@integrity-labs/agt-cli 0.27.8 → 0.27.9-test.12

package/dist/lib/manager-worker.js

@@ -1,5 +1,6 @@
 import {
   ApiError,
+  CHANNEL_SECRET_ENV_KEYS,
   INTEGRATIONS_SECTION_END,
   INTEGRATIONS_SECTION_START,
   SUPERVISOR_RESTART_EXIT_CODE,
@@ -14,8 +15,9 @@ import {
   provisionIsolationHook,
   provisionOrientHook,
   provisionStopHook,
-  requireHost
-} from "../chunk-IB655E5U.js";
+  requireHost,
+  safeWriteJsonAtomic
+} from "../chunk-SXBZDUKN.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -25,6 +27,9 @@ import {
 } from "../chunk-HR5T2RQF.js";
 import {
   buildAllowedTools,
+  checkChannelInputs,
+  creditWatchdogGiveUpCount,
+  formatMissingVar,
   getLastFailureContext,
   getProjectDir,
   getSessionState,
@@ -34,8 +39,11 @@ import {
   isAgentPromptReady,
   isSessionHealthy,
   isStaleForToday,
+  paneLogPath,
+  parseEnvIntegrations,
   peekCurrentSession,
   prepareForRespawn,
+  probeMcpEnvSubstitution,
   readPaneLogTail,
   resetRestartCount,
   resolveClaudeBinary,
@@ -45,10 +53,12 @@ import {
   startPersistentSession,
   stopAllSessionsAndWait,
   stopPersistentSession,
+  takeWatchdogGiveUpCount,
   takeZombieDetection
-} from "../chunk-GN4XPQWJ.js";
+} from "../chunk-MQJ5DMPT.js";
 import {
   KANBAN_CHECK_COMMAND,
+  SUPPRESS_SENTINEL,
   appendDmFooter,
   attributeTranscriptUsageByRun,
   classifyActor,
@@ -69,7 +79,7 @@ import {
   resolveConnectivityProbe,
   resolveDmTarget,
   wrapScheduledTaskPrompt
-} from "../chunk-YSBGIXJG.js";
+} from "../chunk-I2OTQJH3.js";
 import {
   parsePsRows,
   reapOrphanChannelMcps
@@ -77,10 +87,10 @@ import {
 
 // src/lib/manager-worker.ts
 import { createHash as createHash3 } from "crypto";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, appendFileSync, mkdirSync as mkdirSync2, chmodSync, existsSync as existsSync4, rmSync as rmSync2, readdirSync as readdirSync3, statSync as statSync2, unlinkSync, copyFileSync } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, appendFileSync, mkdirSync as mkdirSync4, chmodSync, existsSync as existsSync5, rmSync as rmSync2, readdirSync as readdirSync4, statSync as statSync3, unlinkSync, copyFileSync } from "fs";
 import https from "https";
 import { execFileSync as syncExecFile } from "child_process";
-import { join as join6, dirname } from "path";
+import { join as join8, dirname as dirname3 } from "path";
 import { homedir as homedir4 } from "os";
 import { fileURLToPath } from "url";
 
@@ -106,6 +116,12 @@ function managedMcpStructureHash(entries) {
   const basis = entries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => `${e.serverId}|${Object.keys(e.headers ?? {}).sort().join(",")}`).join("\n");
   return createHash("sha256").update(basis).digest("hex").slice(0, 16);
 }
+function channelSecretValueHash(envEntries, channelSecretKeys) {
+  if (!envEntries) return null;
+  const basis = channelSecretKeys.slice().sort().filter((k) => Object.prototype.hasOwnProperty.call(envEntries, k)).map((k) => `${k}=${envEntries[k]}`).join("\n");
+  if (basis.length === 0) return null;
+  return createHash("sha256").update(basis).digest("hex").slice(0, 16);
+}
 
 // src/lib/integration-hash.ts
 import { createHash as createHash2 } from "crypto";
@@ -412,7 +428,13 @@ function reapMissingMcpSessions(args) {
     graceMs = DEFAULT_COLD_START_GRACE_MS,
     rotationGraceMs = DEFAULT_ROTATION_GRACE_MS,
     onGiveUp,
-    onRestart
+    onRestart,
+    // ENG-5932: defaults make quarantine a strict no-op (classify everything
+    // essential, mode off) so legacy callers/tests are unaffected.
+    classifyKey = () => "essential",
+    quarantineDwellMs = 0,
+    quarantineMode = "off",
+    onQuarantine
   } = args;
   const now = args.now ?? Date.now;
   const runPs = args.runPs ?? (() => execFileSync2("ps", ["-eo", "pid,ppid,args"], { encoding: "utf-8", timeout: 5e3 }));
@@ -460,12 +482,14 @@ function reapMissingMcpSessions(args) {
     if (!missingRaw.includes(key)) liveKeys.add(key);
   }
   for (const key of liveKeys) {
-    const state5 = presenceReaperState.get(stateKey(codeName, key));
-    if (state5) {
-      state5.attempts = 0;
-      state5.lastSeenLiveAt = now();
-      state5.lastAttemptedSessionStartedAt = null;
-      state5.gaveUpLogged = false;
+    const state6 = presenceReaperState.get(stateKey(codeName, key));
+    if (state6) {
+      state6.attempts = 0;
+      state6.lastSeenLiveAt = now();
+      state6.lastAttemptedSessionStartedAt = null;
+      state6.gaveUpLogged = false;
+      state6.firstMissingAt = null;
+      state6.quarantineLogged = false;
     }
   }
   if (missing.length === 0) {
@@ -476,28 +500,34 @@ function reapMissingMcpSessions(args) {
       rotationGraced: rotationGraced.length > 0 ? rotationGraced : void 0
     };
   }
+  const nowMs = now();
   const givenUp = [];
   const active = [];
+  const quarantined = [];
+  const wouldQuarantine = [];
   for (const key of missing) {
     const sk = stateKey(codeName, key);
-    const state5 = presenceReaperState.get(sk) ?? {
+    const state6 = presenceReaperState.get(sk) ?? {
       attempts: 0,
       lastSeenLiveAt: null,
       lastAttemptedSessionStartedAt: null,
-      gaveUpLogged: false
+      gaveUpLogged: false,
+      firstMissingAt: null,
+      quarantineLogged: false
     };
-    if (state5.lastAttemptedSessionStartedAt !== sessionStartedAt) {
-      state5.attempts += 1;
-      state5.lastAttemptedSessionStartedAt = sessionStartedAt;
+    if (state6.firstMissingAt === null) state6.firstMissingAt = nowMs;
+    if (state6.lastAttemptedSessionStartedAt !== sessionStartedAt) {
+      state6.attempts += 1;
+      state6.lastAttemptedSessionStartedAt = sessionStartedAt;
     }
-    presenceReaperState.set(sk, state5);
-    if (state5.attempts > MAX_PRESENCE_RESTART_ATTEMPTS) {
+    presenceReaperState.set(sk, state6);
+    if (state6.attempts > MAX_PRESENCE_RESTART_ATTEMPTS) {
       givenUp.push(key);
-      if (!state5.gaveUpLogged) {
+      if (!state6.gaveUpLogged) {
         log2(
           `[mcp-presence-reaper] giving up on '${codeName}:${key}' after ${MAX_PRESENCE_RESTART_ATTEMPTS} consecutive failed restarts \u2014 declared but never recovers (likely orphaned config; see ENG-5279)`
         );
-        state5.gaveUpLogged = true;
+        state6.gaveUpLogged = true;
         if (onGiveUp) {
           try {
             onGiveUp(codeName, key);
@@ -508,6 +538,32 @@ function reapMissingMcpSessions(args) {
           }
         }
       }
+      if (quarantineMode !== "off" && !state6.quarantineLogged && classifyKey(key) === "optional") {
+        const dwellElapsed = quarantineDwellMs <= 0 || state6.firstMissingAt !== null && nowMs - state6.firstMissingAt >= quarantineDwellMs;
+        if (dwellElapsed) {
+          state6.quarantineLogged = true;
+          if (quarantineMode === "enforce") {
+            quarantined.push(key);
+            log2(
+              `[mcp-presence-reaper] QUARANTINE '${codeName}:${key}' \u2014 optional channel dead past restart budget + ${quarantineDwellMs}ms dwell; dropping from provisioned set so the dead channel stops restarting the whole session (ENG-5932)`
+            );
+            if (onQuarantine) {
+              try {
+                onQuarantine(codeName, key);
+              } catch (err) {
+                log2(
+                  `[mcp-presence-reaper] onQuarantine callback threw for '${codeName}:${key}' (suppressed; reaper continues): ${err.message}`
+                );
+              }
+            }
+          } else {
+            wouldQuarantine.push(key);
+            log2(
+              `[mcp-presence-reaper] SHADOW would-quarantine '${codeName}:${key}' \u2014 optional channel dead past restart budget + ${quarantineDwellMs}ms dwell; no action taken (ENG-5932 shadow mode)`
+            );
+          }
+        }
+      }
     } else {
       active.push(key);
     }
@@ -518,7 +574,9 @@ function reapMissingMcpSessions(args) {
       restarted: false,
       reason: "all-keys-over-cap",
       givenUp,
-      rotationGraced: rotationGraced.length > 0 ? rotationGraced : void 0
+      rotationGraced: rotationGraced.length > 0 ? rotationGraced : void 0,
+      quarantined: quarantined.length > 0 ? quarantined : void 0,
+      wouldQuarantine: wouldQuarantine.length > 0 ? wouldQuarantine : void 0
     };
   }
   const givenUpSuffix = givenUp.length > 0 ? ` (skipping over-cap: [${givenUp.join(", ")}])` : "";
@@ -546,7 +604,9 @@ function reapMissingMcpSessions(args) {
     missing,
     restarted: true,
     givenUp: givenUp.length > 0 ? givenUp : void 0,
-    rotationGraced: rotationGraced.length > 0 ? rotationGraced : void 0
+    rotationGraced: rotationGraced.length > 0 ? rotationGraced : void 0,
+    quarantined: quarantined.length > 0 ? quarantined : void 0,
+    wouldQuarantine: wouldQuarantine.length > 0 ? wouldQuarantine : void 0
   };
 }
 
@@ -578,6 +638,228 @@ function decideChannelRestart(input) {
   return { restart: true, added, removed };
 }
 
+// src/lib/channel-launch-flags.ts
+var DEV_CHANNEL_SERVER_IDS = ["slack", "telegram", "msteams"];
+function resolveChannelLaunchFlags(channelConfigs, quarantinedChannels) {
+  const devChannels = [];
+  const pluginChannels = [];
+  if (!channelConfigs) return { devChannels, pluginChannels };
+  const isChannelEnabled = (id) => {
+    if (quarantinedChannels.has(id)) return false;
+    const entry = channelConfigs[id];
+    return !!entry?.config && (entry.status === "active" || entry.status === "pending");
+  };
+  for (const id of DEV_CHANNEL_SERVER_IDS) {
+    if (isChannelEnabled(id)) devChannels.push(`server:${id}`);
+  }
+  if (isChannelEnabled("discord")) {
+    pluginChannels.push("plugin:discord@claude-plugins-official");
+  }
+  return { devChannels, pluginChannels };
+}
+
+// src/lib/sender-policy-restart-decision.ts
+function decideSenderPolicyRestart(input) {
+  const {
+    previousHash,
+    currentHash,
+    sessionMode,
+    framework,
+    sessionHealthy,
+    channelSetRestartAlreadyScheduled
+  } = input;
+  if (previousHash === void 0) {
+    return { restart: false, firstPoll: true, changed: false };
+  }
+  if (previousHash === currentHash) {
+    return { restart: false, firstPoll: false, changed: false };
+  }
+  if (sessionMode !== "persistent") {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  if (framework !== "claude-code") {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  if (!sessionHealthy) {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  if (channelSetRestartAlreadyScheduled) {
+    return { restart: false, firstPoll: false, changed: true };
+  }
+  return { restart: true, firstPoll: false, changed: true };
+}
+
+// src/lib/msteams-behaviour-restart.ts
+function extractMsTeamsBehaviourSubset(config2) {
+  const adaptiveCardsEnabled = config2?.["adaptive_cards_enabled"] === true;
+  return {
+    thread_auto_follow: config2?.["thread_auto_follow"] ?? "off",
+    channel_response_mode: config2?.["channel_response_mode"] ?? "mention_only",
+    adaptive_cards_enabled: adaptiveCardsEnabled,
+    // The adapter only emits MSTEAMS_ADAPTIVE_CARDS_ASK_USER_ENABLED when the
+    // parent flag is also on — mirror that so toggling ask_user while
+    // Adaptive Cards is off (a no-op for the env) doesn't restart.
+    adaptive_cards_ask_user_enabled: adaptiveCardsEnabled && config2?.["adaptive_cards_ask_user_enabled"] === true
+  };
+}
+
+// src/lib/slack-behaviour-restart.ts
+function extractSlackBehaviourSubset(config2) {
+  const rawAllowed = config2?.["allowed_users"];
+  return {
+    thread_auto_follow: config2?.["thread_auto_follow"] ?? "off",
+    channel_response_mode: config2?.["channel_response_mode"] ?? "mention_only",
+    // Mirror the adapter's defensive filter exactly — a malformed entry the
+    // adapter would drop must not count as an env change.
+    allowed_users: Array.isArray(rawAllowed) ? rawAllowed.filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()) : []
+  };
+}
+
+// src/lib/channel-quarantine.ts
+import { readFileSync } from "fs";
+import { join } from "path";
+
+// src/lib/atomic-write.ts
+import { closeSync, fsyncSync, openSync, writeSync, renameSync, mkdirSync } from "fs";
+import { dirname } from "path";
+function atomicWriteFileSync(path, data) {
+  const dirPath = dirname(path);
+  const tmpPath = `${path}.tmp.${process.pid}.${Math.random().toString(36).slice(2, 8)}`;
+  try {
+    mkdirSync(dirPath, { recursive: true });
+  } catch {
+  }
+  const fd = openSync(tmpPath, "w", 420);
+  try {
+    writeSync(fd, data);
+    try {
+      fsyncSync(fd);
+    } catch {
+    }
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(tmpPath, path);
+  try {
+    const dirFd = openSync(dirPath, "r");
+    try {
+      fsyncSync(dirFd);
+    } finally {
+      closeSync(dirFd);
+    }
+  } catch {
+  }
+}
+
+// src/lib/channel-quarantine.ts
+var ESSENTIAL_CHANNEL_KEYS = /* @__PURE__ */ new Set(["direct-chat", "augmented"]);
+var OPTIONAL_CHANNEL_KEYS = /* @__PURE__ */ new Set([
+  "telegram",
+  "slack",
+  "msteams",
+  "discord",
+  "whatsapp",
+  "signal",
+  "imessage",
+  "matrix",
+  "irc",
+  "nostr"
+]);
+function readDeclaredCriticality(entry) {
+  if (!entry || typeof entry !== "object") return void 0;
+  const meta = entry._augmented;
+  if (!meta || typeof meta !== "object") return void 0;
+  const value = meta.criticality;
+  return value === "essential" || value === "optional" ? value : void 0;
+}
+function classifyChannelCriticality(serverKey, entry) {
+  if (ESSENTIAL_CHANNEL_KEYS.has(serverKey)) return "essential";
+  const declared = readDeclaredCriticality(entry);
+  if (declared) return declared;
+  if (OPTIONAL_CHANNEL_KEYS.has(serverKey)) return "optional";
+  return "essential";
+}
+function defaultQuarantinePath(configDir) {
+  return join(configDir, "channel-quarantine.json");
+}
+var ChannelQuarantineStore = class {
+  path;
+  cache = null;
+  constructor(path) {
+    this.path = path;
+  }
+  load() {
+    if (this.cache) return this.cache;
+    try {
+      const raw = readFileSync(this.path, "utf-8");
+      const parsed = JSON.parse(raw);
+      this.cache = isQuarantineFile(parsed) ? parsed : {};
+    } catch {
+      this.cache = {};
+    }
+    return this.cache;
+  }
+  persist() {
+    atomicWriteFileSync(this.path, JSON.stringify(this.cache ?? {}, null, 2));
+  }
+  /** Is `serverKey` currently quarantined for `codeName`? */
+  isQuarantined(codeName, serverKey) {
+    return this.load()[codeName]?.[serverKey] !== void 0;
+  }
+  /** The set of quarantined server keys for `codeName` (empty Set if none). */
+  getQuarantinedKeys(codeName) {
+    const forAgent = this.load()[codeName];
+    return new Set(forAgent ? Object.keys(forAgent) : []);
+  }
+  /**
+   * Mark `serverKey` quarantined for `codeName`. Idempotent — re-quarantining
+   * an already-quarantined key preserves the original `quarantinedAt` (so the
+   * "how long has this been quarantined" escalation clock in Slice 3 isn't
+   * reset by provisioning churn). Returns true iff this call newly quarantined
+   * the key (false if it was already quarantined).
+   */
+  quarantine(codeName, serverKey, reason, now) {
+    const file = this.load();
+    const forAgent = file[codeName] ??= {};
+    if (forAgent[serverKey]) return false;
+    forAgent[serverKey] = { quarantinedAt: now, reason };
+    this.persist();
+    return true;
+  }
+  /**
+   * Clear the quarantine for `serverKey` (explicit re-enable). Returns true iff
+   * a marker was actually removed. NOTE: re-enable is an EXPLICIT verb (Slice 2
+   * exposes it via the API/console) — provisioning's idempotent `.mcp.json`
+   * rewrites must NEVER call this, or a quarantined channel would re-arm into a
+   * fresh flap laundered through the config loop.
+   */
+  clearQuarantine(codeName, serverKey) {
+    const file = this.load();
+    const forAgent = file[codeName];
+    if (!forAgent || !forAgent[serverKey]) return false;
+    delete forAgent[serverKey];
+    if (Object.keys(forAgent).length === 0) delete file[codeName];
+    this.persist();
+    return true;
+  }
+  /** Test seam: drop the in-memory cache so the next read re-hits disk. */
+  __invalidateCacheForTests() {
+    this.cache = null;
+  }
+};
+function isQuarantineFile(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  for (const forAgent of Object.values(value)) {
+    if (!forAgent || typeof forAgent !== "object" || Array.isArray(forAgent)) return false;
+    for (const entry of Object.values(forAgent)) {
+      if (!entry || typeof entry !== "object") return false;
+      const e = entry;
+      if (typeof e.quarantinedAt !== "number" || typeof e.reason !== "string") return false;
+    }
+  }
+  return true;
+}
+
 // src/lib/restart-breaker.ts
 function reaperRestartBreakerReason(activeKeys) {
   return activeKeys.length >= 2 ? "mcp-presence-reaper" : void 0;
@@ -910,6 +1192,300 @@ function runCliProbe(binary, args, opts = {}) {
   });
 }
 
+// src/lib/self-update-coalesce.ts
+import { readFileSync as readFileSync2, writeFileSync, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname2 } from "path";
+var DEFAULT_SELF_UPDATE_COALESCE_MS = 30 * 60 * 1e3;
+function resolveCoalesceWindowMs(env = process.env) {
+  const raw = env.AGT_SELF_UPDATE_COALESCE_MS;
+  if (raw == null || raw === "") return DEFAULT_SELF_UPDATE_COALESCE_MS;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed < 0) return DEFAULT_SELF_UPDATE_COALESCE_MS;
+  return Math.trunc(parsed);
+}
+function readLastSelfUpdateAppliedMs(markerPath, now = Date.now(), read = (p) => readFileSync2(p, "utf-8")) {
+  let raw;
+  try {
+    raw = read(markerPath);
+  } catch {
+    return null;
+  }
+  const v = parseInt(raw.trim(), 10);
+  if (!Number.isFinite(v) || v <= 0) return null;
+  if (v > now) return null;
+  return v;
+}
+function stampLastSelfUpdateApplied(markerPath, now = Date.now(), write = (p, v) => {
+  mkdirSync2(dirname2(p), { recursive: true });
+  writeFileSync(p, v);
+}) {
+  try {
+    write(markerPath, String(now));
+  } catch {
+  }
+}
+function decideSelfUpdateCoalesce(inputs) {
+  const { windowMs, lastAppliedMs, now } = inputs;
+  if (windowMs <= 0) return { proceed: true, remainingMs: 0, lastAppliedMs: null };
+  if (lastAppliedMs == null) return { proceed: true, remainingMs: 0, lastAppliedMs: null };
+  const elapsed = now - lastAppliedMs;
+  if (elapsed < 0) return { proceed: true, remainingMs: 0, lastAppliedMs: null };
+  if (elapsed >= windowMs) return { proceed: true, remainingMs: 0, lastAppliedMs: null };
+  return { proceed: false, remainingMs: windowMs - elapsed, lastAppliedMs };
+}
+function formatCoalesceDeferLogLine(opts) {
+  const remainingSec = Math.ceil(opts.remainingMs / 1e3);
+  const windowMin = Math.round(opts.windowMs / 6e4);
+  return `[self-update] coalescing \u2014 ${opts.installed} \u2192 ${opts.latest} (${opts.channelLabel}) available, deferring for ${remainingSec}s (last restart inside ${windowMin}min window). See ENG-5862. Override with AGT_SELF_UPDATE_COALESCE_MS=0 during incident response.`;
+}
+
+// src/lib/maintenance-window.ts
+var DEFAULT_WINDOW_START = "01:00";
+var DEFAULT_WINDOW_END = "02:00";
+function isMaintenanceWindowDisabled(env = process.env) {
+  return env["AGT_MAINTENANCE_WINDOW_DISABLE"] === "1";
+}
+var HHMM_RE = /^([01]\d|2[0-3]):([0-5]\d)$/;
+function normalizeHhmm(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return HHMM_RE.test(trimmed) ? trimmed : null;
+}
+function resolveWindow(input) {
+  const tzRaw = typeof input.timezone === "string" ? input.timezone.trim() : "";
+  return {
+    start: normalizeHhmm(input.start) ?? DEFAULT_WINDOW_START,
+    end: normalizeHhmm(input.end) ?? DEFAULT_WINDOW_END,
+    // Blank/whitespace → UTC. An explicit 'UTC' is also UTC. (Unlike
+    // getTeamTimezone we keep 'UTC' here because this is the *evaluation* tz,
+    // not an inherit-or-not decision.)
+    timezone: tzRaw.length > 0 ? tzRaw : "UTC"
+  };
+}
+function hhmmToMinutes(hhmm) {
+  const [h, m] = hhmm.split(":");
+  return Number(h) * 60 + Number(m);
+}
+function localHhmm(now, timezone) {
+  try {
+    const parts = new Intl.DateTimeFormat("en-GB", {
+      timeZone: timezone,
+      hour: "2-digit",
+      minute: "2-digit",
+      hour12: false
+    }).formatToParts(now);
+    const hh = parts.find((p) => p.type === "hour")?.value ?? "00";
+    const mm = parts.find((p) => p.type === "minute")?.value ?? "00";
+    const h = hh === "24" ? "00" : hh;
+    return `${h}:${mm}`;
+  } catch {
+    const h = String(now.getUTCHours()).padStart(2, "0");
+    const m = String(now.getUTCMinutes()).padStart(2, "0");
+    return `${h}:${m}`;
+  }
+}
+function isWithinMaintenanceWindow(input, now) {
+  const w = resolveWindow(input);
+  const start = hhmmToMinutes(w.start);
+  const end = hhmmToMinutes(w.end);
+  if (start === end) return false;
+  const cur = hhmmToMinutes(localHhmm(now, w.timezone));
+  if (start < end) return cur >= start && cur < end;
+  return cur >= start || cur < end;
+}
+function minutesUntilWindowOpen(input, now) {
+  if (isWithinMaintenanceWindow(input, now)) return 0;
+  const w = resolveWindow(input);
+  const start = hhmmToMinutes(w.start);
+  const cur = hhmmToMinutes(localHhmm(now, w.timezone));
+  return cur <= start ? start - cur : 1440 - cur + start;
+}
+function formatWindowDeferLogLine(input, now) {
+  const w = resolveWindow(input);
+  const mins = minutesUntilWindowOpen(input, now);
+  return `next maintenance window ${w.start} ${w.timezone} (~${mins} min)`;
+}
+
+// src/lib/update-window-gate.ts
+function decideMaintenanceWindowGate(opts) {
+  if (isMaintenanceWindowDisabled(opts.env)) return "proceed";
+  if (!opts.window) return "proceed";
+  return isWithinMaintenanceWindow(opts.window, opts.now) ? "proceed" : "defer";
+}
+function isUrgentUpgrade(opts) {
+  if (!opts.urgentTarget) return false;
+  if (opts.installed === "dev") return false;
+  return opts.isNewer(opts.installed, opts.urgentTarget);
+}
+var RESTART_IDLE_THRESHOLD_SECONDS = 120;
+var RESTART_INBOUND_QUIET_SECONDS = 300;
+var GATEABLE_RESTART_REASONS = /* @__PURE__ */ new Set([
+  "model-change",
+  "channel-set-change",
+  "sender-policy-change",
+  "channel-behaviour-change",
+  "hot-reload-mcp",
+  "mcp-presence-reaper"
+]);
+function isGateableRestartReason(reason) {
+  return reason != null && GATEABLE_RESTART_REASONS.has(reason);
+}
+function decideRestartGate(opts) {
+  if (isMaintenanceWindowDisabled(opts.env)) return "proceed";
+  if (opts.window && !isWithinMaintenanceWindow(opts.window, opts.now)) {
+    return "defer-window";
+  }
+  const paneThreshold = opts.idleThresholdSeconds ?? RESTART_IDLE_THRESHOLD_SECONDS;
+  const inboundThreshold = opts.inboundQuietSeconds ?? RESTART_INBOUND_QUIET_SECONDS;
+  const paneBusy = opts.paneLogAgeSeconds !== null && opts.paneLogAgeSeconds < paneThreshold;
+  const inboundBusy = opts.inboundAgeSeconds !== null && opts.inboundAgeSeconds < inboundThreshold;
+  if (paneBusy || inboundBusy) return "defer-idle";
+  return "proceed";
+}
+
+// src/lib/claude-pid-tracker.ts
+import { existsSync, readFileSync as readFileSync3 } from "fs";
+function readPidFile(path) {
+  if (!existsSync(path)) return { version: 1, spawns: [] };
+  try {
+    const raw = JSON.parse(readFileSync3(path, "utf-8"));
+    if (raw.version !== 1 || !Array.isArray(raw.spawns)) return { version: 1, spawns: [] };
+    const spawns = raw.spawns.filter(
+      (s) => !!s && typeof s.pid === "number" && Number.isFinite(s.pid) && s.pid > 0
+    );
+    return { version: 1, spawns };
+  } catch {
+    return { version: 1, spawns: [] };
+  }
+}
+function writePidFile(path, file) {
+  atomicWriteFileSync(path, JSON.stringify(file, null, 2));
+}
+function addSpawn(path, record) {
+  const file = readPidFile(path);
+  const filtered = file.spawns.filter((s) => s.pid !== record.pid);
+  writePidFile(path, { version: 1, spawns: [...filtered, record] });
+}
+function removeSpawn(path, pid) {
+  const file = readPidFile(path);
+  const next = file.spawns.filter((s) => s.pid !== pid);
+  if (next.length !== file.spawns.length) writePidFile(path, { version: 1, spawns: next });
+}
+function decideReaperActions(file, isAlive, looksLikeClaude = () => true) {
+  const toKill = [];
+  const alreadyDead = [];
+  const pidReusedSkipped = [];
+  for (const s of file.spawns) {
+    if (!isAlive(s.pid)) {
+      alreadyDead.push(s);
+      continue;
+    }
+    if (!looksLikeClaude(s.pid)) {
+      pidReusedSkipped.push(s);
+      continue;
+    }
+    toKill.push(s);
+  }
+  const toResetKanban = toKill.filter(
+    (s) => s.kind === "kanban-work" && typeof s.kanban_card_id === "string" && s.kanban_card_id.length > 0
+  );
+  return { toKill, alreadyDead, pidReusedSkipped, toResetKanban };
+}
+function formatDrainShutdownLine(opts) {
+  const killed = opts.killedPids && opts.killedPids.length > 0 ? ` killed_pids=${opts.killedPids.join(",")}` : "";
+  const note = opts.note ? ` note="${opts.note.replace(/"/g, '\\"')}"` : "";
+  return `[drain] step=${opts.step} elapsed_ms=${opts.elapsedMs}${killed}${note}`;
+}
+function formatReaperBootLine(opts) {
+  return `[drain] step=boot-reaper total=${opts.totalRecorded} killed=${opts.killed} already_dead=${opts.alreadyDead} pid_reused_skipped=${opts.pidReusedSkipped} kanban_reset=${opts.kanbanReset}`;
+}
+
+// src/lib/direct-chat-spawn-gate.ts
+var DEFAULT_DIRECT_CHAT_HOST_CONCURRENCY = 2;
+var DEFAULT_DIRECT_CHAT_PER_AGENT_CONCURRENCY = 1;
+var DEFAULT_DIRECT_CHAT_MAX_AGE_MS = 30 * 6e4;
+function directChatHostConcurrency() {
+  const raw = parseInt(process.env["AGT_DIRECT_CHAT_MAX_CONCURRENCY"] ?? "", 10);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_DIRECT_CHAT_HOST_CONCURRENCY;
+}
+function directChatMaxAgeMs() {
+  const raw = parseInt(process.env["AGT_DIRECT_CHAT_MAX_AGE_MS"] ?? "", 10);
+  return Number.isFinite(raw) && raw >= 0 ? raw : DEFAULT_DIRECT_CHAT_MAX_AGE_MS;
+}
+function isDirectChatMessageExpired(createdAt, nowMs, maxAgeMs) {
+  if (!maxAgeMs || maxAgeMs <= 0) return false;
+  if (!createdAt) return false;
+  const created = Date.parse(createdAt);
+  if (!Number.isFinite(created)) return false;
+  return nowMs - created > maxAgeMs;
+}
+var DirectChatSpawnGate = class {
+  hostMax;
+  perAgentMax;
+  host = 0;
+  perAgent = /* @__PURE__ */ new Map();
+  queue = [];
+  constructor(config2) {
+    this.hostMax = Math.max(1, config2?.hostMaxConcurrency ?? DEFAULT_DIRECT_CHAT_HOST_CONCURRENCY);
+    this.perAgentMax = Math.max(
+      1,
+      config2?.perAgentMaxConcurrency ?? DEFAULT_DIRECT_CHAT_PER_AGENT_CONCURRENCY
+    );
+  }
+  /** Live host-wide spawn count. */
+  get hostInFlight() {
+    return this.host;
+  }
+  /** Live spawn count for a single agent. */
+  agentInFlight(codeName) {
+    return this.perAgent.get(codeName) ?? 0;
+  }
+  /** Number of acquirers currently waiting for a slot. */
+  get queuedCount() {
+    return this.queue.length;
+  }
+  canGrant(codeName) {
+    return this.host < this.hostMax && this.agentInFlight(codeName) < this.perAgentMax;
+  }
+  grant(codeName) {
+    this.host += 1;
+    this.perAgent.set(codeName, this.agentInFlight(codeName) + 1);
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      this.host -= 1;
+      const remaining = this.agentInFlight(codeName) - 1;
+      if (remaining <= 0) this.perAgent.delete(codeName);
+      else this.perAgent.set(codeName, remaining);
+      this.drain();
+    };
+  }
+  /** Acquire a spawn slot for `codeName`. Resolves with a single-use release. */
+  acquire(codeName) {
+    if (this.canGrant(codeName)) {
+      return Promise.resolve(this.grant(codeName));
+    }
+    return new Promise((resolve) => {
+      this.queue.push({ codeName, resolve });
+    });
+  }
+  /** Grant as many queued waiters as free slots allow, in FIFO order. */
+  drain() {
+    let i = 0;
+    while (i < this.queue.length && this.host < this.hostMax) {
+      const waiter = this.queue[i];
+      if (!waiter) break;
+      if (this.canGrant(waiter.codeName)) {
+        this.queue.splice(i, 1);
+        waiter.resolve(this.grant(waiter.codeName));
+      } else {
+        i += 1;
+      }
+    }
+  }
+};
+
 // src/lib/usage-banner-monitor.ts
 var MIN_CHECK_INTERVAL_MS = 6e4;
 var PANE_TAIL_LINES_FOR_BANNER = 200;
@@ -966,8 +1542,8 @@ async function maybeReportUsageBanner(args) {
 }
 
 // src/lib/token-usage-monitor.ts
-import { readdirSync, readFileSync, statSync } from "fs";
-import { join } from "path";
+import { readdirSync, readFileSync as readFileSync4, statSync } from "fs";
+import { join as join2 } from "path";
 var MIN_CHECK_INTERVAL_MS2 = 6e4;
 var TRANSCRIPT_MTIME_WINDOW_MS = 2 * 24 * 60 * 60 * 1e3;
 var MAX_ENTRIES_PER_POST = 200;
@@ -996,7 +1572,7 @@ async function maybeReportTokenUsage(args) {
     if (!name.endsWith(".jsonl")) continue;
     const sessionId = name.slice(0, -".jsonl".length);
     if (!sessionId) continue;
-    const path = join(dir, name);
+    const path = join2(dir, name);
     let st;
     try {
       st = statSync(path);
@@ -1012,7 +1588,7 @@ async function maybeReportTokenUsage(args) {
     }
     let content;
     try {
-      content = readFileSync(path, "utf-8");
+      content = readFileSync4(path, "utf-8");
     } catch (err) {
       log2(`[token-usage] read failed for '${codeName}/${name}': ${err.message}`);
       continue;
@@ -1092,14 +1668,272 @@ async function maybeReportTokenUsage(args) {
   state2.set(codeName, next);
 }
 
+// src/lib/conversation-evaluator.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { join as join3 } from "path";
+var MIN_CHECK_INTERVAL_MS3 = 5 * 6e4;
+var TRANSCRIPT_MTIME_WINDOW_MS2 = 3 * 24 * 60 * 60 * 1e3;
+var WINDOW_PAD_MS = 5 * 6e4;
+var MAX_TURN_CHARS = 1500;
+var MAX_TRANSCRIPT_CHARS = 6e3;
+var DEFAULT_CLAUDE_EVAL_MODEL = "claude-haiku-4-5-20251001";
+var DEFAULT_LOCAL_EVAL_URL = "http://localhost:11434/v1/chat/completions";
+var DEFAULT_LOCAL_EVAL_MODEL = "gemma4:12b";
+var EVAL_TIMEOUT_MS = 12e4;
+async function runLocalEvalChat(prompt, opts) {
+  const endpoint = new URL(opts.url);
+  const hostname = endpoint.hostname.toLowerCase();
+  const isLoopback = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+  if (!isLoopback) {
+    throw new Error(`local eval url must be loopback-only, got host '${endpoint.hostname}'`);
+  }
+  const doFetch = opts.fetchImpl ?? fetch;
+  const res = await doFetch(opts.url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...opts.apiKey ? { Authorization: `Bearer ${opts.apiKey}` } : {}
+    },
+    body: JSON.stringify({
+      model: opts.model,
+      messages: [{ role: "user", content: prompt }],
+      temperature: 0,
+      max_tokens: 512,
+      stream: false
+    }),
+    signal: AbortSignal.timeout(opts.timeoutMs ?? EVAL_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(`local eval endpoint ${opts.url} returned ${res.status}`);
+  }
+  const data = await res.json();
+  const text = data.choices?.[0]?.message?.content;
+  if (typeof text !== "string" || !text.trim()) {
+    throw new Error("local eval endpoint returned no message content");
+  }
+  return text;
+}
+var state3 = /* @__PURE__ */ new Map();
+function channelRefTokens(channelRef) {
+  return channelRef.split(":").slice(1).filter((p) => p && p !== "dm");
+}
+function contentToText(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.map((b) => {
+      if (typeof b === "string") return b;
+      if (b && typeof b === "object" && b.type === "text") {
+        return String(b.text ?? "");
+      }
+      return "";
+    }).filter(Boolean).join(" ");
+  }
+  return "";
+}
+function parseTranscriptTurns(jsonl) {
+  const turns = [];
+  for (const line of jsonl.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let obj;
+    try {
+      obj = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const role = obj.type === "user" || obj.type === "assistant" ? obj.type : void 0;
+    if (!role) continue;
+    const text = contentToText(obj.message?.content).trim();
+    if (!text) continue;
+    const ts = obj.timestamp ? Date.parse(obj.timestamp) : NaN;
+    turns.push({ role, text, ts: Number.isFinite(ts) ? ts : 0 });
+  }
+  return turns;
+}
+function stripChannelTag(text) {
+  return text.replace(/<channel\b[^>]*\/?>/i, "").replace(/<\/channel>/i, "").trim();
+}
+function reconstructConversation(allTurns, tokens, windowStartMs, windowEndMs) {
+  if (tokens.length === 0) return [];
+  const sorted = [...allTurns].sort((a, b) => a.ts - b.ts);
+  const out = [];
+  let inConversation = false;
+  for (const turn of sorted) {
+    if (turn.ts && (turn.ts < windowStartMs || turn.ts > windowEndMs)) continue;
+    if (turn.role === "user") {
+      inConversation = tokens.every((t) => turn.text.includes(t));
+      if (inConversation) {
+        out.push({ ...turn, text: stripChannelTag(turn.text) });
+      }
+    } else if (inConversation) {
+      out.push(turn);
+    }
+  }
+  return out;
+}
+function renderTranscript(turns) {
+  const lines = [];
+  let total = 0;
+  for (const turn of turns) {
+    const label = turn.role === "user" ? "User" : "Agent";
+    const body = turn.text.length > MAX_TURN_CHARS ? `${turn.text.slice(0, MAX_TURN_CHARS)}\u2026` : turn.text;
+    const line = `${label}: ${body}`;
+    if (total + line.length > MAX_TRANSCRIPT_CHARS) break;
+    lines.push(line);
+    total += line.length;
+  }
+  return lines.join("\n\n");
+}
+function buildEvalPrompt(channel, transcript) {
+  return `You are a strict QA evaluator scoring whether an AI agent successfully helped an end-user in a single ${channel} conversation. Judge ONLY the agent's effectiveness for the user \u2014 not tone, length, or policy.
+
+Conversation transcript:
+"""
+${transcript}
+"""
+
+Score the agent's success:
+- score: integer 0-100 (0 = ignored/unhelpful/wrong, 100 = fully resolved the user's need)
+- verdict: "success" (need clearly met), "partial" (some help but incomplete/ambiguous), or "failure" (did not help / made it worse)
+- summary: ONE short sentence (max 140 chars) explaining the score. Do NOT quote sensitive user content.
+
+Respond with ONLY a JSON object, no other text:
+{"score": 0-100, "verdict": "success|partial|failure", "summary": "..."}`;
+}
+function parseVerdict(raw) {
+  const match = raw.match(/\{[\s\S]*\}/);
+  if (!match) return null;
+  let obj;
+  try {
+    obj = JSON.parse(match[0]);
+  } catch {
+    return null;
+  }
+  const score = typeof obj.score === "number" ? obj.score : Number(obj.score);
+  if (!Number.isFinite(score) || score < 0 || score > 100) return null;
+  if (obj.verdict !== "success" && obj.verdict !== "partial" && obj.verdict !== "failure") return null;
+  const summary = typeof obj.summary === "string" ? obj.summary.slice(0, 140) : "";
+  return { score: Math.round(score), verdict: obj.verdict, summary };
+}
+async function maybeEvaluateConversations(args) {
+  const { api: api2, backend, codeName, agentId, log: log2 } = args;
+  const now = args.now ?? /* @__PURE__ */ new Date();
+  const nowMs = now.getTime();
+  const existing = state3.get(codeName);
+  if (existing && nowMs - existing.lastCheckedAt < MIN_CHECK_INTERVAL_MS3) {
+    return;
+  }
+  state3.set(codeName, { lastCheckedAt: nowMs });
+  let pending;
+  try {
+    const resp = await api2.get(
+      `/host/conversations/pending-evaluation?agent_id=${encodeURIComponent(agentId)}`
+    );
+    pending = resp?.conversations ?? [];
+  } catch (err) {
+    log2(`[conversation-eval] ${codeName}: pending fetch failed: ${err.message}`);
+    return;
+  }
+  if (pending.length === 0) return;
+  const dir = args.transcriptDir ?? sessionTranscriptDir(getProjectDir(codeName));
+  const allTurns = readRecentTurns(dir, nowMs);
+  if (allTurns.length === 0) {
+    for (const conv of pending) {
+      await reportSkip(api2, agentId, conv.conversation_id, log2, codeName);
+    }
+    return;
+  }
+  for (const conv of pending) {
+    const tokens = channelRefTokens(conv.channel_ref);
+    const windowStart = Date.parse(conv.started_at) - WINDOW_PAD_MS;
+    const windowEnd = Date.parse(conv.last_message_at) + WINDOW_PAD_MS;
+    const turns = reconstructConversation(allTurns, tokens, windowStart, windowEnd);
+    if (turns.length === 0) {
+      await reportSkip(api2, agentId, conv.conversation_id, log2, codeName);
+      continue;
+    }
+    const transcript = renderTranscript(turns);
+    if (!transcript.trim()) {
+      await reportSkip(api2, agentId, conv.conversation_id, log2, codeName);
+      continue;
+    }
+    let verdict;
+    try {
+      const out = await backend.run(buildEvalPrompt(conv.channel, transcript));
+      verdict = parseVerdict(out);
+    } catch (err) {
+      log2(`[conversation-eval] ${codeName}: scoring failed: ${err.message}`);
+      continue;
+    }
+    if (!verdict) {
+      log2(`[conversation-eval] ${codeName}: unparseable verdict for ${conv.conversation_id.slice(0, 8)}`);
+      continue;
+    }
+    try {
+      await api2.post("/host/conversations/evaluation", {
+        agent_id: agentId,
+        conversation_id: conv.conversation_id,
+        score: verdict.score,
+        verdict: verdict.verdict,
+        summary: verdict.summary,
+        model: backend.model
+      });
+      log2(
+        `[conversation-eval] ${codeName}: ${conv.conversation_id.slice(0, 8)} \u2192 ${verdict.verdict} (${verdict.score})`
+      );
+    } catch (err) {
+      log2(`[conversation-eval] ${codeName}: report failed: ${err.message}`);
+    }
+  }
+}
+async function reportSkip(api2, agentId, conversationId, log2, codeName) {
+  try {
+    await api2.post("/host/conversations/evaluation", {
+      agent_id: agentId,
+      conversation_id: conversationId,
+      skipped: true
+    });
+  } catch (err) {
+    log2(`[conversation-eval] ${codeName}: skip report failed: ${err.message}`);
+  }
+}
+function readRecentTurns(dir, nowMs) {
+  let entries;
+  try {
+    entries = readdirSync2(dir);
+  } catch {
+    return [];
+  }
+  const turns = [];
+  for (const name of entries) {
+    if (!name.endsWith(".jsonl")) continue;
+    const full = join3(dir, name);
+    let mtimeMs;
+    try {
+      mtimeMs = statSync2(full).mtimeMs;
+    } catch {
+      continue;
+    }
+    if (nowMs - mtimeMs > TRANSCRIPT_MTIME_WINDOW_MS2) continue;
+    let content;
+    try {
+      content = readFileSync5(full, "utf8");
+    } catch {
+      continue;
+    }
+    turns.push(...parseTranscriptTurns(content));
+  }
+  return turns;
+}
+
 // src/lib/activity-cache-monitor.ts
-import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync6 } from "fs";
 import { homedir } from "os";
-import { join as join2 } from "path";
-var MIN_CHECK_INTERVAL_MS3 = 6e4;
-var STATS_CACHE_PATH = join2(homedir(), ".claude", "stats-cache.json");
+import { join as join4 } from "path";
+var MIN_CHECK_INTERVAL_MS4 = 6e4;
+var STATS_CACHE_PATH = join4(homedir(), ".claude", "stats-cache.json");
 var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
-var state3 = { lastObservedDate: null, lastCheckedAt: 0 };
+var state4 = { lastObservedDate: null, lastCheckedAt: 0 };
 function selectNewDailyRows(raw, lastObservedDate) {
   let parsed;
   try {
@@ -1138,24 +1972,24 @@ async function maybeReportActivityCache(args) {
   const { api: api2, log: log2 } = args;
   const now = args.now ?? /* @__PURE__ */ new Date();
   const nowMs = now.getTime();
-  if (nowMs - state3.lastCheckedAt < MIN_CHECK_INTERVAL_MS3) return;
-  state3.lastCheckedAt = nowMs;
-  if (!existsSync(STATS_CACHE_PATH)) {
+  if (nowMs - state4.lastCheckedAt < MIN_CHECK_INTERVAL_MS4) return;
+  state4.lastCheckedAt = nowMs;
+  if (!existsSync2(STATS_CACHE_PATH)) {
     return;
   }
   let raw;
   try {
-    raw = readFileSync2(STATS_CACHE_PATH, "utf-8");
+    raw = readFileSync6(STATS_CACHE_PATH, "utf-8");
   } catch (err) {
     log2(`[activity-cache] readFileSync failed: ${err.message}`);
     return;
   }
-  const rows = selectNewDailyRows(raw, state3.lastObservedDate);
+  const rows = selectNewDailyRows(raw, state4.lastObservedDate);
   if (rows.length === 0) return;
   for (const row of rows) {
     try {
       await api2.post("/host/activity-observations", row);
-      state3.lastObservedDate = row.date;
+      state4.lastObservedDate = row.date;
     } catch (err) {
       log2(
         `[activity-cache] POST /host/activity-observations failed for date=${row.date}: ${err.message}`
@@ -1595,7 +2429,7 @@ var GatewayClientPool = class extends EventEmitter {
 // src/lib/claude-auth-detect.ts
 import { readFile, readdir } from "fs/promises";
 import { homedir as homedir2, platform } from "os";
-import { join as join3 } from "path";
+import { join as join5 } from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile2);
@@ -1610,8 +2444,8 @@ async function detectClaudeAuth() {
 }
 async function findClaudeCredentialsPaths() {
   const candidates = [
-    join3(homedir2(), ".claude", ".credentials.json"),
-    join3(homedir2(), ".claude", "credentials.json")
+    join5(homedir2(), ".claude", ".credentials.json"),
+    join5(homedir2(), ".claude", "credentials.json")
   ];
   const isLinuxRoot = platform() === "linux" && typeof process.getuid === "function" && process.getuid() === 0;
   if (isLinuxRoot) {
@@ -1619,8 +2453,8 @@ async function findClaudeCredentialsPaths() {
       const entries = await readdir("/home", { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        candidates.push(join3("/home", entry.name, ".claude", ".credentials.json"));
-        candidates.push(join3("/home", entry.name, ".claude", "credentials.json"));
+        candidates.push(join5("/home", entry.name, ".claude", ".credentials.json"));
+        candidates.push(join5("/home", entry.name, ".claude", "credentials.json"));
       }
     } catch {
     }
@@ -1712,18 +2546,18 @@ function normalize(value) {
 }
 
 // src/lib/channel-hash-cache.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "fs";
+import { join as join6 } from "path";
 var CACHE_FILENAME = "channel-hash-cache.json";
 function getChannelHashCacheFile(configDir) {
-  return join4(configDir, CACHE_FILENAME);
+  return join6(configDir, CACHE_FILENAME);
 }
 function loadChannelHashCache(target, configDir) {
   const path = getChannelHashCacheFile(configDir);
-  if (!existsSync2(path)) return;
+  if (!existsSync3(path)) return;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync3(path, "utf-8"));
+    parsed = JSON.parse(readFileSync7(path, "utf-8"));
   } catch {
     return;
   }
@@ -1737,7 +2571,7 @@ function saveChannelHashCache(source, configDir) {
   const obj = {};
   for (const [key, value] of source) obj[key] = value;
   try {
-    writeFileSync(path, JSON.stringify(obj, null, 2));
+    writeFileSync2(path, JSON.stringify(obj, null, 2));
   } catch {
   }
 }
@@ -1992,108 +2826,6 @@ function killAgentChannelProcesses(codeName, opts) {
   return pids;
 }
 
-// src/lib/channel-input-watchdog.ts
-var STUCK_THRESHOLD_MS = 5e3;
-var ATTACHED_STUCK_THRESHOLD_MS = 15e3;
-var INPUT_BOX_DIVIDER = /^[─━]{10,}/;
-var PROMPT_PREFIX = "\u276F ";
-function decide(pane, prev, now, config2 = {}) {
-  const threshold = config2.stuckThresholdMs ?? STUCK_THRESHOLD_MS;
-  const inputText = extractInputBoxText(pane);
-  if (!inputText) {
-    return { fire: false, next: void 0 };
-  }
-  if (isActivelyProcessing(pane)) {
-    return { fire: false, next: prev };
-  }
-  const hash = simpleHash(inputText);
-  if (!prev || prev.lastInputHash !== hash) {
-    return {
-      fire: false,
-      next: { lastInputHash: hash, firstSeenAt: now, resolved: false }
-    };
-  }
-  if (prev.resolved) return { fire: false, next: prev };
-  if (now - prev.firstSeenAt < threshold) return { fire: false, next: prev };
-  return {
-    fire: true,
-    next: { ...prev, resolved: true }
-  };
-}
-function extractInputBoxText(pane) {
-  const lines = pane.split("\n");
-  for (let i = 1; i < lines.length; i++) {
-    const line = lines[i] ?? "";
-    if (!line.startsWith(PROMPT_PREFIX)) continue;
-    let j = i - 1;
-    while (j >= 0 && (lines[j] ?? "").trim() === "") j--;
-    if (j < 0) continue;
-    if (!INPUT_BOX_DIVIDER.test((lines[j] ?? "").trim())) continue;
-    const text = line.slice(PROMPT_PREFIX.length).trim();
-    return text.length > 0 ? text : null;
-  }
-  return null;
-}
-function isActivelyProcessing(pane) {
-  const lines = pane.split("\n");
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const line = (lines[i] ?? "").trim();
-    if (!line.startsWith("\u273B")) continue;
-    if (/\bfor\s+\d+s\s*$/.test(line)) return false;
-    if (/\b\w+ing[…\.]{0,3}\s*$/i.test(line)) return true;
-    return false;
-  }
-  return false;
-}
-function simpleHash(s) {
-  let h = 0;
-  for (let i = 0; i < s.length; i++) {
-    h = (h << 5) - h + s.charCodeAt(i) | 0;
-  }
-  return h.toString(16);
-}
-function checkChannelInputs(codeNames, io, config2 = {}, states = sharedStates) {
-  const live = new Set(codeNames);
-  for (const codeName of codeNames) {
-    try {
-      checkOne(codeName, io, config2, states);
-    } catch (err) {
-      io.log(`[channel-input-watchdog] '${codeName}': ${err.message}`);
-    }
-  }
-  for (const key of [...states.keys()]) {
-    if (!live.has(key)) states.delete(key);
-  }
-}
-function checkOne(codeName, io, config2, states) {
-  const pane = io.capturePane(codeName);
-  if (!pane) {
-    states.delete(codeName);
-    return;
-  }
-  const attached = io.isClientAttached(codeName);
-  const effectiveConfig = attached ? {
-    ...config2,
-    stuckThresholdMs: config2.attachedStuckThresholdMs ?? ATTACHED_STUCK_THRESHOLD_MS
-  } : config2;
-  const prev = states.get(codeName);
-  const { fire, next } = decide(pane, prev, io.now(), effectiveConfig);
-  if (next === void 0) {
-    states.delete(codeName);
-  } else {
-    states.set(codeName, next);
-  }
-  if (fire) {
-    const text = extractInputBoxText(pane) ?? "";
-    const hash = next?.lastInputHash ?? simpleHash(text);
-    io.log(
-      `[channel-input-watchdog] '${codeName}': stuck channel input \u2014 firing Enter (input_hash=${hash}, len=${text.length})`
-    );
-    io.sendEnter(codeName);
-  }
-}
-var sharedStates = /* @__PURE__ */ new Map();
-
 // src/lib/delivery-hint.ts
 var DEFAULT_PROBABILITY = 0.1;
 function envSuffixFor(codeName) {
@@ -2210,6 +2942,34 @@ var agentState = {
   knownIntegrationHashes: /* @__PURE__ */ new Map(),
   knownManagedMcpHashes: /* @__PURE__ */ new Map(),
   knownManagedMcpStructure: /* @__PURE__ */ new Map(),
+  /**
+   * ENG-5858: hash of the effective sender_policy returned by
+   * /host/refresh for this agent. Tracked separately from
+   * `knownChannelConfigHashes` because the channel-cred hash is
+   * per-channel (cleared/rewritten per channel) whereas sender_policy is
+   * agent-wide. A change here triggers a session restart so the
+   * slack-channel / teams-channel MCP children pick up the new env vars
+   * (they read SLACK_SENDER_POLICY / MSTEAMS_SENDER_POLICY only at boot).
+   */
+  knownSenderPolicyHashes: /* @__PURE__ */ new Map(),
+  /**
+   * ENG-6024: hash of the Teams behaviour subset (thread_auto_follow,
+   * channel_response_mode, adaptive_cards_enabled/_ask_user_enabled) from the
+   * agent's msteams channel config. Same last-hop rationale as
+   * `knownSenderPolicyHashes`: teams-channel reads the corresponding env vars
+   * once at boot, and neither the channel-set restart nor the .mcp.json drift
+   * watcher fires on a value-only change, so this dedicated trigger restarts
+   * the session when an operator saves the webapp's Teams Advanced panel.
+   */
+  knownMsTeamsBehaviourHashes: /* @__PURE__ */ new Map(),
+  /**
+   * ENG-6035: hash of the Slack behaviour subset (allowed_users,
+   * thread_auto_follow, channel_response_mode) from the agent's slack
+   * channel config. Same last-hop rationale as the Teams map above —
+   * slack-channel reads SLACK_ALLOWED_USERS (and friends) once at boot,
+   * so an operator save needs this dedicated value-change trigger.
+   */
+  knownSlackBehaviourHashes: /* @__PURE__ */ new Map(),
   // ---------------------------------------------------------------------------
   // codeName-keyed
   // ---------------------------------------------------------------------------
@@ -2239,6 +2999,9 @@ function clearAgentState(agentId, codeName) {
   agentState.knownIntegrationHashes.delete(agentId);
   agentState.knownManagedMcpHashes.delete(agentId);
   agentState.knownManagedMcpStructure.delete(agentId);
+  agentState.knownSenderPolicyHashes.delete(agentId);
+  agentState.knownMsTeamsBehaviourHashes.delete(agentId);
+  agentState.knownSlackBehaviourHashes.delete(agentId);
   agentState.agentDisplayNames.delete(codeName);
   agentState.codeNameToAgentId.delete(codeName);
   let channelCacheMutated = false;
@@ -2257,24 +3020,24 @@ function clearAgentState(agentId, codeName) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync4, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync8, renameSync as renameSync2, rmSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join5 } from "path";
+import { join as join7 } from "path";
 import { randomUUID } from "crypto";
 function restartFlagsDir() {
-  return join5(homedir3(), ".augmented", "restart-flags");
+  return join7(homedir3(), ".augmented", "restart-flags");
 }
 function flagPath(codeName) {
-  return join5(restartFlagsDir(), `${codeName}.flag`);
+  return join7(restartFlagsDir(), `${codeName}.flag`);
 }
 function readRestartFlags() {
   const dir = restartFlagsDir();
-  if (!existsSync3(dir)) return [];
+  if (!existsSync4(dir)) return [];
   const out = [];
-  for (const entry of readdirSync2(dir)) {
+  for (const entry of readdirSync3(dir)) {
     if (!entry.endsWith(".flag")) continue;
     try {
-      const raw = readFileSync4(join5(dir, entry), "utf8");
+      const raw = readFileSync8(join7(dir, entry), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.codeName !== "string" || parsed.codeName.length === 0) {
         parsed.codeName = entry.replace(/\.flag$/, "");
@@ -2292,7 +3055,7 @@ function readRestartFlags() {
 }
 function deleteRestartFlag(codeName) {
   const path = flagPath(codeName);
-  if (existsSync3(path)) {
+  if (existsSync4(path)) {
     rmSync(path, { force: true });
   }
 }
@@ -2666,14 +3429,32 @@ function startRealtimeIntegrationContext(config2) {
   if (agentIds.length === 0) return;
   const sb = ensureClient(config2);
   const filterStr = agentIds.length === 1 ? `agent_id=eq.${agentIds[0]}` : `agent_id=in.(${agentIds.join(",")})`;
-  integrationContextChannel = sb.channel("plugin-context-realtime").on("postgres_changes", {
+  integrationContextChannel = sb.channel("agent-integration-context-realtime").on("postgres_changes", {
+    event: "INSERT",
+    schema: "public",
+    table: "agent_integration_context",
+    filter: filterStr
+  }, (payload) => {
+    const row = payload.new;
+    log2(`[realtime] agent_integration_context INSERT for agent ${row.agent_id} (plugin ${row.plugin_id})`);
+    onContextChange(row);
+  }).on("postgres_changes", {
+    event: "UPDATE",
+    schema: "public",
+    table: "agent_integration_context",
+    filter: filterStr
+  }, (payload) => {
+    const row = payload.new;
+    log2(`[realtime] agent_integration_context UPDATE for agent ${row.agent_id} (plugin ${row.plugin_id})`);
+    onContextChange(row);
+  }).on("postgres_changes", {
     event: "INSERT",
     schema: "public",
     table: "plugin_context",
     filter: filterStr
   }, (payload) => {
     const row = payload.new;
-    log2(`[realtime] plugin_context INSERT for agent ${row.agent_id} (plugin ${row.plugin_id})`);
+    log2(`[realtime] plugin_context (legacy) INSERT for agent ${row.agent_id} (plugin ${row.plugin_id})`);
     onContextChange(row);
   }).on("postgres_changes", {
     event: "UPDATE",
@@ -2682,7 +3463,7 @@ function startRealtimeIntegrationContext(config2) {
     filter: filterStr
   }, (payload) => {
     const row = payload.new;
-    log2(`[realtime] plugin_context UPDATE for agent ${row.agent_id} (plugin ${row.plugin_id})`);
+    log2(`[realtime] plugin_context (legacy) UPDATE for agent ${row.agent_id} (plugin ${row.plugin_id})`);
     onContextChange(row);
   }).subscribe((status) => {
     if (status === "SUBSCRIBED") {
@@ -2691,7 +3472,7 @@ function startRealtimeIntegrationContext(config2) {
       log2(`[realtime] Integration context channel: ${status}`);
     }
   });
-  log2(`[realtime] Subscribing to plugin_context for ${agentIds.length} agent(s)`);
+  log2(`[realtime] Subscribing to agent_integration_context (+ legacy plugin_context) for ${agentIds.length} agent(s)`);
 }
 function stopRealtimeIntegrationContext() {
   if (!integrationContextChannel) return;
@@ -2803,8 +3584,8 @@ function applyRestartAcks(args) {
 var GATEWAY_PORT_BASE = 18800;
 var GATEWAY_PORT_STEP = 10;
 var GATEWAY_PORT_MAX = 18899;
-var AUGMENTED_DIR = join6(process.env["HOME"] ?? "/tmp", ".augmented");
-var GATEWAY_PORTS_FILE = join6(AUGMENTED_DIR, "gateway-ports.json");
+var AUGMENTED_DIR = join8(process.env["HOME"] ?? "/tmp", ".augmented");
+var GATEWAY_PORTS_FILE = join8(AUGMENTED_DIR, "gateway-ports.json");
 var CHANNEL_SWEEP_INTERVAL_MS = (() => {
   const raw = parseInt(process.env["AGT_CHANNEL_SWEEP_INTERVAL_MS"] ?? "", 10);
   if (!Number.isFinite(raw)) return 5 * 60 * 1e3;
@@ -2911,8 +3692,8 @@ var KNOWN_SAFE_TAIL_SIGNATURES = /* @__PURE__ */ new Set(["session_id_in_use"]);
 function shouldSkipRevokedCleanup(previousKnownStatus) {
   return previousKnownStatus === "revoked";
 }
-function hasRevokedResiduals(state5) {
-  return state5.gatewayRunning || state5.portAllocated || state5.provisionDirExists;
+function hasRevokedResiduals(state6) {
+  return state6.gatewayRunning || state6.portAllocated || state6.provisionDirExists;
 }
 var pendingSessionRestarts = /* @__PURE__ */ new Map();
 var restartBreaker = new RestartBreaker();
@@ -2954,6 +3735,14 @@ function scheduleSessionRestart(codeName, delayMs, reason, breakerReason = "hot-
   }
   const timer = setTimeout(() => {
     pendingSessionRestarts.delete(codeName);
+    const gate = restartGateFor(codeName, breakerReason);
+    if (gate !== "bypass" && gate !== "proceed") {
+      log(
+        `[maintenance-window] Deferring '${reason}' restart for '${codeName}' (${gate}) \u2014 re-checking in ${RESTART_DEFER_RECHECK_MS / 1e3}s`
+      );
+      scheduleSessionRestart(codeName, RESTART_DEFER_RECHECK_MS, reason, breakerReason);
+      return;
+    }
     stopPersistentSession(codeName, log);
     runningMcpHashes.delete(codeName);
     recordRestartForBreaker(codeName, breakerReason);
@@ -2969,11 +3758,40 @@ function cancelPendingSessionRestart(codeName) {
   pendingSessionRestarts.delete(codeName);
   log(`[hot-reload] Cancelled pending restart timer for '${codeName}' (another teardown path is handling it)`);
 }
+var RESTART_DEFER_RECHECK_MS = 6e4;
+var lastInboundMs = /* @__PURE__ */ new Map();
+function noteInbound(codeName) {
+  lastInboundMs.set(codeName, Date.now());
+}
+function inboundAgeSecondsFor(codeName) {
+  const ts = lastInboundMs.get(codeName);
+  if (ts === void 0) return null;
+  return Math.max(0, Math.floor((Date.now() - ts) / 1e3));
+}
+function paneLogAgeSecondsFor(codeName) {
+  try {
+    const mtimeMs = statSync3(paneLogPath(codeName)).mtimeMs;
+    return Math.max(0, Math.floor((Date.now() - mtimeMs) / 1e3));
+  } catch (err) {
+    if (err?.code === "ENOENT") return null;
+    return 0;
+  }
+}
+function restartGateFor(codeName, breakerReason) {
+  if (!isGateableRestartReason(breakerReason)) return "bypass";
+  return decideRestartGate({
+    window: cachedMaintenanceWindow,
+    paneLogAgeSeconds: paneLogAgeSecondsFor(codeName),
+    inboundAgeSeconds: inboundAgeSecondsFor(codeName),
+    now: /* @__PURE__ */ new Date()
+  });
+}
 var runningMcpHashes = /* @__PURE__ */ new Map();
 var runningMcpServerKeys = /* @__PURE__ */ new Map();
+var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
-    const raw = readFileSync5(join6(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync9(join8(projectDir, ".mcp.json"), "utf-8");
     return createHash3("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
@@ -2981,7 +3799,7 @@ function projectMcpHash(_codeName, projectDir) {
 }
 function projectMcpKeys(_codeName, projectDir) {
   try {
-    const raw = readFileSync5(join6(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync9(join8(projectDir, ".mcp.json"), "utf-8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers;
     if (!servers || typeof servers !== "object") return /* @__PURE__ */ new Set();
@@ -2992,7 +3810,7 @@ function projectMcpKeys(_codeName, projectDir) {
 }
 function readMcpHttpServerConfig(projectDir, serverKey) {
   try {
-    const raw = readFileSync5(join6(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync9(join8(projectDir, ".mcp.json"), "utf-8");
     const servers = JSON.parse(raw).mcpServers ?? {};
     const entry = servers[serverKey];
     if (entry && typeof entry.url === "string" && (entry.type === "http" || entry.type === void 0)) {
@@ -3047,10 +3865,16 @@ async function runAgentConnectivityProbes(agent, integrations, projectDir) {
   }
 }
 function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason) {
+  const gate = restartGateFor(codeName, breakerReason);
+  if (gate !== "bypass" && gate !== "proceed") {
+    log(`[maintenance-window] Deferring '${breakerReason}' restart for '${codeName}' (${gate})`);
+    return;
+  }
   cancelPendingSessionRestart(codeName);
   stopPersistentSession(codeName, log);
   runningMcpHashes.delete(codeName);
   runningMcpServerKeys.delete(codeName);
+  runningChannelSecretHashes.delete(codeName);
   closeInjectedRunIfOpen(codeName, "cancelled", `session stopped (${breakerReason ?? "deprovision"})`);
   closeScheduledRunsForCode(codeName, "cancelled", `session stopped (${breakerReason ?? "deprovision"})`);
   if (breakerReason) {
@@ -3081,11 +3905,22 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
       const previousKeys = runningMcpServerKeys.get(codeName);
       const currentKeys = projectMcpKeys(codeName, projectDir);
       const decision = decideMcpRestartOnDrift(previousKeys, currentKeys);
+      let quarantineOnlyDrift = false;
+      if (decision.restart && !decision.membershipUnknown && currentKeys) {
+        const quarantined = channelQuarantineStore().getQuarantinedKeys(codeName);
+        const added = decision.addedOrRemoved.filter((k) => currentKeys.has(k));
+        const removed = decision.addedOrRemoved.filter((k) => !currentKeys.has(k));
+        quarantineOnlyDrift = added.length === 0 && removed.length > 0 && removed.every((k) => quarantined.has(k));
+      }
       if (decision.membershipUnknown) {
         clearPresenceReaperState(codeName);
         log(
           `[hot-reload] .mcp.json key membership unavailable for '${codeName}' \u2014 clearing full presence-reaper state and restarting (ENG-5285/ENG-5537)`
         );
+      } else if (quarantineOnlyDrift) {
+        log(
+          `[channel-quarantine] .mcp.json drift for '${codeName}' is quarantined-channel removal only [${decision.addedOrRemoved.join(", ")}] \u2014 adopting new baseline WITHOUT restart (0-restart-on-removal, ENG-5932)`
+        );
       } else if (decision.restart) {
         clearPresenceReaperStateForKeys(codeName, new Set(decision.addedOrRemoved));
         log(
@@ -3096,7 +3931,7 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
           `[hot-reload] .mcp.json value-only drift for '${codeName}' \u2014 preserving presence-reaper state and NOT restarting (ENG-5285/ENG-5537)`
         );
       }
-      if (decision.restart) {
+      if (decision.restart && !quarantineOnlyDrift) {
         scheduleSessionRestart(codeName, 0, ".mcp.json content change (ENG-4897)");
         runningMcpHashes.delete(codeName);
         runningMcpServerKeys.delete(codeName);
@@ -3108,6 +3943,35 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
     }
   }
 }
+function projectChannelSecretHash(projectDir) {
+  try {
+    const entries = parseEnvIntegrations(
+      readFileSync9(join8(projectDir, ".env.integrations"), "utf-8")
+    );
+    return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
+  } catch {
+    return null;
+  }
+}
+function checkChannelSecretDriftAndScheduleRestart(codeName, projectDir) {
+  const currentHash = projectChannelSecretHash(projectDir);
+  const action = decideMcpDriftAction(currentHash, runningChannelSecretHashes.get(codeName));
+  switch (action.kind) {
+    case "no-config":
+    case "no-drift":
+      return;
+    case "baseline":
+      runningChannelSecretHashes.set(codeName, action.hash);
+      return;
+    case "drift":
+      log(
+        `[hot-reload] channel credential rotated for '${codeName}' (${action.previous} \u2192 ${action.current}) \u2014 respawning to load the new token (ENG-6062)`
+      );
+      scheduleSessionRestart(codeName, 0, "channel credential rotation (ENG-6062)");
+      runningChannelSecretHashes.delete(codeName);
+      return;
+  }
+}
 var managedToolkitIdByAgentAndServerId = /* @__PURE__ */ new Map();
 function managedToolkitMapKey(agentId, serverId) {
   return `${agentId}\0${serverId}`;
@@ -3127,9 +3991,12 @@ var alertSlackWebhook = null;
 var alertedJobs = /* @__PURE__ */ new Set();
 var taskDisplayInfo = /* @__PURE__ */ new Map();
 var agentChannelTokens = /* @__PURE__ */ new Map();
+function __setAgentChannelTokensForTest(codeName, tokens) {
+  agentChannelTokens.set(codeName, tokens);
+}
 var activeChannels = /* @__PURE__ */ new Map();
 var gatewaysStartedThisCycle = /* @__PURE__ */ new Set();
-var state4 = {
+var state5 = {
   pid: process.pid,
   startedAt: (/* @__PURE__ */ new Date()).toISOString(),
   lastPollAt: null,
@@ -3139,8 +4006,10 @@ var state4 = {
 };
 var registeredAgentsCache = /* @__PURE__ */ new Map();
 var agentFrameworkCache = /* @__PURE__ */ new Map();
+var migratedSecretStorage = /* @__PURE__ */ new Set();
 var frameworkBinaryChecked = /* @__PURE__ */ new Set();
 var agentRuntimeAuthenticated = false;
+var lastManagedSettingsStatus = null;
 function resolveAgentFramework(codeName) {
   const frameworkId = agentFrameworkCache.get(codeName) ?? "openclaw";
   return getFramework(frameworkId);
@@ -3163,10 +4032,11 @@ function clearAgentCaches(agentId, codeName) {
   if (channelCacheMutated) saveChannelHashCache2();
 }
 var cachedFrameworkVersion = null;
+var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.27.8" : "dev";
+var agtCliVersion = true ? "0.27.9-test.12" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -3179,7 +4049,7 @@ function resolveBrewPath(execFileSync4) {
     "/usr/local/bin/brew"
   ];
   for (const path of fallbacks) {
-    if (existsSync4(path)) return path;
+    if (existsSync5(path)) return path;
   }
   return null;
 }
@@ -3189,7 +4059,7 @@ function claudeBinaryInstalled(execFileSync4) {
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude"
   ];
-  if (canonical.some((path) => existsSync4(path))) return true;
+  if (canonical.some((path) => existsSync5(path))) return true;
   try {
     execFileSync4("which", ["claude"], { timeout: 5e3 });
     return true;
@@ -3261,7 +4131,7 @@ async function ensureToolkitCli(toolkitSlug) {
         toolkitCliEnsured.add(toolkitSlug);
         return;
       }
-      brewBinDir = dirname(brewPath);
+      brewBinDir = dirname3(brewPath);
       const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
       log(`[toolkit-install] ${toolkitSlug}: installing via brew (${pkg})\u2026`);
       if (isRoot) {
@@ -3342,36 +4212,38 @@ function claudeManagedSettingsPath() {
 function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
   try {
     let settings = {};
-    if (existsSync4(path)) {
-      const raw = readFileSync5(path, "utf-8").trim();
+    if (existsSync5(path)) {
+      const raw = readFileSync9(path, "utf-8").trim();
       if (raw) {
         let parsed;
         try {
           parsed = JSON.parse(raw);
         } catch (err) {
           log(`[managed-settings] ${path} is not valid JSON (${err.message}) \u2014 leaving as-is; Claude Code channels may be blocked`);
-          return;
+          return "invalid_json";
         }
         if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
           settings = parsed;
         }
       }
     }
-    if (settings.channelsEnabled === true) return;
+    if (settings.channelsEnabled === true) return "ok";
     settings.channelsEnabled = true;
-    mkdirSync2(dirname(path), { recursive: true });
-    writeFileSync3(path, `${JSON.stringify(settings, null, 2)}
+    mkdirSync4(dirname3(path), { recursive: true });
+    writeFileSync4(path, `${JSON.stringify(settings, null, 2)}
 `);
     log(`[managed-settings] set channelsEnabled:true in ${path} (ENG-5786 \u2014 unblocks Claude Code channels)`);
+    return "ok";
   } catch (err) {
     log(`[managed-settings] could not ensure ${path}: ${err.message} \u2014 Claude Code channels may be blocked; set channelsEnabled:true manually`);
+    return "write_failed";
   }
 }
 async function ensureFrameworkBinary(frameworkId) {
   if (frameworkId !== "claude-code") return;
   if (frameworkBinaryChecked.has(frameworkId)) return;
   frameworkBinaryChecked.add(frameworkId);
-  ensureClaudeManagedSettings();
+  lastManagedSettingsStatus = ensureClaudeManagedSettings();
   const { execFileSync: execFileSync4 } = await import("child_process");
   const brewPath = resolveBrewPath(execFileSync4);
   if (!brewPath) {
@@ -3399,11 +4271,11 @@ async function ensureFrameworkBinary(frameworkId) {
       log(`Claude Code install failed: ${err.message}`);
       return;
     }
-    const brewBinDir = dirname(brewPath);
+    const brewBinDir = dirname3(brewPath);
     if (!process.env.PATH?.split(":").includes(brewBinDir)) {
       process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
     }
-    if (existsSync4("/home/linuxbrew/.linuxbrew/bin/claude")) {
+    if (existsSync5("/home/linuxbrew/.linuxbrew/bin/claude")) {
       log("Claude Code installed successfully");
     } else {
       log("Claude Code install completed but binary not found at expected path \u2014 check brew logs");
@@ -3415,17 +4287,17 @@ async function ensureFrameworkBinary(frameworkId) {
 var CLAUDE_CODE_UPGRADE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var claudeCodeUpgradeInFlight = false;
 function claudeCodeUpgradeMarkerPath() {
-  return join6(homedir4(), ".augmented", ".last-claude-code-upgrade-check");
+  return join8(homedir4(), ".augmented", ".last-claude-code-upgrade-check");
 }
 function stampClaudeCodeUpgradeMarker() {
   try {
-    writeFileSync3(claudeCodeUpgradeMarkerPath(), String(Date.now()));
+    writeFileSync4(claudeCodeUpgradeMarkerPath(), String(Date.now()));
   } catch {
   }
 }
 function claudeCodeUpgradeThrottled() {
   try {
-    const lastCheck = parseInt(readFileSync5(claudeCodeUpgradeMarkerPath(), "utf-8").trim(), 10);
+    const lastCheck = parseInt(readFileSync9(claudeCodeUpgradeMarkerPath(), "utf-8").trim(), 10);
     if (!Number.isFinite(lastCheck)) return false;
     return Date.now() - lastCheck < CLAUDE_CODE_UPGRADE_CHECK_INTERVAL_MS;
   } catch {
@@ -3435,6 +4307,9 @@ function claudeCodeUpgradeThrottled() {
 async function maybeUpgradeClaudeCode() {
   if (claudeCodeUpgradeInFlight) return;
   if (claudeCodeUpgradeThrottled()) return;
+  if (decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "defer") {
+    return;
+  }
   claudeCodeUpgradeInFlight = true;
   stampClaudeCodeUpgradeMarker();
   const { execFileSync: execFileSync4 } = await import("child_process");
@@ -3474,6 +4349,9 @@ ${r.stderr}`;
   });
 }
 var UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
+function selfUpdateAppliedMarkerPath() {
+  return join8(homedir4(), ".augmented", ".last-self-update-applied");
+}
 var selfUpdateUpToDateLogged = false;
 var restartAfterUpgrade = false;
 var pendingUpgradeVersion = null;
@@ -3495,7 +4373,7 @@ async function checkAndUpdateCli() {
     const isNpmGlobal = !isBrewFormula && resolvedPath.includes("node_modules");
     if (!isBrewFormula && !isNpmGlobal) return;
     const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
-    const markerPath = join6(homedir4(), ".augmented", ".last-update-check");
+    const markerPath = join8(homedir4(), ".augmented", ".last-update-check");
     try {
       const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
       if (Date.now() - lastCheck < UPDATE_CHECK_INTERVAL_MS) return;
@@ -3537,6 +4415,28 @@ async function checkAndUpdateCliViaBrew() {
     if (agtOutdated) {
       const installed = agtOutdated.installed_versions?.[0] ?? "unknown";
       const latest = agtOutdated.current_version ?? "unknown";
+      if (decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "defer") {
+        log(
+          `[self-update] agt CLI ${installed} \u2192 ${latest} (brew) deferred \u2014 ` + formatWindowDeferLogLine(cachedMaintenanceWindow ?? {}, /* @__PURE__ */ new Date())
+        );
+        return;
+      }
+      const coalesceWindowMs = resolveCoalesceWindowMs();
+      const coalesce = decideSelfUpdateCoalesce({
+        windowMs: coalesceWindowMs,
+        lastAppliedMs: readLastSelfUpdateAppliedMs(selfUpdateAppliedMarkerPath()),
+        now: Date.now()
+      });
+      if (!coalesce.proceed) {
+        log(formatCoalesceDeferLogLine({
+          installed,
+          latest,
+          channelLabel: "brew",
+          remainingMs: coalesce.remainingMs,
+          windowMs: coalesceWindowMs
+        }));
+        return;
+      }
       log(`[self-update] agt CLI update available: ${installed} \u2192 ${latest}. Upgrading via brew...`);
       try {
         execFileSync4(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
@@ -3544,6 +4444,7 @@ async function checkAndUpdateCliViaBrew() {
           stdio: "pipe"
         });
         log(`[self-update] agt CLI upgraded to ${latest}. Scheduling manager restart so the new binary takes effect.`);
+        stampLastSelfUpdateApplied(selfUpdateAppliedMarkerPath());
         restartAfterUpgrade = true;
         pendingUpgradeVersion = latest;
       } catch (err) {
@@ -3558,7 +4459,6 @@ async function checkAndUpdateCliViaBrew() {
   }
 }
 async function checkAndUpdateCliViaNpm() {
-  const { execFileSync: execFileSync4 } = await import("child_process");
   if (agtCliVersion === "dev") return;
   const channel = process.env.AGT_CLI_RELEASE_CHANNEL || "latest";
   let latest;
@@ -3584,6 +4484,18 @@ async function checkAndUpdateCliViaNpm() {
     log(`[self-update] npm registry fetch failed: ${err.message}`);
     return;
   }
+  const urgentTarget = await fetchUrgentDistTagVersion();
+  if (isUrgentUpgrade({
+    urgentTarget,
+    installed: agtCliVersion,
+    isNewer: (installed, candidate) => candidate !== installed && !isOlderSemverTuple(installed, candidate)
+  })) {
+    log(
+      `[self-update] URGENT agt CLI hotfix ${agtCliVersion} \u2192 ${urgentTarget} (overrides channel=${channel} + maintenance window). Upgrading via npm...`
+    );
+    await installAgtCliViaNpm(urgentTarget, "urgent");
+    return;
+  }
   let shouldUpdate;
   if (channel === "latest") {
     shouldUpdate = isNewerSemver(agtCliVersion, latest);
@@ -3604,27 +4516,63 @@ async function checkAndUpdateCliViaNpm() {
     }
     return;
   }
+  if (decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "defer") {
+    log(
+      `[self-update] agt CLI ${agtCliVersion} \u2192 ${latest} (channel=${channel}) deferred \u2014 ` + formatWindowDeferLogLine(cachedMaintenanceWindow ?? {}, /* @__PURE__ */ new Date())
+    );
+    return;
+  }
+  const coalesceWindowMs = resolveCoalesceWindowMs();
+  const coalesce = decideSelfUpdateCoalesce({
+    windowMs: coalesceWindowMs,
+    lastAppliedMs: readLastSelfUpdateAppliedMs(selfUpdateAppliedMarkerPath()),
+    now: Date.now()
+  });
+  if (!coalesce.proceed) {
+    log(formatCoalesceDeferLogLine({
+      installed: agtCliVersion,
+      latest,
+      channelLabel: `npm, channel=${channel}`,
+      remainingMs: coalesce.remainingMs,
+      windowMs: coalesceWindowMs
+    }));
+    return;
+  }
   log(`[self-update] agt CLI update available: ${agtCliVersion} \u2192 ${latest} (channel=${channel}). Upgrading via npm...`);
+  await installAgtCliViaNpm(latest, `channel=${channel}`);
+}
+async function fetchUrgentDistTagVersion() {
+  try {
+    const res = await fetch("https://registry.npmjs.org/@integrity-labs/agt-cli/urgent", {
+      signal: AbortSignal.timeout(1e4),
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return body.version ?? null;
+  } catch {
+    return null;
+  }
+}
+async function installAgtCliViaNpm(version, reasonLabel) {
+  const { execFileSync: execFileSync4 } = await import("child_process");
   const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
   const cmd = isRoot ? "npm" : "sudo";
-  const args = isRoot ? [
-    "install",
-    "-g",
-    `@integrity-labs/agt-cli@${latest}`,
-    "--registry=https://registry.npmjs.org"
-  ] : [
-    "-n",
-    "npm",
+  const installArgs = [
     "install",
     "-g",
-    `@integrity-labs/agt-cli@${latest}`,
+    `@integrity-labs/agt-cli@${version}`,
     "--registry=https://registry.npmjs.org"
   ];
+  const args = isRoot ? installArgs : ["-n", "npm", ...installArgs];
   try {
     execFileSync4(cmd, args, { timeout: 18e4, stdio: "pipe" });
-    log(`[self-update] agt CLI upgraded to ${latest}. Scheduling manager restart so the new binary takes effect.`);
+    log(
+      `[self-update] agt CLI upgraded to ${version} (${reasonLabel}). Scheduling manager restart so the new binary takes effect.`
+    );
+    stampLastSelfUpdateApplied(selfUpdateAppliedMarkerPath());
     restartAfterUpgrade = true;
-    pendingUpgradeVersion = latest;
+    pendingUpgradeVersion = version;
   } catch (err) {
     log(`[self-update] npm upgrade failed: ${err.message}`);
   }
@@ -3682,10 +4630,10 @@ async function applyClaudeAuthToEnv(childEnv, label) {
       throw new Error("claude_auth_mode=api_key but /host/exchange returned no decrypted key");
     }
     childEnv.ANTHROPIC_API_KEY = exchange.anthropicApiKey;
-    const claudeDir = join6(homedir4(), ".claude");
+    const claudeDir = join8(homedir4(), ".claude");
     for (const filename of [".credentials.json", "credentials.json"]) {
-      const p = join6(claudeDir, filename);
-      if (existsSync4(p)) {
+      const p = join8(claudeDir, filename);
+      if (existsSync5(p)) {
         try {
           rmSync2(p, { force: true });
           log(`[${label}] Removed ${p} (api_key mode \u2014 preventing OAuth fallback)`);
@@ -3697,16 +4645,93 @@ async function applyClaudeAuthToEnv(childEnv, label) {
     delete childEnv.ANTHROPIC_API_KEY;
   }
 }
+var evalEmptyMcpConfigPath = null;
+function ensureEvalEmptyMcpConfig() {
+  if (evalEmptyMcpConfigPath && existsSync5(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
+  const dir = join8(homedir4(), ".augmented");
+  try {
+    mkdirSync4(dir, { recursive: true });
+  } catch {
+  }
+  const p = join8(dir, ".eval-empty-mcp.json");
+  writeFileSync4(p, JSON.stringify({ mcpServers: {} }));
+  evalEmptyMcpConfigPath = p;
+  return p;
+}
+async function runEvalClaude(prompt, model) {
+  const childEnv = { ...process.env };
+  await applyClaudeAuthToEnv(childEnv, "conversation-eval");
+  const emptyMcp = ensureEvalEmptyMcpConfig();
+  const args = [
+    "-p",
+    prompt,
+    "--model",
+    model,
+    "--output-format",
+    "text",
+    // Isolation: only the empty MCP config, ignore project/user config + no tools.
+    "--mcp-config",
+    emptyMcp,
+    "--strict-mcp-config",
+    "--permission-mode",
+    "auto",
+    "--allowedTools",
+    ""
+  ];
+  const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
+    cwd: homedir4(),
+    timeout: 12e4,
+    stdin: "ignore",
+    env: childEnv,
+    onSpawn: (pid) => registerClaudeSpawn({ pid, started_at: Date.now(), kind: "other" }),
+    onExit: (pid) => unregisterClaudeSpawn(pid)
+  });
+  return stdout;
+}
+var conversationEvalBackend = null;
+function resolveConversationEvalBackend() {
+  if (conversationEvalBackend) return conversationEvalBackend;
+  const kind = (process.env["AGT_CONV_EVAL_BACKEND"] ?? "claude-p").trim().toLowerCase();
+  if (kind === "local") {
+    const url = process.env["AGT_CONV_EVAL_LOCAL_URL"]?.trim() || DEFAULT_LOCAL_EVAL_URL;
+    const model = process.env["AGT_CONV_EVAL_LOCAL_MODEL"]?.trim() || DEFAULT_LOCAL_EVAL_MODEL;
+    const apiKey = process.env["AGT_CONV_EVAL_LOCAL_API_KEY"]?.trim() || void 0;
+    const safeUrl = (() => {
+      try {
+        const parsed = new URL(url);
+        return `${parsed.origin}${parsed.pathname}`;
+      } catch {
+        return "[invalid-url]";
+      }
+    })();
+    log(`[conversation-eval] backend=local url=${safeUrl} model=${model}`);
+    conversationEvalBackend = { model, run: (prompt) => runLocalEvalChat(prompt, { url, model, apiKey }) };
+    return conversationEvalBackend;
+  }
+  if (kind === "" || kind === "claude-p") {
+    const model = process.env["AGT_CONV_EVAL_CLAUDE_MODEL"]?.trim() || DEFAULT_CLAUDE_EVAL_MODEL;
+    conversationEvalBackend = { model, run: (prompt) => runEvalClaude(prompt, model) };
+    return conversationEvalBackend;
+  }
+  log(`[conversation-eval] invalid AGT_CONV_EVAL_BACKEND='${kind}' \u2014 expected 'claude-p' or 'local'; evaluation disabled`);
+  conversationEvalBackend = {
+    model: "invalid-conversation-eval-backend",
+    run: async () => {
+      throw new Error(`Unsupported AGT_CONV_EVAL_BACKEND='${kind}'. Expected 'claude-p' or 'local'.`);
+    }
+  };
+  return conversationEvalBackend;
+}
 function loadGatewayPorts() {
   try {
-    return JSON.parse(readFileSync5(GATEWAY_PORTS_FILE, "utf-8"));
+    return JSON.parse(readFileSync9(GATEWAY_PORTS_FILE, "utf-8"));
   } catch {
     return {};
   }
 }
 function saveGatewayPorts(ports) {
-  mkdirSync2(AUGMENTED_DIR, { recursive: true });
-  writeFileSync3(GATEWAY_PORTS_FILE, JSON.stringify(ports, null, 2));
+  mkdirSync4(AUGMENTED_DIR, { recursive: true });
+  writeFileSync4(GATEWAY_PORTS_FILE, JSON.stringify(ports, null, 2));
 }
 function allocatePort(codeName) {
   const ports = loadGatewayPorts();
@@ -3729,10 +4754,10 @@ function freePort(codeName) {
   }
 }
 function getStateFile() {
-  return join6(config?.configDir ?? join6(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
+  return join8(config?.configDir ?? join8(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
 }
 function channelHashCacheDir() {
-  return config?.configDir ?? join6(process.env["HOME"] ?? "/tmp", ".augmented");
+  return config?.configDir ?? join8(process.env["HOME"] ?? "/tmp", ".augmented");
 }
 function loadChannelHashCache2() {
   loadChannelHashCache(agentState.knownChannelConfigHashes, channelHashCacheDir());
@@ -3740,10 +4765,34 @@ function loadChannelHashCache2() {
 function saveChannelHashCache2() {
   saveChannelHashCache(agentState.knownChannelConfigHashes, channelHashCacheDir());
 }
+var _channelQuarantineStore = null;
+function channelQuarantineStore() {
+  if (!_channelQuarantineStore) {
+    const dir = config?.configDir ?? join8(process.env["HOME"] ?? "/tmp", ".augmented");
+    _channelQuarantineStore = new ChannelQuarantineStore(defaultQuarantinePath(dir));
+  }
+  return _channelQuarantineStore;
+}
+function channelQuarantineMode() {
+  const v = process.env["AGT_CHANNEL_QUARANTINE_MODE"]?.toLowerCase();
+  if (v === "off") return "off";
+  if (v === "enforce") return "enforce";
+  return "shadow";
+}
+function channelQuarantineDwellMs() {
+  const raw = parseInt(process.env["AGT_CHANNEL_QUARANTINE_DWELL_MS"] ?? "", 10);
+  return Number.isFinite(raw) && raw >= 0 ? raw : 18e4;
+}
+function setWithout(source, remove) {
+  if (remove.size === 0) return new Set(source);
+  const out = /* @__PURE__ */ new Set();
+  for (const v of source) if (!remove.has(v)) out.add(v);
+  return out;
+}
 function send(msg) {
   if (msg.type === "state-update") {
     try {
-      writeFileSync3(getStateFile(), JSON.stringify(msg.state, null, 2));
+      atomicWriteFileSync(getStateFile(), JSON.stringify(msg.state, null, 2));
     } catch {
     }
   }
@@ -3774,9 +4823,9 @@ function log(msg) {
 `;
   if (!managerLogPath) {
     try {
-      managerLogPath = join6(homedir4(), ".augmented", "manager.log");
-      mkdirSync2(dirname(managerLogPath), { recursive: true });
-      if (existsSync4(managerLogPath)) {
+      managerLogPath = join8(homedir4(), ".augmented", "manager.log");
+      mkdirSync4(dirname3(managerLogPath), { recursive: true });
+      if (existsSync5(managerLogPath)) {
         chmodSync(managerLogPath, 384);
       }
     } catch {
@@ -3804,7 +4853,7 @@ function sha256(content) {
 }
 function hashFile(filePath) {
   try {
-    const content = readFileSync5(filePath, "utf-8");
+    const content = readFileSync9(filePath, "utf-8");
     return sha256(content);
   } catch {
     return null;
@@ -3828,13 +4877,13 @@ function parseSkillFrontmatter(content) {
   return out;
 }
 async function refreshSkillsIndexInClaudeMd(configDir, codeName, log2) {
-  const { readdirSync: readdirSync4, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync4 } = await import("fs");
-  const skillsDir = join6(configDir, codeName, "project", ".claude", "skills");
-  const claudeMdPath = join6(configDir, codeName, "project", "CLAUDE.md");
+  const { readdirSync: readdirSync5, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync5 } = await import("fs");
+  const skillsDir = join8(configDir, codeName, "project", ".claude", "skills");
+  const claudeMdPath = join8(configDir, codeName, "project", "CLAUDE.md");
   if (!ex(skillsDir) || !ex(claudeMdPath)) return;
   const entries = [];
-  for (const dir of readdirSync4(skillsDir).sort()) {
-    const skillFile = join6(skillsDir, dir, "SKILL.md");
+  for (const dir of readdirSync5(skillsDir).sort()) {
+    const skillFile = join8(skillsDir, dir, "SKILL.md");
     if (!ex(skillFile)) continue;
     try {
       const { name, description } = parseSkillFrontmatter(rfs(skillFile, "utf-8"));
@@ -3860,9 +4909,9 @@ Integration skills under \`.claude/skills/integration-*/SKILL.md\` are **read-on
 
 **Never edit \`.claude/skills/integration-*/SKILL.md\` files directly.** If you do, your edit will be silently overwritten on the next manager refresh, AND it won't propagate to other agents using the same integration.
 
-To change an integration's behavior (add a rule, update a default, tell the integration not to do something), call the **\`plugin.improve\`** MCP tool with the user's request. The tool calls the platform API, which uses an LLM to translate the request into a structured update of the integration's typed context fields and/or freeform overrides text. You'll get a diff back to show the user; on confirmation, call the tool again with \`auto_apply: true\` to apply.
+To change an integration's behavior (add a rule, update a default, tell the integration not to do something), call the **\`plugin_improve\`** MCP tool with the user's request. The tool calls the platform API, which uses an LLM to translate the request into a structured update of the integration's typed context fields and/or freeform overrides text. You'll get a diff back to show the user; on confirmation, call the tool again with \`auto_apply: true\` to apply.
 
-Examples of when to use \`plugin.improve\`:
+Examples of when to use \`plugin_improve\`:
 - *"Update the Coding integration so we always use trunk instead of main"*
 - *"Add a rule to the Coding integration: never merge directly to main, always open a PR"*
 - *"Tell the Knowledge Base integration not to return results below 70% relevance"*
@@ -3876,16 +4925,16 @@ ${SKILLS_INDEX_END}`;
     next = current.trimEnd() + "\n\n" + section + "\n";
   }
   if (next !== current) {
-    writeFileSync4(claudeMdPath, next, "utf-8");
+    writeFileSync5(claudeMdPath, next, "utf-8");
     log2(`Refreshed skills index in CLAUDE.md for '${codeName}' (${entries.length} skills)`);
   }
 }
 async function migrateToProfiles() {
   const homeDir = process.env["HOME"] ?? "/tmp";
-  const sharedConfigPath = join6(homeDir, ".openclaw", "openclaw.json");
+  const sharedConfigPath = join8(homeDir, ".openclaw", "openclaw.json");
   let sharedConfig;
   try {
-    sharedConfig = JSON.parse(readFileSync5(sharedConfigPath, "utf-8"));
+    sharedConfig = JSON.parse(readFileSync9(sharedConfigPath, "utf-8"));
   } catch {
     return;
   }
@@ -3898,19 +4947,19 @@ async function migrateToProfiles() {
     const codeName = agentEntry["id"];
     if (!codeName) continue;
     if (codeName === "main") continue;
-    const profileDir = join6(homeDir, `.openclaw-${codeName}`);
-    if (existsSync4(join6(profileDir, "openclaw.json"))) continue;
+    const profileDir = join8(homeDir, `.openclaw-${codeName}`);
+    if (existsSync5(join8(profileDir, "openclaw.json"))) continue;
     log(`Migrating agent '${codeName}' to per-agent profile`);
     if (adapter.seedProfileConfig) {
       adapter.seedProfileConfig(codeName);
     }
-    const sharedAuthDir = join6(homeDir, ".openclaw", "agents", codeName, "agent");
-    const profileAuthDir = join6(profileDir, "agents", codeName, "agent");
-    const authFile = join6(sharedAuthDir, "auth-profiles.json");
-    if (existsSync4(authFile)) {
-      mkdirSync2(profileAuthDir, { recursive: true });
-      const authContent = readFileSync5(authFile, "utf-8");
-      writeFileSync3(join6(profileAuthDir, "auth-profiles.json"), authContent);
+    const sharedAuthDir = join8(homeDir, ".openclaw", "agents", codeName, "agent");
+    const profileAuthDir = join8(profileDir, "agents", codeName, "agent");
+    const authFile = join8(sharedAuthDir, "auth-profiles.json");
+    if (existsSync5(authFile)) {
+      mkdirSync4(profileAuthDir, { recursive: true });
+      const authContent = readFileSync9(authFile, "utf-8");
+      writeFileSync4(join8(profileAuthDir, "auth-profiles.json"), authContent);
     }
     allocatePort(codeName);
     migrated++;
@@ -3948,7 +4997,7 @@ function readGatewayToken(codeName) {
   }
   const homeDir = process.env["HOME"] ?? "/tmp";
   try {
-    const cfg = JSON.parse(readFileSync5(join6(homeDir, `.openclaw-${codeName}`, "openclaw.json"), "utf-8"));
+    const cfg = JSON.parse(readFileSync9(join8(homeDir, `.openclaw-${codeName}`, "openclaw.json"), "utf-8"));
     return cfg?.gateway?.auth?.token;
   } catch {
     return void 0;
@@ -3957,18 +5006,18 @@ function readGatewayToken(codeName) {
 var GATEWAY_HUNG_TIMEOUT_MS = 5 * 6e4;
 function isGatewayHung(codeName) {
   const homeDir = process.env["HOME"] ?? "/tmp";
-  const jobsPath = join6(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
-  if (!existsSync4(jobsPath)) return false;
+  const jobsPath = join8(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
+  if (!existsSync5(jobsPath)) return false;
   try {
-    const data = JSON.parse(readFileSync5(jobsPath, "utf-8"));
+    const data = JSON.parse(readFileSync9(jobsPath, "utf-8"));
     const jobs = data.jobs ?? data;
     if (!Array.isArray(jobs)) return false;
     const now = Date.now();
     for (const job of jobs) {
-      const state5 = job.state;
-      if (!state5) continue;
-      const runStartedAt = state5.runStartedAtMs;
-      const isRunning = state5.status === "running" || state5.running === true;
+      const state6 = job.state;
+      if (!state6) continue;
+      const runStartedAt = state6.runStartedAtMs;
+      const isRunning = state6.status === "running" || state6.running === true;
       if (isRunning && runStartedAt && now - runStartedAt > GATEWAY_HUNG_TIMEOUT_MS) {
         return true;
       }
@@ -3993,19 +5042,19 @@ async function ensureGatewayRunning(codeName, adapter) {
       }
       await new Promise((r) => setTimeout(r, 2e3));
       const homeDir = process.env["HOME"] ?? "/tmp";
-      const cronJobsPath = join6(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
+      const cronJobsPath = join8(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
       clearStaleCronRunState(cronJobsPath);
     } else {
       if (status.port) {
         try {
           const homeDir = process.env["HOME"] ?? "/tmp";
-          const configPath = join6(homeDir, `.openclaw-${codeName}`, "openclaw.json");
-          if (existsSync4(configPath)) {
-            const cfg = JSON.parse(readFileSync5(configPath, "utf-8"));
+          const configPath = join8(homeDir, `.openclaw-${codeName}`, "openclaw.json");
+          if (existsSync5(configPath)) {
+            const cfg = JSON.parse(readFileSync9(configPath, "utf-8"));
             if (cfg.gateway?.port !== status.port) {
               if (!cfg.gateway) cfg.gateway = {};
               cfg.gateway.port = status.port;
-              writeFileSync3(configPath, JSON.stringify(cfg, null, 2));
+              writeFileSync4(configPath, JSON.stringify(cfg, null, 2));
             }
           }
         } catch {
@@ -4025,12 +5074,12 @@ async function ensureGatewayRunning(codeName, adapter) {
     gatewaysStartedThisCycle.add(codeName);
     try {
       const homeDir = process.env["HOME"] ?? "/tmp";
-      const configPath = join6(homeDir, `.openclaw-${codeName}`, "openclaw.json");
-      if (existsSync4(configPath)) {
-        const cfg = JSON.parse(readFileSync5(configPath, "utf-8"));
+      const configPath = join8(homeDir, `.openclaw-${codeName}`, "openclaw.json");
+      if (existsSync5(configPath)) {
+        const cfg = JSON.parse(readFileSync9(configPath, "utf-8"));
         if (!cfg.gateway) cfg.gateway = {};
         cfg.gateway.port = port;
-        writeFileSync3(configPath, JSON.stringify(cfg, null, 2));
+        writeFileSync4(configPath, JSON.stringify(cfg, null, 2));
       }
     } catch {
     }
@@ -4119,7 +5168,7 @@ async function pollCycle() {
       log,
       resolveFramework: (codeName) => agentFrameworkCache.get(codeName) ?? null,
       stopSession: (codeName) => {
-        stopPersistentSessionAndForgetMcpBaseline(codeName, "channel-set-change");
+        stopPersistentSessionAndForgetMcpBaseline(codeName, "channel-restart-flag");
         agentState.persistentSessionAgents.delete(codeName);
         claudeAuthTupleBySession.delete(codeName);
       },
@@ -4169,7 +5218,7 @@ async function pollCycle() {
     const now = Date.now();
     if (now - lastVersionCheckAt > VERSION_CHECK_INTERVAL_MS) {
       try {
-        const firstAgent = state4.agents[0];
+        const firstAgent = state5.agents[0];
         const versionAdapter = firstAgent ? resolveAgentFramework(firstAgent.codeName) : getFramework("openclaw");
         if (versionAdapter.getVersion) {
           cachedFrameworkVersion = await versionAdapter.getVersion();
@@ -4180,7 +5229,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-ICYFLUAM.js");
+      const { collectDiagnostics } = await import("../persistent-session-OL5EDYB4.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -4213,6 +5262,14 @@ async function pollCycle() {
         const errId = createHash3("sha256").update(errText).digest("hex").slice(0, 12);
         log(`Claude auth detection failed (error_id=${errId})`);
       }
+      const hostHasClaudeCode = state5.agents.some(
+        (a) => agentFrameworkCache.get(a.codeName) === "claude-code"
+      );
+      if (hostHasClaudeCode) {
+        lastManagedSettingsStatus = ensureClaudeManagedSettings();
+      } else {
+        lastManagedSettingsStatus = null;
+      }
       const hbResp = await api.post("/host/heartbeat", {
         host_id: hostId,
         framework_version: cachedFrameworkVersion ?? void 0,
@@ -4229,15 +5286,26 @@ async function pollCycle() {
         // polling fallback (healRealtimeSocketDivergence forces it). Surfaced
         // so a sustained socket-down window is observable rather than hidden
         // behind a fresh heartbeat.
-        realtime_socket_connected: isRealtimeSocketConnected()
+        realtime_socket_connected: isRealtimeSocketConnected(),
+        // ENG-6068: outcome of the channels managed-settings assertion.
+        // 'invalid_json' / 'write_failed' mean CC may be silently dropping
+        // ALL channel inbound — the API opens a host-scoped alert on it.
+        // Omitted (undefined) on hosts that haven't run the assertion
+        // (non-claude-code frameworks).
+        channels_setting_status: lastManagedSettingsStatus ?? void 0
       });
+      if (hbResp?.maintenance_window) {
+        cachedMaintenanceWindow = hbResp.maintenance_window;
+      }
       try {
-        const { maybeUpdateClaudeCode } = await import("../claude-code-updater-4E5T2X3Z.js");
-        await maybeUpdateClaudeCode({
-          desiredVersion: hbResp?.desired_claude_code_version ?? "latest",
-          currentVersion: cachedFrameworkVersion,
-          log
-        });
+        if (decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "proceed") {
+          const { maybeUpdateClaudeCode } = await import("../claude-code-updater-4E5T2X3Z.js");
+          await maybeUpdateClaudeCode({
+            desiredVersion: hbResp?.desired_claude_code_version ?? "latest",
+            currentVersion: cachedFrameworkVersion,
+            log
+          });
+        }
       } catch (err) {
         log(`Claude Code updater error: ${err.message}`);
       }
@@ -4248,15 +5316,23 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-WZNQ2762.js");
+      } = await import("../responsiveness-probe-B6LJJRUD.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
         if (probeCodeNames.length > 0) {
-          const probes = collectResponsivenessProbes(probeCodeNames);
+          const drainedGiveUps = /* @__PURE__ */ new Map();
+          const probes = collectResponsivenessProbes(probeCodeNames).map((p) => {
+            const giveUps = takeWatchdogGiveUpCount(p.code_name);
+            if (giveUps > 0) drainedGiveUps.set(p.code_name, giveUps);
+            return { ...p, input_stuck_give_ups: giveUps };
+          });
           if (probes.length > 0) {
             void api.post("/host/responsiveness-probe", { host_id: hostId, probes }).catch((err) => {
-              log(`[responsiveness-probe] post failed: ${err.message}`);
+              for (const [codeName, count] of drainedGiveUps) {
+                creditWatchdogGiveUpCount(codeName, count);
+              }
+              log(`[responsiveness-probe] post failed (give-up counts re-credited): ${err.message}`);
             });
           }
         }
@@ -4308,7 +5384,7 @@ async function pollCycle() {
     for (const agent of agents) {
       const requested = agent.restart_requested_at ?? null;
       if (!requested) continue;
-      const prev = state4.agents.find((a) => a.agentId === agent.agent_id);
+      const prev = state5.agents.find((a) => a.agentId === agent.agent_id);
       const lastProcessed = prev?.lastRestartProcessedAt ?? null;
       if (lastProcessed && Date.parse(lastProcessed) >= Date.parse(requested)) continue;
       log(`[restart] Dashboard requested restart for '${agent.code_name}' at ${requested}`);
@@ -4331,7 +5407,7 @@ async function pollCycle() {
         await processAgent(agent, agentStates);
       } catch (err) {
         log(`Error processing agent '${agent.code_name}': ${err.message}`);
-        const existing = state4.agents.find((a) => a.agentId === agent.agent_id);
+        const existing = state5.agents.find((a) => a.agentId === agent.agent_id);
         if (existing) {
           agentStates.push(existing);
         } else {
@@ -4357,13 +5433,13 @@ async function pollCycle() {
     void maybeReportActivityCache({ api, log });
     const restartAckStateChanged = applyRestartAcks({
       agentStates,
-      priorAgents: state4.agents,
+      priorAgents: state5.agents,
       restartAcks
     });
     if (restartAckStateChanged) {
       try {
-        const ackedState = { ...state4, agents: agentStates };
-        writeFileSync3(getStateFile(), JSON.stringify(ackedState, null, 2));
+        const ackedState = { ...state5, agents: agentStates };
+        atomicWriteFileSync(getStateFile(), JSON.stringify(ackedState, null, 2));
       } catch (err) {
         log(`[restart] failed to persist ack immediately: ${err.message}`);
       }
@@ -4380,7 +5456,7 @@ async function pollCycle() {
     } catch {
     }
     const currentIds = new Set(agents.map((a) => a.agent_id));
-    for (const prev of state4.agents) {
+    for (const prev of state5.agents) {
       if (!currentIds.has(prev.agentId)) {
         log(`Agent '${prev.codeName}' removed from host (deleted or unassigned)`);
         const adapter = resolveAgentFramework(prev.codeName);
@@ -4393,7 +5469,7 @@ async function pollCycle() {
         }
         killAgentChannelProcesses(prev.codeName, { log });
         freePort(prev.codeName);
-        const agentDir = join6(adapter.getAgentDir(prev.codeName), "provision");
+        const agentDir = join8(adapter.getAgentDir(prev.codeName), "provision");
         await cleanupAgentFiles(prev.codeName, agentDir);
         clearAgentCaches(prev.agentId, prev.codeName);
       }
@@ -4451,8 +5527,48 @@ async function pollCycle() {
           } catch {
           }
         },
+        // ENG-6017: dialog-dismissal keys — one send-keys call per key so a
+        // multi-key sequence can't be wrapped into a single bracketed paste
+        // (see defaultArmSender in persistent-session.ts). The inter-key
+        // delay is a blocking sleep; dialog sequences are at most two keys
+        // with a 300ms gap, well within poll-cycle tolerances.
+        sendKeys: (codeName, keys, interKeyDelayMs) => {
+          try {
+            for (let i = 0; i < keys.length; i++) {
+              if (i > 0 && interKeyDelayMs > 0) {
+                const view = new Int32Array(new SharedArrayBuffer(4));
+                Atomics.wait(view, 0, 0, interKeyDelayMs);
+              }
+              syncExecFile("tmux", ["send-keys", "-t", `agt-${codeName}`, keys[i]], {
+                stdio: "ignore",
+                timeout: 2e3
+              });
+            }
+          } catch {
+          }
+        },
         log,
-        now: () => Date.now()
+        now: () => Date.now(),
+        // ENG-6058: persist the give-up for the agent's channel servers —
+        // their periodic sweeps turn it into a throttled user-facing
+        // "please resend" notice for every conversation with an undrained
+        // pending-inbound marker. Best-effort: a write failure is logged by
+        // the watchdog, never fails the poll cycle.
+        signalGiveUp: (codeName) => {
+          const dir = join8(homedir4(), ".augmented", codeName);
+          if (!existsSync5(dir)) return;
+          atomicWriteFileSync(
+            join8(dir, "watchdog-give-up.json"),
+            JSON.stringify({ gave_up_at: (/* @__PURE__ */ new Date()).toISOString() })
+          );
+        }
+      }, {
+        // ENG-6055: heal-keystroke escalation. 'disturb' (default) retries
+        // with x→BSpace→Enter after the first bare Enter fails — a bare
+        // retry repeats the exact keystroke the stuck TUI state eats
+        // (kylie 2026-06-05). AGT_INPUT_HEAL_MODE=bare reverts to the
+        // pre-ENG-6055 behaviour if a future CC/tmux pairing misbehaves.
+        healMode: process.env.AGT_INPUT_HEAL_MODE === "bare" ? "bare" : "disturb"
       });
     }
     const lastHealthCheck = lastHarvestAt.get("__cron_health__") ?? 0;
@@ -4481,10 +5597,10 @@ async function pollCycle() {
       }
     } catch {
     }
-    state4 = {
-      ...state4,
+    state5 = {
+      ...state5,
       lastPollAt: (/* @__PURE__ */ new Date()).toISOString(),
-      pollCount: state4.pollCount + 1,
+      pollCount: state5.pollCount + 1,
       agents: agentStates,
       // ENG-5441: serialise trip state on every poll so manager restarts
       // never silently clear a tripped breaker. Cheap — only tripped
@@ -4495,9 +5611,9 @@ async function pollCycle() {
       log(`[poll-backoff] recovered after ${consecutivePollFailures} failure(s), resuming normal interval`);
       consecutivePollFailures = 0;
     }
-    send({ type: "state-update", state: state4 });
+    send({ type: "state-update", state: state5 });
   } catch (err) {
-    state4.errorCount++;
+    state5.errorCount++;
     const message = err.message;
     log(`Poll error: ${message}`);
     send({ type: "error", message });
@@ -4541,10 +5657,17 @@ async function processAgent(agent, agentStates) {
       agentId: agent.agent_id,
       log
     });
+    void maybeEvaluateConversations({
+      api,
+      backend: resolveConversationEvalBackend(),
+      codeName: agent.code_name,
+      agentId: agent.agent_id,
+      log
+    });
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const adapter = resolveAgentFramework(agent.code_name);
-  let agentDir = join6(adapter.getAgentDir(agent.code_name), "provision");
+  let agentDir = join8(adapter.getAgentDir(agent.code_name), "provision");
   if (agent.status === "draft" || agent.status === "paused") {
     if (previousKnownStatus !== agent.status) {
       log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
@@ -4583,7 +5706,7 @@ async function processAgent(agent, agentStates) {
       const residuals = {
         gatewayRunning: gatewayLiveness.running,
         portAllocated: Object.prototype.hasOwnProperty.call(ports, agent.code_name),
-        provisionDirExists: existsSync4(agentDir)
+        provisionDirExists: existsSync5(agentDir)
       };
       if (!hasRevokedResiduals(residuals)) {
         agentStates.push({
@@ -4665,7 +5788,7 @@ async function processAgent(agent, agentStates) {
     });
   } catch (err) {
     log(`Refresh failed for '${agent.code_name}': ${err.message}`);
-    const existing = state4.agents.find((a) => a.agentId === agent.agent_id);
+    const existing = state5.agents.find((a) => a.agentId === agent.agent_id);
     agentStates.push(existing ?? {
       agentId: agent.agent_id,
       codeName: agent.code_name,
@@ -4713,16 +5836,28 @@ async function processAgent(agent, agentStates) {
   const frameworkId = refreshData.agent.framework ?? "openclaw";
   agentFrameworkCache.set(agent.code_name, frameworkId);
   const frameworkAdapter = getFramework(frameworkId);
-  agentDir = join6(frameworkAdapter.getAgentDir(agent.code_name), "provision");
+  agentDir = join8(frameworkAdapter.getAgentDir(agent.code_name), "provision");
   cacheAgentDeliveryMetadata(agent.code_name, refreshData);
+  if (frameworkAdapter.migrateSecretStorage && !migratedSecretStorage.has(agent.code_name)) {
+    try {
+      frameworkAdapter.migrateSecretStorage(agent.code_name);
+      migratedSecretStorage.add(agent.code_name);
+    } catch (err) {
+      log(`[mcp-migrate] failed for '${agent.code_name}': ${err.message}`);
+    }
+  }
   if (frameworkAdapter.seedProfileConfig) {
     frameworkAdapter.seedProfileConfig(agent.code_name);
   }
   const charterVersion = refreshData.charter.version;
   const toolsVersion = refreshData.tools.version;
   const known = agentState.knownVersions.get(agent.agent_id);
-  let lastProvisionAt = state4.agents.find((a) => a.agentId === agent.agent_id)?.lastProvisionAt ?? null;
-  const currentChannelIds = launchableChannelIds(refreshData.channel_configs);
+  let lastProvisionAt = state5.agents.find((a) => a.agentId === agent.agent_id)?.lastProvisionAt ?? null;
+  const quarantinedChannels = channelQuarantineStore().getQuarantinedKeys(agent.code_name);
+  const currentChannelIds = setWithout(
+    launchableChannelIds(refreshData.channel_configs),
+    quarantinedChannels
+  );
   const previousChannelIds = agentState.knownChannels.get(agent.agent_id);
   const channelsChanged = !previousChannelIds || currentChannelIds.size !== previousChannelIds.size || [...currentChannelIds].some((ch) => !previousChannelIds.has(ch)) || [...previousChannelIds].some((ch) => !currentChannelIds.has(ch));
   let channelConfigConverged = true;
@@ -4742,9 +5877,9 @@ async function processAgent(agent, agentStates) {
   try {
     const artifacts = generateArtifacts(agent, refreshData, frameworkAdapter);
     const changedFiles = [];
-    mkdirSync2(agentDir, { recursive: true });
+    mkdirSync4(agentDir, { recursive: true });
     for (const artifact of artifacts) {
-      const filePath = join6(agentDir, artifact.relativePath);
+      const filePath = join8(agentDir, artifact.relativePath);
       let existingHash;
       let newHash;
       let writeContent = artifact.content;
@@ -4763,8 +5898,8 @@ async function processAgent(agent, agentStates) {
         };
         newHash = sha256(stripDynamicSections(artifact.content));
         try {
-          const projectClaudeMd = join6(config.configDir, agent.code_name, "project", "CLAUDE.md");
-          const existing = readFileSync5(projectClaudeMd, "utf-8");
+          const projectClaudeMd = join8(config.configDir, agent.code_name, "project", "CLAUDE.md");
+          const existing = readFileSync9(projectClaudeMd, "utf-8");
           existingHash = sha256(stripDynamicSections(existing));
         } catch {
           existingHash = null;
@@ -4782,7 +5917,7 @@ async function processAgent(agent, agentStates) {
         const generatorKeys = Object.keys(generatorServers);
         let existingRaw = "";
         try {
-          existingRaw = readFileSync5(filePath, "utf-8");
+          existingRaw = readFileSync9(filePath, "utf-8");
         } catch {
         }
         const existingServers = parseMcp(existingRaw);
@@ -4804,22 +5939,26 @@ async function processAgent(agent, agentStates) {
       }
     }
     if (changedFiles.length > 0) {
-      const isFirst = !existsSync4(join6(agentDir, "CHARTER.md"));
+      const isFirst = !existsSync5(join8(agentDir, "CHARTER.md"));
       const verb = isFirst ? "Provisioning" : "Updating";
       const fileNames = changedFiles.map((f) => f.relativePath).join(", ");
       log(`${verb} '${agent.code_name}': ${fileNames}`);
       for (const file of changedFiles) {
-        const filePath = join6(agentDir, file.relativePath);
-        mkdirSync2(dirname(filePath), { recursive: true });
-        writeFileSync3(filePath, file.content);
+        const filePath = join8(agentDir, file.relativePath);
+        mkdirSync4(dirname3(filePath), { recursive: true });
+        if (file.relativePath === ".mcp.json") {
+          safeWriteJsonAtomic(filePath, file.content, { mode: 384 });
+        } else {
+          writeFileSync4(filePath, file.content);
+        }
       }
       try {
-        const provSkillsDir = join6(agentDir, ".claude", "skills");
-        if (existsSync4(provSkillsDir)) {
-          for (const folder of readdirSync3(provSkillsDir)) {
+        const provSkillsDir = join8(agentDir, ".claude", "skills");
+        if (existsSync5(provSkillsDir)) {
+          for (const folder of readdirSync4(provSkillsDir)) {
             if (folder.startsWith("knowledge-")) {
               try {
-                rmSync2(join6(provSkillsDir, folder), { recursive: true });
+                rmSync2(join8(provSkillsDir, folder), { recursive: true });
               } catch {
               }
             }
@@ -4832,7 +5971,7 @@ async function processAgent(agent, agentStates) {
       const trackedFiles2 = frameworkAdapter.driftTrackedFiles();
       const hashes = /* @__PURE__ */ new Map();
       for (const file of trackedFiles2) {
-        const h = hashFile(join6(agentDir, file));
+        const h = hashFile(join8(agentDir, file));
         if (h) hashes.set(file, h);
       }
       agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -4897,10 +6036,10 @@ async function processAgent(agent, agentStates) {
   }
   let lastDriftCheckAt = now;
   const written = agentState.writtenHashes.get(agent.agent_id);
-  if (written && existsSync4(agentDir)) {
+  if (written && existsSync5(agentDir)) {
     const driftedFiles = [];
     for (const [file, expectedHash] of written) {
-      const localHash = hashFile(join6(agentDir, file));
+      const localHash = hashFile(join8(agentDir, file));
       if (localHash && localHash !== expectedHash) {
         driftedFiles.push(file);
       }
@@ -4911,7 +6050,7 @@ async function processAgent(agent, agentStates) {
       try {
         const localHashes = {};
         for (const file of driftedFiles) {
-          localHashes[file] = hashFile(join6(agentDir, file));
+          localHashes[file] = hashFile(join8(agentDir, file));
         }
         await api.post("/host/drift", {
           agent_id: agent.agent_id,
@@ -4949,6 +6088,14 @@ async function processAgent(agent, agentStates) {
   if (refreshData.channel_configs && frameworkAdapter.writeChannelCredentials) {
     if (agent.status === "active") {
       for (const [channelId, entry] of Object.entries(refreshData.channel_configs)) {
+        if (quarantinedChannels.has(channelId)) {
+          try {
+            frameworkAdapter.removeChannelCredentials?.(agent.code_name, channelId);
+          } catch (err) {
+            log(`[channel-quarantine] failed to drop quarantined channel '${agent.code_name}/${channelId}' from .mcp.json: ${err.message}`);
+          }
+          continue;
+        }
         if ((entry.status === "active" || entry.status === "pending") && entry.config) {
           if (!activeChannels.has(channelId)) {
             activeChannels.set(channelId, /* @__PURE__ */ new Set());
@@ -4975,14 +6122,16 @@ async function processAgent(agent, agentStates) {
           } : void 0;
           const peersForHash = channelId === "telegram" ? extractCharterTelegramPeers(refreshData.charter?.raw_content ?? "", gateContext) : channelId === "slack" ? extractCharterSlackPeers(refreshData.charter?.raw_content ?? "", gateContext) : null;
           const sessionModeForHash = refreshData.agent.session_mode;
-          const CHANNEL_WRITE_VERSION = 5;
+          const senderPolicyForHash = refreshData.sender_policy ?? null;
+          const CHANNEL_WRITE_VERSION = 9;
           const configHash = createHash3("sha256").update(
             canonicalJson({
               writeVersion: CHANNEL_WRITE_VERSION,
               config: entry.config,
               team: teamSettingsForHash,
               peers: peersForHash,
-              sessionMode: sessionModeForHash ?? null
+              sessionMode: sessionModeForHash ?? null,
+              senderPolicy: senderPolicyForHash
             })
           ).digest("hex");
           const cacheKey = `${agent.agent_id}:${channelId}`;
@@ -5008,6 +6157,7 @@ async function processAgent(agent, agentStates) {
             const telegramPeerDisabled = channelId === "telegram" ? peerDisabledMode === "all" : void 0;
             const telegramPeers = channelId === "telegram" ? extractCharterTelegramPeers(refreshData.charter?.raw_content ?? "", gateContext) : void 0;
             const slackPeers = channelId === "slack" ? extractCharterSlackPeers(refreshData.charter?.raw_content ?? "", gateContext) : void 0;
+            const senderPolicyForCall = channelId === "slack" || channelId === "msteams" ? refreshData.sender_policy ?? void 0 : void 0;
             frameworkAdapter.writeChannelCredentials(
               agent.code_name,
               channelId,
@@ -5019,7 +6169,8 @@ async function processAgent(agent, agentStates) {
                 peerDisabled,
                 telegramPeers,
                 slackPeers,
-                agentTimezone
+                agentTimezone,
+                senderPolicy: senderPolicyForCall
               }
             );
             agentState.knownChannelConfigHashes.set(cacheKey, configHash);
@@ -5051,7 +6202,14 @@ async function processAgent(agent, agentStates) {
     framework: agentFrameworkCache.get(agent.code_name) ?? "openclaw",
     sessionHealthy: isSessionHealthy(agent.code_name)
   }) : { restart: false, added: [], removed: [] };
-  if (restartDecision.restart) {
+  const quarantineOnlyRemoval = restartDecision.restart && restartDecision.added.length === 0 && restartDecision.removed.length > 0 && restartDecision.removed.every((c) => quarantinedChannels.has(c));
+  const channelSetRestartScheduled = restartDecision.restart && !quarantineOnlyRemoval;
+  if (quarantineOnlyRemoval) {
+    log(
+      `[channel-quarantine] suppressing channel-set-change restart for '${agent.code_name}' \u2014 only delta is quarantined-channel removal [${restartDecision.removed.join(", ")}] (0-restart-on-removal, ENG-5932)`
+    );
+  }
+  if (channelSetRestartScheduled) {
     const reasonParts = [];
     if (restartDecision.added.length > 0) reasonParts.push(`added=${restartDecision.added.join(",")}`);
     if (restartDecision.removed.length > 0) reasonParts.push(`removed=${restartDecision.removed.join(",")}`);
@@ -5065,45 +6223,188 @@ async function processAgent(agent, agentStates) {
     }
     scheduleSessionRestart(agent.code_name, delay, "new channel set");
   }
+  if (channelConfigConverged) {
+    const hasSenderPolicyChannel = currentChannelIds.has("slack") || currentChannelIds.has("msteams");
+    const senderPolicyForRestartHash = refreshData.sender_policy ?? null;
+    const senderPolicyHash = createHash3("sha256").update(canonicalJson({ senderPolicy: senderPolicyForRestartHash })).digest("hex");
+    const prevSenderPolicyHash = agentState.knownSenderPolicyHashes.get(agent.agent_id);
+    const senderPolicyDecision = hasSenderPolicyChannel ? decideSenderPolicyRestart({
+      previousHash: prevSenderPolicyHash,
+      currentHash: senderPolicyHash,
+      sessionMode: refreshData.agent.session_mode,
+      framework: agentFrameworkCache.get(agent.code_name) ?? "openclaw",
+      sessionHealthy: isSessionHealthy(agent.code_name),
+      channelSetRestartAlreadyScheduled: channelSetRestartScheduled
+    }) : { restart: false, firstPoll: prevSenderPolicyHash === void 0, changed: false };
+    if (senderPolicyDecision.restart) {
+      log(
+        `[hot-reload] sender_policy changed for '${agent.code_name}' (${prevSenderPolicyHash?.slice(0, 8) ?? "first"} \u2192 ${senderPolicyHash.slice(0, 8)}) \u2014 restarting session`
+      );
+      const notice = "Your sender_policy has been updated. Restarting session shortly so the channel MCP servers pick up the new gate.";
+      const delivered = await injectMessage(
+        agent.code_name,
+        "system",
+        notice,
+        { task_name: "sender-policy-update" },
+        log
+      ).catch(() => false);
+      const delay = delivered ? 8e3 : 3e3;
+      if (!delivered) {
+        log(
+          `[hot-reload] Inject notification unconfirmed for '${agent.code_name}' \u2014 proceeding with shorter delay`
+        );
+      }
+      scheduleSessionRestart(
+        agent.code_name,
+        delay,
+        "sender_policy change",
+        "sender-policy-change"
+      );
+    }
+    agentState.knownSenderPolicyHashes.set(agent.agent_id, senderPolicyHash);
+    let msteamsBehaviourRestartScheduled = false;
+    if (currentChannelIds.has("msteams")) {
+      const msteamsEntry = refreshData.channel_configs?.["msteams"];
+      const behaviourSubset = extractMsTeamsBehaviourSubset(
+        msteamsEntry?.config
+      );
+      const behaviourHash = createHash3("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
+      const prevBehaviourHash = agentState.knownMsTeamsBehaviourHashes.get(agent.agent_id);
+      const behaviourDecision = decideSenderPolicyRestart({
+        previousHash: prevBehaviourHash,
+        currentHash: behaviourHash,
+        sessionMode: refreshData.agent.session_mode,
+        framework: agentFrameworkCache.get(agent.code_name) ?? "openclaw",
+        sessionHealthy: isSessionHealthy(agent.code_name),
+        // A channel-set or sender-policy restart scheduled this tick will
+        // respawn the MCP children with the freshly-written env for free.
+        channelSetRestartAlreadyScheduled: channelSetRestartScheduled || senderPolicyDecision.restart
+      });
+      if (behaviourDecision.restart) {
+        log(
+          `[hot-reload] msteams behaviour settings changed for '${agent.code_name}' (${prevBehaviourHash?.slice(0, 8) ?? "first"} \u2192 ${behaviourHash.slice(0, 8)}) \u2014 restarting session`
+        );
+        const behaviourNotice = "Your Microsoft Teams channel behaviour settings were updated. Restarting session shortly so the teams-channel MCP picks up the new configuration.";
+        const behaviourDelivered = await injectMessage(
+          agent.code_name,
+          "system",
+          behaviourNotice,
+          { task_name: "channel-update" },
+          log
+        ).catch(() => false);
+        const behaviourDelay = behaviourDelivered ? 8e3 : 3e3;
+        if (!behaviourDelivered) {
+          log(
+            `[hot-reload] Inject notification unconfirmed for '${agent.code_name}' \u2014 proceeding with shorter delay`
+          );
+        }
+        scheduleSessionRestart(
+          agent.code_name,
+          behaviourDelay,
+          "msteams behaviour change",
+          "channel-behaviour-change"
+        );
+        msteamsBehaviourRestartScheduled = true;
+      }
+      agentState.knownMsTeamsBehaviourHashes.set(agent.agent_id, behaviourHash);
+    } else {
+      agentState.knownMsTeamsBehaviourHashes.delete(agent.agent_id);
+    }
+    if (currentChannelIds.has("slack")) {
+      const slackEntry = refreshData.channel_configs?.["slack"];
+      const slackBehaviourSubset = extractSlackBehaviourSubset(
+        slackEntry?.config
+      );
+      const slackBehaviourHash = createHash3("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
+      const prevSlackBehaviourHash = agentState.knownSlackBehaviourHashes.get(agent.agent_id);
+      const slackBehaviourDecision = decideSenderPolicyRestart({
+        previousHash: prevSlackBehaviourHash,
+        currentHash: slackBehaviourHash,
+        sessionMode: refreshData.agent.session_mode,
+        framework: agentFrameworkCache.get(agent.code_name) ?? "openclaw",
+        sessionHealthy: isSessionHealthy(agent.code_name),
+        // A channel-set, sender-policy, or msteams-behaviour restart
+        // scheduled this tick respawns the MCP children with the
+        // freshly-written env for free.
+        channelSetRestartAlreadyScheduled: channelSetRestartScheduled || senderPolicyDecision.restart || msteamsBehaviourRestartScheduled
+      });
+      if (slackBehaviourDecision.restart) {
+        log(
+          `[hot-reload] slack behaviour settings changed for '${agent.code_name}' (${prevSlackBehaviourHash?.slice(0, 8) ?? "first"} \u2192 ${slackBehaviourHash.slice(0, 8)}) \u2014 restarting session`
+        );
+        const slackBehaviourNotice = "Your Slack channel behaviour settings were updated. Restarting session shortly so the slack-channel MCP picks up the new configuration.";
+        const slackBehaviourDelivered = await injectMessage(
+          agent.code_name,
+          "system",
+          slackBehaviourNotice,
+          { task_name: "channel-update" },
+          log
+        ).catch(() => false);
+        const slackBehaviourDelay = slackBehaviourDelivered ? 8e3 : 3e3;
+        if (!slackBehaviourDelivered) {
+          log(
+            `[hot-reload] Inject notification unconfirmed for '${agent.code_name}' \u2014 proceeding with shorter delay`
+          );
+        }
+        scheduleSessionRestart(
+          agent.code_name,
+          slackBehaviourDelay,
+          "slack behaviour change",
+          "channel-behaviour-change"
+        );
+      }
+      agentState.knownSlackBehaviourHashes.set(agent.agent_id, slackBehaviourHash);
+    } else {
+      agentState.knownSlackBehaviourHashes.delete(agent.agent_id);
+    }
+  }
   const agentSessionMode = refreshData.agent.session_mode;
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? "openclaw") === "claude-code") {
     try {
       const agentProvisionDir = agentDir;
-      const projectDir = join6(homedir4(), ".augmented", agent.code_name, "project");
-      mkdirSync2(agentProvisionDir, { recursive: true });
-      mkdirSync2(projectDir, { recursive: true });
-      const provisionMcpPath = join6(agentProvisionDir, ".mcp.json");
-      const projectMcpPath = join6(projectDir, ".mcp.json");
+      const projectDir = join8(homedir4(), ".augmented", agent.code_name, "project");
+      mkdirSync4(agentProvisionDir, { recursive: true });
+      mkdirSync4(projectDir, { recursive: true });
+      const provisionMcpPath = join8(agentProvisionDir, ".mcp.json");
+      const projectMcpPath = join8(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
       try {
-        mcpConfig = JSON.parse(readFileSync5(provisionMcpPath, "utf-8"));
+        mcpConfig = JSON.parse(readFileSync9(provisionMcpPath, "utf-8"));
         if (!mcpConfig.mcpServers) mcpConfig.mcpServers = {};
       } catch {
       }
-      const localDirectChatChannel = join6(homedir4(), ".augmented", "_mcp", "direct-chat-channel.js");
+      const localDirectChatChannel = join8(homedir4(), ".augmented", "_mcp", "direct-chat-channel.js");
       const directChatTeamSettings = refreshData.team?.settings;
       const directChatTz = (() => {
         const tz = directChatTeamSettings?.["timezone"];
         return typeof tz === "string" && tz.trim() !== "" ? tz.trim() : void 0;
       })();
-      if (existsSync4(localDirectChatChannel) && !mcpConfig.mcpServers["direct-chat"]) {
-        mcpConfig.mcpServers["direct-chat"] = {
+      if (existsSync5(localDirectChatChannel)) {
+        const directChatEnv = {
+          AGT_HOST: requireHost(),
+          // ENG-5901 Track D: templated — the manager exports the real
+          // AGT_API_KEY to every spawn env (getApiKey()); Claude Code
+          // substitutes at MCP-launch. No literal in .mcp.json.
+          AGT_API_KEY: "${AGT_API_KEY}",
+          AGT_AGENT_ID: agent.agent_id
+        };
+        if (directChatTz) directChatEnv["TZ"] = directChatTz;
+        if (!frameworkAdapter.writeMcpServer) {
+          throw new Error(
+            `[direct-chat] Framework '${frameworkAdapter.id}' must implement writeMcpServer for direct-chat provisioning (agent=${agent.code_name}, cachedFramework=${agentFrameworkCache.get(agent.code_name) ?? "openclaw"})`
+          );
+        }
+        frameworkAdapter.writeMcpServer(agent.code_name, "direct-chat", {
           command: "node",
           args: [localDirectChatChannel],
-          env: {
-            AGT_HOST: requireHost(),
-            AGT_API_KEY: getApiKey() ?? "",
-            AGT_AGENT_ID: agent.agent_id,
-            ...directChatTz ? { TZ: directChatTz } : {}
-          }
-        };
-        const serialized = JSON.stringify(mcpConfig, null, 2);
-        writeFileSync3(provisionMcpPath, serialized);
-        writeFileSync3(projectMcpPath, serialized);
-        log(`Channel credentials written for '${agent.code_name}/direct-chat'`);
+          env: directChatEnv
+        });
+        if (!mcpConfig.mcpServers["direct-chat"]) {
+          log(`Channel credentials written for '${agent.code_name}/direct-chat'`);
+        }
       }
-      const staleChannelsPath = join6(projectDir, ".mcp-channels.json");
-      if (existsSync4(staleChannelsPath)) {
+      const staleChannelsPath = join8(projectDir, ".mcp-channels.json");
+      if (existsSync5(staleChannelsPath)) {
         try {
           rmSync2(staleChannelsPath, { force: true });
         } catch {
@@ -5113,7 +6414,7 @@ async function processAgent(agent, agentStates) {
       log(`Failed to provision direct-chat channel for '${agent.code_name}': ${err.message}`);
     }
   }
-  let lastSecretsProvisionAt = state4.agents.find((a) => a.agentId === agent.agent_id)?.lastSecretsProvisionAt ?? null;
+  let lastSecretsProvisionAt = state5.agents.find((a) => a.agentId === agent.agent_id)?.lastSecretsProvisionAt ?? null;
   let secretsHash = agentState.knownSecretsHashes.get(agent.agent_id) ?? null;
   try {
     const secretsData = await api.post("/host/secrets", { agent_id: agent.agent_id });
@@ -5167,7 +6468,7 @@ async function processAgent(agent, agentStates) {
     }
     if (process.env.AGT_CONNECTIVITY_PROBE_ENABLED === "true") {
       try {
-        const probeProjectDir = join6(homedir4(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join8(homedir4(), ".augmented", agent.code_name, "project");
         await runAgentConnectivityProbes(agent, integrations, probeProjectDir);
       } catch (err) {
         log(`Connectivity probe failed for '${agent.code_name}': ${err.message}`);
@@ -5177,11 +6478,11 @@ async function processAgent(agent, agentStates) {
       const intHash = computeIntegrationsHash(integrations);
       const prevIntHash = agentState.knownIntegrationHashes.get(agent.agent_id);
       if (intHash !== prevIntHash) {
-        const projectDir = join6(homedir4(), ".augmented", agent.code_name, "project");
-        const envIntPath = join6(projectDir, ".env.integrations");
+        const projectDir = join8(homedir4(), ".augmented", agent.code_name, "project");
+        const envIntPath = join8(projectDir, ".env.integrations");
         let preWriteEnv;
         try {
-          preWriteEnv = readFileSync5(envIntPath, "utf-8");
+          preWriteEnv = readFileSync9(envIntPath, "utf-8");
         } catch {
           preWriteEnv = void 0;
         }
@@ -5193,9 +6494,9 @@ async function processAgent(agent, agentStates) {
         let rotationHandled = true;
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
-            const projectMcpPath = join6(projectDir, ".mcp.json");
-            const postWriteEnv = readFileSync5(envIntPath, "utf-8");
-            const mcpContent = readFileSync5(projectMcpPath, "utf-8");
+            const projectMcpPath = join8(projectDir, ".mcp.json");
+            const postWriteEnv = readFileSync9(envIntPath, "utf-8");
+            const mcpContent = readFileSync9(projectMcpPath, "utf-8");
             const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
             const mcpJsonForReap = JSON.parse(mcpContent);
             const affectedServerKeys = findMcpServersUsingVars(mcpJsonForReap, changedVars);
@@ -5263,8 +6564,8 @@ async function processAgent(agent, agentStates) {
             const mcpPath = frameworkAdapter.getMcpPath(agent.code_name);
             if (mcpPath) {
               try {
-                const { readFileSync: readFileSync6 } = await import("fs");
-                const mcpConfig = JSON.parse(readFileSync6(mcpPath, "utf-8"));
+                const { readFileSync: readFileSync10 } = await import("fs");
+                const mcpConfig = JSON.parse(readFileSync10(mcpPath, "utf-8"));
                 if (mcpConfig.mcpServers) {
                   const managedPrefixes = [
                     "composio_",
@@ -5360,8 +6661,8 @@ async function processAgent(agent, agentStates) {
   if (agent.status === "active") {
     if (frameworkAdapter.installPlugin) {
       try {
-        const pluginPath = join6(process.cwd(), "packages", "openclaw-plugin-augmented", "src", "index.ts");
-        if (existsSync4(pluginPath)) {
+        const pluginPath = join8(process.cwd(), "packages", "openclaw-plugin-augmented", "src", "index.ts");
+        if (existsSync5(pluginPath)) {
           frameworkAdapter.installPlugin(agent.code_name, "augmented", pluginPath, {
             agtHost: requireHost(),
             agtApiKey: getApiKey() ?? void 0,
@@ -5426,25 +6727,25 @@ async function processAgent(agent, agentStates) {
         }
       }
       try {
-        const { readdirSync: readdirSync4, rmSync: rmSync3 } = await import("fs");
+        const { readdirSync: readdirSync5, rmSync: rmSync3 } = await import("fs");
         const { homedir: homedir5 } = await import("os");
         const frameworkId2 = frameworkAdapter.id;
         const candidateSkillDirs = [
           // Claude Code — framework runtime tree
-          join6(homedir5(), ".augmented", agent.code_name, "skills"),
+          join8(homedir5(), ".augmented", agent.code_name, "skills"),
           // Claude Code — project tree
-          join6(homedir5(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+          join8(homedir5(), ".augmented", agent.code_name, "project", ".claude", "skills"),
           // OpenClaw — framework runtime tree
-          join6(homedir5(), `.openclaw-${agent.code_name}`, "skills"),
+          join8(homedir5(), `.openclaw-${agent.code_name}`, "skills"),
           // Defensive: legacy provision-side path, not currently an
           // install target but cheap to sweep.
-          join6(agentDir, ".claude", "skills")
+          join8(agentDir, ".claude", "skills")
         ];
-        const existingDirs = candidateSkillDirs.filter((d) => existsSync4(d));
+        const existingDirs = candidateSkillDirs.filter((d) => existsSync5(d));
         const discoveredEntries = /* @__PURE__ */ new Set();
         for (const dir of existingDirs) {
           try {
-            for (const entry of readdirSync4(dir)) {
+            for (const entry of readdirSync5(dir)) {
               if (entry.startsWith("plugin-") || entry.startsWith("integration-")) {
                 discoveredEntries.add(entry);
               }
@@ -5454,8 +6755,8 @@ async function processAgent(agent, agentStates) {
         }
         const removeSkillFolder = (entry, reason) => {
           for (const dir of existingDirs) {
-            const p = join6(dir, entry);
-            if (existsSync4(p)) {
+            const p = join8(dir, entry);
+            if (existsSync5(p)) {
               rmSync3(p, { recursive: true, force: true });
             }
           }
@@ -5612,12 +6913,19 @@ async function processAgent(agent, agentStates) {
     } catch (err) {
       log(`[hot-reload] .mcp.json drift check failed for '${agent.code_name}': ${err.message}`);
     }
+    if (channelConfigConverged) {
+      try {
+        checkChannelSecretDriftAndScheduleRestart(agent.code_name, getProjectDir(agent.code_name));
+      } catch (err) {
+        log(`[hot-reload] channel-secret drift check failed for '${agent.code_name}': ${err.message}`);
+      }
+    }
     try {
       const sess = getSessionState(agent.code_name);
       let mcpJsonParsed = null;
       try {
-        const mcpPath = join6(getProjectDir(agent.code_name), ".mcp.json");
-        mcpJsonParsed = JSON.parse(readFileSync5(mcpPath, "utf-8"));
+        const mcpPath = join8(getProjectDir(agent.code_name), ".mcp.json");
+        mcpJsonParsed = JSON.parse(readFileSync9(mcpPath, "utf-8"));
       } catch {
       }
       reapMissingMcpSessions({
@@ -5688,6 +6996,37 @@ async function processAgent(agent, agentStates) {
               `[mcp-presence-reaper] failed to record restart event for '${codeName}' (ENG-5286): ${err.message} \u2014 local restart still proceeded; CloudWatch metric will under-count this event`
             );
           });
+        },
+        // ENG-5932: classify each declared key for the quarantine path. Reads a
+        // server-declared criticality field off the .mcp.json entry when
+        // present (Slice 2 will stamp it); otherwise fails closed to ESSENTIAL
+        // for everything except the known optional channel set. Tool servers
+        // (composio_*/xero) classify ESSENTIAL here and stay on the existing
+        // managed-toolkit onGiveUp path above.
+        classifyKey: (serverKey) => classifyChannelCriticality(
+          serverKey,
+          mcpJsonParsed?.mcpServers?.[serverKey]
+        ),
+        quarantineDwellMs: channelQuarantineDwellMs(),
+        quarantineMode: channelQuarantineMode(),
+        // ENG-5932: enforce-mode quarantine. Persist the local marker; the next
+        // provisioning poll then omits the channel from .mcp.json + the launch
+        // flags, and the channel-set-change / .mcp.json-drift restart paths are
+        // taught to NOT bounce the session for a quarantine-driven removal.
+        // Local-authoritative: no API call — with the control plane down, the
+        // flap still stops.
+        onQuarantine: (codeName, serverKey) => {
+          const newly = channelQuarantineStore().quarantine(
+            codeName,
+            serverKey,
+            `mcp-presence-reaper: optional channel dead past restart budget + dwell`,
+            Date.now()
+          );
+          if (newly) {
+            log(
+              `[channel-quarantine] persisted quarantine marker for '${codeName}:${serverKey}' \u2014 will be dropped from .mcp.json on next provisioning poll (ENG-5932)`
+            );
+          }
         }
       });
     } catch (err) {
@@ -5771,10 +7110,10 @@ async function processAgent(agent, agentStates) {
         lastWorkTriggerAt.set(agent.code_name, triggerTs);
         if (agentFw === "openclaw" && gatewayRunning && gatewayPort) {
           const homeDir = process.env["HOME"] ?? "/tmp";
-          const jobsPath = join6(homeDir, `.openclaw-${agent.code_name}`, "cron", "jobs.json");
-          if (existsSync4(jobsPath)) {
+          const jobsPath = join8(homeDir, `.openclaw-${agent.code_name}`, "cron", "jobs.json");
+          if (existsSync5(jobsPath)) {
             try {
-              const jobsData = JSON.parse(readFileSync5(jobsPath, "utf-8"));
+              const jobsData = JSON.parse(readFileSync9(jobsPath, "utf-8"));
               const kanbanJob = (jobsData.jobs ?? []).find(
                 (j) => typeof j.name === "string" && j.name.includes("kanban-work")
               );
@@ -5908,10 +7247,10 @@ In progress for ${age} minutes \u2014 auto-failed`).catch(() => {
     }
   }
   const trackedFiles = frameworkAdapter.driftTrackedFiles();
-  if (trackedFiles.length > 0 && existsSync4(agentDir)) {
+  if (trackedFiles.length > 0 && existsSync5(agentDir)) {
     const hashes = /* @__PURE__ */ new Map();
     for (const file of trackedFiles) {
-      const h = hashFile(join6(agentDir, file));
+      const h = hashFile(join8(agentDir, file));
       if (h) hashes.set(file, h);
     }
     agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -5945,19 +7284,19 @@ function cleanupStaleSessions(codeName) {
   lastCleanupAt.set(codeName, Date.now());
   const homeDir = process.env["HOME"] ?? "/tmp";
   for (const agentDir of ["main", codeName]) {
-    const sessionsDir = join6(homeDir, `.openclaw-${codeName}`, "agents", agentDir, "sessions");
+    const sessionsDir = join8(homeDir, `.openclaw-${codeName}`, "agents", agentDir, "sessions");
     cleanupCronSessions(sessionsDir, CRON_SESSION_KEEP_COUNT);
   }
-  const cronRunsDir = join6(homeDir, `.openclaw-${codeName}`, "cron", "runs");
+  const cronRunsDir = join8(homeDir, `.openclaw-${codeName}`, "cron", "runs");
   cleanupOldFiles(cronRunsDir, CRON_RUN_RETENTION_DAYS, ".jsonl");
-  const cronJobsPath = join6(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
+  const cronJobsPath = join8(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
   clearStaleCronRunState(cronJobsPath);
 }
 function cleanupCronSessions(sessionsDir, keepCount) {
-  const indexPath = join6(sessionsDir, "sessions.json");
-  if (!existsSync4(indexPath)) return;
+  const indexPath = join8(sessionsDir, "sessions.json");
+  if (!existsSync5(indexPath)) return;
   try {
-    const raw = readFileSync5(indexPath, "utf-8");
+    const raw = readFileSync9(indexPath, "utf-8");
     const index = JSON.parse(raw);
     const cronRunKeys = Object.keys(index).filter((k) => k.includes(":cron:") && k.includes(":run:")).map((k) => ({
       key: k,
@@ -5970,9 +7309,9 @@ function cleanupCronSessions(sessionsDir, keepCount) {
     for (const entry of toDelete) {
       delete index[entry.key];
       if (entry.sessionId) {
-        const sessionFile = join6(sessionsDir, `${entry.sessionId}.jsonl`);
+        const sessionFile = join8(sessionsDir, `${entry.sessionId}.jsonl`);
         try {
-          if (existsSync4(sessionFile)) {
+          if (existsSync5(sessionFile)) {
             unlinkSync(sessionFile);
             deletedFiles++;
           }
@@ -5992,8 +7331,8 @@ function cleanupCronSessions(sessionsDir, keepCount) {
         delete index[parentKey];
         if (parentSessionId) {
           try {
-            const f = join6(sessionsDir, `${parentSessionId}.jsonl`);
-            if (existsSync4(f)) {
+            const f = join8(sessionsDir, `${parentSessionId}.jsonl`);
+            if (existsSync5(f)) {
               unlinkSync(f);
               deletedFiles++;
             }
@@ -6002,7 +7341,7 @@ function cleanupCronSessions(sessionsDir, keepCount) {
         }
       }
     }
-    writeFileSync3(indexPath, JSON.stringify(index));
+    writeFileSync4(indexPath, JSON.stringify(index));
     if (toDelete.length > 0) {
       log(`Cleaned ${toDelete.length} cron session(s) and ${deletedFiles} file(s) from ${sessionsDir}`);
     }
@@ -6011,48 +7350,48 @@ function cleanupCronSessions(sessionsDir, keepCount) {
 }
 var STALE_RUN_TIMEOUT_MS = 5 * 6e4;
 function clearStaleCronRunState(jobsPath) {
-  if (!existsSync4(jobsPath)) return;
+  if (!existsSync5(jobsPath)) return;
   try {
-    const raw = readFileSync5(jobsPath, "utf-8");
+    const raw = readFileSync9(jobsPath, "utf-8");
     const data = JSON.parse(raw);
     const jobs = data.jobs ?? data;
     if (!Array.isArray(jobs)) return;
     let changed = false;
     const now = Date.now();
     for (const job of jobs) {
-      const state5 = job.state;
-      if (!state5) continue;
-      const runStartedAt = state5.runningAtMs ?? state5.runStartedAtMs;
-      const isRunning = state5.running === true || state5.status === "running";
+      const state6 = job.state;
+      if (!state6) continue;
+      const runStartedAt = state6.runningAtMs ?? state6.runStartedAtMs;
+      const isRunning = state6.running === true || state6.status === "running";
       if (isRunning && runStartedAt && now - runStartedAt > STALE_RUN_TIMEOUT_MS) {
-        state5.running = false;
-        delete state5.status;
-        delete state5.runStartedAtMs;
-        delete state5.currentRunId;
+        state6.running = false;
+        delete state6.status;
+        delete state6.runStartedAtMs;
+        delete state6.currentRunId;
         changed = true;
         log(`Cleared stale running state for cron job '${job.name}' (stuck for ${Math.round((now - runStartedAt) / 6e4)}min)`);
       } else if (isRunning && !runStartedAt) {
-        state5.running = false;
+        state6.running = false;
         changed = true;
         log(`Cleared stale running state for cron job '${job.name}' (no start timestamp)`);
       }
     }
     if (changed) {
-      writeFileSync3(jobsPath, JSON.stringify(data, null, 2));
+      writeFileSync4(jobsPath, JSON.stringify(data, null, 2));
     }
   } catch {
   }
 }
 function cleanupOldFiles(dir, maxAgeDays, ext) {
-  if (!existsSync4(dir)) return;
+  if (!existsSync5(dir)) return;
   const cutoff = Date.now() - maxAgeDays * 24 * 60 * 60 * 1e3;
   let removed = 0;
   try {
-    for (const f of readdirSync3(dir)) {
+    for (const f of readdirSync4(dir)) {
       if (!f.endsWith(ext)) continue;
-      const fullPath = join6(dir, f);
+      const fullPath = join8(dir, f);
       try {
-        const st = statSync2(fullPath);
+        const st = statSync3(fullPath);
         if (st.mtimeMs < cutoff) {
           unlinkSync(fullPath);
           removed++;
@@ -6069,6 +7408,25 @@ function cleanupOldFiles(dir, maxAgeDays, ext) {
 var inFlightClaudeTasks = /* @__PURE__ */ new Set();
 var claudeTaskConcurrency = /* @__PURE__ */ new Map();
 var MAX_CLAUDE_CONCURRENCY = 2;
+function claudePidFilePath() {
+  return join8(homedir4(), ".augmented", "manager-claude-pids.json");
+}
+var inFlightClaudePids = /* @__PURE__ */ new Map();
+function registerClaudeSpawn(record) {
+  inFlightClaudePids.set(record.pid, record);
+  try {
+    addSpawn(claudePidFilePath(), record);
+  } catch (err) {
+    log(`[drain] pid-file write failed: ${err.message}`);
+  }
+}
+function unregisterClaudeSpawn(pid) {
+  inFlightClaudePids.delete(pid);
+  try {
+    removeSpawn(claudePidFilePath(), pid);
+  } catch {
+  }
+}
 var claudeSchedulerStates = /* @__PURE__ */ new Map();
 async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
@@ -6096,16 +7454,16 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
       enabled: t.enabled ?? true,
       triggered_at: t.triggered_at ?? null
     }));
-    const state6 = syncTasksToScheduler(codeName, agent.agent_id, taskInputs);
-    claudeSchedulerStates.set(codeName, state6);
+    const state7 = syncTasksToScheduler(codeName, agent.agent_id, taskInputs);
+    claudeSchedulerStates.set(codeName, state7);
     agentState.knownTasksHashes.set(agent.agent_id, combinedHash);
     log(`[claude-scheduler] Tasks synced for '${codeName}' (${taskInputs.length} task(s))`);
   }
   if (!claudeSchedulerStates.has(codeName)) {
     claudeSchedulerStates.set(codeName, loadSchedulerState(codeName));
   }
-  const state5 = claudeSchedulerStates.get(codeName);
-  const ready = getReadyTasks(state5, inFlightClaudeTasks);
+  const state6 = claudeSchedulerStates.get(codeName);
+  const ready = getReadyTasks(state6, inFlightClaudeTasks);
   if (ready.length === 0) return;
   for (const task of ready) {
     if ((claudeTaskConcurrency.get(codeName) ?? 0) >= MAX_CLAUDE_CONCURRENCY) break;
@@ -6122,6 +7480,12 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
     }
     inFlightClaudeTasks.add(task.taskId);
     claudeTaskConcurrency.set(codeName, (claudeTaskConcurrency.get(codeName) ?? 0) + 1);
+    if (isScheduledViaKanbanEnabled() && isPlainScheduledTemplate(task.templateId)) {
+      await fireScheduledTaskViaKanban(codeName, agent.agent_id, task, prompt);
+      inFlightClaudeTasks.delete(task.taskId);
+      claudeTaskConcurrency.set(codeName, Math.max(0, (claudeTaskConcurrency.get(codeName) ?? 1) - 1));
+      continue;
+    }
     log(`[claude-scheduler] Firing '${task.name}' for '${codeName}'`);
     executeAndProcessClaudeTask(codeName, agent.agent_id, task, prompt).finally(() => {
       inFlightClaudeTasks.delete(task.taskId);
@@ -6129,6 +7493,19 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
     });
   }
 }
+function deriveScheduledTaskNotify(task) {
+  if (task.deliveryChannel !== "msteams") return {};
+  const to = task.deliveryTo;
+  let conversationId = null;
+  if (typeof to === "string" && to.trim().length > 0) {
+    conversationId = to.trim();
+  } else if (to && typeof to === "object") {
+    const cid = to.conversation_id;
+    if (typeof cid === "string" && cid.trim().length > 0) conversationId = cid.trim();
+  }
+  if (!conversationId) return {};
+  return { notify_channel: "msteams", notify_to: conversationId };
+}
 async function startRun(opts) {
   try {
     const res = await api.post(
@@ -6179,7 +7556,7 @@ async function fetchPriorScheduledRuns(agentId, taskId) {
 }
 function isScheduledViaKanbanEnabled() {
   const v = process.env["AGT_SCHEDULED_VIA_KANBAN"];
-  return v === "1" || v?.toLowerCase() === "true";
+  return !(v === "0" || v?.toLowerCase() === "false");
 }
 var scheduledRunsByCode = /* @__PURE__ */ new Map();
 var claimedScheduledCards = /* @__PURE__ */ new Set();
@@ -6246,8 +7623,8 @@ async function deliverScheduledCardResult(codeName, agentId, cardId) {
     markScheduledCardDeliveryComplete(cardId);
     return "terminal";
   }
-  const state5 = claudeSchedulerStates.get(codeName) ?? loadSchedulerState(codeName);
-  const task = state5.tasks[card.source_ref];
+  const state6 = claudeSchedulerStates.get(codeName) ?? loadSchedulerState(codeName);
+  const task = state6.tasks[card.source_ref];
   if (!task) {
     log(`[scheduled-kanban] delivery: no scheduler task for source_ref=${card.source_ref} on '${codeName}' \u2014 skipping`);
     markScheduledCardDeliveryComplete(cardId);
@@ -6297,7 +7674,8 @@ async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt) {
       title: task.name,
       description: prompt,
       priority: 2,
-      initial_status: "todo"
+      initial_status: "todo",
+      ...deriveScheduledTaskNotify(task)
     }
   });
   if (!run_id || !kanban_item_id) {
@@ -6306,6 +7684,7 @@ async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt) {
     return false;
   }
   const nudge = `You have a new scheduled task on your kanban board: id=${kanban_item_id} title=${JSON.stringify(task.name)}. Call kanban_move("${kanban_item_id}", "in_progress"), do the work described on the card, then write the finished result onto the card and mark it done. Do NOT send, post, or message the result to anyone yourself \u2014 recording it on the card is enough; delivery to the recipient is handled for you.
+If \u2014 and ONLY if \u2014 the task description contains explicit opt-out wording the user typed (e.g. "DO NOT notify me unless urgent", "only if X", "stay silent unless \u2026") and that condition is NOT met this run, write exactly \`${SUPPRESS_SENTINEL}\` ALONE as the card result (no other text, no "nothing urgent", no notes) and mark the card done \u2014 that tells the delivery pipeline to skip the send. A report with zero items ("nothing urgent", "no follow-ups", "all quiet") is still a valid deliverable when the task asks for a digest, NOT a reason to suppress \u2014 when in doubt, deliver.
 ` + formatRunMarker(run_id);
   let injectStatus;
   try {
@@ -6328,9 +7707,32 @@ async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt) {
   log(`[scheduled-kanban] Routed task '${task.name}' for '${codeName}' via todo card ${kanban_item_id} run_id=${run_id}`);
   return true;
 }
+async function fireScheduledTaskViaKanban(codeName, agentId, task, prompt) {
+  let routed = false;
+  try {
+    routed = await routeScheduledTaskViaKanban(codeName, agentId, task, prompt);
+  } catch (err) {
+    log(`[scheduled-kanban] route threw for '${task.name}' on '${codeName}': ${err.message}`);
+    routed = false;
+  }
+  try {
+    const updated = markTaskFired(codeName, task.taskId, routed ? "ok" : "error");
+    claudeSchedulerStates.set(codeName, updated);
+  } catch (err) {
+    log(`[scheduled-kanban] markTaskFired failed for '${task.name}' on '${codeName}': ${err.message}`);
+  }
+  if (task.scheduleKind === "at") {
+    try {
+      await api.post("/host/schedules/disable", { agent_id: agentId, task_id: task.taskId });
+    } catch (err) {
+      log(`[scheduled-kanban] Failed to disable one-off task '${task.name}': ${err.message}`);
+    }
+  }
+  return routed;
+}
 async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
   const projectDir = getProjectDir2(codeName);
-  const mcpConfigPath = join6(projectDir, ".mcp.json");
+  const mcpConfigPath = join8(projectDir, ".mcp.json");
   let runId = null;
   let kanbanItemId = null;
   let taskResult;
@@ -6338,11 +7740,11 @@ async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
   const priorRuns = await fetchPriorScheduledRuns(agentId, task.taskId);
   prompt = wrapScheduledTaskPrompt(prompt, { priorRuns });
   try {
-    const claudeMdPath = join6(projectDir, "CLAUDE.md");
+    const claudeMdPath = join8(projectDir, "CLAUDE.md");
     const serverNames = [];
-    if (existsSync4(mcpConfigPath)) {
+    if (existsSync5(mcpConfigPath)) {
       try {
-        const d = JSON.parse(readFileSync5(mcpConfigPath, "utf-8"));
+        const d = JSON.parse(readFileSync9(mcpConfigPath, "utf-8"));
         if (d.mcpServers) serverNames.push(...Object.keys(d.mcpServers));
       } catch {
       }
@@ -6361,18 +7763,14 @@ async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
       "--allowedTools",
       allowedTools
     ];
-    if (existsSync4(claudeMdPath)) {
+    if (existsSync5(claudeMdPath)) {
       claudeArgs.push("--system-prompt-file", claudeMdPath);
     }
     const childEnv = { ...process.env };
-    const envIntPath = join6(projectDir, ".env.integrations");
-    if (existsSync4(envIntPath)) {
+    const envIntPath = join8(projectDir, ".env.integrations");
+    if (existsSync5(envIntPath)) {
       try {
-        for (const line of readFileSync5(envIntPath, "utf-8").split("\n")) {
-          if (!line || line.startsWith("#") || !line.includes("=")) continue;
-          const eqIdx = line.indexOf("=");
-          childEnv[line.slice(0, eqIdx)] = line.slice(eqIdx + 1);
-        }
+        Object.assign(childEnv, parseEnvIntegrations(readFileSync9(envIntPath, "utf-8")));
       } catch {
       }
     }
@@ -6387,16 +7785,33 @@ async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
       source_type: "scheduled_task",
       source_ref: task.taskId,
       metadata: { template_id: task.templateId, name: task.name },
-      materialize_kanban: { title: task.name, priority: 2 }
+      materialize_kanban: { title: task.name, priority: 2, ...deriveScheduledTaskNotify(task) }
     });
     runId = startResult.run_id;
     kanbanItemId = startResult.kanban_item_id;
     if (runId) childEnv["AGT_RUN_ID"] = runId;
+    for (const f of probeMcpEnvSubstitution({
+      mcpConfigPath,
+      envIntegrationsPath: envIntPath,
+      baseEnv: childEnv
+    })) {
+      log(`[claude-scheduler] ${formatMissingVar(f)} agent=${codeName}`);
+    }
+    const claudeKind = task.templateId === "kanban-work" ? "kanban-work" : "scheduled-task";
     const { stdout, stderr } = await execFilePromiseLong(resolveClaudeBinary(), claudeArgs, {
       cwd: projectDir,
       timeout: 3e5,
       stdin: "ignore",
-      env: childEnv
+      env: childEnv,
+      onSpawn: (pid) => registerClaudeSpawn({
+        pid,
+        started_at: Date.now(),
+        kind: claudeKind,
+        agent_id: agentId,
+        agent_code_name: codeName,
+        kanban_card_id: kanbanItemId ?? void 0
+      }),
+      onExit: (pid) => unregisterClaudeSpawn(pid)
     });
     if (stderr) {
       log(`[claude-scheduler] Task '${task.name}' stderr for '${codeName}': ${stderr.slice(0, 500)}`);
@@ -6527,8 +7942,8 @@ var claudeAuthTupleBySession = /* @__PURE__ */ new Map();
 async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
   const projectDir = getProjectDir(codeName);
-  const mcpConfigPath = join6(projectDir, ".mcp.json");
-  const claudeMdPath = join6(projectDir, "CLAUDE.md");
+  const mcpConfigPath = join8(projectDir, ".mcp.json");
+  const claudeMdPath = join8(projectDir, "CLAUDE.md");
   if (restartBreaker.isTripped(codeName)) {
     const trip = restartBreaker.getTrip(codeName);
     return {
@@ -6544,23 +7959,11 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
     return typeof tz === "string" && tz.trim() !== "" ? tz.trim() : void 0;
   })();
   const channelConfigs = refreshData.channel_configs;
-  const channels = [];
-  const devChannels = [];
-  if (channelConfigs) {
-    const isChannelEnabled = (id) => {
-      const entry = channelConfigs[id];
-      return !!entry?.config && (entry.status === "active" || entry.status === "pending");
-    };
-    if (isChannelEnabled("slack")) {
-      devChannels.push("server:slack");
-    }
-    if (isChannelEnabled("telegram")) {
-      devChannels.push("server:telegram");
-    }
-    if (isChannelEnabled("discord")) {
-      channels.push("plugin:discord@claude-plugins-official");
-    }
-  }
+  const { devChannels, pluginChannels } = resolveChannelLaunchFlags(
+    channelConfigs,
+    channelQuarantineStore().getQuarantinedKeys(codeName)
+  );
+  const channels = [...pluginChannels];
   devChannels.push("server:direct-chat");
   let claudeAuthMode;
   let anthropicApiKey;
@@ -6767,9 +8170,9 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash3("sha256").
   } else if (!claudeSchedulerStates.has(codeName)) {
     claudeSchedulerStates.set(codeName, loadSchedulerState(codeName));
   }
-  const state5 = claudeSchedulerStates.get(codeName);
-  if (state5) {
-    const ready = getReadyTasks(state5, inFlightClaudeTasks);
+  const state6 = claudeSchedulerStates.get(codeName);
+  if (state6) {
+    const ready = getReadyTasks(state6, inFlightClaudeTasks);
     if (ready.length > 0) {
       log(`[persistent-session] ${ready.length} ready task(s) for '${codeName}': ${ready.map((t) => `${t.name}(next=${t.nextFireAt ? new Date(t.nextFireAt).toISOString() : "null"})`).join(", ")}`);
     }
@@ -6794,29 +8197,10 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash3("sha256").
       inFlightClaudeTasks.add(task.taskId);
       claudeTaskConcurrency.set(codeName, (claudeTaskConcurrency.get(codeName) ?? 0) + 1);
       if (isScheduledViaKanbanEnabled() && isPlainScheduledTemplate(task.templateId)) {
-        let routed = false;
-        try {
-          routed = await routeScheduledTaskViaKanban(codeName, agent.agent_id, task, prompt);
-        } catch (err) {
-          log(`[scheduled-kanban] route threw for '${task.name}' on '${codeName}': ${err.message}`);
-          routed = false;
-        }
-        if (routed) {
-          try {
-            const updated = markTaskFired(codeName, task.taskId, "ok");
-            claudeSchedulerStates.set(codeName, updated);
-          } catch (err) {
-            log(`[scheduled-kanban] markTaskFired failed for '${task.name}' on '${codeName}': ${err.message}`);
-          }
-          if (task.scheduleKind === "at") {
-            api.post("/host/schedules/disable", { agent_id: agent.agent_id, task_id: task.taskId }).catch(
-              (err) => log(`[scheduled-kanban] Failed to disable one-off task '${task.name}': ${err.message}`)
-            );
-          }
-          inFlightClaudeTasks.delete(task.taskId);
-          claudeTaskConcurrency.set(codeName, Math.max(0, (claudeTaskConcurrency.get(codeName) ?? 1) - 1));
-          break;
-        }
+        await fireScheduledTaskViaKanban(codeName, agent.agent_id, task, prompt);
+        inFlightClaudeTasks.delete(task.taskId);
+        claudeTaskConcurrency.set(codeName, Math.max(0, (claudeTaskConcurrency.get(codeName) ?? 1) - 1));
+        break;
       }
       log(`[persistent-session] Firing task '${task.name}' for '${codeName}' via claude -p`);
       executeAndProcessClaudeTask(codeName, agent.agent_id, task, prompt).catch(() => {
@@ -7123,6 +8507,9 @@ function triggerEarlyPoll(reason) {
   }, 0);
 }
 var directChatInFlight = /* @__PURE__ */ new Set();
+var directChatSpawnGate = new DirectChatSpawnGate({
+  hostMaxConcurrency: directChatHostConcurrency()
+});
 async function pollDirectChatMessages(agentStates) {
   for (const agent of agentStates) {
     if (agent.status !== "active") continue;
@@ -7143,8 +8530,21 @@ async function pollDirectChatMessages(agentStates) {
   }
 }
 async function processDirectChatMessage(agent, msg) {
+  noteInbound(agent.codeName);
   const fw = agentFrameworkCache.get(agent.codeName) ?? "openclaw";
   log(`[direct-chat] Processing message for '${agent.codeName}' (fw=${fw}): id=${msg.id} len=${msg.content.length}`);
+  if (isDirectChatMessageExpired(msg.created_at, Date.now(), directChatMaxAgeMs())) {
+    log(`[direct-chat] Expired backlog message for '${agent.codeName}' (msg=${msg.id}, created_at=${msg.created_at}) \u2014 draining without delivery`);
+    try {
+      await api.post("/host/direct-chat/reply", {
+        agent_id: agent.agentId,
+        session_id: msg.session_id,
+        content: "[Expired] This message timed out before it could be processed. Please resend it."
+      });
+    } catch {
+    }
+    return;
+  }
   if (isSessionHealthy(agent.codeName)) {
     const escapeXml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
     const channelEnvelope = `<channel source="direct-chat" session_id="${escapeXml(msg.session_id)}" user="webapp">
@@ -7163,16 +8563,31 @@ ${escapeXml(msg.content)}
     }
     log(`[direct-chat] Inject reported unverified for '${agent.codeName}' (msg=${msg.id}) \u2014 falling back to one-shot direct-chat handling`);
   }
+  let releaseSpawnSlot;
   try {
     let reply;
     if (fw === "claude-code") {
+      releaseSpawnSlot = await directChatSpawnGate.acquire(agent.codeName);
+      if (isDirectChatMessageExpired(msg.created_at, Date.now(), directChatMaxAgeMs())) {
+        log(`[direct-chat] Message for '${agent.codeName}' expired while queued behind the spawn gate (msg=${msg.id}) \u2014 draining without a spawn`);
+        try {
+          await api.post("/host/direct-chat/reply", {
+            agent_id: agent.agentId,
+            session_id: msg.session_id,
+            content: "[Expired] This message timed out before it could be processed. Please resend it."
+          });
+        } catch {
+        }
+        return;
+      }
+      log(`[direct-chat] One-shot spawn for '${agent.codeName}' (msg=${msg.id}; host in-flight=${directChatSpawnGate.hostInFlight}, queued=${directChatSpawnGate.queuedCount})`);
       const { getProjectDir: ccProjectDir } = await import("../claude-scheduler-EM24LTGV.js");
       const projDir = ccProjectDir(agent.codeName);
-      const mcpConfigPath = join6(projDir, ".mcp.json");
+      const mcpConfigPath = join8(projDir, ".mcp.json");
       const serverNames = [];
-      if (existsSync4(mcpConfigPath)) {
+      if (existsSync5(mcpConfigPath)) {
         try {
-          const d = JSON.parse(readFileSync5(mcpConfigPath, "utf-8"));
+          const d = JSON.parse(readFileSync9(mcpConfigPath, "utf-8"));
           if (d.mcpServers) serverNames.push(...Object.keys(d.mcpServers));
         } catch {
         }
@@ -7191,19 +8606,15 @@ ${escapeXml(msg.content)}
         "--allowedTools",
         allowedTools
       ];
-      const chatClaudeMd = join6(projDir, "CLAUDE.md");
-      if (existsSync4(chatClaudeMd)) {
+      const chatClaudeMd = join8(projDir, "CLAUDE.md");
+      if (existsSync5(chatClaudeMd)) {
         chatArgs.push("--system-prompt-file", chatClaudeMd);
       }
-      const envIntPath = join6(projDir, ".env.integrations");
+      const envIntPath = join8(projDir, ".env.integrations");
       const childEnv = { ...process.env };
-      if (existsSync4(envIntPath)) {
+      if (existsSync5(envIntPath)) {
         try {
-          for (const line of readFileSync5(envIntPath, "utf-8").split("\n")) {
-            if (!line || line.startsWith("#") || !line.includes("=")) continue;
-            const eqIdx = line.indexOf("=");
-            childEnv[line.slice(0, eqIdx)] = line.slice(eqIdx + 1);
-          }
+          Object.assign(childEnv, parseEnvIntegrations(readFileSync9(envIntPath, "utf-8")));
         } catch {
         }
       }
@@ -7212,7 +8623,26 @@ ${escapeXml(msg.content)}
       } catch (err) {
         throw new Error(`Auth resolve failed for '${agent.codeName}': ${err.message}`);
       }
-      const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), chatArgs, { cwd: projDir, stdin: "ignore", env: childEnv });
+      for (const f of probeMcpEnvSubstitution({
+        mcpConfigPath,
+        envIntegrationsPath: envIntPath,
+        baseEnv: childEnv
+      })) {
+        log(`[direct-chat] ${formatMissingVar(f)} agent=${agent.codeName}`);
+      }
+      const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), chatArgs, {
+        cwd: projDir,
+        stdin: "ignore",
+        env: childEnv,
+        onSpawn: (pid) => registerClaudeSpawn({
+          pid,
+          started_at: Date.now(),
+          kind: "direct-chat",
+          agent_id: agent.agentId,
+          agent_code_name: agent.codeName
+        }),
+        onExit: (pid) => unregisterClaudeSpawn(pid)
+      });
       reply = stdout.trim() || "[No response from agent]";
     } else {
       const { stdout } = await execFilePromiseLong("openclaw", [
@@ -7254,6 +8684,8 @@ ${escapeXml(msg.content)}
       });
     } catch {
     }
+  } finally {
+    releaseSpawnSlot?.();
   }
 }
 var STANDUP_TEMPLATES = /* @__PURE__ */ new Set(["daily-standup", "end-of-day-summary"]);
@@ -7560,12 +8992,12 @@ function getBuiltInSkillContent(skillId) {
   if (builtInSkillCache.has(skillId)) return builtInSkillCache.get(skillId);
   try {
     const candidates = [
-      join6(process.cwd(), "skills", skillId, "SKILL.md"),
-      join6(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "skills", skillId, "SKILL.md")
+      join8(process.cwd(), "skills", skillId, "SKILL.md"),
+      join8(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "skills", skillId, "SKILL.md")
     ];
     for (const candidate of candidates) {
-      if (existsSync4(candidate)) {
-        const content = readFileSync5(candidate, "utf-8");
+      if (existsSync5(candidate)) {
+        const content = readFileSync9(candidate, "utf-8");
         const files = [{ relativePath: "SKILL.md", content }];
         builtInSkillCache.set(skillId, files);
         return files;
@@ -7678,10 +9110,10 @@ function formatBoardForPrompt(items, template) {
     lines.push("=========================");
     lines.push("");
     lines.push("IMPORTANT: Use kanban MCP tools to update the board IN REAL TIME:");
-    lines.push("1. FIRST call kanban.move to move your chosen item to in_progress BEFORE starting work");
+    lines.push("1. FIRST call kanban_move to move your chosen item to in_progress BEFORE starting work");
     lines.push("2. Do the work");
-    lines.push("3. Call kanban.done with a result summary when finished");
-    lines.push("4. If blocked, call kanban.update with notes, then pick the next item");
+    lines.push("3. Call kanban_done with a result summary when finished");
+    lines.push("4. If blocked, call kanban_update with notes, then pick the next item");
     lines.push("");
     if (hasSourceThread) {
       lines.push("THREAD CONTINUITY: If a card shows a `source:` line, the request originated");
@@ -7692,8 +9124,8 @@ function formatBoardForPrompt(items, template) {
       lines.push("");
     }
     lines.push("SELF-MANAGEMENT: When you receive a request from a channel (Slack, Telegram)");
-    lines.push("that takes more than a quick response, create a task first with kanban.add,");
-    lines.push("move to in_progress, do the work, then kanban.done with a result summary.");
+    lines.push("that takes more than a quick response, create a task first with kanban_add,");
+    lines.push("move to in_progress, do the work, then kanban_done with a result summary.");
     lines.push("");
     lines.push("If MCP tools are unavailable, include a KANBAN UPDATE section in your output:");
     lines.push("KANBAN UPDATE:");
@@ -7736,6 +9168,12 @@ async function execFilePromiseLong(cmd, args, opts) {
       stdio: [opts?.stdin === "ignore" ? "ignore" : "pipe", "pipe", "pipe"],
       ...opts?.env ? { env: opts.env } : {}
     });
+    if (opts?.onSpawn && typeof child.pid === "number") {
+      try {
+        opts.onSpawn(child.pid);
+      } catch {
+      }
+    }
     let stdout = "";
     let stderr = "";
     child.stdout?.on("data", (d) => {
@@ -7750,6 +9188,12 @@ async function execFilePromiseLong(cmd, args, opts) {
     }, opts?.timeout ?? 12e4);
     child.on("close", (code) => {
       clearTimeout(timer);
+      if (opts?.onExit && typeof child.pid === "number") {
+        try {
+          opts.onExit(child.pid);
+        } catch {
+        }
+      }
       if (code !== 0) reject(new ChildProcessError(code, stdout, stderr));
       else resolve({ stdout, stderr });
     });
@@ -7912,7 +9356,7 @@ async function postSlackChannelMessage(agentCodeName, channelId, text, threadTs)
       const data = await response.json();
       if (!data.ok) {
         log(`Slack chat.postMessage failed for '${agentCodeName}' to ${channelId}: ${data.error}`);
-        return { ok: false };
+        return { ok: false, error: data.error };
       }
       return { ok: true, ts: data.ts };
     } finally {
@@ -7994,14 +9438,26 @@ async function deliverScheduledTaskOutput(agentCodeName, agentId, rawTarget, bod
   if (parsed.kind === "channel") {
     if (parsed.provider === "slack") {
       const channelId = parsed.channel_id ?? "";
-      const sent = await postSlackChannelMessage(agentCodeName, channelId, withLink(body, "slack"));
+      const threadTs = parsed.thread_ts;
+      let sent = await postSlackChannelMessage(agentCodeName, channelId, withLink(body, "slack"), threadTs);
+      let deliveredInThread = Boolean(threadTs);
+      if (!sent.ok && threadTs && (sent.error === "thread_not_found" || sent.error === "message_not_found")) {
+        log(`[delivery] Originating thread ${threadTs} gone in ${channelId} for '${agentCodeName}' \u2014 falling back to top-level post`);
+        sent = await postSlackChannelMessage(agentCodeName, channelId, withLink(body, "slack"));
+        deliveredInThread = false;
+      }
       await reportDeliveryStatus(agentId, taskId, {
         status: sent.ok ? "ok" : "failed",
         medium: "slack",
-        error_code: sent.ok ? null : "SLACK_SEND_FAILED"
+        // Preserve Slack's concrete failure code (channel_not_found,
+        // not_in_channel, auth errors, …) in the observability row rather
+        // than collapsing everything to the generic constant.
+        error_code: sent.ok ? null : sent.error ? `SLACK_SEND_FAILED:${sent.error}` : "SLACK_SEND_FAILED"
       });
       if (sent.ok) {
-        await maybePostSlackThreadHint(agentCodeName, channelId, sent.ts);
+        if (!deliveredInThread) {
+          await maybePostSlackThreadHint(agentCodeName, channelId, sent.ts);
+        }
         if (sent.ts && taskId) {
           await maybePostScheduledTaskRatingPrompt(agentId, taskId, channelId, sent.ts);
         }
@@ -8196,7 +9652,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-ZBQKBBMT.js");
+  } = await import("../claude-pair-runtime-F6USL3EW.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -8506,8 +9962,8 @@ function parseMemoryFile(raw, fallbackName) {
   };
 }
 async function syncMemories(agent, configDir, log2) {
-  const projectDir = join6(configDir, agent.code_name, "project");
-  const memoryDir = join6(projectDir, "memory");
+  const projectDir = join8(configDir, agent.code_name, "project");
+  const memoryDir = join8(projectDir, "memory");
   const isFreshSync = pendingFreshMemorySync.has(agent.agent_id);
   if (isFreshSync) {
     log2(`[memory-sync] Fresh-sync requested for '${agent.code_name}' \u2014 pulling DB first`);
@@ -8518,14 +9974,14 @@ async function syncMemories(agent, configDir, log2) {
     }
     pendingFreshMemorySync.delete(agent.agent_id);
   }
-  if (existsSync4(memoryDir)) {
+  if (existsSync5(memoryDir)) {
     const prevHashes = memoryFileHashes.get(agent.agent_id) ?? /* @__PURE__ */ new Map();
     const currentHashes = /* @__PURE__ */ new Map();
     const changedMemories = [];
-    for (const file of readdirSync3(memoryDir)) {
+    for (const file of readdirSync4(memoryDir)) {
       if (!file.endsWith(".md")) continue;
       try {
-        const raw = readFileSync5(join6(memoryDir, file), "utf-8");
+        const raw = readFileSync9(join8(memoryDir, file), "utf-8");
         const fileHash = createHash3("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
@@ -8550,7 +10006,7 @@ async function syncMemories(agent, configDir, log2) {
       } catch (err) {
         for (const mem of changedMemories) {
           for (const [file] of currentHashes) {
-            const parsed = parseMemoryFile(readFileSync5(join6(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
+            const parsed = parseMemoryFile(readFileSync9(join8(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
             if (parsed?.name === mem.name) currentHashes.delete(file);
           }
         }
@@ -8563,7 +10019,7 @@ async function syncMemories(agent, configDir, log2) {
   }
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
-  const localFiles = existsSync4(memoryDir) ? readdirSync3(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
+  const localFiles = existsSync5(memoryDir) ? readdirSync4(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
   const localListHash = createHash3("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
@@ -8578,14 +10034,14 @@ async function downloadMemories(agent, memoryDir, log2, { force }) {
     lastDownloadHash.set(agent.agent_id, responseHash);
     lastLocalFileHash.set(agent.agent_id, localListHash);
     if (dbMemories.memories?.length) {
-      mkdirSync2(memoryDir, { recursive: true });
+      mkdirSync4(memoryDir, { recursive: true });
       let written = 0;
       let overwritten = 0;
       for (let i = 0; i < dbMemories.memories.length; i++) {
         const mem = dbMemories.memories[i];
         const rawSlug = mem.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "").slice(0, 60);
         const slug = rawSlug || `memory-${i}`;
-        const filePath = join6(memoryDir, `${slug}.md`);
+        const filePath = join8(memoryDir, `${slug}.md`);
         const desired = `---
 name: ${JSON.stringify(mem.name)}
 type: ${mem.type}
@@ -8594,22 +10050,22 @@ description: ${JSON.stringify(mem.content.slice(0, 200))}
 
 ${mem.content}
 `;
-        if (existsSync4(filePath)) {
+        if (existsSync5(filePath)) {
           let existing = "";
           try {
-            existing = readFileSync5(filePath, "utf-8");
+            existing = readFileSync9(filePath, "utf-8");
           } catch {
           }
           if (existing === desired) continue;
-          writeFileSync3(filePath, desired);
+          writeFileSync4(filePath, desired);
           overwritten++;
         } else {
-          writeFileSync3(filePath, desired);
+          writeFileSync4(filePath, desired);
           written++;
         }
       }
       if (written > 0 || overwritten > 0) {
-        const updatedFiles = readdirSync3(memoryDir).filter((f) => f.endsWith(".md")).sort();
+        const updatedFiles = readdirSync4(memoryDir).filter((f) => f.endsWith(".md")).sort();
         lastLocalFileHash.set(agent.agent_id, createHash3("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
         log2(`Memory download for '${agent.code_name}': wrote ${written} new, overwrote ${overwritten} stale`);
       }
@@ -8621,7 +10077,7 @@ ${mem.content}
   }
 }
 async function cleanupAgentFiles(codeName, agentDir) {
-  if (existsSync4(agentDir)) {
+  if (existsSync5(agentDir)) {
     try {
       rmSync2(agentDir, { recursive: true, force: true });
       log(`Removed provision directory for '${codeName}'`);
@@ -8777,9 +10233,24 @@ async function stopPolling(opts = {}) {
     process.exit(opts.forcedExitCode ?? 1);
   }, 15e3);
   shutdownTimer.unref();
+  const drainStartedAt = Date.now();
+  const livePids = [...inFlightClaudePids.keys()];
+  if (livePids.length > 0) {
+    for (const pid of livePids) {
+      try {
+        process.kill(pid, "SIGTERM");
+      } catch {
+      }
+    }
+    log(formatDrainShutdownLine({ step: "sigterm-claude-pids", elapsedMs: Date.now() - drainStartedAt, killedPids: livePids }));
+  } else {
+    log(formatDrainShutdownLine({ step: "sigterm-claude-pids", elapsedMs: 0, note: "no in-flight claude -p children" }));
+  }
+  const subsysStartedAt = Date.now();
   stopCaffeinate();
   stopRealtimeChat();
   stopGatewayPool();
+  log(formatDrainShutdownLine({ step: "stop-subsystems", elapsedMs: Date.now() - subsysStartedAt }));
   for (const codeName of [...scheduledRunsByCode.keys()]) {
     closeScheduledRunsForCode(codeName, "cancelled", "manager shutdown");
   }
@@ -8795,12 +10266,12 @@ function startManager(opts) {
   config = opts;
   try {
     const stateFile = getStateFile();
-    if (existsSync4(stateFile)) {
-      const raw = readFileSync5(stateFile, "utf-8");
+    if (existsSync5(stateFile)) {
+      const raw = readFileSync9(stateFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.agents)) {
-        state4.agents = parsed.agents;
-        log(`[startup] rehydrated ${state4.agents.length} agent state(s) from ${stateFile}`);
+        state5.agents = parsed.agents;
+        log(`[startup] rehydrated ${state5.agents.length} agent state(s) from ${stateFile}`);
       }
       if (parsed.circuitBreakerTrips && typeof parsed.circuitBreakerTrips === "object") {
         restartBreaker.hydrate(parsed.circuitBreakerTrips);
@@ -8812,12 +10283,81 @@ function startManager(opts) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);
   }
   log(
-    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join6(homedir4(), ".augmented", "manager.log")}`
+    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join8(homedir4(), ".augmented", "manager.log")}`
   );
   deployMcpAssets();
   reapOrphanChannelMcps({ log });
-  void ensureHostFrameworkBinaries();
-  startPolling();
+  void (async () => {
+    try {
+      await reapOrphanedClaudePids();
+    } catch (err) {
+      log(`[drain] boot reaper failed: ${err.message}`);
+    }
+    void ensureHostFrameworkBinaries();
+    startPolling();
+  })();
+}
+async function reapOrphanedClaudePids() {
+  const path = claudePidFilePath();
+  const file = readPidFile(path);
+  if (file.spawns.length === 0) return;
+  const looksLikeClaude = (pid) => {
+    if (process.platform !== "linux") return true;
+    try {
+      const comm = readFileSync9(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
+      return comm.includes("claude");
+    } catch {
+      return false;
+    }
+  };
+  const decision = decideReaperActions(
+    file,
+    (pid) => {
+      try {
+        process.kill(pid, 0);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    looksLikeClaude
+  );
+  for (const spawn of decision.toKill) {
+    try {
+      process.kill(spawn.pid, "SIGKILL");
+    } catch (err) {
+      log(`[drain] reaper SIGKILL pid=${spawn.pid} failed: ${err.message}`);
+    }
+  }
+  for (const spawn of decision.pidReusedSkipped) {
+    log(
+      `[drain] reaper skipped pid=${spawn.pid} agent=${spawn.agent_code_name} card=${spawn.kanban_card_id ?? "none"} \u2014 PID reuse suspected (identity probe rejected)`
+    );
+  }
+  let kanbanReset = 0;
+  for (const spawn of decision.toResetKanban) {
+    try {
+      await api.post("/host/kanban", {
+        agent_id: spawn.agent_id,
+        update: [{ id: spawn.kanban_card_id, status: "backlog" }]
+      });
+      kanbanReset += 1;
+    } catch (err) {
+      log(`[drain] reaper kanban-reset failed for card=${spawn.kanban_card_id} agent=${spawn.agent_code_name}: ${err.message}`);
+    }
+  }
+  log(formatReaperBootLine({
+    totalRecorded: file.spawns.length,
+    killed: decision.toKill.length,
+    alreadyDead: decision.alreadyDead.length,
+    pidReusedSkipped: decision.pidReusedSkipped.length,
+    kanbanReset
+  }));
+  try {
+    writePidFile(path, { version: 1, spawns: [] });
+  } catch (err) {
+    log(`[drain] reaper file truncate failed: ${err.message}`);
+  }
 }
 async function ensureHostFrameworkBinaries() {
   const apiKey = getApiKey();
@@ -8874,18 +10414,18 @@ function restartRunningChannelMcps(basenames) {
   }
 }
 function deployMcpAssets() {
-  const targetDir = join6(homedir4(), ".augmented", "_mcp");
-  mkdirSync2(targetDir, { recursive: true });
-  const moduleDir = dirname(fileURLToPath(import.meta.url));
+  const targetDir = join8(homedir4(), ".augmented", "_mcp");
+  mkdirSync4(targetDir, { recursive: true });
+  const moduleDir = dirname3(fileURLToPath(import.meta.url));
   let mcpSourceDir = "";
   let dir = moduleDir;
   for (let i = 0; i < 6; i++) {
-    const candidate = join6(dir, "dist", "mcp");
-    if (existsSync4(join6(candidate, "index.js"))) {
+    const candidate = join8(dir, "dist", "mcp");
+    if (existsSync5(join8(candidate, "index.js"))) {
       mcpSourceDir = candidate;
       break;
     }
-    const parent = dirname(dir);
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -8896,8 +10436,8 @@ function deployMcpAssets() {
   const changedBasenames = [];
   const fileHash = (p) => {
     try {
-      if (!existsSync4(p)) return null;
-      return createHash3("sha256").update(readFileSync5(p)).digest("hex");
+      if (!existsSync5(p)) return null;
+      return createHash3("sha256").update(readFileSync9(p)).digest("hex");
     } catch {
       return null;
     }
@@ -8905,12 +10445,22 @@ function deployMcpAssets() {
   const RESTARTABLE_CHANNEL_FILES = /* @__PURE__ */ new Set([
     "slack-channel.js",
     "direct-chat-channel.js",
-    "telegram-channel.js"
+    "telegram-channel.js",
+    // ENG-6019: teams-channel was provisioned into .mcp.json but never shipped
+    // in the bundle — the file below has never existed on hosts until now.
+    "teams-channel.js"
   ]);
-  for (const file of ["index.js", "slack-channel.js", "direct-chat-channel.js", "telegram-channel.js"]) {
-    const src = join6(mcpSourceDir, file);
-    const dst = join6(targetDir, file);
-    if (!existsSync4(src)) continue;
+  for (const file of [
+    "index.js",
+    "slack-channel.js",
+    "direct-chat-channel.js",
+    "telegram-channel.js",
+    "teams-channel.js"
+    // ENG-6019
+  ]) {
+    const src = join8(mcpSourceDir, file);
+    const dst = join8(targetDir, file);
+    if (!existsSync5(src)) continue;
     const before = fileHash(dst);
     try {
       copyFileSync(src, dst);
@@ -8927,23 +10477,23 @@ function deployMcpAssets() {
     log(`[manager] Bundle(s) updated: ${changedBasenames.join(", ")} \u2014 signalling running instances to restart`);
     restartRunningChannelMcps(changedBasenames);
   }
-  const localMcpPath = join6(targetDir, "index.js");
+  const localMcpPath = join8(targetDir, "index.js");
   try {
-    const agentsDir = join6(homedir4(), ".augmented", "agents");
-    if (existsSync4(agentsDir)) {
-      for (const entry of readdirSync3(agentsDir, { withFileTypes: true })) {
+    const agentsDir = join8(homedir4(), ".augmented", "agents");
+    if (existsSync5(agentsDir)) {
+      for (const entry of readdirSync4(agentsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         for (const subdir of ["provision", "project"]) {
-          const mcpJsonPath = join6(agentsDir, entry.name, subdir, ".mcp.json");
+          const mcpJsonPath = join8(agentsDir, entry.name, subdir, ".mcp.json");
           try {
-            const raw = readFileSync5(mcpJsonPath, "utf-8");
+            const raw = readFileSync9(mcpJsonPath, "utf-8");
             if (!raw.includes("@integrity-labs/augmented-mcp")) continue;
             const mcpConfig = JSON.parse(raw);
             const augServer = mcpConfig.mcpServers?.["augmented"];
             if (!augServer) continue;
             augServer.command = "node";
             augServer.args = [localMcpPath];
-            writeFileSync3(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
+            writeFileSync4(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
             log(`[manager] Patched ${entry.name}/${subdir}/.mcp.json: npx \u2192 node`);
           } catch {
           }
@@ -8980,15 +10530,19 @@ process.on("disconnect", () => {
 export {
   ChildProcessError,
   __resetScheduledDeliveryDedupeForTest,
+  __setAgentChannelTokensForTest,
   applyRestartAcks,
   buildDoneCardNotification,
   claudeCodeUpgradeMarkerPath,
   claudeCodeUpgradeThrottled,
   claudeManagedSettingsPath,
   deliverScheduledCardResult,
+  deliverScheduledTaskOutput,
+  deriveScheduledTaskNotify,
   ensureClaudeManagedSettings,
   extractCharterSlackPeers,
   extractCharterTelegramPeers,
+  fireScheduledTaskViaKanban,
   formatBoardForPrompt,
   hasActionableItems,
   hasHybridActionableItems,