@integrity-labs/agt-cli 0.28.1177 → 0.28.1179

package/dist/bin/agt.js

@@ -36,21 +36,21 @@ import {
   resolveFlagFromLayers,
   setActiveTeam,
   setJsonMode,
-  startWatchdog,
+  setupCommand,
   success,
   table,
   warn
-} from "../chunk-45UH24I2.js";
+} from "../chunk-O5P2OS36.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-H37WRW2E.js";
+} from "../chunk-GJD536LU.js";
 import {
   markDailySessionSpawn,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-DJNCIWVG.js";
+} from "../chunk-2FHYCFZM.js";
 import "../chunk-OO36JBFI.js";
 import "../chunk-6HBXEJHO.js";
 import "../chunk-XWVM4KPK.js";
@@ -64,7 +64,6 @@ import {
   SLACK_SCOPE_PRESETS,
   SlackApiError,
   createSlackApp,
-  deriveConsoleUrl,
   detectDrift,
   extractFrontmatter,
   generateCharterMd,
@@ -84,13 +83,13 @@ import {
   requiredMcpWildcard,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-47P33SZF.js";
+} from "../chunk-PINFVWGX.js";
 import "../chunk-AIUIMEUS.js";
 import "../chunk-DGUM43GV.js";
 
 // src/bin/agt.ts
-import { join as join24 } from "path";
-import { homedir as homedir12 } from "os";
+import { join as join23 } from "path";
+import { homedir as homedir11 } from "os";
 import { Command } from "commander";
 
 // src/commands/whoami.ts
@@ -4903,321 +4902,9 @@ async function kanbanRecurringDisableCommand(titleOrId, opts) {
   }
 }
 
-// src/commands/setup.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8, accessSync, constants as fsConstants } from "fs";
-import { join as join17, dirname as dirname6 } from "path";
-import { homedir as homedir7 } from "os";
+// src/commands/kanban.ts
 import chalk16 from "chalk";
 import ora14 from "ora";
-function detectShellProfile() {
-  const shell = process.env["SHELL"] ?? "";
-  const home = homedir7();
-  if (shell.includes("zsh")) {
-    return join17(home, ".zshrc");
-  }
-  if (shell.includes("fish")) {
-    const fishConfig = join17(home, ".config", "fish", "config.fish");
-    return fishConfig;
-  }
-  const bashrc = join17(home, ".bashrc");
-  if (existsSync10(bashrc)) return bashrc;
-  return join17(home, ".bash_profile");
-}
-function maybeWriteSystemWideEnv(apiUrl, apiKey, consoleUrl) {
-  const empty = { etcEnvironment: false, profileD: false, bashrc: false };
-  if (process.platform === "win32") return empty;
-  if (typeof process.getuid !== "function" || process.getuid() !== 0) return empty;
-  return {
-    etcEnvironment: writeEtcEnvironment(apiUrl, apiKey, consoleUrl),
-    profileD: writeProfileDScript(apiUrl, apiKey, consoleUrl),
-    // Run for its side-effect (wiring /etc/bashrc to source agt.sh) but
-    // treat it as a supporting channel, not proof that env values were
-    // persisted. Success reporting should reflect actual value writes.
-    bashrc: ensureBashrcSourcesProfileD()
-  };
-}
-function quoteForEtcEnvironment(value) {
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\r?\n/g, "\\n")}"`;
-}
-function quoteForPosixShell(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function quoteForFishShell(value) {
-  return `'${value.replace(/\\/g, "\\\\").replace(/'/g, `\\'`)}'`;
-}
-function writeEtcEnvironment(apiUrl, apiKey, consoleUrl) {
-  const envPath = "/etc/environment";
-  if (!existsSync10(envPath)) return false;
-  try {
-    accessSync(envPath, fsConstants.W_OK);
-  } catch {
-    return false;
-  }
-  try {
-    const current = readFileSync9(envPath, "utf-8");
-    const stripped = current.split(/\r?\n/).filter((line) => !/^\s*(?:export\s+)?AGT_(?:HOST|API_KEY|CONSOLE_URL)=/.test(line)).join("\n");
-    const base = stripped.endsWith("\n") || stripped.length === 0 ? stripped : `${stripped}
-`;
-    const lines = [
-      `AGT_HOST=${quoteForEtcEnvironment(apiUrl)}`,
-      `AGT_API_KEY=${quoteForEtcEnvironment(apiKey)}`
-    ];
-    if (consoleUrl) lines.push(`AGT_CONSOLE_URL=${quoteForEtcEnvironment(consoleUrl)}`);
-    const appended = `${base}${lines.join("\n")}
-`;
-    writeFileSync8(envPath, appended, { mode: 420 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function writeProfileDScript(apiUrl, apiKey, consoleUrl) {
-  const profileD = "/etc/profile.d";
-  if (!existsSync10(profileD)) return false;
-  try {
-    accessSync(profileD, fsConstants.W_OK);
-  } catch {
-    return false;
-  }
-  try {
-    const scriptPath = `${profileD}/agt.sh`;
-    const lines = [
-      "# Augmented \u2014 auto-generated by `agt setup`. Do not edit.",
-      `export AGT_HOST=${quoteForPosixShell(apiUrl)}`,
-      `export AGT_API_KEY=${quoteForPosixShell(apiKey)}`
-    ];
-    if (consoleUrl) lines.push(`export AGT_CONSOLE_URL=${quoteForPosixShell(consoleUrl)}`);
-    lines.push("");
-    writeFileSync8(scriptPath, lines.join("\n"), { mode: 420 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function ensureBashrcSourcesProfileD() {
-  const bashrc = "/etc/bashrc";
-  if (!existsSync10(bashrc)) return false;
-  try {
-    accessSync(bashrc, fsConstants.W_OK);
-  } catch {
-    return false;
-  }
-  try {
-    const current = readFileSync9(bashrc, "utf-8");
-    const marker = "# Augmented (agt) \u2014 source system-wide AGT env";
-    if (current.includes(marker)) return true;
-    const snippet = [
-      "",
-      marker,
-      "if [ -r /etc/profile.d/agt.sh ]; then",
-      "  . /etc/profile.d/agt.sh",
-      "fi",
-      ""
-    ].join("\n");
-    writeFileSync8(bashrc, current + snippet);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function buildExportLines(shell, apiUrl, apiKey, consoleUrl) {
-  if (shell.includes("fish")) {
-    const lines2 = [
-      "",
-      "# Augmented (agt) host configuration",
-      `set -gx AGT_HOST ${quoteForFishShell(apiUrl)}`,
-      `set -gx AGT_API_KEY ${quoteForFishShell(apiKey)}`
-    ];
-    if (consoleUrl) lines2.push(`set -gx AGT_CONSOLE_URL ${quoteForFishShell(consoleUrl)}`);
-    lines2.push("");
-    return lines2.join("\n");
-  }
-  const lines = [
-    "",
-    "# Augmented (agt) host configuration",
-    `export AGT_HOST=${quoteForPosixShell(apiUrl)}`,
-    `export AGT_API_KEY=${quoteForPosixShell(apiKey)}`
-  ];
-  if (consoleUrl) lines.push(`export AGT_CONSOLE_URL=${quoteForPosixShell(consoleUrl)}`);
-  lines.push("");
-  return lines.join("\n");
-}
-async function setupCommand(token, options = {}) {
-  const json = isJsonMode();
-  const shortTokenPattern = /^[A-HJ-NP-Z2-9]{4}-[A-HJ-NP-Z2-9]{4}$/i;
-  const legacyTokenPattern = /^prov_[a-f0-9]{64}$/i;
-  if (!token || !shortTokenPattern.test(token) && !legacyTokenPattern.test(token)) {
-    if (json) {
-      jsonOutput({ ok: false, error: "Invalid provisioning token. Expected format: XXXX-XXXX or prov_<64 hex>" });
-    } else {
-      error("Invalid provisioning token. Expected format: XXXX-XXXX or prov_<64 hex>");
-      info("Get a provisioning token from the Augmented dashboard after creating a host.");
-    }
-    process.exitCode = 1;
-    return;
-  }
-  const normalizedToken = shortTokenPattern.test(token) ? token.toUpperCase() : token.toLowerCase();
-  const apiHostFlag = options.apiHost?.trim();
-  const envHost = process.env["AGT_HOST"]?.trim();
-  const apiUrl = apiHostFlag || envHost;
-  if (!apiUrl) {
-    const msg = "Cannot determine API host for token exchange. Pass --api-host <url> or set AGT_HOST before running `agt setup`.\n  Production:        --api-host https://api.augmented.team\n  Non-prod stage:    --api-host https://<stage>.api.staging.augmented.team\n  Local development: --api-host http://api.agt.localhost:1355";
-    if (json) {
-      jsonOutput({ ok: false, error: msg });
-    } else {
-      error(msg);
-    }
-    process.exitCode = 1;
-    return;
-  }
-  if (!json) {
-    if (apiHostFlag) {
-      info(`Exchanging token against ${chalk16.bold(apiUrl)} (from --api-host)`);
-    } else {
-      info(`Exchanging token against ${chalk16.bold(apiUrl)} (from AGT_HOST)`);
-    }
-  }
-  const spinner = ora14({ text: "Exchanging provisioning token\u2026", isSilent: json });
-  spinner.start();
-  let setupResult;
-  try {
-    const res = await fetch(`${apiUrl}/host/setup`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ token: normalizedToken })
-    });
-    if (!res.ok) {
-      const body = await res.json().catch(() => ({}));
-      throw new Error(body["error"] ?? `Setup failed: HTTP ${res.status}`);
-    }
-    setupResult = await res.json();
-    spinner.succeed("Provisioning token accepted");
-  } catch (err) {
-    spinner.fail("Failed to exchange provisioning token");
-    if (json) {
-      jsonOutput({ ok: false, error: err.message });
-    } else {
-      error(err.message);
-    }
-    process.exitCode = 1;
-    return;
-  }
-  const finalApiUrl = setupResult.api_url || apiUrl;
-  process.env["AGT_HOST"] = finalApiUrl;
-  process.env["AGT_API_KEY"] = setupResult.api_key;
-  const verifySpinner = ora14({ text: "Verifying connection\u2026", isSilent: json });
-  verifySpinner.start();
-  try {
-    const exchange = await exchangeApiKey(setupResult.api_key);
-    verifySpinner.succeed("Connection verified");
-    if (!json) {
-      info(`Host:       ${chalk16.bold(setupResult.host_name)}`);
-      info(`Host ID:    ${exchange.hostId}`);
-      info(`Team:       ${chalk16.bold(exchange.teamSlug ?? setupResult.team_slug ?? "unknown")}`);
-      if (exchange.userEmail) {
-        info(`User:       ${chalk16.bold(exchange.userEmail)}`);
-      }
-    }
-  } catch (err) {
-    verifySpinner.fail("Connection verification failed");
-    if (json) {
-      jsonOutput({ ok: false, error: err.message });
-    } else {
-      error(err.message);
-      info("Connection could not be verified. No changes were written to your shell profile.");
-      info("Check your network connection and try: agt whoami");
-    }
-    process.exitCode = 1;
-    return;
-  }
-  const profilePath = detectShellProfile();
-  const shell = process.env["SHELL"] ?? "bash";
-  const consoleUrl = deriveConsoleUrl(finalApiUrl);
-  if (consoleUrl) {
-    process.env["AGT_CONSOLE_URL"] = consoleUrl;
-  }
-  if (!json && !consoleUrl) {
-    warn(
-      `Could not derive AGT_CONSOLE_URL from ${finalApiUrl} \u2014 scheduled-delivery deep links will be disabled until you set it manually.`
-    );
-  }
-  const exportLines = buildExportLines(shell, finalApiUrl, setupResult.api_key, consoleUrl);
-  const profileDir = dirname6(profilePath);
-  if (!existsSync10(profileDir)) {
-    mkdirSync8(profileDir, { recursive: true });
-  }
-  const marker = "# Augmented (agt) host configuration";
-  const current = existsSync10(profilePath) ? readFileSync9(profilePath, "utf-8") : "";
-  let updated;
-  if (current.includes(marker)) {
-    updated = current.replace(
-      /\n?# Augmented \(agt\) host configuration\n(?:(?:export\s+AGT_\w+=.*|set\s+-gx\s+AGT_\w+\s+.*)\n)*\n?/,
-      exportLines
-    );
-    if (!json) {
-      info("Replacing existing Augmented config block in shell profile.");
-    }
-  } else {
-    updated = current + exportLines;
-  }
-  writeFileSync8(profilePath, updated.endsWith("\n") ? updated : `${updated}
-`);
-  if (!json) {
-    success(`Environment variables written to ${chalk16.bold(profilePath)}`);
-  }
-  const sys = maybeWriteSystemWideEnv(finalApiUrl, setupResult.api_key, consoleUrl);
-  const valueChannelsWritten = sys.etcEnvironment || sys.profileD;
-  if (!json && valueChannelsWritten) {
-    const channels2 = [
-      sys.etcEnvironment ? "/etc/environment" : null,
-      sys.profileD ? "/etc/profile.d/agt.sh" : null,
-      sys.bashrc ? "/etc/bashrc" : null
-    ].filter(Boolean).join(" + ");
-    success(`System-wide env updated: ${channels2}`);
-  }
-  const managerSpinner = ora14({ text: "Starting manager daemon\u2026", isSilent: json });
-  managerSpinner.start();
-  try {
-    const configDir = join17(homedir7(), ".augmented");
-    const { pid } = startWatchdog({ intervalMs: 1e4, configDir, detached: true });
-    managerSpinner.succeed(`Manager started (PID ${pid})`);
-  } catch (err) {
-    managerSpinner.warn("Could not start manager daemon");
-    if (!json) {
-      warn(err.message);
-      info("Start it manually with: agt manager start");
-    }
-  }
-  const includeApiKey = process.env["AGT_SETUP_INCLUDE_API_KEY"] === "1";
-  if (json) {
-    jsonOutput({
-      ok: true,
-      host_name: setupResult.host_name,
-      host_id: setupResult.host_id,
-      team_slug: setupResult.team_slug,
-      api_url: finalApiUrl,
-      ...includeApiKey ? { api_key: setupResult.api_key } : {},
-      agents: setupResult.agents,
-      profile: profilePath
-    });
-    process.exit(0);
-  } else {
-    console.log();
-    console.log(chalk16.green.bold("  Setup complete!"));
-    console.log();
-    if (setupResult.agents.length > 0) {
-      info(`Agents:     ${setupResult.agents.map((a) => chalk16.cyan(a)).join(", ")}`);
-    } else {
-      info("No agents assigned yet. Assign agents in the dashboard or with: agt host assign");
-    }
-    console.log();
-    info(`Restart your shell or run: ${chalk16.bold(`source ${profilePath}`)}`);
-  }
-}
-
-// src/commands/kanban.ts
-import chalk17 from "chalk";
-import ora15 from "ora";
 function kanbanListJson(data) {
   return {
     ok: true,
@@ -5250,14 +4937,14 @@ async function resolveAgentId2(codeName) {
   }
 }
 function priorityLabel2(p) {
-  return p === 1 ? chalk17.red("HIGH") : p === 3 ? chalk17.dim("LOW") : chalk17.yellow("MED");
+  return p === 1 ? chalk16.red("HIGH") : p === 3 ? chalk16.dim("LOW") : chalk16.yellow("MED");
 }
 function statusLabel(s) {
   const map = {
-    in_progress: chalk17.blue("In Progress"),
-    todo: chalk17.green("To Do"),
-    backlog: chalk17.dim("Backlog"),
-    done: chalk17.gray("Done")
+    in_progress: chalk16.blue("In Progress"),
+    todo: chalk16.green("To Do"),
+    backlog: chalk16.dim("Backlog"),
+    done: chalk16.gray("Done")
   };
   return map[s] ?? s;
 }
@@ -5265,7 +4952,7 @@ async function kanbanListCommand(opts) {
   const teamSlug = requireTeam();
   if (!teamSlug) return;
   const json = isJsonMode();
-  const spinner = ora15({ text: "Fetching kanban board\u2026", isSilent: json });
+  const spinner = ora14({ text: "Fetching kanban board\u2026", isSilent: json });
   spinner.start();
   const agentId = await resolveAgentId2(opts.agent);
   if (!agentId) {
@@ -5295,7 +4982,7 @@ async function kanbanListCommand(opts) {
       item.estimated_minutes ? `~${item.estimated_minutes}min` : "",
       item.id.slice(0, 8)
     ]);
-    console.log(chalk17.bold(`
+    console.log(chalk16.bold(`
 Kanban: ${opts.agent}
 `));
     table(["Pri", "Status", "Title", "Est", "ID"], rows);
@@ -5510,10 +5197,10 @@ async function kanbanDoneCommand(titleOrId, opts) {
 
 // src/commands/update.ts
 import { execFileSync, execSync } from "child_process";
-import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
-import chalk18 from "chalk";
-import ora16 from "ora";
-var cliVersion = true ? "0.28.1177" : "dev";
+import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
+import chalk17 from "chalk";
+import ora15 from "ora";
+var cliVersion = true ? "0.28.1179" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5617,7 +5304,7 @@ function performUpdate(version) {
 function detectBrewOwner() {
   for (const prefix of ["/home/linuxbrew/.linuxbrew", "/opt/homebrew", "/usr/local"]) {
     const cellar = `${prefix}/Cellar`;
-    if (!existsSync11(cellar)) continue;
+    if (!existsSync10(cellar)) continue;
     try {
       return execSync(`stat -c %U "${cellar}" 2>/dev/null || stat -f %Su "${cellar}"`, { encoding: "utf-8" }).trim() || null;
     } catch {
@@ -5631,16 +5318,16 @@ function reportActiveSessionsBlocked(json, current, target) {
   if (!json) {
     warn("Active processes detected:");
     if (managerPid) {
-      console.error(chalk18.yellow(`  \u2022 Manager process running (PID ${managerPid})`));
+      console.error(chalk17.yellow(`  \u2022 Manager process running (PID ${managerPid})`));
     }
     if (tmuxSessions.length > 0) {
-      console.error(chalk18.yellow(`  \u2022 ${tmuxSessions.length} active agent session(s): ${tmuxSessions.join(", ")}`));
+      console.error(chalk17.yellow(`  \u2022 ${tmuxSessions.length} active agent session(s): ${tmuxSessions.join(", ")}`));
     }
     console.error();
     warn("Updating while the manager is running will leave it on the old version until restarted.");
     warn("Active agent sessions will continue with stale MCP servers.");
     console.error();
-    info(`Run ${chalk18.bold("agt update --force")} to update anyway, then restart the manager.`);
+    info(`Run ${chalk17.bold("agt update --force")} to update anyway, then restart the manager.`);
   } else {
     jsonOutput({
       ok: false,
@@ -5657,7 +5344,7 @@ function reportActiveSessionsBlocked(json, current, target) {
   return true;
 }
 function runInstall(target, json, current) {
-  const updateSpinner = ora16({ text: "Installing update\u2026", isSilent: json });
+  const updateSpinner = ora15({ text: "Installing update\u2026", isSilent: json });
   updateSpinner.start();
   try {
     performUpdate(target);
@@ -5671,8 +5358,8 @@ function runInstall(target, json, current) {
         updated: true
       });
     } else {
-      success(`Updated to ${chalk18.bold(target)}`);
-      info(`If you have a running manager, restart it: ${chalk18.bold("agt manager stop && agt manager start")}`);
+      success(`Updated to ${chalk17.bold(target)}`);
+      info(`If you have a running manager, restart it: ${chalk17.bold("agt manager stop && agt manager start")}`);
     }
   } catch (err) {
     updateSpinner.fail("Update failed");
@@ -5715,7 +5402,7 @@ async function updateCommand(opts = {}) {
       if (json) {
         jsonOutput({ ok: true, current: cliVersion, latest: target, update_available: false });
       } else {
-        success(`Already on ${chalk18.bold(cliVersion)}.`);
+        success(`Already on ${chalk17.bold(cliVersion)}.`);
       }
       return;
     }
@@ -5734,7 +5421,7 @@ async function updateCommand(opts = {}) {
       return;
     }
     if (!json) {
-      info(`Installing ${chalk18.bold(target)} (was ${chalk18.dim(cliVersion)}).`);
+      info(`Installing ${chalk17.bold(target)} (was ${chalk17.dim(cliVersion)}).`);
       if (pinned && pinned !== target) {
         warn(`This host is pinned to ${pinned} via AGT_CLI_PIN_VERSION; the manager will reconcile back to the pin on its next poll unless you also update the pin.`);
       }
@@ -5757,12 +5444,12 @@ async function updateCommand(opts = {}) {
         error: "Host is pinned via AGT_CLI_PIN_VERSION. Use `agt update --version <v>` to change it, or `agt update --force` to update to latest."
       });
     } else {
-      warn(`This host is pinned to ${chalk18.bold(pinned)} via AGT_CLI_PIN_VERSION.`);
-      info(`To change it deliberately, run ${chalk18.bold("agt update --version <version>")}; to update to latest anyway, run ${chalk18.bold("agt update --force")}.`);
+      warn(`This host is pinned to ${chalk17.bold(pinned)} via AGT_CLI_PIN_VERSION.`);
+      info(`To change it deliberately, run ${chalk17.bold("agt update --version <version>")}; to update to latest anyway, run ${chalk17.bold("agt update --force")}.`);
     }
     return;
   }
-  const spinner = ora16({ text: "Checking for updates\u2026", isSilent: json });
+  const spinner = ora15({ text: "Checking for updates\u2026", isSilent: json });
   spinner.start();
   const versionInfo = await fetchLatestVersion();
   if (!versionInfo) {
@@ -5781,13 +5468,13 @@ async function updateCommand(opts = {}) {
     if (json) {
       jsonOutput({ ok: true, current: cliVersion, latest: versionInfo.latest, update_available: false });
     } else {
-      success(`You're on the latest version (${chalk18.bold(cliVersion)})`);
+      success(`You're on the latest version (${chalk17.bold(cliVersion)})`);
     }
     return;
   }
   spinner.stop();
   if (!json) {
-    info(`Update available: ${chalk18.dim(cliVersion)} \u2192 ${chalk18.bold.green(versionInfo.latest)}`);
+    info(`Update available: ${chalk17.dim(cliVersion)} \u2192 ${chalk17.bold.green(versionInfo.latest)}`);
     if (versionInfo.changelog_url) {
       info(`Changelog: ${versionInfo.changelog_url}`);
     }
@@ -5804,8 +5491,8 @@ async function checkForUpdateOnStartup() {
     if (!versionInfo) return;
     if (isNewerVersion(cliVersion, versionInfo.latest)) {
       console.error(
-        chalk18.yellow(`
-  Update available: ${cliVersion} \u2192 ${versionInfo.latest}. Run ${chalk18.bold("agt update")} to install.`) + chalk18.dim("\n  Note: Restart the manager after updating.\n")
+        chalk17.yellow(`
+  Update available: ${cliVersion} \u2192 ${versionInfo.latest}. Run ${chalk17.bold("agt update")} to install.`) + chalk17.dim("\n  Note: Restart the manager after updating.\n")
       );
     }
   } catch {
@@ -5813,12 +5500,12 @@ async function checkForUpdateOnStartup() {
 }
 
 // src/commands/audit-subagents.ts
-import { homedir as homedir8 } from "os";
-import { join as join19 } from "path";
+import { homedir as homedir7 } from "os";
+import { join as join18 } from "path";
 
 // src/lib/subagent-mcp-audit.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
-import { join as join18 } from "path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
+import { join as join17 } from "path";
 function parseFrontmatter(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!match) return null;
@@ -5868,7 +5555,7 @@ function findSubagentFiles(dir, depth = 0) {
   const out = [];
   const isAgentsDir = dir.endsWith("/agents") || dir.endsWith("\\agents");
   for (const entry of entries) {
-    const full = join18(dir, entry);
+    const full = join17(dir, entry);
     let s;
     try {
       s = statSync3(full);
@@ -5892,7 +5579,7 @@ function auditSubagentMcpBindings(rootDirs) {
       seen.add(file);
       let content;
       try {
-        content = readFileSync10(file, "utf-8");
+        content = readFileSync9(file, "utf-8");
       } catch {
         continue;
       }
@@ -5915,11 +5602,11 @@ function formatFinding(f) {
 
 // src/commands/audit-subagents.ts
 function defaultRoots() {
-  const home = homedir8();
+  const home = homedir7();
   return [
-    join19(home, ".claude", "agents"),
-    join19(home, ".claude", "plugins"),
-    join19(process.cwd(), ".claude", "agents")
+    join18(home, ".claude", "agents"),
+    join18(home, ".claude", "plugins"),
+    join18(process.cwd(), ".claude", "agents")
   ];
 }
 async function auditSubagentsCommand(options = {}) {
@@ -5954,9 +5641,9 @@ async function auditSubagentsCommand(options = {}) {
 }
 
 // src/lib/mcp-render-allowlist-audit.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync4 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join20 } from "path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync10, statSync as statSync4 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join19 } from "path";
 function expectedWildcard(serverKey) {
   return requiredMcpWildcard(serverKey);
 }
@@ -5969,13 +5656,13 @@ function parseMcpWildcardsFromToolsLine(content) {
 }
 function readMcpServerKeys(mcpJsonPath) {
   try {
-    const config = JSON.parse(readFileSync11(mcpJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync10(mcpJsonPath, "utf-8"));
     return Object.keys(config.mcpServers ?? {});
   } catch {
     return null;
   }
 }
-function auditMcpRenderAllowlist(rootDir = join20(homedir9(), ".augmented")) {
+function auditMcpRenderAllowlist(rootDir = join19(homedir8(), ".augmented")) {
   const findings = [];
   let entries;
   try {
@@ -5984,7 +5671,7 @@ function auditMcpRenderAllowlist(rootDir = join20(homedir9(), ".augmented")) {
     return findings;
   }
   for (const entry of entries) {
-    const agentDir = join20(rootDir, entry);
+    const agentDir = join19(rootDir, entry);
     let s;
     try {
       s = statSync4(agentDir);
@@ -5993,15 +5680,15 @@ function auditMcpRenderAllowlist(rootDir = join20(homedir9(), ".augmented")) {
     }
     if (!s.isDirectory() || entry.startsWith("_") || entry.startsWith(".")) continue;
     for (const scope of ["provision", "project"]) {
-      const mcpJsonPath = scope === "provision" ? join20(agentDir, "provision", ".mcp.json") : join20(agentDir, "project", ".mcp.json");
+      const mcpJsonPath = scope === "provision" ? join19(agentDir, "provision", ".mcp.json") : join19(agentDir, "project", ".mcp.json");
       const keys = readMcpServerKeys(mcpJsonPath);
       if (keys === null || keys.length === 0) continue;
       const expected = new Set(keys.map(expectedWildcard));
       for (const subagent of ["channel-message-handler", "augmented-worker"]) {
-        const mdPath = scope === "provision" ? join20(agentDir, ".claude", "agents", `${subagent}.md`) : join20(agentDir, "project", ".claude", "agents", `${subagent}.md`);
+        const mdPath = scope === "provision" ? join19(agentDir, ".claude", "agents", `${subagent}.md`) : join19(agentDir, "project", ".claude", "agents", `${subagent}.md`);
         let content;
         try {
-          content = readFileSync11(mdPath, "utf-8");
+          content = readFileSync10(mdPath, "utf-8");
         } catch {
           continue;
         }
@@ -6059,12 +5746,12 @@ async function auditMcpRenderCommand(options = {}) {
 }
 
 // src/commands/audit-secrets.ts
-import { homedir as homedir10 } from "os";
-import { join as join22 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join21 } from "path";
 
 // src/lib/secret-leak-audit.ts
-import { readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync5 } from "fs";
-import { join as join21 } from "path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync11, statSync as statSync5 } from "fs";
+import { join as join20 } from "path";
 var SECRET_KEY_NAME_RE = /TOKEN|KEY|SECRET|BEARER|PASSWORD/i;
 function isTemplated(value) {
   return value.includes("${");
@@ -6090,7 +5777,7 @@ function scanMcpFile(file, agent2, findings) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync12(file, "utf-8"));
+    parsed = JSON.parse(readFileSync11(file, "utf-8"));
   } catch {
     return;
   }
@@ -6134,15 +5821,15 @@ function auditSecretLeaks(augmentedRoot) {
     return findings;
   }
   for (const agent2 of agents) {
-    const agentDir = join21(augmentedRoot, agent2);
+    const agentDir = join20(augmentedRoot, agent2);
     try {
       if (!statSync5(agentDir).isDirectory()) continue;
     } catch {
       continue;
     }
-    scanMcpFile(join21(agentDir, "provision", ".mcp.json"), agent2, findings);
-    scanMcpFile(join21(agentDir, "project", ".mcp.json"), agent2, findings);
-    scanEnvIntegrations(join21(agentDir, ".env.integrations"), agent2, findings);
+    scanMcpFile(join20(agentDir, "provision", ".mcp.json"), agent2, findings);
+    scanMcpFile(join20(agentDir, "project", ".mcp.json"), agent2, findings);
+    scanEnvIntegrations(join20(agentDir, ".env.integrations"), agent2, findings);
   }
   return findings;
 }
@@ -6168,7 +5855,7 @@ function describe(f) {
   return `secret file is mode ${f.mode} (expected 0600)`;
 }
 async function auditSecretsCommand(options = {}) {
-  const root = options.root ?? join22(homedir10(), ".augmented");
+  const root = options.root ?? join21(homedir9(), ".augmented");
   const findings = auditSecretLeaks(root);
   if (options.json) {
     process.stdout.write(`${JSON.stringify({ findings, root }, null, 2)}
@@ -6291,10 +5978,10 @@ async function anchorOnboardCommand(profile, options) {
 }
 
 // src/commands/integration.ts
-import { homedir as homedir11 } from "os";
-import { join as join23 } from "path";
-import chalk19 from "chalk";
-import ora17 from "ora";
+import { homedir as homedir10 } from "os";
+import { join as join22 } from "path";
+import chalk18 from "chalk";
+import ora16 from "ora";
 
 // src/lib/integration-provisioned-message.ts
 function notProvisionedMessage(input4) {
@@ -6349,7 +6036,7 @@ async function fetchAgents() {
 }
 async function integrationListCommand() {
   const json = isJsonMode();
-  const spinner = ora17({ text: "Fetching integrations\u2026", isSilent: json }).start();
+  const spinner = ora16({ text: "Fetching integrations\u2026", isSilent: json }).start();
   try {
     const data = await api.get("/integrations/installs");
     spinner.stop();
@@ -6361,11 +6048,11 @@ async function integrationListCommand() {
       info("No integrations found for this team.");
       return;
     }
-    console.log(chalk19.bold("\nAvailable Integrations:\n"));
+    console.log(chalk18.bold("\nAvailable Integrations:\n"));
     for (const p of data) {
-      const statusColor = p.status === "published" ? chalk19.green : p.status === "archived" ? chalk19.gray : chalk19.yellow;
+      const statusColor = p.status === "published" ? chalk18.green : p.status === "archived" ? chalk18.gray : chalk18.yellow;
       console.log(
-        `  ${chalk19.bold(p.name)} ${chalk19.dim(`(${p.slug})`)}  ${statusColor(p.status)} v${p.version}  ${chalk19.dim(`${p.skills?.length ?? 0} skills, ${p.defined_scopes?.length ?? 0} scopes`)}`
+        `  ${chalk18.bold(p.name)} ${chalk18.dim(`(${p.slug})`)}  ${statusColor(p.status)} v${p.version}  ${chalk18.dim(`${p.skills?.length ?? 0} skills, ${p.defined_scopes?.length ?? 0} scopes`)}`
       );
     }
     console.log();
@@ -6376,7 +6063,7 @@ async function integrationListCommand() {
 }
 async function integrationShowCommand(slug) {
   const json = isJsonMode();
-  const spinner = ora17({ text: "Fetching integration\u2026", isSilent: json }).start();
+  const spinner = ora16({ text: "Fetching integration\u2026", isSilent: json }).start();
   try {
     const all = await api.get("/integrations/installs");
     const integration2 = all.find((p) => p.slug === slug);
@@ -6392,21 +6079,21 @@ async function integrationShowCommand(slug) {
       jsonOutput({ integration: integration2, scopes });
       return;
     }
-    console.log(chalk19.bold(`
-${integration2.name}`), chalk19.dim(`(${integration2.slug})`));
-    if (integration2.description) console.log(chalk19.dim(integration2.description));
+    console.log(chalk18.bold(`
+${integration2.name}`), chalk18.dim(`(${integration2.slug})`));
+    if (integration2.description) console.log(chalk18.dim(integration2.description));
     console.log();
     console.log(`  Status:    ${integration2.status} v${integration2.version}`);
     console.log(`  Category:  ${integration2.category}`);
     console.log(`  Toolkits:  ${integration2.required_toolkits.join(", ") || "none"}`);
     console.log(`  Skills:    ${integration2.skills?.length ?? 0}`);
     if (scopes.length > 0) {
-      console.log(chalk19.bold("\n  Permission Scopes:\n"));
+      console.log(chalk18.bold("\n  Permission Scopes:\n"));
       for (const s of scopes) {
-        const roleColor = s.can_grant ? chalk19.green : chalk19.red;
-        const overrideTag = s.is_overridden ? chalk19.cyan(" [team override]") : "";
+        const roleColor = s.can_grant ? chalk18.green : chalk18.red;
+        const overrideTag = s.is_overridden ? chalk18.cyan(" [team override]") : "";
         console.log(
-          `    ${chalk19.bold(s.id)}  ${s.name}  min: ${roleColor(s.effective_min_role)}${overrideTag}  ${s.can_grant ? chalk19.green("\u2713 grantable") : chalk19.red("\u2717 needs approval")}`
+          `    ${chalk18.bold(s.id)}  ${s.name}  min: ${roleColor(s.effective_min_role)}${overrideTag}  ${s.can_grant ? chalk18.green("\u2713 grantable") : chalk18.red("\u2717 needs approval")}`
         );
       }
     }
@@ -6448,7 +6135,7 @@ function buildForcedProbeTarget(row, ctx) {
 }
 async function integrationProbeCommand(agentCodeName, slug) {
   const json = isJsonMode();
-  const spinner = ora17({ text: `Probing ${slug} on ${agentCodeName}\u2026`, isSilent: json }).start();
+  const spinner = ora16({ text: `Probing ${slug} on ${agentCodeName}\u2026`, isSilent: json }).start();
   try {
     const agents = await fetchAgents();
     const agent2 = agents.find((a) => a.code_name === agentCodeName);
@@ -6479,7 +6166,7 @@ async function integrationProbeCommand(agentCodeName, slug) {
       process.exitCode = 1;
       return;
     }
-    const projectDir = join23(homedir11(), ".augmented", agentCodeName, "project");
+    const projectDir = join22(homedir10(), ".augmented", agentCodeName, "project");
     const probeEnv = buildProbeEnv(projectDir, agent2.agent_id);
     const probeDeps = buildConnectivityProbeDeps(projectDir, probeEnv);
     const sourceType = integ.source_type ?? null;
@@ -6513,7 +6200,7 @@ async function integrationProbeCommand(agentCodeName, slug) {
         return;
       }
       info(`${integ.definition_id}: not probeable (no probe wired for this integration kind)`);
-      console.log(chalk19.dim(scopeNote.split("\n").map((l) => l ? `  ${l}` : "").join("\n")));
+      console.log(chalk18.dim(scopeNote.split("\n").map((l) => l ? `  ${l}` : "").join("\n")));
       return;
     }
     const result = {
@@ -6533,12 +6220,12 @@ async function integrationProbeCommand(agentCodeName, slug) {
       jsonOutput(result);
       return;
     }
-    const color = outcome.status === "ok" ? chalk19.green : outcome.status === "down" ? chalk19.red : chalk19.yellow;
+    const color = outcome.status === "ok" ? chalk18.green : outcome.status === "down" ? chalk18.red : chalk18.yellow;
     console.log(
-      `${chalk19.bold(integ.definition_id)} on ${chalk19.bold(agentCodeName)}: ${color(outcome.status)}`
+      `${chalk18.bold(integ.definition_id)} on ${chalk18.bold(agentCodeName)}: ${color(outcome.status)}`
     );
-    if (outcome.message) console.log(chalk19.dim(`  ${outcome.message}`));
-    console.log(chalk19.dim(scopeNote.split("\n").map((l) => l ? `  ${l}` : "").join("\n")));
+    if (outcome.message) console.log(chalk18.dim(`  ${outcome.message}`));
+    console.log(chalk18.dim(scopeNote.split("\n").map((l) => l ? `  ${l}` : "").join("\n")));
   } catch (err) {
     spinner.stop();
     handleError(err);
@@ -6546,7 +6233,7 @@ async function integrationProbeCommand(agentCodeName, slug) {
 }
 async function integrationInstallCommand(slug, options) {
   const json = isJsonMode();
-  const spinner = ora17({ text: "Installing integration\u2026", isSilent: json }).start();
+  const spinner = ora16({ text: "Installing integration\u2026", isSilent: json }).start();
   try {
     const all = await api.get("/integrations/installs");
     const integration2 = all.find((p) => p.slug === slug);
@@ -6585,7 +6272,7 @@ async function integrationInstallCommand(slug, options) {
       const needsApproval = err.body["needs_approval"];
       error("Some scopes exceed your role ceiling:");
       for (const s of needsApproval) {
-        console.log(chalk19.yellow(`  - ${s}`));
+        console.log(chalk18.yellow(`  - ${s}`));
       }
       info("To request elevated scopes, use the web dashboard or contact your team admin.");
       process.exitCode = 1;
@@ -6596,7 +6283,7 @@ async function integrationInstallCommand(slug, options) {
 }
 async function integrationUninstallCommand(slug, options) {
   const json = isJsonMode();
-  const spinner = ora17({ text: "Uninstalling integration\u2026", isSilent: json }).start();
+  const spinner = ora16({ text: "Uninstalling integration\u2026", isSilent: json }).start();
   try {
     const all = await api.get("/integrations/installs");
     const integration2 = all.find((p) => p.slug === slug);
@@ -6627,7 +6314,7 @@ async function integrationUninstallCommand(slug, options) {
 }
 async function integrationRequestsCommand() {
   const json = isJsonMode();
-  const spinner = ora17({ text: "Fetching scope requests\u2026", isSilent: json }).start();
+  const spinner = ora16({ text: "Fetching scope requests\u2026", isSilent: json }).start();
   try {
     const requests = await api.get("/integrations/installs/scope-requests");
     spinner.stop();
@@ -6639,10 +6326,10 @@ async function integrationRequestsCommand() {
       info("No pending scope requests.");
       return;
     }
-    console.log(chalk19.bold("\nPending Scope Requests:\n"));
+    console.log(chalk18.bold("\nPending Scope Requests:\n"));
     for (const r of requests) {
-      console.log(`  ${chalk19.bold(r.id)}  scopes: ${r.requested_scopes.join(", ")}`);
-      if (r.reason) console.log(`    reason: ${chalk19.dim(r.reason)}`);
+      console.log(`  ${chalk18.bold(r.id)}  scopes: ${r.requested_scopes.join(", ")}`);
+      if (r.reason) console.log(`    reason: ${chalk18.dim(r.reason)}`);
       console.log(`    status: ${r.status}  requested: ${r.created_at}`);
       console.log();
     }
@@ -6653,7 +6340,7 @@ async function integrationRequestsCommand() {
 }
 async function integrationApproveCommand(requestId, options) {
   const json = isJsonMode();
-  const spinner = ora17({ text: "Approving request\u2026", isSilent: json }).start();
+  const spinner = ora16({ text: "Approving request\u2026", isSilent: json }).start();
   try {
     const result = await api.put(`/integrations/installs/scope-requests/${requestId}`, {
       status: "approved",
@@ -6672,7 +6359,7 @@ async function integrationApproveCommand(requestId, options) {
 }
 async function integrationDenyCommand(requestId, options) {
   const json = isJsonMode();
-  const spinner = ora17({ text: "Denying request\u2026", isSilent: json }).start();
+  const spinner = ora16({ text: "Denying request\u2026", isSilent: json }).start();
   try {
     const result = await api.put(`/integrations/installs/scope-requests/${requestId}`, {
       status: "denied",
@@ -6714,7 +6401,7 @@ async function integrationEnrolCommand(options) {
   const [secretKey, secretValue] = secrets[0];
   const credentials = { [secretKey]: secretValue };
   const authType = options.authType ?? (options.webhookSecret ? "webhook" : options.apiKey ? "api_key" : "oauth2");
-  const spinner = ora17({ text: `Enrolling ${options.def} at ${apiScope} scope\u2026`, isSilent: json }).start();
+  const spinner = ora16({ text: `Enrolling ${options.def} at ${apiScope} scope\u2026`, isSilent: json }).start();
   try {
     let agentId;
     if (apiScope === "agent") {
@@ -6773,7 +6460,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1177" : "dev";
+var cliVersion2 = true ? "0.28.1179" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {
@@ -6873,11 +6560,11 @@ host.command("pair <host-name>").description("Start an SSM port-forward + shell
   })
 );
 var manager = program.command("manager").description("Host config sync daemon \u2014 keeps local agent files in sync with API");
-manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join24(homedir12(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
-manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join24(homedir12(), ".augmented")).action(managerStopCommand);
-manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join24(homedir12(), ".augmented")).action(managerStatusCommand);
-manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join24(homedir12(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
-manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join24(homedir12(), ".augmented")).action(managerInstallCommand);
+manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join23(homedir11(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
+manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join23(homedir11(), ".augmented")).action(managerStopCommand);
+manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join23(homedir11(), ".augmented")).action(managerStatusCommand);
+manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join23(homedir11(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
+manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join23(homedir11(), ".augmented")).action(managerInstallCommand);
 manager.command("uninstall").description("Remove the OS-level supervisor (launchctl unload + delete plist on macOS). Idempotent.").action(managerUninstallCommand);
 manager.command("install-system-unit").description("Install a system-level systemd unit (Linux, root) so the manager auto-starts on every boot. For headless EC2 hosts \u2014 survives reboot without `loginctl enable-linger`. (ENG-4706)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files (defaults to /root/.augmented or /home/<user>/.augmented)").option("--user <name>", "Unix user the manager runs as", "root").action(managerInstallSystemUnitCommand);
 manager.command("uninstall-system-unit").description("Remove the system-level systemd unit (Linux, root). Idempotent. (ENG-4706)").action(managerUninstallSystemUnitCommand);
@@ -6885,7 +6572,7 @@ var agent = program.command("agent").description("Inspect and manage agents");
 agent.command("restore-transcripts <code-name>").description(
   "Place a migrated agent's archived transcripts on this host and re-pin its conversation (ENG-9567)"
 ).option("--from <host>", "Source host to restore from \u2014 its name or uuid").option("--bucket <bucket>", "Source bucket, when no address is recorded for the host").option("--key-prefix <prefix>", "Source key prefix, when no address is recorded for the host").option("--region <region>", "Bucket region").option("--timezone <iana>", "The agent's IANA timezone, so the restored pin is dated as the spawner will read it").option("--json", "Emit the result as JSON").action(agentRestoreTranscriptsCommand);
-agent.command("show <code-name>").description("Display an agent's provisioned configuration").option("--config-dir <dir>", "Config directory", join24(homedir12(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
+agent.command("show <code-name>").description("Display an agent's provisioned configuration").option("--config-dir <dir>", "Config directory", join23(homedir11(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
 var kanban = program.command("kanban").description("Manage agent kanban boards");
 kanban.command("list").description("List kanban board items for an agent").requiredOption("--agent <code-name>", "Agent code name").action(kanbanListCommand);
 kanban.command("add <title>").description("Add a new item to an agent kanban board").requiredOption("--agent <code-name>", "Agent code name").option("--priority <1|2|3>", "Priority: 1=high, 2=medium, 3=low", "2").option("--status <status>", "Initial status: backlog | todo | in_progress", "todo").option("--description <text>", "Item description").option("--estimate <minutes>", "Estimated time in minutes").option("--deliverable <text>", "Expected output/deliverable").action(kanbanAddCommand);