@integrity-labs/agt-cli 0.28.207 → 0.28.209

package/dist/chunk-GWBOA7ZY.js

@@ -1,1634 +0,0 @@
-import {
-  claudeModelAlias,
-  formatMissingVar,
-  isClaudeFastMode,
-  probeMcpEnvSubstitution
-} from "./chunk-ELBYWACS.js";
-import {
-  reapOrphanChannelMcps
-} from "./chunk-XWVM4KPK.js";
-
-// src/lib/persistent-session.ts
-import { spawn, execSync, execFileSync as execFileSync3 } from "child_process";
-import { join as join2, dirname } from "path";
-import { homedir as homedir2, platform, userInfo } from "os";
-import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync as writeFileSync3, appendFileSync, mkdirSync as mkdirSync2, chmodSync, copyFileSync, rmSync } from "fs";
-
-// src/lib/mcp-sanitize.ts
-import { readFileSync, writeFileSync } from "fs";
-function sanitizeMcpJson(mcpConfigPath, apiHost) {
-  try {
-    const mcpRaw = JSON.parse(readFileSync(mcpConfigPath, "utf-8"));
-    const servers = mcpRaw.mcpServers;
-    if (!servers) return false;
-    let changed = false;
-    for (const [key, val] of Object.entries(servers)) {
-      if (typeof val?.url !== "string") continue;
-      if (val.url.startsWith("/")) {
-        if (apiHost) {
-          val.url = `${apiHost}${val.url}`;
-          changed = true;
-        } else {
-          delete servers[key];
-          changed = true;
-          continue;
-        }
-      }
-      const headers = val.headers;
-      if (headers && typeof headers === "object" && Object.keys(headers).length > 0) {
-        if (typeof val.type !== "string") {
-          val.type = "http";
-          changed = true;
-        }
-        continue;
-      }
-      const url = val.url;
-      delete val.url;
-      delete val.type;
-      val.command = "npx";
-      val.args = ["-y", "mcp-remote", url, "--allow-http"];
-      changed = true;
-    }
-    if (changed) writeFileSync(mcpConfigPath, JSON.stringify(mcpRaw, null, 2));
-    return changed;
-  } catch {
-    return false;
-  }
-}
-
-// src/lib/claude-tools.ts
-var BASE_TOOLS = ["Bash", "Read", "Write", "Edit", "Grep", "Glob", "Agent", "Skill", "ToolSearch"];
-function buildAllowedTools(mcpServerNames) {
-  const mcpPatterns = mcpServerNames.map((name) => `mcp__${name.replace(/-/g, "_")}__*`);
-  return [...mcpPatterns, ...BASE_TOOLS].join(",");
-}
-
-// src/lib/persistent-session.ts
-import { randomUUID as randomUUID2 } from "crypto";
-
-// src/lib/daily-session.ts
-import { randomUUID } from "crypto";
-import { existsSync, mkdirSync, readFileSync as readFileSync2, readdirSync, renameSync, statSync, writeFileSync as writeFileSync2 } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-var HISTORY_DAYS = 7;
-function profileDir(codeName) {
-  return join(homedir(), ".augmented", codeName);
-}
-function dailySessionPath(codeName) {
-  return join(profileDir(codeName), "daily-session.json");
-}
-function todayLocalIso(now = /* @__PURE__ */ new Date(), timezone) {
-  if (timezone) {
-    try {
-      const fmt = new Intl.DateTimeFormat("en-CA", {
-        timeZone: timezone,
-        year: "numeric",
-        month: "2-digit",
-        day: "2-digit"
-      });
-      return fmt.format(now);
-    } catch {
-    }
-  }
-  const y = now.getFullYear();
-  const m = String(now.getMonth() + 1).padStart(2, "0");
-  const d = String(now.getDate()).padStart(2, "0");
-  return `${y}-${m}-${d}`;
-}
-function readFile(codeName) {
-  const path = dailySessionPath(codeName);
-  if (!existsSync(path)) return { current: null, history: [] };
-  try {
-    const raw = readFileSync2(path, "utf-8");
-    const parsed = JSON.parse(raw);
-    return {
-      current: parsed.current ?? null,
-      history: Array.isArray(parsed.history) ? parsed.history : []
-    };
-  } catch {
-    return { current: null, history: [] };
-  }
-}
-function writeFile(codeName, data) {
-  const dir = profileDir(codeName);
-  mkdirSync(dir, { recursive: true });
-  const finalPath = dailySessionPath(codeName);
-  const tmpPath = `${finalPath}.${process.pid}.${randomUUID()}.tmp`;
-  writeFileSync2(tmpPath, JSON.stringify(data, null, 2), "utf-8");
-  renameSync(tmpPath, finalPath);
-}
-function trimHistory(history, now, timezone) {
-  const cutoff = new Date(now);
-  cutoff.setDate(cutoff.getDate() - HISTORY_DAYS);
-  const cutoffIso = todayLocalIso(cutoff, timezone);
-  return history.filter((h) => h.date >= cutoffIso).slice(0, HISTORY_DAYS);
-}
-function getOrCreateDailySession(codeName, now = /* @__PURE__ */ new Date(), timezone) {
-  const today = todayLocalIso(now, timezone);
-  const file = readFile(codeName);
-  if (file.current && file.current.date === today) {
-    return { sessionId: file.current.sessionId, isNew: false };
-  }
-  const next = {
-    date: today,
-    sessionId: randomUUID(),
-    startedAt: now.toISOString()
-  };
-  const history = trimHistory(
-    [...file.current ? [file.current] : [], ...file.history],
-    now,
-    timezone
-  );
-  writeFile(codeName, { current: next, history });
-  return { sessionId: next.sessionId, isNew: true };
-}
-function markDailySessionSpawn(codeName, sessionId, now = /* @__PURE__ */ new Date(), timezone) {
-  const today = todayLocalIso(now, timezone);
-  const file = readFile(codeName);
-  if (file.current && file.current.date === today && file.current.sessionId === sessionId) {
-    return;
-  }
-  const next = {
-    date: today,
-    sessionId,
-    startedAt: now.toISOString()
-  };
-  const history = trimHistory(
-    [...file.current ? [file.current] : [], ...file.history],
-    now,
-    timezone
-  );
-  writeFile(codeName, { current: next, history });
-}
-function rotateDailySession(codeName, now = /* @__PURE__ */ new Date(), timezone) {
-  const today = todayLocalIso(now, timezone);
-  const file = readFile(codeName);
-  const next = {
-    date: today,
-    sessionId: randomUUID(),
-    startedAt: now.toISOString()
-  };
-  const history = trimHistory(
-    [...file.current ? [file.current] : [], ...file.history],
-    now,
-    timezone
-  );
-  writeFile(codeName, { current: next, history });
-  return next.sessionId;
-}
-function encodeProjectPath(projectDir) {
-  return "-" + projectDir.replace(/^\//, "").replace(/[/.]/g, "-");
-}
-function sessionFileExists(projectDir, sessionId) {
-  const path = join(
-    homedir(),
-    ".claude",
-    "projects",
-    encodeProjectPath(projectDir),
-    `${sessionId}.jsonl`
-  );
-  return existsSync(path);
-}
-function sessionTranscriptDir(projectDir) {
-  return join(homedir(), ".claude", "projects", encodeProjectPath(projectDir));
-}
-function sessionFilePath(projectDir, sessionId) {
-  return join(sessionTranscriptDir(projectDir), `${sessionId}.jsonl`);
-}
-function transcriptActivityAgeSeconds(projectDir, sessionId, now = /* @__PURE__ */ new Date()) {
-  if (!sessionId) return null;
-  try {
-    const mtimeMs = statSync(sessionFilePath(projectDir, sessionId)).mtimeMs;
-    return Math.max(0, Math.floor((now.getTime() - mtimeMs) / 1e3));
-  } catch {
-    return null;
-  }
-}
-function subagentActivityAgeSeconds(projectDir, sessionId, now = /* @__PURE__ */ new Date()) {
-  if (!sessionId) return null;
-  const dir = join(sessionTranscriptDir(projectDir), sessionId, "subagents");
-  try {
-    let freshestMtimeMs = null;
-    for (const name of readdirSync(dir)) {
-      if (!name.endsWith(".jsonl")) continue;
-      try {
-        const mtimeMs = statSync(join(dir, name)).mtimeMs;
-        if (freshestMtimeMs === null || mtimeMs > freshestMtimeMs) freshestMtimeMs = mtimeMs;
-      } catch {
-      }
-    }
-    if (freshestMtimeMs === null) return null;
-    return Math.max(0, Math.floor((now.getTime() - freshestMtimeMs) / 1e3));
-  } catch {
-    return null;
-  }
-}
-function isAgentIdle(projectDir, sessionId, idleSeconds = 60, now = /* @__PURE__ */ new Date()) {
-  const path = sessionFilePath(projectDir, sessionId);
-  if (!existsSync(path)) return true;
-  try {
-    const mtimeMs = statSync(path).mtimeMs;
-    return now.getTime() - mtimeMs >= idleSeconds * 1e3;
-  } catch {
-    return false;
-  }
-}
-function isStaleForToday(codeName, now = /* @__PURE__ */ new Date(), timezone) {
-  const file = readFile(codeName);
-  if (!file.current) return false;
-  return file.current.date !== todayLocalIso(now, timezone);
-}
-function peekCurrentSession(codeName) {
-  return readFile(codeName).current;
-}
-
-// ../../packages/core/dist/runtime/session-probe.js
-import { execFileSync } from "child_process";
-function escapePgrepRegex(value) {
-  return value.replace(/[.[\]{}()*+?^$|\\]/g, "\\$&");
-}
-function probeClaudeProcessInTmux(tmuxSession) {
-  const escapedSession = escapePgrepRegex(tmuxSession);
-  const pattern = `(^|[[:space:]])--name ${escapedSession}([[:space:]]|$)`;
-  try {
-    const out = execFileSync("pgrep", ["-f", "--", pattern], {
-      encoding: "utf-8",
-      timeout: 3e3
-    }).trim();
-    return out.length > 0 ? "alive" : "dead";
-  } catch (err) {
-    const e = err;
-    if (e?.code === "ENOENT")
-      return "unknown";
-    return e?.status === 1 ? "dead" : "unknown";
-  }
-}
-
-// src/lib/claude-dialogs.ts
-import { execFileSync as execFileSync2 } from "child_process";
-function isLoginPickerVisible(screen) {
-  return screen.includes("Select login method") || screen.includes("Claude account with subscription") && screen.includes("Anthropic Console account");
-}
-function isResumeModeDialogVisible(screen) {
-  return screen.includes("Resume from summary") && screen.includes("Don't ask me again");
-}
-function isSessionFeedbackDialogVisible(screen) {
-  return screen.includes("How is Claude doing this session") && screen.includes("0: Dismiss");
-}
-function sweepDialogs(screen) {
-  if (screen.includes("Choose the text style") || screen.includes("Dark mode") && screen.includes("Light mode")) {
-    return {
-      kind: "theme-picker",
-      keys: ["Enter"],
-      interKeyDelayMs: 0,
-      logMessage: "Auto-accepted theme picker"
-    };
-  }
-  if (screen.includes("Yes, I trust this folder")) {
-    return {
-      kind: "folder-trust",
-      keys: ["Enter"],
-      interKeyDelayMs: 0,
-      logMessage: "Auto-accepted folder trust"
-    };
-  }
-  if (isResumeModeDialogVisible(screen)) {
-    return {
-      kind: "resume-mode",
-      keys: ["3", "Enter"],
-      interKeyDelayMs: 300,
-      logMessage: "Auto-dismissed resume-mode dialog (picked 'Don't ask me again')"
-    };
-  }
-  if (screen.includes("I am using this for local development")) {
-    return {
-      kind: "dev-channels",
-      keys: ["Enter"],
-      interKeyDelayMs: 0,
-      logMessage: "Auto-accepted dev channels"
-    };
-  }
-  if (screen.includes("Enter to confirm") && screen.includes("MCP")) {
-    return {
-      kind: "mcp-servers",
-      keys: ["Enter"],
-      interKeyDelayMs: 0,
-      logMessage: "Auto-accepted MCP servers"
-    };
-  }
-  if (screen.includes("Yes, I accept") && screen.includes("Bypass Permissions")) {
-    return {
-      kind: "bypass-permissions",
-      keys: ["2", "Enter"],
-      interKeyDelayMs: 300,
-      logMessage: "Auto-accepted bypass permissions"
-    };
-  }
-  if (isSessionFeedbackDialogVisible(screen)) {
-    return {
-      kind: "session-feedback",
-      keys: ["0"],
-      interKeyDelayMs: 0,
-      logMessage: "Auto-dismissed session-feedback dialog"
-    };
-  }
-  return null;
-}
-async function sendDialogKeys(tmuxSession, action) {
-  for (let i = 0; i < action.keys.length; i++) {
-    if (i > 0 && action.interKeyDelayMs > 0) {
-      await new Promise((r) => setTimeout(r, action.interKeyDelayMs));
-    }
-    execFileSync2("tmux", ["send-keys", "-t", tmuxSession, action.keys[i]], {
-      stdio: "ignore"
-    });
-  }
-}
-function simpleTextHash(s) {
-  let h = 0;
-  for (let i = 0; i < s.length; i++) {
-    h = (h << 5) - h + s.charCodeAt(i) | 0;
-  }
-  return h.toString(16);
-}
-
-// src/lib/channel-input-watchdog.ts
-var STUCK_THRESHOLD_MS = 5e3;
-var MAX_ENTER_FIRES = 3;
-var DISTURB_HEAL_KEYS = ["x", "BSpace", "Enter"];
-var DISTURB_INTER_KEY_DELAY_MS = 200;
-var ATTACHED_STUCK_THRESHOLD_MS = 15e3;
-var INPUT_BOX_DIVIDER = /^[─━]{10,}/;
-var PROMPT_PREFIX = "\u276F ";
-function selectFireKeys(attempt, healMode = "disturb") {
-  if (healMode === "disturb" && attempt >= 2) return DISTURB_HEAL_KEYS;
-  return ["Enter"];
-}
-function decide(pane, prev, now, config = {}) {
-  const threshold = config.stuckThresholdMs ?? STUCK_THRESHOLD_MS;
-  const maxFires = config.maxEnterFires ?? MAX_ENTER_FIRES;
-  const dialogAction = sweepDialogs(pane);
-  if (dialogAction) {
-    return { fire: false, dialog: dialogAction, next: prev };
-  }
-  const inputText = extractInputBoxText(pane);
-  if (!inputText) {
-    return { fire: false, next: void 0 };
-  }
-  if (inputText === "\u2026") {
-    return { fire: false, next: void 0 };
-  }
-  const hash = simpleTextHash(inputText);
-  if (!prev || prev.lastInputHash !== hash) {
-    return {
-      fire: false,
-      next: { lastInputHash: hash, firstSeenAt: now, fires: 0, lastFireAt: 0, gaveUpLogged: false }
-    };
-  }
-  if (prev.fires >= maxFires) {
-    if (!prev.gaveUpLogged) {
-      return { fire: false, gaveUp: true, next: { ...prev, gaveUpLogged: true } };
-    }
-    return { fire: false, next: prev };
-  }
-  const sinceLastAttempt = prev.fires === 0 ? now - prev.firstSeenAt : now - prev.lastFireAt;
-  if (sinceLastAttempt < threshold) return { fire: false, next: prev };
-  return {
-    fire: true,
-    next: { ...prev, fires: prev.fires + 1, lastFireAt: now }
-  };
-}
-function extractInputBoxText(pane) {
-  const lines = pane.split("\n");
-  for (let i = 1; i < lines.length; i++) {
-    const line = lines[i] ?? "";
-    if (!line.startsWith(PROMPT_PREFIX)) continue;
-    let j = i - 1;
-    while (j >= 0 && (lines[j] ?? "").trim() === "") j--;
-    if (j < 0) continue;
-    if (!INPUT_BOX_DIVIDER.test((lines[j] ?? "").trim())) continue;
-    const text = line.slice(PROMPT_PREFIX.length).trim();
-    return text.length > 0 ? text : null;
-  }
-  return null;
-}
-var SPINNER_GLYPHS = ["\u273B", "\u273D", "\u2736", "\u2733", "\u2722"];
-function isActivelyProcessing(pane) {
-  const lines = pane.split("\n");
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const line = (lines[i] ?? "").trim();
-    if (!SPINNER_GLYPHS.some((g) => line.startsWith(g))) continue;
-    if (/\bfor\s+\d+s\s*$/.test(line)) return false;
-    if (/\b\w+ing[…\.]{0,3}(\s*\([^)]*\))?\s*$/i.test(line)) return true;
-    return false;
-  }
-  return false;
-}
-function checkChannelInputs(codeNames, io, config = {}, states = sharedStates) {
-  const live = new Set(codeNames);
-  for (const codeName of codeNames) {
-    try {
-      checkOne(codeName, io, config, states);
-    } catch (err) {
-      io.log(`[channel-input-watchdog] '${codeName}': ${err.message}`);
-    }
-  }
-  for (const key of [...states.keys()]) {
-    if (!live.has(key)) states.delete(key);
-  }
-  for (const key of [...giveUpCounts.keys()]) {
-    if (!live.has(key)) giveUpCounts.delete(key);
-  }
-}
-function checkOne(codeName, io, config, states) {
-  const pane = io.capturePane(codeName);
-  if (!pane) {
-    states.delete(codeName);
-    return;
-  }
-  const attached = io.isClientAttached(codeName);
-  const effectiveConfig = attached ? {
-    ...config,
-    stuckThresholdMs: config.attachedStuckThresholdMs ?? ATTACHED_STUCK_THRESHOLD_MS
-  } : config;
-  const prev = states.get(codeName);
-  const { fire, dialog, gaveUp, next } = decide(pane, prev, io.now(), effectiveConfig);
-  if (next === void 0) {
-    states.delete(codeName);
-    if (prev && prev.fires > 0) {
-      io.log(
-        `[channel-input-watchdog] '${codeName}': recovered after ${prev.fires} fire(s) \u2014 input submitted (input_hash=${prev.lastInputHash})`
-      );
-    }
-  } else {
-    states.set(codeName, next);
-  }
-  if (dialog) {
-    io.log(
-      `[channel-input-watchdog] '${codeName}': ${dialog.logMessage} (dialog was blocking the input box)`
-    );
-    io.sendKeys(codeName, dialog.keys, dialog.interKeyDelayMs);
-    return;
-  }
-  const text = extractInputBoxText(pane) ?? "";
-  const hash = next?.lastInputHash ?? simpleTextHash(text);
-  if (gaveUp) {
-    const maxFires = effectiveConfig.maxEnterFires ?? MAX_ENTER_FIRES;
-    io.log(
-      `[channel-input-watchdog] '${codeName}': GIVING UP after ${maxFires} Enter attempts \u2014 input remains unsubmitted (input_hash=${hash}, len=${text.length})`
-    );
-    giveUpCounts.set(codeName, (giveUpCounts.get(codeName) ?? 0) + 1);
-    try {
-      io.signalGiveUp?.(codeName);
-    } catch (err) {
-      io.log(
-        `[channel-input-watchdog] '${codeName}': give-up signal write failed: ${err.message}`
-      );
-    }
-    return;
-  }
-  if (fire) {
-    const maxFires = effectiveConfig.maxEnterFires ?? MAX_ENTER_FIRES;
-    const attempt = next?.fires ?? 1;
-    const busy = isActivelyProcessing(pane);
-    const keys = selectFireKeys(attempt, effectiveConfig.healMode);
-    if (keys.length === 1 && keys[0] === "Enter") {
-      io.log(
-        `[channel-input-watchdog] '${codeName}': stuck channel input \u2014 firing Enter (attempt ${attempt}/${maxFires}, busy=${busy}, input_hash=${hash}, len=${text.length})`
-      );
-      io.sendEnter(codeName);
-    } else {
-      io.log(
-        `[channel-input-watchdog] '${codeName}': stuck channel input \u2014 escalating to disturb sequence ${keys.join("\u2192")} (attempt ${attempt}/${maxFires}, busy=${busy}, input_hash=${hash}, len=${text.length})`
-      );
-      io.sendKeys(codeName, keys, DISTURB_INTER_KEY_DELAY_MS);
-    }
-  }
-}
-var sharedStates = /* @__PURE__ */ new Map();
-var giveUpCounts = /* @__PURE__ */ new Map();
-function takeWatchdogGiveUpCount(codeName) {
-  const count = giveUpCounts.get(codeName) ?? 0;
-  giveUpCounts.delete(codeName);
-  return count;
-}
-function creditWatchdogGiveUpCount(codeName, count) {
-  if (count <= 0) return;
-  giveUpCounts.set(codeName, (giveUpCounts.get(codeName) ?? 0) + count);
-}
-
-// src/lib/persistent-session.ts
-var OPENROUTER_ANTHROPIC_BASE_URL = "https://openrouter.ai/api";
-function syncClaudeCredsToRoot() {
-  if (platform() !== "linux") return true;
-  if (typeof process.getuid !== "function" || process.getuid() !== 0) return true;
-  for (const filename of [".credentials.json", "credentials.json"]) {
-    if (existsSync2(join2("/root/.claude", filename))) return true;
-  }
-  let sourcePath = null;
-  try {
-    const entries = readdirSync2("/home", { withFileTypes: true });
-    outer: for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      for (const filename of [".credentials.json", "credentials.json"]) {
-        const candidate = join2("/home", entry.name, ".claude", filename);
-        if (existsSync2(candidate)) {
-          sourcePath = candidate;
-          break outer;
-        }
-      }
-    }
-  } catch {
-  }
-  if (!sourcePath) return false;
-  const targetDir = "/root/.claude";
-  const sourceFilename = sourcePath.endsWith("credentials.json") && !sourcePath.endsWith(".credentials.json") ? "credentials.json" : ".credentials.json";
-  const targetPath = join2(targetDir, sourceFilename);
-  try {
-    if (!existsSync2(targetDir)) mkdirSync2(targetDir, { recursive: true, mode: 448 });
-    copyFileSync(sourcePath, targetPath);
-    chmodSync(targetPath, 384);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function resolveOAuthCredAction(claudeAuthMode, openRouterMode) {
-  if (openRouterMode) return "sync";
-  return claudeAuthMode === "api_key" ? "purge" : "sync";
-}
-var cachedClaudePath = null;
-function resolveClaudeBinary() {
-  if (cachedClaudePath) return cachedClaudePath;
-  const override = process.env.CLAUDE_PATH;
-  if (override && existsSync2(override)) {
-    cachedClaudePath = override;
-    return override;
-  }
-  try {
-    const out = execSync("which claude 2>/dev/null", { encoding: "utf-8" }).trim();
-    if (out && existsSync2(out)) {
-      cachedClaudePath = out;
-      return out;
-    }
-  } catch {
-  }
-  const candidates = [
-    "/home/linuxbrew/.linuxbrew/bin/claude",
-    "/opt/homebrew/bin/claude",
-    "/usr/local/bin/claude"
-  ];
-  for (const p of candidates) {
-    if (existsSync2(p)) {
-      cachedClaudePath = p;
-      return p;
-    }
-  }
-  return "claude";
-}
-function isolationMode(codeName) {
-  if (process.env.AGT_ISOLATION !== "docker") return "none";
-  const allow = (process.env.AGT_ISOLATION_AGENTS ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-  if (allow.length > 0 && (!codeName || !allow.includes(codeName))) return "none";
-  return "docker";
-}
-var EGRESS_BASELINE_DOMAINS = [
-  ".anthropic.com",
-  // claude API
-  "claude.ai",
-  // subscription auth
-  ".augmented.team",
-  // the host/control-plane API
-  ".slack.com",
-  // channels (incl. wss)
-  ".composio.dev"
-  // composio MCP
-];
-function egressMode(codeName) {
-  if (process.env.AGT_EGRESS !== "allowlist") return "none";
-  if (isolationMode(codeName) !== "docker") return "none";
-  return "allowlist";
-}
-var VALID_EGRESS_DOMAIN = /^\.?([a-z0-9-]+\.)+[a-z0-9-]+$/;
-function buildEgressAllowlist(toolsFrontmatter) {
-  const domains = new Set(EGRESS_BASELINE_DOMAINS);
-  for (const tool of toolsFrontmatter?.tools ?? []) {
-    for (const d of tool.network?.allowlist_domains ?? []) {
-      if (typeof d !== "string") continue;
-      const norm = d.trim().toLowerCase();
-      if (VALID_EGRESS_DOMAIN.test(norm)) domains.add(norm);
-    }
-  }
-  return [...domains].sort();
-}
-function egressAllowlistHostPath(codeName, homeDir) {
-  const home = homeDir ?? (process.env.HOME?.trim() || homedir2());
-  return join2(home, ".augmented", "_egress", `${codeName}.txt`);
-}
-function writeEgressAllowlist(codeName, domains, homeDir) {
-  const p = egressAllowlistHostPath(codeName, homeDir);
-  mkdirSync2(dirname(p), { recursive: true });
-  writeFileSync3(p, domains.join("\n") + "\n", { mode: 420 });
-  return p;
-}
-var EGRESS_DOCKER_TIMEOUT_MS = 1e4;
-function isNoSuchContainer(err) {
-  const e = err;
-  const text = `${e?.stderr?.toString() ?? ""}${e?.message ?? ""}`;
-  return /no such container|is not running/i.test(text);
-}
-function reloadEgressSidecar(codeName) {
-  try {
-    execFileSync3("docker", ["kill", "--signal=HUP", `agt-squid-${codeName}`], {
-      stdio: "pipe",
-      timeout: EGRESS_DOCKER_TIMEOUT_MS
-    });
-    return true;
-  } catch (err) {
-    if (!isNoSuchContainer(err)) throw err;
-    return false;
-  }
-}
-function restartEgressSidecar(codeName) {
-  try {
-    execFileSync3("docker", ["restart", `agt-squid-${codeName}`], {
-      stdio: "pipe",
-      timeout: EGRESS_DOCKER_TIMEOUT_MS
-    });
-    return true;
-  } catch (err) {
-    if (!isNoSuchContainer(err)) throw err;
-    return false;
-  }
-}
-function buildDockerRunCommand(args) {
-  const { codeName, agentId, wrapperPath, projectDir, homeDir, runId, passApiKey, passOpenRouter, egress } = args;
-  const q = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
-  const agentDir = join2(homeDir, ".augmented", codeName);
-  const agentIdDir = join2(homeDir, ".augmented", agentId);
-  const mcpDir = join2(homeDir, ".augmented", "_mcp");
-  const claudeHome = join2(homeDir, ".claude");
-  const claudeJson = join2(homeDir, ".claude.json");
-  const mounts = [
-    `-v ${q(`${agentDir}:${agentDir}`)}`,
-    `-v ${q(`${agentIdDir}:${agentIdDir}`)}`,
-    `-v ${q(`${mcpDir}:${mcpDir}:ro`)}`,
-    `-v ${q(`${claudeHome}:${claudeHome}`)}`,
-    `-v ${q(`${claudeJson}:${claudeJson}`)}`
-  ];
-  const image = process.env.AGT_ISOLATION_IMAGE || "agt-runtime:latest";
-  const memory = process.env.AGT_ISOLATION_MEMORY || "2g";
-  const cpus = process.env.AGT_ISOLATION_CPUS || "1.0";
-  const pids = process.env.AGT_ISOLATION_PIDS || "512";
-  const envArgs = [`-e ${q(`HOME=${homeDir}`)}`];
-  envArgs.push(`-e ${q(`npm_config_cache=${join2(agentDir, ".npm-cache")}`)}`);
-  if (passApiKey) envArgs.push("-e ANTHROPIC_API_KEY");
-  if (passOpenRouter) {
-    envArgs.push("-e ANTHROPIC_BASE_URL");
-    envArgs.push("-e ANTHROPIC_AUTH_TOKEN");
-    envArgs.push("-e ANTHROPIC_MODEL");
-    envArgs.push("-e ANTHROPIC_SMALL_FAST_MODEL");
-  }
-  if (runId) envArgs.push(`-e ${q(`AGT_RUN_ID=${runId}`)}`);
-  envArgs.push("-e AGT_API_KEY");
-  envArgs.push("-e AGT_HOST");
-  envArgs.push(`-e ${q(`AGT_AGENT_ID=${agentId}`)}`);
-  envArgs.push(`-e AGT_DIRECT_CHAT_DOORBELL_ENABLED=true`);
-  envArgs.push(`-e AGT_IN_CONTAINER=true`);
-  const egressImage = process.env.AGT_EGRESS_IMAGE || "agt-squid:latest";
-  const internalNet = `agt-net-${codeName}`;
-  const squidName = `agt-squid-${codeName}`;
-  const networkArgs = [];
-  let egressSetup = "";
-  if (egress) {
-    networkArgs.push(`--network ${internalNet}`);
-    const proxyUrl = `http://${squidName}:3128`;
-    envArgs.push(`-e ${q(`HTTPS_PROXY=${proxyUrl}`)}`);
-    envArgs.push(`-e ${q(`HTTP_PROXY=${proxyUrl}`)}`);
-    envArgs.push(`-e ${q(`NO_PROXY=${squidName},localhost,127.0.0.1`)}`);
-    egressSetup = [
-      `docker rm -f ${squidName} agt-${codeName} >/dev/null 2>&1 || true`,
-      `docker network create agt-egress >/dev/null 2>&1 || true`,
-      // FAIL-CLOSED: a stale or hand-created `agt-net-<codeName>` that is NOT
-      // internal would give the agent a route off-net, bypassing the proxy.
-      // Don't trust create-if-absent - verify the Internal flag and rebuild the
-      // network when it's missing or wrong.
-      `{ [ "$(docker network inspect -f '{{.Internal}}' ${internalNet} 2>/dev/null)" = "true" ] || { docker network rm ${internalNet} >/dev/null 2>&1 || true; docker network create --internal ${internalNet} >/dev/null; }; }`,
-      // squid processes untrusted agent traffic - give it the same hardening as
-      // the agent container (drop all caps, block privilege escalation). squid
-      // binds 3128 (>1024) and needs no capabilities; verified it still boots.
-      `docker run -d --name ${squidName} --network ${internalNet} --restart unless-stopped --memory 128m --cap-drop ALL --security-opt no-new-privileges -v ${q(`${egress.allowlistHostPath}:/etc/squid/allowlist.txt:ro`)} ${q(egressImage)} >/dev/null`,
-      `docker network connect agt-egress ${squidName} >/dev/null 2>&1`
-    ].join(" && ");
-  }
-  const runCmd = [
-    "exec docker run --rm -it",
-    `--name agt-${codeName}`,
-    `--memory ${memory}`,
-    `--cpus ${cpus}`,
-    `--pids-limit ${pids}`,
-    // Defence in depth (red-team 2026-06-16): drop all Linux capabilities and
-    // block privilege escalation. claude + node MCP servers need none - verified
-    // booting clean under these. The mount namespace is the primary boundary;
-    // these shrink what a container-escape CVE could reach if it ever landed.
-    "--cap-drop ALL",
-    "--security-opt no-new-privileges",
-    ...networkArgs,
-    ...mounts,
-    `-w ${q(projectDir)}`,
-    ...envArgs,
-    q(image),
-    q(wrapperPath)
-  ].join(" ");
-  return egress ? `${egressSetup} && ${runCmd}` : `docker rm -f agt-${codeName} >/dev/null 2>&1; ${runCmd}`;
-}
-function writePersistentClaudeWrapper(args) {
-  const { projectDir, claudeBin, initPrompt, claudeArgsJoined } = args;
-  const envIntegrationsPath = join2(projectDir, ".env.integrations");
-  const wrapperPath = join2(projectDir, ".claude", "persistent-claude.sh");
-  const wrapperLines = [
-    "#!/usr/bin/env bash",
-    "set -e",
-    // IS_SANDBOX=1 lets claude run under root/sudo with
-    // --dangerously-skip-permissions on dedicated EC2 hosts.
-    "export IS_SANDBOX=1"
-  ];
-  if (existsSync2(envIntegrationsPath)) {
-    wrapperLines.push(
-      "set -a",
-      `source ${JSON.stringify(envIntegrationsPath)}`,
-      "set +a"
-    );
-  }
-  const initPromptArg = initPrompt ? `${JSON.stringify(initPrompt)} ` : "";
-  wrapperLines.push(
-    `exec ${JSON.stringify(claudeBin)} ${initPromptArg}${claudeArgsJoined}`
-  );
-  mkdirSync2(join2(projectDir, ".claude"), { recursive: true });
-  writeFileSync3(wrapperPath, wrapperLines.join("\n") + "\n", { mode: 448 });
-  chmodSync(wrapperPath, 448);
-  return wrapperPath;
-}
-function collectMcpServerNames(mcpConfigPath) {
-  if (!existsSync2(mcpConfigPath)) return [];
-  try {
-    const data = JSON.parse(readFileSync3(mcpConfigPath, "utf-8"));
-    const servers = data.mcpServers;
-    return servers ? Object.keys(servers) : [];
-  } catch {
-    return [];
-  }
-}
-var sessions = /* @__PURE__ */ new Map();
-var PANE_LOG_DIR = join2(homedir2(), ".augmented");
-var PANE_TAIL_LINES = 20;
-function paneLogPath(codeName) {
-  return join2(PANE_LOG_DIR, codeName, "pane.log");
-}
-function setupPaneLog(tmuxSession, codeName, log) {
-  const logPath = paneLogPath(codeName);
-  try {
-    mkdirSync2(dirname(logPath), { recursive: true });
-    appendFileSync(
-      logPath,
-      `
---- spawn ${(/* @__PURE__ */ new Date()).toISOString()} (session ${tmuxSession}) ---
-`,
-      "utf-8"
-    );
-    execSync(
-      `tmux pipe-pane -o -t ${tmuxSession} 'cat >> ${logPath.replace(/'/g, `'\\''`)}'`,
-      { stdio: "ignore" }
-    );
-  } catch (err) {
-    log(`[persistent-session] pipe-pane setup failed for '${codeName}': ${err.message}`);
-  }
-}
-function readPaneLogTail(codeName, lines = PANE_TAIL_LINES) {
-  const logPath = paneLogPath(codeName);
-  if (!existsSync2(logPath)) return null;
-  try {
-    const raw = readFileSync3(logPath, "utf-8");
-    if (!raw) return null;
-    const stripped = raw.replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "");
-    const all = stripped.split("\n").filter((l) => l.length > 0);
-    return all.slice(-lines).join("\n");
-  } catch {
-    return null;
-  }
-}
-function detectFailureSignature(tail) {
-  if (!tail) return "unknown";
-  if (/Session ID .* is already in use/i.test(tail)) return "session_id_in_use";
-  return "unknown";
-}
-function prepareForRespawn(codeName) {
-  const session = sessions.get(codeName);
-  if (!session) return null;
-  const signature = detectFailureSignature(session.lastFailureTail);
-  if (session.consecutiveSameUuidFailures >= 2) {
-    const failureCount = session.consecutiveSameUuidFailures;
-    const newId = rotateDailySession(
-      codeName,
-      /* @__PURE__ */ new Date(),
-      session.agentTimezone ?? void 0
-    );
-    session.consecutiveSameUuidFailures = 0;
-    session.lastFailureSessionId = null;
-    return `rotated daily-session UUID to ${newId} after ${failureCount} consecutive failures on the same UUID (signature=${signature})`;
-  }
-  return null;
-}
-function rotateSessionForWedge(codeName, now = /* @__PURE__ */ new Date()) {
-  const session = sessions.get(codeName);
-  const newId = rotateDailySession(codeName, now, session?.agentTimezone ?? void 0);
-  if (session) {
-    session.consecutiveSameUuidFailures = 0;
-    session.lastFailureSessionId = null;
-  }
-  return newId;
-}
-function getLastFailureContext(codeName) {
-  const session = sessions.get(codeName);
-  return {
-    tail: session?.lastFailureTail ?? null,
-    signature: detectFailureSignature(session?.lastFailureTail ?? null),
-    consecutiveSameUuid: session?.consecutiveSameUuidFailures ?? 0,
-    restartCount: session?.restartCount ?? 0
-  };
-}
-function resolveSessionSpawnDecision(args) {
-  const { codeName, projectDir, agentTimezone } = args;
-  const now = args.now ?? /* @__PURE__ */ new Date();
-  const disableFlag = process.env["AGT_DISABLE_SESSION_RESUME"];
-  const resumeDisabled = disableFlag === "1" || disableFlag?.toLowerCase() === "true";
-  if (resumeDisabled) {
-    return { flag: "--session-id", sessionId: randomUUID2(), reason: "resume-disabled" };
-  }
-  const daily = getOrCreateDailySession(codeName, now, agentTimezone);
-  if (!daily.isNew && sessionFileExists(projectDir, daily.sessionId)) {
-    return { flag: "--resume", sessionId: daily.sessionId, reason: "resume-today" };
-  }
-  if (daily.isNew) {
-    return { flag: "--session-id", sessionId: daily.sessionId, reason: "fresh-new-day" };
-  }
-  return {
-    flag: "--session-id",
-    sessionId: rotateDailySession(codeName, now, agentTimezone),
-    reason: "rotated-missing-transcript"
-  };
-}
-function directChatSessionStatePath(agentId) {
-  return join2(homedir2(), ".augmented", agentId, "direct-chat-session.json");
-}
-function writeDirectChatSessionState(agentId, state) {
-  const p = directChatSessionStatePath(agentId);
-  mkdirSync2(dirname(p), { recursive: true });
-  writeFileSync3(p, JSON.stringify(state));
-}
-function startPersistentSession(config) {
-  const existing = sessions.get(config.codeName);
-  if (existing && existing.status === "running") {
-    return existing;
-  }
-  const restartCount = existing?.restartCount ?? 0;
-  if (existing?.status === "crashed" && existing.startedAt) {
-    const backoffMs = Math.min(5e3 * Math.pow(2, restartCount), 6e4);
-    if (Date.now() - existing.startedAt < backoffMs) {
-      return existing;
-    }
-  }
-  const session = {
-    codeName: config.codeName,
-    startedAt: null,
-    restartCount,
-    status: "starting",
-    currentSessionId: existing?.currentSessionId ?? null,
-    lastFailureTail: existing?.lastFailureTail ?? null,
-    lastFailureSessionId: existing?.lastFailureSessionId ?? null,
-    consecutiveSameUuidFailures: existing?.consecutiveSameUuidFailures ?? 0,
-    agentTimezone: config.agentTimezone ?? null
-  };
-  sessions.set(config.codeName, session);
-  spawnSession(config, session);
-  return session;
-}
-function spawnSession(config, session) {
-  const { codeName, projectDir, mcpConfigPath, claudeMdPath, channels, devChannels, apiHost, log } = config;
-  const claudeAuthMode = config.claudeAuthMode ?? "subscription";
-  const openRouterMode = !!config.openRouter;
-  const tmuxSession = `agt-${codeName}`;
-  log(
-    `[persistent-session] Starting tmux session '${tmuxSession}' for '${codeName}' (auth=${openRouterMode ? "openrouter" : claudeAuthMode})`
-  );
-  try {
-    sanitizeMcpJson(mcpConfigPath, apiHost);
-    try {
-      execSync(`tmux kill-session -t ${tmuxSession} 2>/dev/null`, { stdio: "ignore" });
-    } catch {
-    }
-    if (resolveOAuthCredAction(claudeAuthMode, openRouterMode) === "sync") {
-      const credsSynced = syncClaudeCredsToRoot();
-      const onLinuxRoot = platform() === "linux" && typeof process.getuid === "function" && process.getuid() === 0;
-      if (openRouterMode) {
-        if (credsSynced) {
-          log(`[persistent-session] OpenRouter mode for '${codeName}' - model=${config.openRouter.model}; inference via OpenRouter, claude.ai OAuth retained for channels.`);
-        } else if (onLinuxRoot) {
-          log(`[persistent-session] OpenRouter mode for '${codeName}' - model=${config.openRouter.model}; no claude.ai OAuth creds under /root/.claude or /home/*, so channels (Telegram/Slack/direct-chat) will not load. Inference still works via OpenRouter. Run 'claude /login' on the host to enable channels.`);
-        }
-      } else if (!credsSynced && onLinuxRoot) {
-        log(`[persistent-session] No Claude Code credentials found under /root/.claude or /home/*. Pair via browser from the host page, or run 'claude /login' on the host.`);
-      }
-    } else {
-      const claudeDir = join2(homedir2(), ".claude");
-      for (const filename of [".credentials.json", "credentials.json"]) {
-        const p = join2(claudeDir, filename);
-        if (existsSync2(p)) {
-          try {
-            rmSync(p, { force: true });
-            log(`[persistent-session] Removed ${p} (api_key mode active \u2014 preventing OAuth fallback)`);
-          } catch {
-          }
-        }
-      }
-      if (!config.anthropicApiKey) {
-        log(`[persistent-session] api_key mode but no anthropicApiKey passed. Session will fail auth.`);
-      }
-    }
-    const args = [];
-    const decision = resolveSessionSpawnDecision({
-      codeName,
-      projectDir,
-      agentTimezone: config.agentTimezone ?? void 0
-    });
-    const sessionId = decision.sessionId;
-    const resuming = decision.flag === "--resume";
-    args.push(decision.flag, sessionId);
-    log(
-      `[persistent-session] ${resuming ? "Resuming" : "Starting"} session ${sessionId} for '${codeName}' (${decision.reason})`
-    );
-    try {
-      markDailySessionSpawn(codeName, sessionId, /* @__PURE__ */ new Date(), config.agentTimezone ?? void 0);
-    } catch (err) {
-      log(
-        `[persistent-session] Failed to update daily-session marker for '${codeName}': ${err.message}`
-      );
-    }
-    try {
-      writeDirectChatSessionState(config.agentId, {
-        fresh: !resuming,
-        sessionId,
-        startedAtMs: Date.now()
-      });
-    } catch (err) {
-      log(
-        `[persistent-session] Failed to write direct-chat session state for '${codeName}': ${err.message}`
-      );
-    }
-    if (channels.length > 0) args.push("--channels", ...channels);
-    if (devChannels.length > 0) args.push("--dangerously-load-development-channels", ...devChannels);
-    args.push("--mcp-config", mcpConfigPath);
-    if (existsSync2(claudeMdPath)) args.push("--system-prompt-file", claudeMdPath);
-    if (!openRouterMode) {
-      const modelAlias = claudeModelAlias(config.primaryModel);
-      if (modelAlias) args.push("--model", modelAlias);
-    }
-    args.push("--allow-dangerously-skip-permissions");
-    args.push("--dangerously-skip-permissions");
-    args.push("--strict-mcp-config");
-    args.push("--name", tmuxSession);
-    const mcpServerNames = collectMcpServerNames(mcpConfigPath);
-    args.push("--allowedTools", buildAllowedTools(mcpServerNames));
-    const initPrompt = resuming ? "" : 'You are now online. Say "Ready." and wait for incoming messages. Do not run any tools or load any data until a message arrives.';
-    const claudeBin = resolveClaudeBinary();
-    const claudeArgsJoined = args.map((a) => a.includes(" ") || a.includes("*") ? JSON.stringify(a) : a).join(" ");
-    const wrapperPath = writePersistentClaudeWrapper({
-      projectDir,
-      claudeBin,
-      initPrompt,
-      claudeArgsJoined
-    });
-    const tmuxSessionEnvArgs = [];
-    if (openRouterMode) {
-      const or = config.openRouter;
-      tmuxSessionEnvArgs.push("-e", `ANTHROPIC_BASE_URL=${OPENROUTER_ANTHROPIC_BASE_URL}`);
-      tmuxSessionEnvArgs.push("-e", `ANTHROPIC_AUTH_TOKEN=${or.authToken}`);
-      tmuxSessionEnvArgs.push("-e", `ANTHROPIC_MODEL=${or.model}`);
-      if (or.smallFastModel) {
-        tmuxSessionEnvArgs.push("-e", `ANTHROPIC_SMALL_FAST_MODEL=${or.smallFastModel}`);
-      }
-    } else if (claudeAuthMode === "api_key" && config.anthropicApiKey) {
-      tmuxSessionEnvArgs.push("-e", `ANTHROPIC_API_KEY=${config.anthropicApiKey}`);
-    }
-    const sessionHomeDir = process.env.HOME?.trim() || homedir2();
-    let egress;
-    if (egressMode(codeName) === "allowlist") {
-      const allowlist = config.egressAllowlist ?? buildEgressAllowlist(null);
-      const allowlistHostPath = writeEgressAllowlist(codeName, allowlist, sessionHomeDir);
-      egress = { allowlistHostPath };
-      log(`[persistent-session] egress allowlist for '${codeName}': ${allowlist.length} domains (deny-by-default)`);
-    }
-    const claudeCmd = isolationMode(codeName) === "docker" ? buildDockerRunCommand({
-      codeName,
-      agentId: config.agentId,
-      wrapperPath,
-      projectDir,
-      homeDir: sessionHomeDir,
-      runId: config.runId ?? void 0,
-      passApiKey: !openRouterMode && claudeAuthMode === "api_key" && !!config.anthropicApiKey,
-      // ENG-7152: forward the OpenRouter ANTHROPIC_* vars (by name) from the
-      // session-shell env into the container, same posture as passApiKey.
-      passOpenRouter: openRouterMode,
-      egress
-    }) : JSON.stringify(wrapperPath);
-    const tmuxEnv = {
-      ...process.env,
-      // Treat empty-string as missing too — `HOME=""` makes ~ resolve
-      // to cwd, which is the same broken outcome as no HOME, just
-      // better hidden.
-      HOME: process.env.HOME?.trim() || homedir2(),
-      USER: process.env.USER?.trim() || userInfo().username
-    };
-    if (config.runId) {
-      tmuxEnv["AGT_RUN_ID"] = config.runId;
-    }
-    const apiKeyEnv = !openRouterMode && claudeAuthMode === "api_key" && config.anthropicApiKey ? { ANTHROPIC_API_KEY: config.anthropicApiKey } : {};
-    const openRouterEnv = openRouterMode ? {
-      ANTHROPIC_BASE_URL: OPENROUTER_ANTHROPIC_BASE_URL,
-      ANTHROPIC_AUTH_TOKEN: config.openRouter.authToken,
-      ANTHROPIC_MODEL: config.openRouter.model,
-      ...config.openRouter.smallFastModel ? { ANTHROPIC_SMALL_FAST_MODEL: config.openRouter.smallFastModel } : {}
-    } : {};
-    const probeBaseEnv = isolationMode(codeName) === "docker" ? {
-      HOME: tmuxEnv["HOME"],
-      ...apiKeyEnv,
-      ...openRouterEnv,
-      ...config.runId ? { AGT_RUN_ID: config.runId } : {},
-      AGT_API_KEY: tmuxEnv["AGT_API_KEY"],
-      AGT_HOST: tmuxEnv["AGT_HOST"],
-      AGT_AGENT_ID: config.agentId
-    } : { ...tmuxEnv, ...apiKeyEnv, ...openRouterEnv };
-    for (const f of probeMcpEnvSubstitution({
-      mcpConfigPath,
-      envIntegrationsPath: join2(projectDir, ".env.integrations"),
-      baseEnv: probeBaseEnv
-    })) {
-      log(`[persistent-session] ${formatMissingVar(f)} agent=${codeName}`);
-    }
-    const child = spawn("tmux", [
-      "new-session",
-      "-d",
-      "-s",
-      tmuxSession,
-      "-c",
-      projectDir,
-      ...tmuxSessionEnvArgs,
-      claudeCmd
-    ], {
-      cwd: projectDir,
-      stdio: ["ignore", "pipe", "pipe"],
-      env: tmuxEnv
-    });
-    child.on("close", (code) => {
-      if (code !== 0) {
-        log(`[persistent-session] Failed to create tmux session for '${codeName}' (exit ${code})`);
-        session.status = "crashed";
-        session.startedAt = Date.now();
-        session.restartCount++;
-        return;
-      }
-      log(`[persistent-session] tmux session '${tmuxSession}' created for '${codeName}'`);
-      setupPaneLog(tmuxSession, codeName, log);
-      session.currentSessionId = sessionId;
-      acceptDialogs(tmuxSession, codeName, log, config.primaryModel ?? null, sessionId).catch(() => {
-      });
-    });
-    child.on("error", (err) => {
-      log(`[persistent-session] Failed to start tmux for '${codeName}': ${err.message}`);
-      session.status = "crashed";
-      session.startedAt = Date.now();
-      session.restartCount++;
-    });
-    session.startedAt = Date.now();
-    session.status = "running";
-    session.restartCount = 0;
-  } catch (err) {
-    log(`[persistent-session] Failed to start session for '${codeName}': ${err.message}`);
-    session.status = "crashed";
-    session.startedAt = Date.now();
-    session.restartCount++;
-  }
-}
-function hasMcpChildren(tmuxSession) {
-  try {
-    const claudePidOut = execSync(
-      `pgrep -f -- "--name ${tmuxSession}" 2>/dev/null || true`,
-      { encoding: "utf-8" }
-    ).trim();
-    if (!claudePidOut) return false;
-    const pids = claudePidOut.split("\n").map((p) => Number(p)).filter((p) => p > 0);
-    if (pids.length === 0) return false;
-    const claudePid = Math.max(...pids);
-    const childrenOut = execSync(
-      `pgrep -P ${claudePid} 2>/dev/null || true`,
-      { encoding: "utf-8" }
-    ).trim();
-    if (!childrenOut) return false;
-    const childPids = childrenOut.split("\n").map((p) => p.trim()).filter(Boolean);
-    for (const cp of childPids) {
-      const cmdline = execSync(
-        `cat /proc/${cp}/cmdline 2>/dev/null | tr '\\0' ' ' || ps -p ${cp} -o args= 2>/dev/null || true`,
-        { encoding: "utf-8" }
-      );
-      if (/slack-channel\.js|telegram-channel\.js|direct-chat-channel\.js|composio_/i.test(cmdline)) {
-        return true;
-      }
-    }
-    return false;
-  } catch {
-    return false;
-  }
-}
-async function acceptDialogs(tmuxSession, codeName, log, primaryModel = null, sessionId = null) {
-  let loginPickerReported = false;
-  let dialogIterations = 0;
-  const MAX_DIALOG_ITERATIONS = 15;
-  let loginPickerIterations = 0;
-  const MAX_LOGIN_PICKER_ITERATIONS = 450;
-  while (dialogIterations < MAX_DIALOG_ITERATIONS && loginPickerIterations < MAX_LOGIN_PICKER_ITERATIONS) {
-    await new Promise((r) => setTimeout(r, 2e3));
-    try {
-      const screen = execSync(`tmux capture-pane -t ${tmuxSession} -p 2>/dev/null`, { encoding: "utf-8" });
-      if (isLoginPickerVisible(screen)) {
-        if (!loginPickerReported) {
-          log(`[persistent-session] CLAUDE LOGIN REQUIRED for '${codeName}' \u2014 agent cannot start until ~/.claude.json is provisioned. Pair via the Hosts page or run 'claude /login' on the host.`);
-          loginPickerReported = true;
-        }
-        loginPickerIterations++;
-        continue;
-      }
-      dialogIterations++;
-      const dialogAction = sweepDialogs(screen);
-      if (dialogAction) {
-        await sendDialogKeys(tmuxSession, dialogAction);
-        log(`[persistent-session] ${dialogAction.logMessage} for '${codeName}'`);
-        continue;
-      }
-      if (screen.includes("\u276F") && !screen.includes("Enter to confirm")) {
-        if (hasMcpChildren(tmuxSession)) {
-          log(`[persistent-session] Session ready for '${codeName}' \u2014 MCP servers spawned`);
-          await maybeSendFastMode({
-            tmuxSession,
-            codeName,
-            primaryModel,
-            sessionId,
-            screen,
-            log
-          });
-          break;
-        }
-      }
-    } catch {
-      break;
-    }
-  }
-}
-async function maybeSendFastMode(ctx) {
-  if (!isClaudeFastMode(ctx.primaryModel)) return;
-  const sid = ctx.sessionId ?? "unknown";
-  const banner = ctx.screen.toLowerCase();
-  const hasOpus = banner.includes("opus");
-  const hasNonOpus = banner.includes("sonnet") || banner.includes("haiku");
-  if (hasNonOpus && !hasOpus) {
-    ctx.log(
-      `[fast-mode] skip /fast for agent=${ctx.codeName} session=${sid} \u2014 banner shows non-Opus model`
-    );
-    return;
-  }
-  if (!hasOpus) {
-    ctx.log(
-      `[fast-mode] skip /fast for agent=${ctx.codeName} session=${sid} \u2014 Opus not visible in banner`
-    );
-    return;
-  }
-  const ok = sendToAgent(ctx.tmuxSession, "/fast");
-  if (ok) {
-    ctx.log(`[fast-mode] sent /fast for agent=${ctx.codeName} session=${sid}`);
-  } else {
-    ctx.log(`[fast-mode] failed to send /fast for agent=${ctx.codeName} session=${sid} \u2014 tmux send-keys errored`);
-  }
-}
-async function waitForPromptReady(tmuxSession) {
-  const deadline = Date.now() + 1e4;
-  while (Date.now() < deadline) {
-    try {
-      const screen = execFileSync3(
-        "tmux",
-        ["capture-pane", "-t", tmuxSession, "-p"],
-        { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
-      );
-      if (screen.includes("\u276F ")) return true;
-    } catch {
-    }
-    await new Promise((r) => setTimeout(r, 500));
-  }
-  return false;
-}
-var SEND_KEYS_ENTER_DELAY_MS = 50;
-function sleepBlockingMs(ms) {
-  const view = new Int32Array(new SharedArrayBuffer(4));
-  Atomics.wait(view, 0, 0, ms);
-}
-function defaultArmSender(tmuxSession, command) {
-  try {
-    execFileSync3("tmux", ["send-keys", "-t", tmuxSession, "-l", command], {
-      stdio: ["ignore", "ignore", "pipe"]
-    });
-    sleepBlockingMs(SEND_KEYS_ENTER_DELAY_MS);
-    execFileSync3("tmux", ["send-keys", "-t", tmuxSession, "Enter"], {
-      stdio: ["ignore", "ignore", "pipe"]
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-var armSender = defaultArmSender;
-function defaultPaneCapture(tmuxSession) {
-  try {
-    return execFileSync3("tmux", ["capture-pane", "-t", tmuxSession, "-p"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 2e3
-    });
-  } catch {
-    return null;
-  }
-}
-var paneCapture = defaultPaneCapture;
-var defaultHygieneKeySender = async (tmuxSession, keys, interKeyDelayMs) => {
-  for (let i = 0; i < keys.length; i++) {
-    if (i > 0 && interKeyDelayMs > 0) {
-      await new Promise((r) => setTimeout(r, interKeyDelayMs));
-    }
-    execFileSync3("tmux", ["send-keys", "-t", tmuxSession, keys[i]], {
-      stdio: "ignore"
-    });
-  }
-};
-var hygieneKeySender = defaultHygieneKeySender;
-async function preSendPaneHygiene(tmuxSession, codeName, log) {
-  try {
-    let screen = paneCapture(tmuxSession);
-    if (screen === null) return;
-    const action = sweepDialogs(screen);
-    if (action) {
-      await hygieneKeySender(tmuxSession, action.keys, action.interKeyDelayMs);
-      log(`[inject] ${action.logMessage} for '${codeName}' before injection`);
-      await new Promise((r) => setTimeout(r, 300));
-      screen = paneCapture(tmuxSession) ?? "";
-    }
-    const orphan = extractInputBoxText(screen);
-    if (orphan) {
-      log(
-        `[inject] clearing orphaned input for '${codeName}' before injection (input_hash=${simpleTextHash(orphan)}, len=${orphan.length})`
-      );
-      await hygieneKeySender(tmuxSession, ["C-u"], 0);
-    }
-  } catch {
-  }
-}
-function sendToAgent(tmuxSession, command) {
-  return armSender(tmuxSession, command);
-}
-async function isAgentPromptReady(tmuxSession) {
-  return waitForPromptReady(tmuxSession);
-}
-var _internals = {
-  isLoginPickerVisible,
-  isResumeModeDialogVisible,
-  detectFailureSignature,
-  // ENG-6039 test seams: seed/clear the module-private session map so
-  // prepareForRespawn's rotation gate can be exercised without tmux.
-  __seedSession(session) {
-    sessions.set(session.codeName, session);
-  },
-  __clearSessions() {
-    sessions.clear();
-  },
-  isClaudeProcessAliveInTmux,
-  waitForPromptReady,
-  // ENG-5770: exported so the unit test in claude-model-alias.test.ts can
-  // exercise the send/skip decision without spawning a real tmux session.
-  maybeSendFastMode,
-  // Test seam: swap the tmux send-keys path so tests don't have to
-  // spawn a real tmux server. ESM module-binding makes
-  // `vi.spyOn(module, 'execFileSync')` ineffective for in-module
-  // callers, so we route through this shim.
-  __setArmSender(fn) {
-    armSender = fn ?? defaultArmSender;
-  },
-  // ENG-6017 test seam: swap the pane capture used by the inject-time
-  // hygiene so unit tests can simulate dialog overlays / orphaned input
-  // without a tmux server. null restores the real capture.
-  __setPaneCapture(fn) {
-    paneCapture = fn ?? defaultPaneCapture;
-  },
-  // ENG-6017 test seam: swap the hygiene key sender (dialog dismissal +
-  // C-u clear) so unit tests can assert keystrokes without tmux.
-  __setHygieneKeySender(fn) {
-    hygieneKeySender = fn ?? defaultHygieneKeySender;
-  },
-  // Test-only resets so each test starts from a clean slate.
-  __resetZombieState() {
-    zombieProbeCache.clear();
-    pendingZombieDetections.clear();
-  },
-  __getSessionsMap() {
-    return sessions;
-  },
-  __peekPendingZombie(codeName) {
-    return pendingZombieDetections.get(codeName) ?? null;
-  }
-};
-async function injectMessage(codeName, type, content, meta, log) {
-  return (await injectMessageWithStatus(codeName, type, content, meta, log)).delivered;
-}
-async function injectMessageWithStatus(codeName, type, content, meta, log) {
-  const _log = log ?? ((_) => {
-  });
-  const session = sessions.get(codeName);
-  if (!session || session.status !== "running") {
-    _log(`[inject] SKIP '${codeName}' \u2014 session ${session ? `status=${session.status}` : "not found in Map"}`);
-    return { delivered: false, fallbackUsed: false };
-  }
-  const prefix = meta?.task_name ? `[Task: ${meta.task_name}] ` : "";
-  const text = prefix + content;
-  const singleLineText = text.replace(/\s*\n+\s*/g, " ").trim();
-  await preSendPaneHygiene(`agt-${codeName}`, codeName, _log);
-  const sent = sendToAgent(`agt-${codeName}`, singleLineText);
-  if (sent) {
-    _log(`[inject] tmux send-keys sent for '${codeName}' \u2014 unverified (delivered=false, fallbackUsed=true)`);
-    return { delivered: false, fallbackUsed: true };
-  }
-  _log(`[inject] tmux send-keys failed for '${codeName}'`);
-  return { delivered: false, fallbackUsed: false };
-}
-function stopPersistentSession(codeName, log) {
-  const session = sessions.get(codeName);
-  if (!session) return;
-  log(`[persistent-session] Stopping session for '${codeName}'`);
-  session.status = "stopped";
-  try {
-    execFileSync3("tmux", ["kill-session", "-t", `agt-${codeName}`], { stdio: ["ignore", "ignore", "pipe"] });
-  } catch (err) {
-    const stderr = (err.stderr ?? "").toString().trim();
-    const alreadyGone = /can't find session|no server running/i.test(stderr);
-    if (!alreadyGone) {
-      log(
-        `[persistent-session] WARN tmux kill-session for '${codeName}' failed unexpectedly: ${stderr || err.message} \u2014 the session may still be running (ENG-6174)`
-      );
-    }
-  }
-  sessions.delete(codeName);
-  setTimeout(() => {
-    reapOrphanChannelMcps({ log });
-  }, 3e3).unref();
-}
-function getSessionState(codeName) {
-  return sessions.get(codeName) ?? null;
-}
-var ZOMBIE_PROBE_TTL_MS = 3e4;
-var ZOMBIE_STARTUP_GRACE_MS = 6e4;
-var zombieProbeCache = /* @__PURE__ */ new Map();
-var pendingZombieDetections = /* @__PURE__ */ new Map();
-function isClaudeProcessAliveInTmux(tmuxSession) {
-  const codeName = tmuxSession.replace(/^agt-/, "");
-  if (isolationMode(codeName) === "docker") {
-    try {
-      const out = execFileSync3("docker", ["exec", `agt-${codeName}`, "pgrep", "-f", "claude"], {
-        encoding: "utf-8",
-        timeout: 8e3
-      }).trim();
-      return out.length > 0;
-    } catch (err) {
-      const e = err;
-      if (e?.status === 1 || e?.status === 125 || e?.status === 126) return false;
-      return true;
-    }
-  }
-  return probeClaudeProcessInTmux(tmuxSession) === "alive";
-}
-function takeZombieDetection(codeName) {
-  const record = pendingZombieDetections.get(codeName);
-  if (record) pendingZombieDetections.delete(codeName);
-  return record ?? null;
-}
-function isSessionHealthy(codeName) {
-  const tmuxSession = `agt-${codeName}`;
-  try {
-    execSync(`tmux has-session -t ${tmuxSession} 2>/dev/null`, { stdio: "ignore" });
-  } catch {
-    const session2 = sessions.get(codeName);
-    if (session2 && session2.status === "running") {
-      session2.status = "crashed";
-      session2.lastFailureTail = readPaneLogTail(codeName);
-      const failedUuid = session2.currentSessionId;
-      if (failedUuid && failedUuid === session2.lastFailureSessionId) {
-        session2.consecutiveSameUuidFailures += 1;
-      } else {
-        session2.consecutiveSameUuidFailures = 1;
-      }
-      session2.lastFailureSessionId = failedUuid;
-    }
-    return false;
-  }
-  if (!sessions.has(codeName)) {
-    sessions.set(codeName, {
-      codeName,
-      startedAt: Date.now(),
-      restartCount: 0,
-      status: "running",
-      currentSessionId: null,
-      lastFailureTail: null,
-      lastFailureSessionId: null,
-      consecutiveSameUuidFailures: 0,
-      agentTimezone: null
-    });
-  }
-  const session = sessions.get(codeName);
-  if (session.status !== "running") {
-    session.status = "running";
-  }
-  const startedAt = session.startedAt;
-  const withinGrace = startedAt != null && Date.now() - startedAt < ZOMBIE_STARTUP_GRACE_MS;
-  if (!withinGrace) {
-    const cached = zombieProbeCache.get(codeName);
-    const cacheFresh = cached !== void 0 && Date.now() - cached.at < ZOMBIE_PROBE_TTL_MS;
-    const claudeAlive = cacheFresh ? cached.alive : isClaudeProcessAliveInTmux(tmuxSession);
-    if (!cacheFresh) {
-      zombieProbeCache.set(codeName, { at: Date.now(), alive: claudeAlive });
-    }
-    if (!claudeAlive) {
-      const paneTail = readPaneLogTail(codeName);
-      try {
-        execFileSync3("tmux", ["kill-session", "-t", tmuxSession], { stdio: "ignore" });
-      } catch {
-      }
-      session.status = "crashed";
-      session.lastFailureTail = paneTail;
-      const failedUuid = session.currentSessionId;
-      if (failedUuid && failedUuid === session.lastFailureSessionId) {
-        session.consecutiveSameUuidFailures += 1;
-      } else {
-        session.consecutiveSameUuidFailures = 1;
-      }
-      session.lastFailureSessionId = failedUuid;
-      if (!pendingZombieDetections.has(codeName)) {
-        pendingZombieDetections.set(codeName, {
-          codeName,
-          tmuxSession,
-          detectedAt: Date.now(),
-          // Cap pane tail to keep the audit payload bounded.
-          paneTail: paneTail ? paneTail.slice(-1e3) : null
-        });
-      }
-      zombieProbeCache.delete(codeName);
-      return false;
-    }
-  }
-  return true;
-}
-function resetRestartCount(codeName) {
-  const session = sessions.get(codeName);
-  if (session) session.restartCount = 0;
-}
-function collectDiagnostics(codeNames) {
-  return codeNames.map((codeName) => {
-    const session = sessions.get(codeName);
-    const tmuxSession = `agt-${codeName}`;
-    let tmuxAlive = false;
-    let screenCapture = null;
-    let launchArgs = null;
-    let channelStatus = null;
-    try {
-      execFileSync3("tmux", ["has-session", "-t", tmuxSession], { stdio: "ignore" });
-      tmuxAlive = true;
-    } catch {
-    }
-    if (tmuxAlive) {
-      try {
-        screenCapture = execFileSync3("tmux", ["capture-pane", "-t", tmuxSession, "-p", "-S", "-30"], {
-          encoding: "utf-8",
-          timeout: 3e3
-        }).trim();
-      } catch {
-      }
-    }
-    try {
-      const psOutput = execFileSync3("ps", ["aux"], { encoding: "utf-8", timeout: 3e3 });
-      const line = psOutput.split("\n").find((l) => l.includes(`agt-${codeName}`) && !l.includes("grep"));
-      if (line) {
-        const match = line.match(/claude\s+.*/);
-        launchArgs = match ? match[0].slice(0, 500) : null;
-      }
-    } catch {
-    }
-    if (screenCapture) {
-      const recentLines = screenCapture.split("\n").slice(-5).join("\n");
-      const isIdle = recentLines.includes("\u276F");
-      if (isIdle) {
-        if (screenCapture.includes("Channels require claude.ai authentication")) {
-          channelStatus = "error: auth required";
-        } else {
-          channelStatus = "ok";
-        }
-      } else if (recentLines.includes("CHANNEL_ERROR") || recentLines.includes("CLOSED")) {
-        channelStatus = "error: disconnected";
-      } else if (recentLines.includes("no MCP server configured")) {
-        channelStatus = "error: MCP server not found";
-      } else if (recentLines.includes("ignored")) {
-        channelStatus = "error: channels ignored";
-      } else {
-        channelStatus = "ok";
-      }
-    }
-    return {
-      codeName,
-      status: tmuxAlive ? session?.status ?? "running" : session?.status === "running" ? "crashed" : session?.status ?? "unknown",
-      startedAt: session?.startedAt ? new Date(session.startedAt).toISOString() : null,
-      restartCount: session?.restartCount ?? 0,
-      tmuxAlive,
-      screenCapture: screenCapture ? screenCapture.slice(-2e3) : null,
-      // limit size
-      launchArgs,
-      channelStatus
-    };
-  });
-}
-function stopAllSessions(log) {
-  for (const codeName of sessions.keys()) {
-    stopPersistentSession(codeName, log);
-  }
-}
-async function stopAllSessionsAndWait(log, opts) {
-  const codeNames = [...sessions.keys()];
-  if (codeNames.length === 0) return;
-  for (const codeName of codeNames) {
-    stopPersistentSession(codeName, log);
-  }
-  await new Promise((resolve) => setTimeout(resolve, Math.min(opts.timeoutMs, 2e3)));
-}
-function getProjectDir(codeName) {
-  return join2(homedir2(), ".augmented", codeName, "project");
-}
-
-export {
-  sessionTranscriptDir,
-  transcriptActivityAgeSeconds,
-  subagentActivityAgeSeconds,
-  isAgentIdle,
-  isStaleForToday,
-  peekCurrentSession,
-  checkChannelInputs,
-  takeWatchdogGiveUpCount,
-  creditWatchdogGiveUpCount,
-  resolveOAuthCredAction,
-  resolveClaudeBinary,
-  isolationMode,
-  EGRESS_BASELINE_DOMAINS,
-  egressMode,
-  buildEgressAllowlist,
-  egressAllowlistHostPath,
-  writeEgressAllowlist,
-  reloadEgressSidecar,
-  restartEgressSidecar,
-  buildDockerRunCommand,
-  writePersistentClaudeWrapper,
-  paneLogPath,
-  readPaneLogTail,
-  prepareForRespawn,
-  rotateSessionForWedge,
-  getLastFailureContext,
-  resolveSessionSpawnDecision,
-  directChatSessionStatePath,
-  writeDirectChatSessionState,
-  startPersistentSession,
-  SEND_KEYS_ENTER_DELAY_MS,
-  sendToAgent,
-  isAgentPromptReady,
-  _internals,
-  injectMessage,
-  injectMessageWithStatus,
-  stopPersistentSession,
-  getSessionState,
-  takeZombieDetection,
-  isSessionHealthy,
-  resetRestartCount,
-  collectDiagnostics,
-  stopAllSessions,
-  stopAllSessionsAndWait,
-  getProjectDir
-};
-//# sourceMappingURL=chunk-GWBOA7ZY.js.map