FILE_MODE);
+    for (const integration of decryptedIntegrations) {
+      const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
+      const defaults = def?.remoteMcp?.envDefaults;
+      if (!defaults)
+        continue;
+      for (const [key, value] of Object.entries(defaults)) {
+        if (key in envUpdates)
+          continue;
+        envUpdates[key] = value;
+      }
     }
+    writeEnvIntegrationsForAgent(codeName, {
+      mode: "replace-preserving",
+      updates: envUpdates
+    });
     writeXurlStoreForIntegrations(decryptedIntegrations);
-    const hasQmd = integrations.some((i) => i.definition_id === "qmd");
-    if (hasQmd) {
-      this.writeMcpServer(codeName, "qmd", { command: "qmd", args: ["mcp"] });
+    for (const integration of decryptedIntegrations) {
+      const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
+      if (!def?.nativeMcp)
+        continue;
+      const key = def.nativeMcp.key ?? integration.definition_id;
+      this.writeMcpServer(codeName, key, buildNativeMcpEntry(def.nativeMcp, {
+        agentId: agentId ?? "",
+        agentCodeName: codeName,
+        integration
+      }));
     }
     const xeroIntegration = integrations.find((i) => i.definition_id === "xero");
     if (xeroIntegration) {
@@ -5255,16 +6021,15 @@ ${sections}`
       }
     }
     if (this.removeMcpServer) {
+      const nativeMcpKeys = INTEGRATION_REGISTRY.filter((d) => d.nativeMcp !== void 0).map((d) => d.nativeMcp.key ?? d.id);
       const integrationDerivedKeys = /* @__PURE__ */ new Set([
-        "qmd",
         "xero",
         "postiz",
         "cloud-broker",
+        ...nativeMcpKeys,
         ...Object.entries(OAUTH_PROVIDERS).filter(([, provider]) => Boolean(provider.mcpUrl)).map(([id]) => id)
       ]);
       const expectedKeys = /* @__PURE__ */ new Set();
-      if (hasQmd)
-        expectedKeys.add("qmd");
       if (xeroIntegration)
         expectedKeys.add("xero");
       if (postizIntegration)
@@ -5272,6 +6037,10 @@ ${sections}`
       if (hasCloudBroker)
         expectedKeys.add("cloud-broker");
       for (const integration of integrations) {
+        const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
+        if (def?.nativeMcp) {
+          expectedKeys.add(def.nativeMcp.key ?? integration.definition_id);
+        }
         if (buildRemoteMcpEntry(integration.definition_id)) {
           expectedKeys.add(integration.definition_id);
         }
@@ -5303,12 +6072,18 @@ ${sections}`
       const envSrc = join4(agentDir2, ".env.integrations");
       try {
         const envContent = readFileSync5(envSrc, "utf-8");
-        writeFileSync5(join4(projectDir, ".env.integrations"), envContent);
+        const envDest = join4(projectDir, ".env.integrations");
+        writeFileSync5(envDest, envContent, { mode: SECRET_FILE_MODE });
+        try {
+          chmodSync5(envDest, SECRET_FILE_MODE);
+        } catch {
+        }
       } catch {
       }
     } catch {
     }
     renderChannelMessageHandlerForAgent(codeName);
+    renderAugmentedWorkerForAgent(codeName);
   },
   writeMcpServer(codeName, serverId, config) {
     const agentDir = getAgentDir(codeName);
@@ -5326,7 +6101,27 @@ ${sections}`
     const mcpServers = mcpConfig["mcpServers"];
     let serverEntry;
     if ("url" in config) {
-      serverEntry = buildUrlMcpServerEntry(config.url, config.headers);
+      serverEntry = buildUrlMcpServerEntry(config.url, config.headers, config.type);
+      const hoisted = {};
+      const entryHeaders = serverEntry.headers;
+      if (entryHeaders) {
+        const composioKey = entryHeaders["x-api-key"];
+        if (composioKey && !composioKey.includes("${")) {
+          hoisted["COMPOSIO_API_KEY"] = composioKey;
+          entryHeaders["x-api-key"] = "${COMPOSIO_API_KEY}";
+        }
+      }
+      const entryEnv = serverEntry.env;
+      if (entryEnv) {
+        const pdSecret = entryEnv["PIPEDREAM_CLIENT_SECRET"];
+        if (pdSecret && !pdSecret.includes("${")) {
+          hoisted["PIPEDREAM_CLIENT_SECRET"] = pdSecret;
+          entryEnv["PIPEDREAM_CLIENT_SECRET"] = "${PIPEDREAM_CLIENT_SECRET}";
+        }
+      }
+      if (Object.keys(hoisted).length > 0) {
+        writeEnvIntegrationsForAgent(codeName, { mode: "upsert", updates: hoisted });
+      }
     } else {
       serverEntry = { command: config.command };
       if (config.args?.length)
@@ -5379,14 +6174,14 @@ ${sections}`
         mkdirSync4(join4(filePath, ".."), { recursive: true });
         if (isPluginManaged && existsSync5(filePath)) {
           try {
-            chmodSync4(filePath, READ_WRITE_MODE);
+            chmodSync5(filePath, READ_WRITE_MODE);
           } catch {
           }
         }
         writeFileSync5(filePath, file.content);
         if (isPluginManaged) {
           try {
-            chmodSync4(filePath, READ_ONLY_MODE);
+            chmodSync5(filePath, READ_ONLY_MODE);
           } catch {
           }
         }
@@ -5567,7 +6362,7 @@ ${sections}`
       return;
     const tokenPath = join4(agentDir, ".tokens.json");
     writeFileSync5(tokenPath, JSON.stringify(tokens, null, 2));
-    chmodSync4(tokenPath, SECRET_FILE_MODE);
+    chmodSync5(tokenPath, SECRET_FILE_MODE);
   }
 };
 registerFramework(claudeCodeAdapter);
@@ -5933,12 +6728,15 @@ function setActiveTeam(slug) {
   config.active_team = slug;
   saveConfig(config);
 }
-var DEFAULT_AGT_HOST = "https://api.augmented.team";
+var PROD_AGT_HOST = "https://api.augmented.team";
+var AGT_HOST_UNSET_MESSAGE = "AGT_HOST is not set. Set it to the API URL for your stage before running this command:\n  Production:        export AGT_HOST=https://api.augmented.team\n  Non-prod stage:    export AGT_HOST=https://<stage>.api.staging.augmented.team\n  Local development: export AGT_HOST=http://api.agt.localhost:1355\n\nFor first-time host setup, pass --api-host <url> to `agt setup` instead \u2014 the setup command does NOT silently default to prod (ENG-5831).";
 function getHost() {
   const envHost = process.env["AGT_HOST"]?.trim();
-  return envHost ? envHost : DEFAULT_AGT_HOST;
+  if (!envHost) {
+    throw new Error(AGT_HOST_UNSET_MESSAGE);
+  }
+  return envHost;
 }
-var AGT_HOST = getHost();
 function requireHost() {
   return getHost();
 }
@@ -6142,7 +6940,7 @@ import { homedir as homedir6, userInfo } from "os";
 import { spawn as spawn3 } from "child_process";
 
 // src/lib/watchdog.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4, existsSync as existsSync7, mkdirSync as mkdirSync6, openSync, closeSync, chmodSync as chmodSync5 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4, existsSync as existsSync7, mkdirSync as mkdirSync6, openSync, closeSync, chmodSync as chmodSync6 } from "fs";
 import { join as join7 } from "path";
 import { spawn as spawn2, execFileSync } from "child_process";
 var DEFAULT_CONFIG_DIR = join7(process.env["HOME"] ?? "/tmp", ".augmented");
@@ -6236,7 +7034,7 @@ function startWatchdog(opts) {
     const { logFile } = getManagerPaths(configDir);
     const logFd = openSync(logFile, "a", 384);
     try {
-      chmodSync5(logFile, 384);
+      chmodSync6(logFile, 384);
     } catch {
     }
     const intervalSec = String(Math.max(Math.floor(opts.intervalMs / 1e3), 5));
@@ -6749,9 +7547,12 @@ async function managerUninstallSystemUnitCommand() {
 export {
   getIntegration,
   extractCommandNotFound,
+  LITERAL_SECRET_PATTERNS,
+  safeWriteJsonAtomic,
   INTEGRATIONS_SECTION_START,
   INTEGRATIONS_SECTION_END,
   estimateActiveTasksTokens,
+  CHANNEL_SECRET_ENV_KEYS,
   provisionStopHook,
   provisionIsolationHook,
   provisionOrientHook,
@@ -6761,7 +7562,7 @@ export {
   getApiKey,
   getActiveTeam,
   setActiveTeam,
-  DEFAULT_AGT_HOST,
+  PROD_AGT_HOST,
   getHost,
   requireHost,
   exchangeApiKey,
@@ -6785,4 +7586,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-IB655E5U.js.map
+//# sourceMappingURL=chunk-N2EBL4PZ.js.map