@integrity-labs/agt-cli 0.27.9-test.12 → 0.27.9-test.14

package/dist/{chunk-SXBZDUKN.js → chunk-R7NKCGWN.js}

@@ -8,8 +8,9 @@ import {
   isParseError,
   parseDeliveryTarget,
   registerFramework,
+  resolveAvatarEnvUrl,
   wrapScheduledTaskPrompt
-} from "./chunk-I2OTQJH3.js";
+} from "./chunk-WOOYOAPG.js";
 
 // ../../packages/core/dist/integrations/registry.js
 var INTEGRATION_REGISTRY = [
@@ -49,7 +50,13 @@ var INTEGRATION_REGISTRY = [
       binary: "gh",
       env_key: "GITHUB_TOKEN",
       skill_id: "gh-cli",
-      installer: "brew"
+      // ENG-6206: `brew` never installs on the Linux fleet (root-on-AL2023,
+      // no Homebrew) — gh was permanently missing. Use an OS-detecting script
+      // that installs from GitHub's official repos: dnf (AL2023 / RHEL),
+      // apt (Debian / Ubuntu), and brew (macOS hosts). The catalog is the
+      // trust boundary — this string is source-controlled, never runtime data.
+      installer: "script",
+      script: 'if command -v dnf >/dev/null 2>&1; then curl -fsSL https://cli.github.com/packages/rpm/gh-cli.repo -o /etc/yum.repos.d/gh-cli.repo && dnf install -y gh; elif command -v apt-get >/dev/null 2>&1; then curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /usr/share/keyrings/githubcli-archive-keyring.gpg && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list && apt-get update && apt-get install -y gh; elif command -v brew >/dev/null 2>&1; then brew install gh; else echo "gh: no supported installer (need dnf, apt-get, or brew)" >&2; exit 1; fi'
     }
   },
   {
@@ -381,6 +388,24 @@ var INTEGRATION_REGISTRY = [
       }
     }
   },
+  {
+    // ENG-6195: admin-only debugging surface for Integrity Labs STAFF agents.
+    // Provisions the @integrity-labs/augmented-admin-mcp stdio broker, which
+    // reads end-user agent diagnostics cross-org via /admin/debug/*. `beta` so
+    // it is visible/enable-able only by admin-email-domain users; the API
+    // double-gates every call on the caller's owning org `is_internal = true`.
+    // auth `none` — no end-user OAuth; the host JWT (org_id claim) is the
+    // credential. NOT a customer integration; do not promote to `published`.
+    id: "augmented-admin",
+    name: "Augmented Admin Debug",
+    category: "infrastructure",
+    description: "Integrity Labs staff-only: cross-org agent/host/integration/alert diagnostics for troubleshooting managed agents.",
+    supported_auth_types: ["none"],
+    beta: true,
+    capabilities: [
+      { id: "augmented-admin:read-diagnostics", name: "Read Diagnostics", description: "Cross-org read of agent, host, integration, and alert diagnostics (projection only \u2014 never credentials or transcripts).", access: "read" }
+    ]
+  },
   {
     id: "custom",
     name: "Custom Integration",
@@ -3361,32 +3386,43 @@ acknowledge before you start.
 - **FAST (< 60s):** handle inline. Reply via the channel tool
   (slack.reply / telegram.reply / directchat.reply) and end your turn.
 
-- **SLOW (\u2265 60s):** acknowledge first, then handle inline.
+- **SLOW (\u2265 60s):** acknowledge, dispatch to background, stay responsive.
   1. Send a one-line acknowledgement via the channel tool \u2014 short, warm,
      and tell the user you'll come back. Example shape (don't copy verbatim,
      match your voice): "On it \u2014 this'll take a minute or two, I'll ping
      when it's done."
-  2. Do the work yourself in this same session. Use whatever tools you
-     need (MCP, skills, file reads, etc.) \u2014 your parent session has the
-     full MCP surface bound.
-  3. Reply with the result via the channel tool (\`slack.reply\` /
-     \`telegram.reply\` / \`directchat.reply\`), addressing the same thread
-     / chat / conversation you acknowledged in step 1.
-
-> **Why inline and not sub-agent dispatch right now:** there is an
-> upstream Claude Code bug
-> ([anthropics/claude-code#64909](https://github.com/anthropics/claude-code/issues/64909))
-> where sub-agents dispatched via the Task tool with an explicit
-> \`tools:\` allowlist (which is the shape \`channel-message-handler\`
-> uses) get an **empty MCP tool registry** \u2014 every \`mcp__*\` call
-> returns "No such tool available", including the channel reply tools.
-> Dispatching a slow channel reply to \`channel-message-handler\` will
-> therefore silently fail to land: you'd post the one-line ack, the
-> sub-agent would do the analysis fine, but its \`slack.reply\` call
-> would error and the user would never see the substantive reply.
-> Empirically confirmed 2026-06-03 with a 6-tool probe: 0/6 MCP tools
-> bound inside \`channel-message-handler\`. Until Anthropic ships the
-> fix, handling slow channel replies inline is the only working path.
+  2. Dispatch the work to a background sub-agent: the Agent tool with
+     \`subagent_type: general-purpose\` AND \`run_in_background: true\`.
+     Put EVERYTHING the worker needs in the dispatch prompt \u2014 the user's
+     full request, relevant thread context, which integrations/tools to
+     use, and the exact shape of result you want back. The worker inherits
+     your full MCP tool surface but NOT your conversation context.
+  3. End your turn after dispatching. This is the point: you stay free to
+     answer other messages while the worker grinds. Do NOT wait, poll, or
+     dispatch the same work synchronously \u2014 a synchronous dispatch blocks
+     your turn and defeats the purpose.
+  4. When the worker's completion notification arrives (it lands
+     automatically as a system message), read its result and reply via the
+     channel tool (\`slack.reply\` / \`telegram.reply\` / \`directchat.reply\`)
+     to the same thread / chat / conversation you acknowledged in step 1.
+     **You post the substantive reply \u2014 the worker has no channel tools.**
+  5. If the completion notification reports a failure or an unusable
+     result, tell the user what happened and either re-dispatch with a
+     better prompt or handle it inline \u2014 never go silent.
+
+> **Why background dispatch (and why \`general-purpose\`):** validated
+> 2026-06-10 on Claude Code 2.1.170 (ENG-6274 spike,
+> \`docs/spikes/ENG-6274-run-in-background-dispatch.md\`): background
+> dispatch returns immediately, your turn ends, inbound messages get
+> answered in seconds while the worker runs, and the completion arrives
+> as a notification you handle like any other turn. Use
+> \`subagent_type: general-purpose\` (inherit-all tools) \u2014 NOT
+> \`channel-message-handler\` or \`augmented-worker\` \u2014 until ENG-6273
+> re-verifies on this host that the upstream allowlist bug
+> ([anthropics/claude-code#64909](https://github.com/anthropics/claude-code/issues/64909),
+> empirically 0/6 MCP tools in named sub-agents on 2026-06-03) is fixed
+> at the fleet's pinned Claude Code version. \`general-purpose\` escapes
+> that bug by construction either way.
 
 **Why this triage decision still matters more than any other instruction
 below:** if you skip the acknowledgement and just dive into slow work
@@ -3408,25 +3444,29 @@ For background tool work that **isn't** a channel reply \u2014 multi-step data
 pulls, CRM enrichments, research workflows, cross-MCP orchestration \u2014 use
 \`subagent_type: general-purpose\` (Anthropic's built-in). It inherits the
 full MCP tool surface from this session and reliably binds every
-\`mcp__*\` server you have available.
+\`mcp__*\` server you have available. For anything expected to take more
+than a minute, add \`run_in_background: true\` so your turn ends and you
+stay responsive; the completion notification brings you the result.
+Don't background-dispatch trivial work \u2014 each dispatch is a fresh
+context and costs real tokens.
 
 **Why not \`augmented-worker\` for now:** there is an upstream Claude Code
 bug ([anthropics/claude-code#64909](https://github.com/anthropics/claude-code/issues/64909))
 where sub-agents with an explicit \`tools:\` allowlist get an empty MCP
 tool registry \u2014 every \`mcp__*\` call returns "No such tool available."
 \`general-purpose\` uses \`tools: *\` (inherit-all) and escapes the bug.
-Once Anthropic ships the fix, \`augmented-worker\` becomes preferred again
-(restricted tool surface for safety + working MCP binding); the dispatch
-recommendation here will flip back automatically.
+The fix appears to have shipped upstream (verified locally on Claude Code
+2.1.170, 2026-06-10 \u2014 ENG-6269 spike); once ENG-6273 re-verifies it on
+this host's pinned version, \`augmented-worker\` becomes preferred again
+(restricted tool surface for safety + working MCP binding) and
+\`channel-message-handler\` returns as a dispatch target. Until then,
+\`general-purpose\` only.
 
 For slow **channel** replies, see \xA7 FIRST ACTION above \u2014 those are
-currently handled inline (not dispatched) because \`channel-message-handler\`
-shares the explicit-allowlist shape and so suffers the same upstream
-bug. Empirically confirmed 2026-06-03 on agt-aws-1 with a 6-tool probe:
-0/6 MCP tools bound inside \`channel-message-handler\` (matching the
-\`augmented-worker\` result). When Anthropic ships the upstream fix, both
-named sub-agents will work again and the FIRST ACTION triage will switch
-back to dispatch.
+dispatched as background \`general-purpose\` workers and **you** post the
+result back to the channel when the completion notification arrives
+(\`channel-message-handler\` is not yet the dispatch target for the same
+ENG-6273-pending reason).
 
 ${activeTasksSection}${personalitySection}## Identity
 
@@ -3635,8 +3675,15 @@ ask the question alone, no task created yet, and let the user answer before
 anything goes on the board.
 
 When asked about existing work, tasks, or what you've been doing \u2014 call kanban.list
-first to load your recent board state. This gives you context about completed and
-in-progress items so you can answer accurately.
+first to load your recent board state (active items + the last 24h of completed work).
+
+**But kanban.list is recency-windowed: done cards older than 24h are NOT on it** (only done cards age off \u2014 failed and active cards always show).
+So if someone references specific past work ("you drafted X for me", "did you finish Y
+on the weekend?"), do NOT answer from the board alone \u2014 run **kanban.search** for it
+first. "It's not on my board" only means it's older than 24h, not that you never did it.
+Each search hit includes the card's result, so you can recite what you actually
+produced. Denying delivered work because it aged off the board is a serious failure of
+trust \u2014 search before you say "no record".
 
 ${memorySection}
 ${reportsToSection}${teamSection}${peopleSection}${multiAgentSection}${integrationsSection}${capabilityPromptSection}${knowledgeSection}${kanbanWorkPolicySection}${skillAuthoringSection}## Dashboards
@@ -4633,6 +4680,136 @@ function provisionIsolationHook(codeName) {
   settings["hooks"] = hooks;
   writeFileSync5(settingsPath, JSON.stringify(settings, null, 2));
 }
+function provisionAutoKanbanProgressHook(codeName) {
+  const projectDir = getProjectDir(codeName);
+  const claudeDir = join4(projectDir, ".claude");
+  mkdirSync4(claudeDir, { recursive: true });
+  const hookScriptPath = join4(claudeDir, "agt-auto-kanban-progress-hook.sh");
+  const hookScript = `#!/usr/bin/env bash
+# Auto-generated by Augmented (ENG-6179 / ENG-6241) \u2014 PostToolUse auto-progress.
+# Maps the agent's latest tool action onto its active in-thread kanban progress
+# card. Best-effort, silent, throttled; every path degrades to exit 0 and the
+# push is fire-and-forget so it never blocks or fails a tool call.
+# Canonical source: packages/claudecode-plugin-augmented/hooks/auto-kanban-progress.sh
+
+# Best-effort: any unexpected error just exits clean.
+trap 'exit 0' ERR
+
+# Hook input (stdin canonical; CLAUDE_HOOK_INPUT kept as a fallback).
+INPUT="$(cat 2>/dev/null || true)"
+[ -n "$INPUT" ] || INPUT="\${CLAUDE_HOOK_INPUT:-}"
+[ -n "$INPUT" ] || exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+command -v curl >/dev/null 2>&1 || exit 0
+
+TOOL="$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null || true)"
+[ -n "$TOOL" ] || exit 0
+
+# Skip tools that aren't "work the requester wants narrated". kanban_* (incl.
+# the explicit kanban_progress) and channel/status tools would only produce
+# noise \u2014 and a kanban_done clears the step anyway.
+case "$TOOL" in
+  *kanban*|*reply*|*ask_user*|*send_message*|*direct_chat*|status_*|TodoWrite|ExitPlanMode) exit 0 ;;
+esac
+
+# Identity + endpoint.
+PROJECT_DIR="\${CLAUDE_PROJECT_DIR:-$PWD}"
+AGENT_ID="\${AGT_AGENT_ID:-}"
+if [ -z "$AGENT_ID" ] && [ -f "$PROJECT_DIR/.mcp.json" ]; then
+  # The manager writes AGT_AGENT_ID literally into every augmented MCP server's
+  # env block; take the first non-empty one.
+  AGENT_ID="$(jq -r '[.mcpServers[]?.env?.AGT_AGENT_ID // empty] | map(select(. != "")) | .[0] // empty' "$PROJECT_DIR/.mcp.json" 2>/dev/null || true)"
+fi
+HOST="\${AGT_HOST:-}"
+KEY="\${AGT_API_KEY:-}"
+[ -n "$AGENT_ID" ] && [ -n "$HOST" ] && [ -n "$KEY" ] || exit 0
+
+# Throttle: at most one push per ~15s per agent.
+STATE_DIR="\${HOME:-/tmp}/.augmented/.auto-progress/\${AGENT_ID}"
+mkdir -p "$STATE_DIR" 2>/dev/null || exit 0
+STAMP="$STATE_DIR/last-push"
+NOW="$(date +%s)"
+if [ -f "$STAMP" ]; then
+  LAST="$(cat "$STAMP" 2>/dev/null || echo 0)"
+  case "$LAST" in ''|*[!0-9]*) LAST=0 ;; esac
+  [ $(( NOW - LAST )) -ge 15 ] || exit 0
+fi
+
+# Derive the one-line "what I'm doing right now" step.
+STEP="$(printf '%s' "$INPUT" | jq -r '
+  def base(p): (p | tostring | ltrimstr("./") | split("/") | last);
+  .tool_name as $t | (.tool_input // {}) as $i |
+  if   $t == "Bash"         then ($i.description // ("Running: " + (($i.command // "") | tostring | .[0:80])))
+  elif $t == "Edit"         then ("Editing " + base($i.file_path // $i.filePath // "a file"))
+  elif $t == "MultiEdit"    then ("Editing " + base($i.file_path // $i.filePath // "a file"))
+  elif $t == "Write"        then ("Writing " + base($i.file_path // $i.filePath // "a file"))
+  elif $t == "NotebookEdit" then ("Editing " + base($i.notebook_path // "a notebook"))
+  elif $t == "Read"         then ("Reading " + base($i.file_path // $i.filePath // "a file"))
+  elif $t == "Grep"         then ("Searching for " + (($i.pattern // "") | tostring | .[0:60]))
+  elif $t == "Glob"         then ("Finding files: " + (($i.pattern // "") | tostring | .[0:60]))
+  elif $t == "WebSearch"    then ("Searching the web: " + (($i.query // "") | tostring | .[0:60]))
+  elif $t == "WebFetch"     then ("Fetching " + (($i.url // "") | tostring | .[0:80]))
+  elif ($t == "Task" or $t == "Agent") then ("Working on: " + (($i.description // "a subtask") | tostring | .[0:80]))
+  elif ($t | startswith("mcp__")) then ("Using " + ($t | sub("^mcp__"; "") | gsub("__"; " / ")))
+  else ("Working (" + $t + ")")
+  end
+' 2>/dev/null || true)"
+STEP="$(printf '%s' "$STEP" | tr '\\n\\t' '  ' | sed 's/  */ /g' | cut -c1-240)"
+[ -n "$STEP" ] || exit 0
+
+# Stamp BEFORE the network call so a slow API can't unthrottle us.
+printf '%s' "$NOW" > "$STAMP" 2>/dev/null || true
+
+# Bearer JWT (exchange tlk_ -> JWT, cached with expiry).
+TOKEN_FILE="$STATE_DIR/token"
+TOKEN=""
+if [ -f "$TOKEN_FILE" ]; then
+  T_EXP="$(jq -r '.exp // 0' "$TOKEN_FILE" 2>/dev/null || echo 0)"
+  case "$T_EXP" in ''|*[!0-9]*) T_EXP=0 ;; esac
+  [ $(( T_EXP - NOW )) -gt 300 ] && TOKEN="$(jq -r '.token // empty' "$TOKEN_FILE" 2>/dev/null || true)"
+fi
+if [ -z "$TOKEN" ]; then
+  EX="$(curl -fsS --max-time 5 -X POST "$HOST/host/exchange" \\
+        -H 'Content-Type: application/json' \\
+        -d "{\\"host_key\\":\\"$KEY\\"}" 2>/dev/null || true)"
+  TOKEN="$(printf '%s' "$EX" | jq -r '.token // empty' 2>/dev/null || true)"
+  [ -n "$TOKEN" ] || exit 0
+  EXP_ISO="$(printf '%s' "$EX" | jq -r '.expires_at // empty' 2>/dev/null || true)"
+  # GNU date (Linux hosts) first, then BSD date (macOS dev machines), then a
+  # safe 30-min fallback so a parse miss doesn't poison the token cache.
+  EXP_EPOCH="$(date -d "$EXP_ISO" +%s 2>/dev/null \\
+    || date -j -f '%Y-%m-%dT%H:%M:%SZ' "$EXP_ISO" +%s 2>/dev/null \\
+    || echo $(( NOW + 1800 )))"
+  ( umask 177; printf '{"token":"%s","exp":%s}' "$TOKEN" "$EXP_EPOCH" > "$TOKEN_FILE" 2>/dev/null || true )
+fi
+
+# Fire-and-forget the push (never block the agent's tool flow).
+BODY="$(jq -nc --arg a "$AGENT_ID" --arg s "$STEP" '{agent_id:$a, step:$s}' 2>/dev/null || printf '{"agent_id":"%s","step":"%s"}' "$AGENT_ID" "$STEP")"
+( curl -fsS --max-time 4 -X POST "$HOST/host/kanban/auto-progress" \\
+    -H 'Content-Type: application/json' \\
+    -H "Authorization: Bearer $TOKEN" \\
+    -d "$BODY" >/dev/null 2>&1 || true ) &
+
+exit 0
+`;
+  writeFileSync5(hookScriptPath, hookScript, { mode: 493 });
+  const settingsPath = join4(claudeDir, "settings.local.json");
+  let settings = {};
+  try {
+    settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
+  } catch {
+  }
+  const hooks = settings["hooks"] ?? {};
+  hooks["PostToolUse"] = [
+    {
+      hooks: [
+        { type: "command", command: hookScriptPath }
+      ]
+    }
+  ];
+  settings["hooks"] = hooks;
+  writeFileSync5(settingsPath, JSON.stringify(settings, null, 2));
+}
 function provisionOrientHook(codeName) {
   const projectDir = getProjectDir(codeName);
   const claudeDir = join4(projectDir, ".claude");
@@ -4746,6 +4923,11 @@ var SECRETS_DENY_PERMISSIONS = [
   "Read(**/credentials/**)",
   "Read(**/credentials.json)",
   "Read(**/.aws/**)",
+  // gcloud stores ADC + cached access/refresh tokens under ~/.config/gcloud/
+  // (application_default_credentials.json, credentials.db, access_tokens.db).
+  // Brokered GCP access flows via CLOUDSDK_AUTH_ACCESS_TOKEN env, never these
+  // files, so denying reads here is the GCP analogue of the .aws/ block.
+  "Read(**/.config/gcloud/**)",
   "Read(**/.ssh/**)",
   "Read(**/config/database.yml)",
   "Read(**/config/credentials.json)",
@@ -5018,6 +5200,12 @@ function buildMcpJson(input) {
       // dashboard links) in tool replies. Falls back to NEXT_PUBLIC_APP_URL
       // / AGT_CONSOLE_URL — same chain consoleUrl uses for kanban links.
       AGT_APP_URL: process.env["AGT_APP_URL"] ?? process.env["NEXT_PUBLIC_APP_URL"] ?? process.env["AGT_CONSOLE_URL"] ?? "",
+      // ENG-6229: arms the in-session `request_restart` self-restart tool.
+      // Read at provision time from the manager's env (like AGT_HOST above),
+      // NOT a per-spawn `${...}` template — it's a host-level gate. Empty by
+      // default ⇒ the tool isn't registered at all (ships dark). When an
+      // operator sets it on the host, the next /host/refresh bakes it in.
+      AGT_AGENT_SELF_RESTART_ENABLED: process.env["AGT_AGENT_SELF_RESTART_ENABLED"] ?? "",
       // Include PATH/HOME so the MCP subprocess can resolve binaries
       PATH: process.env["PATH"] ?? "",
       HOME: process.env["HOME"] ?? ""
@@ -5034,6 +5222,7 @@ function buildMcpJson(input) {
       integration
     });
   }
+  const hasXeroBroker = input.integrations?.some((i) => i.definition_id === "xero-broker") ?? false;
   const xeroIntegration = input.integrations?.find((i) => i.definition_id === "xero");
   if (xeroIntegration) {
     const brokerMode = Boolean(xeroIntegration.id);
@@ -5048,6 +5237,8 @@ function buildMcpJson(input) {
         AGT_API_KEY: "${AGT_API_KEY}",
         AGT_AGENT_ID: input.agent.agent_id,
         ...brokerMode ? { AGT_INTEGRATION_ID: xeroIntegration.id } : {},
+        // ENG-4922: writes go through xero-broker → read-only vendor server.
+        ...hasXeroBroker ? { XERO_WRITES_VIA_BROKER: "true" } : {},
         PATH: process.env["PATH"] ?? "",
         HOME: process.env["HOME"] ?? ""
       }
@@ -5086,6 +5277,34 @@ function buildMcpJson(input) {
       }
     };
   }
+  if (hasXeroBroker) {
+    mcpServers["xero-broker"] = {
+      command: "npx",
+      args: ["-y", "@integrity-labs/xero-broker@latest"],
+      env: {
+        AGT_HOST: "${AGT_HOST}",
+        AGT_AGENT_ID: input.agent.agent_id,
+        AGT_RUN_ID: "${AGT_RUN_ID}",
+        AGT_API_KEY: "${AGT_API_KEY}",
+        PATH: process.env["PATH"] ?? "",
+        HOME: process.env["HOME"] ?? ""
+      }
+    };
+  }
+  const hasAdminDebug = input.integrations?.some((i) => i.definition_id === "augmented-admin") ?? false;
+  if (hasAdminDebug) {
+    const localAdminMcpPath = join4(getHomeDir3(), ".augmented", "_mcp", "augmented-admin.js");
+    mcpServers["augmented-admin"] = {
+      command: "node",
+      args: [localAdminMcpPath],
+      env: {
+        AGT_HOST: "${AGT_HOST}",
+        AGT_AGENT_ID: input.agent.agent_id,
+        AGT_RUN_ID: "${AGT_RUN_ID}",
+        AGT_API_KEY: "${AGT_API_KEY}"
+      }
+    };
+  }
   return { mcpServers };
 }
 function parseIntervalMinutes(scheduleEvery) {
@@ -5545,6 +5764,7 @@ ${sections}`
             }
           });
           const localSlackChannel = join4(getHomeDir3(), ".augmented", "_mcp", "slack-channel.js");
+          const slackAvatarEnvUrl = resolveAvatarEnvUrl(options?.agentAvatarUrl).url;
           const slackEntry = {
             command: existsSync5(localSlackChannel) ? "node" : "npx",
             args: existsSync5(localSlackChannel) ? [localSlackChannel] : ["-y", "@augmented/claude-code-channel-slack"],
@@ -5562,6 +5782,13 @@ ${sections}`
               ...slackPeerEnv,
               ...slackAgtAuthEnv,
               ...tzEnv,
+              // ENG-6155: the agent's avatar URL (public 512×512 JPG). The
+              // slack-channel MCP sets it as the bot's Slack profile photo on
+              // first connect (users.setPhoto). Omitted when absent so the bot
+              // keeps its current photo; the URL's cache-bust param changes on
+              // re-generation, so the MCP re-applies a new avatar.
+              // ENG-6245: slackAvatarEnvUrl is null for data-URI / oversized values.
+              ...slackAvatarEnvUrl ? { SLACK_AGENT_AVATAR_URL: slackAvatarEnvUrl } : {},
               // ENG-4940: channel-agnostic peer kill switch — same enum
               // as the Telegram path emits above. The Slack classifier
               // (ENG-4936) honours PEER_DISABLED with identical
@@ -5717,6 +5944,7 @@ ${sections}`
           ...appToken ? { SLACK_APP_TOKEN: appToken } : {}
         }
       });
+      const slackAvatarEnvUrl = resolveAvatarEnvUrl(options?.agentAvatarUrl).url;
       if (isPersistent && existsSync5(localSlackChannel)) {
         mcpServers["slack"] = {
           command: "node",
@@ -5730,7 +5958,11 @@ ${sections}`
             ...oneshotBlockKitEnv,
             ...slackPeerEnv,
             ...slackAgtAuthEnv,
-            ...tzEnv
+            ...tzEnv,
+            // ENG-6155: avatar URL → bot Slack profile photo (see persistent
+            // branch above). Mirrored here so oneshot-mode agents get it too.
+            // ENG-6245: slackAvatarEnvUrl is null for data-URI / oversized values.
+            ...slackAvatarEnvUrl ? { SLACK_AGENT_AVATAR_URL: slackAvatarEnvUrl } : {}
           }
         };
       } else {
@@ -5746,7 +5978,11 @@ ${sections}`
             ...oneshotBlockKitEnv,
             ...slackPeerEnv,
             ...slackAgtAuthEnv,
-            ...tzEnv
+            ...tzEnv,
+            // ENG-6155: avatar URL → bot Slack profile photo (see persistent
+            // branch above). Mirrored here so oneshot-mode agents get it too.
+            // ENG-6245: slackAvatarEnvUrl is null for data-URI / oversized values.
+            ...slackAvatarEnvUrl ? { SLACK_AGENT_AVATAR_URL: slackAvatarEnvUrl } : {}
           }
         };
       }
@@ -5915,15 +6151,30 @@ ${sections}`
     for (const integration of decryptedIntegrations) {
       const prefix = integration.definition_id.toUpperCase().replace(/[^A-Z0-9]/g, "_");
       const creds = integration.credentials;
+      const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
+      let token;
       if (integration.auth_type === "oauth2") {
-        const accessToken = creds.access_token;
-        if (accessToken) {
-          envUpdates[`${prefix}_ACCESS_TOKEN`] = accessToken;
+        token = creds.access_token;
+        if (token) {
+          envUpdates[`${prefix}_ACCESS_TOKEN`] = token;
         }
       } else if (integration.auth_type === "api_key") {
-        const apiKey = creds.api_key;
-        if (apiKey) {
-          envUpdates[`${prefix}_API_KEY`] = apiKey;
+        token = creds.api_key;
+        if (token) {
+          envUpdates[`${prefix}_API_KEY`] = token;
+        }
+      }
+      if (def?.cli_tool) {
+        const { env_key, extra_env } = def.cli_tool;
+        if (env_key && token && !(env_key in envUpdates)) {
+          envUpdates[env_key] = token;
+        }
+        if (extra_env) {
+          for (const [k, v] of Object.entries(extra_env)) {
+            if (typeof v === "string" && v && !(k in envUpdates)) {
+              envUpdates[k] = v;
+            }
+          }
         }
       }
       if (integration.config) {
@@ -5964,12 +6215,15 @@ ${sections}`
         integration
       }));
     }
+    const hasXeroBroker = integrations.some((i) => i.definition_id === "xero-broker");
     const xeroIntegration = integrations.find((i) => i.definition_id === "xero");
     if (xeroIntegration) {
       const brokerMode = Boolean(agentId && xeroIntegration.id);
       const xeroEnv = {
         ...brokerMode ? {} : { XERO_CLIENT_BEARER_TOKEN: "${XERO_ACCESS_TOKEN}" },
         XERO_TENANT_ID: "${XERO_TENANT_ID}",
+        // ENG-4922: writes go through xero-broker → read-only vendor server.
+        ...hasXeroBroker ? { XERO_WRITES_VIA_BROKER: "true" } : {},
         PATH: process.env["PATH"] ?? "",
         HOME: process.env["HOME"] ?? ""
       };
@@ -6020,12 +6274,48 @@ ${sections}`
         });
       }
     }
+    if (hasXeroBroker) {
+      const brokerAgentId = resolveBrokerAgentId(codeName);
+      if (!brokerAgentId) {
+        process.stderr.write(`[manager-worker] [xero-broker] skipping write for '${codeName}': no real AGT_AGENT_ID available. The full-provision artifact pipeline will recreate this on the next cycle.
+`);
+      } else {
+        this.writeMcpServer(codeName, "xero-broker", {
+          command: "npx",
+          args: ["-y", "@integrity-labs/xero-broker@latest"],
+          env: {
+            AGT_HOST: "${AGT_HOST}",
+            AGT_API_KEY: "${AGT_API_KEY}",
+            AGT_AGENT_ID: brokerAgentId,
+            AGT_RUN_ID: "${AGT_RUN_ID}",
+            PATH: process.env["PATH"] ?? "",
+            HOME: process.env["HOME"] ?? ""
+          }
+        });
+      }
+    }
+    const hasAdminDebug = integrations.some((i) => i.definition_id === "augmented-admin");
+    if (hasAdminDebug) {
+      const localAdminMcpPath = join4(getHomeDir3(), ".augmented", "_mcp", "augmented-admin.js");
+      this.writeMcpServer(codeName, "augmented-admin", {
+        command: "node",
+        args: [localAdminMcpPath],
+        env: {
+          AGT_HOST: "${AGT_HOST}",
+          AGT_AGENT_ID: resolveBrokerAgentId(codeName) ?? agentId ?? "",
+          AGT_RUN_ID: "${AGT_RUN_ID}",
+          AGT_API_KEY: "${AGT_API_KEY}"
+        }
+      });
+    }
     if (this.removeMcpServer) {
       const nativeMcpKeys = INTEGRATION_REGISTRY.filter((d) => d.nativeMcp !== void 0).map((d) => d.nativeMcp.key ?? d.id);
       const integrationDerivedKeys = /* @__PURE__ */ new Set([
         "xero",
         "postiz",
         "cloud-broker",
+        "xero-broker",
+        "augmented-admin",
         ...nativeMcpKeys,
         ...Object.entries(OAUTH_PROVIDERS).filter(([, provider]) => Boolean(provider.mcpUrl)).map(([id]) => id)
       ]);
@@ -6036,6 +6326,10 @@ ${sections}`
         expectedKeys.add("postiz");
       if (hasCloudBroker)
         expectedKeys.add("cloud-broker");
+      if (hasXeroBroker)
+        expectedKeys.add("xero-broker");
+      if (hasAdminDebug)
+        expectedKeys.add("augmented-admin");
       for (const integration of integrations) {
         const def = INTEGRATION_REGISTRY.find((d) => d.id === integration.definition_id);
         if (def?.nativeMcp) {
@@ -7555,6 +7849,7 @@ export {
   CHANNEL_SECRET_ENV_KEYS,
   provisionStopHook,
   provisionIsolationHook,
+  provisionAutoKanbanProgressHook,
   provisionOrientHook,
   setJsonMode,
   isJsonMode,
@@ -7586,4 +7881,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-SXBZDUKN.js.map
+//# sourceMappingURL=chunk-R7NKCGWN.js.map