@integrity-labs/agt-cli 0.28.1177 → 0.28.1179

package/dist/lib/manager-worker.js

@@ -11,6 +11,7 @@ import {
   RestartBreaker,
   SUPERVISOR_RESTART_EXIT_CODE,
   TunnelWatcher,
+  adoptHostKeyInProcess,
   api,
   atomicWriteFileSync,
   buildClaudeAgentMatcher,
@@ -52,6 +53,7 @@ import {
   markQuarantinedForProbe,
   migrateAgentDirToIdKeyed,
   mintAgentKey,
+  mintRotatedHostKey,
   parseRmPolicy,
   pinAllowsUrgent,
   provision,
@@ -65,6 +67,7 @@ import {
   provisionSessionStateHook,
   provisionStopHook,
   readEnvNumber,
+  readEtcEnvironmentValue,
   readHostArchiveAddress,
   reapLegacyTokenFile,
   reapMissingMcpSessions,
@@ -76,8 +79,10 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   shellGuard,
-  tripClass
-} from "../chunk-45UH24I2.js";
+  tripClass,
+  writeEtcEnvironment,
+  writeProfileDScript
+} from "../chunk-O5P2OS36.js";
 import {
   CLAUDE_CODE_SECURITY_FLOOR,
   SELF_UPDATE_TIMEOUTS,
@@ -91,7 +96,11 @@ import {
   runSafeCleanup,
   tightestDiskStat,
   withPackageCacheLock
-} from "../chunk-NHUXO5H2.js";
+} from "../chunk-KDYZNWZW.js";
+import {
+  rewriteSupervisorApiKey,
+  supervisorChannelsRefusing
+} from "../chunk-H3JMPEH7.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -130,6 +139,7 @@ import {
   injectMessage,
   injectMessageWithStatus,
   injectOpencodeMessage,
+  isActivelyProcessing,
   isConfirmedRespawn,
   isOpencodeSessionHealthy,
   isSessionHealthy,
@@ -178,7 +188,7 @@ import {
   webFetchBaselineValue,
   webFetchRestartNeeded,
   writeEgressAllowlist
-} from "../chunk-H37WRW2E.js";
+} from "../chunk-GJD536LU.js";
 import {
   isAgentIdle,
   isStaleForToday,
@@ -187,12 +197,13 @@ import {
   sessionTranscriptDir,
   subagentActivityAgeSeconds,
   transcriptActivityAgeSeconds
-} from "../chunk-DJNCIWVG.js";
+} from "../chunk-2FHYCFZM.js";
 import {
   classifyUnanswerablePane,
   focusedConfirmDialogBlock,
   isParkedOnToolPermissionPrompt,
   paneRemedy,
+  parkedModalKind,
   sendDialogKeys,
   simpleTextHash
 } from "../chunk-OO36JBFI.js";
@@ -226,6 +237,7 @@ import {
   MANAGER_LIVENESS_HEARTBEAT_INTERVAL_MS,
   MAX_AVATAR_ENV_URL_BYTES,
   NO_FAILING_TURN_RUN,
+  NO_TRANSCRIPT_ACTIVITY,
   SCHEDULED_TURN_MARKER_FILENAME,
   SKILLS_INDEX_SECTION_END,
   SKILLS_INDEX_SECTION_START,
@@ -300,12 +312,15 @@ import {
   resolveChannels,
   resolveCrossTeamPeerIntraOrg,
   resolveDmTarget,
+  resolveSessionActivityState,
   scrubPreservingIdentifiers,
   senderPolicyIsEnforcedOn,
   serializeAccountEnforcementMarker,
+  shouldMintReplacementKey,
   stabiliseResetInstant,
-  sumTranscriptUsageInWindow
-} from "../chunk-47P33SZF.js";
+  sumTranscriptUsageInWindow,
+  summarizeTranscriptActivity
+} from "../chunk-PINFVWGX.js";
 import {
   CLAUDE_CONFIG_DIR_ENV,
   claudeConfigDirFor,
@@ -317,7 +332,7 @@ import "../chunk-DGUM43GV.js";
 
 // src/lib/manager-worker.ts
 import { createHash as createHash20 } from "crypto";
-import { readFileSync as readFileSync34, writeFileSync as writeFileSync18, mkdirSync as mkdirSync16, existsSync as existsSync19, rmSync as rmSync8, readdirSync as readdirSync13, statSync as statSync14, unlinkSync as unlinkSync6, renameSync as renameSync11, utimesSync as utimesSync4, readlinkSync as readlinkSync2 } from "fs";
+import { readFileSync as readFileSync34, writeFileSync as writeFileSync18, mkdirSync as mkdirSync16, existsSync as existsSync19, rmSync as rmSync8, readdirSync as readdirSync14, statSync as statSync15, unlinkSync as unlinkSync6, renameSync as renameSync11, utimesSync as utimesSync4, readlinkSync as readlinkSync2 } from "fs";
 
 // src/lib/atomic-file-replace.ts
 import { copyFileSync, renameSync, unlinkSync } from "fs";
@@ -734,7 +749,7 @@ function clearEpisode(codeName) {
 }
 
 // src/lib/manager-worker.ts
-import { join as join43, dirname as dirname11, delimiter as pathDelimiter } from "path";
+import { join as join44, dirname as dirname11, delimiter as pathDelimiter } from "path";
 import { homedir as homedir17, hostname, platform as platform3 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -3641,6 +3656,100 @@ function maybeMigrateAgentToIdKeyedLayout(agent, deps) {
   }
 }
 
+// src/lib/host-key-rotation.ts
+async function adoptRotatedHostKey(deps) {
+  const refusals = deps.preflightPersist?.() ?? [];
+  if (refusals.length > 0) {
+    deps.log(
+      `[key-rotation] not minting: ${refusals.length} persist channel(s) would refuse the new key, so a mint would leak an active credential for nothing. ${refusals.join(" | ")}`
+    );
+    return deps.held ? { status: "persist-refused", reasons: refusals, held: deps.held } : { status: "persist-refused", reasons: refusals };
+  }
+  let minted;
+  if (deps.held) {
+    minted = deps.held;
+    deps.log(`[key-rotation] retrying the persist of ${minted.prefix}, minted earlier for this request`);
+  } else {
+    let result;
+    try {
+      result = await deps.mint();
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      deps.log(`[key-rotation] mint failed: ${detail}`);
+      return { status: "error", detail };
+    }
+    if (result && "refused" in result) {
+      deps.log(
+        `[key-rotation] the control plane refused the mint for good: ${result.refused}. Not retrying this request. If it never completes, a compromised rotation clears it (docs/runbooks/host-api-key-rotation.md).`
+      );
+      return { status: "mint-refused", reason: result.refused };
+    }
+    if (!result || !result.rawKey || !result.prefix) {
+      deps.log("[key-rotation] mint returned nothing usable - leaving the current key in force");
+      return { status: "mint-failed" };
+    }
+    minted = result;
+  }
+  let persisted;
+  try {
+    persisted = deps.persist(minted.rawKey);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    deps.log(
+      `[key-rotation] could not persist the new key (${minted.prefix}): ${detail} - NOT adopting, NOT acking; the current key stays in force`
+    );
+    return { status: "error", detail, held: minted };
+  }
+  if (!persisted) {
+    deps.log(
+      `[key-rotation] could not persist the new key (${minted.prefix}) - NOT adopting, NOT acking; the current key stays in force`
+    );
+    return { status: "persist-failed", prefix: minted.prefix, held: minted };
+  }
+  if (deps.onPersisted && !deps.onPersisted(minted.prefix)) {
+    deps.log(
+      `[key-rotation] persisted ${minted.prefix} but could not save the pending ack - NOT adopting; the current key stays in force and the retry reuses this key`
+    );
+    return { status: "error", detail: "pending ack could not be saved", held: minted };
+  }
+  try {
+    deps.adoptInProcess(minted.rawKey);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    deps.log(
+      `[key-rotation] persisted ${minted.prefix} but could not adopt it in-process: ${detail} - it will take effect on the next manager restart`
+    );
+    return { status: "error", detail, held: minted };
+  }
+  deps.log(
+    `[key-rotation] adopted new host key ${minted.prefix}. The previous key stays valid until the control plane expires it on this host's ack.`
+  );
+  return { status: "adopted", prefix: minted.prefix };
+}
+function nextPendingAck(pending2, resp) {
+  if (!pending2) return { pending: null, log: null };
+  if (!resp || !("key_rotation_requested_at" in resp)) {
+    return {
+      pending: pending2,
+      log: `[key-rotation] the heartbeat did not report key_rotation_requested_at, so nothing confirms ${pending2} was finalized. Re-acking next poll; the current key stays in force.`
+    };
+  }
+  if (resp.key_rotation_requested_at) {
+    return {
+      pending: pending2,
+      log: `[key-rotation] acked ${pending2} but the request is still armed server-side, so the outgoing key was NOT expired. Re-acking next poll; the current key stays in force either way.`
+    };
+  }
+  return {
+    pending: null,
+    log: `[key-rotation] acked adoption of ${pending2}; the previous key is now expiring`
+  };
+}
+function alreadyHandledRotationRequest(requestedAt, lastHandled) {
+  if (!requestedAt) return true;
+  return requestedAt === lastHandled;
+}
+
 // src/lib/heartbeat-account-email.ts
 function mayReportAccountEmail(rawMode) {
   return rawMode === "subscription";
@@ -4716,9 +4825,130 @@ function failingTurnLoops(now = Date.now(), threshold = failingTurnThreshold(),
   return [...failing, ...recovered];
 }
 
-// src/lib/workflow-run-reconciler.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
+// src/lib/session-activity.ts
+import { readdirSync as readdirSync3, statSync as statSync3 } from "fs";
 import { join as join18 } from "path";
+var RULE = /^[─━]{10,}/;
+var CARET_LINE = /^\s*❯(\s|$)/;
+var NON_BLOCKING_PICKER = { title: "We recommend compacting earlier", footer: "esc not now", kind: "compaction-suggestion" };
+var TOOL_NAME_MAX = 120;
+var MIN_TRANSCRIPT_CHECK_MS = 3e4;
+function classifyPane(screen, tmuxAlive) {
+  if (!tmuxAlive) return { state: "no_session", promptKind: null };
+  if (!screen || !screen.trim()) return null;
+  const kind = parkedModalKind(screen);
+  if (kind) return { state: "blocked_on_prompt", promptKind: kind };
+  const lines = screen.split("\n");
+  const rules = lines.flatMap((l, i) => RULE.test(l.trim()) ? [i] : []);
+  const lastRule = rules[rules.length - 1] ?? -1;
+  const carets = lines.flatMap((l, i) => CARET_LINE.test(l) ? [i] : []);
+  const lastCaret = carets[carets.length - 1] ?? -1;
+  if (lastCaret > lastRule) {
+    const below = lines.slice(lastRule + 1);
+    const footer = below.filter((l) => l.trim()).at(-1) ?? "";
+    if (below.some((l) => l.includes(NON_BLOCKING_PICKER.title)) && footer.includes(NON_BLOCKING_PICKER.footer)) {
+      return isActivelyProcessing(screen) ? { state: "mid_turn", promptKind: null } : { state: "idle_at_prompt", promptKind: NON_BLOCKING_PICKER.kind };
+    }
+    return { state: "blocked_on_prompt", promptKind: "unknown" };
+  }
+  if (isActivelyProcessing(screen)) return { state: "mid_turn", promptKind: null };
+  const prevRule = rules[rules.length - 2] ?? -1;
+  const hasInputBox = lastCaret > prevRule && lastCaret < lastRule && prevRule >= 0;
+  if (!hasInputBox) return { state: "blocked_on_prompt", promptKind: "unknown" };
+  return { state: "idle_at_prompt", promptKind: null };
+}
+var cache = /* @__PURE__ */ new Map();
+function newestTranscript(dir) {
+  let names;
+  try {
+    names = readdirSync3(dir);
+  } catch {
+    return null;
+  }
+  let best = null;
+  for (const name of names) {
+    if (!name.endsWith(".jsonl")) continue;
+    const path = join18(dir, name);
+    try {
+      const st = statSync3(path);
+      if (st.isFile() && (best === null || st.mtimeMs > best.mtimeMs)) {
+        best = { path, mtimeMs: st.mtimeMs, size: st.size };
+      }
+    } catch {
+      continue;
+    }
+  }
+  return best;
+}
+function sessionTranscript(dir, sessionId) {
+  if (!sessionId) return newestTranscript(dir);
+  const path = join18(dir, `${sessionId}.jsonl`);
+  try {
+    const st = statSync3(path);
+    return st.isFile() ? { path, mtimeMs: st.mtimeMs, size: st.size } : null;
+  } catch {
+    return null;
+  }
+}
+function readTranscript(codeName, dir, sessionId, nowMs) {
+  const session = sessionId ?? null;
+  const prev = cache.get(codeName)?.sessionId === session ? cache.get(codeName) : void 0;
+  if (prev && nowMs - prev.checkedAt < MIN_TRANSCRIPT_CHECK_MS) return prev;
+  const file = sessionTranscript(dir, sessionId);
+  if (!file) {
+    const none = { checkedAt: nowMs, sessionId: session, path: null, mtimeMs: null, size: 0, activity: NO_TRANSCRIPT_ACTIVITY };
+    cache.set(codeName, none);
+    return none;
+  }
+  if (prev && prev.path === file.path && prev.mtimeMs === file.mtimeMs && prev.size === file.size) {
+    prev.checkedAt = nowMs;
+    return prev;
+  }
+  const next = {
+    checkedAt: nowMs,
+    sessionId: session,
+    path: file.path,
+    mtimeMs: file.mtimeMs,
+    size: file.size,
+    activity: summarizeTranscriptActivity(readTail(file.path, file.size))
+  };
+  cache.set(codeName, next);
+  return next;
+}
+function iso(ms) {
+  return ms === null ? null : new Date(ms).toISOString();
+}
+function buildSessionActivityReport(args) {
+  const nowMs = args.now ?? Date.now();
+  try {
+    const pane = classifyPane(args.screenCapture, args.tmuxAlive);
+    if (!pane) return null;
+    const transcript = readTranscript(args.codeName, args.transcriptDir, args.sessionId, nowMs);
+    const state10 = resolveSessionActivityState({
+      pane,
+      transcript: transcript.activity,
+      transcriptMtimeMs: transcript.mtimeMs,
+      // When the mtime was read, not now: it can be up to 30s old, and a stale read
+      // must not age a transcript that has since moved into `turn_killed`.
+      nowMs: transcript.checkedAt
+    });
+    return {
+      state: state10,
+      promptKind: state10 === "blocked_on_prompt" || state10 === "idle_at_prompt" ? pane.promptKind : null,
+      lastToolName: transcript.activity.lastToolName?.slice(0, TOOL_NAME_MAX) ?? null,
+      lastToolAt: iso(transcript.activity.lastToolAtMs),
+      lastCompletedTurnAt: iso(transcript.activity.lastCompletedTurnAtMs),
+      transcriptMtime: iso(transcript.mtimeMs)
+    };
+  } catch (err) {
+    args.log?.(`[session-activity] failed for '${args.codeName}': ${err.message}`);
+    return null;
+  }
+}
+
+// src/lib/workflow-run-reconciler.ts
+import { readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync4 } from "fs";
+import { join as join19 } from "path";
 var MIN_CHECK_INTERVAL_MS4 = 5 * 6e4;
 var SETTLE_MS = 3e4;
 var TRANSCRIPT_MTIME_WINDOW_MS2 = 2 * 24 * 60 * 60 * 1e3;
@@ -4752,15 +4982,15 @@ function collectJsonlRecursive(dir, minMtimeMs, out, depth) {
   if (depth > MAX_SUBAGENT_DEPTH) return;
   let entries;
   try {
-    entries = readdirSync3(dir);
+    entries = readdirSync4(dir);
   } catch {
     return;
   }
   for (const name of entries) {
-    const p = join18(dir, name);
+    const p = join19(dir, name);
     let st;
     try {
-      st = statSync3(p);
+      st = statSync4(p);
     } catch {
       continue;
     }
@@ -4775,15 +5005,15 @@ function enumerateTranscriptFiles(transcriptDir, nowMs, minMtimeMs = nowMs - TRA
   const out = [];
   let entries;
   try {
-    entries = readdirSync3(transcriptDir);
+    entries = readdirSync4(transcriptDir);
   } catch {
     return out;
   }
   for (const name of entries) {
-    const path = join18(transcriptDir, name);
+    const path = join19(transcriptDir, name);
     let st;
     try {
-      st = statSync3(path);
+      st = statSync4(path);
     } catch {
       continue;
     }
@@ -4792,7 +5022,7 @@ function enumerateTranscriptFiles(transcriptDir, nowMs, minMtimeMs = nowMs - TRA
       continue;
     }
     if (st.isDirectory()) {
-      collectJsonlRecursive(join18(path, "subagents"), minMtimeMs, out, 0);
+      collectJsonlRecursive(join19(path, "subagents"), minMtimeMs, out, 0);
     }
   }
   return out;
@@ -4881,8 +5111,8 @@ async function maybeReconcileWorkflowRunTokens(args) {
 }
 
 // src/lib/conversation-evaluator.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync13, statSync as statSync4 } from "fs";
-import { join as join19 } from "path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync13, statSync as statSync5 } from "fs";
+import { join as join20 } from "path";
 
 // src/lib/detect-meta-egress.ts
 var REPOST_PREAMBLE_WINDOW = 200;
@@ -5362,12 +5592,12 @@ function readRecentTurns(dir, nowMs) {
   const visit = (d) => {
     let entries;
     try {
-      entries = readdirSync4(d, { withFileTypes: true });
+      entries = readdirSync5(d, { withFileTypes: true });
     } catch {
       return;
     }
     for (const ent of entries) {
-      const full = join19(d, ent.name);
+      const full = join20(d, ent.name);
       if (ent.isDirectory()) {
         visit(full);
         continue;
@@ -5375,7 +5605,7 @@ function readRecentTurns(dir, nowMs) {
       if (!ent.isFile() || !ent.name.endsWith(".jsonl")) continue;
       let mtimeMs;
       try {
-        mtimeMs = statSync4(full).mtimeMs;
+        mtimeMs = statSync5(full).mtimeMs;
       } catch {
         continue;
       }
@@ -5755,17 +5985,17 @@ async function reportSkip2(api2, agentId, conversationId, log2, codeName) {
 
 // src/lib/tool-call-audit.ts
 import { homedir as homedir11 } from "os";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 
 // src/lib/agent-logging-mode.ts
 import { readFileSync as readFileSync14 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 var LOGGING_MODES = ["hash-only", "redacted", "full-local"];
 function charterPath(codeName, homeDir) {
   const home = homeDir ?? (process.env["HOME"]?.trim() || homedir8());
   const key = agentRuntimeKey(codeName, homeDir);
-  return join20(home, ".augmented", key, "provision", "CHARTER.md");
+  return join21(home, ".augmented", key, "provision", "CHARTER.md");
 }
 function readAgentLoggingMode(codeName, homeDir) {
   let raw;
@@ -5796,13 +6026,13 @@ function loggingModeWithholdsTargets(reading) {
 import { randomBytes } from "crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync15, renameSync as renameSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir9 } from "os";
-import { dirname as dirname7, join as join21 } from "path";
+import { dirname as dirname7, join as join22 } from "path";
 var SALT_BYTES = 32;
 var SALT_RE = /^[0-9a-f]{64}$/;
 function pathSaltPath(codeName, homeDir) {
   const home = homeDir ?? (process.env["HOME"]?.trim() || homedir9());
   const key = agentRuntimeKey(codeName, homeDir);
-  return join21(home, ".augmented", key, "tool-call-path-salt");
+  return join22(home, ".augmented", key, "tool-call-path-salt");
 }
 function readToolCallPathSalt(codeName, homeDir) {
   let file;
@@ -5836,11 +6066,11 @@ function readToolCallPathSalt(codeName, homeDir) {
 }
 
 // src/lib/tool-call-scan.ts
-import { statSync as statSync5 } from "fs";
+import { statSync as statSync6 } from "fs";
 
 // src/lib/tool-call-extractor.ts
-import { closeSync as closeSync2, fstatSync, openSync as openSync2, readFileSync as readFileSync16, readSync as readSync2, readdirSync as readdirSync5 } from "fs";
-import { basename as basename2, join as join22, relative } from "path";
+import { closeSync as closeSync2, fstatSync, openSync as openSync2, readFileSync as readFileSync16, readSync as readSync2, readdirSync as readdirSync6 } from "fs";
+import { basename as basename2, join as join23, relative } from "path";
 import { StringDecoder } from "string_decoder";
 
 // src/lib/tool-call-redaction.ts
@@ -5969,7 +6199,7 @@ function redactToolTargetInner(toolName, input, ctx) {
 var EXTRACTOR_VERSION = "e1";
 function enumerateSessionTranscripts(transcriptDir, sessionId, projectsRoot) {
   const files = [];
-  const mainAbs = join22(transcriptDir, `${sessionId}.jsonl`);
+  const mainAbs = join23(transcriptDir, `${sessionId}.jsonl`);
   files.push({
     absPath: mainAbs,
     relPath: relative(projectsRoot, mainAbs),
@@ -5977,16 +6207,16 @@ function enumerateSessionTranscripts(transcriptDir, sessionId, projectsRoot) {
     isSubagent: false,
     subagentId: null
   });
-  const subDir = join22(transcriptDir, sessionId, "subagents");
+  const subDir = join23(transcriptDir, sessionId, "subagents");
   let entries;
   try {
-    entries = readdirSync5(subDir);
+    entries = readdirSync6(subDir);
   } catch {
     return files;
   }
   for (const name of entries) {
     if (!name.endsWith(".jsonl")) continue;
-    const abs = join22(subDir, name);
+    const abs = join23(subDir, name);
     const stem = basename2(name, ".jsonl");
     files.push({
       absPath: abs,
@@ -6186,7 +6416,7 @@ function extractTranscriptWindow(file, opts, from) {
 // src/lib/tool-call-cursor.ts
 import { existsSync as existsSync5, readFileSync as readFileSync17 } from "fs";
 import { homedir as homedir10 } from "os";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 var COVERAGE_DISPOSITIONS = [
   "ok",
   "not_entitled",
@@ -6241,7 +6471,7 @@ function parseCursorKey(key) {
 function cursorStatePath(codeName, homeDir) {
   const home = homeDir ?? (process.env["HOME"]?.trim() || homedir10());
   const key = agentRuntimeKey(codeName, homeDir);
-  return join23(home, ".augmented", key, "tool-call-cursors.json");
+  return join24(home, ".augmented", key, "tool-call-cursors.json");
 }
 function loadCursors(path) {
   const out = /* @__PURE__ */ new Map();
@@ -6390,7 +6620,7 @@ function nextCursor(args) {
   };
 }
 function initialCursor(args) {
-  const iso = new Date(args.nowMs).toISOString();
+  const iso2 = new Date(args.nowMs).toISOString();
   return {
     byteOffset: args.startByte,
     lineOffset: args.startLine,
@@ -6406,8 +6636,8 @@ function initialCursor(args) {
     runScopeId: null,
     unpairedSince: null,
     lastDisposition: "ok",
-    lastScanAt: iso,
-    firstScanAt: iso,
+    lastScanAt: iso2,
+    firstScanAt: iso2,
     transcriptRelPath: args.transcriptRelPath
   };
 }
@@ -6463,7 +6693,7 @@ function chunk(items, size) {
 }
 function endOfFile(absPath) {
   try {
-    return { byteOffset: statSync5(absPath).size, lineOffset: 0 };
+    return { byteOffset: statSync6(absPath).size, lineOffset: 0 };
   } catch {
     return null;
   }
@@ -6654,7 +6884,7 @@ async function maybeScanToolCalls(args) {
       log2(`[tool-call-audit] ${codeName}: no path-hash salt available \u2014 file targets withheld`);
     }
     const home = args.homeDir ?? (process.env["HOME"]?.trim() || homedir11());
-    const projectsRoot = args.projectsRoot ?? join24(home, ".claude", "projects");
+    const projectsRoot = args.projectsRoot ?? join25(home, ".claude", "projects");
     const transcriptDir = args.transcriptDir ?? sessionTranscriptDir(getProjectDir(codeName));
     const current = peekCurrentSession(codeName);
     const sessionIds = current ? [current.sessionId] : [];
@@ -6685,9 +6915,9 @@ async function maybeScanToolCalls(args) {
 // src/lib/activity-cache-monitor.ts
 import { existsSync as existsSync6, readFileSync as readFileSync18 } from "fs";
 import { homedir as homedir12 } from "os";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 var MIN_CHECK_INTERVAL_MS8 = 6e4;
-var STATS_CACHE_PATH = join25(homedir12(), ".claude", "stats-cache.json");
+var STATS_CACHE_PATH = join26(homedir12(), ".claude", "stats-cache.json");
 var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 var state8 = { lastObservedDate: null, lastCheckedAt: 0 };
 function selectNewDailyRows(raw, lastObservedDate) {
@@ -6978,11 +7208,11 @@ function bundleFingerprint(files) {
 }
 
 // src/lib/self-update-device-state-hold.ts
-import { statSync as statSync6 } from "fs";
+import { statSync as statSync7 } from "fs";
 import { platform as osPlatform } from "os";
 function realStat(path) {
   try {
-    return { isFile: statSync6(path).isFile() };
+    return { isFile: statSync7(path).isFile() };
   } catch (err) {
     return { errno: err?.code ?? "UNKNOWN" };
   }
@@ -7058,14 +7288,14 @@ import {
   existsSync as existsSync7,
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync19,
-  readdirSync as readdirSync6,
+  readdirSync as readdirSync7,
   renameSync as renameSync5,
   rmSync as rmSync3,
-  statSync as statSync7,
+  statSync as statSync8,
   utimesSync,
   writeFileSync as writeFileSync8
 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var KNOWLEDGE_FETCH_CHUNK = 100;
 var CACHE_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var SWEEP_INTERVAL_MS = 24 * 60 * 60 * 1e3;
@@ -7074,7 +7304,7 @@ function knowledgeHash(content) {
   return createHash9("sha256").update(content, "utf8").digest("hex");
 }
 function cachePath(cacheDir, hash) {
-  return join26(cacheDir, hash);
+  return join27(cacheDir, hash);
 }
 function readCachedKnowledge(cacheDir, hash) {
   const path = cachePath(cacheDir, hash);
@@ -7107,10 +7337,10 @@ function sweepKnowledgeCache(cacheDir, now = Date.now()) {
   lastSweepAt = now;
   try {
     if (!existsSync7(cacheDir)) return;
-    for (const name of readdirSync6(cacheDir)) {
-      const path = join26(cacheDir, name);
+    for (const name of readdirSync7(cacheDir)) {
+      const path = join27(cacheDir, name);
       try {
-        if (now - statSync7(path).mtimeMs > CACHE_TTL_MS) rmSync3(path, { force: true });
+        if (now - statSync8(path).mtimeMs > CACHE_TTL_MS) rmSync3(path, { force: true });
       } catch {
       }
     }
@@ -7161,14 +7391,14 @@ import {
   existsSync as existsSync8,
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync20,
-  readdirSync as readdirSync7,
+  readdirSync as readdirSync8,
   renameSync as renameSync6,
   rmSync as rmSync4,
-  statSync as statSync8,
+  statSync as statSync9,
   utimesSync as utimesSync2,
   writeFileSync as writeFileSync9
 } from "fs";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 var MEMORY_FETCH_CHUNK = 100;
 var CACHE_TTL_MS2 = 30 * 24 * 60 * 60 * 1e3;
 var SWEEP_INTERVAL_MS2 = 24 * 60 * 60 * 1e3;
@@ -7177,7 +7407,7 @@ function memoryHash(content) {
   return createHash10("sha256").update(content, "utf8").digest("hex");
 }
 function cachePath2(cacheDir, hash) {
-  return join27(cacheDir, hash);
+  return join28(cacheDir, hash);
 }
 function readCachedMemory(cacheDir, hash) {
   const path = cachePath2(cacheDir, hash);
@@ -7210,10 +7440,10 @@ function sweepMemoryCache(cacheDir, now = Date.now()) {
   lastSweepAt2.set(cacheDir, now);
   try {
     if (!existsSync8(cacheDir)) return;
-    for (const name of readdirSync7(cacheDir)) {
-      const path = join27(cacheDir, name);
+    for (const name of readdirSync8(cacheDir)) {
+      const path = join28(cacheDir, name);
       try {
-        if (now - statSync8(path).mtimeMs > CACHE_TTL_MS2) rmSync4(path, { force: true });
+        if (now - statSync9(path).mtimeMs > CACHE_TTL_MS2) rmSync4(path, { force: true });
       } catch {
       }
     }
@@ -7270,14 +7500,14 @@ import {
   existsSync as existsSync9,
   mkdirSync as mkdirSync9,
   readFileSync as readFileSync21,
-  readdirSync as readdirSync8,
+  readdirSync as readdirSync9,
   renameSync as renameSync7,
   rmSync as rmSync5,
-  statSync as statSync9,
+  statSync as statSync10,
   utimesSync as utimesSync3,
   writeFileSync as writeFileSync10
 } from "fs";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 var SKILL_FETCH_CHUNK = 100;
 var CACHE_TTL_MS3 = 30 * 24 * 60 * 60 * 1e3;
 var SWEEP_INTERVAL_MS3 = 24 * 60 * 60 * 1e3;
@@ -7286,7 +7516,7 @@ function skillHash(content) {
   return createHash11("sha256").update(content, "utf8").digest("hex");
 }
 function cachePath3(cacheDir, hash) {
-  return join28(cacheDir, hash);
+  return join29(cacheDir, hash);
 }
 function readCachedSkill(cacheDir, hash) {
   const path = cachePath3(cacheDir, hash);
@@ -7319,10 +7549,10 @@ function sweepSkillCache(cacheDir, now = Date.now()) {
   lastSweepAt3 = now;
   try {
     if (!existsSync9(cacheDir)) return;
-    for (const name of readdirSync8(cacheDir)) {
-      const path = join28(cacheDir, name);
+    for (const name of readdirSync9(cacheDir)) {
+      const path = join29(cacheDir, name);
       try {
-        if (now - statSync9(path).mtimeMs > CACHE_TTL_MS3) rmSync5(path, { force: true });
+        if (now - statSync10(path).mtimeMs > CACHE_TTL_MS3) rmSync5(path, { force: true });
       } catch {
       }
     }
@@ -7650,10 +7880,10 @@ function resolveConditionalResponse(wire, hasCachedBody) {
 
 // src/lib/channel-hash-cache.ts
 import { existsSync as existsSync10, readFileSync as readFileSync22, writeFileSync as writeFileSync11 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 var CACHE_FILENAME = "channel-hash-cache.json";
 function getChannelHashCacheFile(configDir) {
-  return join29(configDir, CACHE_FILENAME);
+  return join30(configDir, CACHE_FILENAME);
 }
 function loadChannelHashCache(target, configDir) {
   const path = getChannelHashCacheFile(configDir);
@@ -7681,7 +7911,7 @@ function saveChannelHashCache(source, configDir) {
 
 // src/lib/sender-policy-baseline.ts
 import { existsSync as existsSync11, readFileSync as readFileSync23 } from "fs";
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 var BASELINE_FILENAME = "sender-policy-baseline.json";
 var SENDER_POLICY_BASELINE_VERSION = 1;
 var BASELINE_CONCERNS = [
@@ -7728,7 +7958,7 @@ function createDeliveryBaselineMaps() {
   };
 }
 function getSenderPolicyBaselineFile(configDir) {
-  return join30(configDir, BASELINE_FILENAME);
+  return join31(configDir, BASELINE_FILENAME);
 }
 function loadSenderPolicyBaseline(target, configDir, log2) {
   const path = getSenderPolicyBaselineFile(configDir);
@@ -7785,7 +8015,7 @@ function saveSenderPolicyBaseline(source, configDir, log2) {
 
 // src/lib/stuck-streak-store.ts
 import { existsSync as existsSync12, readFileSync as readFileSync24 } from "fs";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 var STORE_FILENAME = "stuck-streaks.json";
 var STUCK_STREAK_STORE_VERSION = 1;
 var STUCK_STREAK_CONCERNS = ["channelSync", "realtimeRebind"];
@@ -7793,7 +8023,7 @@ function createStuckStreakMaps() {
   return { channelSync: /* @__PURE__ */ new Map(), realtimeRebind: /* @__PURE__ */ new Map() };
 }
 function getStuckStreakStoreFile(configDir) {
-  return join31(configDir, STORE_FILENAME);
+  return join32(configDir, STORE_FILENAME);
 }
 function isValidPersistedStreak(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
@@ -7878,13 +8108,13 @@ function pruneStuckStreaksToAgents(maps, activeAgentIds) {
 }
 
 // src/lib/claude-device-state.ts
-import { readFileSync as readFileSync25, statSync as statSync10 } from "fs";
+import { readFileSync as readFileSync25, statSync as statSync11 } from "fs";
 function claudeDeviceStatePath(env = process.env) {
   return effectiveClaudeJsonPath(void 0, env);
 }
 function probeClaudeDeviceStatePresence(path = claudeDeviceStatePath()) {
   try {
-    return statSync10(path).isFile() ? { present: true } : { present: false, reason: "not-a-file" };
+    return statSync11(path).isFile() ? { present: true } : { present: false, reason: "not-a-file" };
   } catch (err) {
     return {
       present: false,
@@ -7894,7 +8124,7 @@ function probeClaudeDeviceStatePresence(path = claudeDeviceStatePath()) {
 }
 function checkClaudeDeviceState(path = claudeDeviceStatePath()) {
   try {
-    if (!statSync10(path).isFile()) return { usable: false, reason: "not-a-file" };
+    if (!statSync11(path).isFile()) return { usable: false, reason: "not-a-file" };
   } catch (err) {
     return {
       usable: false,
@@ -8581,32 +8811,32 @@ function planGlobalSkillSync(globalSkills, prevIds, hashOf, knownHash, options)
 }
 
 // src/lib/manager/integration-skill-cache.ts
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 function integrationSkillHashKey(agentId, skillId) {
   return `plugin-skill:${agentId}:${skillId}`;
 }
-function shouldWriteIntegrationSkill(cache2, agentId, skillId, contentHash) {
-  return cache2.get(integrationSkillHashKey(agentId, skillId)) !== contentHash;
+function shouldWriteIntegrationSkill(cache3, agentId, skillId, contentHash) {
+  return cache3.get(integrationSkillHashKey(agentId, skillId)) !== contentHash;
 }
-function rememberIntegrationSkill(cache2, agentId, skillId, contentHash) {
-  cache2.set(integrationSkillHashKey(agentId, skillId), contentHash);
+function rememberIntegrationSkill(cache3, agentId, skillId, contentHash) {
+  cache3.set(integrationSkillHashKey(agentId, skillId), contentHash);
 }
-function forgetIntegrationSkill(cache2, agentId, skillId) {
-  cache2.delete(integrationSkillHashKey(agentId, skillId));
+function forgetIntegrationSkill(cache3, agentId, skillId) {
+  cache3.delete(integrationSkillHashKey(agentId, skillId));
 }
 function removeIntegrationSkillFolder(opts) {
   forgetIntegrationSkill(opts.cache, opts.agentId, opts.entry);
   for (const dir of opts.dirs) {
-    opts.removeDir(join32(dir, opts.entry));
+    opts.removeDir(join33(dir, opts.entry));
   }
 }
 
 // src/lib/manager/managed-skill-manifest.ts
 import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync26, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname8, join as join33 } from "path";
+import { dirname as dirname8, join as join34 } from "path";
 var MANIFEST_VERSION = 1;
 function managedSkillManifestPath(agentRootDir) {
-  return join33(agentRootDir, "managed-skills.json");
+  return join34(agentRootDir, "managed-skills.json");
 }
 function readManagedSkillManifest(path) {
   try {
@@ -8741,7 +8971,7 @@ function resolveModelChain(refreshData) {
 
 // src/lib/manager/claude-auth.ts
 import { chmodSync as chmodSync2, existsSync as existsSync14, lstatSync as lstatSync3, mkdirSync as mkdirSync11, rmSync as rmSync6 } from "fs";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 import { homedir as homedir13 } from "os";
 async function applyClaudeAuthToEnv(childEnv, label, options = {}) {
   const apiKey = getApiKey();
@@ -8760,7 +8990,7 @@ async function applyClaudeAuthToEnv(childEnv, label, options = {}) {
     }
     const claudeDir = claudeConfigDirForChild(childEnv);
     for (const filename of [".credentials.json", "credentials.json"]) {
-      const p = join34(claudeDir, filename);
+      const p = join35(claudeDir, filename);
       if (existsSync14(p)) {
         try {
           rmSync6(p, { force: true });
@@ -8775,7 +9005,7 @@ async function applyClaudeAuthToEnv(childEnv, label, options = {}) {
   return { isolated: false };
 }
 function claudeConfigDirForChild(childEnv) {
-  return childEnv.CLAUDE_CONFIG_DIR?.trim() || join34(homedir13(), ".claude");
+  return childEnv.CLAUDE_CONFIG_DIR?.trim() || join35(homedir13(), ".claude");
 }
 function ensurePrivateConfigDir(dir, platform4 = process.platform, chmod = chmodSync2) {
   mkdirSync11(dir, { recursive: true, mode: 448 });
@@ -8791,7 +9021,7 @@ function ensurePrivateConfigDir(dir, platform4 = process.platform, chmod = chmod
   }
 }
 function oneShotIsolatedConfigDir() {
-  return join34(homedir13(), ".augmented", "claude-oneshot");
+  return join35(homedir13(), ".augmented", "claude-oneshot");
 }
 
 // src/lib/claude-runtime-auth-probe.ts
@@ -9137,11 +9367,11 @@ function formatBoardForPrompt(items, template) {
 
 // src/lib/manager/kanban/nudge-state-cache.ts
 import { existsSync as existsSync15, readFileSync as readFileSync27, writeFileSync as writeFileSync13 } from "fs";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 var CACHE_FILENAME2 = "kanban-nudge-state.json";
 var KANBAN_NUDGE_STATE_VERSION = 1;
 function getKanbanNudgeStateFile(configDir) {
-  return join35(configDir, CACHE_FILENAME2);
+  return join36(configDir, CACHE_FILENAME2);
 }
 function loadKanbanNudgeState(target, configDir) {
   const path = getKanbanNudgeStateFile(configDir);
@@ -9768,7 +9998,7 @@ function closeSessionRunForCode(codeName, outcome, reason) {
 import { createHash as createHash15 } from "crypto";
 import { writeFileSync as writeFileSync14, renameSync as renameSync8, mkdirSync as mkdirSync12, readFileSync as readFileSync28, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir14 } from "os";
-import { join as join36, dirname as dirname9 } from "path";
+import { join as join37, dirname as dirname9 } from "path";
 
 // src/lib/manager/scheduler/notify.ts
 import { createHash as createHash14 } from "crypto";
@@ -10127,7 +10357,7 @@ function resolveScheduledSlackTarget(task) {
 }
 function stampScheduledTurnMarker(codeName, taskId, target) {
   try {
-    const file = join36(homedir14(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
+    const file = join37(homedir14(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
     const marker = { ts: Date.now(), task_id: taskId, ...target ? { target } : {} };
     const tmp = `${file}.tmp`;
     writeFileSync14(tmp, JSON.stringify(marker), "utf8");
@@ -10137,7 +10367,7 @@ function stampScheduledTurnMarker(codeName, taskId, target) {
   }
 }
 function clearScheduledTurnMarkerForTask(codeName, taskId) {
-  const file = join36(homedir14(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
+  const file = join37(homedir14(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
   try {
     const raw = JSON.parse(readFileSync28(file, "utf8"));
     if (typeof raw?.task_id !== "string" || raw.task_id !== taskId) return;
@@ -10359,11 +10589,11 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
 // src/lib/manager/scheduler/execution.ts
 import { createHash as createHash16 } from "crypto";
 import { homedir as homedir15 } from "os";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 
 // src/lib/agent-serving-probe.ts
-import { readFileSync as readFileSync29, readdirSync as readdirSync9, statSync as statSync11 } from "fs";
-import { join as join37 } from "path";
+import { readFileSync as readFileSync29, readdirSync as readdirSync10, statSync as statSync12 } from "fs";
+import { join as join38 } from "path";
 var RATE_LIMIT_WINDOW_MS = 6 * 60 * 60 * 1e3;
 function probeRateLimit(args) {
   const now = args.now ?? /* @__PURE__ */ new Date();
@@ -10372,16 +10602,16 @@ function probeRateLimit(args) {
   const dir = args.transcriptDir ?? sessionTranscriptDir(args.projectDir);
   let entries;
   try {
-    entries = readdirSync9(dir);
+    entries = readdirSync10(dir);
   } catch {
     return UNKNOWN_RATE_LIMIT;
   }
   let newest = UNKNOWN_RATE_LIMIT;
   for (const name of entries) {
     if (!name.endsWith(".jsonl")) continue;
-    const path = join37(dir, name);
+    const path = join38(dir, name);
     try {
-      const st = statSync11(path);
+      const st = statSync12(path);
       if (!st.isFile() || st.mtimeMs < startMs) continue;
     } catch {
       continue;
@@ -10450,7 +10680,7 @@ function shouldLogUsageCapDeferral(site, codeName, limitedUntil) {
 
 // src/lib/manager/scheduler/execution.ts
 function claudePidFilePath() {
-  return join38(homedir15(), ".augmented", "manager-claude-pids.json");
+  return join39(homedir15(), ".augmented", "manager-claude-pids.json");
 }
 var inFlightClaudePids = /* @__PURE__ */ new Map();
 function registerClaudeSpawn(record) {
@@ -10691,8 +10921,8 @@ var BlockedPromptReportCadence = class {
 };
 
 // src/lib/occupancy-gate.ts
-import { closeSync as closeSync3, openSync as openSync3, readdirSync as readdirSync10, readSync as readSync3, statSync as statSync12 } from "fs";
-import { join as join39 } from "path";
+import { closeSync as closeSync3, openSync as openSync3, readdirSync as readdirSync11, readSync as readSync3, statSync as statSync13 } from "fs";
+import { join as join40 } from "path";
 function rostersMeasuredZero(mode, attested, runtimeRunning) {
   return mode === "enforce" && attested && runtimeRunning;
 }
@@ -10701,12 +10931,12 @@ var MAX_RECORD_ALIGN_BYTES = 8 * 1024 * 1024;
 var GATE_MAX_BUCKET_AGE_MS = 30 * 6e4;
 var MAX_BRACKET_DEFERRAL_MS = 25 * 6e4;
 var TRANSCRIPT_MTIME_WINDOW_MS4 = GATE_MAX_BUCKET_AGE_MS + DEFAULT_NEIGHBOURHOOD_MS + 6e4;
-var cache = /* @__PURE__ */ new Map();
+var cache2 = /* @__PURE__ */ new Map();
 var brackets = /* @__PURE__ */ new Map();
 function readAlignedTail(path, tailBytes, maxAlignBytes) {
   let fd = null;
   try {
-    const size = statSync12(path).size;
+    const size = statSync13(path).size;
     if (size <= 0) return { content: "", complete: true, truncated: false };
     fd = openSync3(path, "r");
     let readStart = Math.max(0, size - tailBytes);
@@ -10776,26 +11006,26 @@ function candidateTranscriptPaths(dir) {
   const paths = [];
   let top;
   try {
-    top = readdirSync10(dir);
+    top = readdirSync11(dir);
   } catch {
     return { paths, complete: false };
   }
   let complete = true;
   for (const name of top) {
     if (name.endsWith(".jsonl")) {
-      paths.push(join39(dir, name));
+      paths.push(join40(dir, name));
       continue;
     }
-    const subDir = join39(dir, name, "subagents");
+    const subDir = join40(dir, name, "subagents");
     let subs;
     try {
-      subs = readdirSync10(subDir);
+      subs = readdirSync11(subDir);
     } catch (err) {
       if (!isAbsentDirError(err)) complete = false;
       continue;
     }
     for (const sub of subs) {
-      if (sub.endsWith(".jsonl")) paths.push(join39(subDir, sub));
+      if (sub.endsWith(".jsonl")) paths.push(join40(subDir, sub));
     }
   }
   return { paths, complete };
@@ -10836,7 +11066,7 @@ function collectQualifyingTurns(codeName, nowMs, opts = {}) {
   const tailBytes = opts.tailBytes ?? TAIL_BYTES;
   const maxAlignBytes = opts.maxAlignBytes ?? MAX_RECORD_ALIGN_BYTES;
   const sinceMs = nowMs - TRANSCRIPT_MTIME_WINDOW_MS4;
-  const agentCache = cache.get(codeName) ?? /* @__PURE__ */ new Map();
+  const agentCache = cache2.get(codeName) ?? /* @__PURE__ */ new Map();
   const nextCache = /* @__PURE__ */ new Map();
   const all = /* @__PURE__ */ new Set();
   const eventsByPath = /* @__PURE__ */ new Map();
@@ -10850,7 +11080,7 @@ function collectQualifyingTurns(codeName, nowMs, opts = {}) {
   for (const path of paths) {
     let st;
     try {
-      st = statSync12(path);
+      st = statSync13(path);
     } catch (err) {
       if (!isAbsentDirError(err)) complete = false;
       continue;
@@ -10889,7 +11119,7 @@ function collectQualifyingTurns(codeName, nowMs, opts = {}) {
     }
     for (const t of turns) all.add(t);
   }
-  cache.set(codeName, nextCache);
+  cache2.set(codeName, nextCache);
   const { toolCallBrackets, openToolCalls } = foldToolCallBrackets(codeName, eventsByPath, nowMs);
   return {
     turns: [...all].sort((a, b) => a - b),
@@ -10956,7 +11186,7 @@ function qualifyBuckets(buckets, qualifying, mode, nowMs, neighbourhoodMs = DEFA
 }
 
 // src/lib/pane-occupancy-sampler.ts
-import { statSync as statSync13 } from "fs";
+import { statSync as statSync14 } from "fs";
 var SAMPLE_INTERVAL_MS = 1e4;
 var IDLE_GAP_MS = 12e4;
 var POST_IDLE_CREDIT_MS = 6e4;
@@ -10970,7 +11200,7 @@ function hasFreshPaneObservation(codeName, nowMs, maxAgeMs = OBSERVATION_FRESH_M
 }
 function paneMtimeMs(codeName) {
   try {
-    return statSync13(paneLogPath(codeName)).mtimeMs;
+    return statSync14(paneLogPath(codeName)).mtimeMs;
   } catch {
     return null;
   }
@@ -12433,7 +12663,7 @@ async function fireOpencodeScheduledTask(agent, task) {
 import { createHash as createHash19 } from "crypto";
 import { existsSync as existsSync17, mkdirSync as mkdirSync13, readFileSync as readFileSync31, renameSync as renameSync9, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "fs";
 import { randomUUID } from "crypto";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 
 // src/lib/telegram-ingest.ts
 import https2 from "https";
@@ -13086,7 +13316,7 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
   let filePath;
   try {
     dir = getFramework("opencode").getAgentDir(codeName);
-    filePath = join40(dir, "telegram-getupdates-offset-opencode.json");
+    filePath = join41(dir, "telegram-getupdates-offset-opencode.json");
   } catch {
     dir = null;
     filePath = null;
@@ -13370,24 +13600,24 @@ function partitionActionableByPoison(actionable, states, config2) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync14, readdirSync as readdirSync11, readFileSync as readFileSync32, renameSync as renameSync10, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync14, readdirSync as readdirSync12, readFileSync as readFileSync32, renameSync as renameSync10, rmSync as rmSync7, writeFileSync as writeFileSync16 } from "fs";
 import { homedir as homedir16 } from "os";
-import { join as join41 } from "path";
+import { join as join42 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 function restartFlagsDir() {
-  return join41(homedir16(), ".augmented", "restart-flags");
+  return join42(homedir16(), ".augmented", "restart-flags");
 }
 function flagPath(codeName) {
-  return join41(restartFlagsDir(), `${codeName}.flag`);
+  return join42(restartFlagsDir(), `${codeName}.flag`);
 }
 function readRestartFlags() {
   const dir = restartFlagsDir();
   if (!existsSync18(dir)) return [];
   const out = [];
-  for (const entry of readdirSync11(dir)) {
+  for (const entry of readdirSync12(dir)) {
     if (!entry.endsWith(".flag")) continue;
     try {
-      const raw = readFileSync32(join41(dir, entry), "utf8");
+      const raw = readFileSync32(join42(dir, entry), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.codeName !== "string" || parsed.codeName.length === 0) {
         parsed.codeName = entry.replace(/\.flag$/, "");
@@ -13505,8 +13735,8 @@ async function sendError(flag, opts, text) {
 }
 
 // src/lib/restart-context.ts
-import { readdirSync as readdirSync12, readFileSync as readFileSync33, writeFileSync as writeFileSync17, mkdirSync as mkdirSync15, unlinkSync as unlinkSync5 } from "fs";
-import { dirname as dirname10, join as join42 } from "path";
+import { readdirSync as readdirSync13, readFileSync as readFileSync33, writeFileSync as writeFileSync17, mkdirSync as mkdirSync15, unlinkSync as unlinkSync5 } from "fs";
+import { dirname as dirname10, join as join43 } from "path";
 var SLACK_PENDING_INBOUND_DIRNAME = "slack-pending-inbound";
 var SLACK_RESTART_CONTEXT_DIRNAME = "slack-restart-context";
 var MAX_TOPIC_CHARS = 140;
@@ -13518,10 +13748,10 @@ function augmentedAgentDir(codeName) {
   return dirname10(getProjectDir(codeName));
 }
 function slackPendingInboundDir(codeName) {
-  return join42(augmentedAgentDir(codeName), SLACK_PENDING_INBOUND_DIRNAME);
+  return join43(augmentedAgentDir(codeName), SLACK_PENDING_INBOUND_DIRNAME);
 }
 function slackRestartContextDir(codeName) {
-  return join42(augmentedAgentDir(codeName), SLACK_RESTART_CONTEXT_DIRNAME);
+  return join43(augmentedAgentDir(codeName), SLACK_RESTART_CONTEXT_DIRNAME);
 }
 function sanitizeTopic(raw) {
   const cleaned = raw.replace(/\s+/g, " ").trim().replace(/[<>]/g, " ").replace(/\s+/g, " ").trim();
@@ -13556,7 +13786,7 @@ function computeRestartContextHints(markers, allTurns, nowMs, reconstruct = reco
 }
 function safeReaddir(dir) {
   try {
-    return readdirSync12(dir);
+    return readdirSync13(dir);
   } catch {
     return [];
   }
@@ -13581,7 +13811,7 @@ function pruneHintsExcept(codeName, freshFilenames) {
     if (!filename.endsWith(".json")) continue;
     if (freshFilenames.has(filename)) continue;
     try {
-      unlinkSync5(join42(ctxDir, filename));
+      unlinkSync5(join43(ctxDir, filename));
     } catch {
     }
   }
@@ -13602,7 +13832,7 @@ function refreshSlackRestartContextHints(codeNames, opts = {}) {
       }
       const markers = [];
       for (const filename of markerFilenames.slice(0, cap)) {
-        const parsed = readStrandedMarker(join42(markerDir, filename));
+        const parsed = readStrandedMarker(join43(markerDir, filename));
         if (parsed) markers.push({ filename, channel: parsed.channel, thread_ts: parsed.thread_ts });
       }
       if (markers.length === 0) {
@@ -13616,7 +13846,7 @@ function refreshSlackRestartContextHints(codeNames, opts = {}) {
       const freshFilenames = /* @__PURE__ */ new Set();
       for (const { filename, hint } of hints) {
         try {
-          writeHintFile(join42(ctxDir, filename), ctxDir, hint);
+          writeHintFile(join43(ctxDir, filename), ctxDir, hint);
           freshFilenames.add(filename);
         } catch (err) {
           log2(`[restart-context] ${codeName}: hint write failed for ${filename}: ${err.message}`);
@@ -14410,7 +14640,7 @@ async function runDangerousRmBackstop(agentId, codeName, pane) {
       return;
     }
     const policy = readRmPolicyText(
-      () => readFileSync34(join43(getFramework("claude-code").getAgentDir(codeName), RM_POLICY_RELATIVE_PATH), "utf-8")
+      () => readFileSync34(join44(getFramework("claude-code").getAgentDir(codeName), RM_POLICY_RELATIVE_PATH), "utf-8")
     );
     const decision = decideDangerousRm(action.prompt, policy, {
       isolated: isolationMode(codeName) === "docker"
@@ -15131,7 +15361,7 @@ var pendingDayRolloverReset = /* @__PURE__ */ new Set();
 var dayRolloverInboundHold = /* @__PURE__ */ new Map();
 var INBOUND_HOLD_EPISODE_GAP_MS = 12e4;
 async function channelInboundActivityAgeSecondsFor(codeName) {
-  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-OGZ6ADVR.js");
+  const { newestPendingInboundActivityMtimeMs } = await import("../responsiveness-probe-ZT6ITMYI.js");
   const newest = newestPendingInboundActivityMtimeMs(dirname11(paneLogPath(codeName)));
   if (newest === null) return null;
   return Math.max(0, Math.floor((Date.now() - newest) / 1e3));
@@ -15328,7 +15558,7 @@ function performLazyDayRolloverReset(codeName, agentTimezone) {
 }
 function paneLogAgeSecondsFor(codeName) {
   try {
-    const mtimeMs = statSync14(paneLogPath(codeName)).mtimeMs;
+    const mtimeMs = statSync15(paneLogPath(codeName)).mtimeMs;
     return Math.max(0, Math.floor((Date.now() - mtimeMs) / 1e3));
   } catch (err) {
     if (err?.code === "ENOENT") return null;
@@ -15500,7 +15730,7 @@ var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 var sessionLaunchManagedStructure = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
-    const raw = readFileSync34(join43(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync34(join44(projectDir, ".mcp.json"), "utf-8");
     return createHash20("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
@@ -15508,7 +15738,7 @@ function projectMcpHash(_codeName, projectDir) {
 }
 function projectMcpKeys(_codeName, projectDir) {
   try {
-    const raw = readFileSync34(join43(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync34(join44(projectDir, ".mcp.json"), "utf-8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers;
     if (!servers || typeof servers !== "object") return /* @__PURE__ */ new Set();
@@ -15526,7 +15756,7 @@ function seedSessionLaunchBaselines(codeName, projectDir) {
   else runningMcpServerKeys.delete(codeName);
   let launchStructure = null;
   try {
-    const raw = readFileSync34(join43(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync34(join44(projectDir, ".mcp.json"), "utf-8");
     launchStructure = managedMcpStructureHashFromFile(
       JSON.parse(raw),
       isManagedMcpServerKey
@@ -15663,7 +15893,7 @@ async function runAgentSessionToolBindProbes(agent, integrations, projectDir, op
   if (result && result.rebindCandidates.length > 0 && hostFlagStore().getBoolean("session-tool-rebind")) {
     let mcpJsonForRebind = null;
     try {
-      mcpJsonForRebind = JSON.parse(readFileSync34(join43(projectDir, ".mcp.json"), "utf-8"));
+      mcpJsonForRebind = JSON.parse(readFileSync34(join44(projectDir, ".mcp.json"), "utf-8"));
     } catch {
       mcpJsonForRebind = null;
     }
@@ -15812,7 +16042,7 @@ function shouldInjectChannelSecrets(agentId) {
 function projectChannelSecretHash(projectDir) {
   try {
     const entries = parseEnvIntegrations(
-      readFileSync34(join43(projectDir, ".env.integrations"), "utf-8")
+      readFileSync34(join44(projectDir, ".env.integrations"), "utf-8")
     );
     return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
   } catch {
@@ -15928,7 +16158,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.1177" : "dev";
+var agtCliVersion = true ? "0.28.1179" : "dev";
 function resolveBrewPath(execFileSync3) {
   try {
     const out = execFileSync3("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -16171,6 +16401,82 @@ async function diskNodeVersion() {
 }
 var hostNodeObservation = null;
 var hostNodeObservedAt = 0;
+var lastKeyRotationHandled = null;
+var pendingKeyRotationAck = null;
+function setPendingKeyRotationAck(next) {
+  const prevMemory = pendingKeyRotationAck;
+  const prevState = state9.pendingKeyRotationAck ?? null;
+  pendingKeyRotationAck = next?.prefix ?? null;
+  state9.pendingKeyRotationAck = next;
+  try {
+    atomicWriteFileSync(getStateFile(), JSON.stringify(state9, null, 2));
+    return true;
+  } catch (err) {
+    log(`[key-rotation] could not persist the pending ack: ${err.message}`);
+    if (next !== null) {
+      pendingKeyRotationAck = prevMemory;
+      state9.pendingKeyRotationAck = prevState;
+      return false;
+    }
+    return true;
+  }
+}
+var keyRotationRetryAfter = 0;
+var KEY_ROTATION_RETRY_MS = 5 * 6e4;
+var heldRotatedKey = null;
+function persistRotatedHostKey(rawKey) {
+  const apiUrl = process.env["AGT_HOST"]?.trim();
+  if (!apiUrl) {
+    log("[key-rotation] AGT_HOST is not set, so the env channels cannot be rewritten");
+    return false;
+  }
+  const consoleUrl = process.env["AGT_CONSOLE_URL"] ?? readEtcEnvironmentValue("AGT_CONSOLE_URL");
+  let supervisor;
+  try {
+    supervisor = rewriteSupervisorApiKey(rawKey, void 0, getApiKey() ?? void 0);
+  } catch (err) {
+    log(`[key-rotation] supervisor env rewrite threw: ${err?.message ?? String(err)}`);
+    return false;
+  }
+  for (const path of supervisor.rewritten) {
+    log(`[key-rotation] rewrote AGT_API_KEY in ${path}`);
+  }
+  for (const f of supervisor.failed) {
+    log(`[key-rotation] ${f.path} holds AGT_API_KEY and could NOT be rewritten: ${f.error}`);
+  }
+  for (const path of supervisor.rolledBack ?? []) {
+    log(`[key-rotation] put ${path} back to the running key, because another channel failed`);
+  }
+  if (supervisor.failed.length > 0) {
+    log(
+      `[key-rotation] ${supervisor.failed.length} supervisor channel(s) would still hand out the OUTGOING key - the rotation is abandoned, not acked, so that key keeps working. Retrying after the backoff.`
+    );
+    return false;
+  }
+  if (supervisor.rewritten.length > 0) {
+    let wroteEtcEnvironment = false;
+    try {
+      wroteEtcEnvironment = writeEtcEnvironment(apiUrl, rawKey, consoleUrl);
+    } catch (err) {
+      log(`[key-rotation] /etc/environment write threw: ${err?.message ?? String(err)}`);
+    }
+    try {
+      if (!writeProfileDScript(apiUrl, rawKey, consoleUrl)) {
+        log("[key-rotation] /etc/profile.d/agt.sh was not written; it is read by login shells, not by the manager");
+      }
+    } catch (err) {
+      log(`[key-rotation] /etc/profile.d write threw (non-fatal): ${err?.message ?? String(err)}`);
+    }
+    if (!wroteEtcEnvironment) {
+      log("[key-rotation] /etc/environment was not rewritten; the supervisor channel has the new key, so a restart is safe, but an SSM session and a re-bootstrap will read the old one");
+    }
+    return true;
+  }
+  log(
+    `[key-rotation] no supervisor env channel holds AGT_API_KEY (${supervisor.keyless.length > 0 ? `present but keyless: ${supervisor.keyless.join(", ")}` : "none installed"}) - nothing would hand the new key to the next manager start, so the rotation is abandoned, not acked`
+  );
+  return false;
+}
 function invalidateHostNodeObservation(pathVersion) {
   hostNodeObservedAt = 0;
   if (pathVersion !== void 0 && hostNodeObservation) {
@@ -16412,7 +16718,7 @@ function runAsync(cmd, args, opts) {
   });
 }
 function claudeManagedSettingsPath() {
-  return join43(CLAUDE_MANAGED_SETTINGS_DIR, "managed-settings.json");
+  return join44(CLAUDE_MANAGED_SETTINGS_DIR, "managed-settings.json");
 }
 var MANAGED_SETTINGS_KEYS = ["channelsEnabled", "enableAllProjectMcpServers"];
 var MANAGED_SETTINGS_ENV = { DISABLE_AUTOUPDATER: "1" };
@@ -16490,7 +16796,7 @@ async function ensureOpencodeBinary() {
   try {
     const prefix = execFileSync3("npm", ["prefix", "-g"], { encoding: "utf-8", timeout: 1e4 }).trim();
     if (prefix) {
-      const npmBin = join43(prefix, "bin");
+      const npmBin = join44(prefix, "bin");
       const current = (process.env.PATH ?? "").split(pathDelimiter);
       if (!current.includes(npmBin)) {
         process.env.PATH = [npmBin, ...current.filter(Boolean)].join(pathDelimiter);
@@ -16630,7 +16936,7 @@ async function maybeUpgradeClaudeCode() {
 }
 var UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function selfUpdateAppliedMarkerPath() {
-  return join43(homedir17(), ".augmented", ".last-self-update-applied");
+  return join44(homedir17(), ".augmented", ".last-self-update-applied");
 }
 var selfUpdateUpToDateLogged = false;
 var selfUpdatePinnedLogged = false;
@@ -16681,7 +16987,7 @@ async function checkAndUpdateCli(opts) {
     const isNpmGlobal = !isBrewFormula && resolvedPath.includes("node_modules");
     if (!isBrewFormula && !isNpmGlobal) return "noop";
     const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
-    const markerPath = join43(homedir17(), ".augmented", ".last-update-check");
+    const markerPath = join44(homedir17(), ".augmented", ".last-update-check");
     if (!force) {
       try {
         const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
@@ -17185,12 +17491,12 @@ async function checkClaudeAuth() {
 var evalEmptyMcpConfigPath = null;
 function ensureEvalEmptyMcpConfig() {
   if (evalEmptyMcpConfigPath && existsSync19(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
-  const dir = join43(homedir17(), ".augmented");
+  const dir = join44(homedir17(), ".augmented");
   try {
     mkdirSync16(dir, { recursive: true });
   } catch {
   }
-  const p = join43(dir, ".eval-empty-mcp.json");
+  const p = join44(dir, ".eval-empty-mcp.json");
   writeFileSync18(p, JSON.stringify({ mcpServers: {} }));
   evalEmptyMcpConfigPath = p;
   return p;
@@ -17281,10 +17587,10 @@ function resolveConversationEvalBackend() {
   return conversationEvalBackend;
 }
 function getStateFile() {
-  return join43(config?.configDir ?? join43(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
+  return join44(config?.configDir ?? join44(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
 }
 function channelHashCacheDir() {
-  return config?.configDir ?? join43(process.env["HOME"] ?? "/tmp", ".augmented");
+  return config?.configDir ?? join44(process.env["HOME"] ?? "/tmp", ".augmented");
 }
 function loadChannelHashCache2() {
   loadChannelHashCache(agentState.knownChannelConfigHashes, channelHashCacheDir());
@@ -17497,7 +17803,7 @@ function removeDeliveryBaselineEntries(agentId) {
 var _channelQuarantineStore = null;
 function channelQuarantineStore() {
   if (!_channelQuarantineStore) {
-    const dir = config?.configDir ?? join43(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join44(process.env["HOME"] ?? "/tmp", ".augmented");
     _channelQuarantineStore = new ChannelQuarantineStore(defaultQuarantinePath(dir));
   }
   return _channelQuarantineStore;
@@ -17505,7 +17811,7 @@ function channelQuarantineStore() {
 var _channelResumeHistoryStore = null;
 function channelResumeHistoryStore() {
   if (!_channelResumeHistoryStore) {
-    const dir = config?.configDir ?? join43(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join44(process.env["HOME"] ?? "/tmp", ".augmented");
     _channelResumeHistoryStore = new ChannelResumeHistoryStore(defaultResumeHistoryPath(dir));
   }
   return _channelResumeHistoryStore;
@@ -17530,14 +17836,24 @@ function claudeMdSizeFor(codeName) {
   logClaudeMdGraftTransition(codeName, report, log);
   return report;
 }
+function sessionActivityFor(codeName, pane) {
+  return buildSessionActivityReport({
+    codeName,
+    transcriptDir: sessionTranscriptDir(getProjectDir(codeName)),
+    sessionId: getSessionState(codeName)?.currentSessionId ?? null,
+    tmuxAlive: pane.tmuxAlive,
+    screenCapture: pane.screenCapture,
+    log: (msg) => console.error(msg)
+  });
+}
 function forwardedToolsFor(codeName) {
   if (!config?.configDir) return null;
-  return readForwardedToolsReport(join43(config.configDir, codeName));
+  return readForwardedToolsReport(join44(config.configDir, codeName));
 }
 var _hostFlagStore = null;
 function hostFlagStore() {
   if (!_hostFlagStore) {
-    const dir = config?.configDir ?? join43(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join44(process.env["HOME"] ?? "/tmp", ".augmented");
     _hostFlagStore = new HostFlagStore({ cachePath: defaultFlagsCachePath(dir), log });
   }
   return _hostFlagStore;
@@ -17610,13 +17926,13 @@ function parseSkillFrontmatter(content) {
   return out;
 }
 async function refreshSkillsIndexInClaudeMd(configDir, codeName, log2) {
-  const { readdirSync: readdirSync14, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync19 } = await import("fs");
-  const skillsDir = join43(configDir, codeName, "project", ".claude", "skills");
-  const claudeMdPath = join43(configDir, codeName, "project", "CLAUDE.md");
+  const { readdirSync: readdirSync15, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync19 } = await import("fs");
+  const skillsDir = join44(configDir, codeName, "project", ".claude", "skills");
+  const claudeMdPath = join44(configDir, codeName, "project", "CLAUDE.md");
   if (!ex(skillsDir) || !ex(claudeMdPath)) return;
   const entries = [];
-  for (const dir of readdirSync14(skillsDir).sort()) {
-    const skillFile = join43(skillsDir, dir, "SKILL.md");
+  for (const dir of readdirSync15(skillsDir).sort()) {
+    const skillFile = join44(skillsDir, dir, "SKILL.md");
     if (!ex(skillFile)) continue;
     try {
       const { name, description } = parseSkillFrontmatter(rfs(skillFile, "utf-8"));
@@ -17740,10 +18056,10 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-HVYGIS5C.js");
+      const { collectDiagnostics } = await import("../persistent-session-34QXCPJK.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
-        agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
+        agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor)
       });
     } catch (err) {
       log(`[restart] post-respawn diagnostics flush failed: ${err.message}`);
@@ -17883,9 +18199,9 @@ async function pollCycleInner() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-KQYYZZVW.js");
-      const { collectDiagnostics } = await import("../persistent-session-HVYGIS5C.js");
+      const { collectDiagnostics } = await import("../persistent-session-34QXCPJK.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
-      const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor) : void 0;
+      const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor) : void 0;
       let tailscaleHostname;
       try {
         const { execSync: es } = await import("child_process");
@@ -17963,6 +18279,14 @@ async function pollCycleInner() {
           hostNodePin,
           hostNodePin ? hostNodeConvergence.stateOf(hostNodePin) : null
         ),
+        // ENG-11642: ack a rotated key. Carries the PREFIX, never the key.
+        //
+        // Sent on this authenticated heartbeat on purpose: by the time it goes
+        // out the request is already signed with the NEW key, so the ack and
+        // "the new key works" are the same fact rather than two claims. The API
+        // treats this as permission to expire the outgoing key, so it must not
+        // be possible to ack with a key that cannot authenticate.
+        ...pendingKeyRotationAck ? { key_rotation_adopted_prefix: pendingKeyRotationAck } : {},
         agent_diagnostics: agentDiagnostics,
         hostname: tailscaleHostname,
         os_username: osUsername,
@@ -18085,9 +18409,52 @@ async function pollCycleInner() {
       hostFlagStore().applyNotifyDispatchByAgent(hbResp?.notify_dispatch_by_agent);
       hostFlagStore().applyBooleanFlagsByAgent(hbResp?.feature_flags_by_agent);
       setConfigHash(hbResp?.config_hash ?? null);
+      const ackDecision = nextPendingAck(pendingKeyRotationAck, hbResp);
+      if (ackDecision.log) log(ackDecision.log);
+      if (pendingKeyRotationAck !== null && ackDecision.pending === null) {
+        setPendingKeyRotationAck(null);
+      }
+      const rotationRequestedAt = hbResp?.key_rotation_requested_at ?? null;
+      if (shouldMintReplacementKey(rotationRequestedAt) && !alreadyHandledRotationRequest(rotationRequestedAt, lastKeyRotationHandled) && Date.now() >= keyRotationRetryAfter) {
+        const outcome = await adoptRotatedHostKey({
+          mint: async () => {
+            const current = getApiKey();
+            if (!current) return null;
+            return mintRotatedHostKey(current);
+          },
+          preflightPersist: () => supervisorChannelsRefusing(void 0, {
+            runningKeys: [
+              getApiKey() ?? "",
+              ...heldRotatedKey && heldRotatedKey.requestedAt === rotationRequestedAt ? [heldRotatedKey.minted.rawKey] : []
+            ]
+          }),
+          held: heldRotatedKey && heldRotatedKey.requestedAt === rotationRequestedAt ? heldRotatedKey.minted : void 0,
+          persist: (rawKey) => persistRotatedHostKey(rawKey),
+          onPersisted: (prefix) => rotationRequestedAt ? setPendingKeyRotationAck({ prefix, requestedAt: rotationRequestedAt }) : true,
+          adoptInProcess: (rawKey) => adoptHostKeyInProcess(rawKey),
+          log
+        });
+        if (outcome.status === "error" && outcome.held && pendingKeyRotationAck === outcome.held.prefix) {
+          setPendingKeyRotationAck(null);
+        }
+        heldRotatedKey = (outcome.status === "persist-failed" || outcome.status === "error" || outcome.status === "persist-refused") && outcome.held && rotationRequestedAt ? { requestedAt: rotationRequestedAt, minted: outcome.held } : null;
+        if (outcome.status === "mint-refused") {
+          lastKeyRotationHandled = rotationRequestedAt;
+        } else if (outcome.status === "adopted") {
+          lastKeyRotationHandled = rotationRequestedAt;
+          setPendingKeyRotationAck(
+            rotationRequestedAt ? { prefix: outcome.prefix, requestedAt: rotationRequestedAt } : null
+          );
+        } else {
+          keyRotationRetryAfter = Date.now() + KEY_ROTATION_RETRY_MS;
+          log(
+            `[key-rotation] attempt did not complete (${outcome.status}); retrying after ${Math.round(KEY_ROTATION_RETRY_MS / 6e4)}m. The current key stays in force.`
+          );
+        }
+      }
       try {
         const desiredClaudeCodeVersion = hbResp?.desired_claude_code_version?.trim();
-        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-H7RNX6M7.js");
+        const { maybeUpdateClaudeCode, shouldRunClaudeCodeUpdater } = await import("../claude-code-updater-LL7KVAU3.js");
         const securityFloor = currentSecurityFloor();
         claudeUpdaterInFlight = true;
         if (desiredClaudeCodeVersion && (claudePairLoop.busy || claudePairingInProgress())) {
@@ -18122,7 +18489,7 @@ async function pollCycleInner() {
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs,
         occupancyQualificationClassifications
-      } = await import("../responsiveness-probe-OGZ6ADVR.js");
+      } = await import("../responsiveness-probe-ZT6ITMYI.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -18239,7 +18606,7 @@ async function pollCycleInner() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-OGZ6ADVR.js");
+        } = await import("../responsiveness-probe-ZT6ITMYI.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-M6AFZWNU.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -18331,10 +18698,10 @@ async function pollCycleInner() {
                 const paneTail = readFileSync34(paneLogPath(codeName), "utf8").slice(-65536);
                 const transient = detectTransientApiErrorInLog(paneTail);
                 if (transient) {
-                  const wedgeHome = join43(homedir17(), ".augmented", codeName);
+                  const wedgeHome = join44(homedir17(), ".augmented", codeName);
                   if (existsSync19(wedgeHome)) {
                     atomicWriteFileSync(
-                      join43(wedgeHome, "watchdog-give-up.json"),
+                      join44(wedgeHome, "watchdog-give-up.json"),
                       JSON.stringify({
                         gave_up_at: wedgeNow.toISOString(),
                         reason: "transient_overload"
@@ -18396,7 +18763,7 @@ async function pollCycleInner() {
     try {
       const {
         AlertHeartbeat,
-        classifyPane,
+        classifyPane: classifyPane2,
         decidePaneFatalAction,
         pruneRestartHistory,
         resolvePaneFatalConfig
@@ -18439,7 +18806,7 @@ async function pollCycleInner() {
           } catch {
             pane = null;
           }
-          const verdict = classifyPane(pane);
+          const verdict = classifyPane2(pane);
           const kind = verdict.kind;
           if (!verdict.transcriptBanner) bannerBeat.clear(codeName);
           if (kind === null) {
@@ -18525,7 +18892,7 @@ async function pollCycleInner() {
                 }
               }
             );
-            const { parkPendingInbound } = await import("../responsiveness-probe-OGZ6ADVR.js");
+            const { parkPendingInbound } = await import("../responsiveness-probe-ZT6ITMYI.js");
             const { parked, deadLettered } = parkPendingInbound(codeName, new Date(fatalNowMs));
             paneFatalStreak.delete(codeName);
             paneFatalRestarts.set(codeName, [...history, fatalNowMs]);
@@ -18556,7 +18923,7 @@ async function pollCycleInner() {
         TRANSCRIPT_MOUNT_ESCALATION_REFRESH_MS,
         bindSourceEscalations
       } = await import("../transcript-mount-health-OHE6IVJV.js");
-      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-HVYGIS5C.js");
+      const { transcriptBindSourcesFor, ensureTranscriptBindSources } = await import("../persistent-session-34QXCPJK.js");
       const mountConfig = resolveTranscriptMountConfig();
       const liveAgents = agentState.persistentSessionAgents;
       for (const tracked of [
@@ -18625,7 +18992,7 @@ async function pollCycleInner() {
               { containerPath: src.projects, hostPath: src.mask },
               { containerPath: src.own, hostPath: src.own }
             ],
-            stat: (path) => statSync14(path)
+            stat: (path) => statSync15(path)
           });
           if (verdict.state !== "orphaned") {
             transcriptMountStreak.delete(codeName);
@@ -18721,7 +19088,7 @@ async function pollCycleInner() {
     }
     try {
       const { scrapeMcpFailedBannerCount } = await import("../pane-mcp-banner-scraper-VR5QGP3J.js");
-      const { probeSessionAuth } = await import("../session-auth-dead-2JJLKURE.js");
+      const { probeSessionAuth } = await import("../session-auth-dead-KAHV2ES2.js");
       const observations = [];
       const pendingCacheCommits = [];
       const modelApiErrorReportingOn = hostFlagStore().getBoolean("model-api-error-reporting");
@@ -19226,7 +19593,7 @@ async function pollCycleInner() {
             `[drain-flush] FAILED for '${prev.codeName}': ${err.message} \u2014 proceeding to teardown; this session was NOT shipped (ENG-9491)`
           );
         }
-        const agentDir = join43(adapter.getAgentDir(prev.codeName), "provision");
+        const agentDir = join44(adapter.getAgentDir(prev.codeName), "provision");
         await cleanupAgentFiles(prev.codeName, agentDir);
         clearAgentCaches(prev.agentId, prev.codeName);
       }
@@ -19305,10 +19672,10 @@ async function pollCycleInner() {
         // pending-inbound marker. Best-effort: a write failure is logged by
         // the watchdog, never fails the poll cycle.
         signalGiveUp: (codeName) => {
-          const dir = join43(homedir17(), ".augmented", codeName);
+          const dir = join44(homedir17(), ".augmented", codeName);
           if (!existsSync19(dir)) return;
           atomicWriteFileSync(
-            join43(dir, "watchdog-give-up.json"),
+            join44(dir, "watchdog-give-up.json"),
             JSON.stringify({ gave_up_at: (/* @__PURE__ */ new Date()).toISOString() })
           );
         },
@@ -19336,17 +19703,17 @@ async function pollCycleInner() {
           const dir = getFramework("claude-code").getAgentDir(codeName);
           if (!existsSync19(dir)) return;
           atomicWriteFileSync(
-            join43(dir, "blocked-prompt.json"),
+            join44(dir, "blocked-prompt.json"),
             JSON.stringify({ kind, last_seen_at: (/* @__PURE__ */ new Date()).toISOString() })
           );
         },
         clearBlockedPromptLiveness: (codeName) => {
-          const file = join43(getFramework("claude-code").getAgentDir(codeName), "blocked-prompt.json");
+          const file = join44(getFramework("claude-code").getAgentDir(codeName), "blocked-prompt.json");
           if (existsSync19(file)) rmSync8(file, { force: true });
         },
         refreshUsageLimitLiveness: (codeName) => {
           const dir = getFramework("claude-code").getAgentDir(codeName);
-          const file = join43(dir, "watchdog-give-up.json");
+          const file = join44(dir, "watchdog-give-up.json");
           if (!existsSync19(file)) return;
           try {
             const raw = JSON.parse(readFileSync34(file, "utf8"));
@@ -19360,7 +19727,7 @@ async function pollCycleInner() {
           const dir = getFramework("claude-code").getAgentDir(codeName);
           if (!existsSync19(dir)) return;
           atomicWriteFileSync(
-            join43(dir, "watchdog-give-up.json"),
+            join44(dir, "watchdog-give-up.json"),
             JSON.stringify({
               gave_up_at: (/* @__PURE__ */ new Date()).toISOString(),
               reason: "usage_limit",
@@ -19635,7 +20002,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const adapter = resolveAgentFramework(agent.code_name);
-  let agentDir = join43(adapter.getAgentDir(agent.code_name), "provision");
+  let agentDir = join44(adapter.getAgentDir(agent.code_name), "provision");
   if (agent.status === "draft" || agent.status === "paused") {
     forgetChannelSyncState(agent.agent_id);
     reapLegacyTokenFileEdgeWarned(agent.code_name, log);
@@ -19783,7 +20150,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       if (refreshData.knowledge_manifest) {
         const resolved = await resolveKnowledgeFromManifest({
           manifest: refreshData.knowledge_manifest,
-          cacheDir: join43(config.configDir, "_knowledge"),
+          cacheDir: join44(config.configDir, "_knowledge"),
           delivery: refreshData.agent?.knowledge_delivery ?? "both",
           fetchContents: async (hashes) => {
             const res = await api.post(
@@ -19800,7 +20167,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         const resolvedSkills = await resolveSkillsFromManifest({
           globals: refreshData.global_skills_manifest ?? [],
           shared: refreshData.shared_skills_manifest ?? [],
-          cacheDir: join43(config.configDir, "_skills"),
+          cacheDir: join44(config.configDir, "_skills"),
           fetchContents: async (hashes) => {
             const res = await api.post(
               "/host/skills/contents",
@@ -19818,7 +20185,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       if (refreshData.integration_skills_manifest) {
         const resolvedIntegrationSkills = await resolveIntegrationSkillsFromManifest({
           manifest: refreshData.integration_skills_manifest,
-          cacheDir: join43(config.configDir, "_skills"),
+          cacheDir: join44(config.configDir, "_skills"),
           fetchContents: async (hashes) => {
             const res = await api.post(
               "/host/skills/contents",
@@ -19880,7 +20247,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
   const frameworkId = refreshData.agent.framework ?? DEFAULT_FRAMEWORK;
   agentFrameworkCache.set(agent.code_name, frameworkId);
   const frameworkAdapter = getFramework(frameworkId);
-  agentDir = join43(frameworkAdapter.getAgentDir(agent.code_name), "provision");
+  agentDir = join44(frameworkAdapter.getAgentDir(agent.code_name), "provision");
   cacheAgentDeliveryMetadata(agent.code_name, refreshData);
   agentRestartTimezoneInputs.set(agent.code_name, {
     agentTimezone: typeof refreshData.agent.timezone === "string" ? refreshData.agent.timezone : null,
@@ -19939,7 +20306,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
     const changedFiles = [];
     mkdirSync16(agentDir, { recursive: true });
     for (const artifact of artifacts) {
-      const filePath = join43(agentDir, artifact.relativePath);
+      const filePath = join44(agentDir, artifact.relativePath);
       let existingHash;
       let newHash;
       let writeContent = artifact.content;
@@ -19958,7 +20325,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         };
         newHash = sha256(stripDynamicSections(artifact.content));
         try {
-          const projectClaudeMd = join43(config.configDir, agent.code_name, "project", "CLAUDE.md");
+          const projectClaudeMd = join44(config.configDir, agent.code_name, "project", "CLAUDE.md");
           const existing = readFileSync34(projectClaudeMd, "utf-8");
           existingHash = sha256(stripDynamicSections(existing));
         } catch {
@@ -20009,12 +20376,12 @@ async function processAgent(agent, agentStates, managedToolkits) {
       }
     }
     if (changedFiles.length > 0) {
-      const isFirst = !existsSync19(join43(agentDir, "CHARTER.md"));
+      const isFirst = !existsSync19(join44(agentDir, "CHARTER.md"));
       const verb = isFirst ? "Provisioning" : "Updating";
       const fileNames = changedFiles.map((f) => f.relativePath).join(", ");
       log(`${verb} '${agent.code_name}': ${fileNames}`);
       for (const file of changedFiles) {
-        const filePath = join43(agentDir, file.relativePath);
+        const filePath = join44(agentDir, file.relativePath);
         mkdirSync16(dirname11(filePath), { recursive: true });
         if (file.relativePath === ".mcp.json") {
           safeWriteJsonAtomic(filePath, file.content, { mode: 384 });
@@ -20023,12 +20390,12 @@ async function processAgent(agent, agentStates, managedToolkits) {
         }
       }
       try {
-        const provSkillsDir = join43(agentDir, ".claude", "skills");
+        const provSkillsDir = join44(agentDir, ".claude", "skills");
         if (existsSync19(provSkillsDir)) {
-          for (const folder of readdirSync13(provSkillsDir)) {
+          for (const folder of readdirSync14(provSkillsDir)) {
             if (folder.startsWith("knowledge-")) {
               try {
-                rmSync8(join43(provSkillsDir, folder), { recursive: true });
+                rmSync8(join44(provSkillsDir, folder), { recursive: true });
               } catch {
               }
             }
@@ -20041,7 +20408,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       const trackedFiles2 = frameworkAdapter.driftTrackedFiles();
       const hashes = /* @__PURE__ */ new Map();
       for (const file of trackedFiles2) {
-        const h = hashFile(join43(agentDir, file));
+        const h = hashFile(join44(agentDir, file));
         if (h) hashes.set(file, h);
       }
       agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -20059,14 +20426,14 @@ async function processAgent(agent, agentStates, managedToolkits) {
     }
     if (Array.isArray(refreshData.workflows)) {
       try {
-        const provWorkflowsDir = join43(agentDir, ".claude", "workflows");
+        const provWorkflowsDir = join44(agentDir, ".claude", "workflows");
         if (existsSync19(provWorkflowsDir)) {
           const expected = new Set(refreshData.workflows.map((w) => `${w.name}.js`));
-          for (const file of readdirSync13(provWorkflowsDir)) {
+          for (const file of readdirSync14(provWorkflowsDir)) {
             if (!file.endsWith(".js")) continue;
             if (expected.has(file)) continue;
             try {
-              rmSync8(join43(provWorkflowsDir, file));
+              rmSync8(join44(provWorkflowsDir, file));
             } catch {
             }
           }
@@ -20148,7 +20515,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
   if (written && existsSync19(agentDir)) {
     const driftedFiles = [];
     for (const [file, expectedHash] of written) {
-      const localHash = hashFile(join43(agentDir, file));
+      const localHash = hashFile(join44(agentDir, file));
       if (localHash && localHash !== expectedHash) {
         driftedFiles.push(file);
       }
@@ -20159,7 +20526,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       try {
         const localHashes = {};
         for (const file of driftedFiles) {
-          localHashes[file] = hashFile(join43(agentDir, file));
+          localHashes[file] = hashFile(join44(agentDir, file));
         }
         await api.post("/host/drift", {
           agent_id: agent.agent_id,
@@ -20444,7 +20811,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
     const addedChannels = [...restartDecision.added];
     const writeDmNoticeMarkers = isChannelAddRestart ? () => {
       try {
-        const agentAugmentedDir = join43(homedir17(), ".augmented", agent.code_name);
+        const agentAugmentedDir = join44(homedir17(), ".augmented", agent.code_name);
         mkdirSync16(agentAugmentedDir, { recursive: true });
         const markerJson = JSON.stringify({
           version: 1,
@@ -20452,7 +20819,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
           added: addedChannels
         });
         for (const file of ["slack-channel-add-restart.json", "telegram-channel-add-restart.json"]) {
-          atomicWriteFileSync(join43(agentAugmentedDir, file), markerJson);
+          atomicWriteFileSync(join44(agentAugmentedDir, file), markerJson);
         }
       } catch (err) {
         log(`[hot-reload] channel-add DM-notice marker write failed for '${agent.code_name}' (non-fatal): ${err.message}`);
@@ -20751,18 +21118,18 @@ async function processAgent(agent, agentStates, managedToolkits) {
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? DEFAULT_FRAMEWORK) === "claude-code") {
     try {
       const agentProvisionDir = agentDir;
-      const projectDir = join43(homedir17(), ".augmented", agent.code_name, "project");
+      const projectDir = join44(homedir17(), ".augmented", agent.code_name, "project");
       mkdirSync16(agentProvisionDir, { recursive: true });
       mkdirSync16(projectDir, { recursive: true });
-      const provisionMcpPath = join43(agentProvisionDir, ".mcp.json");
-      const projectMcpPath = join43(projectDir, ".mcp.json");
+      const provisionMcpPath = join44(agentProvisionDir, ".mcp.json");
+      const projectMcpPath = join44(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
       try {
         mcpConfig = JSON.parse(readFileSync34(provisionMcpPath, "utf-8"));
         if (!mcpConfig.mcpServers) mcpConfig.mcpServers = {};
       } catch {
       }
-      const localDirectChatChannel = join43(homedir17(), ".augmented", "_mcp", "direct-chat-channel.js");
+      const localDirectChatChannel = join44(homedir17(), ".augmented", "_mcp", "direct-chat-channel.js");
       const directChatTeamSettings = refreshData.team?.settings;
       const directChatTz = (() => {
         const tz = directChatTeamSettings?.["timezone"];
@@ -20788,7 +21155,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
           // ~/.augmented/<codeName>/.current-turn-initiator.json. Note getAgentDir
           // returns the agent root (NOT the /provision subdir `agentDir` points at),
           // so it byte-matches the broker readers' path.
-          AGT_TURN_INITIATOR_FILE: join43(
+          AGT_TURN_INITIATOR_FILE: join44(
             frameworkAdapter.getAgentDir(agent.code_name),
             ".current-turn-initiator.json"
           )
@@ -20808,7 +21175,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
           log(`Channel credentials written for '${agent.code_name}/direct-chat'`);
         }
       }
-      const staleChannelsPath = join43(projectDir, ".mcp-channels.json");
+      const staleChannelsPath = join44(projectDir, ".mcp-channels.json");
       if (existsSync19(staleChannelsPath)) {
         try {
           rmSync8(staleChannelsPath, { force: true });
@@ -20918,7 +21285,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
     }
     if (hostFlagStore().getBoolean("connectivity-probe")) {
       try {
-        const probeProjectDir = join43(homedir17(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join44(homedir17(), ".augmented", agent.code_name, "project");
         let probeSet = integrations;
         const fetchQuarantined = async () => {
           const quarantined = await api.post("/host/agent-integrations/quarantined", { agent_id: agent.agent_id });
@@ -20978,7 +21345,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
       const forceDue = attemptsLeft > 0;
       let probeRan = false;
       try {
-        const probeProjectDir = join43(homedir17(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join44(homedir17(), ".augmented", agent.code_name, "project");
         probeRan = await runAgentSessionToolBindProbes(agent, integrations, probeProjectDir, { forceDue });
       } catch (err) {
         log(`Session-tool-bind probe failed for '${agent.code_name}': ${err.message}`);
@@ -21056,8 +21423,8 @@ async function processAgent(agent, agentStates, managedToolkits) {
       const intHash = computeIntegrationsHash(integrations);
       const prevIntHash = agentState.knownIntegrationHashes.get(agent.agent_id);
       if (intHash !== prevIntHash) {
-        const projectDir = join43(homedir17(), ".augmented", agent.code_name, "project");
-        const envIntPath = join43(projectDir, ".env.integrations");
+        const projectDir = join44(homedir17(), ".augmented", agent.code_name, "project");
+        const envIntPath = join44(projectDir, ".env.integrations");
         let preWriteEnv;
         try {
           preWriteEnv = readFileSync34(envIntPath, "utf-8");
@@ -21080,7 +21447,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         }
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
-            const projectMcpPath = join43(projectDir, ".mcp.json");
+            const projectMcpPath = join44(projectDir, ".mcp.json");
             const postWriteEnv = readFileSync34(envIntPath, "utf-8");
             const mcpContent = readFileSync34(projectMcpPath, "utf-8");
             const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
@@ -21384,23 +21751,23 @@ async function processAgent(agent, agentStates, managedToolkits) {
         }
       }
       try {
-        const { readdirSync: readdirSync14, rmSync: rmSync9 } = await import("fs");
+        const { readdirSync: readdirSync15, rmSync: rmSync9 } = await import("fs");
         const { homedir: homedir18 } = await import("os");
         const frameworkId2 = frameworkAdapter.id;
         const candidateSkillDirs = [
           // Claude Code — framework runtime tree
-          join43(homedir18(), ".augmented", agent.code_name, "skills"),
+          join44(homedir18(), ".augmented", agent.code_name, "skills"),
           // Claude Code — project tree
-          join43(homedir18(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+          join44(homedir18(), ".augmented", agent.code_name, "project", ".claude", "skills"),
           // Defensive: legacy provision-side path, not currently an
           // install target but cheap to sweep.
-          join43(agentDir, ".claude", "skills")
+          join44(agentDir, ".claude", "skills")
         ];
         const existingDirs = candidateSkillDirs.filter((d) => existsSync19(d));
         const discoveredEntries = /* @__PURE__ */ new Set();
         for (const dir of existingDirs) {
           try {
-            for (const entry of readdirSync14(dir)) {
+            for (const entry of readdirSync15(dir)) {
               if (entry.startsWith("plugin-") || entry.startsWith("integration-")) {
                 discoveredEntries.add(entry);
               }
@@ -21437,7 +21804,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         const sharedSkillsPayload = refreshAny.shared_skills;
         const desiredResolved = globalSkillsPayload !== void 0 || sharedSkillsPayload !== void 0;
         const manifestPath = managedSkillManifestPath(
-          join43(homedir17(), ".augmented", agent.code_name)
+          join44(homedir17(), ".augmented", agent.code_name)
         );
         const prevIds = /* @__PURE__ */ new Set([
           ...agentState.knownGlobalSkillIds.get(agent.agent_id) ?? /* @__PURE__ */ new Set(),
@@ -21457,15 +21824,15 @@ async function processAgent(agent, agentStates, managedToolkits) {
         }
         if (plan.removes.length) {
           const globalSkillDirs = [
-            join43(homedir17(), ".augmented", agent.code_name, "skills"),
-            join43(homedir17(), ".augmented", agent.code_name, "project", ".claude", "skills"),
-            join43(agentDir, ".claude", "skills")
+            join44(homedir17(), ".augmented", agent.code_name, "skills"),
+            join44(homedir17(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+            join44(agentDir, ".claude", "skills")
           ];
           for (const id of plan.removes) {
             let prunedAny = false;
             for (const dir of globalSkillDirs) {
-              const p = join43(dir, id);
-              if (existsSync19(p) && existsSync19(join43(p, "SKILL.md"))) {
+              const p = join44(dir, id);
+              if (existsSync19(p) && existsSync19(join44(p, "SKILL.md"))) {
                 rmSync8(p, { recursive: true, force: true });
                 prunedAny = true;
               }
@@ -21735,7 +22102,7 @@ async function processAgent(agent, agentStates, managedToolkits) {
         const sess = getSessionState(agent.code_name);
         let mcpJsonParsed = null;
         try {
-          const mcpPath = join43(getProjectDir(agent.code_name), ".mcp.json");
+          const mcpPath = join44(getProjectDir(agent.code_name), ".mcp.json");
           mcpJsonParsed = JSON.parse(readFileSync34(mcpPath, "utf-8"));
         } catch {
         }
@@ -22249,7 +22616,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
   if (trackedFiles.length > 0 && existsSync19(agentDir)) {
     const hashes = /* @__PURE__ */ new Map();
     for (const file of trackedFiles) {
-      const h = hashFile(join43(agentDir, file));
+      const h = hashFile(join44(agentDir, file));
       if (h) hashes.set(file, h);
     }
     agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -22264,7 +22631,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
         refreshData.agent.onboarding_state
       );
       const obStep = obState.step;
-      const markerPath = join43(homedir17(), ".augmented", agent.code_name, "onboarding-drive.json");
+      const markerPath = join44(homedir17(), ".augmented", agent.code_name, "onboarding-drive.json");
       const marker = readOnboardingDriveMarker(markerPath);
       const obContactRaw = refreshData.agent.manager_last_contacted_at;
       const obContact = typeof obContactRaw === "string" && obContactRaw ? obContactRaw : null;
@@ -22380,7 +22747,7 @@ async function ensureOpencodeRuntime(agent, refreshData, agentTimezone) {
   }
   stopOpencodeSlackIngest(codeName, log);
   stopOpencodeTelegramIngest(codeName, log);
-  const opencodeProjectDir = join43(getFramework("opencode").getAgentDir(codeName), "provision");
+  const opencodeProjectDir = join44(getFramework("opencode").getAgentDir(codeName), "provision");
   const serveEnv = {
     AGT_HOST: requireHost(),
     AGT_API_KEY: getApiKey() ?? void 0,
@@ -22440,8 +22807,8 @@ async function ensurePersistentSessionUnchecked(agent, tasks, boardItems, refres
     });
   }
   const projectDir = getProjectDir(codeName);
-  const mcpConfigPath = join43(projectDir, ".mcp.json");
-  const claudeMdPath = join43(projectDir, "CLAUDE.md");
+  const mcpConfigPath = join44(projectDir, ".mcp.json");
+  const claudeMdPath = join44(projectDir, "CLAUDE.md");
   if (restartBreaker.isTripped(codeName)) {
     const trip = restartBreaker.getTrip(codeName);
     return {
@@ -23410,7 +23777,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
       try {
         const freshId = rotateSessionForWedge(codeName);
         consecutiveWedgeCycles.delete(codeName);
-        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-OGZ6ADVR.js");
+        const { parkPendingInbound: parkForRestart } = await import("../responsiveness-probe-ZT6ITMYI.js");
         const { parked, deadLettered } = parkForRestart(codeName, /* @__PURE__ */ new Date());
         const parkNote = parked > 0 ? `, ${parked} inbound parked` : "";
         const deadNote = deadLettered > 0 ? `, ${deadLettered} undeliverable dead-lettered` : "";
@@ -23453,10 +23820,10 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-HVYGIS5C.js");
+        const { collectDiagnostics } = await import("../persistent-session-34QXCPJK.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
-          agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
+          agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor)
         });
       } catch (err) {
         log(`[restart-lane] post-respawn diagnostics flush failed for '${codeName}': ${err.message}`);
@@ -23504,10 +23871,10 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-HVYGIS5C.js");
+      const { collectDiagnostics } = await import("../persistent-session-34QXCPJK.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
-        agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor)
+        agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor, spawnOutcomeForDiagnostics, pidPressureFor, forwardedToolsFor, runtimeVersionFor, sessionActivityFor)
       });
     } catch (err) {
       log(`[fast-mcp-respawn] post-respawn diagnostics flush failed for '${codeName}': ${err.message}`);
@@ -24206,7 +24573,7 @@ async function processClaudePairSessions(agents) {
     snapshotPairConfig,
     // ENG-11659: result -> report body + the manager.log line that records it.
     planPairStartReport
-  } = await import("../claude-pair-runtime-53JY6TQX.js");
+  } = await import("../claude-pair-runtime-R5MNSUM7.js");
   const { resetClaudeSignin, describeSigninResetForLog, describeSigninResetFailure } = await import("../claude-signin-reset-6IJMMVYG.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
@@ -24497,10 +24864,10 @@ var lastLocalFileHash = /* @__PURE__ */ new Map();
 var lastMemoriesBody = /* @__PURE__ */ new Map();
 var memoryManifests = /* @__PURE__ */ new Map();
 function memoryRetirementDir(configDir, codeName) {
-  return join43(configDir, "_memory-retirement", codeName);
+  return join44(configDir, "_memory-retirement", codeName);
 }
 function memoryManifestPath(configDir, codeName) {
-  return join43(memoryRetirementDir(configDir, codeName), "manifest.json");
+  return join44(memoryRetirementDir(configDir, codeName), "manifest.json");
 }
 function loadMemoryManifest(agentId, configDir, codeName) {
   const cached = memoryManifests.get(agentId);
@@ -24535,7 +24902,7 @@ function saveMemoryManifest(agentId, configDir, codeName) {
   }
 }
 function retiredMemoryDir(configDir, codeName) {
-  return join43(memoryRetirementDir(configDir, codeName), "retired");
+  return join44(memoryRetirementDir(configDir, codeName), "retired");
 }
 var RETIRED_MEMORY_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var lastRetirementReport = /* @__PURE__ */ new Map();
@@ -24614,7 +24981,7 @@ function applyMemoryTombstones(opts) {
       log2(`[memory-retire] ${agent.code_name}: KEPT '${tomb.name}' \u2014 no write record, not ours to remove`);
       continue;
     }
-    const filePath = join43(memoryDir, entry.file);
+    const filePath = join44(memoryDir, entry.file);
     if (!existsSync19(filePath)) {
       outcomes.already_gone++;
       delete manifest[tomb.name];
@@ -24634,9 +25001,9 @@ function applyMemoryTombstones(opts) {
       const destDir = retiredMemoryDir(configDir, agent.code_name);
       mkdirSync16(destDir, { recursive: true });
       const stamp = Date.now();
-      let dest = join43(destDir, `${entry.file}.${stamp}.retired`);
+      let dest = join44(destDir, `${entry.file}.${stamp}.retired`);
       for (let n = 1; existsSync19(dest); n++) {
-        dest = join43(destDir, `${entry.file}.${stamp}-${n}.retired`);
+        dest = join44(destDir, `${entry.file}.${stamp}-${n}.retired`);
       }
       renameSync11(filePath, dest);
       try {
@@ -24673,11 +25040,11 @@ function reapRetiredMemories(configDir, codeName, log2) {
   const cutoff = Date.now() - RETIRED_MEMORY_TTL_MS;
   let reaped = 0;
   try {
-    for (const file of readdirSync13(dir)) {
+    for (const file of readdirSync14(dir)) {
       if (!file.endsWith(".retired")) continue;
-      const path = join43(dir, file);
+      const path = join44(dir, file);
       try {
-        if (statSync14(path).mtimeMs < cutoff) {
+        if (statSync15(path).mtimeMs < cutoff) {
           unlinkSync6(path);
           reaped++;
         }
@@ -24690,8 +25057,8 @@ function reapRetiredMemories(configDir, codeName, log2) {
   if (reaped > 0) log2(`[memory-retire] ${codeName}: reaped ${reaped} retired memory file(s) past TTL`);
 }
 async function syncMemories(agent, configDir, log2) {
-  const projectDir = join43(configDir, agent.code_name, "project");
-  const memoryDir = join43(projectDir, "memory");
+  const projectDir = join44(configDir, agent.code_name, "project");
+  const memoryDir = join44(projectDir, "memory");
   const isFreshSync = pendingFreshMemorySync.has(agent.agent_id);
   if (isFreshSync) {
     log2(`[memory-sync] Fresh-sync requested for '${agent.code_name}' \u2014 pulling DB first`);
@@ -24719,10 +25086,10 @@ async function syncMemories(agent, configDir, log2) {
     const prevHashes = memoryFileHashes.get(agent.agent_id) ?? /* @__PURE__ */ new Map();
     const currentHashes = /* @__PURE__ */ new Map();
     const changedMemories = [];
-    for (const file of readdirSync13(memoryDir)) {
+    for (const file of readdirSync14(memoryDir)) {
       if (!file.endsWith(".md")) continue;
       try {
-        const raw = readFileSync34(join43(memoryDir, file), "utf-8");
+        const raw = readFileSync34(join44(memoryDir, file), "utf-8");
         const fileHash = createHash20("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
@@ -24747,7 +25114,7 @@ async function syncMemories(agent, configDir, log2) {
       } catch (err) {
         for (const mem of changedMemories) {
           for (const [file] of currentHashes) {
-            const parsed = parseMemoryFile(readFileSync34(join43(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
+            const parsed = parseMemoryFile(readFileSync34(join44(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
             if (parsed?.name === mem.name) currentHashes.delete(file);
           }
         }
@@ -24773,7 +25140,7 @@ async function syncMemories(agent, configDir, log2) {
   }
 }
 async function downloadMemories(agent, memoryDir, log2, { force, configDir }) {
-  const localFiles = existsSync19(memoryDir) ? readdirSync13(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
+  const localFiles = existsSync19(memoryDir) ? readdirSync14(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
   const localListHash = createHash20("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
@@ -24828,7 +25195,7 @@ async function downloadMemories(agent, memoryDir, log2, { force, configDir }) {
         // Per-agent, not host-wide: memories are agent-private, so a shared
         // store would buy almost no dedupe while exposing one agent's content
         // to every other agent on the host. See memory-cache.ts's header.
-        cacheDir: join43(configDir, agent.code_name, "_memory_bodies"),
+        cacheDir: join44(configDir, agent.code_name, "_memory_bodies"),
         fetchContents: async (hashes) => {
           const res = await api.post(
             "/host/memories/contents",
@@ -24866,7 +25233,7 @@ async function downloadMemories(agent, memoryDir, log2, { force, configDir }) {
         const rawSlug = mem.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "").slice(0, 60);
         const slug = rawSlug || `memory-${i}`;
         const fileName = `${slug}.md`;
-        const filePath = join43(memoryDir, fileName);
+        const filePath = join44(memoryDir, fileName);
         const desired = `---
 name: ${JSON.stringify(mem.name)}
 type: ${mem.type}
@@ -24904,7 +25271,7 @@ ${mem.content}
         if (manifestDirty) saveMemoryManifest(agent.agent_id, configDir, agent.code_name);
       }
       if (written > 0 || overwritten > 0) {
-        const updatedFiles = readdirSync13(memoryDir).filter((f) => f.endsWith(".md")).sort();
+        const updatedFiles = readdirSync14(memoryDir).filter((f) => f.endsWith(".md")).sort();
         lastLocalFileHash.set(agent.agent_id, createHash20("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
         log2(`Memory download for '${agent.code_name}': wrote ${written} new, overwrote ${overwritten} stale`);
       }
@@ -25304,12 +25671,19 @@ function startManager(opts) {
           log(`[startup] rehydrated update-request ack at ${state9.lastUpdateRequestProcessedAt} (ENG-6692)`);
         }
       }
+      const pendingAck = parsed.pendingKeyRotationAck;
+      if (pendingAck && typeof pendingAck.prefix === "string" && typeof pendingAck.requestedAt === "string") {
+        state9.pendingKeyRotationAck = pendingAck;
+        pendingKeyRotationAck = pendingAck.prefix;
+        lastKeyRotationHandled = pendingAck.requestedAt;
+        log(`[startup] rehydrated pending key-rotation ack for ${pendingAck.prefix} (ENG-11642)`);
+      }
     }
   } catch (err) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);
   }
   log(
-    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join43(homedir17(), ".augmented", "manager.log")}`
+    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join44(homedir17(), ".augmented", "manager.log")}`
   );
   deployMcpAssets();
   reapOrphanChannelMcps({ log });
@@ -25435,14 +25809,14 @@ function restartRunningChannelMcps(basenames) {
   }
 }
 function deployMcpAssets() {
-  const targetDir = join43(homedir17(), ".augmented", "_mcp");
+  const targetDir = join44(homedir17(), ".augmented", "_mcp");
   mkdirSync16(targetDir, { recursive: true });
   const moduleDir = dirname11(fileURLToPath2(import.meta.url));
   let mcpSourceDir = "";
   let dir = moduleDir;
   for (let i = 0; i < 6; i++) {
-    const candidate = join43(dir, "dist", "mcp");
-    if (existsSync19(join43(candidate, "index.js"))) {
+    const candidate = join44(dir, "dist", "mcp");
+    if (existsSync19(join44(candidate, "index.js"))) {
       mcpSourceDir = candidate;
       break;
     }
@@ -25542,8 +25916,8 @@ function deployMcpAssets() {
     // natural session restart.
     "computer-use-proxy.js"
   ]) {
-    const src = join43(mcpSourceDir, file);
-    const dst = join43(targetDir, file);
+    const src = join44(mcpSourceDir, file);
+    const dst = join44(targetDir, file);
     if (!existsSync19(src)) continue;
     attemptedFiles.push(file);
     const before = fileHash(dst);
@@ -25569,14 +25943,14 @@ function deployMcpAssets() {
     log(`[manager] Bundle(s) updated: ${changedBasenames.join(", ")} \u2014 signalling running instances to restart`);
     restartRunningChannelMcps(changedBasenames);
   }
-  const localMcpPath = join43(targetDir, "index.js");
+  const localMcpPath = join44(targetDir, "index.js");
   try {
-    const agentsDir = join43(homedir17(), ".augmented", "agents");
+    const agentsDir = join44(homedir17(), ".augmented", "agents");
     if (existsSync19(agentsDir)) {
-      for (const entry of readdirSync13(agentsDir, { withFileTypes: true })) {
+      for (const entry of readdirSync14(agentsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         for (const subdir of ["provision", "project"]) {
-          const mcpJsonPath = join43(agentsDir, entry.name, subdir, ".mcp.json");
+          const mcpJsonPath = join44(agentsDir, entry.name, subdir, ".mcp.json");
           try {
             const raw = readFileSync34(mcpJsonPath, "utf-8");
             if (!raw.includes("@integrity-labs/augmented-mcp")) continue;