@integrity-labs/agt-cli 0.28.1010 → 0.28.1012

package/dist/lib/manager-worker.js

@@ -64,7 +64,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-V6HO4MUI.js";
+} from "../chunk-O3DODZVZ.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -77,8 +77,10 @@ import {
   CHANNEL_SECRET_ENV_KEYS,
   CLAUDE_MANAGED_SETTINGS_DIR,
   ChildProcessError,
+  DEFAULT_KILL_AFTER_MS,
   agentRuntimeKey,
   applyBlockedPromptVerdict,
+  boundedArgv,
   buildEgressAllowlist,
   checkChannelInputs,
   collectChannelSpawnSecrets,
@@ -95,6 +97,7 @@ import {
   getProjectDir,
   getSessionState,
   hardBoundedCapture,
+  hasTimeoutBinary,
   hashFile,
   injectMessage,
   injectMessageWithStatus,
@@ -142,7 +145,7 @@ import {
   takeZombieDetection,
   toOpencodeModel,
   writeEgressAllowlist
-} from "../chunk-HSYBLAWA.js";
+} from "../chunk-K73BIWKA.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -241,7 +244,7 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-OPDT2OE5.js";
+} from "../chunk-LV72A4BE.js";
 import "../chunk-DHWNVVX4.js";
 import {
   reapOrphanChannelMcps
@@ -7652,8 +7655,8 @@ function shouldNudgeUnchangedBoard(signature, state9, now, fullCadenceMs, maxCad
   if (state9.signature !== signature) return true;
   return now - state9.nudgedAt >= nudgeIntervalForCount(state9.nudgeCount ?? 1, fullCadenceMs, maxCadenceMs);
 }
-function failureRetryIntervalForCount(failureCount, baseMs, maxMs) {
-  const exponent = Math.max(0, Math.min(failureCount - 1, 8));
+function failureRetryIntervalForCount(failureCount2, baseMs, maxMs) {
+  const exponent = Math.max(0, Math.min(failureCount2 - 1, 8));
   return Math.min(baseMs * 3 ** exponent, Math.max(maxMs, baseMs));
 }
 var KANBAN_NOTICE_BREAKER_THRESHOLD = 5;
@@ -7911,7 +7914,7 @@ function loadKanbanNudgeState(target, configDir) {
     if (!value || typeof value !== "object") continue;
     const v = value;
     if (typeof v.signature !== "string" || typeof v.nudgedAt !== "number" || !Number.isFinite(v.nudgedAt)) continue;
-    const failureCount = typeof v.failureCount === "number" && Number.isFinite(v.failureCount) && v.failureCount >= 1 ? Math.floor(v.failureCount) : void 0;
+    const failureCount2 = typeof v.failureCount === "number" && Number.isFinite(v.failureCount) && v.failureCount >= 1 ? Math.floor(v.failureCount) : void 0;
     const failedAt = typeof v.failedAt === "number" && Number.isFinite(v.failedAt) ? v.failedAt : void 0;
     target.set(codeName, {
       signature: v.signature,
@@ -7920,8 +7923,8 @@ function loadKanbanNudgeState(target, configDir) {
       // Only carry the pair when the count is real: a failedAt with no count
       // cannot gate anything, and a count with no timestamp is handled as
       // "due now" by shouldAttemptNoticeEnqueue rather than wedging the agent.
-      ...failureCount !== void 0 ? { failureCount } : {},
-      ...failureCount !== void 0 && failedAt !== void 0 ? { failedAt } : {}
+      ...failureCount2 !== void 0 ? { failureCount: failureCount2 } : {},
+      ...failureCount2 !== void 0 && failedAt !== void 0 ? { failedAt } : {}
     });
   }
 }
@@ -9764,6 +9767,105 @@ function stopPidPressureSampler() {
   timer2 = null;
 }
 
+// src/lib/runtime-version-sampler.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { execFile as execFileCb } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFileCb);
+var SAMPLE_INTERVAL_MS3 = 5 * 6e4;
+var lastSample2 = /* @__PURE__ */ new Map();
+var failureCount = /* @__PURE__ */ new Map();
+async function readVersionReal(codeName) {
+  const timeoutMs = 1e4;
+  timeoutBinaryAvailable ??= hasTimeoutBinary(execFileSync2);
+  const { execFile: file, execArgs } = boundedArgv(
+    "docker",
+    ["exec", `agt-${codeName}`, "claude", "--version"],
+    timeoutMs,
+    DEFAULT_KILL_AFTER_MS,
+    timeoutBinaryAvailable
+  );
+  try {
+    const { stdout } = await execFileAsync2(file, execArgs, {
+      encoding: "utf-8",
+      timeout: timeoutBinaryAvailable ? timeoutMs + DEFAULT_KILL_AFTER_MS + 5e3 : timeoutMs
+    });
+    return String(stdout ?? "");
+  } catch {
+    return null;
+  }
+}
+var timeoutBinaryAvailable;
+function parseClaudeVersion(raw) {
+  if (raw == null) return null;
+  const m = raw.trim().match(/\b(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\b/);
+  return m ? m[1] : null;
+}
+async function sampleRuntimeVersionFor(codeName, io = {}) {
+  const isolated = io.isolatedFor?.(codeName) ?? effectiveIsolationMode(codeName) === "docker";
+  if (!isolated) {
+    lastSample2.delete(codeName);
+    failureCount.delete(codeName);
+    return { state: "not-isolated", version: null, sampledAt: null, failures: 0 };
+  }
+  const resolveDir = io.resolveCgroupDir ?? resolveCgroupDirReal;
+  const readVersion = io.readVersion ?? readVersionReal;
+  const now = io.now ?? Date.now;
+  const dir = resolveDir(codeName);
+  if (dir == null) {
+    const failures = (failureCount.get(codeName) ?? 0) + 1;
+    failureCount.set(codeName, failures);
+    lastSample2.delete(codeName);
+    return { state: "error", version: null, sampledAt: null, failures };
+  }
+  const cached = lastSample2.get(codeName);
+  if (cached && cached.dir === dir) return cached.sample;
+  const version = parseClaudeVersion(await readVersion(codeName));
+  if (version == null) {
+    const failures = (failureCount.get(codeName) ?? 0) + 1;
+    failureCount.set(codeName, failures);
+    lastSample2.delete(codeName);
+    return { state: "error", version: null, sampledAt: null, failures };
+  }
+  failureCount.delete(codeName);
+  const sample = {
+    state: "ok",
+    version,
+    sampledAt: new Date(now()).toISOString(),
+    failures: 0
+  };
+  lastSample2.set(codeName, { dir, sample });
+  return sample;
+}
+async function sampleRuntimeVersionOnce(codeNames, io = {}) {
+  for (const codeName of codeNames) await sampleRuntimeVersionFor(codeName, io);
+}
+function runtimeVersionFor(codeName) {
+  const cached = lastSample2.get(codeName);
+  if (cached) return cached.sample;
+  const failures = failureCount.get(codeName) ?? 0;
+  if (failures > 0) return { state: "error", version: null, sampledAt: null, failures };
+  return { state: "unsampled", version: null, sampledAt: null, failures: 0 };
+}
+var timer3 = null;
+var sampling = false;
+function startRuntimeVersionSampler(liveAgents, io = {}) {
+  if (timer3) return;
+  timer3 = setInterval(() => {
+    if (sampling) return;
+    sampling = true;
+    void sampleRuntimeVersionOnce(liveAgents(), io).catch(() => {
+    }).finally(() => {
+      sampling = false;
+    });
+  }, SAMPLE_INTERVAL_MS3);
+  timer3.unref?.();
+}
+function stopRuntimeVersionSampler() {
+  if (timer3) clearInterval(timer3);
+  timer3 = null;
+}
+
 // src/lib/opencode-slack-ingest.ts
 import { createHash as createHash17 } from "crypto";
 
@@ -13247,7 +13349,7 @@ function scheduleSessionRestart(codeName, delayMs, reason, breakerReason = "hot-
     clearTimeout(existing.timer);
     log(`[hot-reload] Coalesced restart for '${codeName}': replacing pending timer with ${reason}`);
   }
-  const timer3 = setTimeout(() => {
+  const timer4 = setTimeout(() => {
     pendingSessionRestarts.delete(codeName);
     const gate = restartGateFor(codeName, breakerReason);
     if (gate !== "bypass" && gate !== "proceed") {
@@ -13335,8 +13437,8 @@ function scheduleSessionRestart(codeName, delayMs, reason, breakerReason = "hot-
       void respawnAgentAfterMcpStop(codeName, reason);
     }
   }, delayMs);
-  timer3.unref?.();
-  pendingSessionRestarts.set(codeName, { timer: timer3, reason, breakerReason, beforeStop, auditDetail });
+  timer4.unref?.();
+  pendingSessionRestarts.set(codeName, { timer: timer4, reason, breakerReason, beforeStop, auditDetail });
 }
 function cancelPendingSessionRestart(codeName) {
   pendingRestartVerifications.delete(codeName);
@@ -13465,7 +13567,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-ETSEM5K6.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-RSVGRS63.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14208,10 +14310,10 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1010" : "dev";
-function resolveBrewPath(execFileSync2) {
+var agtCliVersion = true ? "0.28.1012" : "dev";
+function resolveBrewPath(execFileSync3) {
   try {
-    const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
+    const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
     if (out) return out;
   } catch {
   }
@@ -14225,7 +14327,7 @@ function resolveBrewPath(execFileSync2) {
   }
   return null;
 }
-function claudeBinaryInstalled(execFileSync2) {
+function claudeBinaryInstalled(execFileSync3) {
   const canonical = [
     "/home/linuxbrew/.linuxbrew/bin/claude",
     "/opt/homebrew/bin/claude",
@@ -14233,7 +14335,7 @@ function claudeBinaryInstalled(execFileSync2) {
   ];
   if (canonical.some((path) => existsSync19(path))) return true;
   try {
-    execFileSync2("which", ["claude"], { timeout: 5e3 });
+    execFileSync3("which", ["claude"], { timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -14267,9 +14369,9 @@ async function ensureToolkitCli(toolkitSlug) {
   }
   const { binary, installer, package: pkg, script } = integration.cli_tool;
   const resolvedInstaller = installer ?? "manual";
-  const { execFileSync: execFileSync2, execSync } = await import("child_process");
+  const { execFileSync: execFileSync3, execSync } = await import("child_process");
   try {
-    execFileSync2("which", [binary], { timeout: 5e3, stdio: "pipe" });
+    execFileSync3("which", [binary], { timeout: 5e3, stdio: "pipe" });
     toolkitCliEnsured.add(toolkitSlug);
     toolkitCliRetryAfter.delete(toolkitSlug);
     toolkitCliFailureCount.delete(toolkitSlug);
@@ -14290,14 +14392,14 @@ async function ensureToolkitCli(toolkitSlug) {
         return;
       }
       log(`[toolkit-install] ${toolkitSlug}: installing via npm (${pkg})\u2026`);
-      execFileSync2("npm", ["install", "-g", pkg], { timeout: 18e4, stdio: "pipe" });
+      execFileSync3("npm", ["install", "-g", pkg], { timeout: 18e4, stdio: "pipe" });
     } else if (resolvedInstaller === "brew") {
       if (!pkg) {
         log(`[toolkit-install] ${toolkitSlug}: installer=brew but no package declared`);
         toolkitCliEnsured.add(toolkitSlug);
         return;
       }
-      const brewPath = resolveBrewPath(execFileSync2);
+      const brewPath = resolveBrewPath(execFileSync3);
       if (!brewPath) {
         log(`[toolkit-install] ${toolkitSlug}: installer=brew but Homebrew not available \u2014 install manually: brew install ${pkg}`);
         toolkitCliEnsured.add(toolkitSlug);
@@ -14307,9 +14409,9 @@ async function ensureToolkitCli(toolkitSlug) {
       const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
       log(`[toolkit-install] ${toolkitSlug}: installing via brew (${pkg})\u2026`);
       if (isRoot) {
-        execFileSync2("sudo", ["-u", "ec2-user", "-H", brewPath, "install", pkg], { timeout: 18e4, stdio: "pipe", cwd: "/tmp" });
+        execFileSync3("sudo", ["-u", "ec2-user", "-H", brewPath, "install", pkg], { timeout: 18e4, stdio: "pipe", cwd: "/tmp" });
       } else {
-        execFileSync2(brewPath, ["install", pkg], { timeout: 18e4, stdio: "pipe" });
+        execFileSync3(brewPath, ["install", pkg], { timeout: 18e4, stdio: "pipe" });
       }
     } else if (resolvedInstaller === "script") {
       if (!script) {
@@ -14331,7 +14433,7 @@ async function ensureToolkitCli(toolkitSlug) {
     process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
   }
   try {
-    execFileSync2("which", [binary], { timeout: 5e3, stdio: "pipe" });
+    execFileSync3("which", [binary], { timeout: 5e3, stdio: "pipe" });
     log(`[toolkit-install] ${toolkitSlug}: installed \u2014 ${binary} now on PATH`);
     toolkitCliEnsured.add(toolkitSlug);
     toolkitCliRetryAfter.delete(toolkitSlug);
@@ -14379,16 +14481,16 @@ async function ensureIsolationImage(imageUri) {
   }
   isolationImageInFlight.add(imageUri);
   try {
-    const { execFileSync: execFileSync2 } = await import("child_process");
+    const { execFileSync: execFileSync3 } = await import("child_process");
     try {
-      execFileSync2("which", ["docker"], { timeout: 5e3, stdio: "pipe" });
+      execFileSync3("which", ["docker"], { timeout: 5e3, stdio: "pipe" });
     } catch {
       recordIsolationImageFailure(imageUri, `'docker' not found on host - required to pull the isolation image (install it, then the manager retries)`);
       return;
     }
     const hasAws = (() => {
       try {
-        execFileSync2("which", ["aws"], { timeout: 5e3, stdio: "pipe" });
+        execFileSync3("which", ["aws"], { timeout: 5e3, stdio: "pipe" });
         return true;
       } catch {
         return false;
@@ -14397,11 +14499,11 @@ async function ensureIsolationImage(imageUri) {
     if (isPublic) {
       if (hasAws) {
         try {
-          const password = execFileSync2("aws", ["ecr-public", "get-login-password", "--region", "us-east-1"], {
+          const password = execFileSync3("aws", ["ecr-public", "get-login-password", "--region", "us-east-1"], {
             timeout: 3e4,
             stdio: ["ignore", "pipe", "pipe"]
           }).toString().trim();
-          execFileSync2("docker", ["login", "--username", "AWS", "--password-stdin", "public.ecr.aws"], {
+          execFileSync3("docker", ["login", "--username", "AWS", "--password-stdin", "public.ecr.aws"], {
             input: password,
             timeout: 3e4,
             stdio: ["pipe", "pipe", "pipe"]
@@ -14416,11 +14518,11 @@ async function ensureIsolationImage(imageUri) {
         return;
       }
       try {
-        const password = execFileSync2("aws", ["ecr", "get-login-password", "--region", privRegion], {
+        const password = execFileSync3("aws", ["ecr", "get-login-password", "--region", privRegion], {
           timeout: 3e4,
           stdio: ["ignore", "pipe", "pipe"]
         }).toString().trim();
-        execFileSync2("docker", ["login", "--username", "AWS", "--password-stdin", registry], {
+        execFileSync3("docker", ["login", "--username", "AWS", "--password-stdin", registry], {
           input: password,
           timeout: 3e4,
           stdio: ["pipe", "pipe", "pipe"]
@@ -14501,7 +14603,7 @@ function runAsync(cmd, args, opts) {
       let stdout = "";
       let stderr = "";
       let settled = false;
-      const timer3 = setTimeout(() => {
+      const timer4 = setTimeout(() => {
         child.kill("SIGTERM");
         if (settled) return;
         settled = true;
@@ -14522,13 +14624,13 @@ function runAsync(cmd, args, opts) {
       child.on("error", (err) => {
         if (settled) return;
         settled = true;
-        clearTimeout(timer3);
+        clearTimeout(timer4);
         reject(err);
       });
       child.on("close", (code) => {
         if (settled) return;
         settled = true;
-        clearTimeout(timer3);
+        clearTimeout(timer4);
         resolve2({ code: code ?? -1, stdout, stderr });
       });
     }).catch(reject);
@@ -14583,11 +14685,11 @@ function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
 }
 var OPENCODE_NPM_VERSION = "1.18.3";
 async function ensureOpencodeBinary() {
-  const { execFileSync: execFileSync2 } = await import("child_process");
+  const { execFileSync: execFileSync3 } = await import("child_process");
   const bin = process.env["AGT_OPENCODE_BIN"]?.trim() || "opencode";
   const probe = () => {
     try {
-      execFileSync2(bin, ["--version"], { stdio: "ignore", timeout: 1e4 });
+      execFileSync3(bin, ["--version"], { stdio: "ignore", timeout: 1e4 });
       return true;
     } catch {
       return false;
@@ -14608,7 +14710,7 @@ async function ensureOpencodeBinary() {
     return false;
   }
   try {
-    const prefix = execFileSync2("npm", ["prefix", "-g"], { encoding: "utf-8", timeout: 1e4 }).trim();
+    const prefix = execFileSync3("npm", ["prefix", "-g"], { encoding: "utf-8", timeout: 1e4 }).trim();
     if (prefix) {
       const npmBin = join42(prefix, "bin");
       const current = (process.env.PATH ?? "").split(pathDelimiter);
@@ -14640,8 +14742,8 @@ async function ensureFrameworkBinary(frameworkId) {
   }
   frameworkBinaryChecked.add(frameworkId);
   lastManagedSettingsStatus = ensureClaudeManagedSettings();
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) {
     log("Homebrew not found (no `brew` on PATH, no /home/linuxbrew/.linuxbrew/bin/brew). Cannot auto-install Claude Code. Install manually: https://claude.ai/download");
     return;
@@ -14654,7 +14756,7 @@ async function ensureFrameworkBinary(frameworkId) {
     }
     return runAsync(brewPath, args, opts);
   };
-  const claudeExists = claudeBinaryInstalled(execFileSync2);
+  const claudeExists = claudeBinaryInstalled(execFileSync3);
   if (!claudeExists) {
     log(`Claude Code binary not found \u2014 installing via Homebrew${isRoot ? " (as ec2-user via sudo)" : ""}...`);
     try {
@@ -14689,13 +14791,13 @@ async function maybeUpgradeClaudeCode() {
   }
   claudeCodeUpgradeInFlight = true;
   stampClaudeCodeUpgradeMarker();
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) {
     claudeCodeUpgradeInFlight = false;
     return;
   }
-  if (!claudeBinaryInstalled(execFileSync2)) {
+  if (!claudeBinaryInstalled(execFileSync3)) {
     claudeCodeUpgradeInFlight = false;
     return;
   }
@@ -14825,8 +14927,8 @@ async function checkAndUpdateCli(opts) {
   }
 }
 async function checkAndUpdateCliViaBrew(force = false) {
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  const brewPath = resolveBrewPath(execFileSync2);
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  const brewPath = resolveBrewPath(execFileSync3);
   if (!brewPath) return "noop";
   {
     const brewPinRaw = resolveAgtCliPinRaw();
@@ -14853,13 +14955,13 @@ async function checkAndUpdateCliViaBrew(force = false) {
   }
   let metadataFresh = true;
   try {
-    execFileSync2(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
+    execFileSync3(brewPath, ["update", "--quiet"], { timeout: 6e4, stdio: "pipe" });
   } catch (err) {
     metadataFresh = false;
     log(`[self-update] brew update failed (continuing with stale cache): ${err.message}`);
   }
   try {
-    const outdated = execFileSync2(brewPath, ["outdated", "--json=v2"], {
+    const outdated = execFileSync3(brewPath, ["outdated", "--json=v2"], {
       timeout: 3e4,
       encoding: "utf-8"
     });
@@ -14894,7 +14996,7 @@ async function checkAndUpdateCliViaBrew(force = false) {
       const brewInstallHold = await selfUpdateDeviceStateHold(force);
       if (brewInstallHold) return brewInstallHold;
       try {
-        execFileSync2(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
+        execFileSync3(brewPath, ["upgrade", "integrity-labs/tap/agt"], {
           timeout: 12e4,
           stdio: "pipe"
         });
@@ -15071,7 +15173,7 @@ async function fetchUrgentDistTagVersion() {
   }
 }
 async function installAgtCliViaNpm(version, reasonLabel, force = false) {
-  const { execFileSync: execFileSync2 } = await import("child_process");
+  const { execFileSync: execFileSync3 } = await import("child_process");
   const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
   const cmd = isRoot ? "npm" : "sudo";
   const installArgs = [
@@ -15084,14 +15186,14 @@ async function installAgtCliViaNpm(version, reasonLabel, force = false) {
   const npmInstallHold = await selfUpdateDeviceStateHold(force);
   if (npmInstallHold) return npmInstallHold;
   try {
-    execFileSync2(cmd, args, { timeout: 18e4, stdio: "pipe" });
+    execFileSync3(cmd, args, { timeout: 18e4, stdio: "pipe" });
   } catch (err) {
     log(`[self-update] npm upgrade failed: ${err.message}`);
     return "failed";
   }
   let smokeOk = false;
   try {
-    const out = execFileSync2("agt", ["--version"], { timeout: 15e3, stdio: "pipe" }).toString();
+    const out = execFileSync3("agt", ["--version"], { timeout: 15e3, stdio: "pipe" }).toString();
     smokeOk = isAgtVersionSmokeOk(out, version);
     if (!smokeOk) {
       log(
@@ -15156,8 +15258,8 @@ function effectiveRuntimeAuthenticated() {
 async function maybeProbeClaudeRuntimeAuth() {
   if (runtimeAuthProbeInFlight) return;
   if (Date.now() - lastRuntimeAuthProbeAt < RUNTIME_AUTH_PROBE_INTERVAL_MS) return;
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  if (!claudeBinaryInstalled(execFileSync2)) return;
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  if (!claudeBinaryInstalled(execFileSync3)) return;
   runtimeAuthProbeInFlight = true;
   lastRuntimeAuthProbeAt = Date.now();
   try {
@@ -15266,8 +15368,8 @@ async function runHostUsageCommand() {
   }
 }
 async function maybePollHostUsageFromCycle() {
-  const { execFileSync: execFileSync2 } = await import("child_process");
-  if (!claudeBinaryInstalled(execFileSync2)) return;
+  const { execFileSync: execFileSync3 } = await import("child_process");
+  if (!claudeBinaryInstalled(execFileSync3)) return;
   await maybePollHostUsage({
     api,
     runUsageCommand: runHostUsageCommand,
@@ -15842,10 +15944,10 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-NLQ6AASM.js");
+      const { collectDiagnostics } = await import("../persistent-session-KPASTJIV.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
-        agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
+        agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
       });
     } catch (err) {
       log(`[restart] post-respawn diagnostics flush failed: ${err.message}`);
@@ -15908,7 +16010,7 @@ async function pollCycleInner() {
       getSlackToken: (codeName) => agentChannelTokens.get(codeName)?.slack ?? null,
       sendSlack: async (botToken, body) => {
         const controller = new AbortController();
-        const timer3 = setTimeout(() => controller.abort(), 5e3);
+        const timer4 = setTimeout(() => controller.abort(), 5e3);
         try {
           const res = await fetch("https://slack.com/api/chat.postMessage", {
             method: "POST",
@@ -15925,7 +16027,7 @@ async function pollCycleInner() {
           const isAbort = err.name === "AbortError";
           return { ok: false, error: isAbort ? "timeout" : err.message };
         } finally {
-          clearTimeout(timer3);
+          clearTimeout(timer4);
         }
       },
       // ENG-6399: report the restart to audit_log via POST /host/restart-event.
@@ -15984,9 +16086,9 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-NLQ6AASM.js");
+      const { collectDiagnostics } = await import("../persistent-session-KPASTJIV.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
-      const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor) : void 0;
+      const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
       try {
         const { execSync: es } = await import("child_process");
@@ -16160,7 +16262,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-ETSEM5K6.js");
+      } = await import("../responsiveness-probe-RSVGRS63.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -16277,7 +16379,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-ETSEM5K6.js");
+        } = await import("../responsiveness-probe-RSVGRS63.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -16433,7 +16535,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-J3MNBHCZ.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-YV2X4AGF.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -20813,7 +20915,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-ETSEM5K6.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-RSVGRS63.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -20856,10 +20958,10 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-NLQ6AASM.js");
+        const { collectDiagnostics } = await import("../persistent-session-KPASTJIV.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
-          agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
+          agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
         });
       } catch (err) {
         log(`[restart-lane] post-respawn diagnostics flush failed for '${codeName}': ${err.message}`);
@@ -20907,10 +21009,10 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-NLQ6AASM.js");
+      const { collectDiagnostics } = await import("../persistent-session-KPASTJIV.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
-        agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor)
+        agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
       });
     } catch (err) {
       log(`[fast-mcp-respawn] post-respawn diagnostics flush failed for '${codeName}': ${err.message}`);
@@ -21508,17 +21610,17 @@ async function maybeInjectKanbanCheck(codeName, agentId, actionableCount, signat
     });
     return;
   }
-  const failureCount = (priorState?.failureCount ?? 0) + 1;
+  const failureCount2 = (priorState?.failureCount ?? 0) + 1;
   setKanbanNudgeState(codeName, {
     signature: priorState?.signature ?? signature,
     nudgedAt: priorState?.nudgedAt ?? 0,
     ...priorState?.nudgeCount !== void 0 ? { nudgeCount: priorState.nudgeCount } : {},
-    failureCount,
+    failureCount: failureCount2,
     failedAt: Date.now()
   });
-  if (failureCount === KANBAN_NOTICE_BREAKER_THRESHOLD) {
+  if (failureCount2 === KANBAN_NOTICE_BREAKER_THRESHOLD) {
     log(
-      `[manager-worker] kanban notice rail BREAKER OPEN for '${codeName}' \u2014 ${failureCount} consecutive enqueue failures; retries continue at the capped interval`
+      `[manager-worker] kanban notice rail BREAKER OPEN for '${codeName}' \u2014 ${failureCount2} consecutive enqueue failures; retries continue at the capped interval`
     );
     getHostId().then((hostId) => {
       if (!hostId) return;
@@ -21529,7 +21631,7 @@ async function maybeInjectKanbanCheck(codeName, agentId, actionableCount, signat
         payload: {
           agent_code_name: codeName,
           agent_id: agentId,
-          consecutive_failures: failureCount,
+          consecutive_failures: failureCount2,
           retry_interval_ms: KANBAN_HYBRID_MAX_CADENCE_MS
         },
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
@@ -21542,7 +21644,7 @@ async function maybeInjectKanbanCheck(codeName, agentId, actionableCount, signat
     return;
   }
   log(
-    `[manager-worker] kanban direct-chat enqueue failed for '${codeName}' (${failureCount} consecutive) - backing off before the next attempt`
+    `[manager-worker] kanban direct-chat enqueue failed for '${codeName}' (${failureCount2} consecutive) - backing off before the next attempt`
   );
 }
 var lastHarvestAt = /* @__PURE__ */ new Map();
@@ -21578,7 +21680,7 @@ async function processClaudePairSessions(agents) {
     // cannot take it for itself — by the time it runs, the write it is looking
     // for may already have happened.
     snapshotPairConfig
-  } = await import("../claude-pair-runtime-EQDC53WO.js");
+  } = await import("../claude-pair-runtime-NPXBXUSE.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -22399,6 +22501,7 @@ function startPolling() {
   livenessTimer.unref();
   startPaneOccupancySampler(() => agentState.persistentSessionAgents);
   startPidPressureSampler(() => agentState.persistentSessionAgents);
+  startRuntimeVersionSampler(() => agentState.persistentSessionAgents);
   {
     const seedOutcome = seedClaudeConfigFromLegacy({ log });
     const configDirUsable = claudeConfigDirIsReady();
@@ -22564,6 +22667,7 @@ async function stopPolling(opts = {}) {
   }
   stopPaneOccupancySampler();
   stopPidPressureSampler();
+  stopRuntimeVersionSampler();
   const shutdownTimer = setTimeout(() => {
     log("Shutdown timeout exceeded (15s), forcing exit");
     process.exit(opts.forcedExitCode ?? 1);