@integrity-labs/agt-cli 0.28.250 → 0.28.252

package/dist/bin/agt.js

@@ -38,7 +38,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-FQBAABKO.js";
+} from "../chunk-U2VQQ2UK.js";
 import {
   CHANNEL_REGISTRY,
   DEFAULT_FRAMEWORK,
@@ -4826,7 +4826,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.250" : "dev";
+var cliVersion = true ? "0.28.252" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -5840,7 +5840,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.250" : "dev";
+var cliVersion2 = true ? "0.28.252" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-FQBAABKO.js → chunk-U2VQQ2UK.js}

@@ -5832,7 +5832,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.250" : "dev";
+var agtCliVersion = true ? "0.28.252" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8102,4 +8102,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-FQBAABKO.js.map
+//# sourceMappingURL=chunk-U2VQQ2UK.js.map

package/dist/lib/manager-worker.js

@@ -37,7 +37,7 @@ import {
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-FQBAABKO.js";
+} from "../chunk-U2VQQ2UK.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -128,7 +128,7 @@ import {
 } from "../chunk-XWVM4KPK.js";
 
 // src/lib/manager-worker.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { readFileSync as readFileSync14, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6, existsSync as existsSync8, rmSync as rmSync4, readdirSync as readdirSync5, statSync as statSync4, copyFileSync } from "fs";
 import { execFileSync as syncExecFile } from "child_process";
 import { join as join16, dirname as dirname5 } from "path";
@@ -318,6 +318,49 @@ function decideSenderPolicyRestart(input) {
   return { restart: true, firstPoll: false, changed: true };
 }
 
+// src/lib/sender-policy-normalize.ts
+import { createHash as createHash3 } from "crypto";
+
+// src/lib/canonical-json.ts
+function canonicalJson(value) {
+  return JSON.stringify(normalize(value));
+}
+function normalize(value) {
+  if (value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map(normalize);
+  const sorted = {};
+  const keys = Object.keys(value).sort();
+  for (const k of keys) {
+    sorted[k] = normalize(value[k]);
+  }
+  return sorted;
+}
+
+// src/lib/sender-policy-normalize.ts
+var PRINCIPAL_ID_LIST_KEYS = [
+  "slack_user_ids",
+  "telegram_chat_ids",
+  "teams_aad_object_ids"
+];
+function normalizeSenderPolicyForHash(policy) {
+  if (policy === null || typeof policy !== "object") return policy;
+  const p = policy;
+  const tp = p.team_principals;
+  if (tp === null || typeof tp !== "object") return policy;
+  const src = tp;
+  const normalizedTeamPrincipals = { ...src };
+  for (const key of PRINCIPAL_ID_LIST_KEYS) {
+    const list = src[key];
+    if (Array.isArray(list)) {
+      normalizedTeamPrincipals[key] = [...list].sort();
+    }
+  }
+  return { ...p, team_principals: normalizedTeamPrincipals };
+}
+function computeSenderPolicyRestartHash(policy) {
+  return createHash3("sha256").update(canonicalJson({ senderPolicy: normalizeSenderPolicyForHash(policy) })).digest("hex");
+}
+
 // src/lib/msteams-behaviour-restart.ts
 function extractMsTeamsBehaviourSubset(config2) {
   const adaptiveCardsEnabled = config2?.["adaptive_cards_enabled"] === true;
@@ -1405,7 +1448,7 @@ function isDirectChatMessageExpired(createdAt, nowMs, maxAgeMs) {
 }
 
 // ../../packages/core/dist/host-config/capture.js
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var NON_SECRET_ENV_GATES = [
   "AGT_MEMORY_EXTRACTION_ENABLED",
   "AGT_CHANNEL_REPLAY_ENABLED",
@@ -2358,6 +2401,114 @@ function readRecentTurns(dir, nowMs) {
   return turns;
 }
 
+// src/lib/routine-candidate-extractor.ts
+var VALID_CADENCE_GUESSES = /* @__PURE__ */ new Set(["daily", "weekdays", "weekly", "unknown"]);
+var MAX_ASK_CHARS = 400;
+var MAX_INPUT_CHARS = 6e3;
+function buildUserAsksInput(turns) {
+  const lines = [];
+  let total = 0;
+  for (const turn of turns) {
+    if (turn.role !== "user") continue;
+    const body = turn.text.length > MAX_ASK_CHARS ? `${turn.text.slice(0, MAX_ASK_CHARS)}\u2026` : turn.text;
+    const line = `User: ${body}`;
+    if (total + line.length > MAX_INPUT_CHARS) break;
+    lines.push(line);
+    total += line.length;
+  }
+  return lines.join("\n");
+}
+function buildRoutinePrompt(channel, userAsks) {
+  return `You are looking for a DURABLE RECURRING ASK in the user's messages from one completed ${channel} conversation with an AI agent. A routine candidate is something the user asks for repeatedly or explicitly wants on a schedule ("every morning", "each Friday", "again" for the third time) - not a one-off task.
+
+User messages (agent replies deliberately omitted):
+"""
+${userAsks}
+"""
+
+Extract 0-2 routine candidates. For each:
+- description: the recurring ask, self-contained and generic (max 200 chars). No secrets, no personal data beyond what is needed to name the task.
+- cadence_guess: "daily", "weekdays", "weekly", or "unknown" if the messages imply repetition without a clear cadence
+- evidence_count: how many of the user messages above support this ask (integer >= 1)
+- confidence: 0.0-1.0 - how sure you are this is a genuine recurring responsibility
+
+Most conversations contain NO routine candidate - return an empty array unless the recurrence signal is clear. Do NOT invent candidates.
+
+Respond with ONLY a JSON array, no other text:
+[{"description":"...","cadence_guess":"daily","evidence_count":2,"confidence":0.7}]`;
+}
+function parseRoutineCandidates(raw) {
+  const match = raw.match(/\[[\s\S]*\]/);
+  if (!match) return null;
+  let arr;
+  try {
+    arr = JSON.parse(match[0]);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(arr)) return null;
+  const out = [];
+  for (const entry of arr) {
+    if (!entry || typeof entry !== "object") continue;
+    const c = entry;
+    const description = typeof c.description === "string" ? c.description.trim() : "";
+    if (!description) continue;
+    const confidence = typeof c.confidence === "number" && Number.isFinite(c.confidence) ? Math.max(0, Math.min(1, c.confidence)) : 0;
+    if (confidence === 0) continue;
+    const cadence = typeof c.cadence_guess === "string" && VALID_CADENCE_GUESSES.has(c.cadence_guess) ? c.cadence_guess : "unknown";
+    const evidenceRaw = typeof c.evidence_count === "number" && Number.isFinite(c.evidence_count) ? Math.floor(c.evidence_count) : 1;
+    out.push({
+      // Bounded parse only - the FINAL 200-char truncation happens after
+      // scrubbing (maybeEmitRoutineCandidates), because slicing first can
+      // split a secret across the cut so the scrub regex no longer matches
+      // and a fragment leaks onto the wire.
+      description: description.slice(0, 500),
+      cadence_guess: cadence,
+      evidence_count: Math.max(1, Math.min(50, evidenceRaw)),
+      confidence
+    });
+  }
+  return out;
+}
+async function maybeEmitRoutineCandidates(args) {
+  const { api: api2, backend, codeName, agentId, conversationId, channel, turns, log: log2 } = args;
+  try {
+    const userAsks = buildUserAsksInput(turns);
+    if (!userAsks.trim()) return;
+    let candidates;
+    try {
+      const out = await backend.run(buildRoutinePrompt(channel, userAsks));
+      candidates = parseRoutineCandidates(out);
+    } catch (err) {
+      log2(`[routine-extract] ${codeName}: extraction failed: ${err.message}`);
+      args.onModelCallError?.(err);
+      return;
+    }
+    if (!candidates || candidates.length === 0) return;
+    const scrubbed = candidates.map((c) => ({
+      ...c,
+      description: scrubSensitive(c.description).slice(0, 200)
+    }));
+    try {
+      const res = await api2.post(
+        "/host/routines/candidates",
+        {
+          agent_id: agentId,
+          conversation_id: conversationId,
+          candidates: scrubbed
+        }
+      );
+      log2(
+        `[routine-extract] ${codeName}: ${conversationId.slice(0, 8)} \u2192 ${scrubbed.length} candidate(s)${res?.discarded ? " (discarded: feature off)" : ""}`
+      );
+    } catch (err) {
+      log2(`[routine-extract] ${codeName}: report failed: ${err.message}`);
+    }
+  } catch (err) {
+    log2(`[routine-extract] ${codeName}: unexpected error: ${err.message}`);
+  }
+}
+
 // src/lib/memory-extractor.ts
 var MIN_CHECK_INTERVAL_MS5 = 10 * 6e4;
 var WINDOW_PAD_MS2 = 5 * 6e4;
@@ -2503,6 +2654,17 @@ async function maybeExtractMemories(args) {
     } catch (err) {
       log2(`[memory-extract] ${codeName}: report failed: ${err.message}`);
     }
+    await maybeEmitRoutineCandidates({
+      api: api2,
+      backend,
+      codeName,
+      agentId,
+      conversationId: conv.conversation_id,
+      channel: conv.channel,
+      turns,
+      log: log2,
+      onModelCallError: args.onModelCallError
+    });
   }
 }
 async function reportSkip2(api2, agentId, conversationId, log2, codeName) {
@@ -2858,26 +3020,11 @@ function parseExpiresAt(raw) {
   return null;
 }
 
-// src/lib/canonical-json.ts
-function canonicalJson(value) {
-  return JSON.stringify(normalize(value));
-}
-function normalize(value) {
-  if (value === null || typeof value !== "object") return value;
-  if (Array.isArray(value)) return value.map(normalize);
-  const sorted = {};
-  const keys = Object.keys(value).sort();
-  for (const k of keys) {
-    sorted[k] = normalize(value[k]);
-  }
-  return sorted;
-}
-
 // src/lib/channel-config-hash.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var CHANNEL_WRITE_VERSION = 9;
 function computeChannelConfigHash(input) {
-  return createHash4("sha256").update(
+  return createHash5("sha256").update(
     canonicalJson({
       writeVersion: CHANNEL_WRITE_VERSION,
       cliVersion: input.cliVersion,
@@ -2885,7 +3032,9 @@ function computeChannelConfigHash(input) {
       team: input.team,
       peers: input.peers,
       sessionMode: input.sessionMode ?? null,
-      senderPolicy: input.senderPolicy
+      // ENG-7435: value-blind on the team_principals id SETS so a reorder of
+      // the same principals can't oscillate this hash into a false rewrite.
+      senderPolicy: normalizeSenderPolicyForHash(input.senderPolicy)
     })
   ).digest("hex");
 }
@@ -3302,7 +3451,7 @@ function planGlobalSkillSync(globalSkills, prevIds, hashOf, knownHash) {
 }
 
 // src/lib/manager/runtime.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { readFileSync as readFileSync11, appendFileSync, mkdirSync as mkdirSync4, chmodSync, existsSync as existsSync4 } from "fs";
 import { join as join11, dirname as dirname4 } from "path";
 import { homedir as homedir5 } from "os";
@@ -3351,7 +3500,7 @@ function log(msg) {
   }
 }
 function sha256(content) {
-  return createHash5("sha256").update(content, "utf8").digest("hex");
+  return createHash6("sha256").update(content, "utf8").digest("hex");
 }
 function hashFile(filePath) {
   try {
@@ -3815,7 +3964,7 @@ function formatBoardForPrompt(items, template) {
 }
 
 // src/lib/manager/kanban/notify.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 async function enqueueKanbanNotice(opts) {
   try {
     const res = await api.post(
@@ -3830,7 +3979,7 @@ async function enqueueKanbanNotice(opts) {
     return res.ok === true;
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash6("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash7("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[kanban] notice enqueue failed for agent_id=${opts.agentId} error_id=${errId}`);
     return false;
   }
@@ -4197,7 +4346,7 @@ function deriveScheduledTaskNotify(task) {
 }
 
 // src/lib/manager/scheduler/runs.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 async function startRun(opts) {
   try {
     const res = await api.post(
@@ -4207,7 +4356,7 @@ async function startRun(opts) {
     return { run_id: res.run_id ?? null, kanban_item_id: res.kanban_item_id ?? null };
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash7("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash8("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] start failed for agent_id=${opts.agent_id} source_type=${opts.source_type} error_id=${errId}`);
     return { run_id: null, kanban_item_id: null };
   }
@@ -4224,7 +4373,7 @@ async function finishRun(runId, outcome, options = {}) {
     });
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash7("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash8("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] finish failed for run_id=${runId} outcome=${outcome} error_id=${errId}`);
   }
 }
@@ -4241,7 +4390,7 @@ async function fetchPriorScheduledRuns(agentId, taskId) {
     return rows.filter((r) => typeof r.output_text === "string" && r.output_text.length > 0).map((r) => ({ startedAt: r.started_at, output: r.output_text }));
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash7("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash8("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] prior-runs lookup failed for task_id=${taskId} error_id=${errId}`);
     return [];
   }
@@ -4290,7 +4439,7 @@ function closeScheduledRunsForCode(codeName, outcome, reason) {
 }
 
 // src/lib/manager/scheduler/kanban-route.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 
 // src/lib/delivery-schedule-link.ts
 function envSuffixFor2(codeName) {
@@ -4722,24 +4871,24 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
       const assertion = parseDeliverAssertion(rawOutput);
       if (!assertion.deliver) {
         const trimmed = (rawOutput ?? "").trim();
-        const outputHash = trimmed.length === 0 ? "empty" : createHash8("sha256").update(trimmed).digest("hex").slice(0, 12);
+        const outputHash = trimmed.length === 0 ? "empty" : createHash9("sha256").update(trimmed).digest("hex").slice(0, 12);
         log(`[claude-scheduler] Suppressed by delivery_policy=conditional for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 ${assertion.vacuous ? "deliver marker had a vacuous reason" : "no deliver marker"}; output_len=${trimmed.length} output_hash=${outputHash}`);
         if (delivery?.mode === "announce" && delivery.to) {
           await reportDeliveryStatus(agentId, delivery.taskId, { status: "skipped", error_code: "SUPPRESSED_BY_POLICY" });
         }
         return { ok: true };
       }
-      const reasonHash = createHash8("sha256").update(assertion.reason ?? "").digest("hex").slice(0, 12);
+      const reasonHash = createHash9("sha256").update(assertion.reason ?? "").digest("hex").slice(0, 12);
       log(`[claude-scheduler] Delivering conditional run for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 agent asserted a concrete trigger (reason_len=${(assertion.reason ?? "").length} reason_hash=${reasonHash})`);
       rawOutput = assertion.deliverable;
     }
     const classification = classifyOutput(rawOutput);
     if (classification.action === "suppress") {
       const trimmed = (rawOutput ?? "").trim();
-      const outputHash = trimmed.length === 0 ? "empty" : createHash8("sha256").update(trimmed).digest("hex").slice(0, 12);
+      const outputHash = trimmed.length === 0 ? "empty" : createHash9("sha256").update(trimmed).digest("hex").slice(0, 12);
       log(`[claude-scheduler] Suppressing delivery for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 output_len=${trimmed.length} output_hash=${outputHash}`);
       if (classification.suppressedNotes) {
-        const notesHash = createHash8("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
+        const notesHash = createHash9("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
         log(`[claude-scheduler] Suppressed notes for '${codeName}' (task=${delivery?.taskId ?? "n/a"}) \u2014 notes_len=${classification.suppressedNotes.length} notes_hash=${notesHash}`);
       }
       if (delivery?.mode === "announce" && delivery.to) {
@@ -4805,7 +4954,7 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
 }
 
 // src/lib/manager/scheduler/execution.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import { homedir as homedir7 } from "os";
 import { join as join14 } from "path";
 function claudePidFilePath() {
@@ -4829,10 +4978,10 @@ function unregisterClaudeSpawn(pid) {
 }
 async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
-  const stableTasksHash = createHash9("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
-  const boardHash = boardItems.length > 0 ? createHash9("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
+  const stableTasksHash = createHash10("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const boardHash = boardItems.length > 0 ? createHash10("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
   const resolvedModels = resolveModelChain(refreshData);
-  const modelsHash = createHash9("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
+  const modelsHash = createHash10("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
   const combinedHash = `${stableTasksHash}:${boardHash}:${modelsHash}`;
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (combinedHash !== prevHash) {
@@ -6206,7 +6355,7 @@ var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
     const raw = readFileSync14(join16(projectDir, ".mcp.json"), "utf-8");
-    return createHash10("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
+    return createHash11("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
   }
@@ -6520,7 +6669,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.250" : "dev";
+var agtCliVersion = true ? "0.28.252" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7498,7 +7647,7 @@ async function pollCycle() {
         claudeAuth = await detectClaudeAuth();
       } catch (err) {
         const errText = err instanceof Error ? err.message : String(err);
-        const errId = createHash10("sha256").update(errText).digest("hex").slice(0, 12);
+        const errId = createHash11("sha256").update(errText).digest("hex").slice(0, 12);
         log(`Claude auth detection failed (error_id=${errId})`);
       }
       const hostHasClaudeCode = state6.agents.some(
@@ -8825,7 +8974,7 @@ async function processAgent(agent, agentStates) {
   if (channelConfigConverged) {
     const hasSenderPolicyChannel = currentChannelIds.has("slack") || currentChannelIds.has("msteams");
     const senderPolicyForRestartHash = refreshData.sender_policy ?? null;
-    const senderPolicyHash = createHash10("sha256").update(canonicalJson({ senderPolicy: senderPolicyForRestartHash })).digest("hex");
+    const senderPolicyHash = computeSenderPolicyRestartHash(senderPolicyForRestartHash);
     const prevSenderPolicyHash = agentState.knownSenderPolicyHashes.get(agent.agent_id);
     const senderPolicyDecision = hasSenderPolicyChannel ? decideSenderPolicyRestart({
       previousHash: prevSenderPolicyHash,
@@ -8867,7 +9016,7 @@ async function processAgent(agent, agentStates) {
       const behaviourSubset = extractMsTeamsBehaviourSubset(
         msteamsEntry?.config
       );
-      const behaviourHash = createHash10("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
+      const behaviourHash = createHash11("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
       const prevBehaviourHash = agentState.knownMsTeamsBehaviourHashes.get(agent.agent_id);
       const behaviourDecision = decideSenderPolicyRestart({
         previousHash: prevBehaviourHash,
@@ -8914,7 +9063,7 @@ async function processAgent(agent, agentStates) {
       const slackBehaviourSubset = extractSlackBehaviourSubset(
         slackEntry?.config
       );
-      const slackBehaviourHash = createHash10("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
+      const slackBehaviourHash = createHash11("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
       const prevSlackBehaviourHash = agentState.knownSlackBehaviourHashes.get(agent.agent_id);
       const slackBehaviourDecision = decideSenderPolicyRestart({
         previousHash: prevSlackBehaviourHash,
@@ -9213,10 +9362,10 @@ async function processAgent(agent, agentStates) {
           desiredEntries.push({ serverId, url, headers: mcpHeaders, name: tk.toolkit_name });
         }
         const hashBasis = desiredEntries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => {
-          const headersHash = createHash10("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
+          const headersHash = createHash11("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
           return `${e.serverId}|${e.url}|${headersHash}`;
         }).join("\n");
-        const mcpHash = createHash10("sha256").update(hashBasis).digest("hex").slice(0, 16);
+        const mcpHash = createHash11("sha256").update(hashBasis).digest("hex").slice(0, 16);
         const prevMcpHash = agentState.knownManagedMcpHashes.get(agent.agent_id);
         const structureHash = managedMcpStructureHash(desiredEntries);
         const prevStructureHash = agentState.knownManagedMcpStructure.get(agent.agent_id);
@@ -9231,7 +9380,7 @@ async function processAgent(agent, agentStates) {
         if (mcpHash !== prevMcpHash) {
           for (const e of desiredEntries) {
             frameworkAdapter.writeMcpServer(agent.code_name, e.serverId, { url: e.url, headers: e.headers });
-            const urlHash = createHash10("sha256").update(e.url).digest("hex").slice(0, 12);
+            const urlHash = createHash11("sha256").update(e.url).digest("hex").slice(0, 12);
             log(`[managed-toolkit] ${agent.code_name}: wrote '${e.name}' (serverId=${e.serverId}, url_hash=${urlHash})`);
           }
           if (frameworkAdapter.removeMcpServer && frameworkAdapter.getMcpPath) {
@@ -9333,7 +9482,7 @@ async function processAgent(agent, agentStates) {
     if (frameworkAdapter.installSkillFiles) {
       const currentIntegrationSkillIds = /* @__PURE__ */ new Set();
       const installedIntegrationSkills = [];
-      const { createHash: createHash11 } = await import("crypto");
+      const { createHash: createHash12 } = await import("crypto");
       const refreshAny = refreshData;
       const contexts = refreshAny.integration_contexts ?? refreshAny.plugin_contexts ?? [];
       const contextBySlug = /* @__PURE__ */ new Map();
@@ -9362,7 +9511,7 @@ async function processAgent(agent, agentStates) {
             )
           }));
           const bundle = buildIntegrationBundle(renderedScopes);
-          const contentHash = createHash11("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
+          const contentHash = createHash12("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
           const hashKey = `plugin-skill:${agent.agent_id}:${integrationSkillId}`;
           if (agentState.knownSkillHashes.get(hashKey) === contentHash) continue;
           frameworkAdapter.installSkillFiles(agent.code_name, integrationSkillId, bundle.files);
@@ -9419,7 +9568,7 @@ async function processAgent(agent, agentStates) {
         const plan = planGlobalSkillSync(
           [...refreshAny.global_skills ?? [], ...refreshAny.shared_skills ?? []],
           agentState.knownGlobalSkillIds.get(agent.agent_id) ?? /* @__PURE__ */ new Set(),
-          (content) => createHash11("sha256").update(content).digest("hex").slice(0, 12),
+          (content) => createHash12("sha256").update(content).digest("hex").slice(0, 12),
           (skillId) => agentState.knownSkillHashes.get(`global-skill:${agent.agent_id}:${skillId}`)
         );
         for (const { skillId, content, hash } of plan.installs) {
@@ -9462,7 +9611,7 @@ async function processAgent(agent, agentStates) {
           const slug = hook.integration_slug ?? hook.plugin_slug;
           if (!slug) continue;
           try {
-            const scriptHash = createHash11("sha256").update(hook.script).digest("hex").slice(0, 12);
+            const scriptHash = createHash12("sha256").update(hook.script).digest("hex").slice(0, 12);
             const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${slug}:on_install`;
             if (agentState.knownSkillHashes.get(hookKey) === scriptHash) continue;
             const result = await frameworkAdapter.executePluginHook({
@@ -9477,9 +9626,9 @@ async function processAgent(agent, agentStates) {
             } else if (result.timedOut) {
               log(`Integration hook on_install '${slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
             } else {
-              const stderrHash = createHash11("sha256").update(result.stderr).digest("hex").slice(0, 12);
+              const stderrHash = createHash12("sha256").update(result.stderr).digest("hex").slice(0, 12);
               const missingCmd = result.exitCode === 127 ? extractCommandNotFound(result.stderr) : null;
-              const missingCmdHash = missingCmd ? createHash11("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
+              const missingCmdHash = missingCmd ? createHash12("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
               log(
                 `Integration hook on_install '${slug}' exited ${result.exitCode} for '${agent.code_name}' ` + (missingCmdHash ? `[missing_command_hash=${missingCmdHash}] ` : "") + `[stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
               );
@@ -10107,7 +10256,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       const ctx = getLastFailureContext(codeName);
       const recovery = prepareForRespawn(codeName);
       const tailSummary = !ctx.tail ? "" : KNOWN_SAFE_TAIL_SIGNATURES.has(ctx.signature) ? `; last pane output (${PANE_TAIL_PREVIEW_LINES} of ~20 lines):
-${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash10("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
+${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash11("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
       const sigSummary = ctx.signature !== "unknown" ? `; signature=${ctx.signature}` : "";
       const recoverySummary = recovery ? `; recovery=${recovery}` : "";
       log(
@@ -10121,7 +10270,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash10("sha256")
       );
       getHostId().then((hostId) => {
         if (!hostId) return;
-        const paneTailHash = zombie.paneTail ? `sha256:${createHash10("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
+        const paneTailHash = zombie.paneTail ? `sha256:${createHash11("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
         return api.post("/host/events", {
           host_id: hostId,
           agent_code_name: codeName,
@@ -10257,7 +10406,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash10("sha256")
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
   }
-  const stableTasksHash = createHash10("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const stableTasksHash = createHash11("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (stableTasksHash !== prevHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
@@ -11178,7 +11327,7 @@ async function syncMemories(agent, configDir, log2) {
       if (!file.endsWith(".md")) continue;
       try {
         const raw = readFileSync14(join16(memoryDir, file), "utf-8");
-        const fileHash = createHash10("sha256").update(raw).digest("hex").slice(0, 16);
+        const fileHash = createHash11("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
         const parsed = parseMemoryFile(raw, file.replace(/\.md$/, ""));
@@ -11216,14 +11365,14 @@ async function syncMemories(agent, configDir, log2) {
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
   const localFiles = existsSync8(memoryDir) ? readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
-  const localListHash = createHash10("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
+  const localListHash = createHash11("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
   try {
     const dbMemories = await api.post("/host/memories", {
       agent_id: agent.agent_id
     });
-    const responseHash = createHash10("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
+    const responseHash = createHash11("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
     if (!force && prevDownload && prevLocalHash === localListHash && lastDownloadHash.get(agent.agent_id) === responseHash) {
       return true;
     }
@@ -11262,7 +11411,7 @@ ${mem.content}
       }
       if (written > 0 || overwritten > 0) {
         const updatedFiles = readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort();
-        lastLocalFileHash.set(agent.agent_id, createHash10("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
+        lastLocalFileHash.set(agent.agent_id, createHash11("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
         log2(`Memory download for '${agent.code_name}': wrote ${written} new, overwrote ${overwritten} stale`);
       }
     }
@@ -11675,7 +11824,7 @@ function deployMcpAssets() {
   const fileHash = (p) => {
     try {
       if (!existsSync8(p)) return null;
-      return createHash10("sha256").update(readFileSync14(p)).digest("hex");
+      return createHash11("sha256").update(readFileSync14(p)).digest("hex");
     } catch {
       return null;
     }