@integrity-labs/agt-cli 0.28.13-canary.18 → 0.28.14

package/dist/lib/manager-worker.js

@@ -22,7 +22,7 @@ import {
   provisionStopHook,
   requireHost,
   safeWriteJsonAtomic
-} from "../chunk-BBTTZRCH.js";
+} from "../chunk-REFMPKKL.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -103,12 +103,12 @@ import {
 } from "../chunk-XWVM4KPK.js";
 
 // src/lib/manager-worker.ts
-import { createHash as createHash3 } from "crypto";
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, appendFileSync, mkdirSync as mkdirSync3, chmodSync, existsSync as existsSync5, rmSync as rmSync2, readdirSync as readdirSync5, statSync as statSync4, unlinkSync, copyFileSync } from "fs";
+import { createHash as createHash4 } from "crypto";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync7, rmSync as rmSync3, readdirSync as readdirSync5, statSync as statSync4, unlinkSync, copyFileSync } from "fs";
 import https from "https";
 import { execFileSync as syncExecFile } from "child_process";
-import { join as join11, dirname as dirname2 } from "path";
-import { homedir as homedir5 } from "os";
+import { join as join13, dirname as dirname3 } from "path";
+import { homedir as homedir7 } from "os";
 import { fileURLToPath } from "url";
 
 // src/lib/mcp-config-drift.ts
@@ -3674,6 +3674,189 @@ function planGlobalSkillSync(globalSkills, prevIds, hashOf, knownHash) {
   return { installs, removes, currentIds };
 }
 
+// src/lib/manager/runtime.ts
+import { createHash as createHash3 } from "crypto";
+import { readFileSync as readFileSync9, appendFileSync, mkdirSync as mkdirSync2, chmodSync, existsSync as existsSync4 } from "fs";
+import { join as join10, dirname as dirname2 } from "path";
+import { homedir as homedir4 } from "os";
+function redactForDiskLog(value) {
+  try {
+    return value.replace(/\b(Bearer\s+)[A-Za-z0-9._-]+\b/gi, "$1[REDACTED]").replace(/\bxox[baprs]-[A-Za-z0-9-]+\b/g, "[REDACTED-SLACK]").replace(/\btlk_[A-Za-z0-9._-]+\b/g, "[REDACTED-HOST]").replace(/\bsk-ant-[A-Za-z0-9_-]+\b/g, "[REDACTED-ANTHROPIC]").replace(/\b\d{8,12}:[A-Za-z0-9_-]{30,}\b/g, "[REDACTED-TELEGRAM]").replace(
+      /\b([A-Z0-9_]*(?:TOKEN|SECRET|API[_-]?KEY|PASSWORD)[A-Z0-9_]*)=(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s\r\n]+)/gi,
+      "$1=[REDACTED]"
+    );
+  } catch {
+    return "[REDACTED]";
+  }
+}
+var managerLogPath = null;
+var managerLogWritable = true;
+function log(msg) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  const safeMsg = redactForDiskLog(msg);
+  const line = `[manager-worker ${ts}] ${safeMsg}
+`;
+  if (!managerLogPath) {
+    try {
+      managerLogPath = join10(homedir4(), ".augmented", "manager.log");
+      mkdirSync2(dirname2(managerLogPath), { recursive: true });
+      if (existsSync4(managerLogPath)) {
+        chmodSync(managerLogPath, 384);
+      }
+    } catch {
+    }
+  }
+  let appendedToFile = false;
+  if (managerLogPath && managerLogWritable) {
+    try {
+      appendFileSync(managerLogPath, line, { encoding: "utf-8", mode: 384 });
+      appendedToFile = true;
+    } catch (err) {
+      managerLogWritable = false;
+      process.stderr.write(
+        `[manager-worker ${ts}] [log] manager.log append failed; falling back to stderr-only: ${err.message}
+`
+      );
+    }
+  }
+  if (!appendedToFile || process.stderr.isTTY === true) {
+    process.stderr.write(line);
+  }
+}
+function sha256(content) {
+  return createHash3("sha256").update(content, "utf8").digest("hex");
+}
+function hashFile(filePath) {
+  try {
+    const content = readFileSync9(filePath, "utf-8");
+    return sha256(content);
+  } catch {
+    return null;
+  }
+}
+async function execFilePromise(cmd, args) {
+  const { execFile: ef } = await import("child_process");
+  return new Promise((resolve, reject) => {
+    ef(cmd, args, { timeout: 15e3 }, (err, stdout, stderr) => {
+      if (err) reject(err);
+      else resolve({ stdout, stderr });
+    });
+  });
+}
+var ChildProcessError = class extends Error {
+  code;
+  stdout;
+  stderr;
+  constructor(code, stdout, stderr) {
+    const stderrSnippet = stderr.trim().slice(0, 500);
+    const stdoutSnippet = stdout.trim().slice(0, 500);
+    const detail = stderrSnippet || stdoutSnippet || "(no output)";
+    super(`Exit code ${code}: ${detail}`);
+    this.name = "ChildProcessError";
+    this.code = code;
+    this.stdout = stdout;
+    this.stderr = stderr;
+  }
+};
+async function execFilePromiseLong(cmd, args, opts) {
+  const { spawn: sp } = await import("child_process");
+  return new Promise((resolve, reject) => {
+    const child = sp(cmd, args, {
+      cwd: opts?.cwd,
+      stdio: [opts?.stdin === "ignore" ? "ignore" : "pipe", "pipe", "pipe"],
+      ...opts?.env ? { env: opts.env } : {}
+    });
+    if (opts?.onSpawn && typeof child.pid === "number") {
+      try {
+        opts.onSpawn(child.pid);
+      } catch {
+      }
+    }
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (d) => {
+      stdout += d.toString();
+    });
+    child.stderr?.on("data", (d) => {
+      stderr += d.toString();
+    });
+    const timer = setTimeout(() => {
+      child.kill();
+      reject(new Error(`Timed out after ${opts?.timeout ?? 12e4}ms`));
+    }, opts?.timeout ?? 12e4);
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (opts?.onExit && typeof child.pid === "number") {
+        try {
+          opts.onExit(child.pid);
+        } catch {
+        }
+      }
+      if (code !== 0) reject(new ChildProcessError(code, stdout, stderr));
+      else resolve({ stdout, stderr });
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+
+// src/lib/manager/model.ts
+function resolveModelChain(refreshData) {
+  const agent = refreshData.agent;
+  const modelDefaults = refreshData.model_defaults;
+  const platform2 = modelDefaults?.platform ?? {};
+  const org = modelDefaults?.org ?? {};
+  function resolve(tier) {
+    const agentField = `${tier}_model`;
+    const platformField = `default_${tier}_model`;
+    const agentVal = agent?.[agentField];
+    if (agentVal) return agentVal;
+    const orgVal = org?.[platformField];
+    if (orgVal) return orgVal;
+    const platformVal = platform2?.[platformField];
+    if (platformVal) return platformVal;
+    return void 0;
+  }
+  return {
+    primary: resolve("primary"),
+    secondary: resolve("secondary"),
+    tertiary: resolve("tertiary")
+  };
+}
+
+// src/lib/manager/claude-auth.ts
+import { existsSync as existsSync5, rmSync } from "fs";
+import { join as join11 } from "path";
+import { homedir as homedir5 } from "os";
+async function applyClaudeAuthToEnv(childEnv, label) {
+  const apiKey = getApiKey();
+  if (!apiKey) {
+    throw new Error("AGT_API_KEY is not set");
+  }
+  const exchange = await exchangeApiKey(apiKey, false, { forceRefresh: true });
+  if (exchange.claudeAuthMode === "api_key") {
+    if (!exchange.anthropicApiKey) {
+      throw new Error("claude_auth_mode=api_key but /host/exchange returned no decrypted key");
+    }
+    childEnv.ANTHROPIC_API_KEY = exchange.anthropicApiKey;
+    const claudeDir = join11(homedir5(), ".claude");
+    for (const filename of [".credentials.json", "credentials.json"]) {
+      const p = join11(claudeDir, filename);
+      if (existsSync5(p)) {
+        try {
+          rmSync(p, { force: true });
+          log(`[${label}] Removed ${p} (api_key mode \u2014 preventing OAuth fallback)`);
+        } catch {
+        }
+      }
+    }
+  } else {
+    delete childEnv.ANTHROPIC_API_KEY;
+  }
+}
+
 // src/lib/wedge-detection.ts
 var DEFAULTS = {
   inboundWaitSeconds: 120,
@@ -3813,24 +3996,24 @@ function partitionActionableByPoison(actionable, states, config2) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readdirSync as readdirSync4, readFileSync as readFileSync9, renameSync, rmSync, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join10 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync10, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join12 } from "path";
 import { randomUUID } from "crypto";
 function restartFlagsDir() {
-  return join10(homedir4(), ".augmented", "restart-flags");
+  return join12(homedir6(), ".augmented", "restart-flags");
 }
 function flagPath(codeName) {
-  return join10(restartFlagsDir(), `${codeName}.flag`);
+  return join12(restartFlagsDir(), `${codeName}.flag`);
 }
 function readRestartFlags() {
   const dir = restartFlagsDir();
-  if (!existsSync4(dir)) return [];
+  if (!existsSync6(dir)) return [];
   const out = [];
   for (const entry of readdirSync4(dir)) {
     if (!entry.endsWith(".flag")) continue;
     try {
-      const raw = readFileSync9(join10(dir, entry), "utf8");
+      const raw = readFileSync10(join12(dir, entry), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.codeName !== "string" || parsed.codeName.length === 0) {
         parsed.codeName = entry.replace(/\.flag$/, "");
@@ -3848,8 +4031,8 @@ function readRestartFlags() {
 }
 function deleteRestartFlag(codeName) {
   const path = flagPath(codeName);
-  if (existsSync4(path)) {
-    rmSync(path, { force: true });
+  if (existsSync6(path)) {
+    rmSync2(path, { force: true });
   }
 }
 
@@ -4378,8 +4561,8 @@ function applyRestartAcks(args) {
 var GATEWAY_PORT_BASE = 18800;
 var GATEWAY_PORT_STEP = 10;
 var GATEWAY_PORT_MAX = 18899;
-var AUGMENTED_DIR = join11(process.env["HOME"] ?? "/tmp", ".augmented");
-var GATEWAY_PORTS_FILE = join11(AUGMENTED_DIR, "gateway-ports.json");
+var AUGMENTED_DIR = join13(process.env["HOME"] ?? "/tmp", ".augmented");
+var GATEWAY_PORTS_FILE = join13(AUGMENTED_DIR, "gateway-ports.json");
 var CHANNEL_SWEEP_INTERVAL_MS = (() => {
   const raw = parseInt(process.env["AGT_CHANNEL_SWEEP_INTERVAL_MS"] ?? "", 10);
   if (!Number.isFinite(raw)) return 5 * 60 * 1e3;
@@ -4754,15 +4937,15 @@ var runningMcpServerKeys = /* @__PURE__ */ new Map();
 var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
-    const raw = readFileSync10(join11(projectDir, ".mcp.json"), "utf-8");
-    return createHash3("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
+    const raw = readFileSync11(join13(projectDir, ".mcp.json"), "utf-8");
+    return createHash4("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
   }
 }
 function projectMcpKeys(_codeName, projectDir) {
   try {
-    const raw = readFileSync10(join11(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync11(join13(projectDir, ".mcp.json"), "utf-8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers;
     if (!servers || typeof servers !== "object") return /* @__PURE__ */ new Set();
@@ -4773,7 +4956,7 @@ function projectMcpKeys(_codeName, projectDir) {
 }
 function readMcpHttpServerConfig(projectDir, serverKey, env) {
   try {
-    const raw = readFileSync10(join11(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync11(join13(projectDir, ".mcp.json"), "utf-8");
     const servers = JSON.parse(raw).mcpServers ?? {};
     const entry = servers[serverKey];
     if (entry && typeof entry.url === "string" && (entry.type === "http" || entry.type === void 0)) {
@@ -4801,9 +4984,9 @@ async function runAgentConnectivityProbes(agent, integrations, projectDir) {
   if (integrations.length === 0) return;
   const probeEnv = { ...process.env };
   try {
-    const envIntPath = join11(projectDir, ".env.integrations");
-    if (existsSync5(envIntPath)) {
-      Object.assign(probeEnv, parseEnvIntegrations(readFileSync10(envIntPath, "utf-8")));
+    const envIntPath = join13(projectDir, ".env.integrations");
+    if (existsSync7(envIntPath)) {
+      Object.assign(probeEnv, parseEnvIntegrations(readFileSync11(envIntPath, "utf-8")));
     }
   } catch {
   }
@@ -4991,7 +5174,7 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
 function projectChannelSecretHash(projectDir) {
   try {
     const entries = parseEnvIntegrations(
-      readFileSync10(join11(projectDir, ".env.integrations"), "utf-8")
+      readFileSync11(join13(projectDir, ".env.integrations"), "utf-8")
     );
     return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
   } catch {
@@ -5083,7 +5266,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.13-canary.18" : "dev";
+var agtCliVersion = true ? "0.28.14" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -5096,7 +5279,7 @@ function resolveBrewPath(execFileSync4) {
     "/usr/local/bin/brew"
   ];
   for (const path of fallbacks) {
-    if (existsSync5(path)) return path;
+    if (existsSync7(path)) return path;
   }
   return null;
 }
@@ -5106,7 +5289,7 @@ function claudeBinaryInstalled(execFileSync4) {
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude"
   ];
-  if (canonical.some((path) => existsSync5(path))) return true;
+  if (canonical.some((path) => existsSync7(path))) return true;
   try {
     execFileSync4("which", ["claude"], { timeout: 5e3 });
     return true;
@@ -5178,7 +5361,7 @@ async function ensureToolkitCli(toolkitSlug) {
         toolkitCliEnsured.add(toolkitSlug);
         return;
       }
-      brewBinDir = dirname2(brewPath);
+      brewBinDir = dirname3(brewPath);
       const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
       log(`[toolkit-install] ${toolkitSlug}: installing via brew (${pkg})\u2026`);
       if (isRoot) {
@@ -5259,8 +5442,8 @@ function claudeManagedSettingsPath() {
 function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
   try {
     let settings = {};
-    if (existsSync5(path)) {
-      const raw = readFileSync10(path, "utf-8").trim();
+    if (existsSync7(path)) {
+      const raw = readFileSync11(path, "utf-8").trim();
       if (raw) {
         let parsed;
         try {
@@ -5276,7 +5459,7 @@ function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
     }
     if (settings.channelsEnabled === true) return "ok";
     settings.channelsEnabled = true;
-    mkdirSync3(dirname2(path), { recursive: true });
+    mkdirSync4(dirname3(path), { recursive: true });
     writeFileSync4(path, `${JSON.stringify(settings, null, 2)}
 `);
     log(`[managed-settings] set channelsEnabled:true in ${path} (ENG-5786 \u2014 unblocks Claude Code channels)`);
@@ -5318,11 +5501,11 @@ async function ensureFrameworkBinary(frameworkId) {
       log(`Claude Code install failed: ${err.message}`);
       return;
     }
-    const brewBinDir = dirname2(brewPath);
+    const brewBinDir = dirname3(brewPath);
     if (!process.env.PATH?.split(":").includes(brewBinDir)) {
       process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
     }
-    if (existsSync5("/home/linuxbrew/.linuxbrew/bin/claude")) {
+    if (existsSync7("/home/linuxbrew/.linuxbrew/bin/claude")) {
       log("Claude Code installed successfully");
     } else {
       log("Claude Code install completed but binary not found at expected path \u2014 check brew logs");
@@ -5334,7 +5517,7 @@ async function ensureFrameworkBinary(frameworkId) {
 var CLAUDE_CODE_UPGRADE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var claudeCodeUpgradeInFlight = false;
 function claudeCodeUpgradeMarkerPath() {
-  return join11(homedir5(), ".augmented", ".last-claude-code-upgrade-check");
+  return join13(homedir7(), ".augmented", ".last-claude-code-upgrade-check");
 }
 function stampClaudeCodeUpgradeMarker() {
   try {
@@ -5344,7 +5527,7 @@ function stampClaudeCodeUpgradeMarker() {
 }
 function claudeCodeUpgradeThrottled() {
   try {
-    const lastCheck = parseInt(readFileSync10(claudeCodeUpgradeMarkerPath(), "utf-8").trim(), 10);
+    const lastCheck = parseInt(readFileSync11(claudeCodeUpgradeMarkerPath(), "utf-8").trim(), 10);
     if (!Number.isFinite(lastCheck)) return false;
     return Date.now() - lastCheck < CLAUDE_CODE_UPGRADE_CHECK_INTERVAL_MS;
   } catch {
@@ -5397,7 +5580,7 @@ ${r.stderr}`;
 }
 var UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function selfUpdateAppliedMarkerPath() {
-  return join11(homedir5(), ".augmented", ".last-self-update-applied");
+  return join13(homedir7(), ".augmented", ".last-self-update-applied");
 }
 var selfUpdateUpToDateLogged = false;
 var restartAfterUpgrade = false;
@@ -5420,7 +5603,7 @@ async function checkAndUpdateCli() {
     const isNpmGlobal = !isBrewFormula && resolvedPath.includes("node_modules");
     if (!isBrewFormula && !isNpmGlobal) return;
     const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
-    const markerPath = join11(homedir5(), ".augmented", ".last-update-check");
+    const markerPath = join13(homedir7(), ".augmented", ".last-update-check");
     try {
       const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
       if (Date.now() - lastCheck < UPDATE_CHECK_INTERVAL_MS) return;
@@ -5675,41 +5858,15 @@ async function checkClaudeAuth() {
     return false;
   }
 }
-async function applyClaudeAuthToEnv(childEnv, label) {
-  const apiKey = getApiKey();
-  if (!apiKey) {
-    throw new Error("AGT_API_KEY is not set");
-  }
-  const exchange = await exchangeApiKey(apiKey, false, { forceRefresh: true });
-  if (exchange.claudeAuthMode === "api_key") {
-    if (!exchange.anthropicApiKey) {
-      throw new Error("claude_auth_mode=api_key but /host/exchange returned no decrypted key");
-    }
-    childEnv.ANTHROPIC_API_KEY = exchange.anthropicApiKey;
-    const claudeDir = join11(homedir5(), ".claude");
-    for (const filename of [".credentials.json", "credentials.json"]) {
-      const p = join11(claudeDir, filename);
-      if (existsSync5(p)) {
-        try {
-          rmSync2(p, { force: true });
-          log(`[${label}] Removed ${p} (api_key mode \u2014 preventing OAuth fallback)`);
-        } catch {
-        }
-      }
-    }
-  } else {
-    delete childEnv.ANTHROPIC_API_KEY;
-  }
-}
 var evalEmptyMcpConfigPath = null;
 function ensureEvalEmptyMcpConfig() {
-  if (evalEmptyMcpConfigPath && existsSync5(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
-  const dir = join11(homedir5(), ".augmented");
+  if (evalEmptyMcpConfigPath && existsSync7(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
+  const dir = join13(homedir7(), ".augmented");
   try {
-    mkdirSync3(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true });
   } catch {
   }
-  const p = join11(dir, ".eval-empty-mcp.json");
+  const p = join13(dir, ".eval-empty-mcp.json");
   writeFileSync4(p, JSON.stringify({ mcpServers: {} }));
   evalEmptyMcpConfigPath = p;
   return p;
@@ -5735,7 +5892,7 @@ async function runEvalClaude(prompt, model) {
     ""
   ];
   const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-    cwd: homedir5(),
+    cwd: homedir7(),
     timeout: 12e4,
     stdin: "ignore",
     env: childEnv,
@@ -5784,13 +5941,13 @@ function resolveConversationEvalBackend() {
 }
 function loadGatewayPorts() {
   try {
-    return JSON.parse(readFileSync10(GATEWAY_PORTS_FILE, "utf-8"));
+    return JSON.parse(readFileSync11(GATEWAY_PORTS_FILE, "utf-8"));
   } catch {
     return {};
   }
 }
 function saveGatewayPorts(ports) {
-  mkdirSync3(AUGMENTED_DIR, { recursive: true });
+  mkdirSync4(AUGMENTED_DIR, { recursive: true });
   writeFileSync4(GATEWAY_PORTS_FILE, JSON.stringify(ports, null, 2));
 }
 function allocatePort(codeName) {
@@ -5814,10 +5971,10 @@ function freePort(codeName) {
   }
 }
 function getStateFile() {
-  return join11(config?.configDir ?? join11(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
+  return join13(config?.configDir ?? join13(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
 }
 function channelHashCacheDir() {
-  return config?.configDir ?? join11(process.env["HOME"] ?? "/tmp", ".augmented");
+  return config?.configDir ?? join13(process.env["HOME"] ?? "/tmp", ".augmented");
 }
 function loadChannelHashCache2() {
   loadChannelHashCache(agentState.knownChannelConfigHashes, channelHashCacheDir());
@@ -5828,7 +5985,7 @@ function saveChannelHashCache2() {
 var _channelQuarantineStore = null;
 function channelQuarantineStore() {
   if (!_channelQuarantineStore) {
-    const dir = config?.configDir ?? join11(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join13(process.env["HOME"] ?? "/tmp", ".augmented");
     _channelQuarantineStore = new ChannelQuarantineStore(defaultQuarantinePath(dir));
   }
   return _channelQuarantineStore;
@@ -5836,7 +5993,7 @@ function channelQuarantineStore() {
 var _hostFlagStore = null;
 function hostFlagStore() {
   if (!_hostFlagStore) {
-    const dir = config?.configDir ?? join11(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join13(process.env["HOME"] ?? "/tmp", ".augmented");
     _hostFlagStore = new HostFlagStore({ cachePath: defaultFlagsCachePath(dir), log });
   }
   return _hostFlagStore;
@@ -5869,61 +6026,6 @@ function send(msg) {
     log(`Error: ${msg.message}`);
   }
 }
-var managerLogPath = null;
-var managerLogWritable = true;
-function redactForDiskLog(value) {
-  try {
-    return value.replace(/\b(Bearer\s+)[A-Za-z0-9._-]+\b/gi, "$1[REDACTED]").replace(/\bxox[baprs]-[A-Za-z0-9-]+\b/g, "[REDACTED-SLACK]").replace(/\btlk_[A-Za-z0-9._-]+\b/g, "[REDACTED-HOST]").replace(/\bsk-ant-[A-Za-z0-9_-]+\b/g, "[REDACTED-ANTHROPIC]").replace(/\b\d{8,12}:[A-Za-z0-9_-]{30,}\b/g, "[REDACTED-TELEGRAM]").replace(
-      /\b([A-Z0-9_]*(?:TOKEN|SECRET|API[_-]?KEY|PASSWORD)[A-Z0-9_]*)=(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s\r\n]+)/gi,
-      "$1=[REDACTED]"
-    );
-  } catch {
-    return "[REDACTED]";
-  }
-}
-function log(msg) {
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  const safeMsg = redactForDiskLog(msg);
-  const line = `[manager-worker ${ts}] ${safeMsg}
-`;
-  if (!managerLogPath) {
-    try {
-      managerLogPath = join11(homedir5(), ".augmented", "manager.log");
-      mkdirSync3(dirname2(managerLogPath), { recursive: true });
-      if (existsSync5(managerLogPath)) {
-        chmodSync(managerLogPath, 384);
-      }
-    } catch {
-    }
-  }
-  let appendedToFile = false;
-  if (managerLogPath && managerLogWritable) {
-    try {
-      appendFileSync(managerLogPath, line, { encoding: "utf-8", mode: 384 });
-      appendedToFile = true;
-    } catch (err) {
-      managerLogWritable = false;
-      process.stderr.write(
-        `[manager-worker ${ts}] [log] manager.log append failed; falling back to stderr-only: ${err.message}
-`
-      );
-    }
-  }
-  if (!appendedToFile || process.stderr.isTTY === true) {
-    process.stderr.write(line);
-  }
-}
-function sha256(content) {
-  return createHash3("sha256").update(content, "utf8").digest("hex");
-}
-function hashFile(filePath) {
-  try {
-    const content = readFileSync10(filePath, "utf-8");
-    return sha256(content);
-  } catch {
-    return null;
-  }
-}
 var SKILLS_INDEX_START = "<!-- AGT:SKILLS_INDEX_START -->";
 var SKILLS_INDEX_END = "<!-- AGT:SKILLS_INDEX_END -->";
 function sanitizeSkillsIndexText(value) {
@@ -5943,12 +6045,12 @@ function parseSkillFrontmatter(content) {
 }
 async function refreshSkillsIndexInClaudeMd(configDir, codeName, log2) {
   const { readdirSync: readdirSync6, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync5 } = await import("fs");
-  const skillsDir = join11(configDir, codeName, "project", ".claude", "skills");
-  const claudeMdPath = join11(configDir, codeName, "project", "CLAUDE.md");
+  const skillsDir = join13(configDir, codeName, "project", ".claude", "skills");
+  const claudeMdPath = join13(configDir, codeName, "project", "CLAUDE.md");
   if (!ex(skillsDir) || !ex(claudeMdPath)) return;
   const entries = [];
   for (const dir of readdirSync6(skillsDir).sort()) {
-    const skillFile = join11(skillsDir, dir, "SKILL.md");
+    const skillFile = join13(skillsDir, dir, "SKILL.md");
     if (!ex(skillFile)) continue;
     try {
       const { name, description } = parseSkillFrontmatter(rfs(skillFile, "utf-8"));
@@ -5996,10 +6098,10 @@ ${SKILLS_INDEX_END}`;
 }
 async function migrateToProfiles() {
   const homeDir = process.env["HOME"] ?? "/tmp";
-  const sharedConfigPath = join11(homeDir, ".openclaw", "openclaw.json");
+  const sharedConfigPath = join13(homeDir, ".openclaw", "openclaw.json");
   let sharedConfig;
   try {
-    sharedConfig = JSON.parse(readFileSync10(sharedConfigPath, "utf-8"));
+    sharedConfig = JSON.parse(readFileSync11(sharedConfigPath, "utf-8"));
   } catch {
     return;
   }
@@ -6012,19 +6114,19 @@ async function migrateToProfiles() {
     const codeName = agentEntry["id"];
     if (!codeName) continue;
     if (codeName === "main") continue;
-    const profileDir = join11(homeDir, `.openclaw-${codeName}`);
-    if (existsSync5(join11(profileDir, "openclaw.json"))) continue;
+    const profileDir = join13(homeDir, `.openclaw-${codeName}`);
+    if (existsSync7(join13(profileDir, "openclaw.json"))) continue;
     log(`Migrating agent '${codeName}' to per-agent profile`);
     if (adapter.seedProfileConfig) {
       adapter.seedProfileConfig(codeName);
     }
-    const sharedAuthDir = join11(homeDir, ".openclaw", "agents", codeName, "agent");
-    const profileAuthDir = join11(profileDir, "agents", codeName, "agent");
-    const authFile = join11(sharedAuthDir, "auth-profiles.json");
-    if (existsSync5(authFile)) {
-      mkdirSync3(profileAuthDir, { recursive: true });
-      const authContent = readFileSync10(authFile, "utf-8");
-      writeFileSync4(join11(profileAuthDir, "auth-profiles.json"), authContent);
+    const sharedAuthDir = join13(homeDir, ".openclaw", "agents", codeName, "agent");
+    const profileAuthDir = join13(profileDir, "agents", codeName, "agent");
+    const authFile = join13(sharedAuthDir, "auth-profiles.json");
+    if (existsSync7(authFile)) {
+      mkdirSync4(profileAuthDir, { recursive: true });
+      const authContent = readFileSync11(authFile, "utf-8");
+      writeFileSync4(join13(profileAuthDir, "auth-profiles.json"), authContent);
     }
     allocatePort(codeName);
     migrated++;
@@ -6033,28 +6135,6 @@ async function migrateToProfiles() {
     log(`Migration complete: ${migrated} agent(s) migrated to per-agent profiles`);
   }
 }
-function resolveModelChain(refreshData) {
-  const agent = refreshData.agent;
-  const modelDefaults = refreshData.model_defaults;
-  const platform2 = modelDefaults?.platform ?? {};
-  const org = modelDefaults?.org ?? {};
-  function resolve(tier) {
-    const agentField = `${tier}_model`;
-    const platformField = `default_${tier}_model`;
-    const agentVal = agent?.[agentField];
-    if (agentVal) return agentVal;
-    const orgVal = org?.[platformField];
-    if (orgVal) return orgVal;
-    const platformVal = platform2?.[platformField];
-    if (platformVal) return platformVal;
-    return void 0;
-  }
-  return {
-    primary: resolve("primary"),
-    secondary: resolve("secondary"),
-    tertiary: resolve("tertiary")
-  };
-}
 function readGatewayToken(codeName) {
   const adapter = resolveAgentFramework(codeName);
   if (adapter.readGatewayToken) {
@@ -6062,7 +6142,7 @@ function readGatewayToken(codeName) {
   }
   const homeDir = process.env["HOME"] ?? "/tmp";
   try {
-    const cfg = JSON.parse(readFileSync10(join11(homeDir, `.openclaw-${codeName}`, "openclaw.json"), "utf-8"));
+    const cfg = JSON.parse(readFileSync11(join13(homeDir, `.openclaw-${codeName}`, "openclaw.json"), "utf-8"));
     return cfg?.gateway?.auth?.token;
   } catch {
     return void 0;
@@ -6071,10 +6151,10 @@ function readGatewayToken(codeName) {
 var GATEWAY_HUNG_TIMEOUT_MS = 5 * 6e4;
 function isGatewayHung(codeName) {
   const homeDir = process.env["HOME"] ?? "/tmp";
-  const jobsPath = join11(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
-  if (!existsSync5(jobsPath)) return false;
+  const jobsPath = join13(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
+  if (!existsSync7(jobsPath)) return false;
   try {
-    const data = JSON.parse(readFileSync10(jobsPath, "utf-8"));
+    const data = JSON.parse(readFileSync11(jobsPath, "utf-8"));
     const jobs = data.jobs ?? data;
     if (!Array.isArray(jobs)) return false;
     const now = Date.now();
@@ -6107,15 +6187,15 @@ async function ensureGatewayRunning(codeName, adapter) {
       }
       await new Promise((r) => setTimeout(r, 2e3));
       const homeDir = process.env["HOME"] ?? "/tmp";
-      const cronJobsPath = join11(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
+      const cronJobsPath = join13(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
       clearStaleCronRunState(cronJobsPath);
     } else {
       if (status.port) {
         try {
           const homeDir = process.env["HOME"] ?? "/tmp";
-          const configPath = join11(homeDir, `.openclaw-${codeName}`, "openclaw.json");
-          if (existsSync5(configPath)) {
-            const cfg = JSON.parse(readFileSync10(configPath, "utf-8"));
+          const configPath = join13(homeDir, `.openclaw-${codeName}`, "openclaw.json");
+          if (existsSync7(configPath)) {
+            const cfg = JSON.parse(readFileSync11(configPath, "utf-8"));
             if (cfg.gateway?.port !== status.port) {
               if (!cfg.gateway) cfg.gateway = {};
               cfg.gateway.port = status.port;
@@ -6139,9 +6219,9 @@ async function ensureGatewayRunning(codeName, adapter) {
     gatewaysStartedThisCycle.add(codeName);
     try {
       const homeDir = process.env["HOME"] ?? "/tmp";
-      const configPath = join11(homeDir, `.openclaw-${codeName}`, "openclaw.json");
-      if (existsSync5(configPath)) {
-        const cfg = JSON.parse(readFileSync10(configPath, "utf-8"));
+      const configPath = join13(homeDir, `.openclaw-${codeName}`, "openclaw.json");
+      if (existsSync7(configPath)) {
+        const cfg = JSON.parse(readFileSync11(configPath, "utf-8"));
         if (!cfg.gateway) cfg.gateway = {};
         cfg.gateway.port = port;
         writeFileSync4(configPath, JSON.stringify(cfg, null, 2));
@@ -6325,7 +6405,7 @@ async function pollCycle() {
         claudeAuth = await detectClaudeAuth();
       } catch (err) {
         const errText = err instanceof Error ? err.message : String(err);
-        const errId = createHash3("sha256").update(errText).digest("hex").slice(0, 12);
+        const errId = createHash4("sha256").update(errText).digest("hex").slice(0, 12);
         log(`Claude auth detection failed (error_id=${errId})`);
       }
       const hostHasClaudeCode = state6.agents.some(
@@ -6678,7 +6758,7 @@ async function pollCycle() {
         }
         killAgentChannelProcesses(prev.codeName, { log });
         freePort(prev.codeName);
-        const agentDir = join11(adapter.getAgentDir(prev.codeName), "provision");
+        const agentDir = join13(adapter.getAgentDir(prev.codeName), "provision");
         await cleanupAgentFiles(prev.codeName, agentDir);
         clearAgentCaches(prev.agentId, prev.codeName);
       }
@@ -6764,10 +6844,10 @@ async function pollCycle() {
         // pending-inbound marker. Best-effort: a write failure is logged by
         // the watchdog, never fails the poll cycle.
         signalGiveUp: (codeName) => {
-          const dir = join11(homedir5(), ".augmented", codeName);
-          if (!existsSync5(dir)) return;
+          const dir = join13(homedir7(), ".augmented", codeName);
+          if (!existsSync7(dir)) return;
           atomicWriteFileSync(
-            join11(dir, "watchdog-give-up.json"),
+            join13(dir, "watchdog-give-up.json"),
             JSON.stringify({ gave_up_at: (/* @__PURE__ */ new Date()).toISOString() })
           );
         }
@@ -6894,7 +6974,7 @@ async function processAgent(agent, agentStates) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const adapter = resolveAgentFramework(agent.code_name);
-  let agentDir = join11(adapter.getAgentDir(agent.code_name), "provision");
+  let agentDir = join13(adapter.getAgentDir(agent.code_name), "provision");
   if (agent.status === "draft" || agent.status === "paused") {
     if (previousKnownStatus !== agent.status) {
       log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
@@ -6946,7 +7026,7 @@ async function processAgent(agent, agentStates) {
       const residuals = {
         gatewayRunning: gatewayLiveness.running,
         portAllocated: Object.prototype.hasOwnProperty.call(ports, agent.code_name),
-        provisionDirExists: existsSync5(agentDir)
+        provisionDirExists: existsSync7(agentDir)
       };
       if (!hasRevokedResiduals(residuals)) {
         agentStates.push({
@@ -7098,7 +7178,7 @@ async function processAgent(agent, agentStates) {
   const frameworkId = refreshData.agent.framework ?? "openclaw";
   agentFrameworkCache.set(agent.code_name, frameworkId);
   const frameworkAdapter = getFramework(frameworkId);
-  agentDir = join11(frameworkAdapter.getAgentDir(agent.code_name), "provision");
+  agentDir = join13(frameworkAdapter.getAgentDir(agent.code_name), "provision");
   cacheAgentDeliveryMetadata(agent.code_name, refreshData);
   if (frameworkAdapter.migrateSecretStorage && !migratedSecretStorage.has(agent.code_name)) {
     try {
@@ -7139,9 +7219,9 @@ async function processAgent(agent, agentStates) {
   try {
     const artifacts = generateArtifacts(agent, refreshData, frameworkAdapter);
     const changedFiles = [];
-    mkdirSync3(agentDir, { recursive: true });
+    mkdirSync4(agentDir, { recursive: true });
     for (const artifact of artifacts) {
-      const filePath = join11(agentDir, artifact.relativePath);
+      const filePath = join13(agentDir, artifact.relativePath);
       let existingHash;
       let newHash;
       let writeContent = artifact.content;
@@ -7160,8 +7240,8 @@ async function processAgent(agent, agentStates) {
         };
         newHash = sha256(stripDynamicSections(artifact.content));
         try {
-          const projectClaudeMd = join11(config.configDir, agent.code_name, "project", "CLAUDE.md");
-          const existing = readFileSync10(projectClaudeMd, "utf-8");
+          const projectClaudeMd = join13(config.configDir, agent.code_name, "project", "CLAUDE.md");
+          const existing = readFileSync11(projectClaudeMd, "utf-8");
           existingHash = sha256(stripDynamicSections(existing));
         } catch {
           existingHash = null;
@@ -7179,7 +7259,7 @@ async function processAgent(agent, agentStates) {
         const generatorKeys = Object.keys(generatorServers);
         let existingRaw = "";
         try {
-          existingRaw = readFileSync10(filePath, "utf-8");
+          existingRaw = readFileSync11(filePath, "utf-8");
         } catch {
         }
         const existingServers = parseMcp(existingRaw);
@@ -7201,13 +7281,13 @@ async function processAgent(agent, agentStates) {
       }
     }
     if (changedFiles.length > 0) {
-      const isFirst = !existsSync5(join11(agentDir, "CHARTER.md"));
+      const isFirst = !existsSync7(join13(agentDir, "CHARTER.md"));
       const verb = isFirst ? "Provisioning" : "Updating";
       const fileNames = changedFiles.map((f) => f.relativePath).join(", ");
       log(`${verb} '${agent.code_name}': ${fileNames}`);
       for (const file of changedFiles) {
-        const filePath = join11(agentDir, file.relativePath);
-        mkdirSync3(dirname2(filePath), { recursive: true });
+        const filePath = join13(agentDir, file.relativePath);
+        mkdirSync4(dirname3(filePath), { recursive: true });
         if (file.relativePath === ".mcp.json") {
           safeWriteJsonAtomic(filePath, file.content, { mode: 384 });
         } else {
@@ -7215,12 +7295,12 @@ async function processAgent(agent, agentStates) {
         }
       }
       try {
-        const provSkillsDir = join11(agentDir, ".claude", "skills");
-        if (existsSync5(provSkillsDir)) {
+        const provSkillsDir = join13(agentDir, ".claude", "skills");
+        if (existsSync7(provSkillsDir)) {
           for (const folder of readdirSync5(provSkillsDir)) {
             if (folder.startsWith("knowledge-")) {
               try {
-                rmSync2(join11(provSkillsDir, folder), { recursive: true });
+                rmSync3(join13(provSkillsDir, folder), { recursive: true });
               } catch {
               }
             }
@@ -7233,7 +7313,7 @@ async function processAgent(agent, agentStates) {
       const trackedFiles2 = frameworkAdapter.driftTrackedFiles();
       const hashes = /* @__PURE__ */ new Map();
       for (const file of trackedFiles2) {
-        const h = hashFile(join11(agentDir, file));
+        const h = hashFile(join13(agentDir, file));
         if (h) hashes.set(file, h);
       }
       agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -7251,14 +7331,14 @@ async function processAgent(agent, agentStates) {
     }
     if (Array.isArray(refreshData.workflows)) {
       try {
-        const provWorkflowsDir = join11(agentDir, ".claude", "workflows");
-        if (existsSync5(provWorkflowsDir)) {
+        const provWorkflowsDir = join13(agentDir, ".claude", "workflows");
+        if (existsSync7(provWorkflowsDir)) {
           const expected = new Set(refreshData.workflows.map((w) => `${w.name}.js`));
           for (const file of readdirSync5(provWorkflowsDir)) {
             if (!file.endsWith(".js")) continue;
             if (expected.has(file)) continue;
             try {
-              rmSync2(join11(provWorkflowsDir, file));
+              rmSync3(join13(provWorkflowsDir, file));
             } catch {
             }
           }
@@ -7315,10 +7395,10 @@ async function processAgent(agent, agentStates) {
   }
   let lastDriftCheckAt = now;
   const written = agentState.writtenHashes.get(agent.agent_id);
-  if (written && existsSync5(agentDir)) {
+  if (written && existsSync7(agentDir)) {
     const driftedFiles = [];
     for (const [file, expectedHash] of written) {
-      const localHash = hashFile(join11(agentDir, file));
+      const localHash = hashFile(join13(agentDir, file));
       if (localHash && localHash !== expectedHash) {
         driftedFiles.push(file);
       }
@@ -7329,7 +7409,7 @@ async function processAgent(agent, agentStates) {
       try {
         const localHashes = {};
         for (const file of driftedFiles) {
-          localHashes[file] = hashFile(join11(agentDir, file));
+          localHashes[file] = hashFile(join13(agentDir, file));
         }
         await api.post("/host/drift", {
           agent_id: agent.agent_id,
@@ -7403,7 +7483,7 @@ async function processAgent(agent, agentStates) {
           const sessionModeForHash = refreshData.agent.session_mode;
           const senderPolicyForHash = refreshData.sender_policy ?? null;
           const CHANNEL_WRITE_VERSION = 9;
-          const configHash = createHash3("sha256").update(
+          const configHash = createHash4("sha256").update(
             canonicalJson({
               writeVersion: CHANNEL_WRITE_VERSION,
               config: entry.config,
@@ -7517,7 +7597,7 @@ async function processAgent(agent, agentStates) {
   if (channelConfigConverged) {
     const hasSenderPolicyChannel = currentChannelIds.has("slack") || currentChannelIds.has("msteams");
     const senderPolicyForRestartHash = refreshData.sender_policy ?? null;
-    const senderPolicyHash = createHash3("sha256").update(canonicalJson({ senderPolicy: senderPolicyForRestartHash })).digest("hex");
+    const senderPolicyHash = createHash4("sha256").update(canonicalJson({ senderPolicy: senderPolicyForRestartHash })).digest("hex");
     const prevSenderPolicyHash = agentState.knownSenderPolicyHashes.get(agent.agent_id);
     const senderPolicyDecision = hasSenderPolicyChannel ? decideSenderPolicyRestart({
       previousHash: prevSenderPolicyHash,
@@ -7559,7 +7639,7 @@ async function processAgent(agent, agentStates) {
       const behaviourSubset = extractMsTeamsBehaviourSubset(
         msteamsEntry?.config
       );
-      const behaviourHash = createHash3("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
+      const behaviourHash = createHash4("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
       const prevBehaviourHash = agentState.knownMsTeamsBehaviourHashes.get(agent.agent_id);
       const behaviourDecision = decideSenderPolicyRestart({
         previousHash: prevBehaviourHash,
@@ -7606,7 +7686,7 @@ async function processAgent(agent, agentStates) {
       const slackBehaviourSubset = extractSlackBehaviourSubset(
         slackEntry?.config
       );
-      const slackBehaviourHash = createHash3("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
+      const slackBehaviourHash = createHash4("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
       const prevSlackBehaviourHash = agentState.knownSlackBehaviourHashes.get(agent.agent_id);
       const slackBehaviourDecision = decideSenderPolicyRestart({
         previousHash: prevSlackBehaviourHash,
@@ -7653,24 +7733,24 @@ async function processAgent(agent, agentStates) {
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? "openclaw") === "claude-code") {
     try {
       const agentProvisionDir = agentDir;
-      const projectDir = join11(homedir5(), ".augmented", agent.code_name, "project");
-      mkdirSync3(agentProvisionDir, { recursive: true });
-      mkdirSync3(projectDir, { recursive: true });
-      const provisionMcpPath = join11(agentProvisionDir, ".mcp.json");
-      const projectMcpPath = join11(projectDir, ".mcp.json");
+      const projectDir = join13(homedir7(), ".augmented", agent.code_name, "project");
+      mkdirSync4(agentProvisionDir, { recursive: true });
+      mkdirSync4(projectDir, { recursive: true });
+      const provisionMcpPath = join13(agentProvisionDir, ".mcp.json");
+      const projectMcpPath = join13(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
       try {
-        mcpConfig = JSON.parse(readFileSync10(provisionMcpPath, "utf-8"));
+        mcpConfig = JSON.parse(readFileSync11(provisionMcpPath, "utf-8"));
         if (!mcpConfig.mcpServers) mcpConfig.mcpServers = {};
       } catch {
       }
-      const localDirectChatChannel = join11(homedir5(), ".augmented", "_mcp", "direct-chat-channel.js");
+      const localDirectChatChannel = join13(homedir7(), ".augmented", "_mcp", "direct-chat-channel.js");
       const directChatTeamSettings = refreshData.team?.settings;
       const directChatTz = (() => {
         const tz = directChatTeamSettings?.["timezone"];
         return typeof tz === "string" && tz.trim() !== "" ? tz.trim() : void 0;
       })();
-      if (existsSync5(localDirectChatChannel)) {
+      if (existsSync7(localDirectChatChannel)) {
         const directChatEnv = {
           AGT_HOST: requireHost(),
           // ENG-5901 Track D: templated — the manager exports the real
@@ -7694,10 +7774,10 @@ async function processAgent(agent, agentStates) {
           log(`Channel credentials written for '${agent.code_name}/direct-chat'`);
         }
       }
-      const staleChannelsPath = join11(projectDir, ".mcp-channels.json");
-      if (existsSync5(staleChannelsPath)) {
+      const staleChannelsPath = join13(projectDir, ".mcp-channels.json");
+      if (existsSync7(staleChannelsPath)) {
         try {
-          rmSync2(staleChannelsPath, { force: true });
+          rmSync3(staleChannelsPath, { force: true });
         } catch {
         }
       }
@@ -7759,7 +7839,7 @@ async function processAgent(agent, agentStates) {
     }
     if (process.env.AGT_CONNECTIVITY_PROBE_ENABLED === "true") {
       try {
-        const probeProjectDir = join11(homedir5(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join13(homedir7(), ".augmented", agent.code_name, "project");
         await runAgentConnectivityProbes(agent, integrations, probeProjectDir);
       } catch (err) {
         log(`Connectivity probe failed for '${agent.code_name}': ${err.message}`);
@@ -7777,11 +7857,11 @@ async function processAgent(agent, agentStates) {
         recordConfigChurnEvent(agent.agent_id, agent.code_name, FLAP_CHANNEL_INTEGRATIONS, intMembership);
       }
       if (intHash !== prevIntHash) {
-        const projectDir = join11(homedir5(), ".augmented", agent.code_name, "project");
-        const envIntPath = join11(projectDir, ".env.integrations");
+        const projectDir = join13(homedir7(), ".augmented", agent.code_name, "project");
+        const envIntPath = join13(projectDir, ".env.integrations");
         let preWriteEnv;
         try {
-          preWriteEnv = readFileSync10(envIntPath, "utf-8");
+          preWriteEnv = readFileSync11(envIntPath, "utf-8");
         } catch {
           preWriteEnv = void 0;
         }
@@ -7793,9 +7873,9 @@ async function processAgent(agent, agentStates) {
         let rotationHandled = true;
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
-            const projectMcpPath = join11(projectDir, ".mcp.json");
-            const postWriteEnv = readFileSync10(envIntPath, "utf-8");
-            const mcpContent = readFileSync10(projectMcpPath, "utf-8");
+            const projectMcpPath = join13(projectDir, ".mcp.json");
+            const postWriteEnv = readFileSync11(envIntPath, "utf-8");
+            const mcpContent = readFileSync11(projectMcpPath, "utf-8");
             const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
             const mcpJsonForReap = JSON.parse(mcpContent);
             const affectedServerKeys = findMcpServersUsingVars(mcpJsonForReap, changedVars);
@@ -7850,10 +7930,10 @@ async function processAgent(agent, agentStates) {
           desiredEntries.push({ serverId, url, headers: mcpHeaders, name: tk.toolkit_name });
         }
         const hashBasis = desiredEntries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => {
-          const headersHash = createHash3("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
+          const headersHash = createHash4("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
           return `${e.serverId}|${e.url}|${headersHash}`;
         }).join("\n");
-        const mcpHash = createHash3("sha256").update(hashBasis).digest("hex").slice(0, 16);
+        const mcpHash = createHash4("sha256").update(hashBasis).digest("hex").slice(0, 16);
         const prevMcpHash = agentState.knownManagedMcpHashes.get(agent.agent_id);
         const structureHash = managedMcpStructureHash(desiredEntries);
         const prevStructureHash = agentState.knownManagedMcpStructure.get(agent.agent_id);
@@ -7868,15 +7948,15 @@ async function processAgent(agent, agentStates) {
         if (mcpHash !== prevMcpHash) {
           for (const e of desiredEntries) {
             frameworkAdapter.writeMcpServer(agent.code_name, e.serverId, { url: e.url, headers: e.headers });
-            const urlHash = createHash3("sha256").update(e.url).digest("hex").slice(0, 12);
+            const urlHash = createHash4("sha256").update(e.url).digest("hex").slice(0, 12);
             log(`[managed-toolkit] ${agent.code_name}: wrote '${e.name}' (serverId=${e.serverId}, url_hash=${urlHash})`);
           }
           if (frameworkAdapter.removeMcpServer && frameworkAdapter.getMcpPath) {
             const mcpPath = frameworkAdapter.getMcpPath(agent.code_name);
             if (mcpPath) {
               try {
-                const { readFileSync: readFileSync11 } = await import("fs");
-                const mcpConfig = JSON.parse(readFileSync11(mcpPath, "utf-8"));
+                const { readFileSync: readFileSync12 } = await import("fs");
+                const mcpConfig = JSON.parse(readFileSync12(mcpPath, "utf-8"));
                 if (mcpConfig.mcpServers) {
                   const managedPrefixes = [
                     "composio_",
@@ -7977,8 +8057,8 @@ async function processAgent(agent, agentStates) {
   if (agent.status === "active") {
     if (frameworkAdapter.installPlugin) {
       try {
-        const pluginPath = join11(process.cwd(), "packages", "openclaw-plugin-augmented", "src", "index.ts");
-        if (existsSync5(pluginPath)) {
+        const pluginPath = join13(process.cwd(), "packages", "openclaw-plugin-augmented", "src", "index.ts");
+        if (existsSync7(pluginPath)) {
           frameworkAdapter.installPlugin(agent.code_name, "augmented", pluginPath, {
             agtHost: requireHost(),
             agtApiKey: getApiKey() ?? void 0,
@@ -8002,7 +8082,7 @@ async function processAgent(agent, agentStates) {
     if (frameworkAdapter.installSkillFiles) {
       const currentIntegrationSkillIds = /* @__PURE__ */ new Set();
       const installedIntegrationSkills = [];
-      const { createHash: createHash4 } = await import("crypto");
+      const { createHash: createHash5 } = await import("crypto");
       const refreshAny = refreshData;
       const contexts = refreshAny.integration_contexts ?? refreshAny.plugin_contexts ?? [];
       const contextBySlug = /* @__PURE__ */ new Map();
@@ -8031,7 +8111,7 @@ async function processAgent(agent, agentStates) {
             )
           }));
           const bundle = buildIntegrationBundle(renderedScopes);
-          const contentHash = createHash4("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
+          const contentHash = createHash5("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
           const hashKey = `plugin-skill:${agent.agent_id}:${integrationSkillId}`;
           if (agentState.knownSkillHashes.get(hashKey) === contentHash) continue;
           frameworkAdapter.installSkillFiles(agent.code_name, integrationSkillId, bundle.files);
@@ -8043,21 +8123,21 @@ async function processAgent(agent, agentStates) {
         }
       }
       try {
-        const { readdirSync: readdirSync6, rmSync: rmSync3 } = await import("fs");
-        const { homedir: homedir6 } = await import("os");
+        const { readdirSync: readdirSync6, rmSync: rmSync4 } = await import("fs");
+        const { homedir: homedir8 } = await import("os");
         const frameworkId2 = frameworkAdapter.id;
         const candidateSkillDirs = [
           // Claude Code — framework runtime tree
-          join11(homedir6(), ".augmented", agent.code_name, "skills"),
+          join13(homedir8(), ".augmented", agent.code_name, "skills"),
           // Claude Code — project tree
-          join11(homedir6(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+          join13(homedir8(), ".augmented", agent.code_name, "project", ".claude", "skills"),
           // OpenClaw — framework runtime tree
-          join11(homedir6(), `.openclaw-${agent.code_name}`, "skills"),
+          join13(homedir8(), `.openclaw-${agent.code_name}`, "skills"),
           // Defensive: legacy provision-side path, not currently an
           // install target but cheap to sweep.
-          join11(agentDir, ".claude", "skills")
+          join13(agentDir, ".claude", "skills")
         ];
-        const existingDirs = candidateSkillDirs.filter((d) => existsSync5(d));
+        const existingDirs = candidateSkillDirs.filter((d) => existsSync7(d));
         const discoveredEntries = /* @__PURE__ */ new Set();
         for (const dir of existingDirs) {
           try {
@@ -8071,9 +8151,9 @@ async function processAgent(agent, agentStates) {
         }
         const removeSkillFolder = (entry, reason) => {
           for (const dir of existingDirs) {
-            const p = join11(dir, entry);
-            if (existsSync5(p)) {
-              rmSync3(p, { recursive: true, force: true });
+            const p = join13(dir, entry);
+            if (existsSync7(p)) {
+              rmSync4(p, { recursive: true, force: true });
             }
           }
           log(`Removed ${reason} '${entry}' for '${agent.code_name}' (framework=${frameworkId2})`);
@@ -8090,7 +8170,7 @@ async function processAgent(agent, agentStates) {
         const plan = planGlobalSkillSync(
           refreshAny.global_skills ?? [],
           agentState.knownGlobalSkillIds.get(agent.agent_id) ?? /* @__PURE__ */ new Set(),
-          (content) => createHash4("sha256").update(content).digest("hex").slice(0, 12),
+          (content) => createHash5("sha256").update(content).digest("hex").slice(0, 12),
           (skillId) => agentState.knownSkillHashes.get(`global-skill:${agent.agent_id}:${skillId}`)
         );
         for (const { skillId, content, hash } of plan.installs) {
@@ -8099,18 +8179,18 @@ async function processAgent(agent, agentStates) {
           log(`Installed global skill '${skillId}' for '${agent.code_name}'`);
         }
         if (plan.removes.length) {
-          const { rmSync: rmSync3 } = await import("fs");
-          const { homedir: homedir6 } = await import("os");
+          const { rmSync: rmSync4 } = await import("fs");
+          const { homedir: homedir8 } = await import("os");
           const globalSkillDirs = [
-            join11(homedir6(), ".augmented", agent.code_name, "skills"),
-            join11(homedir6(), ".augmented", agent.code_name, "project", ".claude", "skills"),
-            join11(homedir6(), `.openclaw-${agent.code_name}`, "skills"),
-            join11(agentDir, ".claude", "skills")
+            join13(homedir8(), ".augmented", agent.code_name, "skills"),
+            join13(homedir8(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+            join13(homedir8(), `.openclaw-${agent.code_name}`, "skills"),
+            join13(agentDir, ".claude", "skills")
           ];
           for (const id of plan.removes) {
             for (const dir of globalSkillDirs) {
-              const p = join11(dir, id);
-              if (existsSync5(p)) rmSync3(p, { recursive: true, force: true });
+              const p = join13(dir, id);
+              if (existsSync7(p)) rmSync4(p, { recursive: true, force: true });
             }
             agentState.knownSkillHashes.delete(`global-skill:${agent.agent_id}:${id}`);
             log(`Removed unpublished global skill '${id}' for '${agent.code_name}'`);
@@ -8134,7 +8214,7 @@ async function processAgent(agent, agentStates) {
           const slug = hook.integration_slug ?? hook.plugin_slug;
           if (!slug) continue;
           try {
-            const scriptHash = createHash4("sha256").update(hook.script).digest("hex").slice(0, 12);
+            const scriptHash = createHash5("sha256").update(hook.script).digest("hex").slice(0, 12);
             const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${slug}:on_install`;
             if (agentState.knownSkillHashes.get(hookKey) === scriptHash) continue;
             const result = await frameworkAdapter.executePluginHook({
@@ -8149,9 +8229,9 @@ async function processAgent(agent, agentStates) {
             } else if (result.timedOut) {
               log(`Integration hook on_install '${slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
             } else {
-              const stderrHash = createHash4("sha256").update(result.stderr).digest("hex").slice(0, 12);
+              const stderrHash = createHash5("sha256").update(result.stderr).digest("hex").slice(0, 12);
               const missingCmd = result.exitCode === 127 ? extractCommandNotFound(result.stderr) : null;
-              const missingCmdHash = missingCmd ? createHash4("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
+              const missingCmdHash = missingCmd ? createHash5("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
               log(
                 `Integration hook on_install '${slug}' exited ${result.exitCode} for '${agent.code_name}' ` + (missingCmdHash ? `[missing_command_hash=${missingCmdHash}] ` : "") + `[stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
               );
@@ -8285,8 +8365,8 @@ async function processAgent(agent, agentStates) {
       const sess = getSessionState(agent.code_name);
       let mcpJsonParsed = null;
       try {
-        const mcpPath = join11(getProjectDir(agent.code_name), ".mcp.json");
-        mcpJsonParsed = JSON.parse(readFileSync10(mcpPath, "utf-8"));
+        const mcpPath = join13(getProjectDir(agent.code_name), ".mcp.json");
+        mcpJsonParsed = JSON.parse(readFileSync11(mcpPath, "utf-8"));
       } catch {
       }
       reapMissingMcpSessions({
@@ -8420,10 +8500,10 @@ async function processAgent(agent, agentStates) {
   } else if (agentFw === "claude-code" && tasks.length > 0) {
     await syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData);
   } else if (frameworkAdapter.syncScheduledTasks && gatewayRunning && gatewayPort) {
-    const stableTasksHash = createHash3("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
-    const boardHash = boardItems.length > 0 ? createHash3("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
+    const stableTasksHash = createHash4("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+    const boardHash = boardItems.length > 0 ? createHash4("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
     const resolvedModels = resolveModelChain(refreshData);
-    const modelsHash = createHash3("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
+    const modelsHash = createHash4("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
     const combinedHash = `${stableTasksHash}:${boardHash}:${modelsHash}`;
     const prevTasksHash = agentState.knownTasksHashes.get(agent.agent_id);
     if (combinedHash !== prevTasksHash) {
@@ -8495,10 +8575,10 @@ async function processAgent(agent, agentStates) {
         lastWorkTriggerAt.set(agent.code_name, triggerTs);
         if (agentFw === "openclaw" && gatewayRunning && gatewayPort) {
           const homeDir = process.env["HOME"] ?? "/tmp";
-          const jobsPath = join11(homeDir, `.openclaw-${agent.code_name}`, "cron", "jobs.json");
-          if (existsSync5(jobsPath)) {
+          const jobsPath = join13(homeDir, `.openclaw-${agent.code_name}`, "cron", "jobs.json");
+          if (existsSync7(jobsPath)) {
             try {
-              const jobsData = JSON.parse(readFileSync10(jobsPath, "utf-8"));
+              const jobsData = JSON.parse(readFileSync11(jobsPath, "utf-8"));
               const kanbanJob = (jobsData.jobs ?? []).find(
                 (j) => typeof j.name === "string" && j.name.includes("kanban-work")
               );
@@ -8632,10 +8712,10 @@ In progress for ${age} minutes \u2014 auto-failed`).catch(() => {
     }
   }
   const trackedFiles = frameworkAdapter.driftTrackedFiles();
-  if (trackedFiles.length > 0 && existsSync5(agentDir)) {
+  if (trackedFiles.length > 0 && existsSync7(agentDir)) {
     const hashes = /* @__PURE__ */ new Map();
     for (const file of trackedFiles) {
-      const h = hashFile(join11(agentDir, file));
+      const h = hashFile(join13(agentDir, file));
       if (h) hashes.set(file, h);
     }
     agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -8669,19 +8749,19 @@ function cleanupStaleSessions(codeName) {
   lastCleanupAt.set(codeName, Date.now());
   const homeDir = process.env["HOME"] ?? "/tmp";
   for (const agentDir of ["main", codeName]) {
-    const sessionsDir = join11(homeDir, `.openclaw-${codeName}`, "agents", agentDir, "sessions");
+    const sessionsDir = join13(homeDir, `.openclaw-${codeName}`, "agents", agentDir, "sessions");
     cleanupCronSessions(sessionsDir, CRON_SESSION_KEEP_COUNT);
   }
-  const cronRunsDir = join11(homeDir, `.openclaw-${codeName}`, "cron", "runs");
+  const cronRunsDir = join13(homeDir, `.openclaw-${codeName}`, "cron", "runs");
   cleanupOldFiles(cronRunsDir, CRON_RUN_RETENTION_DAYS, ".jsonl");
-  const cronJobsPath = join11(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
+  const cronJobsPath = join13(homeDir, `.openclaw-${codeName}`, "cron", "jobs.json");
   clearStaleCronRunState(cronJobsPath);
 }
 function cleanupCronSessions(sessionsDir, keepCount) {
-  const indexPath = join11(sessionsDir, "sessions.json");
-  if (!existsSync5(indexPath)) return;
+  const indexPath = join13(sessionsDir, "sessions.json");
+  if (!existsSync7(indexPath)) return;
   try {
-    const raw = readFileSync10(indexPath, "utf-8");
+    const raw = readFileSync11(indexPath, "utf-8");
     const index = JSON.parse(raw);
     const cronRunKeys = Object.keys(index).filter((k) => k.includes(":cron:") && k.includes(":run:")).map((k) => ({
       key: k,
@@ -8694,9 +8774,9 @@ function cleanupCronSessions(sessionsDir, keepCount) {
     for (const entry of toDelete) {
       delete index[entry.key];
       if (entry.sessionId) {
-        const sessionFile = join11(sessionsDir, `${entry.sessionId}.jsonl`);
+        const sessionFile = join13(sessionsDir, `${entry.sessionId}.jsonl`);
         try {
-          if (existsSync5(sessionFile)) {
+          if (existsSync7(sessionFile)) {
             unlinkSync(sessionFile);
             deletedFiles++;
           }
@@ -8716,8 +8796,8 @@ function cleanupCronSessions(sessionsDir, keepCount) {
         delete index[parentKey];
         if (parentSessionId) {
           try {
-            const f = join11(sessionsDir, `${parentSessionId}.jsonl`);
-            if (existsSync5(f)) {
+            const f = join13(sessionsDir, `${parentSessionId}.jsonl`);
+            if (existsSync7(f)) {
               unlinkSync(f);
               deletedFiles++;
             }
@@ -8735,9 +8815,9 @@ function cleanupCronSessions(sessionsDir, keepCount) {
 }
 var STALE_RUN_TIMEOUT_MS = 5 * 6e4;
 function clearStaleCronRunState(jobsPath) {
-  if (!existsSync5(jobsPath)) return;
+  if (!existsSync7(jobsPath)) return;
   try {
-    const raw = readFileSync10(jobsPath, "utf-8");
+    const raw = readFileSync11(jobsPath, "utf-8");
     const data = JSON.parse(raw);
     const jobs = data.jobs ?? data;
     if (!Array.isArray(jobs)) return;
@@ -8768,13 +8848,13 @@ function clearStaleCronRunState(jobsPath) {
   }
 }
 function cleanupOldFiles(dir, maxAgeDays, ext) {
-  if (!existsSync5(dir)) return;
+  if (!existsSync7(dir)) return;
   const cutoff = Date.now() - maxAgeDays * 24 * 60 * 60 * 1e3;
   let removed = 0;
   try {
     for (const f of readdirSync5(dir)) {
       if (!f.endsWith(ext)) continue;
-      const fullPath = join11(dir, f);
+      const fullPath = join13(dir, f);
       try {
         const st = statSync4(fullPath);
         if (st.mtimeMs < cutoff) {
@@ -8814,7 +8894,7 @@ var inFlightClaudeTasks = /* @__PURE__ */ new Set();
 var claudeTaskConcurrency = /* @__PURE__ */ new Map();
 var MAX_CLAUDE_CONCURRENCY = 2;
 function claudePidFilePath() {
-  return join11(homedir5(), ".augmented", "manager-claude-pids.json");
+  return join13(homedir7(), ".augmented", "manager-claude-pids.json");
 }
 var inFlightClaudePids = /* @__PURE__ */ new Map();
 function registerClaudeSpawn(record) {
@@ -8835,10 +8915,10 @@ function unregisterClaudeSpawn(pid) {
 var claudeSchedulerStates = /* @__PURE__ */ new Map();
 async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
-  const stableTasksHash = createHash3("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
-  const boardHash = boardItems.length > 0 ? createHash3("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
+  const stableTasksHash = createHash4("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const boardHash = boardItems.length > 0 ? createHash4("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
   const resolvedModels = resolveModelChain(refreshData);
-  const modelsHash = createHash3("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
+  const modelsHash = createHash4("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
   const combinedHash = `${stableTasksHash}:${boardHash}:${modelsHash}`;
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (combinedHash !== prevHash) {
@@ -8904,7 +8984,7 @@ async function startRun(opts) {
     return { run_id: res.run_id ?? null, kanban_item_id: res.kanban_item_id ?? null };
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash3("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash4("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] start failed for agent_id=${opts.agent_id} source_type=${opts.source_type} error_id=${errId}`);
     return { run_id: null, kanban_item_id: null };
   }
@@ -8921,7 +9001,7 @@ async function finishRun(runId, outcome, options = {}) {
     });
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash3("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash4("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] finish failed for run_id=${runId} outcome=${outcome} error_id=${errId}`);
   }
 }
@@ -8938,7 +9018,7 @@ async function fetchPriorScheduledRuns(agentId, taskId) {
     return rows.filter((r) => typeof r.output_text === "string" && r.output_text.length > 0).map((r) => ({ startedAt: r.started_at, output: r.output_text }));
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash3("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash4("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] prior-runs lookup failed for task_id=${taskId} error_id=${errId}`);
     return [];
   }
@@ -9154,7 +9234,7 @@ async function fireScheduledTaskViaKanban(codeName, agentId, task, prompt) {
 }
 async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
   const projectDir = getProjectDir2(codeName);
-  const mcpConfigPath = join11(projectDir, ".mcp.json");
+  const mcpConfigPath = join13(projectDir, ".mcp.json");
   let runId = null;
   let kanbanItemId = null;
   let taskResult;
@@ -9162,11 +9242,11 @@ async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
   const priorRuns = await fetchPriorScheduledRuns(agentId, task.taskId);
   prompt = wrapScheduledTaskPrompt(prompt, { priorRuns });
   try {
-    const claudeMdPath = join11(projectDir, "CLAUDE.md");
+    const claudeMdPath = join13(projectDir, "CLAUDE.md");
     const serverNames = [];
-    if (existsSync5(mcpConfigPath)) {
+    if (existsSync7(mcpConfigPath)) {
       try {
-        const d = JSON.parse(readFileSync10(mcpConfigPath, "utf-8"));
+        const d = JSON.parse(readFileSync11(mcpConfigPath, "utf-8"));
         if (d.mcpServers) serverNames.push(...Object.keys(d.mcpServers));
       } catch {
       }
@@ -9185,14 +9265,14 @@ async function executeAndProcessClaudeTask(codeName, agentId, task, prompt) {
       "--allowedTools",
       allowedTools
     ];
-    if (existsSync5(claudeMdPath)) {
+    if (existsSync7(claudeMdPath)) {
       claudeArgs.push("--system-prompt-file", claudeMdPath);
     }
     const childEnv = { ...process.env };
-    const envIntPath = join11(projectDir, ".env.integrations");
-    if (existsSync5(envIntPath)) {
+    const envIntPath = join13(projectDir, ".env.integrations");
+    if (existsSync7(envIntPath)) {
       try {
-        Object.assign(childEnv, parseEnvIntegrations(readFileSync10(envIntPath, "utf-8")));
+        Object.assign(childEnv, parseEnvIntegrations(readFileSync11(envIntPath, "utf-8")));
       } catch {
       }
     }
@@ -9294,10 +9374,10 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
     const classification = classifyOutput(rawOutput);
     if (classification.action === "suppress") {
       const trimmed = (rawOutput ?? "").trim();
-      const outputHash = trimmed.length === 0 ? "empty" : createHash3("sha256").update(trimmed).digest("hex").slice(0, 12);
+      const outputHash = trimmed.length === 0 ? "empty" : createHash4("sha256").update(trimmed).digest("hex").slice(0, 12);
       log(`[claude-scheduler] Suppressing delivery for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 output_len=${trimmed.length} output_hash=${outputHash}`);
       if (classification.suppressedNotes) {
-        const notesHash = createHash3("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
+        const notesHash = createHash4("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
         log(`[claude-scheduler] Suppressed notes for '${codeName}' (task=${delivery?.taskId ?? "n/a"}) \u2014 notes_len=${classification.suppressedNotes.length} notes_hash=${notesHash}`);
       }
       if (delivery?.mode === "announce" && delivery.to) {
@@ -9364,8 +9444,8 @@ var claudeAuthTupleBySession = /* @__PURE__ */ new Map();
 async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
   const projectDir = getProjectDir(codeName);
-  const mcpConfigPath = join11(projectDir, ".mcp.json");
-  const claudeMdPath = join11(projectDir, "CLAUDE.md");
+  const mcpConfigPath = join13(projectDir, ".mcp.json");
+  const claudeMdPath = join13(projectDir, "CLAUDE.md");
   if (restartBreaker.isTripped(codeName)) {
     const trip = restartBreaker.getTrip(codeName);
     return {
@@ -9482,7 +9562,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       const ctx = getLastFailureContext(codeName);
       const recovery = prepareForRespawn(codeName);
       const tailSummary = !ctx.tail ? "" : KNOWN_SAFE_TAIL_SIGNATURES.has(ctx.signature) ? `; last pane output (${PANE_TAIL_PREVIEW_LINES} of ~20 lines):
-${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash3("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
+${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash4("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
       const sigSummary = ctx.signature !== "unknown" ? `; signature=${ctx.signature}` : "";
       const recoverySummary = recovery ? `; recovery=${recovery}` : "";
       log(
@@ -9496,7 +9576,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash3("sha256").
       );
       getHostId().then((hostId) => {
         if (!hostId) return;
-        const paneTailHash = zombie.paneTail ? `sha256:${createHash3("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
+        const paneTailHash = zombie.paneTail ? `sha256:${createHash4("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
         return api.post("/host/events", {
           host_id: hostId,
           agent_code_name: codeName,
@@ -9575,7 +9655,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash3("sha256").
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
   }
-  const stableTasksHash = createHash3("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const stableTasksHash = createHash4("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (stableTasksHash !== prevHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
@@ -9964,8 +10044,8 @@ async function processDirectChatMessage(agent, msg) {
   if (isSessionHealthy(agent.codeName)) {
     if (hostFlagStore().getBoolean("direct-chat-doorbell")) {
       try {
-        const doorbell = directChatDoorbellPath(agent.agentId, homedir5());
-        mkdirSync3(dirname2(doorbell), { recursive: true });
+        const doorbell = directChatDoorbellPath(agent.agentId, homedir7());
+        mkdirSync4(dirname3(doorbell), { recursive: true });
         writeFileSync4(doorbell, String(Date.now()));
         log(`[direct-chat] Doorbell rung for '${agent.codeName}' (msg=${msg.id}) \u2014 in-session MCP will pull via the cursor`);
         return;
@@ -10010,11 +10090,11 @@ ${escapeXml(msg.content)}
       log(`[direct-chat] One-shot spawn for '${agent.codeName}' (msg=${msg.id}; host in-flight=${directChatSpawnGate.hostInFlight}, queued=${directChatSpawnGate.queuedCount})`);
       const { getProjectDir: ccProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
       const projDir = ccProjectDir(agent.codeName);
-      const mcpConfigPath = join11(projDir, ".mcp.json");
+      const mcpConfigPath = join13(projDir, ".mcp.json");
       const serverNames = [];
-      if (existsSync5(mcpConfigPath)) {
+      if (existsSync7(mcpConfigPath)) {
         try {
-          const d = JSON.parse(readFileSync10(mcpConfigPath, "utf-8"));
+          const d = JSON.parse(readFileSync11(mcpConfigPath, "utf-8"));
           if (d.mcpServers) serverNames.push(...Object.keys(d.mcpServers));
         } catch {
         }
@@ -10033,15 +10113,15 @@ ${escapeXml(msg.content)}
         "--allowedTools",
         allowedTools
       ];
-      const chatClaudeMd = join11(projDir, "CLAUDE.md");
-      if (existsSync5(chatClaudeMd)) {
+      const chatClaudeMd = join13(projDir, "CLAUDE.md");
+      if (existsSync7(chatClaudeMd)) {
         chatArgs.push("--system-prompt-file", chatClaudeMd);
       }
-      const envIntPath = join11(projDir, ".env.integrations");
+      const envIntPath = join13(projDir, ".env.integrations");
       const childEnv = { ...process.env };
-      if (existsSync5(envIntPath)) {
+      if (existsSync7(envIntPath)) {
         try {
-          Object.assign(childEnv, parseEnvIntegrations(readFileSync10(envIntPath, "utf-8")));
+          Object.assign(childEnv, parseEnvIntegrations(readFileSync11(envIntPath, "utf-8")));
         } catch {
         }
       }
@@ -10101,7 +10181,7 @@ ${escapeXml(msg.content)}
     log(`[direct-chat] Reply sent for '${agent.codeName}'`);
   } catch (err) {
     const errMsg = err instanceof Error ? err.message : String(err);
-    const errorId = createHash3("sha256").update(errMsg).digest("hex").slice(0, 12);
+    const errorId = createHash4("sha256").update(errMsg).digest("hex").slice(0, 12);
     log(`[direct-chat] Failed to process message for '${agent.codeName}': error_id=${errorId} error=${errMsg.slice(0, 500)}`);
     try {
       await api.post("/host/direct-chat/reply", {
@@ -10419,12 +10499,12 @@ function getBuiltInSkillContent(skillId) {
   if (builtInSkillCache.has(skillId)) return builtInSkillCache.get(skillId);
   try {
     const candidates = [
-      join11(process.cwd(), "skills", skillId, "SKILL.md"),
-      join11(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "skills", skillId, "SKILL.md")
+      join13(process.cwd(), "skills", skillId, "SKILL.md"),
+      join13(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "skills", skillId, "SKILL.md")
     ];
     for (const candidate of candidates) {
-      if (existsSync5(candidate)) {
-        const content = readFileSync10(candidate, "utf-8");
+      if (existsSync7(candidate)) {
+        const content = readFileSync11(candidate, "utf-8");
         const files = [{ relativePath: "SKILL.md", content }];
         builtInSkillCache.set(skillId, files);
         return files;
@@ -10563,73 +10643,6 @@ function formatBoardForPrompt(items, template) {
   }
   return lines.join("\n");
 }
-async function execFilePromise(cmd, args) {
-  const { execFile: ef } = await import("child_process");
-  return new Promise((resolve, reject) => {
-    ef(cmd, args, { timeout: 15e3 }, (err, stdout, stderr) => {
-      if (err) reject(err);
-      else resolve({ stdout, stderr });
-    });
-  });
-}
-var ChildProcessError = class extends Error {
-  code;
-  stdout;
-  stderr;
-  constructor(code, stdout, stderr) {
-    const stderrSnippet = stderr.trim().slice(0, 500);
-    const stdoutSnippet = stdout.trim().slice(0, 500);
-    const detail = stderrSnippet || stdoutSnippet || "(no output)";
-    super(`Exit code ${code}: ${detail}`);
-    this.name = "ChildProcessError";
-    this.code = code;
-    this.stdout = stdout;
-    this.stderr = stderr;
-  }
-};
-async function execFilePromiseLong(cmd, args, opts) {
-  const { spawn: sp } = await import("child_process");
-  return new Promise((resolve, reject) => {
-    const child = sp(cmd, args, {
-      cwd: opts?.cwd,
-      stdio: [opts?.stdin === "ignore" ? "ignore" : "pipe", "pipe", "pipe"],
-      ...opts?.env ? { env: opts.env } : {}
-    });
-    if (opts?.onSpawn && typeof child.pid === "number") {
-      try {
-        opts.onSpawn(child.pid);
-      } catch {
-      }
-    }
-    let stdout = "";
-    let stderr = "";
-    child.stdout?.on("data", (d) => {
-      stdout += d.toString();
-    });
-    child.stderr?.on("data", (d) => {
-      stderr += d.toString();
-    });
-    const timer = setTimeout(() => {
-      child.kill();
-      reject(new Error(`Timed out after ${opts?.timeout ?? 12e4}ms`));
-    }, opts?.timeout ?? 12e4);
-    child.on("close", (code) => {
-      clearTimeout(timer);
-      if (opts?.onExit && typeof child.pid === "number") {
-        try {
-          opts.onExit(child.pid);
-        } catch {
-        }
-      }
-      if (code !== 0) reject(new ChildProcessError(code, stdout, stderr));
-      else resolve({ stdout, stderr });
-    });
-    child.on("error", (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-  });
-}
 var LATE_THRESHOLD_MS = 5 * 60 * 1e3;
 async function monitorCronHealth(agentStates) {
   const alerts = [];
@@ -11393,8 +11406,8 @@ function parseMemoryFile(raw, fallbackName) {
   };
 }
 async function syncMemories(agent, configDir, log2) {
-  const projectDir = join11(configDir, agent.code_name, "project");
-  const memoryDir = join11(projectDir, "memory");
+  const projectDir = join13(configDir, agent.code_name, "project");
+  const memoryDir = join13(projectDir, "memory");
   const isFreshSync = pendingFreshMemorySync.has(agent.agent_id);
   if (isFreshSync) {
     log2(`[memory-sync] Fresh-sync requested for '${agent.code_name}' \u2014 pulling DB first`);
@@ -11405,15 +11418,15 @@ async function syncMemories(agent, configDir, log2) {
     }
     pendingFreshMemorySync.delete(agent.agent_id);
   }
-  if (existsSync5(memoryDir)) {
+  if (existsSync7(memoryDir)) {
     const prevHashes = memoryFileHashes.get(agent.agent_id) ?? /* @__PURE__ */ new Map();
     const currentHashes = /* @__PURE__ */ new Map();
     const changedMemories = [];
     for (const file of readdirSync5(memoryDir)) {
       if (!file.endsWith(".md")) continue;
       try {
-        const raw = readFileSync10(join11(memoryDir, file), "utf-8");
-        const fileHash = createHash3("sha256").update(raw).digest("hex").slice(0, 16);
+        const raw = readFileSync11(join13(memoryDir, file), "utf-8");
+        const fileHash = createHash4("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
         const parsed = parseMemoryFile(raw, file.replace(/\.md$/, ""));
@@ -11437,7 +11450,7 @@ async function syncMemories(agent, configDir, log2) {
       } catch (err) {
         for (const mem of changedMemories) {
           for (const [file] of currentHashes) {
-            const parsed = parseMemoryFile(readFileSync10(join11(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
+            const parsed = parseMemoryFile(readFileSync11(join13(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
             if (parsed?.name === mem.name) currentHashes.delete(file);
           }
         }
@@ -11450,29 +11463,29 @@ async function syncMemories(agent, configDir, log2) {
   }
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
-  const localFiles = existsSync5(memoryDir) ? readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
-  const localListHash = createHash3("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
+  const localFiles = existsSync7(memoryDir) ? readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
+  const localListHash = createHash4("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
   try {
     const dbMemories = await api.post("/host/memories", {
       agent_id: agent.agent_id
     });
-    const responseHash = createHash3("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
+    const responseHash = createHash4("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
     if (!force && prevDownload && prevLocalHash === localListHash && lastDownloadHash.get(agent.agent_id) === responseHash) {
       return true;
     }
     lastDownloadHash.set(agent.agent_id, responseHash);
     lastLocalFileHash.set(agent.agent_id, localListHash);
     if (dbMemories.memories?.length) {
-      mkdirSync3(memoryDir, { recursive: true });
+      mkdirSync4(memoryDir, { recursive: true });
       let written = 0;
       let overwritten = 0;
       for (let i = 0; i < dbMemories.memories.length; i++) {
         const mem = dbMemories.memories[i];
         const rawSlug = mem.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "").slice(0, 60);
         const slug = rawSlug || `memory-${i}`;
-        const filePath = join11(memoryDir, `${slug}.md`);
+        const filePath = join13(memoryDir, `${slug}.md`);
         const desired = `---
 name: ${JSON.stringify(mem.name)}
 type: ${mem.type}
@@ -11481,10 +11494,10 @@ description: ${JSON.stringify(mem.content.slice(0, 200))}
 
 ${mem.content}
 `;
-        if (existsSync5(filePath)) {
+        if (existsSync7(filePath)) {
           let existing = "";
           try {
-            existing = readFileSync10(filePath, "utf-8");
+            existing = readFileSync11(filePath, "utf-8");
           } catch {
           }
           if (existing === desired) continue;
@@ -11497,7 +11510,7 @@ ${mem.content}
       }
       if (written > 0 || overwritten > 0) {
         const updatedFiles = readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort();
-        lastLocalFileHash.set(agent.agent_id, createHash3("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
+        lastLocalFileHash.set(agent.agent_id, createHash4("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
         log2(`Memory download for '${agent.code_name}': wrote ${written} new, overwrote ${overwritten} stale`);
       }
     }
@@ -11508,9 +11521,9 @@ ${mem.content}
   }
 }
 async function cleanupAgentFiles(codeName, agentDir) {
-  if (existsSync5(agentDir)) {
+  if (existsSync7(agentDir)) {
     try {
-      rmSync2(agentDir, { recursive: true, force: true });
+      rmSync3(agentDir, { recursive: true, force: true });
       log(`Removed provision directory for '${codeName}'`);
     } catch (err) {
       log(`Failed to remove provision dir for '${codeName}': ${err.message}`);
@@ -11738,8 +11751,8 @@ function startManager(opts) {
   config = opts;
   try {
     const stateFile = getStateFile();
-    if (existsSync5(stateFile)) {
-      const raw = readFileSync10(stateFile, "utf-8");
+    if (existsSync7(stateFile)) {
+      const raw = readFileSync11(stateFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.agents)) {
         state6.agents = parsed.agents;
@@ -11760,7 +11773,7 @@ function startManager(opts) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);
   }
   log(
-    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join11(homedir5(), ".augmented", "manager.log")}`
+    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join13(homedir7(), ".augmented", "manager.log")}`
   );
   deployMcpAssets();
   reapOrphanChannelMcps({ log });
@@ -11781,7 +11794,7 @@ async function reapOrphanedClaudePids() {
   const looksLikeClaude = (pid) => {
     if (process.platform !== "linux") return true;
     try {
-      const comm = readFileSync10(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
+      const comm = readFileSync11(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
       return comm.includes("claude");
     } catch {
       return false;
@@ -11891,18 +11904,18 @@ function restartRunningChannelMcps(basenames) {
   }
 }
 function deployMcpAssets() {
-  const targetDir = join11(homedir5(), ".augmented", "_mcp");
-  mkdirSync3(targetDir, { recursive: true });
-  const moduleDir = dirname2(fileURLToPath(import.meta.url));
+  const targetDir = join13(homedir7(), ".augmented", "_mcp");
+  mkdirSync4(targetDir, { recursive: true });
+  const moduleDir = dirname3(fileURLToPath(import.meta.url));
   let mcpSourceDir = "";
   let dir = moduleDir;
   for (let i = 0; i < 6; i++) {
-    const candidate = join11(dir, "dist", "mcp");
-    if (existsSync5(join11(candidate, "index.js"))) {
+    const candidate = join13(dir, "dist", "mcp");
+    if (existsSync7(join13(candidate, "index.js"))) {
       mcpSourceDir = candidate;
       break;
     }
-    const parent = dirname2(dir);
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -11913,8 +11926,8 @@ function deployMcpAssets() {
   const changedBasenames = [];
   const fileHash = (p) => {
     try {
-      if (!existsSync5(p)) return null;
-      return createHash3("sha256").update(readFileSync10(p)).digest("hex");
+      if (!existsSync7(p)) return null;
+      return createHash4("sha256").update(readFileSync11(p)).digest("hex");
     } catch {
       return null;
     }
@@ -11941,9 +11954,9 @@ function deployMcpAssets() {
     // natural session restart.
     "augmented-admin.js"
   ]) {
-    const src = join11(mcpSourceDir, file);
-    const dst = join11(targetDir, file);
-    if (!existsSync5(src)) continue;
+    const src = join13(mcpSourceDir, file);
+    const dst = join13(targetDir, file);
+    if (!existsSync7(src)) continue;
     const before = fileHash(dst);
     try {
       copyFileSync(src, dst);
@@ -11960,16 +11973,16 @@ function deployMcpAssets() {
     log(`[manager] Bundle(s) updated: ${changedBasenames.join(", ")} \u2014 signalling running instances to restart`);
     restartRunningChannelMcps(changedBasenames);
   }
-  const localMcpPath = join11(targetDir, "index.js");
+  const localMcpPath = join13(targetDir, "index.js");
   try {
-    const agentsDir = join11(homedir5(), ".augmented", "agents");
-    if (existsSync5(agentsDir)) {
+    const agentsDir = join13(homedir7(), ".augmented", "agents");
+    if (existsSync7(agentsDir)) {
       for (const entry of readdirSync5(agentsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         for (const subdir of ["provision", "project"]) {
-          const mcpJsonPath = join11(agentsDir, entry.name, subdir, ".mcp.json");
+          const mcpJsonPath = join13(agentsDir, entry.name, subdir, ".mcp.json");
           try {
-            const raw = readFileSync10(mcpJsonPath, "utf-8");
+            const raw = readFileSync11(mcpJsonPath, "utf-8");
             if (!raw.includes("@integrity-labs/augmented-mcp")) continue;
             const mcpConfig = JSON.parse(raw);
             const augServer = mcpConfig.mcpServers?.["augmented"];
@@ -12012,7 +12025,6 @@ process.on("disconnect", () => {
 });
 export {
   BACK_ONLINE_GREETING_GUIDANCE,
-  ChildProcessError,
   SCHEDULED_CARD_DELIVERY_CONTRACT,
   __resetScheduledDeliveryDedupeForTest,
   __setAgentChannelTokensForTest,