@integrity-labs/agt-cli 0.28.1127 → 0.28.1129

package/dist/{claude-pair-runtime-H55GPDDO.js → claude-pair-runtime-LDJXKNWF.js}

@@ -4,7 +4,7 @@ import {
 import {
   consumerTermsOffKeys,
   selectRowKeys
-} from "./chunk-OCMJ5E6J.js";
+} from "./chunk-B6UYVEMD.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -269,7 +269,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-D5O5MMNY.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-QSE66QYT.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -739,4 +739,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-H55GPDDO.js.map
+//# sourceMappingURL=claude-pair-runtime-LDJXKNWF.js.map

package/dist/lib/manager-worker.js

@@ -7,6 +7,7 @@ import {
   DEAD_CHANNEL_MS,
   FIRST_CONNECT_WINDOW_MS,
   HostFlagStore,
+  RM_POLICY_RELATIVE_PATH,
   RestartBreaker,
   SUPERVISOR_RESTART_EXIT_CODE,
   TunnelWatcher,
@@ -40,6 +41,7 @@ import {
   getCachedClaudeAuthModeRaw,
   getHostId,
   givenUpMcpServerKeys,
+  guardrailsForProvision,
   isIntegrationBucketedReason,
   isProvisioningReloadReason,
   isTransientAuthFailure,
@@ -49,6 +51,7 @@ import {
   markQuarantinedForProbe,
   migrateAgentDirToIdKeyed,
   mintAgentKey,
+  parseRmPolicy,
   pinAllowsUrgent,
   provision,
   provisionAutoKanbanProgressHook,
@@ -57,6 +60,7 @@ import {
   provisionLongCommandHook,
   provisionOrientHook,
   provisionPreCompactHook,
+  provisionRootRmHook,
   provisionSessionStateHook,
   provisionStopHook,
   readEnvNumber,
@@ -70,8 +74,9 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash,
+  shellGuard,
   tripClass
-} from "../chunk-7W5TLMFG.js";
+} from "../chunk-2YWHPXY7.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -158,7 +163,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-37PZYGGA.js";
+} from "../chunk-23GMWGOP.js";
 import {
   ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
@@ -254,6 +259,7 @@ import {
   parseUsageReport,
   peekCurrentSession,
   pickNewerClassification,
+  redactPaneFrame,
   remoteMcpServerKey,
   resolveAgentTimezone,
   resolveAvatarEnvUrl,
@@ -268,11 +274,15 @@ import {
   subagentActivityAgeSeconds,
   sumTranscriptUsageInWindow,
   transcriptActivityAgeSeconds
-} from "../chunk-6J7WE4J4.js";
+} from "../chunk-JFABPA3Z.js";
 import {
   classifyUnanswerablePane,
-  paneRemedy
-} from "../chunk-OCMJ5E6J.js";
+  focusedConfirmDialogBlock,
+  isParkedOnToolPermissionPrompt,
+  paneRemedy,
+  sendDialogKeys,
+  simpleTextHash
+} from "../chunk-B6UYVEMD.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
@@ -314,7 +324,7 @@ function defaultUnique() {
 // src/lib/manager-worker.ts
 import { execFileSync as syncExecFile } from "child_process";
 import { join as join43, dirname as dirname11, delimiter as pathDelimiter } from "path";
-import { homedir as homedir17, platform as platform3 } from "os";
+import { homedir as homedir17, hostname, platform as platform3 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../../packages/core/dist/provisioning/channel-policy-env.js
@@ -822,6 +832,237 @@ var AnchorSessionLifecycle = class {
   }
 };
 
+// src/lib/dangerous-rm-backstop.ts
+import { lstatSync } from "fs";
+var BACKSTOP_AFTER_MS = 2 * 6e4;
+var MAX_ANSWERS_PER_PROMPT = 3;
+var DANGEROUS_RM_LINE = /Dangerous rm operation\b/;
+var SEARCH_LINES = 40;
+var STANDARD_ROOT_ENTRIES = /* @__PURE__ */ new Set([
+  "vmlinuz",
+  "vmlinuz.old",
+  "initrd.img",
+  "initrd.img.old",
+  "swapfile",
+  "swap.img",
+  ".autorelabel",
+  "bin",
+  "boot",
+  "dev",
+  "etc",
+  "home",
+  "lib",
+  "lib32",
+  "lib64",
+  "libx32",
+  "lost+found",
+  "media",
+  "mnt",
+  "opt",
+  "proc",
+  "root",
+  "run",
+  "sbin",
+  "snap",
+  "srv",
+  "sys",
+  "tmp",
+  "usr",
+  "var"
+]);
+function stripBox(line) {
+  return line.replace(/^\s*│ ?/, "").replace(/\s*│\s*$/, "");
+}
+function readDangerousRmPrompt(pane) {
+  if (!pane || !isParkedOnToolPermissionPrompt(pane)) return null;
+  const block = focusedConfirmDialogBlock(pane);
+  if (!block) return null;
+  const lines = pane.split("\n");
+  const footer = lines.lastIndexOf(block[block.length - 1]);
+  if (footer < 0) return null;
+  let head = -1;
+  for (let i = footer; i >= Math.max(0, footer - SEARCH_LINES); i--) {
+    if (DANGEROUS_RM_LINE.test(lines[i])) {
+      head = i;
+      break;
+    }
+  }
+  if (head < 0) return null;
+  const reasonParts = [stripBox(lines[head]).replace(/^.*Dangerous rm operation\s*(?:on\s*)?/, "")];
+  for (let i = head + 1; i < footer; i++) {
+    const t = stripBox(lines[i]).trim();
+    if (!t || /^Do you want to proceed\?/.test(t)) break;
+    reasonParts.push(t);
+  }
+  const reason = reasonParts.join(" ").trim();
+  let commandLines = null;
+  for (let i = head - 1; i >= Math.max(0, head - SEARCH_LINES); i--) {
+    if (lines[i].trim() === "Bash command") {
+      const cmd = [];
+      for (let j = i + 1; j < head; j++) {
+        if (!/^\s*│/.test(lines[j])) break;
+        cmd.push(stripBox(lines[j]));
+      }
+      if (cmd.length) commandLines = cmd;
+      break;
+    }
+  }
+  const key = simpleTextHash([reason, ...commandLines ?? [], ...block].join("\n"));
+  return { reason, commandLines, key };
+}
+function judgeReading(command) {
+  const a = shellGuard.analyze(command);
+  if (!a.ok || a.heredoc || a.substitution || a.findDelete) return { rule: "unparseable", target: null };
+  if (a.rm.length !== 1) return { rule: "not-single-rm", target: null };
+  const inv = a.rm[0];
+  if (inv.targetsUnknown) return { rule: "unresolved-target", target: null };
+  if (inv.recursive) return { rule: "recursive", target: null };
+  if (inv.targets.length !== 1) return { rule: "multiple-targets", target: null };
+  const t = inv.targets[0];
+  if (t.expansion || t.glob || t.tilde) return { rule: "unresolved-target", target: null };
+  if (!/^\/[^/]+$/.test(t.text)) return { rule: "not-root-level", target: null };
+  if (STANDARD_ROOT_ENTRIES.has(t.text.slice(1))) return { rule: "standard-root-entry", target: t.text };
+  return { rule: "single-root-file", target: t.text };
+}
+var MAX_YES_COMMAND_LINES = 6;
+function looksElided(lines) {
+  if (lines.length > MAX_YES_COMMAND_LINES) return true;
+  return lines.some((l) => /…|\.\.\.\s*$|\+\s*\d+\s+(?:more\s+)?lines?\b/i.test(l));
+}
+function commandReadings(lines) {
+  if (lines.length === 1) return [lines[0]];
+  return [lines.join(""), lines.join(" "), lines.join("\n")];
+}
+function decideDangerousRm(prompt, policy, opts = {}) {
+  const lstat = opts.lstat ?? lstatSync;
+  const command = prompt.commandLines ? commandReadings(prompt.commandLines)[0] : null;
+  const no = (rule, alert, target2 = null) => ({
+    answer: "no",
+    rule,
+    alert,
+    command,
+    target: target2
+  });
+  if (policy === null) return no("policy-unknown", true);
+  if (policy.no_delete) return no("no-delete-guardrail", false);
+  if (!prompt.commandLines) return no("command-not-visible", true);
+  if (looksElided(prompt.commandLines)) return no("command-elided", true);
+  const verdicts = commandReadings(prompt.commandLines).map(judgeReading);
+  const first = verdicts[0];
+  if (first.rule !== "single-root-file") return no(first.rule, true, first.target);
+  if (!verdicts.every((v) => v.rule === "single-root-file" && v.target === first.target)) {
+    return no("unparseable", true);
+  }
+  const target = first.target;
+  if (!/^critical path:/.test(prompt.reason) || !prompt.reason.endsWith(`: ${target}`)) {
+    return no("reason-mismatch", true, target);
+  }
+  if (opts.isolated) return no("isolated-agent", false, target);
+  try {
+    if (!lstat(target).isFile()) return no("not-regular-file", true, target);
+  } catch {
+    return no("not-regular-file", true, target);
+  }
+  return { answer: "yes", rule: "single-root-file", alert: false, command, target };
+}
+var OPTION_ROW = /^\s*(❯\s*)?(\d)\.\s+(.*?)\s*$/;
+function promptAnswerKeys(pane, answer) {
+  const block = focusedConfirmDialogBlock(pane);
+  if (!block) return answer === "no" ? ["Escape"] : null;
+  let cursor = -1;
+  let target = -1;
+  for (let i = 0; i < block.length; i++) {
+    const m = OPTION_ROW.exec(block[i]);
+    if (!m) continue;
+    if (m[1]) cursor = i;
+    const label = m[3];
+    if (target < 0 && (answer === "yes" ? label === "Yes" : /^No\b/.test(label))) target = i;
+  }
+  if (cursor < 0 || target < 0) return answer === "no" ? ["Escape"] : null;
+  const d = target - cursor;
+  return [...Array(Math.abs(d)).fill(d > 0 ? "Down" : "Up"), "Enter"];
+}
+var DangerousRmBackstop = class {
+  episodes = /* @__PURE__ */ new Map();
+  observe(agent, pane, now) {
+    const prompt = readDangerousRmPrompt(pane);
+    if (!prompt) {
+      if (pane) this.episodes.delete(agent);
+      return null;
+    }
+    const ep = this.episodes.get(agent);
+    if (!ep || ep.key !== prompt.key) {
+      this.episodes.set(agent, {
+        key: prompt.key,
+        firstSeen: now,
+        answeredAt: null,
+        answers: 0,
+        inFlight: false,
+        reportedStuck: false,
+        reportedDispatchFailure: false
+      });
+      return null;
+    }
+    if (ep.inFlight) return null;
+    if (ep.answeredAt !== null) {
+      if (now - ep.answeredAt < BACKSTOP_AFTER_MS) return null;
+      if (ep.answers >= MAX_ANSWERS_PER_PROMPT) {
+        if (ep.reportedStuck) return null;
+        ep.reportedStuck = true;
+        return { kind: "still-parked", prompt, sinceAnswerMs: now - ep.answeredAt, answers: ep.answers };
+      }
+      ep.inFlight = true;
+      return { kind: "answer", prompt, waitedMs: now - ep.answeredAt };
+    }
+    if (now - ep.firstSeen < BACKSTOP_AFTER_MS) return null;
+    ep.inFlight = true;
+    return { kind: "answer", prompt, waitedMs: now - ep.firstSeen };
+  }
+  /** The keys for `key` were sent: this prompt is answered. */
+  answered(agent, key, now) {
+    const ep = this.episodes.get(agent);
+    if (!ep || ep.key !== key) return;
+    ep.inFlight = false;
+    ep.answeredAt = now;
+    ep.answers += 1;
+  }
+  /**
+   * Sending failed: release the reservation so a later sweep retries. Returns
+   * true the FIRST time for this prompt, so the caller alerts once rather than
+   * on every ~10s retry.
+   */
+  dispatchFailed(agent, key) {
+    const ep = this.episodes.get(agent);
+    if (!ep || ep.key !== key) return false;
+    ep.inFlight = false;
+    if (ep.reportedDispatchFailure) return false;
+    ep.reportedDispatchFailure = true;
+    return true;
+  }
+  forget(agent) {
+    this.episodes.delete(agent);
+  }
+};
+function planAnswer(pane, decision) {
+  const keys = promptAnswerKeys(pane, decision.answer);
+  if (keys) return { decision, keys };
+  return {
+    decision: { ...decision, answer: "no", rule: "yes-row-unreadable", alert: true },
+    keys: promptAnswerKeys(pane, "no") ?? ["Escape"]
+  };
+}
+function readRmPolicyText(read) {
+  try {
+    return parseRmPolicy(read());
+  } catch {
+    return null;
+  }
+}
+function describeDecision(codeName, host, decision, waitedMs, attempted = false) {
+  const cmd = decision.command === null ? "(command not visible in the pane)" : JSON.stringify(decision.command);
+  return `host ${host}, agent ${codeName}: ${attempted ? "tried to answer" : "answered"} ${decision.answer === "yes" ? "Yes" : "No"} to Claude Code's "Dangerous rm operation" prompt after ${Math.round(waitedMs / 1e3)}s unanswered (rule ${decision.rule}). Command: ${cmd}`;
+}
+
 // src/lib/channel-restart-decision.ts
 function launchableChannelIds(channelConfigs) {
   if (!channelConfigs) return /* @__PURE__ */ new Set();
@@ -2728,7 +2969,7 @@ function provisionReviewPoster(codeName, sourceDir = resolveBundledReviewAssetDi
 }
 
 // src/lib/id-keyed-migration.ts
-import { existsSync as existsSync3, lstatSync, readlinkSync, renameSync as renameSync2 } from "fs";
+import { existsSync as existsSync3, lstatSync as lstatSync2, readlinkSync, renameSync as renameSync2 } from "fs";
 import { join as join10 } from "path";
 import { homedir as homedir3 } from "os";
 var ID_KEYED_MIGRATION_FLAG = "id-keyed-layout-migration";
@@ -2775,7 +3016,7 @@ function maybeMigrateAgentToIdKeyedLayout(agent, deps) {
   const newCwd = join10(idPath, "project");
   let codeNameKind;
   try {
-    codeNameKind = lstatSync(codeNamePath).isSymbolicLink() ? "symlink" : "realdir";
+    codeNameKind = lstatSync2(codeNamePath).isSymbolicLink() ? "symlink" : "realdir";
   } catch {
     codeNameKind = "absent";
   }
@@ -4117,8 +4358,8 @@ var DEFAULT_LOCAL_EVAL_MODEL = "gemma4:12b";
 var EVAL_TIMEOUT_MS = 12e4;
 async function runLocalEvalChat(prompt, opts) {
   const endpoint = new URL(opts.url);
-  const hostname = endpoint.hostname.toLowerCase();
-  const isLoopback = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+  const hostname2 = endpoint.hostname.toLowerCase();
+  const isLoopback = hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "::1" || hostname2 === "[::1]";
   if (!isLoopback) {
     throw new Error(`local eval url must be loopback-only, got host '${endpoint.hostname}'`);
   }
@@ -7874,7 +8115,7 @@ function resolveModelChain(refreshData) {
 }
 
 // src/lib/manager/claude-auth.ts
-import { chmodSync as chmodSync2, existsSync as existsSync14, lstatSync as lstatSync2, mkdirSync as mkdirSync11, rmSync as rmSync6 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync14, lstatSync as lstatSync3, mkdirSync as mkdirSync11, rmSync as rmSync6 } from "fs";
 import { join as join34 } from "path";
 import { homedir as homedir13 } from "os";
 async function applyClaudeAuthToEnv(childEnv, label, options = {}) {
@@ -7913,13 +8154,13 @@ function claudeConfigDirForChild(childEnv) {
 }
 function ensurePrivateConfigDir(dir, platform4 = process.platform, chmod = chmodSync2) {
   mkdirSync11(dir, { recursive: true, mode: 448 });
-  const st = lstatSync2(dir);
+  const st = lstatSync3(dir);
   if (!st.isDirectory()) {
     throw new Error(`isolated Claude config dir ${dir} is not a real directory (symlink or file); refusing`);
   }
   if (platform4 === "win32") return;
   if ((st.mode & 511) !== 448) chmod(dir, 448);
-  const mode = lstatSync2(dir).mode & 511;
+  const mode = lstatSync3(dir).mode & 511;
   if (mode !== 448) {
     throw new Error(`isolated Claude config dir ${dir} could not be made private (mode ${mode.toString(8)}); refusing`);
   }
@@ -13511,6 +13752,64 @@ async function reportReaperEvent(agentId, reaper, action, reason) {
     );
   }
 }
+var dangerousRmBackstop = new DangerousRmBackstop();
+async function runDangerousRmBackstop(agentId, codeName, pane) {
+  let action = null;
+  try {
+    action = dangerousRmBackstop.observe(codeName, pane, Date.now());
+    if (!action || pane === null) return;
+    const host = hostname();
+    const scrub = (s) => {
+      const r = redactPaneFrame(s);
+      return r.length > 400 ? `${r.slice(0, 399)}\u2026` : r;
+    };
+    if (action.kind === "still-parked") {
+      const msg = `host ${host}, agent ${codeName}: the same "Dangerous rm operation" prompt is on screen after the backstop answered it ${action.answers} times (last ${Math.round(action.sinceAnswerMs / 1e3)}s ago), so either the keys are not landing or the agent keeps re-running the command; not answering again`;
+      log(`[dangerous-rm-backstop] ${msg}`);
+      void reportReaperEvent(agentId, "dangerous-rm-backstop", "alert", msg);
+      return;
+    }
+    const policy = readRmPolicyText(
+      () => readFileSync34(join43(getFramework("claude-code").getAgentDir(codeName), RM_POLICY_RELATIVE_PATH), "utf-8")
+    );
+    const decision = decideDangerousRm(action.prompt, policy, {
+      isolated: isolationMode(codeName) === "docker"
+    });
+    const shown = { ...decision, command: decision.command === null ? null : scrub(decision.command) };
+    const plan = planAnswer(pane, decision);
+    const final = plan.decision;
+    const line = describeDecision(codeName, host, { ...final, command: shown.command }, action.waitedMs);
+    try {
+      await sendDialogKeys(`agt-${codeName}`, {
+        kind: "dangerous-rm-backstop",
+        keys: plan.keys,
+        interKeyDelayMs: 150,
+        logMessage: `Answered ${final.answer} to a dangerous-rm prompt`
+      });
+    } catch (err) {
+      const first = dangerousRmBackstop.dispatchFailed(codeName, action.prompt.key);
+      const tried = describeDecision(codeName, host, { ...final, command: shown.command }, action.waitedMs, true);
+      log(`[dangerous-rm-backstop] ${tried} - SEND FAILED, will retry: ${err.message}`);
+      if (first) {
+        void reportReaperEvent(
+          agentId,
+          "dangerous-rm-backstop",
+          "alert",
+          `${tried} - the keys could not be sent, so the prompt is still up; retrying`
+        );
+      }
+      return;
+    }
+    dangerousRmBackstop.answered(codeName, action.prompt.key, Date.now());
+    log(
+      `[dangerous-rm-backstop] ${line} (keys ${plan.keys.join(" ")}${policy?.sources.length ? `; guardrails ${policy.sources.join(", ")}` : ""})`
+    );
+    if (final.alert) void reportReaperEvent(agentId, "dangerous-rm-backstop", "alert", line);
+  } catch (err) {
+    if (action?.kind === "answer") dangerousRmBackstop.dispatchFailed(codeName, action.prompt.key);
+    log(`[dangerous-rm-backstop] ${codeName}: failed (suppressed): ${err.message}`);
+  }
+}
 function recordRestartForBreaker(codeName, reason) {
   if (reason === "managed-mcp-churn" && mcpFlapDampener.flappedWithin(codeName, FLAP_CHANNEL_MANAGED_MCP, FLAP_BREAKER_COOLDOWN_MS)) {
     log(
@@ -14192,7 +14491,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-JJQ3AC5E.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-NC4A3FCR.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -14950,7 +15249,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1127" : "dev";
+var agtCliVersion = true ? "0.28.1129" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -16580,7 +16879,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-D5O5MMNY.js");
+      const { collectDiagnostics } = await import("../persistent-session-QSE66QYT.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -16722,7 +17021,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-D5O5MMNY.js");
+      const { collectDiagnostics } = await import("../persistent-session-QSE66QYT.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -16930,7 +17229,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-JJQ3AC5E.js");
+      } = await import("../responsiveness-probe-NC4A3FCR.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -17047,7 +17346,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-JJQ3AC5E.js");
+        } = await import("../responsiveness-probe-NC4A3FCR.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -17333,7 +17632,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-JJQ3AC5E.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-NC4A3FCR.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -17364,7 +17663,7 @@ async function pollCycleInner() {
         TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
         bindSourceEscalations
       } = await import("../transcript-mount-health-OHE6IVJV.js");
-      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-D5O5MMNY.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-QSE66QYT.js");
       const mountConfig = resolveTranscriptMountConfig();
       const liveAgents = agentState.persistentSessionAgents;
       for (const tracked of [
@@ -17529,7 +17828,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-WYJJYTQB.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-23ERZN4N.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -17817,16 +18116,19 @@ async function pollCycleInner() {
           omittedNoSession += 1;
           continue;
         }
+        let sweptPane = null;
         const observation = observeBlockedPrompt(agent.code_name, true, (codeName) => {
           try {
-            return syncExecFile("tmux", ["capture-pane", "-t", `agt-${codeName}`, "-p"], {
+            sweptPane = syncExecFile("tmux", ["capture-pane", "-t", `agt-${codeName}`, "-p"], {
               stdio: ["ignore", "pipe", "ignore"],
               timeout: 2e3
             }).toString();
+            return sweptPane;
           } catch {
             return null;
           }
         });
+        void runDangerousRmBackstop(agent.agent_id, agent.code_name, sweptPane);
         const { observation: settled, cost } = blockedPromptCost.settle(
           agent.code_name,
           observation
@@ -21591,6 +21893,11 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash20("sha256")
     } catch (err) {
       log(`[persistent-session] Failed to provision long-command hook for '${codeName}': ${err.message}`);
     }
+    try {
+      provisionRootRmHook(codeName);
+    } catch (err) {
+      log(`[persistent-session] Failed to provision root-rm hook for '${codeName}': ${err.message}`);
+    }
     try {
       provisionSessionStateHook(codeName);
     } catch (err) {
@@ -22116,7 +22423,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-JJQ3AC5E.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-NC4A3FCR.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -22159,7 +22466,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-D5O5MMNY.js");
+        const { collectDiagnostics } = await import("../persistent-session-QSE66QYT.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22210,7 +22517,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-D5O5MMNY.js");
+      const { collectDiagnostics } = await import("../persistent-session-QSE66QYT.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -22883,7 +23190,7 @@ async function processClaudePairSessions(agents) {
     // cannot take it for itself — by the time it runs, the write it is looking
     // for may already have happened.
     snapshotPairConfig
-  } = await import("../claude-pair-runtime-H55GPDDO.js");
+  } = await import("../claude-pair-runtime-LDJXKNWF.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -23133,7 +23440,8 @@ function generateArtifacts(agent, refreshData, adapter, renderIntegrationsSectio
     knowledgeDelivery: refreshData.agent.knowledge_delivery ?? "both",
     teamMembers: refreshData.team_members ?? void 0,
     people: refreshData.people ?? void 0,
-    guardrails: refreshData.guardrails,
+    // ENG-11513: a failed resolution becomes undefined (unknown), not [] (none).
+    guardrails: guardrailsForProvision(refreshData.guardrails, refreshData.guardrails_resolved),
     // ENG-9862: standing rules (ENG-9789), threaded exactly like guardrails so
     // the claude-code adapter can render them into CLAUDE.md. Absent on an
     // older API renders nothing, which is the documented fail-direction.