@integrity-labs/agt-cli 0.28.1177 → 0.28.1178

package/dist/{chunk-DJNCIWVG.js → chunk-MO5JQVBG.js}

@@ -1,6 +1,6 @@
 import {
   encodeClaudeProjectPath
-} from "./chunk-47P33SZF.js";
+} from "./chunk-MHSZBN6M.js";
 
 // src/lib/daily-session.ts
 import { randomUUID } from "crypto";
@@ -235,4 +235,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-DJNCIWVG.js.map
+//# sourceMappingURL=chunk-MO5JQVBG.js.map

package/dist/{chunk-NHUXO5H2.js → chunk-R2NQG77N.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-XWVM4KPK.js";
 import {
   FORCED_UPDATE_HARD_DEADLINE_MS
-} from "./chunk-47P33SZF.js";
+} from "./chunk-MHSZBN6M.js";
 import {
   effectiveClaudeJsonPath
 } from "./chunk-AIUIMEUS.js";
@@ -722,4 +722,4 @@ export {
   probeClaudeInstalls,
   maybeUpdateClaudeCode
 };
-//# sourceMappingURL=chunk-NHUXO5H2.js.map
+//# sourceMappingURL=chunk-R2NQG77N.js.map

package/dist/{claude-code-updater-H7RNX6M7.js → claude-code-updater-F2O3LAWX.js}

@@ -13,9 +13,9 @@ import {
   probeClaudeInstalls,
   readsAsNativeInstall,
   shouldRunClaudeCodeUpdater
-} from "./chunk-NHUXO5H2.js";
+} from "./chunk-R2NQG77N.js";
 import "./chunk-XWVM4KPK.js";
-import "./chunk-47P33SZF.js";
+import "./chunk-MHSZBN6M.js";
 import "./chunk-AIUIMEUS.js";
 import "./chunk-DGUM43GV.js";
 export {
@@ -34,4 +34,4 @@ export {
   readsAsNativeInstall,
   shouldRunClaudeCodeUpdater
 };
-//# sourceMappingURL=claude-code-updater-H7RNX6M7.js.map
+//# sourceMappingURL=claude-code-updater-F2O3LAWX.js.map

package/dist/{claude-pair-runtime-53JY6TQX.js → claude-pair-runtime-I6KVCUBG.js}

@@ -8,7 +8,7 @@ import {
 import {
   redactPaneFrame,
   sanitizeTerminalFrame
-} from "./chunk-47P33SZF.js";
+} from "./chunk-MHSZBN6M.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -321,7 +321,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-HVYGIS5C.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-7HP4KOED.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -836,4 +836,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-53JY6TQX.js.map
+//# sourceMappingURL=claude-pair-runtime-I6KVCUBG.js.map

package/dist/lib/manager-worker.js

@@ -11,6 +11,7 @@ import {
   RestartBreaker,
   SUPERVISOR_RESTART_EXIT_CODE,
   TunnelWatcher,
+  adoptHostKeyInProcess,
   api,
   atomicWriteFileSync,
   buildClaudeAgentMatcher,
@@ -52,6 +53,7 @@ import {
   markQuarantinedForProbe,
   migrateAgentDirToIdKeyed,
   mintAgentKey,
+  mintRotatedHostKey,
   parseRmPolicy,
   pinAllowsUrgent,
   provision,
@@ -65,6 +67,7 @@ import {
   provisionSessionStateHook,
   provisionStopHook,
   readEnvNumber,
+  readEtcEnvironmentValue,
   readHostArchiveAddress,
   reapLegacyTokenFile,
   reapMissingMcpSessions,
@@ -76,8 +79,10 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   shellGuard,
-  tripClass
-} from "../chunk-45UH24I2.js";
+  tripClass,
+  writeEtcEnvironment,
+  writeProfileDScript
+} from "../chunk-DAIXT5DR.js";
 import {
   CLAUDE_CODE_SECURITY_FLOOR,
   SELF_UPDATE_TIMEOUTS,
@@ -91,7 +96,11 @@ import {
   runSafeCleanup,
   tightestDiskStat,
   withPackageCacheLock
-} from "../chunk-NHUXO5H2.js";
+} from "../chunk-R2NQG77N.js";
+import {
+  rewriteSupervisorApiKey,
+  supervisorChannelsRefusing
+} from "../chunk-H3JMPEH7.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -178,7 +187,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-H37WRW2E.js";
+} from "../chunk-3XURNDW5.js";
 import {
   isAgentIdle,
   isStaleForToday,
@@ -187,7 +196,7 @@ import {
   sessionTranscriptDir,
   subagentActivityAgeSeconds,
   transcriptActivityAgeSeconds
-} from "../chunk-DJNCIWVG.js";
+} from "../chunk-MO5JQVBG.js";
 import {
   classifyUnanswerablePane,
   focusedConfirmDialogBlock,
@@ -303,9 +312,10 @@ import {
   scrubPreservingIdentifiers,
   senderPolicyIsEnforcedOn,
   serializeAccountEnforcementMarker,
+  shouldMintReplacementKey,
   stabiliseResetInstant,
   sumTranscriptUsageInWindow
-} from "../chunk-47P33SZF.js";
+} from "../chunk-MHSZBN6M.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -3641,6 +3651,100 @@ function maybeMigrateAgentToIdKeyedLayout(agent, deps) {
   }
 }
 
+// src/lib/host-key-rotation.ts
+async function adoptRotatedHostKey(deps) {
+  const refusals = deps.preflightPersist?.() ?? [];
+  if (refusals.length > 0) {
+    deps.log(
+      `[key-rotation] not minting: ${refusals.length} persist channel(s) would refuse the new key, so a mint would leak an active credential for nothing. ${refusals.join(" | ")}`
+    );
+    return deps.held ? { status: "persist-refused", reasons: refusals, held: deps.held } : { status: "persist-refused", reasons: refusals };
+  }
+  let minted;
+  if (deps.held) {
+    minted = deps.held;
+    deps.log(`[key-rotation] retrying the persist of ${minted.prefix}, minted earlier for this request`);
+  } else {
+    let result;
+    try {
+      result = await deps.mint();
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      deps.log(`[key-rotation] mint failed: ${detail}`);
+      return { status: "error", detail };
+    }
+    if (result && "refused" in result) {
+      deps.log(
+        `[key-rotation] the control plane refused the mint for good: ${result.refused}. Not retrying this request. If it never completes, a compromised rotation clears it (docs/runbooks/host-api-key-rotation.md).`
+      );
+      return { status: "mint-refused", reason: result.refused };
+    }
+    if (!result || !result.rawKey || !result.prefix) {
+      deps.log("[key-rotation] mint returned nothing usable - leaving the current key in force");
+      return { status: "mint-failed" };
+    }
+    minted = result;
+  }
+  let persisted;
+  try {
+    persisted = deps.persist(minted.rawKey);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    deps.log(
+      `[key-rotation] could not persist the new key (${minted.prefix}): ${detail} - NOT adopting, NOT acking; the current key stays in force`
+    );
+    return { status: "error", detail, held: minted };
+  }
+  if (!persisted) {
+    deps.log(
+      `[key-rotation] could not persist the new key (${minted.prefix}) - NOT adopting, NOT acking; the current key stays in force`
+    );
+    return { status: "persist-failed", prefix: minted.prefix, held: minted };
+  }
+  if (deps.onPersisted && !deps.onPersisted(minted.prefix)) {
+    deps.log(
+      `[key-rotation] persisted ${minted.prefix} but could not save the pending ack - NOT adopting; the current key stays in force and the retry reuses this key`
+    );
+    return { status: "error", detail: "pending ack could not be saved", held: minted };
+  }
+  try {
+    deps.adoptInProcess(minted.rawKey);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    deps.log(
+      `[key-rotation] persisted ${minted.prefix} but could not adopt it in-process: ${detail} - it will take effect on the next manager restart`
+    );
+    return { status: "error", detail, held: minted };
+  }
+  deps.log(
+    `[key-rotation] adopted new host key ${minted.prefix}. The previous key stays valid until the control plane expires it on this host's ack.`
+  );
+  return { status: "adopted", prefix: minted.prefix };
+}
+function nextPendingAck(pending2, resp) {
+  if (!pending2) return { pending: null, log: null };
+  if (!resp || !("key_rotation_requested_at" in resp)) {
+    return {
+      pending: pending2,
+      log: `[key-rotation] the heartbeat did not report key_rotation_requested_at, so nothing confirms ${pending2} was finalized. Re-acking next poll; the current key stays in force.`
+    };
+  }
+  if (resp.key_rotation_requested_at) {
+    return {
+      pending: pending2,
+      log: `[key-rotation] acked ${pending2} but the request is still armed server-side, so the outgoing key was NOT expired. Re-acking next poll; the current key stays in force either way.`
+    };
+  }
+  return {
+    pending: null,
+    log: `[key-rotation] acked adoption of ${pending2}; the previous key is now expiring`
+  };
+}
+function alreadyHandledRotationRequest(requestedAt, lastHandled) {
+  if (!requestedAt) return true;
+  return requestedAt === lastHandled;
+}
+
 // src/lib/heartbeat-account-email.ts
 function mayReportAccountEmail(rawMode) {
   return rawMode === "subscription";
@@ -15131,7 +15235,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-OGZ6ADVR.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-EPG7NOKI.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -15928,7 +16032,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1177" : "dev";
+var agtCliVersion = true ? "0.28.1178" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -16171,6 +16275,82 @@ async function diskNodeVersion() {
 }
 var hostNodeObservation = null;
 var hostNodeObservedAt = 0;
+var lastKeyRotationHandled = null;
+var pendingKeyRotationAck = null;
+function setPendingKeyRotationAck(next) {
+  const prevMemory = pendingKeyRotationAck;
+  const prevState = state9.pendingKeyRotationAck ?? null;
+  pendingKeyRotationAck = next?.prefix ?? null;
+  state9.pendingKeyRotationAck = next;
+  try {
+    atomicWriteFileSync(getStateFile(), JSON.stringify(state9, null, 2));
+    return true;
+  } catch (err) {
+    log(`[key-rotation] could not persist the pending ack: ${err.message}`);
+    if (next !== null) {
+      pendingKeyRotationAck = prevMemory;
+      state9.pendingKeyRotationAck = prevState;
+      return false;
+    }
+    return true;
+  }
+}
+var keyRotationRetryAfter = 0;
+var KEY_ROTATION_RETRY_MS = 5 * 6e4;
+var heldRotatedKey = null;
+function persistRotatedHostKey(rawKey) {
+  const apiUrl = process.env["AGT_HOST"]?.trim();
+  if (!apiUrl) {
+    log("[key-rotation] AGT_HOST is not set, so the env channels cannot be rewritten");
+    return false;
+  }
+  const consoleUrl = process.env["AGT_CONSOLE_URL"] ?? readEtcEnvironmentValue("AGT_CONSOLE_URL");
+  let supervisor;
+  try {
+    supervisor = rewriteSupervisorApiKey(rawKey, void 0, getApiKey() ?? void 0);
+  } catch (err) {
+    log(`[key-rotation] supervisor env rewrite threw: ${err?.message ?? String(err)}`);
+    return false;
+  }
+  for (const path of supervisor.rewritten) {
+    log(`[key-rotation] rewrote AGT_API_KEY in ${path}`);
+  }
+  for (const f of supervisor.failed) {
+    log(`[key-rotation] ${f.path} holds AGT_API_KEY and could NOT be rewritten: ${f.error}`);
+  }
+  for (const path of supervisor.rolledBack ?? []) {
+    log(`[key-rotation] put ${path} back to the running key, because another channel failed`);
+  }
+  if (supervisor.failed.length > 0) {
+    log(
+      `[key-rotation] ${supervisor.failed.length} supervisor channel(s) would still hand out the OUTGOING key - the rotation is abandoned, not acked, so that key keeps working. Retrying after the backoff.`
+    );
+    return false;
+  }
+  if (supervisor.rewritten.length > 0) {
+    let wroteEtcEnvironment = false;
+    try {
+      wroteEtcEnvironment = writeEtcEnvironment(apiUrl, rawKey, consoleUrl);
+    } catch (err) {
+      log(`[key-rotation] /etc/environment write threw: ${err?.message ?? String(err)}`);
+    }
+    try {
+      if (!writeProfileDScript(apiUrl, rawKey, consoleUrl)) {
+        log("[key-rotation] /etc/profile.d/agt.sh was not written; it is read by login shells, not by the manager");
+      }
+    } catch (err) {
+      log(`[key-rotation] /etc/profile.d write threw (non-fatal): ${err?.message ?? String(err)}`);
+    }
+    if (!wroteEtcEnvironment) {
+      log("[key-rotation] /etc/environment was not rewritten; the supervisor channel has the new key, so a restart is safe, but an SSM session and a re-bootstrap will read the old one");
+    }
+    return true;
+  }
+  log(
+    `[key-rotation] no supervisor env channel holds AGT_API_KEY (${supervisor.keyless.length > 0 ? `present but keyless: ${supervisor.keyless.join(", ")}` : "none installed"}) - nothing would hand the new key to the next manager start, so the rotation is abandoned, not acked`
+  );
+  return false;
+}
 function invalidateHostNodeObservation(pathVersion) {
   hostNodeObservedAt = 0;
   if (pathVersion !== void 0 && hostNodeObservation) {
@@ -17740,7 +17920,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-HVYGIS5C.js");
+      const { collectDiagnostics } = await import("../persistent-session-7HP4KOED.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -17883,7 +18063,7 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-HVYGIS5C.js");
+      const { collectDiagnostics } = await import("../persistent-session-7HP4KOED.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
       let tailscaleHostname;
@@ -17963,6 +18143,14 @@ async function pollCycleInner() {
           hostNodePin,
           hostNodePin ? hostNodeConvergence.stateOf(hostNodePin) : null
         ),
+        // ENG-11642: ack a rotated key. Carries the PREFIX, never the key.
+        //
+        // Sent on this authenticated heartbeat on purpose: by the time it goes
+        // out the request is already signed with the NEW key, so the ack and
+        // "the new key works" are the same fact rather than two claims. The API
+        // treats this as permission to expire the outgoing key, so it must not
+        // be possible to ack with a key that cannot authenticate.
+        ...pendingKeyRotationAck ? { key_rotation_adopted_prefix: pendingKeyRotationAck } : {},
         agent_diagnostics: agentDiagnostics,
         hostname: tailscaleHostname,
         os_username: osUsername,
@@ -18085,9 +18273,52 @@ async function pollCycleInner() {
       hostFlagStore().applyNotifyDispatchByAgent(hbResp?.notify_dispatch_by_agent);
       hostFlagStore().applyBooleanFlagsByAgent(hbResp?.feature_flags_by_agent);
       setConfigHash(hbResp?.config_hash ?? null);
+      const ackDecision = nextPendingAck(pendingKeyRotationAck, hbResp);
+      if (ackDecision.log) log(ackDecision.log);
+      if (pendingKeyRotationAck !== null && ackDecision.pending === null) {
+        setPendingKeyRotationAck(null);
+      }
+      const rotationRequestedAt = hbResp?.key_rotation_requested_at ?? null;
+      if (shouldMintReplacementKey(rotationRequestedAt) && !alreadyHandledRotationRequest(rotationRequestedAt, lastKeyRotationHandled) && Date.now() >= keyRotationRetryAfter) {
+        const outcome = await adoptRotatedHostKey({
+          mint: async () => {
+            const current = getApiKey();
+            if (!current) return null;
+            return mintRotatedHostKey(current);
+          },
+          preflightPersist: () => supervisorChannelsRefusing(void 0, {
+            runningKeys: [
+              getApiKey() ?? "",
+              ...heldRotatedKey && heldRotatedKey.requestedAt === rotationRequestedAt ? [heldRotatedKey.minted.rawKey] : []
+            ]
+          }),
+          held: heldRotatedKey && heldRotatedKey.requestedAt === rotationRequestedAt ? heldRotatedKey.minted : void 0,
+          persist: (rawKey) => persistRotatedHostKey(rawKey),
+          onPersisted: (prefix) => rotationRequestedAt ? setPendingKeyRotationAck({ prefix, requestedAt: rotationRequestedAt }) : true,
+          adoptInProcess: (rawKey) => adoptHostKeyInProcess(rawKey),
+          log
+        });
+        if (outcome.status === "error" && outcome.held && pendingKeyRotationAck === outcome.held.prefix) {
+          setPendingKeyRotationAck(null);
+        }
+        heldRotatedKey = (outcome.status === "persist-failed" || outcome.status === "error" || outcome.status === "persist-refused") && outcome.held && rotationRequestedAt ? { requestedAt: rotationRequestedAt, minted: outcome.held } : null;
+        if (outcome.status === "mint-refused") {
+          lastKeyRotationHandled = rotationRequestedAt;
+        } else if (outcome.status === "adopted") {
+          lastKeyRotationHandled = rotationRequestedAt;
+          setPendingKeyRotationAck(
+            rotationRequestedAt ? { prefix: outcome.prefix, requestedAt: rotationRequestedAt } : null
+          );
+        } else {
+          keyRotationRetryAfter = Date.now() + KEY_ROTATION_RETRY_MS;
+          log(
+            `[key-rotation] attempt did not complete (${outcome.status}); retrying after ${Math.round(KEY_ROTATION_RETRY_MS / 6e4)}m. The current key stays in force.`
+          );
+        }
+      }
       try {
         const desiredClaudeCodeVersion = hbResp?.desired_claude_code_version?.trim();
-        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-H7RNX6M7.js");
+        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-F2O3LAWX.js");
         const securityFloor = currentSecurityFloor();
         claudeUpdaterInFlight = true;
         if (desiredClaudeCodeVersion && (claudePairLoop.busy || claudePairingInProgress())) {
@@ -18122,7 +18353,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-OGZ6ADVR.js");
+      } = await import("../responsiveness-probe-EPG7NOKI.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -18239,7 +18470,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-OGZ6ADVR.js");
+        } = await import("../responsiveness-probe-EPG7NOKI.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -18525,7 +18756,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-OGZ6ADVR.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-EPG7NOKI.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -18556,7 +18787,7 @@ async function pollCycleInner() {
         TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
         bindSourceEscalations
       } = await import("../transcript-mount-health-OHE6IVJV.js");
-      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-HVYGIS5C.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-7HP4KOED.js");
       const mountConfig = resolveTranscriptMountConfig();
       const liveAgents = agentState.persistentSessionAgents;
       for (const tracked of [
@@ -18721,7 +18952,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-2JJLKURE.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-IG3MKV2W.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -23410,7 +23641,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-OGZ6ADVR.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-EPG7NOKI.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -23453,7 +23684,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-HVYGIS5C.js");
+        const { collectDiagnostics } = await import("../persistent-session-7HP4KOED.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -23504,7 +23735,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-HVYGIS5C.js");
+      const { collectDiagnostics } = await import("../persistent-session-7HP4KOED.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
@@ -24206,7 +24437,7 @@ async function processClaudePairSessions(agents) {
     snapshotPairConfig,
     // ENG-11659: result -> report body + the manager.log line that records it.
     planPairStartReport
-  } = await import("../claude-pair-runtime-53JY6TQX.js");
+  } = await import("../claude-pair-runtime-I6KVCUBG.js");
   const { resetClaudeSignin, describeSigninResetForLog, describeSigninResetFailure } = await import("../claude-signin-reset-6IJMMVYG.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
@@ -25304,6 +25535,13 @@ function startManager(opts) {
           log(`[startup] rehydrated update-request ack at ${state9.lastUpdateRequestProcessedAt} (ENG-6692)`);
         }
       }
+      const pendingAck = parsed.pendingKeyRotationAck;
+      if (pendingAck && typeof pendingAck.prefix === "string" && typeof pendingAck.requestedAt === "string") {
+        state9.pendingKeyRotationAck = pendingAck;
+        pendingKeyRotationAck = pendingAck.prefix;
+        lastKeyRotationHandled = pendingAck.requestedAt;
+        log(`[startup] rehydrated pending key-rotation ack for ${pendingAck.prefix} (ENG-11642)`);
+      }
     }
   } catch (err) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);