@integrity-labs/agt-cli 0.28.31 → 0.28.33

package/dist/{chunk-SR6RHUAV.js → chunk-HTRILMXV.js}

@@ -1,7 +1,7 @@
 import {
   claudeModelAlias,
   isClaudeFastMode
-} from "./chunk-VIIPFWE4.js";
+} from "./chunk-R5CP4WAO.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -1487,4 +1487,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-SR6RHUAV.js.map
+//# sourceMappingURL=chunk-HTRILMXV.js.map

package/dist/{chunk-VIIPFWE4.js → chunk-R5CP4WAO.js}

@@ -5299,10 +5299,11 @@ export {
   isEmptyTotals,
   attributeTranscriptUsageByRun,
   KANBAN_CHECK_COMMAND,
+  FLAG_REGISTRY,
   getFlagDefinition,
   listFlagDefinitions,
   normalizeFlagValue,
   coerceEnvValue,
   FLAGS_SCHEMA_VERSION
 };
-//# sourceMappingURL=chunk-VIIPFWE4.js.map
+//# sourceMappingURL=chunk-R5CP4WAO.js.map

package/dist/{claude-pair-runtime-RLIUZRLZ.js → claude-pair-runtime-LP4W56RT.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-JHBXSNVW.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-RNALQ7JD.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-RLIUZRLZ.js.map
+//# sourceMappingURL=claude-pair-runtime-LP4W56RT.js.map

package/dist/lib/manager-worker.js

@@ -21,8 +21,9 @@ import {
   provisionSessionStateHook,
   provisionStopHook,
   requireHost,
-  safeWriteJsonAtomic
-} from "../chunk-EJIU6AD6.js";
+  safeWriteJsonAtomic,
+  setConfigHash
+} from "../chunk-7V2NY5F6.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -64,9 +65,10 @@ import {
   takeWatchdogGiveUpCount,
   takeZombieDetection,
   transcriptActivityAgeSeconds
-} from "../chunk-SR6RHUAV.js";
+} from "../chunk-HTRILMXV.js";
 import {
   FLAGS_SCHEMA_VERSION,
+  FLAG_REGISTRY,
   KANBAN_CHECK_COMMAND,
   MAX_AVATAR_ENV_URL_BYTES,
   SUPPRESS_SENTINEL,
@@ -97,14 +99,14 @@ import {
   sumTranscriptUsageInWindow,
   worseConnectivityOutcome,
   wrapScheduledTaskPrompt
-} from "../chunk-VIIPFWE4.js";
+} from "../chunk-R5CP4WAO.js";
 import {
   parsePsRows,
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
 
 // src/lib/manager-worker.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { readFileSync as readFileSync12, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, existsSync as existsSync8, rmSync as rmSync3, readdirSync as readdirSync5, statSync as statSync4, unlinkSync, copyFileSync } from "fs";
 import { execFileSync as syncExecFile } from "child_process";
 import { join as join14, dirname as dirname3 } from "path";
@@ -1693,6 +1695,32 @@ var DirectChatSpawnGate = class {
   }
 };
 
+// ../../packages/core/dist/host-config/capture.js
+import { createHash as createHash3 } from "crypto";
+var NON_SECRET_ENV_GATES = [
+  "AGT_MEMORY_EXTRACTION_ENABLED",
+  "AGT_CHANNEL_REPLAY_ENABLED",
+  "AGT_DISABLE_MSTEAMS_HOST_ROUTES",
+  "AGT_DEPLOY_CRONS",
+  "AGT_CONV_EVAL_BACKEND",
+  "AGT_CLI_RELEASE_CHANNEL"
+];
+var SECRET_NAME_PATTERN = /(KEY|SECRET|TOKEN|PASSWORD|PASSWD|CREDENTIAL|PRIVATE|SIGNING|WEBHOOK)/i;
+function listCapturableEnvGateNames() {
+  const fromRegistry = FLAG_REGISTRY.map((f) => f.envVar).filter((v) => typeof v === "string" && v.length > 0);
+  return [.../* @__PURE__ */ new Set([...fromRegistry, ...NON_SECRET_ENV_GATES])].filter((name) => !SECRET_NAME_PATTERN.test(name)).sort();
+}
+function collectEnvGates(env) {
+  const out = {};
+  for (const name of listCapturableEnvGateNames()) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      out[name] = value.length > 128 ? value.slice(0, 128) : value;
+    }
+  }
+  return out;
+}
+
 // src/lib/artifact-stream.ts
 import { join as join3 } from "path";
 import { homedir } from "os";
@@ -3605,7 +3633,7 @@ function planGlobalSkillSync(globalSkills, prevIds, hashOf, knownHash) {
 }
 
 // src/lib/manager/runtime.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { readFileSync as readFileSync9, appendFileSync, mkdirSync as mkdirSync2, chmodSync, existsSync as existsSync4 } from "fs";
 import { join as join10, dirname as dirname2 } from "path";
 import { homedir as homedir4 } from "os";
@@ -3654,7 +3682,7 @@ function log(msg) {
   }
 }
 function sha256(content) {
-  return createHash3("sha256").update(content, "utf8").digest("hex");
+  return createHash4("sha256").update(content, "utf8").digest("hex");
 }
 function hashFile(filePath) {
   try {
@@ -5489,6 +5517,8 @@ var AUTO_RESUME_SELF_WINDOW_MS = 12e4;
 var autoResumeLoggedSkips = /* @__PURE__ */ new Map();
 var autoResumeStandDowns = /* @__PURE__ */ new Set();
 var dependencyRecoveryLedger = new DependencyRecoveryLedger();
+var unstableLatchUnreported = /* @__PURE__ */ new Set();
+var unstableLatchReportInFlight = /* @__PURE__ */ new Set();
 var killPausedCodeNames = /* @__PURE__ */ new Set();
 var BACK_ONLINE_GREETING_GUIDANCE = " When you reconnect, if you tell anyone you are back, start that message with a \u{1F44B} wave emoji and do not use a \u{1F7E2} green-light emoji.";
 function maybeAutoResume(agent) {
@@ -5556,13 +5586,34 @@ function logResumeReconcileHoldOnce(codeName, trippedAt, reason, detail) {
     log(`[resume-reconciler] agent=${codeName} decision=hold reason=${reason}${detail ? ` (${detail})` : ""} (ENG-6383)`);
   }
 }
+function reportUnstableLatch(agent, trippedAt, standDownKey) {
+  if (unstableLatchReportInFlight.has(standDownKey)) return;
+  unstableLatchReportInFlight.add(standDownKey);
+  void api.post("/host/circuit-breaker/unstable-latch", {
+    agent_id: agent.agent_id,
+    tripped_at: new Date(trippedAt).toISOString()
+  }).then(() => {
+    unstableLatchUnreported.delete(standDownKey);
+  }).catch((err) => {
+    log(
+      `[resume-reconciler] agent=${agent.code_name} unstable-latch report failed (will retry next poll): ${err.message} (ENG-6392)`
+    );
+  }).finally(() => {
+    unstableLatchReportInFlight.delete(standDownKey);
+  });
+}
 async function maybeResumeReconcile(agent) {
   const codeName = agent.code_name;
   if (autoResumeInFlight.has(codeName)) return;
   const trip = restartBreaker.getTrip(codeName);
   if (!trip) return;
   const standDownKey = `${codeName}:${trip.trippedAt}`;
-  if (autoResumeStandDowns.has(standDownKey)) return;
+  if (autoResumeStandDowns.has(standDownKey)) {
+    if (unstableLatchUnreported.has(standDownKey)) {
+      reportUnstableLatch(agent, trip.trippedAt, standDownKey);
+    }
+    return;
+  }
   autoResumeInFlight.add(codeName);
   try {
     const config2 = { ...readResumeReconcilerConfig(), enabled: hostFlagStore().getBoolean("resume-reconciler") };
@@ -5605,6 +5656,8 @@ async function maybeResumeReconcile(agent) {
           `[resume-reconciler] agent=${codeName} decision=latch-unstable \u2014 auto-resumed once then re-tripped within the backoff window; latching to mandatory-manual (NOT resuming; restart counter untouched; agent stays paused with its circuit-breaker alert open) (ENG-6383)`
         );
       }
+      unstableLatchUnreported.add(standDownKey);
+      reportUnstableLatch(agent, trippedAt, standDownKey);
       return;
     }
     log(
@@ -5787,7 +5840,7 @@ var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
     const raw = readFileSync12(join14(projectDir, ".mcp.json"), "utf-8");
-    return createHash4("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
+    return createHash5("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
   }
@@ -6146,7 +6199,7 @@ var cachedMaintenanceWindow = null;
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.31" : "dev";
+var agtCliVersion = true ? "0.28.33" : "dev";
 function resolveBrewPath(execFileSync4) {
   try {
     const out = execFileSync4("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7274,7 +7327,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-JHBXSNVW.js");
+      const { collectDiagnostics } = await import("../persistent-session-RNALQ7JD.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -7304,7 +7357,7 @@ async function pollCycle() {
         claudeAuth = await detectClaudeAuth();
       } catch (err) {
         const errText = err instanceof Error ? err.message : String(err);
-        const errId = createHash4("sha256").update(errText).digest("hex").slice(0, 12);
+        const errId = createHash5("sha256").update(errText).digest("hex").slice(0, 12);
         log(`Claude auth detection failed (error_id=${errId})`);
       }
       const hostHasClaudeCode = state6.agents.some(
@@ -7341,7 +7394,12 @@ async function pollCycle() {
         // ENG-6251: capability advertisement — the flags schema version this
         // CLI compiled with, so the admin UI can show flip reach across a
         // mixed-CLI fleet (an older CLI sends an older fingerprint).
-        flags_schema_version: FLAGS_SCHEMA_VERSION
+        flags_schema_version: FLAGS_SCHEMA_VERSION,
+        // ENG-6412: the host's allowlisted, non-secret env gates. The API
+        // combines these with the org's server-resolved flags + versions into a
+        // host_config_snapshots row (on change) so bugs correlate with config.
+        // Allowlist-only by construction — no raw env / secrets ever sent.
+        env_gates: collectEnvGates(process.env)
       });
       if (hbResp?.maintenance_window) {
         cachedMaintenanceWindow = hbResp.maintenance_window;
@@ -7349,6 +7407,7 @@ async function pollCycle() {
       if (hbResp?.feature_flags) {
         hostFlagStore().applyHeartbeat(hbResp.feature_flags, hbResp.flags_schema_version);
       }
+      setConfigHash(hbResp?.config_hash ?? null);
       try {
         if (decideMaintenanceWindowGate({ window: cachedMaintenanceWindow, now: /* @__PURE__ */ new Date() }) === "proceed") {
           const { maybeUpdateClaudeCode } = await import("../claude-code-updater-4E5T2X3Z.js");
@@ -7362,13 +7421,14 @@ async function pollCycle() {
         log(`Claude Code updater error: ${err.message}`);
       }
     } catch (err) {
+      setConfigHash(null);
       log(`Heartbeat failed: ${err.message}`);
     }
     try {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-SKVWT5CO.js");
+      } = await import("../responsiveness-probe-DRP2PPVE.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -7400,7 +7460,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-SKVWT5CO.js");
+        } = await import("../responsiveness-probe-DRP2PPVE.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -8382,7 +8442,7 @@ async function processAgent(agent, agentStates) {
           const sessionModeForHash = refreshData.agent.session_mode;
           const senderPolicyForHash = refreshData.sender_policy ?? null;
           const CHANNEL_WRITE_VERSION = 9;
-          const configHash = createHash4("sha256").update(
+          const configHash = createHash5("sha256").update(
             canonicalJson({
               writeVersion: CHANNEL_WRITE_VERSION,
               config: entry.config,
@@ -8496,7 +8556,7 @@ async function processAgent(agent, agentStates) {
   if (channelConfigConverged) {
     const hasSenderPolicyChannel = currentChannelIds.has("slack") || currentChannelIds.has("msteams");
     const senderPolicyForRestartHash = refreshData.sender_policy ?? null;
-    const senderPolicyHash = createHash4("sha256").update(canonicalJson({ senderPolicy: senderPolicyForRestartHash })).digest("hex");
+    const senderPolicyHash = createHash5("sha256").update(canonicalJson({ senderPolicy: senderPolicyForRestartHash })).digest("hex");
     const prevSenderPolicyHash = agentState.knownSenderPolicyHashes.get(agent.agent_id);
     const senderPolicyDecision = hasSenderPolicyChannel ? decideSenderPolicyRestart({
       previousHash: prevSenderPolicyHash,
@@ -8538,7 +8598,7 @@ async function processAgent(agent, agentStates) {
       const behaviourSubset = extractMsTeamsBehaviourSubset(
         msteamsEntry?.config
       );
-      const behaviourHash = createHash4("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
+      const behaviourHash = createHash5("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
       const prevBehaviourHash = agentState.knownMsTeamsBehaviourHashes.get(agent.agent_id);
       const behaviourDecision = decideSenderPolicyRestart({
         previousHash: prevBehaviourHash,
@@ -8585,7 +8645,7 @@ async function processAgent(agent, agentStates) {
       const slackBehaviourSubset = extractSlackBehaviourSubset(
         slackEntry?.config
       );
-      const slackBehaviourHash = createHash4("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
+      const slackBehaviourHash = createHash5("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
       const prevSlackBehaviourHash = agentState.knownSlackBehaviourHashes.get(agent.agent_id);
       const slackBehaviourDecision = decideSenderPolicyRestart({
         previousHash: prevSlackBehaviourHash,
@@ -8829,10 +8889,10 @@ async function processAgent(agent, agentStates) {
           desiredEntries.push({ serverId, url, headers: mcpHeaders, name: tk.toolkit_name });
         }
         const hashBasis = desiredEntries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => {
-          const headersHash = createHash4("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
+          const headersHash = createHash5("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
           return `${e.serverId}|${e.url}|${headersHash}`;
         }).join("\n");
-        const mcpHash = createHash4("sha256").update(hashBasis).digest("hex").slice(0, 16);
+        const mcpHash = createHash5("sha256").update(hashBasis).digest("hex").slice(0, 16);
         const prevMcpHash = agentState.knownManagedMcpHashes.get(agent.agent_id);
         const structureHash = managedMcpStructureHash(desiredEntries);
         const prevStructureHash = agentState.knownManagedMcpStructure.get(agent.agent_id);
@@ -8847,7 +8907,7 @@ async function processAgent(agent, agentStates) {
         if (mcpHash !== prevMcpHash) {
           for (const e of desiredEntries) {
             frameworkAdapter.writeMcpServer(agent.code_name, e.serverId, { url: e.url, headers: e.headers });
-            const urlHash = createHash4("sha256").update(e.url).digest("hex").slice(0, 12);
+            const urlHash = createHash5("sha256").update(e.url).digest("hex").slice(0, 12);
             log(`[managed-toolkit] ${agent.code_name}: wrote '${e.name}' (serverId=${e.serverId}, url_hash=${urlHash})`);
           }
           if (frameworkAdapter.removeMcpServer && frameworkAdapter.getMcpPath) {
@@ -8981,7 +9041,7 @@ async function processAgent(agent, agentStates) {
     if (frameworkAdapter.installSkillFiles) {
       const currentIntegrationSkillIds = /* @__PURE__ */ new Set();
       const installedIntegrationSkills = [];
-      const { createHash: createHash5 } = await import("crypto");
+      const { createHash: createHash6 } = await import("crypto");
       const refreshAny = refreshData;
       const contexts = refreshAny.integration_contexts ?? refreshAny.plugin_contexts ?? [];
       const contextBySlug = /* @__PURE__ */ new Map();
@@ -9010,7 +9070,7 @@ async function processAgent(agent, agentStates) {
             )
           }));
           const bundle = buildIntegrationBundle(renderedScopes);
-          const contentHash = createHash5("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
+          const contentHash = createHash6("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
           const hashKey = `plugin-skill:${agent.agent_id}:${integrationSkillId}`;
           if (agentState.knownSkillHashes.get(hashKey) === contentHash) continue;
           frameworkAdapter.installSkillFiles(agent.code_name, integrationSkillId, bundle.files);
@@ -9069,7 +9129,7 @@ async function processAgent(agent, agentStates) {
         const plan = planGlobalSkillSync(
           refreshAny.global_skills ?? [],
           agentState.knownGlobalSkillIds.get(agent.agent_id) ?? /* @__PURE__ */ new Set(),
-          (content) => createHash5("sha256").update(content).digest("hex").slice(0, 12),
+          (content) => createHash6("sha256").update(content).digest("hex").slice(0, 12),
           (skillId) => agentState.knownSkillHashes.get(`global-skill:${agent.agent_id}:${skillId}`)
         );
         for (const { skillId, content, hash } of plan.installs) {
@@ -9113,7 +9173,7 @@ async function processAgent(agent, agentStates) {
           const slug = hook.integration_slug ?? hook.plugin_slug;
           if (!slug) continue;
           try {
-            const scriptHash = createHash5("sha256").update(hook.script).digest("hex").slice(0, 12);
+            const scriptHash = createHash6("sha256").update(hook.script).digest("hex").slice(0, 12);
             const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${slug}:on_install`;
             if (agentState.knownSkillHashes.get(hookKey) === scriptHash) continue;
             const result = await frameworkAdapter.executePluginHook({
@@ -9128,9 +9188,9 @@ async function processAgent(agent, agentStates) {
             } else if (result.timedOut) {
               log(`Integration hook on_install '${slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
             } else {
-              const stderrHash = createHash5("sha256").update(result.stderr).digest("hex").slice(0, 12);
+              const stderrHash = createHash6("sha256").update(result.stderr).digest("hex").slice(0, 12);
               const missingCmd = result.exitCode === 127 ? extractCommandNotFound(result.stderr) : null;
-              const missingCmdHash = missingCmd ? createHash5("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
+              const missingCmdHash = missingCmd ? createHash6("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
               log(
                 `Integration hook on_install '${slug}' exited ${result.exitCode} for '${agent.code_name}' ` + (missingCmdHash ? `[missing_command_hash=${missingCmdHash}] ` : "") + `[stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
               );
@@ -9399,10 +9459,10 @@ async function processAgent(agent, agentStates) {
   } else if (agentFw === "claude-code" && tasks.length > 0) {
     await syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData);
   } else if (frameworkAdapter.syncScheduledTasks && gatewayRunning && gatewayPort) {
-    const stableTasksHash = createHash4("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
-    const boardHash = boardItems.length > 0 ? createHash4("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
+    const stableTasksHash = createHash5("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+    const boardHash = boardItems.length > 0 ? createHash5("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
     const resolvedModels = resolveModelChain(refreshData);
-    const modelsHash = createHash4("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
+    const modelsHash = createHash5("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
     const combinedHash = `${stableTasksHash}:${boardHash}:${modelsHash}`;
     const prevTasksHash = agentState.knownTasksHashes.get(agent.agent_id);
     if (combinedHash !== prevTasksHash) {
@@ -9814,10 +9874,10 @@ function unregisterClaudeSpawn(pid) {
 var claudeSchedulerStates = /* @__PURE__ */ new Map();
 async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
-  const stableTasksHash = createHash4("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
-  const boardHash = boardItems.length > 0 ? createHash4("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
+  const stableTasksHash = createHash5("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const boardHash = boardItems.length > 0 ? createHash5("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
   const resolvedModels = resolveModelChain(refreshData);
-  const modelsHash = createHash4("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
+  const modelsHash = createHash5("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
   const combinedHash = `${stableTasksHash}:${boardHash}:${modelsHash}`;
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (combinedHash !== prevHash) {
@@ -9883,7 +9943,7 @@ async function startRun(opts) {
     return { run_id: res.run_id ?? null, kanban_item_id: res.kanban_item_id ?? null };
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash4("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash5("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] start failed for agent_id=${opts.agent_id} source_type=${opts.source_type} error_id=${errId}`);
     return { run_id: null, kanban_item_id: null };
   }
@@ -9900,7 +9960,7 @@ async function finishRun(runId, outcome, options = {}) {
     });
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash4("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash5("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] finish failed for run_id=${runId} outcome=${outcome} error_id=${errId}`);
   }
 }
@@ -9917,7 +9977,7 @@ async function fetchPriorScheduledRuns(agentId, taskId) {
     return rows.filter((r) => typeof r.output_text === "string" && r.output_text.length > 0).map((r) => ({ startedAt: r.started_at, output: r.output_text }));
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash4("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash5("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] prior-runs lookup failed for task_id=${taskId} error_id=${errId}`);
     return [];
   }
@@ -10273,10 +10333,10 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
     const classification = classifyOutput(rawOutput);
     if (classification.action === "suppress") {
       const trimmed = (rawOutput ?? "").trim();
-      const outputHash = trimmed.length === 0 ? "empty" : createHash4("sha256").update(trimmed).digest("hex").slice(0, 12);
+      const outputHash = trimmed.length === 0 ? "empty" : createHash5("sha256").update(trimmed).digest("hex").slice(0, 12);
       log(`[claude-scheduler] Suppressing delivery for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 output_len=${trimmed.length} output_hash=${outputHash}`);
       if (classification.suppressedNotes) {
-        const notesHash = createHash4("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
+        const notesHash = createHash5("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
         log(`[claude-scheduler] Suppressed notes for '${codeName}' (task=${delivery?.taskId ?? "n/a"}) \u2014 notes_len=${classification.suppressedNotes.length} notes_hash=${notesHash}`);
       }
       if (delivery?.mode === "announce" && delivery.to) {
@@ -10461,7 +10521,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       const ctx = getLastFailureContext(codeName);
       const recovery = prepareForRespawn(codeName);
       const tailSummary = !ctx.tail ? "" : KNOWN_SAFE_TAIL_SIGNATURES.has(ctx.signature) ? `; last pane output (${PANE_TAIL_PREVIEW_LINES} of ~20 lines):
-${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash4("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
+${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash5("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
       const sigSummary = ctx.signature !== "unknown" ? `; signature=${ctx.signature}` : "";
       const recoverySummary = recovery ? `; recovery=${recovery}` : "";
       log(
@@ -10475,7 +10535,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash4("sha256").
       );
       getHostId().then((hostId) => {
         if (!hostId) return;
-        const paneTailHash = zombie.paneTail ? `sha256:${createHash4("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
+        const paneTailHash = zombie.paneTail ? `sha256:${createHash5("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
         return api.post("/host/events", {
           host_id: hostId,
           agent_code_name: codeName,
@@ -10554,7 +10614,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash4("sha256").
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
   }
-  const stableTasksHash = createHash4("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const stableTasksHash = createHash5("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (stableTasksHash !== prevHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
@@ -11080,7 +11140,7 @@ ${escapeXml(msg.content)}
     log(`[direct-chat] Reply sent for '${agent.codeName}'`);
   } catch (err) {
     const errMsg = err instanceof Error ? err.message : String(err);
-    const errorId = createHash4("sha256").update(errMsg).digest("hex").slice(0, 12);
+    const errorId = createHash5("sha256").update(errMsg).digest("hex").slice(0, 12);
     log(`[direct-chat] Failed to process message for '${agent.codeName}': error_id=${errorId} error=${errMsg.slice(0, 500)}`);
     try {
       await api.post("/host/direct-chat/reply", {
@@ -11372,7 +11432,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-RLIUZRLZ.js");
+  } = await import("../claude-pair-runtime-LP4W56RT.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -11636,7 +11696,7 @@ async function syncMemories(agent, configDir, log2) {
       if (!file.endsWith(".md")) continue;
       try {
         const raw = readFileSync12(join14(memoryDir, file), "utf-8");
-        const fileHash = createHash4("sha256").update(raw).digest("hex").slice(0, 16);
+        const fileHash = createHash5("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
         const parsed = parseMemoryFile(raw, file.replace(/\.md$/, ""));
@@ -11674,14 +11734,14 @@ async function syncMemories(agent, configDir, log2) {
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
   const localFiles = existsSync8(memoryDir) ? readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
-  const localListHash = createHash4("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
+  const localListHash = createHash5("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
   try {
     const dbMemories = await api.post("/host/memories", {
       agent_id: agent.agent_id
     });
-    const responseHash = createHash4("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
+    const responseHash = createHash5("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
     if (!force && prevDownload && prevLocalHash === localListHash && lastDownloadHash.get(agent.agent_id) === responseHash) {
       return true;
     }
@@ -11720,7 +11780,7 @@ ${mem.content}
       }
       if (written > 0 || overwritten > 0) {
         const updatedFiles = readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort();
-        lastLocalFileHash.set(agent.agent_id, createHash4("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
+        lastLocalFileHash.set(agent.agent_id, createHash5("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
         log2(`Memory download for '${agent.code_name}': wrote ${written} new, overwrote ${overwritten} stale`);
       }
     }
@@ -12157,7 +12217,7 @@ function deployMcpAssets() {
   const fileHash = (p) => {
     try {
       if (!existsSync8(p)) return null;
-      return createHash4("sha256").update(readFileSync12(p)).digest("hex");
+      return createHash5("sha256").update(readFileSync12(p)).digest("hex");
     } catch {
       return null;
     }