@integrity-labs/agt-cli 0.28.208 → 0.28.209

package/dist/bin/agt.js

@@ -12,6 +12,7 @@ import {
   exchangeApiKey,
   executeConnectivityProbe,
   flagsCacheAgeSeconds,
+  gatherSessionToolBindProbe,
   getActiveTeam,
   getApiKey,
   getHost,
@@ -37,7 +38,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-3MHPMBN4.js";
+} from "../chunk-Z62QHIR3.js";
 import {
   CHANNEL_REGISTRY,
   DEFAULT_FRAMEWORK,
@@ -48,6 +49,7 @@ import {
   createSlackApp,
   deriveConsoleUrl,
   detectDrift,
+  directChatSessionStatePath,
   extractFrontmatter,
   generateCharterMd,
   generateSlackAppManifest,
@@ -65,11 +67,12 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-ELBYWACS.js";
+} from "../chunk-WFCCBTA6.js";
+import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
-import { join as join22 } from "path";
-import { homedir as homedir11 } from "os";
+import { join as join23 } from "path";
+import { homedir as homedir12 } from "os";
 import { Command } from "commander";
 
 // src/commands/whoami.ts
@@ -202,6 +205,84 @@ function flagsResolveCommand(opts) {
   }
 }
 
+// src/commands/probe-tools.ts
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+import { readFileSync } from "fs";
+async function probeToolsCommand(opts) {
+  const agentId = opts.agentId;
+  const codeName = opts.codeName;
+  const emit = (obj) => {
+    process.stdout.write(`${JSON.stringify(obj)}
+`);
+  };
+  if (!agentId || !codeName) {
+    emit({ ok: false, error: "agent-id and code-name are required" });
+    process.exitCode = 2;
+    return;
+  }
+  try {
+    const data = await api.post("/host/agent-integrations", {
+      agent_id: agentId
+    });
+    const integrations = data.integrations ?? [];
+    if (integrations.length === 0) {
+      emit({ ok: true, agent_id: agentId, code_name: codeName, probed: 0, reported: 0, due: 0, skipped: 0, results: [] });
+      return;
+    }
+    let sessionStartedMs = null;
+    try {
+      const raw = JSON.parse(readFileSync(directChatSessionStatePath(agentId), "utf-8"));
+      sessionStartedMs = typeof raw.startedAtMs === "number" ? raw.startedAtMs : null;
+    } catch {
+    }
+    const projectDir = join2(homedir2(), ".augmented", codeName, "project");
+    const result = await gatherSessionToolBindProbe(
+      { agent_id: agentId, code_name: codeName },
+      integrations,
+      projectDir,
+      { sessionStartedMs, intervalMs: 0, maxPerRun: integrations.length }
+    );
+    if (!result) {
+      emit({
+        ok: true,
+        agent_id: agentId,
+        code_name: codeName,
+        probed: 0,
+        reported: 0,
+        due: 0,
+        skipped: 0,
+        results: [],
+        note: "no .mcp.json to probe"
+      });
+      return;
+    }
+    if (result.reports.length > 0) {
+      await api.post("/host/session-tool-bind", { agent_id: agentId, results: result.reports });
+    }
+    const defById = new Map(integrations.map((i) => [i.id, i.definition_id]));
+    emit({
+      ok: true,
+      agent_id: agentId,
+      code_name: codeName,
+      probed: result.probed,
+      reported: result.reports.length,
+      due: result.due,
+      skipped: result.skipped,
+      session_started_ms: sessionStartedMs,
+      results: result.reports.map((r) => ({
+        integration_id: r.integration_id,
+        definition_id: defById.get(r.integration_id) ?? null,
+        scope: r.scope,
+        status: r.status
+      }))
+    });
+  } catch (err) {
+    emit({ ok: false, agent_id: agentId, code_name: codeName, error: err.message });
+    process.exitCode = 1;
+  }
+}
+
 // src/commands/team.ts
 import chalk2 from "chalk";
 import ora2 from "ora";
@@ -328,7 +409,7 @@ import ora3 from "ora";
 import { input, select, checkbox } from "@inquirer/prompts";
 import { randomUUID } from "crypto";
 import { mkdirSync, writeFileSync } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 function toSlug(name) {
   return name.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
@@ -530,10 +611,10 @@ async function initCommand(opts) {
     process.exitCode = 1;
     return;
   }
-  const agentDir = join2(process.cwd(), ".augmented", codeName);
+  const agentDir = join3(process.cwd(), ".augmented", codeName);
   mkdirSync(agentDir, { recursive: true });
-  writeFileSync(join2(agentDir, "CHARTER.md"), charterMd);
-  writeFileSync(join2(agentDir, "TOOLS.md"), toolsMd);
+  writeFileSync(join3(agentDir, "CHARTER.md"), charterMd);
+  writeFileSync(join3(agentDir, "TOOLS.md"), toolsMd);
   spinner.succeed(`Agent "${chalk3.bold(displayName)}" created.`);
   if (json) {
     jsonOutput({
@@ -585,8 +666,8 @@ async function initCommand(opts) {
 // src/commands/lint.ts
 import chalk4 from "chalk";
 import ora4 from "ora";
-import { readFileSync, existsSync } from "fs";
-import { join as join3, resolve } from "path";
+import { readFileSync as readFileSync2, existsSync } from "fs";
+import { join as join4, resolve } from "path";
 function printDiagnostics2(diagnostics) {
   for (const d of diagnostics) {
     const prefix = d.severity === "error" ? chalk4.red("ERR") : chalk4.yellow("WARN");
@@ -625,7 +706,7 @@ async function lintCommand(path) {
     }
     dirs.push({ name: path, dir: resolved });
   } else {
-    const augmentedDir = join3(process.cwd(), ".augmented");
+    const augmentedDir = join4(process.cwd(), ".augmented");
     if (!existsSync(augmentedDir)) {
       if (json) {
         jsonOutput({ ok: false, error: "No .augmented/ directory found" });
@@ -638,7 +719,7 @@ async function lintCommand(path) {
     const { readdirSync: readdirSync7, statSync: statSync5 } = await import("fs");
     const entries = readdirSync7(augmentedDir);
     for (const entry of entries) {
-      const entryPath = join3(augmentedDir, entry);
+      const entryPath = join4(augmentedDir, entry);
       if (statSync5(entryPath).isDirectory()) {
         dirs.push({ name: entry, dir: entryPath });
       }
@@ -679,8 +760,8 @@ async function lintCommand(path) {
   for (const { name, dir } of dirs) {
     if (!json) console.log(chalk4.bold(`
 Linting ${name}:`));
-    const charterPath = join3(dir, "CHARTER.md");
-    const toolsPath = join3(dir, "TOOLS.md");
+    const charterPath = join4(dir, "CHARTER.md");
+    const toolsPath = join4(dir, "TOOLS.md");
     const hasCharter = existsSync(charterPath);
     const hasTools = existsSync(toolsPath);
     if (!hasCharter && !hasTools) {
@@ -688,8 +769,8 @@ Linting ${name}:`));
       if (json) jsonResults.push({ agent: name, skipped: true });
       continue;
     }
-    const charterContent = hasCharter ? readFileSync(charterPath, "utf-8") : void 0;
-    const toolsContent = hasTools ? readFileSync(toolsPath, "utf-8") : void 0;
+    const charterContent = hasCharter ? readFileSync2(charterPath, "utf-8") : void 0;
+    const toolsContent = hasTools ? readFileSync2(toolsPath, "utf-8") : void 0;
     let result;
     if (charterContent && toolsContent) {
       result = lintAll(charterContent, toolsContent, { orgChannelPolicy: orgPolicy });
@@ -848,7 +929,7 @@ import chalk6 from "chalk";
 import ora6 from "ora";
 import { checkbox as checkbox2, confirm as confirm2, input as input2 } from "@inquirer/prompts";
 import { writeFile } from "fs/promises";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 import { tmpdir } from "os";
 async function channelSlackSetupCommand(agentCodeName, options) {
   const teamSlug = requireTeam();
@@ -920,7 +1001,7 @@ async function channelSlackSetupCommand(agentCodeName, options) {
     });
     const manifestObj = serializeManifestForSlackCli(manifest);
     const manifestJson = JSON.stringify(manifestObj, null, 2);
-    const manifestPath = join4(tmpdir(), `augmented-slack-manifest-${agentCodeName}.json`);
+    const manifestPath = join5(tmpdir(), `augmented-slack-manifest-${agentCodeName}.json`);
     await writeFile(manifestPath, manifestJson, "utf-8");
     success(`Manifest written to ${manifestPath}`);
     console.log(chalk6.dim(manifestJson));
@@ -1273,7 +1354,7 @@ import chalk8 from "chalk";
 import ora8 from "ora";
 import { select as select2, input as input3 } from "@inquirer/prompts";
 import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 async function deployCommand(opts) {
   const teamSlug = requireTeam();
   if (!teamSlug) return;
@@ -1383,9 +1464,9 @@ async function deployCommand(opts) {
     spinner.stop();
     if (!json) info(`Warning: could not record deployment in database: ${deployErr.message}`);
   }
-  const outDir = join5(process.cwd(), ".augmented", "deploy");
+  const outDir = join6(process.cwd(), ".augmented", "deploy");
   mkdirSync2(outDir, { recursive: true });
-  const outPath = join5(outDir, "docker-compose.yaml");
+  const outPath = join6(outDir, "docker-compose.yaml");
   writeFileSync2(outPath, rendered);
   spinner.succeed("Deployment config generated.");
   if (json) {
@@ -1410,7 +1491,7 @@ async function deployCommand(opts) {
 import chalk9 from "chalk";
 import ora9 from "ora";
 import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 function printDiagnostics3(diagnostics) {
   for (const d of diagnostics) {
     const prefix = d.severity === "error" ? chalk9.red("ERR") : chalk9.yellow("WARN");
@@ -1423,7 +1504,7 @@ async function provisionCommand(codeName, options) {
   if (!teamSlug) return;
   const json = isJsonMode();
   const target = options.target ?? "local_docker";
-  const outputDir = options.output ?? join6(process.cwd(), ".augmented", codeName, "provision");
+  const outputDir = options.output ?? join7(process.cwd(), ".augmented", codeName, "provision");
   const dryRun = options.dryRun ?? false;
   if (!json) console.log(chalk9.bold("\nAugmented \u2014 Provision\n"));
   const spinner = ora9({ text: "Fetching agent data\u2026", isSilent: json });
@@ -1612,10 +1693,10 @@ async function provisionCommand(codeName, options) {
   spinner.text = "Writing files\u2026";
   mkdirSync3(outputDir, { recursive: true });
   for (const artifact of provisionOutput.artifacts) {
-    writeFileSync3(join6(outputDir, artifact.relativePath), artifact.content);
+    writeFileSync3(join7(outputDir, artifact.relativePath), artifact.content);
   }
   if (deploymentYaml) {
-    writeFileSync3(join6(outputDir, "docker-compose.yaml"), deploymentYaml);
+    writeFileSync3(join7(outputDir, "docker-compose.yaml"), deploymentYaml);
   }
   spinner.text = "Storing provision snapshot\u2026";
   try {
@@ -1667,8 +1748,8 @@ async function provisionCommand(codeName, options) {
 import chalk10 from "chalk";
 import ora10 from "ora";
 import { spawn } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync7 } from "fs";
-import { delimiter, dirname as dirname3, join as join11 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "fs";
+import { delimiter, dirname as dirname3, join as join12 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/impersonate-flag.ts
@@ -1707,21 +1788,21 @@ import {
   existsSync as existsSync2,
   mkdirSync as mkdirSync4,
   readdirSync,
-  readFileSync as readFileSync2,
+  readFileSync as readFileSync3,
   renameSync,
   rmSync,
   writeFileSync as writeFileSync4
 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join7 } from "path";
-var IMPERSONATE_ROOT = join7(homedir2(), ".augmented-impersonate");
-var ACTIVE_DIR = join7(IMPERSONATE_ROOT, "active");
-var ACTIVE_MANIFEST_PATH = join7(ACTIVE_DIR, "manifest.json");
+import { homedir as homedir3 } from "os";
+import { join as join8 } from "path";
+var IMPERSONATE_ROOT = join8(homedir3(), ".augmented-impersonate");
+var ACTIVE_DIR = join8(IMPERSONATE_ROOT, "active");
+var ACTIVE_MANIFEST_PATH = join8(ACTIVE_DIR, "manifest.json");
 var SESSION_FILE_PREFIX = "session-";
 var SESSION_FILE_SUFFIX = ".json";
 function sessionManifestPath(projectCwd) {
   const hash = createHash("sha256").update(projectCwd).digest("hex").slice(0, 16);
-  return join7(ACTIVE_DIR, `${SESSION_FILE_PREFIX}${hash}${SESSION_FILE_SUFFIX}`);
+  return join8(ACTIVE_DIR, `${SESSION_FILE_PREFIX}${hash}${SESSION_FILE_SUFFIX}`);
 }
 var CODE_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function assertValidCodeName(codeName) {
@@ -1733,7 +1814,7 @@ function assertValidCodeName(codeName) {
 }
 function getImpersonateCodeNameDir(codeName) {
   assertValidCodeName(codeName);
-  return join7(IMPERSONATE_ROOT, codeName);
+  return join8(IMPERSONATE_ROOT, codeName);
 }
 function ensureCodeNameDir(codeName) {
   assertValidCodeName(codeName);
@@ -1742,7 +1823,7 @@ function ensureCodeNameDir(codeName) {
   return dir;
 }
 function ensureImpersonateWorkdir(codeName) {
-  const dir = join7(ensureCodeNameDir(codeName), "workdir");
+  const dir = join8(ensureCodeNameDir(codeName), "workdir");
   mkdirSync4(dir, { recursive: true });
   return dir;
 }
@@ -1764,7 +1845,7 @@ function validateManifest(parsed) {
 function readManifestFile(path) {
   if (!existsSync2(path)) return null;
   try {
-    return validateManifest(JSON.parse(readFileSync2(path, "utf-8")));
+    return validateManifest(JSON.parse(readFileSync3(path, "utf-8")));
   } catch {
     return null;
   }
@@ -1805,7 +1886,7 @@ function listActiveManifests() {
     if (!entry.startsWith(SESSION_FILE_PREFIX) || !entry.endsWith(SESSION_FILE_SUFFIX)) {
       continue;
     }
-    const manifest = readManifestFile(join7(ACTIVE_DIR, entry));
+    const manifest = readManifestFile(join8(ACTIVE_DIR, entry));
     if (manifest) out.push(manifest);
   }
   return out;
@@ -1840,14 +1921,14 @@ import {
   symlinkSync,
   unlinkSync
 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname, join as join8, parse, sep } from "path";
+import { homedir as homedir4 } from "os";
+import { dirname, join as join9, parse, sep } from "path";
 var BACKUP_SUFFIX = ".pre-impersonate-backup";
 function findGitWorkTreeRoot(startDir) {
   const { root } = parse(startDir);
   let dir = startDir;
   for (; ; ) {
-    if (existsSync3(join8(dir, ".git"))) return dir;
+    if (existsSync3(join9(dir, ".git"))) return dir;
     if (dir === root) return null;
     const parent = dirname(dir);
     if (parent === dir) return null;
@@ -1862,7 +1943,7 @@ function swapInPersonaFile(projectPath, personaPath) {
     const stat = lstatSync(projectPath);
     if (stat.isSymbolicLink()) {
       const target = readlinkSync(projectPath);
-      const ourRoot = realpathSync(homedir3()) + sep + ".augmented-impersonate" + sep;
+      const ourRoot = realpathSync(homedir4()) + sep + ".augmented-impersonate" + sep;
       let resolvedTarget;
       try {
         resolvedTarget = realpathSync(projectPath);
@@ -1924,20 +2005,20 @@ import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   renameSync as renameSync3,
   rmdirSync,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync5
 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var INTRODUCE_HOOK_COMMAND = "agt impersonate introduce";
 var SESSION_START_MATCHER = "startup";
 function registerIntroduceHook(projectCwd, command = INTRODUCE_HOOK_COMMAND) {
-  const claudeDir = join9(projectCwd, ".claude");
+  const claudeDir = join10(projectCwd, ".claude");
   const createdClaudeDir = !existsSync4(claudeDir);
   mkdirSync5(claudeDir, { recursive: true });
-  const settingsPath = join9(claudeDir, "settings.local.json");
+  const settingsPath = join10(claudeDir, "settings.local.json");
   const settingsExisted = existsSync4(settingsPath);
   const backupPath = settingsPath + BACKUP_SUFFIX;
   let settings = {};
@@ -1945,7 +2026,7 @@ function registerIntroduceHook(projectCwd, command = INTRODUCE_HOOK_COMMAND) {
     if (!existsSync4(backupPath)) {
       copyFileSync(settingsPath, backupPath);
     }
-    settings = asPlainObject(safeParseJson(readFileSync3(settingsPath, "utf-8")));
+    settings = asPlainObject(safeParseJson(readFileSync4(settingsPath, "utf-8")));
   }
   const hooks = asPlainObject(settings["hooks"]);
   const existing = Array.isArray(hooks[SESSION_START_KEY]) ? [...hooks[SESSION_START_KEY]] : [];
@@ -2018,17 +2099,17 @@ import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync6,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   renameSync as renameSync4,
   rmdirSync as rmdirSync2,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync6
 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname2, join as join10 } from "path";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname2, join as join11 } from "path";
 import { fileURLToPath } from "url";
-var INSTALLED_STATUSLINE_PATH = join10(
-  homedir4(),
+var INSTALLED_STATUSLINE_PATH = join11(
+  homedir5(),
   ".augmented-impersonate",
   "statusline.sh"
 );
@@ -2037,7 +2118,7 @@ var STATUS_LINE_COMMAND_TYPE = "command";
 function installStatusLineAsset(targetPath = INSTALLED_STATUSLINE_PATH) {
   mkdirSync6(dirname2(targetPath), { recursive: true });
   const source = resolveBundledAssetPath();
-  const needsCopy = !existsSync5(targetPath) || readFileSync4(source, "utf-8") !== readFileSync4(targetPath, "utf-8");
+  const needsCopy = !existsSync5(targetPath) || readFileSync5(source, "utf-8") !== readFileSync5(targetPath, "utf-8");
   if (needsCopy) {
     copyFileSync2(source, targetPath);
     chmodSync2(targetPath, 493);
@@ -2047,10 +2128,10 @@ function registerStatusLine(projectCwd, options = {}) {
   if (options.installAsset !== false) {
     installStatusLineAsset();
   }
-  const claudeDir = join10(projectCwd, ".claude");
+  const claudeDir = join11(projectCwd, ".claude");
   const createdClaudeDir = !existsSync5(claudeDir);
   mkdirSync6(claudeDir, { recursive: true });
-  const settingsPath = join10(claudeDir, "settings.local.json");
+  const settingsPath = join11(claudeDir, "settings.local.json");
   const settingsExisted = existsSync5(settingsPath);
   const backupPath = settingsPath + BACKUP_SUFFIX;
   let settings = {};
@@ -2058,7 +2139,7 @@ function registerStatusLine(projectCwd, options = {}) {
     if (!existsSync5(backupPath)) {
       copyFileSync2(settingsPath, backupPath);
     }
-    settings = asPlainObject2(safeParseJson2(readFileSync4(settingsPath, "utf-8")));
+    settings = asPlainObject2(safeParseJson2(readFileSync5(settingsPath, "utf-8")));
   }
   settings[STATUS_LINE_KEY] = {
     type: STATUS_LINE_COMMAND_TYPE,
@@ -2098,11 +2179,11 @@ function resolveBundledAssetPath() {
   const moduleDir = dirname2(fileURLToPath(import.meta.url));
   const candidates = [
     // Built output: dist/<chunk>.js → dist/assets/...
-    join10(moduleDir, "assets", "impersonate-statusline.sh"),
+    join11(moduleDir, "assets", "impersonate-statusline.sh"),
     // Built output sibling case: dist/<sub>/<chunk>.js → dist/assets/...
-    join10(moduleDir, "..", "assets", "impersonate-statusline.sh"),
+    join11(moduleDir, "..", "assets", "impersonate-statusline.sh"),
     // Dev source: src/lib/impersonate-statusline.ts → ../../assets/...
-    join10(moduleDir, "..", "..", "assets", "impersonate-statusline.sh")
+    join11(moduleDir, "..", "..", "assets", "impersonate-statusline.sh")
   ];
   for (const candidate of candidates) {
     if (existsSync5(candidate)) return candidate;
@@ -2113,7 +2194,7 @@ function resolveBundledAssetPath() {
   );
 }
 function stripStatusLineKey(settingsPath) {
-  const settings = asPlainObject2(safeParseJson2(readFileSync4(settingsPath, "utf-8")));
+  const settings = asPlainObject2(safeParseJson2(readFileSync5(settingsPath, "utf-8")));
   if (!(STATUS_LINE_KEY in settings)) return;
   delete settings[STATUS_LINE_KEY];
   writeFileSync6(settingsPath, JSON.stringify(settings, null, 2) + "\n");
@@ -2310,11 +2391,11 @@ async function impersonateConnectCommand(token, options = {}) {
   spinner.text = "Writing persona files\u2026";
   const personaDir = ensureCodeNameDir(bundle.agent.code_name);
   writeFileSync7(
-    join11(personaDir, "CLAUDE.md"),
+    join12(personaDir, "CLAUDE.md"),
     bundle.artifacts["CLAUDE.md"]
   );
   writeFileSync7(
-    join11(personaDir, ".mcp.json"),
+    join12(personaDir, ".mcp.json"),
     rewriteMcpJsonForImpersonation(bundle.artifacts[".mcp.json"], {
       operatorHome: process.env.HOME ?? "",
       operatorPath: resolveOperatorPath(),
@@ -2343,8 +2424,8 @@ async function impersonateConnectCommand(token, options = {}) {
   let statusLineBackup;
   try {
     for (const file of SWAP_FILES) {
-      const projectPath = join11(projectCwd, file);
-      const kind = swapInPersonaFile(projectPath, join11(personaDir, file));
+      const projectPath = join12(projectCwd, file);
+      const kind = swapInPersonaFile(projectPath, join12(personaDir, file));
       backups[file] = kind;
       swapped.push({ file, kind });
     }
@@ -2380,7 +2461,7 @@ async function impersonateConnectCommand(token, options = {}) {
     }
     for (const { file, kind } of [...swapped].reverse()) {
       try {
-        restoreSwapped(join11(projectCwd, file), kind);
+        restoreSwapped(join12(projectCwd, file), kind);
       } catch {
       }
     }
@@ -2588,7 +2669,7 @@ async function performImpersonateExit(manifest, opts) {
   }
   const restored = [];
   for (const [file, kind] of Object.entries(manifest.backups)) {
-    const projectPath = join11(manifest.project_cwd, file);
+    const projectPath = join12(manifest.project_cwd, file);
     try {
       restoreSwapped(projectPath, kind);
       restored.push(file);
@@ -2666,8 +2747,8 @@ async function impersonateIntroduceCommand() {
     const manifest = readActiveManifest(process.cwd());
     if (!manifest || isExpired(manifest)) return;
     const cwd = manifest.project_cwd;
-    const identity = readClaudeMdIdentity(join11(cwd, "CLAUDE.md"));
-    const integrations = readMcpIntegrations(join11(cwd, ".mcp.json"));
+    const identity = readClaudeMdIdentity(join12(cwd, "CLAUDE.md"));
+    const integrations = readMcpIntegrations(join12(cwd, ".mcp.json"));
     const intro = buildIntroduction({
       displayName: identity.displayName,
       codeName: manifest.code_name,
@@ -2680,14 +2761,14 @@ async function impersonateIntroduceCommand() {
 }
 function readClaudeMdIdentity(path) {
   try {
-    return parseIdentityFromClaudeMd(readFileSync5(path, "utf-8"));
+    return parseIdentityFromClaudeMd(readFileSync6(path, "utf-8"));
   } catch {
     return { displayName: null, role: null };
   }
 }
 function readMcpIntegrations(path) {
   try {
-    return parseIntegrationsFromMcpJson(readFileSync5(path, "utf-8"));
+    return parseIntegrationsFromMcpJson(readFileSync6(path, "utf-8"));
   } catch {
     return [];
   }
@@ -2695,12 +2776,12 @@ function readMcpIntegrations(path) {
 function resolveCliMcpBundleDir() {
   const moduleDir = dirname3(fileURLToPath2(import.meta.url));
   const candidates = [
-    join11(moduleDir, "mcp"),
-    join11(moduleDir, "..", "mcp"),
-    join11(moduleDir, "..", "..", "mcp")
+    join12(moduleDir, "mcp"),
+    join12(moduleDir, "..", "mcp"),
+    join12(moduleDir, "..", "..", "mcp")
   ];
   for (const candidate of candidates) {
-    if (existsSync6(join11(candidate, "index.js"))) return candidate;
+    if (existsSync6(join12(candidate, "index.js"))) return candidate;
   }
   return candidates[candidates.length - 1];
 }
@@ -2729,7 +2810,7 @@ function buildImpersonateClaudeLaunch(projectCwd, inheritEnv = process.env, agen
     args: [
       "--strict-mcp-config",
       "--mcp-config",
-      join11(projectCwd, ".mcp.json")
+      join12(projectCwd, ".mcp.json")
     ],
     env
   };
@@ -2742,7 +2823,7 @@ import ora11 from "ora";
 // ../../packages/core/dist/drift/live-state-reader.js
 import { readFile } from "fs/promises";
 import { createHash as createHash2 } from "crypto";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import JSON5 from "json5";
 async function hashFile(filePath) {
   try {
@@ -2766,8 +2847,8 @@ async function readLiveState(options) {
   const toolsFile = trackedFiles.find((f) => f.includes("TOOLS")) ?? "TOOLS.md";
   const [frameworkConfig, charterHash, toolsHash] = await Promise.all([
     readJsonFile(options.configPath),
-    hashFile(join12(options.teamDir, charterFile)),
-    hashFile(join12(options.teamDir, toolsFile))
+    hashFile(join13(options.teamDir, charterFile)),
+    hashFile(join13(options.teamDir, toolsFile))
   ]);
   return {
     frameworkConfig,
@@ -3467,15 +3548,15 @@ function terminate(child) {
 // src/commands/manager-watch.tsx
 import { useEffect, useState, useMemo } from "react";
 import { render, Box, Text, useApp, useInput } from "ink";
-import { existsSync as existsSync7, readFileSync as readFileSync6, statSync, openSync, readSync, closeSync } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join13 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, statSync, openSync, readSync, closeSync } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join14 } from "path";
 import { jsx, jsxs } from "react/jsx-runtime";
 var REFRESH_MS = 1e3;
 var LOG_TAIL_LINES = 200;
 var DETAIL_RECENT_LINES = 50;
 function managerWatchCommand(opts = {}) {
-  const configDir = opts.configDir ?? join13(homedir5(), ".augmented");
+  const configDir = opts.configDir ?? join14(homedir6(), ".augmented");
   const paths = getManagerPaths(configDir);
   const isTty = process.stdout.isTTY === true && process.stdin.isTTY === true;
   if (opts.noTui || !isTty) {
@@ -3500,7 +3581,7 @@ function managerWatchCommand(opts = {}) {
 function readState(stateFile) {
   try {
     if (!existsSync7(stateFile)) return null;
-    const raw = readFileSync6(stateFile, "utf-8");
+    const raw = readFileSync7(stateFile, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -3757,7 +3838,7 @@ Start the manager first: agt manager start
   }
   let lastSize = 0;
   try {
-    const initial = readFileSync6(logFile, "utf-8");
+    const initial = readFileSync7(logFile, "utf-8");
     process.stdout.write(initial);
     lastSize = statSync(logFile).size;
   } catch (err) {
@@ -3793,12 +3874,12 @@ Start the manager first: agt manager start
 
 // src/commands/agent.ts
 import chalk14 from "chalk";
-import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
-import { join as join14 } from "path";
+import { readFileSync as readFileSync8, existsSync as existsSync8 } from "fs";
+import { join as join15 } from "path";
 async function agentShowCommand(codeName, opts) {
   const json = isJsonMode();
-  const unifiedDir = join14(opts.configDir, codeName, "provision");
-  const legacyDir = join14(opts.configDir, codeName, "claudecode", "provision");
+  const unifiedDir = join15(opts.configDir, codeName, "provision");
+  const legacyDir = join15(opts.configDir, codeName, "claudecode", "provision");
   const agentDir = existsSync8(unifiedDir) ? unifiedDir : legacyDir;
   const hasLocalConfig = existsSync8(agentDir);
   let apiChannels = null;
@@ -3832,26 +3913,26 @@ async function agentShowCommand(codeName, opts) {
   let tools = null;
   let agentState = null;
   if (hasLocalConfig) {
-    const charterPath = join14(agentDir, "CHARTER.md");
+    const charterPath = join15(agentDir, "CHARTER.md");
     if (existsSync8(charterPath)) {
-      const raw = readFileSync7(charterPath, "utf-8");
+      const raw = readFileSync8(charterPath, "utf-8");
       const parsed = extractFrontmatter(raw);
       if (parsed.frontmatter) {
         charter = parsed.frontmatter;
       }
     }
-    const toolsPath = join14(agentDir, "TOOLS.md");
+    const toolsPath = join15(agentDir, "TOOLS.md");
     if (existsSync8(toolsPath)) {
-      const raw = readFileSync7(toolsPath, "utf-8");
+      const raw = readFileSync8(toolsPath, "utf-8");
       const parsed = extractFrontmatter(raw);
       if (parsed.frontmatter) {
         tools = parsed.frontmatter;
       }
     }
-    const statePath = join14(opts.configDir, "manager-state.json");
+    const statePath = join15(opts.configDir, "manager-state.json");
     if (existsSync8(statePath)) {
       try {
-        const raw = readFileSync7(statePath, "utf-8");
+        const raw = readFileSync8(statePath, "utf-8");
         const state = JSON.parse(raw);
         agentState = state.agents?.find((a) => a.codeName === codeName) ?? null;
       } catch {
@@ -4170,24 +4251,24 @@ async function kanbanRecurringDisableCommand(titleOrId, opts) {
 }
 
 // src/commands/setup.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync8, mkdirSync as mkdirSync7, accessSync, constants as fsConstants } from "fs";
-import { join as join15, dirname as dirname4 } from "path";
-import { homedir as homedir6 } from "os";
+import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync8, mkdirSync as mkdirSync7, accessSync, constants as fsConstants } from "fs";
+import { join as join16, dirname as dirname4 } from "path";
+import { homedir as homedir7 } from "os";
 import chalk16 from "chalk";
 import ora14 from "ora";
 function detectShellProfile() {
   const shell = process.env["SHELL"] ?? "";
-  const home = homedir6();
+  const home = homedir7();
   if (shell.includes("zsh")) {
-    return join15(home, ".zshrc");
+    return join16(home, ".zshrc");
   }
   if (shell.includes("fish")) {
-    const fishConfig = join15(home, ".config", "fish", "config.fish");
+    const fishConfig = join16(home, ".config", "fish", "config.fish");
     return fishConfig;
   }
-  const bashrc = join15(home, ".bashrc");
+  const bashrc = join16(home, ".bashrc");
   if (existsSync9(bashrc)) return bashrc;
-  return join15(home, ".bash_profile");
+  return join16(home, ".bash_profile");
 }
 function maybeWriteSystemWideEnv(apiUrl, apiKey, consoleUrl) {
   const empty = { etcEnvironment: false, profileD: false, bashrc: false };
@@ -4220,7 +4301,7 @@ function writeEtcEnvironment(apiUrl, apiKey, consoleUrl) {
     return false;
   }
   try {
-    const current = readFileSync8(envPath, "utf-8");
+    const current = readFileSync9(envPath, "utf-8");
     const stripped = current.split(/\r?\n/).filter((line) => !/^\s*(?:export\s+)?AGT_(?:HOST|API_KEY|CONSOLE_URL)=/.test(line)).join("\n");
     const base = stripped.endsWith("\n") || stripped.length === 0 ? stripped : `${stripped}
 `;
@@ -4269,7 +4350,7 @@ function ensureBashrcSourcesProfileD() {
     return false;
   }
   try {
-    const current = readFileSync8(bashrc, "utf-8");
+    const current = readFileSync9(bashrc, "utf-8");
     const marker = "# Augmented (agt) \u2014 source system-wide AGT env";
     if (current.includes(marker)) return true;
     const snippet = [
@@ -4413,7 +4494,7 @@ async function setupCommand(token, options = {}) {
     mkdirSync7(profileDir, { recursive: true });
   }
   const marker = "# Augmented (agt) host configuration";
-  const current = existsSync9(profilePath) ? readFileSync8(profilePath, "utf-8") : "";
+  const current = existsSync9(profilePath) ? readFileSync9(profilePath, "utf-8") : "";
   let updated;
   if (current.includes(marker)) {
     updated = current.replace(
@@ -4444,7 +4525,7 @@ async function setupCommand(token, options = {}) {
   const managerSpinner = ora14({ text: "Starting manager daemon\u2026", isSilent: json });
   managerSpinner.start();
   try {
-    const configDir = join15(homedir6(), ".augmented");
+    const configDir = join16(homedir7(), ".augmented");
     const { pid } = startWatchdog({ intervalMs: 1e4, configDir, detached: true });
     managerSpinner.succeed(`Manager started (PID ${pid})`);
   } catch (err) {
@@ -4749,7 +4830,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.208" : "dev";
+var cliVersion = true ? "0.28.209" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -4981,12 +5062,12 @@ async function checkForUpdateOnStartup() {
 }
 
 // src/commands/audit-subagents.ts
-import { homedir as homedir7 } from "os";
-import { join as join17 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join18 } from "path";
 
 // src/lib/subagent-mcp-audit.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync2 } from "fs";
-import { join as join16 } from "path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync10, statSync as statSync2 } from "fs";
+import { join as join17 } from "path";
 function parseFrontmatter(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!match) return null;
@@ -5036,7 +5117,7 @@ function findSubagentFiles(dir, depth = 0) {
   const out = [];
   const isAgentsDir = dir.endsWith("/agents") || dir.endsWith("\\agents");
   for (const entry of entries) {
-    const full = join16(dir, entry);
+    const full = join17(dir, entry);
     let s;
     try {
       s = statSync2(full);
@@ -5060,7 +5141,7 @@ function auditSubagentMcpBindings(rootDirs) {
       seen.add(file);
       let content;
       try {
-        content = readFileSync9(file, "utf-8");
+        content = readFileSync10(file, "utf-8");
       } catch {
         continue;
       }
@@ -5083,11 +5164,11 @@ function formatFinding(f) {
 
 // src/commands/audit-subagents.ts
 function defaultRoots() {
-  const home = homedir7();
+  const home = homedir8();
   return [
-    join17(home, ".claude", "agents"),
-    join17(home, ".claude", "plugins"),
-    join17(process.cwd(), ".claude", "agents")
+    join18(home, ".claude", "agents"),
+    join18(home, ".claude", "plugins"),
+    join18(process.cwd(), ".claude", "agents")
   ];
 }
 async function auditSubagentsCommand(options = {}) {
@@ -5122,9 +5203,9 @@ async function auditSubagentsCommand(options = {}) {
 }
 
 // src/lib/mcp-render-allowlist-audit.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join18 } from "path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync3 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join19 } from "path";
 function expectedWildcard(serverKey) {
   return `mcp__${serverKey.replace(/-/g, "_")}__*`;
 }
@@ -5137,13 +5218,13 @@ function parseMcpWildcardsFromToolsLine(content) {
 }
 function readMcpServerKeys(mcpJsonPath) {
   try {
-    const config = JSON.parse(readFileSync10(mcpJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync11(mcpJsonPath, "utf-8"));
     return Object.keys(config.mcpServers ?? {});
   } catch {
     return null;
   }
 }
-function auditMcpRenderAllowlist(rootDir = join18(homedir8(), ".augmented")) {
+function auditMcpRenderAllowlist(rootDir = join19(homedir9(), ".augmented")) {
   const findings = [];
   let entries;
   try {
@@ -5152,7 +5233,7 @@ function auditMcpRenderAllowlist(rootDir = join18(homedir8(), ".augmented")) {
     return findings;
   }
   for (const entry of entries) {
-    const agentDir = join18(rootDir, entry);
+    const agentDir = join19(rootDir, entry);
     let s;
     try {
       s = statSync3(agentDir);
@@ -5161,15 +5242,15 @@ function auditMcpRenderAllowlist(rootDir = join18(homedir8(), ".augmented")) {
     }
     if (!s.isDirectory() || entry.startsWith("_") || entry.startsWith(".")) continue;
     for (const scope of ["provision", "project"]) {
-      const mcpJsonPath = scope === "provision" ? join18(agentDir, "provision", ".mcp.json") : join18(agentDir, "project", ".mcp.json");
+      const mcpJsonPath = scope === "provision" ? join19(agentDir, "provision", ".mcp.json") : join19(agentDir, "project", ".mcp.json");
       const keys = readMcpServerKeys(mcpJsonPath);
       if (keys === null || keys.length === 0) continue;
       const expected = new Set(keys.map(expectedWildcard));
       for (const subagent of ["channel-message-handler", "augmented-worker"]) {
-        const mdPath = scope === "provision" ? join18(agentDir, ".claude", "agents", `${subagent}.md`) : join18(agentDir, "project", ".claude", "agents", `${subagent}.md`);
+        const mdPath = scope === "provision" ? join19(agentDir, ".claude", "agents", `${subagent}.md`) : join19(agentDir, "project", ".claude", "agents", `${subagent}.md`);
         let content;
         try {
-          content = readFileSync10(mdPath, "utf-8");
+          content = readFileSync11(mdPath, "utf-8");
         } catch {
           continue;
         }
@@ -5227,12 +5308,12 @@ async function auditMcpRenderCommand(options = {}) {
 }
 
 // src/commands/audit-secrets.ts
-import { homedir as homedir9 } from "os";
-import { join as join20 } from "path";
+import { homedir as homedir10 } from "os";
+import { join as join21 } from "path";
 
 // src/lib/secret-leak-audit.ts
-import { readdirSync as readdirSync6, readFileSync as readFileSync11, statSync as statSync4 } from "fs";
-import { join as join19 } from "path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync4 } from "fs";
+import { join as join20 } from "path";
 var SECRET_KEY_NAME_RE = /TOKEN|KEY|SECRET|BEARER|PASSWORD/i;
 function isTemplated(value) {
   return value.includes("${");
@@ -5258,7 +5339,7 @@ function scanMcpFile(file, agent2, findings) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync11(file, "utf-8"));
+    parsed = JSON.parse(readFileSync12(file, "utf-8"));
   } catch {
     return;
   }
@@ -5302,15 +5383,15 @@ function auditSecretLeaks(augmentedRoot) {
     return findings;
   }
   for (const agent2 of agents) {
-    const agentDir = join19(augmentedRoot, agent2);
+    const agentDir = join20(augmentedRoot, agent2);
     try {
       if (!statSync4(agentDir).isDirectory()) continue;
     } catch {
       continue;
     }
-    scanMcpFile(join19(agentDir, "provision", ".mcp.json"), agent2, findings);
-    scanMcpFile(join19(agentDir, "project", ".mcp.json"), agent2, findings);
-    scanEnvIntegrations(join19(agentDir, ".env.integrations"), agent2, findings);
+    scanMcpFile(join20(agentDir, "provision", ".mcp.json"), agent2, findings);
+    scanMcpFile(join20(agentDir, "project", ".mcp.json"), agent2, findings);
+    scanEnvIntegrations(join20(agentDir, ".env.integrations"), agent2, findings);
   }
   return findings;
 }
@@ -5336,7 +5417,7 @@ function describe(f) {
   return `secret file is mode ${f.mode} (expected 0600)`;
 }
 async function auditSecretsCommand(options = {}) {
-  const root = options.root ?? join20(homedir9(), ".augmented");
+  const root = options.root ?? join21(homedir10(), ".augmented");
   const findings = auditSecretLeaks(root);
   if (options.json) {
     process.stdout.write(`${JSON.stringify({ findings, root }, null, 2)}
@@ -5372,8 +5453,8 @@ async function auditSecretsCommand(options = {}) {
 }
 
 // src/commands/integration.ts
-import { homedir as homedir10 } from "os";
-import { join as join21 } from "path";
+import { homedir as homedir11 } from "os";
+import { join as join22 } from "path";
 import chalk19 from "chalk";
 import ora17 from "ora";
 async function fetchAgents() {
@@ -5476,7 +5557,7 @@ async function integrationProbeCommand(agentCodeName, slug) {
       process.exitCode = 1;
       return;
     }
-    const projectDir = join21(homedir10(), ".augmented", agentCodeName, "project");
+    const projectDir = join22(homedir11(), ".augmented", agentCodeName, "project");
     const probeEnv = buildProbeEnv(projectDir);
     const probeDeps = buildConnectivityProbeDeps(projectDir, probeEnv);
     const sourceType = integ.source_type ?? null;
@@ -5763,7 +5844,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.208" : "dev";
+var cliVersion2 = true ? "0.28.209" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {
@@ -5783,6 +5864,9 @@ var flags = program.command("flags").description("Inspect feature flags resolved
 flags.command("resolve").description("Print each flag\u2019s effective value and source layer (env / heartbeat-cache / compiled default)").option("--flag <key>", "Resolve a single flag by key instead of all registered flags").option("--host", "Show host-cache diagnostics (unrecognised cached keys from a newer API)").option("--config-dir <path>", "Manager config dir holding flags-cache.json (default ~/.augmented)").action((opts) => {
   flagsResolveCommand(opts);
 });
+program.command("probe-tools", { hidden: true }).description("Run a one-shot session-tool-bind probe for one agent and print JSON verdicts").requiredOption("--agent-id <uuid>", "Agent UUID to probe").requiredOption("--code-name <name>", "Agent code_name (resolves its project dir)").option("--json", "Emit JSON (always on; accepted for symmetry)").action((opts) => {
+  return probeToolsCommand(opts);
+});
 program.command("setup <token>").description("One-command host setup: exchange provisioning token, configure env vars, verify, and start manager").option(
   "--api-host <url>",
   // ENG-5831: required when AGT_HOST is not set in the shell — the setup
@@ -5860,16 +5944,16 @@ host.command("pair <host-name>").description("Start an SSM port-forward + shell
   })
 );
 var manager = program.command("manager").description("Host config sync daemon \u2014 keeps local agent files in sync with API");
-manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join22(homedir11(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
-manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join22(homedir11(), ".augmented")).action(managerStopCommand);
-manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join22(homedir11(), ".augmented")).action(managerStatusCommand);
-manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join22(homedir11(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
-manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join22(homedir11(), ".augmented")).action(managerInstallCommand);
+manager.command("start").description("Start the manager daemon (polls API for config changes and detects local drift)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join23(homedir12(), ".augmented")).option("--supervise", "Wrap the manager in a respawn-on-clean-exit loop so auto-upgrades can restart it transparently (ENG-4488)", false).action(managerStartCommand);
+manager.command("stop").description("Stop the running manager daemon").option("--config-dir <dir>", "Config directory for agent files", join23(homedir12(), ".augmented")).action(managerStopCommand);
+manager.command("status").description("Show the current manager daemon status and discovered agents").option("--config-dir <dir>", "Config directory for agent files", join23(homedir12(), ".augmented")).action(managerStatusCommand);
+manager.command("watch").description("Live TUI dashboard \u2014 per-agent boxes, drill-in, log tail. Read-only (ENG-4555).").option("--config-dir <dir>", "Config directory for agent files", join23(homedir12(), ".augmented")).option("--no-tui", "Skip the TUI and stream the manager log to stdout instead (CI / scripts)").action(managerWatchCommand);
+manager.command("install").description("Install OS-level supervisor (launchd LaunchAgent on macOS) so the manager auto-restarts after crash, reboot, or self-update (ENG-4593)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files", join23(homedir12(), ".augmented")).action(managerInstallCommand);
 manager.command("uninstall").description("Remove the OS-level supervisor (launchctl unload + delete plist on macOS). Idempotent.").action(managerUninstallCommand);
 manager.command("install-system-unit").description("Install a system-level systemd unit (Linux, root) so the manager auto-starts on every boot. For headless EC2 hosts \u2014 survives reboot without `loginctl enable-linger`. (ENG-4706)").option("--interval <seconds>", "Poll interval in seconds (min 5)", "10").option("--config-dir <dir>", "Config directory for agent files (defaults to /root/.augmented or /home/<user>/.augmented)").option("--user <name>", "Unix user the manager runs as", "root").action(managerInstallSystemUnitCommand);
 manager.command("uninstall-system-unit").description("Remove the system-level systemd unit (Linux, root). Idempotent. (ENG-4706)").action(managerUninstallSystemUnitCommand);
 var agent = program.command("agent").description("Inspect and manage agents");
-agent.command("show <code-name>").description("Display an agent's provisioned configuration").option("--config-dir <dir>", "Config directory", join22(homedir11(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
+agent.command("show <code-name>").description("Display an agent's provisioned configuration").option("--config-dir <dir>", "Config directory", join23(homedir12(), ".augmented")).option("--all-channels", "Show all channels (including disabled)").action(agentShowCommand);
 var kanban = program.command("kanban").description("Manage agent kanban boards");
 kanban.command("list").description("List kanban board items for an agent").requiredOption("--agent <code-name>", "Agent code name").action(kanbanListCommand);
 kanban.command("add <title>").description("Add a new item to an agent kanban board").requiredOption("--agent <code-name>", "Agent code name").option("--priority <1|2|3>", "Priority: 1=high, 2=medium, 3=low", "2").option("--status <status>", "Initial status: backlog | todo | in_progress", "todo").option("--description <text>", "Item description").option("--estimate <minutes>", "Estimated time in minutes").option("--deliverable <text>", "Expected output/deliverable").action(kanbanAddCommand);