@integrity-labs/agt-cli 0.28.1177 → 0.28.1179

package/dist/{chunk-45UH24I2.js → chunk-O5P2OS36.js}

@@ -16,11 +16,11 @@ import {
   parseEnvFileEntries,
   parseEnvIntegrations,
   shellQuote
-} from "./chunk-H37WRW2E.js";
+} from "./chunk-GJD536LU.js";
 import {
   readDailySessionPin,
   sessionTranscriptDir
-} from "./chunk-DJNCIWVG.js";
+} from "./chunk-2FHYCFZM.js";
 import {
   classifyUnanswerablePane,
   isConsumerTermsDialogVisible,
@@ -59,6 +59,7 @@ import {
   buildIntegrationsSection,
   buildSlackThirdPartyBotsEnvValue,
   coerceEnvValue,
+  deriveConsoleUrl,
   formatLiteralSecretRejection,
   generateClaudeMd,
   getFlagDefinition,
@@ -90,7 +91,7 @@ import {
   scanConfigForLiteralSecrets,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "./chunk-47P33SZF.js";
+} from "./chunk-PINFVWGX.js";
 import {
   claudeJsonPathFor,
   effectiveClaudeJsonPath,
@@ -8078,7 +8079,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1177" : "dev";
+var agtCliVersion = true ? "0.28.1179" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8255,6 +8256,49 @@ async function mintAgentKey(rawHostKey, agentId) {
   }
   return data.agent_key;
 }
+async function mintRotatedHostKey(rawHostKey) {
+  const res = await fetch(`${requireHost()}/host/rotate-key`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ host_key: rawHostKey }),
+    // BOUNDED, because this await is now on the poll cycle's critical path
+    // (CodeRabbit on #7114). The rotation moved onto the heartbeat handler,
+    // which `pollCycleInner` awaits, so an unanswered mint blocks the Claude
+    // Code updater, the responsiveness probe, the wedge and pane-fatal checks,
+    // the /host/agents fetch and every per-agent `processAgent` for as long as
+    // it hangs — and Node's built-in fetch waits 300s by default. The
+    // 5-minute retry backoff would then re-arm the same stall. 10s matches the
+    // other short calls in this process (`telegram-ingest.ts`). A timeout
+    // surfaces as a thrown error, which `adoptRotatedHostKey` reports as
+    // `error` and the manager retries after the backoff — but the retry only
+    // succeeds if the SERVER never committed the mint. The abort cancels the
+    // client, not the route: if the key was already inserted and recorded, the
+    // retry hits the one-mint-per-request guard, gets 409, and the request
+    // needs a `compromised` rotation (Obi Wan `9b564171021b` on #7114). A lost
+    // response after the commit ends the same way. The runbook lists it.
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (res.status === 403) {
+    return null;
+  }
+  if (res.status === 409) {
+    const body = await res.json().catch(() => ({}));
+    return { refused: String(body["error"] ?? "conflict") };
+  }
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    throw new Error(`Host key rotation mint failed (${res.status}): ${String(body["error"] ?? res.statusText)}`);
+  }
+  const data = await res.json();
+  const prefix = data.key?.prefix;
+  const rawKey = data.key?.raw_key;
+  if (!prefix || !rawKey) return null;
+  return { prefix, rawKey };
+}
+function adoptHostKeyInProcess(rawKey) {
+  process.env["AGT_API_KEY"] = rawKey;
+  forceNextExchange();
+}
 async function resolveAuth() {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -12329,12 +12373,38 @@ function decidePin(opts) {
   return { kind: "install", version: pinned };
 }
 
-// src/commands/manager.ts
+// src/commands/setup.ts
+import { existsSync as existsSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8, accessSync, constants as fsConstants } from "fs";
+import { join as join12, dirname as dirname7 } from "path";
+import { homedir as homedir8 } from "os";
 import chalk3 from "chalk";
-import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
-import { join as join12 } from "path";
-import { homedir as homedir8, userInfo } from "os";
-import { spawn as spawn4 } from "child_process";
+import ora from "ora";
+
+// src/lib/output.ts
+import chalk2 from "chalk";
+import Table from "cli-table3";
+function success(msg) {
+  console.log(chalk2.green(`\u2714 ${msg}`));
+}
+function error(msg) {
+  console.error(chalk2.red(`\u2718 ${msg}`));
+}
+function warn(msg) {
+  console.warn(chalk2.yellow(`\u26A0 ${msg}`));
+}
+function info(msg) {
+  console.log(chalk2.cyan(`\u2139 ${msg}`));
+}
+function table(headers, rows) {
+  const t = new Table({
+    head: headers.map((h) => chalk2.bold.cyan(h)),
+    style: { head: [], border: [] }
+  });
+  for (const row of rows) {
+    t.push(row);
+  }
+  console.log(t.toString());
+}
 
 // src/lib/watchdog.ts
 import { readFileSync as readFileSync11, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4, existsSync as existsSync9, mkdirSync as mkdirSync7, openSync as openSync2, closeSync as closeSync2, chmodSync as chmodSync5 } from "fs";
@@ -12532,33 +12602,337 @@ function getManagerStatus(configDir = DEFAULT_CONFIG_DIR) {
   return readStateFile(configDir);
 }
 
-// src/lib/output.ts
-import chalk2 from "chalk";
-import Table from "cli-table3";
-function success(msg) {
-  console.log(chalk2.green(`\u2714 ${msg}`));
+// src/commands/setup.ts
+function detectShellProfile() {
+  const shell = process.env["SHELL"] ?? "";
+  const home = homedir8();
+  if (shell.includes("zsh")) {
+    return join12(home, ".zshrc");
+  }
+  if (shell.includes("fish")) {
+    const fishConfig = join12(home, ".config", "fish", "config.fish");
+    return fishConfig;
+  }
+  const bashrc = join12(home, ".bashrc");
+  if (existsSync10(bashrc)) return bashrc;
+  return join12(home, ".bash_profile");
+}
+function maybeWriteSystemWideEnv(apiUrl, apiKey, consoleUrl) {
+  const empty = { etcEnvironment: false, profileD: false, bashrc: false };
+  if (process.platform === "win32") return empty;
+  if (typeof process.getuid !== "function" || process.getuid() !== 0) return empty;
+  return {
+    etcEnvironment: writeEtcEnvironment(apiUrl, apiKey, consoleUrl),
+    profileD: writeProfileDScript(apiUrl, apiKey, consoleUrl),
+    // Run for its side-effect (wiring /etc/bashrc to source agt.sh) but
+    // treat it as a supporting channel, not proof that env values were
+    // persisted. Success reporting should reflect actual value writes.
+    bashrc: ensureBashrcSourcesProfileD()
+  };
 }
-function error(msg) {
-  console.error(chalk2.red(`\u2718 ${msg}`));
+function quoteForEtcEnvironment(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\r?\n/g, "\\n")}"`;
 }
-function warn(msg) {
-  console.warn(chalk2.yellow(`\u26A0 ${msg}`));
+function parseEtcEnvironmentValue(text, key) {
+  let found = null;
+  for (const line of text.split(/\r?\n/)) {
+    const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (!m || m[1] !== key) continue;
+    const raw = m[2].trim();
+    const quoted = /^"((?:[^"\\]|\\.)*)"$/.exec(raw);
+    found = quoted ? quoted[1].replace(/\\(n|\\|")/g, (_, c) => c === "n" ? "\n" : c) : raw;
+  }
+  return found || null;
 }
-function info(msg) {
-  console.log(chalk2.cyan(`\u2139 ${msg}`));
+function readEtcEnvironmentValue(key) {
+  try {
+    return parseEtcEnvironmentValue(readFileSync12("/etc/environment", "utf-8"), key);
+  } catch {
+    return null;
+  }
 }
-function table(headers, rows) {
-  const t = new Table({
-    head: headers.map((h) => chalk2.bold.cyan(h)),
-    style: { head: [], border: [] }
-  });
-  for (const row of rows) {
-    t.push(row);
+function quoteForPosixShell(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function quoteForFishShell(value) {
+  return `'${value.replace(/\\/g, "\\\\").replace(/'/g, `\\'`)}'`;
+}
+function writeEtcEnvironment(apiUrl, apiKey, consoleUrl) {
+  const envPath = "/etc/environment";
+  if (!existsSync10(envPath)) return false;
+  try {
+    accessSync(envPath, fsConstants.W_OK);
+  } catch {
+    return false;
+  }
+  try {
+    const current = readFileSync12(envPath, "utf-8");
+    const stripped = current.split(/\r?\n/).filter((line) => !/^\s*(?:export\s+)?AGT_(?:HOST|API_KEY|CONSOLE_URL)=/.test(line)).join("\n");
+    const base = stripped.endsWith("\n") || stripped.length === 0 ? stripped : `${stripped}
+`;
+    const lines = [
+      `AGT_HOST=${quoteForEtcEnvironment(apiUrl)}`,
+      `AGT_API_KEY=${quoteForEtcEnvironment(apiKey)}`
+    ];
+    if (consoleUrl) lines.push(`AGT_CONSOLE_URL=${quoteForEtcEnvironment(consoleUrl)}`);
+    const appended = `${base}${lines.join("\n")}
+`;
+    writeFileSync8(envPath, appended, { mode: 420 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function writeProfileDScript(apiUrl, apiKey, consoleUrl) {
+  const profileD = "/etc/profile.d";
+  if (!existsSync10(profileD)) return false;
+  try {
+    accessSync(profileD, fsConstants.W_OK);
+  } catch {
+    return false;
+  }
+  try {
+    const scriptPath = `${profileD}/agt.sh`;
+    const lines = [
+      "# Augmented \u2014 auto-generated by `agt setup`. Do not edit.",
+      `export AGT_HOST=${quoteForPosixShell(apiUrl)}`,
+      `export AGT_API_KEY=${quoteForPosixShell(apiKey)}`
+    ];
+    if (consoleUrl) lines.push(`export AGT_CONSOLE_URL=${quoteForPosixShell(consoleUrl)}`);
+    lines.push("");
+    writeFileSync8(scriptPath, lines.join("\n"), { mode: 420 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function ensureBashrcSourcesProfileD() {
+  const bashrc = "/etc/bashrc";
+  if (!existsSync10(bashrc)) return false;
+  try {
+    accessSync(bashrc, fsConstants.W_OK);
+  } catch {
+    return false;
+  }
+  try {
+    const current = readFileSync12(bashrc, "utf-8");
+    const marker = "# Augmented (agt) \u2014 source system-wide AGT env";
+    if (current.includes(marker)) return true;
+    const snippet = [
+      "",
+      marker,
+      "if [ -r /etc/profile.d/agt.sh ]; then",
+      "  . /etc/profile.d/agt.sh",
+      "fi",
+      ""
+    ].join("\n");
+    writeFileSync8(bashrc, current + snippet);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function buildExportLines(shell, apiUrl, apiKey, consoleUrl) {
+  if (shell.includes("fish")) {
+    const lines2 = [
+      "",
+      "# Augmented (agt) host configuration",
+      `set -gx AGT_HOST ${quoteForFishShell(apiUrl)}`,
+      `set -gx AGT_API_KEY ${quoteForFishShell(apiKey)}`
+    ];
+    if (consoleUrl) lines2.push(`set -gx AGT_CONSOLE_URL ${quoteForFishShell(consoleUrl)}`);
+    lines2.push("");
+    return lines2.join("\n");
+  }
+  const lines = [
+    "",
+    "# Augmented (agt) host configuration",
+    `export AGT_HOST=${quoteForPosixShell(apiUrl)}`,
+    `export AGT_API_KEY=${quoteForPosixShell(apiKey)}`
+  ];
+  if (consoleUrl) lines.push(`export AGT_CONSOLE_URL=${quoteForPosixShell(consoleUrl)}`);
+  lines.push("");
+  return lines.join("\n");
+}
+async function setupCommand(token, options = {}) {
+  const json = isJsonMode();
+  const shortTokenPattern = /^[A-HJ-NP-Z2-9]{4}-[A-HJ-NP-Z2-9]{4}$/i;
+  const legacyTokenPattern = /^prov_[a-f0-9]{64}$/i;
+  if (!token || !shortTokenPattern.test(token) && !legacyTokenPattern.test(token)) {
+    if (json) {
+      jsonOutput({ ok: false, error: "Invalid provisioning token. Expected format: XXXX-XXXX or prov_<64 hex>" });
+    } else {
+      error("Invalid provisioning token. Expected format: XXXX-XXXX or prov_<64 hex>");
+      info("Get a provisioning token from the Augmented dashboard after creating a host.");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const normalizedToken = shortTokenPattern.test(token) ? token.toUpperCase() : token.toLowerCase();
+  const apiHostFlag = options.apiHost?.trim();
+  const envHost = process.env["AGT_HOST"]?.trim();
+  const apiUrl = apiHostFlag || envHost;
+  if (!apiUrl) {
+    const msg = "Cannot determine API host for token exchange. Pass --api-host <url> or set AGT_HOST before running `agt setup`.\n  Production:        --api-host https://api.augmented.team\n  Non-prod stage:    --api-host https://<stage>.api.staging.augmented.team\n  Local development: --api-host http://api.agt.localhost:1355";
+    if (json) {
+      jsonOutput({ ok: false, error: msg });
+    } else {
+      error(msg);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  if (!json) {
+    if (apiHostFlag) {
+      info(`Exchanging token against ${chalk3.bold(apiUrl)} (from --api-host)`);
+    } else {
+      info(`Exchanging token against ${chalk3.bold(apiUrl)} (from AGT_HOST)`);
+    }
+  }
+  const spinner = ora({ text: "Exchanging provisioning token\u2026", isSilent: json });
+  spinner.start();
+  let setupResult;
+  try {
+    const res = await fetch(`${apiUrl}/host/setup`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ token: normalizedToken })
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      throw new Error(body["error"] ?? `Setup failed: HTTP ${res.status}`);
+    }
+    setupResult = await res.json();
+    spinner.succeed("Provisioning token accepted");
+  } catch (err) {
+    spinner.fail("Failed to exchange provisioning token");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const finalApiUrl = setupResult.api_url || apiUrl;
+  process.env["AGT_HOST"] = finalApiUrl;
+  process.env["AGT_API_KEY"] = setupResult.api_key;
+  const verifySpinner = ora({ text: "Verifying connection\u2026", isSilent: json });
+  verifySpinner.start();
+  try {
+    const exchange = await exchangeApiKey(setupResult.api_key);
+    verifySpinner.succeed("Connection verified");
+    if (!json) {
+      info(`Host:       ${chalk3.bold(setupResult.host_name)}`);
+      info(`Host ID:    ${exchange.hostId}`);
+      info(`Team:       ${chalk3.bold(exchange.teamSlug ?? setupResult.team_slug ?? "unknown")}`);
+      if (exchange.userEmail) {
+        info(`User:       ${chalk3.bold(exchange.userEmail)}`);
+      }
+    }
+  } catch (err) {
+    verifySpinner.fail("Connection verification failed");
+    if (json) {
+      jsonOutput({ ok: false, error: err.message });
+    } else {
+      error(err.message);
+      info("Connection could not be verified. No changes were written to your shell profile.");
+      info("Check your network connection and try: agt whoami");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const profilePath = detectShellProfile();
+  const shell = process.env["SHELL"] ?? "bash";
+  const consoleUrl = deriveConsoleUrl(finalApiUrl);
+  if (consoleUrl) {
+    process.env["AGT_CONSOLE_URL"] = consoleUrl;
+  }
+  if (!json && !consoleUrl) {
+    warn(
+      `Could not derive AGT_CONSOLE_URL from ${finalApiUrl} \u2014 scheduled-delivery deep links will be disabled until you set it manually.`
+    );
+  }
+  const exportLines = buildExportLines(shell, finalApiUrl, setupResult.api_key, consoleUrl);
+  const profileDir = dirname7(profilePath);
+  if (!existsSync10(profileDir)) {
+    mkdirSync8(profileDir, { recursive: true });
+  }
+  const marker = "# Augmented (agt) host configuration";
+  const current = existsSync10(profilePath) ? readFileSync12(profilePath, "utf-8") : "";
+  let updated;
+  if (current.includes(marker)) {
+    updated = current.replace(
+      /\n?# Augmented \(agt\) host configuration\n(?:(?:export\s+AGT_\w+=.*|set\s+-gx\s+AGT_\w+\s+.*)\n)*\n?/,
+      exportLines
+    );
+    if (!json) {
+      info("Replacing existing Augmented config block in shell profile.");
+    }
+  } else {
+    updated = current + exportLines;
+  }
+  writeFileSync8(profilePath, updated.endsWith("\n") ? updated : `${updated}
+`);
+  if (!json) {
+    success(`Environment variables written to ${chalk3.bold(profilePath)}`);
+  }
+  const sys = maybeWriteSystemWideEnv(finalApiUrl, setupResult.api_key, consoleUrl);
+  const valueChannelsWritten = sys.etcEnvironment || sys.profileD;
+  if (!json && valueChannelsWritten) {
+    const channels = [
+      sys.etcEnvironment ? "/etc/environment" : null,
+      sys.profileD ? "/etc/profile.d/agt.sh" : null,
+      sys.bashrc ? "/etc/bashrc" : null
+    ].filter(Boolean).join(" + ");
+    success(`System-wide env updated: ${channels}`);
+  }
+  const managerSpinner = ora({ text: "Starting manager daemon\u2026", isSilent: json });
+  managerSpinner.start();
+  try {
+    const configDir = join12(homedir8(), ".augmented");
+    const { pid } = startWatchdog({ intervalMs: 1e4, configDir, detached: true });
+    managerSpinner.succeed(`Manager started (PID ${pid})`);
+  } catch (err) {
+    managerSpinner.warn("Could not start manager daemon");
+    if (!json) {
+      warn(err.message);
+      info("Start it manually with: agt manager start");
+    }
+  }
+  const includeApiKey = process.env["AGT_SETUP_INCLUDE_API_KEY"] === "1";
+  if (json) {
+    jsonOutput({
+      ok: true,
+      host_name: setupResult.host_name,
+      host_id: setupResult.host_id,
+      team_slug: setupResult.team_slug,
+      api_url: finalApiUrl,
+      ...includeApiKey ? { api_key: setupResult.api_key } : {},
+      agents: setupResult.agents,
+      profile: profilePath
+    });
+    process.exit(0);
+  } else {
+    console.log();
+    console.log(chalk3.green.bold("  Setup complete!"));
+    console.log();
+    if (setupResult.agents.length > 0) {
+      info(`Agents:     ${setupResult.agents.map((a) => chalk3.cyan(a)).join(", ")}`);
+    } else {
+      info("No agents assigned yet. Assign agents in the dashboard or with: agt host assign");
+    }
+    console.log();
+    info(`Restart your shell or run: ${chalk3.bold(`source ${profilePath}`)}`);
   }
-  console.log(t.toString());
 }
 
 // src/commands/manager.ts
+import chalk4 from "chalk";
+import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
+import { join as join13 } from "path";
+import { homedir as homedir9, userInfo } from "os";
+import { spawn as spawn4 } from "child_process";
 function normalizePinInEnv(env) {
   const normalized = normalizePinVersion(env.AGT_CLI_PIN_VERSION);
   if (normalized) env.AGT_CLI_PIN_VERSION = normalized;
@@ -12567,7 +12941,7 @@ function normalizePinInEnv(env) {
 function managerStartCommand(opts) {
   const json = isJsonMode();
   if (!process.env.HOME || !process.env.HOME.trim()) {
-    const fallback = homedir8();
+    const fallback = homedir9();
     process.env.HOME = fallback;
     if (!json) {
       info(`HOME was not set in the manager env \u2014 defaulting to ${fallback}.`);
@@ -12601,7 +12975,7 @@ function managerStartCommand(opts) {
     process.exitCode = 1;
     return;
   }
-  const configDir = opts.configDir ?? join12(homedir8(), ".augmented");
+  const configDir = opts.configDir ?? join13(homedir9(), ".augmented");
   if (opts.supervise) {
     if (json) {
       jsonOutput({ ok: false, error: "--supervise is not supported with --json" });
@@ -12697,7 +13071,7 @@ function runSupervisorLoop(intervalSec, configDir) {
 }
 async function managerStopCommand(opts = {}) {
   const json = isJsonMode();
-  const configDir = opts.configDir ?? join12(homedir8(), ".augmented");
+  const configDir = opts.configDir ?? join13(homedir9(), ".augmented");
   try {
     const result = await stopWatchdog(configDir);
     if (!result.stopped && !result.pid) {
@@ -12725,7 +13099,7 @@ async function managerStopCommand(opts = {}) {
 }
 function managerStatusCommand(opts = {}) {
   const json = isJsonMode();
-  const configDir = opts.configDir ?? join12(homedir8(), ".augmented");
+  const configDir = opts.configDir ?? join13(homedir9(), ".augmented");
   const status = getManagerStatus(configDir);
   if (!status) {
     if (json) {
@@ -12739,10 +13113,10 @@ function managerStatusCommand(opts = {}) {
     jsonOutput({ ok: true, running: true, ...status });
     return;
   }
-  console.log(chalk3.bold("\nManager Status\n"));
+  console.log(chalk4.bold("\nManager Status\n"));
   info(`PID:        ${status.pid}`);
   info(`Started:    ${status.startedAt}`);
-  info(`Last poll:  ${status.lastPollAt ?? chalk3.dim("none")}`);
+  info(`Last poll:  ${status.lastPollAt ?? chalk4.dim("none")}`);
   info(`Polls:      ${status.pollCount}`);
   info(`Errors:     ${status.errorCount}`);
   console.log();
@@ -12751,19 +13125,19 @@ function managerStatusCommand(opts = {}) {
     return;
   }
   const rows = status.agents.map((a) => {
-    let gwStatus = chalk3.dim("\u2014");
+    let gwStatus = chalk4.dim("\u2014");
     if (a.gatewayRunning) {
-      gwStatus = chalk3.green(`:${a.gatewayPort} (PID ${a.gatewayPid})`);
+      gwStatus = chalk4.green(`:${a.gatewayPort} (PID ${a.gatewayPid})`);
     } else if (a.gatewayPort) {
-      gwStatus = chalk3.red(`:${a.gatewayPort} (down)`);
+      gwStatus = chalk4.red(`:${a.gatewayPort} (down)`);
     }
     return [
       a.codeName,
-      a.status === "active" ? chalk3.green(a.status) : a.status === "paused" ? chalk3.yellow(a.status) : chalk3.dim(a.status ?? "\u2014"),
-      a.charterVersion || chalk3.dim("\u2014"),
+      a.status === "active" ? chalk4.green(a.status) : a.status === "paused" ? chalk4.yellow(a.status) : chalk4.dim(a.status ?? "\u2014"),
+      a.charterVersion || chalk4.dim("\u2014"),
       gwStatus,
-      a.lastProvisionAt ? new Date(a.lastProvisionAt).toLocaleTimeString() : chalk3.dim("\u2014"),
-      a.lastDriftCheckAt ? new Date(a.lastDriftCheckAt).toLocaleTimeString() : chalk3.dim("\u2014")
+      a.lastProvisionAt ? new Date(a.lastProvisionAt).toLocaleTimeString() : chalk4.dim("\u2014"),
+      a.lastDriftCheckAt ? new Date(a.lastDriftCheckAt).toLocaleTimeString() : chalk4.dim("\u2014")
     ];
   });
   table(
@@ -12772,13 +13146,13 @@ function managerStatusCommand(opts = {}) {
   );
   const acpAgents = status.agents.filter((a) => a.acpSessions && a.acpSessions.length > 0);
   if (acpAgents.length > 0) {
-    console.log(chalk3.bold("\nACP Sessions\n"));
+    console.log(chalk4.bold("\nACP Sessions\n"));
     const acpRows = acpAgents.flatMap(
       (a) => a.acpSessions.map((s) => [
         a.codeName,
         s.agentCommand,
-        s.sessionName ?? chalk3.dim("default"),
-        s.queueState === "running" ? chalk3.green(s.queueState) : s.queueState === "queued" ? chalk3.yellow(s.queueState) : chalk3.dim(s.queueState),
+        s.sessionName ?? chalk4.dim("default"),
+        s.queueState === "running" ? chalk4.green(s.queueState) : s.queueState === "queued" ? chalk4.yellow(s.queueState) : chalk4.dim(s.queueState),
         String(s.turnCount),
         new Date(s.startedAt).toLocaleTimeString()
       ])
@@ -12815,7 +13189,7 @@ function resolveStableAgtBin(rawPath) {
   if (!prefix || !formula) return rawPath;
   const candidates = [`${prefix}/bin/${formula}`, `${prefix}/bin/agt`];
   for (const candidate of candidates) {
-    if (!existsSync10(candidate)) continue;
+    if (!existsSync11(candidate)) continue;
     try {
       realpathSync2(candidate);
       return candidate;
@@ -12826,7 +13200,7 @@ function resolveStableAgtBin(rawPath) {
 }
 async function managerInstallCommand(opts = {}) {
   const json = isJsonMode();
-  const { installSupervisor, supervisorStatus } = await import("./manager-supervisor-KIFBGETA.js");
+  const { installSupervisor, supervisorStatus } = await import("./manager-supervisor-TD7E6FPC.js");
   const intervalSec = parseInt(opts.interval ?? "10", 10);
   if (isNaN(intervalSec) || intervalSec < 5) {
     const msg = "Interval must be at least 5 seconds.";
@@ -12835,7 +13209,7 @@ async function managerInstallCommand(opts = {}) {
     process.exitCode = 1;
     return;
   }
-  const configDir = opts.configDir ?? join12(homedir8(), ".augmented");
+  const configDir = opts.configDir ?? join13(homedir9(), ".augmented");
   const rawAgtBin = process.argv[1];
   if (!rawAgtBin) {
     const msg = "Could not resolve the agt binary path from argv. Re-run via the installed `agt` command.";
@@ -12846,9 +13220,9 @@ async function managerInstallCommand(opts = {}) {
   }
   const agtBin = resolveStableAgtBin(rawAgtBin);
   if (process.platform === "darwin") {
-    const home = homedir8();
+    const home = homedir9();
     const protectedRoots = ["Documents", "Downloads", "Desktop", "Movies", "Music", "Pictures"];
-    const offending = protectedRoots.map((r) => join12(home, r)).find((p) => agtBin === p || agtBin.startsWith(`${p}/`));
+    const offending = protectedRoots.map((r) => join13(home, r)).find((p) => agtBin === p || agtBin.startsWith(`${p}/`));
     if (offending) {
       const msg = `agt binary at ${agtBin} sits inside a macOS TCC-protected folder (${offending}). launchd-spawned processes cannot read files there and the manager would EPERM on startup. Either install agt globally (\`npm install -g @integrity-labs/agt-cli\`) or copy the dist outside protected folders before running this command.`;
       if (json) jsonOutput({ ok: false, error: msg });
@@ -12861,7 +13235,7 @@ async function managerInstallCommand(opts = {}) {
     AGT_HOST: getHost(),
     // ?? alone wouldn't catch `HOME=""` from a stripped systemd env.
     // Treat empty / whitespace-only as missing.
-    HOME: process.env.HOME?.trim() || homedir8(),
+    HOME: process.env.HOME?.trim() || homedir9(),
     USER: process.env.USER?.trim() || userInfo().username
   };
   const apiKey = getApiKey();
@@ -12888,7 +13262,7 @@ async function managerInstallCommand(opts = {}) {
 }
 async function managerUninstallCommand() {
   const json = isJsonMode();
-  const { uninstallSupervisor } = await import("./manager-supervisor-KIFBGETA.js");
+  const { uninstallSupervisor } = await import("./manager-supervisor-TD7E6FPC.js");
   const result = await uninstallSupervisor();
   if (!result.ok) {
     if (json) jsonOutput({ ok: false, error: result.error });
@@ -12904,7 +13278,7 @@ async function managerUninstallCommand() {
 }
 async function managerInstallSystemUnitCommand(opts = {}) {
   const json = isJsonMode();
-  const { installSystemUnit, systemUnitStatus } = await import("./manager-supervisor-KIFBGETA.js");
+  const { installSystemUnit, systemUnitStatus } = await import("./manager-supervisor-TD7E6FPC.js");
   const intervalSec = parseInt(opts.interval ?? "10", 10);
   if (isNaN(intervalSec) || intervalSec < 5) {
     const msg = "Interval must be at least 5 seconds.";
@@ -12914,7 +13288,7 @@ async function managerInstallSystemUnitCommand(opts = {}) {
     return;
   }
   const user = opts.user ?? "root";
-  const configDir = opts.configDir ?? (user === "root" ? "/root/.augmented" : join12("/home", user, ".augmented"));
+  const configDir = opts.configDir ?? (user === "root" ? "/root/.augmented" : join13("/home", user, ".augmented"));
   const rawAgtBin = process.argv[1];
   if (!rawAgtBin) {
     const msg = "Could not resolve the agt binary path from argv. Re-run via the installed `agt` command.";
@@ -12960,7 +13334,7 @@ async function managerInstallSystemUnitCommand(opts = {}) {
 }
 async function managerUninstallSystemUnitCommand() {
   const json = isJsonMode();
-  const { uninstallSystemUnit } = await import("./manager-supervisor-KIFBGETA.js");
+  const { uninstallSystemUnit } = await import("./manager-supervisor-TD7E6FPC.js");
   const result = await uninstallSystemUnit();
   if (!result.ok) {
     if (json) jsonOutput({ ok: false, error: result.error });
@@ -13168,6 +13542,8 @@ export {
   getCachedClaudeAuthModeRaw,
   exchangeApiKey,
   mintAgentKey,
+  mintRotatedHostKey,
+  adoptHostKeyInProcess,
   ApiError,
   api,
   getHostId,
@@ -13224,8 +13600,11 @@ export {
   normalizePinVersion,
   pinAllowsUrgent,
   decidePin,
+  readEtcEnvironmentValue,
+  writeEtcEnvironment,
+  writeProfileDScript,
+  setupCommand,
   getManagerPaths,
-  startWatchdog,
   managerStartCommand,
   SUPERVISOR_RESTART_EXIT_CODE,
   managerStopCommand,
@@ -13235,4 +13614,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-45UH24I2.js.map
+//# sourceMappingURL=chunk-O5P2OS36.js.map