@integrity-labs/agt-cli 0.28.318 → 0.28.320

package/dist/lib/manager-worker.js

@@ -2,8 +2,10 @@ import {
   ApiError,
   CHANNEL_SECRET_ENV_KEYS,
   HostFlagStore,
+  HttpOpencodeClient,
   INTEGRATIONS_SECTION_END,
   INTEGRATIONS_SECTION_START,
+  OpencodeInboundBridge,
   SUPERVISOR_RESTART_EXIT_CODE,
   api,
   atomicWriteFileSync,
@@ -26,6 +28,7 @@ import {
   getCachedClaudeAuthMode,
   getHostId,
   givenUpMcpServerKeys,
+  liveProxyExtraHeaderVars,
   provision,
   provisionAutoKanbanProgressHook,
   provisionChannelProgressHook,
@@ -34,12 +37,13 @@ import {
   provisionPreCompactHook,
   provisionSessionStateHook,
   provisionStopHook,
+  readChannelServerEnv,
   reapMissingMcpSessions,
   reapStaleMcpChildren,
   requireHost,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-2DIWTRTU.js";
+} from "../chunk-CJSATK6B.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -48,6 +52,7 @@ import {
   syncTasksToScheduler
 } from "../chunk-I3YS5WFV.js";
 import {
+  AnchorSessionClient,
   CONVERSATION_FAILURE_CATEGORIES,
   DEFAULT_FRAMEWORK,
   FLAGS_SCHEMA_VERSION,
@@ -127,17 +132,17 @@ import {
   takeZombieDetection,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-4DHYHNCV.js";
+} from "../chunk-NAS4DZNG.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
 
 // src/lib/manager-worker.ts
-import { createHash as createHash11 } from "crypto";
-import { readFileSync as readFileSync16, writeFileSync as writeFileSync8, mkdirSync as mkdirSync7, existsSync as existsSync10, rmSync as rmSync4, readdirSync as readdirSync5, statSync as statSync4, copyFileSync } from "fs";
+import { createHash as createHash12 } from "crypto";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8, existsSync as existsSync11, rmSync as rmSync4, readdirSync as readdirSync5, statSync as statSync4, copyFileSync } from "fs";
 import { execFileSync as syncExecFile } from "child_process";
-import { join as join19, dirname as dirname6 } from "path";
-import { homedir as homedir10 } from "os";
+import { join as join20, dirname as dirname6 } from "path";
+import { homedir as homedir11 } from "os";
 import { fileURLToPath } from "url";
 
 // src/lib/claude-code-upgrade-throttle.ts
@@ -279,6 +284,95 @@ function withResolvedRemoteMcp(integration) {
   };
 }
 
+// src/lib/anchor-session-lifecycle.ts
+var DEFAULT_ANCHOR_SESSION_MAX_DURATION_MINUTES = 60;
+var DEFAULT_ANCHOR_SESSION_REFRESH_MARGIN_MINUTES = 5;
+var AnchorSessionLifecycle = class {
+  store = /* @__PURE__ */ new Map();
+  maxDurationMs;
+  refreshMarginMs;
+  idleTimeoutMinutes;
+  createClient;
+  constructor(opts = {}) {
+    const maxDurationMinutes = opts.maxDurationMinutes ?? DEFAULT_ANCHOR_SESSION_MAX_DURATION_MINUTES;
+    this.maxDurationMs = maxDurationMinutes * 6e4;
+    this.refreshMarginMs = (opts.refreshMarginMinutes ?? DEFAULT_ANCHOR_SESSION_REFRESH_MARGIN_MINUTES) * 6e4;
+    this.idleTimeoutMinutes = opts.idleTimeoutMinutes ?? maxDurationMinutes;
+    this.createClient = opts.createClient ?? ((apiKey) => new AnchorSessionClient({ apiKey }));
+  }
+  /**
+   * Return the session id the agent should bind, minting or re-minting as needed.
+   * Returns null for the stateless case (no profile / no key / mint failure with
+   * no valid fallback) - the manager then leaves `ANCHOR_BROWSER_SESSION_ID`
+   * empty. Never throws.
+   */
+  async ensure(params) {
+    const { agentId, now } = params;
+    const log2 = params.log ?? (() => {
+    });
+    const profileName = params.profileName?.trim() || "";
+    const apiKey = params.apiKey?.trim() || "";
+    const existing = this.store.get(agentId);
+    if (!profileName) {
+      if (existing) {
+        this.endBestEffort(apiKey, existing.sessionId, log2);
+        this.store.delete(agentId);
+      }
+      return null;
+    }
+    if (!apiKey) {
+      if (existing && existing.profileName === profileName && now < existing.expiresAt) {
+        return existing.sessionId;
+      }
+      log2(`[anchor-session] ${agentId}: profile "${profileName}" but no api key - stateless`);
+      return null;
+    }
+    if (existing && existing.profileName === profileName && now < existing.expiresAt - this.refreshMarginMs) {
+      return existing.sessionId;
+    }
+    try {
+      const client2 = this.createClient(apiKey);
+      const session = await client2.createSession({
+        profileName,
+        dedicatedStickyIp: true,
+        maxDurationMinutes: this.maxDurationMs / 6e4,
+        idleTimeoutMinutes: this.idleTimeoutMinutes
+      });
+      const effectiveMs = Math.min(this.maxDurationMs, this.idleTimeoutMinutes * 6e4);
+      this.store.set(agentId, {
+        sessionId: session.sessionId,
+        profileName,
+        expiresAt: now + effectiveMs
+      });
+      if (existing && existing.sessionId !== session.sessionId) {
+        this.endBestEffort(apiKey, existing.sessionId, log2);
+      }
+      log2(`[anchor-session] ${agentId}: minted session for profile "${profileName}"`);
+      return session.sessionId;
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      if (existing && existing.profileName === profileName && now < existing.expiresAt) {
+        log2(`[anchor-session] ${agentId}: re-mint failed (${reason}) - keeping current session`);
+        return existing.sessionId;
+      }
+      log2(`[anchor-session] ${agentId}: mint failed (${reason}) - degrading to stateless`);
+      return null;
+    }
+  }
+  /** Forget an agent's session (e.g. on decommission). Best-effort ends it. */
+  forget(agentId, apiKey, log2 = () => {
+  }) {
+    const existing = this.store.get(agentId);
+    if (!existing) return;
+    this.endBestEffort(apiKey?.trim() || "", existing.sessionId, log2);
+    this.store.delete(agentId);
+  }
+  endBestEffort(apiKey, sessionId, log2) {
+    if (!apiKey || !sessionId) return;
+    void this.createClient(apiKey).endSession(sessionId).catch((err) => log2(`[anchor-session] failed to end a stale session: ${err.message}`));
+  }
+};
+
 // src/lib/channel-restart-decision.ts
 function launchableChannelIds(channelConfigs) {
   if (!channelConfigs) return /* @__PURE__ */ new Set();
@@ -5347,6 +5441,1103 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
   }
 }
 
+// src/lib/opencode-session.ts
+import { spawn, execSync } from "child_process";
+import { createServer } from "net";
+import { randomBytes } from "crypto";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync15 } from "fs";
+import { homedir as homedir9, userInfo } from "os";
+import { join as join18 } from "path";
+var OPENCODE_BIN = process.env["AGT_OPENCODE_BIN"]?.trim() || "opencode";
+var sessions = /* @__PURE__ */ new Map();
+var bridges = /* @__PURE__ */ new Map();
+function opencodeTmuxSession(codeName) {
+  return `agt-oc-${codeName}`;
+}
+function opencodePaneLogPath(codeName) {
+  return join18(homedir9(), ".augmented", codeName, "opencode-serve.log");
+}
+function baseUrlFor(port) {
+  return `http://127.0.0.1:${port}`;
+}
+function findFreePort() {
+  return new Promise((resolve, reject) => {
+    const srv = createServer();
+    srv.on("error", reject);
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      if (addr && typeof addr === "object") {
+        const { port } = addr;
+        srv.close(() => resolve(port));
+      } else {
+        srv.close(() => reject(new Error("could not allocate a port")));
+      }
+    });
+  });
+}
+async function startOpencodeSession(config2) {
+  const { codeName, log: log2 } = config2;
+  const existing = sessions.get(codeName);
+  if (existing && existing.status === "running") return existing;
+  const restartCount = existing?.restartCount ?? 0;
+  if (existing?.status === "crashed" && existing.startedAt) {
+    const backoffMs = Math.min(5e3 * Math.pow(2, restartCount), 6e4);
+    if (Date.now() - existing.startedAt < backoffMs) return existing;
+  }
+  if (config2.isolated) {
+    log2(
+      `[opencode-session] refusing to spawn '${codeName}': Docker isolation requested but the opencode container runtime is not implemented yet (ADR-0047). Not running unisolated on a multi-tenant host.`
+    );
+    const blocked = {
+      codeName,
+      startedAt: Date.now(),
+      restartCount: restartCount + 1,
+      status: "crashed",
+      port: null,
+      password: null,
+      lastFailureTail: "opencode isolation not implemented (ADR-0047)"
+    };
+    sessions.set(codeName, blocked);
+    return blocked;
+  }
+  const session = {
+    codeName,
+    startedAt: null,
+    restartCount,
+    status: "starting",
+    port: null,
+    password: null,
+    lastFailureTail: existing?.lastFailureTail ?? null
+  };
+  sessions.set(codeName, session);
+  try {
+    await spawnServe(config2, session);
+  } catch (err) {
+    log2(`[opencode-session] failed to start '${codeName}': ${err.message}`);
+    session.status = "crashed";
+    session.startedAt = Date.now();
+    session.restartCount++;
+  }
+  return session;
+}
+async function spawnServe(config2, session) {
+  const { codeName, projectDir, log: log2 } = config2;
+  if (!existsSync9(join18(projectDir, "opencode.json"))) {
+    log2(`[opencode-session] warning: no opencode.json in ${projectDir} for '${codeName}' (provisioning may not have run)`);
+  }
+  const tmuxSession = opencodeTmuxSession(codeName);
+  const port = await findFreePort();
+  const password = randomBytes(24).toString("base64url");
+  try {
+    execSync(`tmux kill-session -t ${tmuxSession} 2>/dev/null`, { stdio: "ignore" });
+  } catch {
+  }
+  mkdirSync6(join18(homedir9(), ".augmented", codeName), { recursive: true });
+  const serveEnv = {
+    ...process.env,
+    ...stripUndefined(config2.serveEnv ?? {}),
+    OPENCODE_SERVER_PASSWORD: password,
+    HOME: process.env.HOME?.trim() || homedir9(),
+    USER: process.env.USER?.trim() || userInfo().username
+  };
+  if (config2.runId) serveEnv["AGT_RUN_ID"] = config2.runId;
+  if (config2.agentTimezone) serveEnv["TZ"] = config2.agentTimezone;
+  const serveCmd = `${OPENCODE_BIN} serve --hostname 127.0.0.1 --port ${port} --print-logs`;
+  log2(`[opencode-session] starting '${tmuxSession}' for '${codeName}' on 127.0.0.1:${port}`);
+  const child = spawn(
+    "tmux",
+    ["new-session", "-d", "-s", tmuxSession, "-c", projectDir, serveCmd],
+    { cwd: projectDir, stdio: ["ignore", "pipe", "pipe"], env: serveEnv }
+  );
+  child.on("close", (code) => {
+    if (code !== 0) {
+      log2(`[opencode-session] failed to create tmux session for '${codeName}' (exit ${code})`);
+      session.status = "crashed";
+      session.startedAt = Date.now();
+      session.restartCount++;
+      return;
+    }
+    log2(`[opencode-session] tmux session '${tmuxSession}' created for '${codeName}'`);
+    setupPaneLog(tmuxSession, codeName, log2);
+  });
+  child.on("error", (err) => {
+    log2(`[opencode-session] failed to start tmux for '${codeName}': ${err.message}`);
+    session.status = "crashed";
+    session.startedAt = Date.now();
+    session.restartCount++;
+  });
+  session.port = port;
+  session.password = password;
+  session.startedAt = Date.now();
+  session.status = "running";
+  session.restartCount = 0;
+  bridges.delete(codeName);
+}
+function setupPaneLog(tmuxSession, codeName, log2) {
+  const logPath = opencodePaneLogPath(codeName);
+  try {
+    execSync(`tmux pipe-pane -t ${tmuxSession} -o 'cat >> ${logPath}'`, { stdio: "ignore" });
+  } catch (err) {
+    log2(`[opencode-session] could not attach pane log for '${codeName}': ${err.message}`);
+  }
+}
+function readOpencodePaneLogTail(codeName, lines = 40) {
+  const logPath = opencodePaneLogPath(codeName);
+  if (!existsSync9(logPath)) return null;
+  try {
+    const all = readFileSync15(logPath, "utf8").split("\n");
+    return all.slice(-lines).join("\n");
+  } catch {
+    return null;
+  }
+}
+function isOpencodeSessionHealthy(codeName) {
+  const tmuxSession = opencodeTmuxSession(codeName);
+  try {
+    execSync(`tmux has-session -t ${tmuxSession} 2>/dev/null`, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function injectOpencodeMessage(codeName, msg, opts = {}) {
+  const session = sessions.get(codeName);
+  if (!session || session.status !== "running" || !session.port || !session.password) {
+    return { status: "declined", reason: "server_not_running" };
+  }
+  const bridge = getBridge(codeName, session.port, session.password);
+  return bridge.handleInbound(msg, { gate: opts.gate, awaitReply: opts.awaitReply });
+}
+function getBridge(codeName, port, password) {
+  const cached = bridges.get(codeName);
+  if (cached && cached.port === port && cached.password === password) return cached.bridge;
+  const client2 = new HttpOpencodeClient({ baseUrl: baseUrlFor(port), password });
+  const bridge = new OpencodeInboundBridge({ client: client2 });
+  bridges.set(codeName, { port, password, bridge });
+  return bridge;
+}
+function stripUndefined(env) {
+  const out = {};
+  for (const [k, v] of Object.entries(env)) if (v !== void 0) out[k] = v;
+  return out;
+}
+
+// src/lib/opencode-slack-ingest.ts
+import { createHash as createHash11 } from "crypto";
+
+// ../../packages/core/dist/channels/slack-rich-text.js
+var MAX_DEPTH = 12;
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function asString(v) {
+  return typeof v === "string" ? v : "";
+}
+function asArray(v) {
+  return Array.isArray(v) ? v : [];
+}
+function isTableElement(el) {
+  return isRecord(el) && asString(el.type).includes("table");
+}
+function renderEmoji(el) {
+  const unicode = asString(el.unicode);
+  if (unicode) {
+    try {
+      const cps = unicode.split("-").map((h) => parseInt(h, 16));
+      if (cps.every((n) => Number.isFinite(n) && n >= 0 && n <= 1114111)) {
+        return String.fromCodePoint(...cps);
+      }
+    } catch {
+    }
+  }
+  const name = asString(el.name);
+  return name ? `:${name}:` : "";
+}
+function renderLeaf(el) {
+  if (!isRecord(el))
+    return "";
+  switch (asString(el.type)) {
+    case "text":
+      return asString(el.text);
+    case "link": {
+      const label = asString(el.text);
+      const url = asString(el.url);
+      if (label && url && label !== url)
+        return `${label} (${url})`;
+      return label || url;
+    }
+    case "emoji":
+      return renderEmoji(el);
+    case "user":
+      return `<@${asString(el.user_id)}>`;
+    case "usergroup":
+      return `<!subteam^${asString(el.usergroup_id)}>`;
+    case "channel":
+      return `<#${asString(el.channel_id)}>`;
+    case "broadcast":
+      return `@${asString(el.range) || "channel"}`;
+    case "date":
+      return asString(el.fallback) || asString(el.timestamp);
+    default:
+      if (Array.isArray(el.elements))
+        return renderInline(el.elements);
+      return asString(el.text);
+  }
+}
+function renderInline(elements) {
+  return elements.map(renderLeaf).join("");
+}
+function deepText(node, depth) {
+  if (depth > MAX_DEPTH)
+    return "";
+  if (typeof node === "string")
+    return node;
+  if (Array.isArray(node))
+    return node.map((n) => deepText(n, depth + 1)).join("");
+  if (!isRecord(node))
+    return "";
+  const type = asString(node.type);
+  if (type && type !== "rich_text" && !type.startsWith("rich_text_") && !type.includes("table")) {
+    return renderLeaf(node);
+  }
+  if (Array.isArray(node.elements))
+    return node.elements.map((n) => deepText(n, depth + 1)).join("");
+  if (Array.isArray(node.rows))
+    return node.rows.map((n) => deepText(n, depth + 1)).join(" ");
+  return asString(node.text);
+}
+function renderCell(cell) {
+  if (!isRecord(cell))
+    return deepText(cell, 0).replace(/\s*\n\s*/g, " ").trim();
+  const inner = Array.isArray(cell.elements) ? renderSection(cell, 0) : deepText(cell, 0);
+  return inner.replace(/\s*\n\s*/g, " ").trim();
+}
+function renderTable(el) {
+  const rawRows = asArray(el.elements).length ? asArray(el.elements) : asArray(el.rows);
+  const rows = [];
+  for (const row of rawRows) {
+    if (!isRecord(row) && !Array.isArray(row))
+      continue;
+    const rawCells = Array.isArray(row) ? row : asArray(row.elements).length ? asArray(row.elements) : asArray(row.cells);
+    if (rawCells.length === 0)
+      continue;
+    rows.push(rawCells.map(renderCell));
+  }
+  if (rows.length === 0) {
+    const fallback = deepText(el, 0).replace(/[ \t]+\n/g, "\n").trim();
+    return fallback;
+  }
+  const colCount = rows.reduce((max, r) => Math.max(max, r.length), 0);
+  const pad = (r) => {
+    const cells = r.slice();
+    while (cells.length < colCount)
+      cells.push("");
+    return cells.map((c) => c.replace(/\|/g, "\\|"));
+  };
+  const lines = [];
+  const header = rows[0] ?? [];
+  const body = rows.slice(1);
+  lines.push(`| ${pad(header).join(" | ")} |`);
+  lines.push(`| ${Array.from({ length: colCount }, () => "---").join(" | ")} |`);
+  for (const r of body)
+    lines.push(`| ${pad(r).join(" | ")} |`);
+  return lines.join("\n");
+}
+function renderSection(section, depth) {
+  if (depth > MAX_DEPTH || !isRecord(section))
+    return "";
+  const type = asString(section.type);
+  if (isTableElement(section))
+    return renderTable(section);
+  switch (type) {
+    case "rich_text_section":
+      return renderInline(asArray(section.elements));
+    case "rich_text_preformatted": {
+      const code = renderInline(asArray(section.elements));
+      return code ? `\`\`\`
+${code}
+\`\`\`` : "";
+    }
+    case "rich_text_quote": {
+      const quoted = renderInline(asArray(section.elements));
+      return quoted ? quoted.split("\n").map((l) => `> ${l}`).join("\n") : "";
+    }
+    case "rich_text_list": {
+      const ordered = asString(section.style) === "ordered";
+      const items = asArray(section.elements).map((item, i) => {
+        const body = renderSection(item, depth + 1) || renderInline(asArray(item?.elements));
+        const marker = ordered ? `${i + 1}.` : "-";
+        return `${marker} ${body}`.trimEnd();
+      });
+      return items.join("\n");
+    }
+    default:
+      if (Array.isArray(section.elements))
+        return renderInline(asArray(section.elements));
+      return deepText(section, depth + 1);
+  }
+}
+function renderSlackBlocks(blocks) {
+  let hadTable = false;
+  const out = [];
+  try {
+    for (const block of asArray(blocks)) {
+      if (!isRecord(block))
+        continue;
+      if (isTableElement(block)) {
+        hadTable = true;
+        const rendered = renderTable(block);
+        if (rendered.trim().length > 0)
+          out.push(rendered);
+        continue;
+      }
+      if (asString(block.type) !== "rich_text")
+        continue;
+      for (const section of asArray(block.elements)) {
+        if (isTableElement(section))
+          hadTable = true;
+        const rendered = renderSection(section, 0);
+        if (rendered.trim().length > 0)
+          out.push(rendered);
+      }
+    }
+  } catch {
+  }
+  const text = out.join("\n\n").replace(/[ \t]+$/gm, "").replace(/\n{3,}/g, "\n\n").trim();
+  return { text, hadTable };
+}
+
+// ../../packages/core/dist/channels/governance/slack-forwarded.js
+function asTrimmed(v) {
+  return typeof v === "string" ? v.trim() : "";
+}
+function extractForwardedContent(attachments) {
+  if (!Array.isArray(attachments))
+    return { text: "", files: [] };
+  const parts = [];
+  const files = [];
+  for (const raw of attachments) {
+    if (!raw || typeof raw !== "object")
+      continue;
+    const att = raw;
+    const textBody = asTrimmed(att.text);
+    let body = textBody || asTrimmed(att.fallback);
+    const blockSources = [];
+    if (Array.isArray(att.blocks))
+      blockSources.push(att.blocks);
+    if (Array.isArray(att.message_blocks)) {
+      for (const mb of att.message_blocks)
+        blockSources.push(mb?.message?.blocks);
+    }
+    for (const source of blockSources) {
+      const rendered = renderSlackBlocks(source);
+      const renderedText = rendered.text.trim();
+      if (renderedText && (!textBody || rendered.hadTable)) {
+        body = renderedText;
+        break;
+      }
+    }
+    const title = asTrimmed(att.title);
+    const link = asTrimmed(att.title_link) || asTrimmed(att.from_url);
+    const imageUrl = asTrimmed(att.image_url) || asTrimmed(att.thumb_url);
+    const lines = [];
+    if (body)
+      lines.push(body);
+    if (title && title !== body)
+      lines.push(title);
+    if (link)
+      lines.push(link);
+    if (imageUrl)
+      lines.push(`[image] ${imageUrl}`);
+    if (lines.length)
+      parts.push(lines.join("\n"));
+    if (Array.isArray(att.files))
+      files.push(...att.files);
+  }
+  return { text: parts.join("\n\n"), files };
+}
+function hasForwardedContent(attachments) {
+  const { text, files } = extractForwardedContent(attachments);
+  return text.length > 0 || files.length > 0;
+}
+
+// ../../packages/core/dist/channels/governance/slack-inbound-filter.js
+var ALLOWED_MESSAGE_SUBTYPES = /* @__PURE__ */ new Set([
+  void 0,
+  "file_share",
+  "thread_broadcast"
+]);
+function decideSlackMessageForward(evt) {
+  if (evt.type !== "message") {
+    return { forward: true };
+  }
+  if (!ALLOWED_MESSAGE_SUBTYPES.has(evt.subtype)) {
+    return { forward: false, reason: "subtype" };
+  }
+  if (!evt.user) {
+    return { forward: false, reason: "no_user" };
+  }
+  const hasText = typeof evt.text === "string" && evt.text.trim().length > 0;
+  const hasFiles = Array.isArray(evt.files) && evt.files.length > 0;
+  const hasBlocks = Array.isArray(evt.blocks) && evt.blocks.length > 0;
+  const hasAttachments = hasForwardedContent(evt.attachments);
+  if (!hasText && !hasFiles && !hasBlocks && !hasAttachments) {
+    return { forward: false, reason: "empty" };
+  }
+  return { forward: true };
+}
+function isAppMentionEcho(evt, botUserId) {
+  if (evt.type !== "message")
+    return false;
+  if (!botUserId)
+    return false;
+  if (evt.channel?.startsWith("D"))
+    return false;
+  return typeof evt.text === "string" && evt.text.includes(`<@${botUserId}>`);
+}
+function extractAugmentedSlackLabel(evt) {
+  if (evt.metadata?.event_type !== "augmented_agent_message")
+    return null;
+  return {
+    teamId: evt.metadata.event_payload?.["augmented_team_id"],
+    agentId: evt.metadata.event_payload?.["augmented_agent_id"]
+  };
+}
+function decideModeForward(evt, policy) {
+  if (policy.mode === "all")
+    return { forward: true };
+  if (policy.mode === "manager_only") {
+    if (policy.principalSlackUserId && evt.user === policy.principalSlackUserId) {
+      return { forward: true };
+    }
+  }
+  if (policy.mode === "team_only") {
+    if (policy.teamPrincipalSlackUserIds && policy.teamPrincipalSlackUserIds.length > 0 && typeof evt.user === "string" && policy.teamPrincipalSlackUserIds.includes(evt.user)) {
+      return { forward: true };
+    }
+  }
+  const label = extractAugmentedSlackLabel(evt);
+  if (!label)
+    return { forward: false, reason: "sender_policy" };
+  if (policy.mode === "team_agents_only" || policy.mode === "manager_only" || policy.mode === "team_only") {
+    if (!policy.teamId || label.teamId !== policy.teamId) {
+      return { forward: false, reason: "sender_policy" };
+    }
+  }
+  return { forward: true };
+}
+function decideSenderPolicyForward(evt, policy) {
+  if (policy.internalOnly) {
+    if (!policy.homeTeamId)
+      return { forward: false, reason: "sender_policy" };
+    if (evt.team !== policy.homeTeamId)
+      return { forward: false, reason: "sender_policy" };
+  }
+  return decideModeForward(evt, policy);
+}
+
+// ../../packages/core/dist/channels/governance/slack-peer-classifier.js
+var CODE_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+function classifyPeerMessage(msg, cfg, self) {
+  if (!msg.bot_id)
+    return { kind: "human" };
+  if (self.bot_user_id !== null && msg.user === self.bot_user_id) {
+    return { kind: "self" };
+  }
+  if (cfg.peer_disabled_mode === "all") {
+    return { kind: "drop", reason: "peer_disabled_all" };
+  }
+  if (cfg.peer_agent_mode === "off") {
+    return { kind: "drop", reason: "mode_off" };
+  }
+  if (cfg.peer_group_ids.length === 0) {
+    if (msg.channel_type !== "im") {
+      return { kind: "drop", reason: "chat_not_allowed" };
+    }
+  } else if (!cfg.peer_group_ids.includes(msg.channel)) {
+    return { kind: "drop", reason: "chat_not_allowed" };
+  }
+  const peer = cfg.peers.find((p) => p.bot_user_id === msg.user);
+  if (!peer) {
+    return { kind: "drop", reason: "unknown_peer" };
+  }
+  if (peer.gate_path === null) {
+    return { kind: "drop", reason: "cross_team_grant_missing" };
+  }
+  if (cfg.peer_disabled_mode === "cross_team_only" && peer.gate_path !== void 0 && peer.gate_path !== "same_team") {
+    return { kind: "drop", reason: "peer_disabled_cross_team" };
+  }
+  if (self.bot_user_id === null) {
+    return { kind: "drop", reason: "self_resolution_pending" };
+  }
+  const addressing = classifyAddressing(msg, self.bot_user_id);
+  if (!addressing.addressed) {
+    return { kind: "drop", reason: "not_addressed" };
+  }
+  if (addressing.viaReplyOnly) {
+    const inAllowedGroup = cfg.peer_group_ids.length > 0 && cfg.peer_group_ids.includes(msg.channel);
+    const respondMode = cfg.peer_agent_mode === "respond";
+    if (!(inAllowedGroup && respondMode)) {
+      return { kind: "drop", reason: "not_addressed" };
+    }
+  }
+  return { kind: "peer-ingress", peer };
+}
+function classifyAddressing(msg, ourBotUserId) {
+  const text = msg.text ?? "";
+  const mentionToken = `<@${ourBotUserId}>`;
+  const viaMention = text.includes(mentionToken);
+  const viaReply = !!msg.thread_ts && msg.thread_ts !== void 0 && msg.parent_user_id === ourBotUserId;
+  if (viaMention) {
+    return { addressed: true, viaReplyOnly: false };
+  }
+  if (viaReply) {
+    return { addressed: true, viaReplyOnly: true };
+  }
+  return { addressed: false, viaReplyOnly: false };
+}
+function parsePeersEnv(raw, gateRaw) {
+  if (!raw || raw.trim().length === 0)
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed))
+    return [];
+  const gateMap = /* @__PURE__ */ new Map();
+  let gateConfigInvalid = false;
+  if (gateRaw && gateRaw.trim().length > 0) {
+    try {
+      const gateParsed = JSON.parse(gateRaw);
+      if (!gateParsed || typeof gateParsed !== "object" || Array.isArray(gateParsed)) {
+        gateConfigInvalid = true;
+      } else {
+        for (const [k, v] of Object.entries(gateParsed)) {
+          if (v === null) {
+            gateMap.set(k, null);
+          } else if (typeof v === "string") {
+            const isGrantPath = v.startsWith("grant:") && v.slice("grant:".length).trim().length > 0;
+            if (v === "same_team" || v === "intra_org_unrestricted" || isGrantPath) {
+              gateMap.set(k, v);
+            } else {
+              gateConfigInvalid = true;
+              break;
+            }
+          } else {
+            gateConfigInvalid = true;
+            break;
+          }
+        }
+      }
+    } catch {
+      gateConfigInvalid = true;
+    }
+    if (gateConfigInvalid) {
+      console.error("[slack-peer-classifier] SLACK_PEERS_GATE is present but malformed; failing closed (every peer drops as cross_team_grant_missing)");
+    }
+  }
+  const out = [];
+  for (const entry of parsed) {
+    if (entry && typeof entry === "object" && typeof entry.code_name === "string" && CODE_NAME_RE.test(entry.code_name) && typeof entry.agent_id === "string" && typeof entry.bot_user_id === "string" && entry.bot_user_id.length > 0) {
+      const e = entry;
+      const peer = {
+        code_name: e.code_name,
+        bot_user_id: e.bot_user_id,
+        agent_id: e.agent_id
+      };
+      if (gateConfigInvalid) {
+        peer.gate_path = null;
+      } else if (gateMap.has(e.bot_user_id)) {
+        peer.gate_path = gateMap.get(e.bot_user_id) ?? null;
+      }
+      out.push(peer);
+    }
+  }
+  return out;
+}
+function parsePeerGroupIdsEnv(raw) {
+  if (!raw)
+    return [];
+  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function parsePeerAgentModeEnv(raw) {
+  if (raw === "listen" || raw === "respond")
+    return raw;
+  return "off";
+}
+
+// ../../packages/core/dist/channels/governance/sender-policy-decline.js
+function classifySlackPolicyBlock(evt, policy) {
+  if (policy.internalOnly && (!policy.homeTeamId || evt.team !== policy.homeTeamId)) {
+    return "internal_only";
+  }
+  switch (policy.mode) {
+    case "manager_only":
+      return "mode_manager_only";
+    case "team_only":
+      return "mode_team_only";
+    case "team_agents_only":
+      return "mode_team_agents_only";
+    case "agents_only":
+      return "mode_agents_only";
+    case "all":
+      return "internal_only";
+  }
+}
+function politeDeclineCopy(reason) {
+  switch (reason) {
+    case "internal_only":
+      return "Sorry, I can only respond to people inside our organisation. This conversation appears to be from outside.";
+    case "mode_manager_only":
+      return "Sorry, I only respond to my manager in this channel.";
+    case "mode_team_only":
+      return "Sorry, this agent only replies to its team members.";
+    case "mode_team_agents_only":
+      return "Sorry, I only respond to agents on my team in this channel.";
+    case "mode_agents_only":
+      return "Sorry, I only respond to other agents in this channel.";
+  }
+}
+
+// ../../packages/core/dist/channels/governance/inbound-access.js
+function decideInboundAccess(input) {
+  if (!input.content.forward) {
+    return { kind: "drop", reason: `content:${input.content.reason}` };
+  }
+  if (input.isSelf) {
+    return { kind: "drop", reason: "self" };
+  }
+  if (input.orgBoundary && !input.orgBoundary.forward) {
+    return { kind: "drop", reason: "org_boundary" };
+  }
+  if (input.senderPolicy && !input.senderPolicy.forward) {
+    const reason = input.senderPolicy.reason;
+    const declineWorthy = input.sameOrg && reason !== "internal_only";
+    return {
+      kind: "drop",
+      reason: `sender_policy:${reason}`,
+      decline: declineWorthy ? politeDeclineCopy(reason) : void 0
+    };
+  }
+  if (input.command && !input.isBot) {
+    return {
+      kind: "command",
+      command: input.command.command,
+      authorized: input.command.authorized
+    };
+  }
+  if (input.isBot) {
+    const peer = input.peer;
+    if (!peer || peer.kind === "self") {
+      return { kind: "drop", reason: peer?.kind === "self" ? "self" : "peer:unclassified" };
+    }
+    if (peer.kind === "drop") {
+      return { kind: "drop", reason: `peer:${peer.reason ?? "unspecified"}` };
+    }
+  }
+  return { kind: "admit" };
+}
+
+// ../../packages/core/dist/channels/governance/slack-sender-gate.js
+function evaluateSlackInboundGate(evt, deps) {
+  const isBot = Boolean(evt.bot_id);
+  const content = decideSlackMessageForward(evt);
+  const spDecision = decideSenderPolicyForward(evt, deps.senderPolicy);
+  const senderPolicy = spDecision.forward ? { forward: true } : { forward: false, reason: classifySlackPolicyBlock(evt, deps.senderPolicy) };
+  const peer = isBot ? (() => {
+    const c = classifyPeerMessage({
+      text: evt.text,
+      channel: evt.channel ?? "",
+      channel_type: evt.channel_type,
+      user: evt.user,
+      bot_id: evt.bot_id,
+      thread_ts: evt.thread_ts,
+      parent_user_id: evt.parent_user_id
+    }, deps.peerConfig, { bot_user_id: deps.botUserId ?? null });
+    return { kind: c.kind, reason: c.kind === "drop" ? c.reason : void 0 };
+  })() : void 0;
+  const decision = decideInboundAccess({
+    content,
+    isSelf: Boolean(evt.user && deps.botUserId && evt.user === deps.botUserId),
+    isBot,
+    peer,
+    senderPolicy,
+    // Injection gate: no command dispatch and no same-org decline copy needed.
+    sameOrg: false
+  });
+  if (decision.kind === "drop")
+    return { admit: false, reason: decision.reason };
+  return { admit: true };
+}
+
+// ../../packages/core/dist/channels/governance/slack-inbound-config.js
+function buildSlackSenderPolicyFromEnv(env, ctx) {
+  const raw = (env["SLACK_SENDER_POLICY"] ?? "all").trim().toLowerCase();
+  const internalOnly = env["SLACK_INTERNAL_ONLY"] === "true";
+  const homeTeamId = env["SLACK_HOME_TEAM_ID"];
+  if (internalOnly && !homeTeamId) {
+    throw new Error("SLACK_INTERNAL_ONLY=true requires SLACK_HOME_TEAM_ID. The bot install must have a known team_id (run auth.test against the workspace and persist the result).");
+  }
+  const internalOnlyFields = internalOnly ? { internalOnly: true, homeTeamId } : {};
+  const teamId = ctx.agentTeamId;
+  if (raw === "all")
+    return { mode: "all", ...internalOnlyFields };
+  if (raw === "agents_only")
+    return { mode: "agents_only", ...internalOnlyFields };
+  if (raw === "team_agents_only") {
+    if (!teamId) {
+      throw new Error("SLACK_SENDER_POLICY=team_agents_only requires AGT_TEAM_ID");
+    }
+    return { mode: "team_agents_only", teamId, ...internalOnlyFields };
+  }
+  if (raw === "team_only") {
+    if (!teamId) {
+      throw new Error("SLACK_SENDER_POLICY=team_only requires AGT_TEAM_ID");
+    }
+    const teamPrincipalSlackUserIds = (env["SLACK_SENDER_POLICY_TEAM_PRINCIPAL_IDS"] ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    return { mode: "team_only", teamId, teamPrincipalSlackUserIds, ...internalOnlyFields };
+  }
+  if (raw === "manager_only") {
+    const principalSlackUserId = env["SLACK_SENDER_POLICY_PRINCIPAL_ID"];
+    if (!teamId) {
+      throw new Error("SLACK_SENDER_POLICY=manager_only requires AGT_TEAM_ID");
+    }
+    if (!principalSlackUserId) {
+      throw new Error("SLACK_SENDER_POLICY=manager_only requires SLACK_SENDER_POLICY_PRINCIPAL_ID. Set agent.reports_to_person with a slack_user_id in contact_preferences and re-run /host/refresh.");
+    }
+    return { mode: "manager_only", teamId, principalSlackUserId, ...internalOnlyFields };
+  }
+  throw new Error(`Invalid SLACK_SENDER_POLICY=${JSON.stringify(env["SLACK_SENDER_POLICY"])}`);
+}
+function parseSlackPeerDisabledModeEnv(env, onWarn) {
+  const raw = (env["PEER_DISABLED"] ?? "").trim().toLowerCase();
+  if (raw === "" || raw === "off")
+    return "off";
+  if (raw === "cross_team_only" || raw === "all")
+    return raw;
+  onWarn?.(`invalid PEER_DISABLED=${JSON.stringify(env["PEER_DISABLED"])} - defaulting to 'all' (fail-closed)`);
+  return "all";
+}
+function buildSlackPeerClassifierConfigFromEnv(env, opts) {
+  return {
+    peer_agent_mode: parsePeerAgentModeEnv(env["SLACK_PEER_AGENT_MODE"]),
+    peer_group_ids: parsePeerGroupIdsEnv(env["SLACK_PEER_GROUP_IDS"]),
+    peers: parsePeersEnv(env["SLACK_PEERS"], env["SLACK_PEERS_GATE"]),
+    peer_disabled_mode: parseSlackPeerDisabledModeEnv(env, opts?.onWarn)
+  };
+}
+
+// src/lib/slack-ingest.ts
+var SLACK_AUTH_FAILURE_CODES = /* @__PURE__ */ new Set([
+  "invalid_auth",
+  "token_revoked",
+  "token_expired",
+  "account_inactive",
+  "not_authed"
+]);
+async function resolveSlackBotUserId(botToken, fetchImpl) {
+  const doFetch = fetchImpl ?? globalThis.fetch;
+  try {
+    const res = await doFetch(`${SLACK_API}/auth.test`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${botToken}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    const data = await res.json();
+    if (data.ok) return { id: data.user_id, authFailed: false };
+    return { id: void 0, authFailed: !!data.error && SLACK_AUTH_FAILURE_CODES.has(data.error) };
+  } catch {
+    return { id: void 0, authFailed: false };
+  }
+}
+function resolveSlackIngestParamsFromEnv(env, ctx) {
+  const appToken = env["SLACK_APP_TOKEN"];
+  const botToken = env["SLACK_BOT_TOKEN"];
+  if (!appToken || !botToken) return null;
+  return {
+    appToken,
+    botToken,
+    senderPolicy: buildSlackSenderPolicyFromEnv(env, ctx),
+    peerConfig: buildSlackPeerClassifierConfigFromEnv(env)
+  };
+}
+var BoundedSet = class {
+  max;
+  set = /* @__PURE__ */ new Set();
+  constructor(max = 500) {
+    this.max = max;
+  }
+  has(k) {
+    return this.set.has(k);
+  }
+  add(k) {
+    this.set.add(k);
+    if (this.set.size > this.max) {
+      const oldest = this.set.values().next().value;
+      if (oldest !== void 0) this.set.delete(oldest);
+    }
+  }
+};
+async function dispatchSlackInbound(event, ctx) {
+  if (isAppMentionEcho(event, ctx.botUserId ?? null)) {
+    return "dropped_echo";
+  }
+  const dedupKey = event.channel && event.ts ? `${event.channel}:${event.ts}` : null;
+  if (dedupKey) {
+    if (ctx.seen.has(dedupKey)) return "dropped_duplicate";
+    ctx.seen.add(dedupKey);
+  }
+  const decision = evaluateSlackInboundGate(event, {
+    senderPolicy: ctx.senderPolicy,
+    peerConfig: ctx.peerConfig,
+    botUserId: ctx.botUserId
+  });
+  if (!decision.admit) {
+    ctx.log(`[slack-ingest:${ctx.codeName}] dropped ${redact(event.channel)} reason=${decision.reason}`);
+    return "dropped_gate";
+  }
+  const conversationKey = `${event.channel ?? "nochannel"}:${event.thread_ts ?? event.ts ?? ""}`;
+  const meta = {
+    source: "slack",
+    lane: "conversational",
+    requires_reply: "true"
+  };
+  if (event.thread_ts) meta["thread_ts"] = event.thread_ts;
+  else if (event.ts) meta["thread_ts"] = event.ts;
+  const result = await ctx.inject({
+    channelId: "slack",
+    conversationKey,
+    senderId: event.user ?? "unknown",
+    text: event.text ?? "",
+    meta
+  });
+  if (result.status === "declined") {
+    ctx.log(`[slack-ingest:${ctx.codeName}] inject declined reason=${result.reason}`);
+    return "declined";
+  }
+  if (result.status === "replied" && result.reply && event.channel) {
+    await ctx.sendReply({
+      channel: event.channel,
+      text: result.reply,
+      threadTs: event.thread_ts ?? event.ts
+    });
+    return "admitted_replied";
+  }
+  return "admitted_no_reply";
+}
+function redact(id) {
+  if (!id) return "?";
+  return `${id.slice(0, 1)}***`;
+}
+var SLACK_API = "https://slack.com/api";
+function defaultSendReply(botToken, fetchImpl, log2) {
+  return async ({ channel, text, threadTs }) => {
+    try {
+      const res = await fetchImpl(`${SLACK_API}/chat.postMessage`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${botToken}`,
+          "Content-Type": "application/json; charset=utf-8"
+        },
+        body: JSON.stringify({ channel, text, ...threadTs ? { thread_ts: threadTs } : {} })
+      });
+      const data = await res.json();
+      if (!data.ok) log2(`[slack-ingest] chat.postMessage failed: ${data.error}`);
+    } catch (err) {
+      log2(`[slack-ingest] chat.postMessage threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  };
+}
+function startSlackIngest(config2) {
+  const fetchImpl = config2.fetchImpl ?? globalThis.fetch;
+  const socketFactory = config2.socketFactory ?? ((url) => {
+    const Ctor = globalThis.WebSocket;
+    if (!Ctor) throw new Error("global WebSocket is unavailable (Node 22+ required for opencode Slack ingest)");
+    return new Ctor(url);
+  });
+  const sendReply = config2.sendReply ?? defaultSendReply(config2.botToken, fetchImpl, config2.log);
+  const seen = new BoundedSet();
+  let stopped = false;
+  let ws = null;
+  const ctx = {
+    codeName: config2.codeName,
+    botUserId: config2.botUserId,
+    senderPolicy: config2.senderPolicy,
+    peerConfig: config2.peerConfig,
+    inject: config2.inject,
+    sendReply,
+    log: config2.log,
+    seen
+  };
+  const scheduleReconnect = (delayMs) => {
+    if (stopped) return;
+    setTimeout(() => void connect(), delayMs).unref?.();
+  };
+  const connect = async () => {
+    if (stopped) return;
+    let url;
+    try {
+      const res = await fetchImpl(`${SLACK_API}/apps.connections.open`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${config2.appToken}` },
+        // Bound the open call so a hung request can't wedge ingest without a
+        // reconnect (Node 22+ required for opencode Slack ingest, so
+        // AbortSignal.timeout is available).
+        signal: AbortSignal.timeout(1e4)
+      });
+      const data = await res.json();
+      if (!data.ok || !data.url) {
+        config2.log(`[slack-ingest:${config2.codeName}] apps.connections.open failed: ${data.error}`);
+        scheduleReconnect(1e4);
+        return;
+      }
+      url = data.url;
+    } catch (err) {
+      config2.log(`[slack-ingest:${config2.codeName}] connect threw: ${err instanceof Error ? err.message : String(err)}`);
+      scheduleReconnect(1e4);
+      return;
+    }
+    if (stopped) return;
+    try {
+      ws = socketFactory(url);
+      ws.onopen = () => config2.log(`[slack-ingest:${config2.codeName}] Socket Mode connected`);
+      ws.onclose = () => {
+        if (!stopped) scheduleReconnect(5e3);
+      };
+      ws.onerror = () => {
+      };
+      ws.onmessage = (ev) => {
+        void onEnvelope(String(ev.data));
+      };
+    } catch (err) {
+      config2.log(`[slack-ingest:${config2.codeName}] socket construction threw: ${err instanceof Error ? err.message : String(err)}`);
+      scheduleReconnect(1e4);
+    }
+  };
+  const onEnvelope = async (raw) => {
+    let msg;
+    try {
+      msg = JSON.parse(raw);
+    } catch {
+      return;
+    }
+    if (msg.envelope_id && ws) {
+      try {
+        ws.send(JSON.stringify({ envelope_id: msg.envelope_id }));
+      } catch {
+      }
+    }
+    if (msg.type === "disconnect") {
+      try {
+        ws?.close();
+      } catch {
+      }
+      return;
+    }
+    if (msg.type !== "events_api") return;
+    const event = msg.payload?.event;
+    if (!event || event.type !== "message" && event.type !== "app_mention") return;
+    try {
+      await dispatchSlackInbound(event, ctx);
+    } catch (err) {
+      config2.log(`[slack-ingest:${config2.codeName}] dispatch threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  };
+  void connect();
+  return {
+    stop() {
+      stopped = true;
+      try {
+        ws?.close();
+      } catch {
+      }
+      ws = null;
+    }
+  };
+}
+
+// src/lib/opencode-slack-ingest.ts
+var ingests = /* @__PURE__ */ new Map();
+function fingerprint(params) {
+  return createHash11("sha256").update(
+    JSON.stringify({
+      appToken: params.appToken,
+      botToken: params.botToken,
+      senderPolicy: params.senderPolicy,
+      peerConfig: params.peerConfig
+    })
+  ).digest("hex");
+}
+async function ensureOpencodeSlackIngest(opts) {
+  const { codeName, agentId, log: log2 } = opts;
+  const readEnv = opts.readEnv ?? readChannelServerEnv;
+  let params;
+  let env;
+  try {
+    env = readEnv(codeName, "slack");
+    if (!env) {
+      stopOpencodeSlackIngest(codeName, log2);
+      return;
+    }
+    params = resolveSlackIngestParamsFromEnv(env, { agentTeamId: env["AGT_TEAM_ID"] ?? null });
+  } catch (err) {
+    stopOpencodeSlackIngest(codeName, log2);
+    log2(
+      `[slack-ingest:${codeName}] not started: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return;
+  }
+  if (!params) {
+    stopOpencodeSlackIngest(codeName, log2);
+    return;
+  }
+  const key = fingerprint(params);
+  const existing = ingests.get(codeName);
+  if (existing?.key === key) return;
+  const { id: botUserId, authFailed } = await resolveSlackBotUserId(params.botToken, opts.fetchImpl);
+  if (authFailed) {
+    stopOpencodeSlackIngest(codeName, log2);
+    log2(`[slack-ingest:${codeName}] not started: Slack bot token rejected (needs reconnect)`);
+    return;
+  }
+  if (!botUserId) {
+    log2(`[slack-ingest:${codeName}] bot user id unresolved; echo filtering degraded`);
+  }
+  if (existing) {
+    existing.handle.stop();
+    ingests.delete(codeName);
+    log2(`[slack-ingest:${codeName}] config changed; restarting ingest`);
+  }
+  const handle = startSlackIngest({
+    codeName,
+    agentId,
+    appToken: params.appToken,
+    botToken: params.botToken,
+    botUserId,
+    senderPolicy: params.senderPolicy,
+    peerConfig: params.peerConfig,
+    inject: (msg) => injectOpencodeMessage(codeName, msg, { awaitReply: true }),
+    log: log2,
+    ...opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {},
+    ...opts.socketFactory ? { socketFactory: opts.socketFactory } : {}
+  });
+  ingests.set(codeName, { key, handle });
+  log2(`[slack-ingest:${codeName}] ingest started (policy=${params.senderPolicy.mode})`);
+}
+function stopOpencodeSlackIngest(codeName, log2) {
+  const entry = ingests.get(codeName);
+  if (!entry) return;
+  entry.handle.stop();
+  ingests.delete(codeName);
+  log2?.(`[slack-ingest:${codeName}] ingest stopped`);
+}
+function stopAllOpencodeSlackIngests(log2) {
+  for (const codeName of [...ingests.keys()]) stopOpencodeSlackIngest(codeName, log2);
+}
+
 // src/lib/wedge-detection.ts
 var DEFAULTS = {
   inboundWaitSeconds: 120,
@@ -5487,24 +6678,24 @@ function partitionActionableByPoison(actionable, states, config2) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readdirSync as readdirSync4, readFileSync as readFileSync15, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join18 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readdirSync as readdirSync4, readFileSync as readFileSync16, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join19 } from "path";
 import { randomUUID } from "crypto";
 function restartFlagsDir() {
-  return join18(homedir9(), ".augmented", "restart-flags");
+  return join19(homedir10(), ".augmented", "restart-flags");
 }
 function flagPath(codeName) {
-  return join18(restartFlagsDir(), `${codeName}.flag`);
+  return join19(restartFlagsDir(), `${codeName}.flag`);
 }
 function readRestartFlags() {
   const dir = restartFlagsDir();
-  if (!existsSync9(dir)) return [];
+  if (!existsSync10(dir)) return [];
   const out = [];
   for (const entry of readdirSync4(dir)) {
     if (!entry.endsWith(".flag")) continue;
     try {
-      const raw = readFileSync15(join18(dir, entry), "utf8");
+      const raw = readFileSync16(join19(dir, entry), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.codeName !== "string" || parsed.codeName.length === 0) {
         parsed.codeName = entry.replace(/\.flag$/, "");
@@ -5522,7 +6713,7 @@ function readRestartFlags() {
 }
 function deleteRestartFlag(codeName) {
   const path = flagPath(codeName);
-  if (existsSync9(path)) {
+  if (existsSync10(path)) {
     rmSync3(path, { force: true });
   }
 }
@@ -5868,10 +7059,10 @@ function startRealtimeConfig(config2) {
     filter: filterStr
   }, (payload) => {
     const agent = payload.new;
-    const fingerprint = `${agent.status}|${agent.framework}|${agent.session_mode}|${agent.primary_model}`;
+    const fingerprint2 = `${agent.status}|${agent.framework}|${agent.session_mode}|${agent.primary_model}`;
     const prev = lastKnown.get(agent.agent_id);
-    if (prev === fingerprint) return;
-    lastKnown.set(agent.agent_id, fingerprint);
+    if (prev === fingerprint2) return;
+    lastKnown.set(agent.agent_id, fingerprint2);
     log2(`[realtime] Agent config changed: ${agent.code_name} (status=${agent.status})`);
     onConfigChange(agent);
   }).subscribe((status) => {
@@ -6739,20 +7930,21 @@ function isHostBusyForForcedUpdate() {
   return false;
 }
 var runningMcpHashes = /* @__PURE__ */ new Map();
+var anchorSessionLifecycle = new AnchorSessionLifecycle();
 var runningMcpServerKeys = /* @__PURE__ */ new Map();
 var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 var sessionLaunchManagedStructure = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
-    const raw = readFileSync16(join19(projectDir, ".mcp.json"), "utf-8");
-    return createHash11("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
+    const raw = readFileSync17(join20(projectDir, ".mcp.json"), "utf-8");
+    return createHash12("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
   }
 }
 function projectMcpKeys(_codeName, projectDir) {
   try {
-    const raw = readFileSync16(join19(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync17(join20(projectDir, ".mcp.json"), "utf-8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers;
     if (!servers || typeof servers !== "object") return /* @__PURE__ */ new Set();
@@ -6770,7 +7962,7 @@ function seedSessionLaunchBaselines(codeName, projectDir) {
   else runningMcpServerKeys.delete(codeName);
   let launchStructure = null;
   try {
-    const raw = readFileSync16(join19(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync17(join20(projectDir, ".mcp.json"), "utf-8");
     launchStructure = managedMcpStructureHashFromFile(
       JSON.parse(raw),
       isManagedMcpServerKey
@@ -6870,7 +8062,7 @@ async function runAgentSessionToolBindProbes(agent, integrations, projectDir, op
   if (result && result.rebindCandidates.length > 0 && hostFlagStore().getBoolean("session-tool-rebind")) {
     let mcpJsonForRebind = null;
     try {
-      mcpJsonForRebind = JSON.parse(readFileSync16(join19(projectDir, ".mcp.json"), "utf-8"));
+      mcpJsonForRebind = JSON.parse(readFileSync17(join20(projectDir, ".mcp.json"), "utf-8"));
     } catch {
       mcpJsonForRebind = null;
     }
@@ -6999,7 +8191,7 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
 function projectChannelSecretHash(projectDir) {
   try {
     const entries = parseEnvIntegrations(
-      readFileSync16(join19(projectDir, ".env.integrations"), "utf-8")
+      readFileSync17(join20(projectDir, ".env.integrations"), "utf-8")
     );
     return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
   } catch {
@@ -7061,6 +8253,7 @@ function resolveAgentFramework(codeName) {
 function clearAgentCaches(agentId, codeName) {
   const channelCacheMutated = clearAgentState(agentId, codeName);
   agentChannelTokens.delete(codeName);
+  stopOpencodeSlackIngest(codeName, log);
   agentFrameworkCache.delete(codeName);
   kanbanBoardCache.delete(codeName);
   notifyBoardCache.delete(codeName);
@@ -7087,7 +8280,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.318" : "dev";
+var agtCliVersion = true ? "0.28.320" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -7100,7 +8293,7 @@ function resolveBrewPath(execFileSync2) {
     "/usr/local/bin/brew"
   ];
   for (const path of fallbacks) {
-    if (existsSync10(path)) return path;
+    if (existsSync11(path)) return path;
   }
   return null;
 }
@@ -7110,7 +8303,7 @@ function claudeBinaryInstalled(execFileSync2) {
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude"
   ];
-  if (canonical.some((path) => existsSync10(path))) return true;
+  if (canonical.some((path) => existsSync11(path))) return true;
   try {
     execFileSync2("which", ["claude"], { timeout: 5e3 });
     return true;
@@ -7146,7 +8339,7 @@ async function ensureToolkitCli(toolkitSlug) {
   }
   const { binary, installer, package: pkg, script } = integration.cli_tool;
   const resolvedInstaller = installer ?? "manual";
-  const { execFileSync: execFileSync2, execSync } = await import("child_process");
+  const { execFileSync: execFileSync2, execSync: execSync2 } = await import("child_process");
   try {
     execFileSync2("which", [binary], { timeout: 5e3, stdio: "pipe" });
     toolkitCliEnsured.add(toolkitSlug);
@@ -7197,7 +8390,7 @@ async function ensureToolkitCli(toolkitSlug) {
         return;
       }
       log(`[toolkit-install] ${toolkitSlug}: running declared install script\u2026`);
-      execSync(script, { timeout: 18e4, stdio: "pipe" });
+      execSync2(script, { timeout: 18e4, stdio: "pipe" });
     }
   } catch (err) {
     const e = err;
@@ -7221,8 +8414,8 @@ async function ensureToolkitCli(toolkitSlug) {
 }
 function runAsync(cmd, args, opts) {
   return new Promise((resolve, reject) => {
-    import("child_process").then(({ spawn }) => {
-      const child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"], cwd: opts.cwd });
+    import("child_process").then(({ spawn: spawn2 }) => {
+      const child = spawn2(cmd, args, { stdio: ["ignore", "pipe", "pipe"], cwd: opts.cwd });
       let stdout = "";
       let stderr = "";
       let settled = false;
@@ -7265,8 +8458,8 @@ function claudeManagedSettingsPath() {
 function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
   try {
     let settings = {};
-    if (existsSync10(path)) {
-      const raw = readFileSync16(path, "utf-8").trim();
+    if (existsSync11(path)) {
+      const raw = readFileSync17(path, "utf-8").trim();
       if (raw) {
         let parsed;
         try {
@@ -7282,7 +8475,7 @@ function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
     }
     if (settings.channelsEnabled === true) return "ok";
     settings.channelsEnabled = true;
-    mkdirSync7(dirname6(path), { recursive: true });
+    mkdirSync8(dirname6(path), { recursive: true });
     writeFileSync8(path, `${JSON.stringify(settings, null, 2)}
 `);
     log(`[managed-settings] set channelsEnabled:true in ${path} (ENG-5786 \u2014 unblocks Claude Code channels)`);
@@ -7328,7 +8521,7 @@ async function ensureFrameworkBinary(frameworkId) {
     if (!process.env.PATH?.split(":").includes(brewBinDir)) {
       process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
     }
-    if (existsSync10("/home/linuxbrew/.linuxbrew/bin/claude")) {
+    if (existsSync11("/home/linuxbrew/.linuxbrew/bin/claude")) {
       log("Claude Code installed successfully");
     } else {
       log("Claude Code install completed but binary not found at expected path \u2014 check brew logs");
@@ -7384,7 +8577,7 @@ ${r.stderr}`;
 }
 var UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function selfUpdateAppliedMarkerPath() {
-  return join19(homedir10(), ".augmented", ".last-self-update-applied");
+  return join20(homedir11(), ".augmented", ".last-self-update-applied");
 }
 var selfUpdateUpToDateLogged = false;
 var restartAfterUpgrade = false;
@@ -7408,7 +8601,7 @@ async function checkAndUpdateCli(opts) {
     const isNpmGlobal = !isBrewFormula && resolvedPath.includes("node_modules");
     if (!isBrewFormula && !isNpmGlobal) return "noop";
     const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
-    const markerPath = join19(homedir10(), ".augmented", ".last-update-check");
+    const markerPath = join20(homedir11(), ".augmented", ".last-update-check");
     if (!force) {
       try {
         const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
@@ -7686,13 +8879,13 @@ async function checkClaudeAuth() {
 }
 var evalEmptyMcpConfigPath = null;
 function ensureEvalEmptyMcpConfig() {
-  if (evalEmptyMcpConfigPath && existsSync10(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
-  const dir = join19(homedir10(), ".augmented");
+  if (evalEmptyMcpConfigPath && existsSync11(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
+  const dir = join20(homedir11(), ".augmented");
   try {
-    mkdirSync7(dir, { recursive: true });
+    mkdirSync8(dir, { recursive: true });
   } catch {
   }
-  const p = join19(dir, ".eval-empty-mcp.json");
+  const p = join20(dir, ".eval-empty-mcp.json");
   writeFileSync8(p, JSON.stringify({ mcpServers: {} }));
   evalEmptyMcpConfigPath = p;
   return p;
@@ -7718,7 +8911,7 @@ async function runEvalClaude(prompt, model) {
     ""
   ];
   const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-    cwd: homedir10(),
+    cwd: homedir11(),
     timeout: 12e4,
     stdin: "ignore",
     env: childEnv,
@@ -7784,10 +8977,10 @@ function resolveConversationEvalBackend() {
   return conversationEvalBackend;
 }
 function getStateFile() {
-  return join19(config?.configDir ?? join19(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
+  return join20(config?.configDir ?? join20(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
 }
 function channelHashCacheDir() {
-  return config?.configDir ?? join19(process.env["HOME"] ?? "/tmp", ".augmented");
+  return config?.configDir ?? join20(process.env["HOME"] ?? "/tmp", ".augmented");
 }
 function loadChannelHashCache2() {
   loadChannelHashCache(agentState.knownChannelConfigHashes, channelHashCacheDir());
@@ -7815,7 +9008,7 @@ function removeSenderPolicyBaselineEntry(agentId) {
 var _channelQuarantineStore = null;
 function channelQuarantineStore() {
   if (!_channelQuarantineStore) {
-    const dir = config?.configDir ?? join19(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join20(process.env["HOME"] ?? "/tmp", ".augmented");
     _channelQuarantineStore = new ChannelQuarantineStore(defaultQuarantinePath(dir));
   }
   return _channelQuarantineStore;
@@ -7823,7 +9016,7 @@ function channelQuarantineStore() {
 var _hostFlagStore = null;
 function hostFlagStore() {
   if (!_hostFlagStore) {
-    const dir = config?.configDir ?? join19(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join20(process.env["HOME"] ?? "/tmp", ".augmented");
     _hostFlagStore = new HostFlagStore({ cachePath: defaultFlagsCachePath(dir), log });
   }
   return _hostFlagStore;
@@ -7891,12 +9084,12 @@ function parseSkillFrontmatter(content) {
 }
 async function refreshSkillsIndexInClaudeMd(configDir, codeName, log2) {
   const { readdirSync: readdirSync6, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync9 } = await import("fs");
-  const skillsDir = join19(configDir, codeName, "project", ".claude", "skills");
-  const claudeMdPath = join19(configDir, codeName, "project", "CLAUDE.md");
+  const skillsDir = join20(configDir, codeName, "project", ".claude", "skills");
+  const claudeMdPath = join20(configDir, codeName, "project", "CLAUDE.md");
   if (!ex(skillsDir) || !ex(claudeMdPath)) return;
   const entries = [];
   for (const dir of readdirSync6(skillsDir).sort()) {
-    const skillFile = join19(skillsDir, dir, "SKILL.md");
+    const skillFile = join20(skillsDir, dir, "SKILL.md");
     if (!ex(skillFile)) continue;
     try {
       const { name, description } = parseSkillFrontmatter(rfs(skillFile, "utf-8"));
@@ -7959,7 +9152,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-VSSEZTY7.js");
+      const { collectDiagnostics } = await import("../persistent-session-ZQSAZIVM.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames)
@@ -8057,7 +9250,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-VSSEZTY7.js");
+      const { collectDiagnostics } = await import("../persistent-session-ZQSAZIVM.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -8078,8 +9271,8 @@ async function pollCycle() {
       }
       let osUsername;
       try {
-        const { userInfo } = await import("os");
-        osUsername = userInfo().username;
+        const { userInfo: userInfo2 } = await import("os");
+        osUsername = userInfo2().username;
       } catch {
       }
       let claudeAuth = null;
@@ -8087,7 +9280,7 @@ async function pollCycle() {
         claudeAuth = await detectClaudeAuth();
       } catch (err) {
         const errText = err instanceof Error ? err.message : String(err);
-        const errId = createHash11("sha256").update(errText).digest("hex").slice(0, 12);
+        const errId = createHash12("sha256").update(errText).digest("hex").slice(0, 12);
         log(`Claude auth detection failed (error_id=${errId})`);
       }
       const hostHasClaudeCode = state6.agents.some(
@@ -8206,7 +9399,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-I6YFUKYD.js");
+      } = await import("../responsiveness-probe-NARLJJGH.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -8238,7 +9431,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-I6YFUKYD.js");
+        } = await import("../responsiveness-probe-NARLJJGH.js");
         const { getProjectDir: wedgeProjectDir } = await import("../claude-scheduler-FATCLHDM.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -8327,13 +9520,13 @@ async function pollCycle() {
             );
             if (hostFlagStore().getBoolean("wedge-transient-notice")) {
               try {
-                const paneTail = readFileSync16(paneLogPath(codeName), "utf8").slice(-65536);
+                const paneTail = readFileSync17(paneLogPath(codeName), "utf8").slice(-65536);
                 const transient = detectTransientApiErrorInLog(paneTail);
                 if (transient) {
-                  const wedgeHome = join19(homedir10(), ".augmented", codeName);
-                  if (existsSync10(wedgeHome)) {
+                  const wedgeHome = join20(homedir11(), ".augmented", codeName);
+                  if (existsSync11(wedgeHome)) {
                     atomicWriteFileSync(
-                      join19(wedgeHome, "watchdog-give-up.json"),
+                      join20(wedgeHome, "watchdog-give-up.json"),
                       JSON.stringify({
                         gave_up_at: wedgeNow.toISOString(),
                         reason: "transient_overload"
@@ -8582,7 +9775,7 @@ async function pollCycle() {
         } catch {
         }
         killAgentChannelProcesses(prev.codeName, { log });
-        const agentDir = join19(adapter.getAgentDir(prev.codeName), "provision");
+        const agentDir = join20(adapter.getAgentDir(prev.codeName), "provision");
         await cleanupAgentFiles(prev.codeName, agentDir);
         clearAgentCaches(prev.agentId, prev.codeName);
       }
@@ -8669,10 +9862,10 @@ async function pollCycle() {
         // pending-inbound marker. Best-effort: a write failure is logged by
         // the watchdog, never fails the poll cycle.
         signalGiveUp: (codeName) => {
-          const dir = join19(homedir10(), ".augmented", codeName);
-          if (!existsSync10(dir)) return;
+          const dir = join20(homedir11(), ".augmented", codeName);
+          if (!existsSync11(dir)) return;
           atomicWriteFileSync(
-            join19(dir, "watchdog-give-up.json"),
+            join20(dir, "watchdog-give-up.json"),
             JSON.stringify({ gave_up_at: (/* @__PURE__ */ new Date()).toISOString() })
           );
         }
@@ -8802,7 +9995,7 @@ async function processAgent(agent, agentStates) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const adapter = resolveAgentFramework(agent.code_name);
-  let agentDir = join19(adapter.getAgentDir(agent.code_name), "provision");
+  let agentDir = join20(adapter.getAgentDir(agent.code_name), "provision");
   if (agent.status === "draft" || agent.status === "paused") {
     if (previousKnownStatus !== agent.status) {
       log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
@@ -8848,7 +10041,7 @@ async function processAgent(agent, agentStates) {
       const residuals = {
         gatewayRunning: false,
         portAllocated: false,
-        provisionDirExists: existsSync10(agentDir)
+        provisionDirExists: existsSync11(agentDir)
       };
       if (!hasRevokedResiduals(residuals)) {
         agentStates.push({
@@ -8986,7 +10179,7 @@ async function processAgent(agent, agentStates) {
   const frameworkId = refreshData.agent.framework ?? DEFAULT_FRAMEWORK;
   agentFrameworkCache.set(agent.code_name, frameworkId);
   const frameworkAdapter = getFramework(frameworkId);
-  agentDir = join19(frameworkAdapter.getAgentDir(agent.code_name), "provision");
+  agentDir = join20(frameworkAdapter.getAgentDir(agent.code_name), "provision");
   cacheAgentDeliveryMetadata(agent.code_name, refreshData);
   agentRestartTimezoneInputs.set(agent.code_name, {
     agentTimezone: typeof refreshData.agent.timezone === "string" ? refreshData.agent.timezone : null,
@@ -9031,9 +10224,9 @@ async function processAgent(agent, agentStates) {
   try {
     const artifacts = generateArtifacts(agent, refreshData, frameworkAdapter);
     const changedFiles = [];
-    mkdirSync7(agentDir, { recursive: true });
+    mkdirSync8(agentDir, { recursive: true });
     for (const artifact of artifacts) {
-      const filePath = join19(agentDir, artifact.relativePath);
+      const filePath = join20(agentDir, artifact.relativePath);
       let existingHash;
       let newHash;
       let writeContent = artifact.content;
@@ -9052,8 +10245,8 @@ async function processAgent(agent, agentStates) {
         };
         newHash = sha256(stripDynamicSections(artifact.content));
         try {
-          const projectClaudeMd = join19(config.configDir, agent.code_name, "project", "CLAUDE.md");
-          const existing = readFileSync16(projectClaudeMd, "utf-8");
+          const projectClaudeMd = join20(config.configDir, agent.code_name, "project", "CLAUDE.md");
+          const existing = readFileSync17(projectClaudeMd, "utf-8");
           existingHash = sha256(stripDynamicSections(existing));
         } catch {
           existingHash = null;
@@ -9071,7 +10264,7 @@ async function processAgent(agent, agentStates) {
         const generatorKeys = Object.keys(generatorServers);
         let existingRaw = "";
         try {
-          existingRaw = readFileSync16(filePath, "utf-8");
+          existingRaw = readFileSync17(filePath, "utf-8");
         } catch {
         }
         const existingServers = parseMcp(existingRaw);
@@ -9093,13 +10286,13 @@ async function processAgent(agent, agentStates) {
       }
     }
     if (changedFiles.length > 0) {
-      const isFirst = !existsSync10(join19(agentDir, "CHARTER.md"));
+      const isFirst = !existsSync11(join20(agentDir, "CHARTER.md"));
       const verb = isFirst ? "Provisioning" : "Updating";
       const fileNames = changedFiles.map((f) => f.relativePath).join(", ");
       log(`${verb} '${agent.code_name}': ${fileNames}`);
       for (const file of changedFiles) {
-        const filePath = join19(agentDir, file.relativePath);
-        mkdirSync7(dirname6(filePath), { recursive: true });
+        const filePath = join20(agentDir, file.relativePath);
+        mkdirSync8(dirname6(filePath), { recursive: true });
         if (file.relativePath === ".mcp.json") {
           safeWriteJsonAtomic(filePath, file.content, { mode: 384 });
         } else {
@@ -9107,12 +10300,12 @@ async function processAgent(agent, agentStates) {
         }
       }
       try {
-        const provSkillsDir = join19(agentDir, ".claude", "skills");
-        if (existsSync10(provSkillsDir)) {
+        const provSkillsDir = join20(agentDir, ".claude", "skills");
+        if (existsSync11(provSkillsDir)) {
           for (const folder of readdirSync5(provSkillsDir)) {
             if (folder.startsWith("knowledge-")) {
               try {
-                rmSync4(join19(provSkillsDir, folder), { recursive: true });
+                rmSync4(join20(provSkillsDir, folder), { recursive: true });
               } catch {
               }
             }
@@ -9125,7 +10318,7 @@ async function processAgent(agent, agentStates) {
       const trackedFiles2 = frameworkAdapter.driftTrackedFiles();
       const hashes = /* @__PURE__ */ new Map();
       for (const file of trackedFiles2) {
-        const h = hashFile(join19(agentDir, file));
+        const h = hashFile(join20(agentDir, file));
         if (h) hashes.set(file, h);
       }
       agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -9143,14 +10336,14 @@ async function processAgent(agent, agentStates) {
     }
     if (Array.isArray(refreshData.workflows)) {
       try {
-        const provWorkflowsDir = join19(agentDir, ".claude", "workflows");
-        if (existsSync10(provWorkflowsDir)) {
+        const provWorkflowsDir = join20(agentDir, ".claude", "workflows");
+        if (existsSync11(provWorkflowsDir)) {
           const expected = new Set(refreshData.workflows.map((w) => `${w.name}.js`));
           for (const file of readdirSync5(provWorkflowsDir)) {
             if (!file.endsWith(".js")) continue;
             if (expected.has(file)) continue;
             try {
-              rmSync4(join19(provWorkflowsDir, file));
+              rmSync4(join20(provWorkflowsDir, file));
             } catch {
             }
           }
@@ -9207,10 +10400,10 @@ async function processAgent(agent, agentStates) {
   }
   let lastDriftCheckAt = now;
   const written = agentState.writtenHashes.get(agent.agent_id);
-  if (written && existsSync10(agentDir)) {
+  if (written && existsSync11(agentDir)) {
     const driftedFiles = [];
     for (const [file, expectedHash] of written) {
-      const localHash = hashFile(join19(agentDir, file));
+      const localHash = hashFile(join20(agentDir, file));
       if (localHash && localHash !== expectedHash) {
         driftedFiles.push(file);
       }
@@ -9221,7 +10414,7 @@ async function processAgent(agent, agentStates) {
       try {
         const localHashes = {};
         for (const file of driftedFiles) {
-          localHashes[file] = hashFile(join19(agentDir, file));
+          localHashes[file] = hashFile(join20(agentDir, file));
         }
         await api.post("/host/drift", {
           agent_id: agent.agent_id,
@@ -9408,15 +10601,15 @@ async function processAgent(agent, agentStates) {
     const addedChannels = [...restartDecision.added];
     const writeDmNoticeMarkers = isChannelAddRestart ? () => {
       try {
-        const agentAugmentedDir = join19(homedir10(), ".augmented", agent.code_name);
-        mkdirSync7(agentAugmentedDir, { recursive: true });
+        const agentAugmentedDir = join20(homedir11(), ".augmented", agent.code_name);
+        mkdirSync8(agentAugmentedDir, { recursive: true });
         const markerJson = JSON.stringify({
           version: 1,
           at: (/* @__PURE__ */ new Date()).toISOString(),
           added: addedChannels
         });
         for (const file of ["slack-channel-add-restart.json", "telegram-channel-add-restart.json"]) {
-          atomicWriteFileSync(join19(agentAugmentedDir, file), markerJson);
+          atomicWriteFileSync(join20(agentAugmentedDir, file), markerJson);
         }
       } catch (err) {
         log(`[hot-reload] channel-add DM-notice marker write failed for '${agent.code_name}' (non-fatal): ${err.message}`);
@@ -9492,7 +10685,7 @@ async function processAgent(agent, agentStates) {
       const behaviourSubset = extractMsTeamsBehaviourSubset(
         msteamsEntry?.config
       );
-      const behaviourHash = createHash11("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
+      const behaviourHash = createHash12("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
       const prevBehaviourHash = agentState.knownMsTeamsBehaviourHashes.get(agent.agent_id);
       const behaviourDecision = decideSenderPolicyRestart({
         previousHash: prevBehaviourHash,
@@ -9545,7 +10738,7 @@ async function processAgent(agent, agentStates) {
       const slackBehaviourSubset = extractSlackBehaviourSubset(
         slackEntry?.config
       );
-      const slackBehaviourHash = createHash11("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
+      const slackBehaviourHash = createHash12("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
       const prevSlackBehaviourHash = agentState.knownSlackBehaviourHashes.get(agent.agent_id);
       const slackBehaviourDecision = decideSenderPolicyRestart({
         previousHash: prevSlackBehaviourHash,
@@ -9595,24 +10788,24 @@ async function processAgent(agent, agentStates) {
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? DEFAULT_FRAMEWORK) === "claude-code") {
     try {
       const agentProvisionDir = agentDir;
-      const projectDir = join19(homedir10(), ".augmented", agent.code_name, "project");
-      mkdirSync7(agentProvisionDir, { recursive: true });
-      mkdirSync7(projectDir, { recursive: true });
-      const provisionMcpPath = join19(agentProvisionDir, ".mcp.json");
-      const projectMcpPath = join19(projectDir, ".mcp.json");
+      const projectDir = join20(homedir11(), ".augmented", agent.code_name, "project");
+      mkdirSync8(agentProvisionDir, { recursive: true });
+      mkdirSync8(projectDir, { recursive: true });
+      const provisionMcpPath = join20(agentProvisionDir, ".mcp.json");
+      const projectMcpPath = join20(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
       try {
-        mcpConfig = JSON.parse(readFileSync16(provisionMcpPath, "utf-8"));
+        mcpConfig = JSON.parse(readFileSync17(provisionMcpPath, "utf-8"));
         if (!mcpConfig.mcpServers) mcpConfig.mcpServers = {};
       } catch {
       }
-      const localDirectChatChannel = join19(homedir10(), ".augmented", "_mcp", "direct-chat-channel.js");
+      const localDirectChatChannel = join20(homedir11(), ".augmented", "_mcp", "direct-chat-channel.js");
       const directChatTeamSettings = refreshData.team?.settings;
       const directChatTz = (() => {
         const tz = directChatTeamSettings?.["timezone"];
         return typeof tz === "string" && tz.trim() !== "" ? tz.trim() : void 0;
       })();
-      if (existsSync10(localDirectChatChannel)) {
+      if (existsSync11(localDirectChatChannel)) {
         const directChatEnv = {
           AGT_HOST: requireHost(),
           // ENG-5901 Track D: templated — the manager exports the real
@@ -9632,7 +10825,7 @@ async function processAgent(agent, agentStates) {
           // ~/.augmented/<codeName>/.current-turn-initiator.json. Note getAgentDir
           // returns the agent root (NOT the /provision subdir `agentDir` points at),
           // so it byte-matches the broker readers' path.
-          AGT_TURN_INITIATOR_FILE: join19(
+          AGT_TURN_INITIATOR_FILE: join20(
             frameworkAdapter.getAgentDir(agent.code_name),
             ".current-turn-initiator.json"
           )
@@ -9652,8 +10845,8 @@ async function processAgent(agent, agentStates) {
           log(`Channel credentials written for '${agent.code_name}/direct-chat'`);
         }
       }
-      const staleChannelsPath = join19(projectDir, ".mcp-channels.json");
-      if (existsSync10(staleChannelsPath)) {
+      const staleChannelsPath = join20(projectDir, ".mcp-channels.json");
+      if (existsSync11(staleChannelsPath)) {
         try {
           rmSync4(staleChannelsPath, { force: true });
         } catch {
@@ -9722,9 +10915,27 @@ async function processAgent(agent, agentStates) {
         log(`OAuth token refresh failed for '${agent.code_name}/${integration.definition_id}': ${err.message}`);
       }
     }
+    const anchorIntegration = integrations.find((i) => i.definition_id === "anchor-browser");
+    if (anchorIntegration) {
+      const profileName = anchorIntegration.config?.["profile_name"];
+      const apiKey = anchorIntegration.credentials?.["api_key"];
+      const sessionId = await anchorSessionLifecycle.ensure({
+        agentId: agent.agent_id,
+        profileName,
+        apiKey,
+        now: Date.now(),
+        log
+      });
+      const config2 = { ...anchorIntegration.config ?? {} };
+      if (sessionId) config2["session_id"] = sessionId;
+      else delete config2["session_id"];
+      anchorIntegration.config = config2;
+    } else {
+      anchorSessionLifecycle.forget(agent.agent_id, void 0, log);
+    }
     if (hostFlagStore().getBoolean("connectivity-probe")) {
       try {
-        const probeProjectDir = join19(homedir10(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join20(homedir11(), ".augmented", agent.code_name, "project");
         await runAgentConnectivityProbes(agent, integrations, probeProjectDir);
       } catch (err) {
         log(`Connectivity probe failed for '${agent.code_name}': ${err.message}`);
@@ -9735,7 +10946,7 @@ async function processAgent(agent, agentStates) {
       const forceDue = attemptsLeft > 0;
       let probeRan = false;
       try {
-        const probeProjectDir = join19(homedir10(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join20(homedir11(), ".augmented", agent.code_name, "project");
         probeRan = await runAgentSessionToolBindProbes(agent, integrations, probeProjectDir, { forceDue });
       } catch (err) {
         log(`Session-tool-bind probe failed for '${agent.code_name}': ${err.message}`);
@@ -9748,9 +10959,9 @@ async function processAgent(agent, agentStates) {
     }
     if (frameworkAdapter.removeMcpServer && frameworkAdapter.getMcpPath) {
       const mcpPath = frameworkAdapter.getMcpPath(agent.code_name);
-      if (mcpPath && existsSync10(mcpPath)) {
+      if (mcpPath && existsSync11(mcpPath)) {
         try {
-          const cfg = JSON.parse(readFileSync16(mcpPath, "utf-8"));
+          const cfg = JSON.parse(readFileSync17(mcpPath, "utf-8"));
           const expectedRemoteKeys = new Set(
             integrations.map((i) => i.definition_id)
           );
@@ -9775,11 +10986,11 @@ async function processAgent(agent, agentStates) {
         recordConfigChurnEvent(agent.agent_id, agent.code_name, FLAP_CHANNEL_INTEGRATIONS, intMembership);
       }
       if (intHash !== prevIntHash) {
-        const projectDir = join19(homedir10(), ".augmented", agent.code_name, "project");
-        const envIntPath = join19(projectDir, ".env.integrations");
+        const projectDir = join20(homedir11(), ".augmented", agent.code_name, "project");
+        const envIntPath = join20(projectDir, ".env.integrations");
         let preWriteEnv;
         try {
-          preWriteEnv = readFileSync16(envIntPath, "utf-8");
+          preWriteEnv = readFileSync17(envIntPath, "utf-8");
         } catch {
           preWriteEnv = void 0;
         }
@@ -9791,9 +11002,9 @@ async function processAgent(agent, agentStates) {
         let rotationHandled = true;
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
-            const projectMcpPath = join19(projectDir, ".mcp.json");
-            const postWriteEnv = readFileSync16(envIntPath, "utf-8");
-            const mcpContent = readFileSync16(projectMcpPath, "utf-8");
+            const projectMcpPath = join20(projectDir, ".mcp.json");
+            const postWriteEnv = readFileSync17(envIntPath, "utf-8");
+            const mcpContent = readFileSync17(projectMcpPath, "utf-8");
             const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
             const mcpJsonForReap = JSON.parse(mcpContent);
             const affectedServerKeys = findMcpServersUsingVars(mcpJsonForReap, changedVars);
@@ -9809,7 +11020,8 @@ async function processAgent(agent, agentStates) {
                 isolated: isolationMode(agent.code_name) === "docker"
               });
             }
-            const respawnVars = envOnlyRespawnVars(changedVars, mcpJsonForReap, CHANNEL_SECRET_ENV_KEYS);
+            const liveProxyVars = liveProxyExtraHeaderVars(mcpJsonForReap);
+            const respawnVars = envOnlyRespawnVars(changedVars, mcpJsonForReap, CHANNEL_SECRET_ENV_KEYS).filter((v) => !liveProxyVars.has(v));
             const envDiff = classifyEnvIntegrationsDiff(preWriteEnv, postWriteEnv);
             const rotatedOnlyVars = new Set(envDiff.rotated);
             const envRespawnReason = respawnVars.length > 0 && respawnVars.every((v) => rotatedOnlyVars.has(v)) ? "credential-rotation" : "hot-reload-mcp";
@@ -9869,10 +11081,10 @@ async function processAgent(agent, agentStates) {
           desiredEntries.push({ serverId, url, headers: mcpHeaders, name: tk.toolkit_name });
         }
         const hashBasis = desiredEntries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => {
-          const headersHash = createHash11("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
+          const headersHash = createHash12("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
           return `${e.serverId}|${e.url}|${headersHash}`;
         }).join("\n");
-        const mcpHash = createHash11("sha256").update(hashBasis).digest("hex").slice(0, 16);
+        const mcpHash = createHash12("sha256").update(hashBasis).digest("hex").slice(0, 16);
         const prevMcpHash = agentState.knownManagedMcpHashes.get(agent.agent_id);
         const structureHash = managedMcpStructureHash(desiredEntries);
         const prevStructureHash = agentState.knownManagedMcpStructure.get(agent.agent_id);
@@ -9887,15 +11099,15 @@ async function processAgent(agent, agentStates) {
         if (mcpHash !== prevMcpHash) {
           for (const e of desiredEntries) {
             frameworkAdapter.writeMcpServer(agent.code_name, e.serverId, { url: e.url, headers: e.headers });
-            const urlHash = createHash11("sha256").update(e.url).digest("hex").slice(0, 12);
+            const urlHash = createHash12("sha256").update(e.url).digest("hex").slice(0, 12);
             log(`[managed-toolkit] ${agent.code_name}: wrote '${e.name}' (serverId=${e.serverId}, url_hash=${urlHash})`);
           }
           if (frameworkAdapter.removeMcpServer && frameworkAdapter.getMcpPath) {
             const mcpPath = frameworkAdapter.getMcpPath(agent.code_name);
             if (mcpPath) {
               try {
-                const { readFileSync: readFileSync17 } = await import("fs");
-                const mcpConfig = JSON.parse(readFileSync17(mcpPath, "utf-8"));
+                const { readFileSync: readFileSync18 } = await import("fs");
+                const mcpConfig = JSON.parse(readFileSync18(mcpPath, "utf-8"));
                 if (mcpConfig.mcpServers) {
                   for (const key of Object.keys(mcpConfig.mcpServers)) {
                     if (isManagedMcpServerKey(key) && !expectedServerIds.has(key)) {
@@ -9996,7 +11208,7 @@ async function processAgent(agent, agentStates) {
     if (frameworkAdapter.installSkillFiles) {
       const currentIntegrationSkillIds = /* @__PURE__ */ new Set();
       const installedIntegrationSkills = [];
-      const { createHash: createHash12 } = await import("crypto");
+      const { createHash: createHash13 } = await import("crypto");
       const refreshAny = refreshData;
       const contexts = refreshAny.integration_contexts ?? refreshAny.plugin_contexts ?? [];
       const contextBySlug = /* @__PURE__ */ new Map();
@@ -10025,7 +11237,7 @@ async function processAgent(agent, agentStates) {
             )
           }));
           const bundle = buildIntegrationBundle(renderedScopes);
-          const contentHash = createHash12("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
+          const contentHash = createHash13("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
           const hashKey = `plugin-skill:${agent.agent_id}:${integrationSkillId}`;
           if (agentState.knownSkillHashes.get(hashKey) === contentHash) continue;
           frameworkAdapter.installSkillFiles(agent.code_name, integrationSkillId, bundle.files);
@@ -10038,18 +11250,18 @@ async function processAgent(agent, agentStates) {
       }
       try {
         const { readdirSync: readdirSync6, rmSync: rmSync5 } = await import("fs");
-        const { homedir: homedir11 } = await import("os");
+        const { homedir: homedir12 } = await import("os");
         const frameworkId2 = frameworkAdapter.id;
         const candidateSkillDirs = [
           // Claude Code — framework runtime tree
-          join19(homedir11(), ".augmented", agent.code_name, "skills"),
+          join20(homedir12(), ".augmented", agent.code_name, "skills"),
           // Claude Code — project tree
-          join19(homedir11(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+          join20(homedir12(), ".augmented", agent.code_name, "project", ".claude", "skills"),
           // Defensive: legacy provision-side path, not currently an
           // install target but cheap to sweep.
-          join19(agentDir, ".claude", "skills")
+          join20(agentDir, ".claude", "skills")
         ];
-        const existingDirs = candidateSkillDirs.filter((d) => existsSync10(d));
+        const existingDirs = candidateSkillDirs.filter((d) => existsSync11(d));
         const discoveredEntries = /* @__PURE__ */ new Set();
         for (const dir of existingDirs) {
           try {
@@ -10063,8 +11275,8 @@ async function processAgent(agent, agentStates) {
         }
         const removeSkillFolder = (entry, reason) => {
           for (const dir of existingDirs) {
-            const p = join19(dir, entry);
-            if (existsSync10(p)) {
+            const p = join20(dir, entry);
+            if (existsSync11(p)) {
               rmSync5(p, { recursive: true, force: true });
             }
           }
@@ -10083,7 +11295,7 @@ async function processAgent(agent, agentStates) {
         const sharedSkillsPayload = refreshAny.shared_skills;
         const desiredResolved = globalSkillsPayload !== void 0 || sharedSkillsPayload !== void 0;
         const manifestPath = managedSkillManifestPath(
-          join19(homedir10(), ".augmented", agent.code_name)
+          join20(homedir11(), ".augmented", agent.code_name)
         );
         const prevIds = /* @__PURE__ */ new Set([
           ...agentState.knownGlobalSkillIds.get(agent.agent_id) ?? /* @__PURE__ */ new Set(),
@@ -10092,7 +11304,7 @@ async function processAgent(agent, agentStates) {
         const plan = planGlobalSkillSync(
           [...globalSkillsPayload ?? [], ...sharedSkillsPayload ?? []],
           prevIds,
-          (content) => createHash12("sha256").update(content).digest("hex").slice(0, 12),
+          (content) => createHash13("sha256").update(content).digest("hex").slice(0, 12),
           (skillId) => agentState.knownSkillHashes.get(`global-skill:${agent.agent_id}:${skillId}`),
           { desiredResolved }
         );
@@ -10103,15 +11315,15 @@ async function processAgent(agent, agentStates) {
         }
         if (plan.removes.length) {
           const globalSkillDirs = [
-            join19(homedir10(), ".augmented", agent.code_name, "skills"),
-            join19(homedir10(), ".augmented", agent.code_name, "project", ".claude", "skills"),
-            join19(agentDir, ".claude", "skills")
+            join20(homedir11(), ".augmented", agent.code_name, "skills"),
+            join20(homedir11(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+            join20(agentDir, ".claude", "skills")
           ];
           for (const id of plan.removes) {
             let prunedAny = false;
             for (const dir of globalSkillDirs) {
-              const p = join19(dir, id);
-              if (existsSync10(p) && existsSync10(join19(p, "SKILL.md"))) {
+              const p = join20(dir, id);
+              if (existsSync11(p) && existsSync11(join20(p, "SKILL.md"))) {
                 rmSync4(p, { recursive: true, force: true });
                 prunedAny = true;
               }
@@ -10143,7 +11355,7 @@ async function processAgent(agent, agentStates) {
           const slug = hook.integration_slug ?? hook.plugin_slug;
           if (!slug) continue;
           try {
-            const scriptHash = createHash12("sha256").update(hook.script).digest("hex").slice(0, 12);
+            const scriptHash = createHash13("sha256").update(hook.script).digest("hex").slice(0, 12);
             const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${slug}:on_install`;
             if (agentState.knownSkillHashes.get(hookKey) === scriptHash) continue;
             const result = await frameworkAdapter.executePluginHook({
@@ -10158,9 +11370,9 @@ async function processAgent(agent, agentStates) {
             } else if (result.timedOut) {
               log(`Integration hook on_install '${slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
             } else {
-              const stderrHash = createHash12("sha256").update(result.stderr).digest("hex").slice(0, 12);
+              const stderrHash = createHash13("sha256").update(result.stderr).digest("hex").slice(0, 12);
               const missingCmd = result.exitCode === 127 ? extractCommandNotFound(result.stderr) : null;
-              const missingCmdHash = missingCmd ? createHash12("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
+              const missingCmdHash = missingCmd ? createHash13("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
               log(
                 `Integration hook on_install '${slug}' exited ${result.exitCode} for '${agent.code_name}' ` + (missingCmdHash ? `[missing_command_hash=${missingCmdHash}] ` : "") + `[stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
               );
@@ -10314,8 +11526,8 @@ async function processAgent(agent, agentStates) {
       const sess = getSessionState(agent.code_name);
       let mcpJsonParsed = null;
       try {
-        const mcpPath = join19(getProjectDir(agent.code_name), ".mcp.json");
-        mcpJsonParsed = JSON.parse(readFileSync16(mcpPath, "utf-8"));
+        const mcpPath = join20(getProjectDir(agent.code_name), ".mcp.json");
+        mcpJsonParsed = JSON.parse(readFileSync17(mcpPath, "utf-8"));
       } catch {
       }
       reapMissingMcpSessions({
@@ -10640,10 +11852,10 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
     }
   }
   const trackedFiles = frameworkAdapter.driftTrackedFiles();
-  if (trackedFiles.length > 0 && existsSync10(agentDir)) {
+  if (trackedFiles.length > 0 && existsSync11(agentDir)) {
     const hashes = /* @__PURE__ */ new Map();
     for (const file of trackedFiles) {
-      const h = hashFile(join19(agentDir, file));
+      const h = hashFile(join20(agentDir, file));
       if (h) hashes.set(file, h);
     }
     agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -10658,7 +11870,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
         refreshData.agent.onboarding_state
       );
       const obStep = obState.step;
-      const markerPath = join19(homedir10(), ".augmented", agent.code_name, "onboarding-drive.json");
+      const markerPath = join20(homedir11(), ".augmented", agent.code_name, "onboarding-drive.json");
       const marker = readOnboardingDriveMarker(markerPath);
       const decision = decideOnboardingDrive(obStep, marker, Date.now(), obState.generation ?? 0);
       if (decision.clearMarker) {
@@ -10719,11 +11931,55 @@ function deriveEgressAllowlist(toolsRaw) {
   );
 }
 var egressAllowlistEqual = (a, b) => a.length === b.length && a.every((d, i) => d === b[i]);
+async function ensureOpencodeRuntime(agent, refreshData, agentTimezone) {
+  const codeName = agent.code_name;
+  if (isOpencodeSessionHealthy(codeName)) {
+    await ensureOpencodeSlackIngest({ codeName, agentId: agent.agent_id, log });
+    return { decision: "healthy", spawnAttempted: false, sessionHealthyAfter: true };
+  }
+  stopOpencodeSlackIngest(codeName, log);
+  const opencodeProjectDir = join20(getFramework("opencode").getAgentDir(codeName), "project");
+  const openRouterRaw = refreshData.openrouter ?? null;
+  const serveEnv = {
+    AGT_HOST: requireHost(),
+    AGT_API_KEY: getApiKey() ?? void 0,
+    AGT_APP_URL: process.env["AGT_APP_URL"]
+  };
+  if (openRouterRaw?.auth_token) serveEnv["OPENROUTER_API_KEY"] = openRouterRaw.auth_token;
+  const session = await startOpencodeSession({
+    codeName,
+    agentId: agent.agent_id,
+    projectDir: opencodeProjectDir,
+    serveEnv,
+    agentTimezone,
+    // ADR-0047: the opencode container launcher is not built, so the launcher
+    // refuses to spawn under Docker isolation rather than run unisolated on a
+    // multi-tenant host. Single-agent / dedicated hosts (isolation off) run bare.
+    isolated: isolationMode(codeName) === "docker",
+    log
+  });
+  agentState.persistentSessionAgents.add(codeName);
+  if (session.status === "crashed") {
+    const tail = session.lastFailureTail ?? readOpencodePaneLogTail(codeName);
+    return {
+      decision: "spawn",
+      spawnAttempted: true,
+      sessionHealthyAfter: isOpencodeSessionHealthy(codeName),
+      detail: tail ? `opencode spawn failed: ${tail.slice(0, 200)}` : "opencode spawn failed"
+    };
+  }
+  return {
+    decision: "spawn",
+    spawnAttempted: true,
+    sessionHealthyAfter: isOpencodeSessionHealthy(codeName),
+    detail: `opencode serve on 127.0.0.1:${session.port ?? "?"}`
+  };
+}
 async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
   const projectDir = getProjectDir(codeName);
-  const mcpConfigPath = join19(projectDir, ".mcp.json");
-  const claudeMdPath = join19(projectDir, "CLAUDE.md");
+  const mcpConfigPath = join20(projectDir, ".mcp.json");
+  const claudeMdPath = join20(projectDir, "CLAUDE.md");
   if (restartBreaker.isTripped(codeName)) {
     const trip = restartBreaker.getTrip(codeName);
     return {
@@ -10745,6 +12001,10 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
     }
     return resolveAgentTimezone(ownTz, teamTz, orgTierTz);
   })();
+  const frameworkId = agentFrameworkCache.get(codeName) ?? DEFAULT_FRAMEWORK;
+  if (frameworkId === "opencode") {
+    return ensureOpencodeRuntime(agent, refreshData, agentTimezone ?? null);
+  }
   const channelConfigs = refreshData.channel_configs;
   const { devChannels, pluginChannels } = resolveChannelLaunchFlags(
     channelConfigs,
@@ -10877,7 +12137,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       const ctx = getLastFailureContext(codeName);
       const recovery = prepareForRespawn(codeName);
       const tailSummary = !ctx.tail ? "" : KNOWN_SAFE_TAIL_SIGNATURES.has(ctx.signature) ? `; last pane output (${PANE_TAIL_PREVIEW_LINES} of ~20 lines):
-${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash11("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
+${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash12("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
       const sigSummary = ctx.signature !== "unknown" ? `; signature=${ctx.signature}` : "";
       const recoverySummary = recovery ? `; recovery=${recovery}` : "";
       log(
@@ -10891,7 +12151,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash11("sha256")
       );
       getHostId().then((hostId) => {
         if (!hostId) return;
-        const paneTailHash = zombie.paneTail ? `sha256:${createHash11("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
+        const paneTailHash = zombie.paneTail ? `sha256:${createHash12("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
         return api.post("/host/events", {
           host_id: hostId,
           agent_code_name: codeName,
@@ -11040,7 +12300,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash11("sha256")
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
   }
-  const stableTasksHash = createHash11("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const stableTasksHash = createHash12("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (stableTasksHash !== prevHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
@@ -11257,7 +12517,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-VSSEZTY7.js");
+        const { collectDiagnostics } = await import("../persistent-session-ZQSAZIVM.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName])
@@ -11307,7 +12567,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-VSSEZTY7.js");
+      const { collectDiagnostics } = await import("../persistent-session-ZQSAZIVM.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName])
@@ -11528,6 +12788,46 @@ async function pollDirectChatMessages(agentStates) {
     }
   }
 }
+async function processDirectChatMessageOpencode(agent, msg) {
+  if (!isOpencodeSessionHealthy(agent.codeName)) {
+    log(`[direct-chat] opencode server not running for '${agent.codeName}' (msg=${msg.id}) \u2014 leaving for redelivery`);
+    return;
+  }
+  let result;
+  try {
+    result = await injectOpencodeMessage(agent.codeName, {
+      channelId: "direct-chat",
+      conversationKey: msg.session_id,
+      senderId: "webapp",
+      text: msg.content,
+      // Provenance parity with the Claude Code <channel> envelope: source +
+      // reply-expected, folded into the prompt by the bridge.
+      meta: { source: "direct-chat", user: "webapp", lane: "conversational", requires_reply: "true" }
+    });
+  } catch (err) {
+    log(`[direct-chat] opencode inject failed for '${agent.codeName}' (msg=${msg.id}): ${err.message} \u2014 leaving for redelivery`);
+    return;
+  }
+  if (result.status === "replied" && result.reply) {
+    try {
+      await api.post("/host/direct-chat/reply", {
+        agent_id: agent.agentId,
+        session_id: msg.session_id,
+        content: result.reply,
+        message_ids: [msg.id]
+      });
+      log(`[direct-chat] opencode replied for '${agent.codeName}' (msg=${msg.id}, ${result.reply.length} chars)`);
+    } catch (err) {
+      log(`[direct-chat] opencode reply POST failed for '${agent.codeName}' (msg=${msg.id}): ${err.message} \u2014 leaving for redelivery`);
+    }
+    return;
+  }
+  if (result.status === "declined") {
+    log(`[direct-chat] opencode gate declined message for '${agent.codeName}' (msg=${msg.id}): ${result.reason}`);
+    return;
+  }
+  log(`[direct-chat] opencode produced no reply for '${agent.codeName}' (msg=${msg.id}) \u2014 leaving for redelivery`);
+}
 async function processDirectChatMessage(agent, msg) {
   noteInbound(agent.codeName);
   const fw = agentFrameworkCache.get(agent.codeName) ?? DEFAULT_FRAMEWORK;
@@ -11544,12 +12844,16 @@ async function processDirectChatMessage(agent, msg) {
     }
     return;
   }
+  if (fw === "opencode") {
+    await processDirectChatMessageOpencode(agent, msg);
+    return;
+  }
   if (isSessionHealthy(agent.codeName)) {
     const useDoorbell = hostFlagStore().getBoolean("direct-chat-doorbell") || isolationMode(agent.codeName) === "docker";
     if (useDoorbell) {
       try {
-        const doorbell = directChatDoorbellPath(agent.agentId, homedir10());
-        mkdirSync7(dirname6(doorbell), { recursive: true });
+        const doorbell = directChatDoorbellPath(agent.agentId, homedir11());
+        mkdirSync8(dirname6(doorbell), { recursive: true });
         writeFileSync8(doorbell, String(Date.now()));
         log(`[direct-chat] Doorbell rung for '${agent.codeName}' (msg=${msg.id}) \u2014 in-session MCP will pull via the cursor`);
         return;
@@ -11637,8 +12941,8 @@ ${formatRunMarker(run_id)}` : KANBAN_CHECK_COMMAND;
   }
   if (run_id) openInjectedRunByCode.set(codeName, run_id);
   try {
-    const doorbell = directChatDoorbellPath(agentId, homedir10());
-    mkdirSync7(dirname6(doorbell), { recursive: true });
+    const doorbell = directChatDoorbellPath(agentId, homedir11());
+    mkdirSync8(dirname6(doorbell), { recursive: true });
     writeFileSync8(doorbell, String(Date.now()));
   } catch (err) {
     log(`[kanban] doorbell ring failed for '${codeName}': ${err.message} (notice still queued)`);
@@ -11731,7 +13035,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-PWVOBBX4.js");
+  } = await import("../claude-pair-runtime-DO6OWWGD.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -11766,12 +13070,12 @@ async function processClaudePairSessions(agents) {
     try {
       if (session.status === "initiating") {
         log(`[claude-pair] spawning pair session ${pairSession} for '${codeName}'`);
-        const spawn = await spawnPairSession(pairSession);
-        if (!spawn.ok) {
+        const spawn2 = await spawnPairSession(pairSession);
+        if (!spawn2.ok) {
           await reportAndCleanup(session.pair_id, {
             status: "failure",
-            error_code: spawn.error.kind,
-            error_message: spawn.error.kind === "unknown" ? spawn.error.message : void 0
+            error_code: spawn2.error.kind,
+            error_message: spawn2.error.kind === "unknown" ? spawn2.error.message : void 0
           });
           continue;
         }
@@ -11974,8 +13278,8 @@ function parseMemoryFile(raw, fallbackName) {
   };
 }
 async function syncMemories(agent, configDir, log2) {
-  const projectDir = join19(configDir, agent.code_name, "project");
-  const memoryDir = join19(projectDir, "memory");
+  const projectDir = join20(configDir, agent.code_name, "project");
+  const memoryDir = join20(projectDir, "memory");
   const isFreshSync = pendingFreshMemorySync.has(agent.agent_id);
   if (isFreshSync) {
     log2(`[memory-sync] Fresh-sync requested for '${agent.code_name}' \u2014 pulling DB first`);
@@ -11986,15 +13290,15 @@ async function syncMemories(agent, configDir, log2) {
     }
     pendingFreshMemorySync.delete(agent.agent_id);
   }
-  if (existsSync10(memoryDir)) {
+  if (existsSync11(memoryDir)) {
     const prevHashes = memoryFileHashes.get(agent.agent_id) ?? /* @__PURE__ */ new Map();
     const currentHashes = /* @__PURE__ */ new Map();
     const changedMemories = [];
     for (const file of readdirSync5(memoryDir)) {
       if (!file.endsWith(".md")) continue;
       try {
-        const raw = readFileSync16(join19(memoryDir, file), "utf-8");
-        const fileHash = createHash11("sha256").update(raw).digest("hex").slice(0, 16);
+        const raw = readFileSync17(join20(memoryDir, file), "utf-8");
+        const fileHash = createHash12("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
         const parsed = parseMemoryFile(raw, file.replace(/\.md$/, ""));
@@ -12018,7 +13322,7 @@ async function syncMemories(agent, configDir, log2) {
       } catch (err) {
         for (const mem of changedMemories) {
           for (const [file] of currentHashes) {
-            const parsed = parseMemoryFile(readFileSync16(join19(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
+            const parsed = parseMemoryFile(readFileSync17(join20(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
             if (parsed?.name === mem.name) currentHashes.delete(file);
           }
         }
@@ -12031,29 +13335,29 @@ async function syncMemories(agent, configDir, log2) {
   }
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
-  const localFiles = existsSync10(memoryDir) ? readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
-  const localListHash = createHash11("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
+  const localFiles = existsSync11(memoryDir) ? readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
+  const localListHash = createHash12("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
   try {
     const dbMemories = await api.post("/host/memories", {
       agent_id: agent.agent_id
     });
-    const responseHash = createHash11("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
+    const responseHash = createHash12("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
     if (!force && prevDownload && prevLocalHash === localListHash && lastDownloadHash.get(agent.agent_id) === responseHash) {
       return true;
     }
     lastDownloadHash.set(agent.agent_id, responseHash);
     lastLocalFileHash.set(agent.agent_id, localListHash);
     if (dbMemories.memories?.length) {
-      mkdirSync7(memoryDir, { recursive: true });
+      mkdirSync8(memoryDir, { recursive: true });
       let written = 0;
       let overwritten = 0;
       for (let i = 0; i < dbMemories.memories.length; i++) {
         const mem = dbMemories.memories[i];
         const rawSlug = mem.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "").slice(0, 60);
         const slug = rawSlug || `memory-${i}`;
-        const filePath = join19(memoryDir, `${slug}.md`);
+        const filePath = join20(memoryDir, `${slug}.md`);
         const desired = `---
 name: ${JSON.stringify(mem.name)}
 type: ${mem.type}
@@ -12062,10 +13366,10 @@ description: ${JSON.stringify(mem.content.slice(0, 200))}
 
 ${mem.content}
 `;
-        if (existsSync10(filePath)) {
+        if (existsSync11(filePath)) {
           let existing = "";
           try {
-            existing = readFileSync16(filePath, "utf-8");
+            existing = readFileSync17(filePath, "utf-8");
           } catch {
           }
           if (existing === desired) continue;
@@ -12078,7 +13382,7 @@ ${mem.content}
       }
       if (written > 0 || overwritten > 0) {
         const updatedFiles = readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort();
-        lastLocalFileHash.set(agent.agent_id, createHash11("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
+        lastLocalFileHash.set(agent.agent_id, createHash12("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
         log2(`Memory download for '${agent.code_name}': wrote ${written} new, overwrote ${overwritten} stale`);
       }
     }
@@ -12089,7 +13393,7 @@ ${mem.content}
   }
 }
 async function cleanupAgentFiles(codeName, agentDir) {
-  if (existsSync10(agentDir)) {
+  if (existsSync11(agentDir)) {
     try {
       rmSync4(agentDir, { recursive: true, force: true });
       log(`Removed provision directory for '${codeName}'`);
@@ -12113,8 +13417,8 @@ var caffeinateProc = null;
 async function startCaffeinate() {
   if (process.platform !== "darwin") return;
   try {
-    const { spawn } = await import("child_process");
-    caffeinateProc = spawn("caffeinate", ["-dims"], {
+    const { spawn: spawn2 } = await import("child_process");
+    caffeinateProc = spawn2("caffeinate", ["-dims"], {
       stdio: "ignore",
       detached: false
     });
@@ -12261,8 +13565,8 @@ async function killAllAgtTmuxSessions() {
       ["list-sessions", "-F", "#{session_name}"],
       { timeout: 2e3, stdin: "ignore" }
     );
-    const sessions = output.trim().split("\n").filter((s) => s.startsWith("agt-"));
-    for (const session of sessions) {
+    const sessions2 = output.trim().split("\n").filter((s) => s.startsWith("agt-"));
+    for (const session of sessions2) {
       try {
         await execFilePromiseLong("tmux", ["kill-session", "-t", session], {
           timeout: 2e3,
@@ -12272,8 +13576,8 @@ async function killAllAgtTmuxSessions() {
       } catch {
       }
     }
-    if (sessions.length > 0) {
-      log(`Cleaned up ${sessions.length} agt-* tmux session(s)`);
+    if (sessions2.length > 0) {
+      log(`Cleaned up ${sessions2.length} agt-* tmux session(s)`);
     }
   } catch {
   }
@@ -12309,6 +13613,7 @@ async function stopPolling(opts = {}) {
   const subsysStartedAt = Date.now();
   stopCaffeinate();
   stopRealtimeChat();
+  stopAllOpencodeSlackIngests(log);
   log(formatDrainShutdownLine({ step: "stop-subsystems", elapsedMs: Date.now() - subsysStartedAt }));
   for (const codeName of [...scheduledRunsByCode.keys()]) {
     closeScheduledRunsForCode(codeName, "cancelled", "manager shutdown");
@@ -12323,8 +13628,8 @@ function startManager(opts) {
   config = opts;
   try {
     const stateFile = getStateFile();
-    if (existsSync10(stateFile)) {
-      const raw = readFileSync16(stateFile, "utf-8");
+    if (existsSync11(stateFile)) {
+      const raw = readFileSync17(stateFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.agents)) {
         state6.agents = parsed.agents;
@@ -12351,7 +13656,7 @@ function startManager(opts) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);
   }
   log(
-    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join19(homedir10(), ".augmented", "manager.log")}`
+    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join20(homedir11(), ".augmented", "manager.log")}`
   );
   deployMcpAssets();
   reapOrphanChannelMcps({ log });
@@ -12372,7 +13677,7 @@ async function reapOrphanedClaudePids() {
   const looksLikeClaude = (pid) => {
     if (process.platform !== "linux") return true;
     try {
-      const comm = readFileSync16(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
+      const comm = readFileSync17(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
       return comm.includes("claude");
     } catch {
       return false;
@@ -12390,16 +13695,16 @@ async function reapOrphanedClaudePids() {
     },
     looksLikeClaude
   );
-  for (const spawn of decision.toKill) {
+  for (const spawn2 of decision.toKill) {
     try {
-      process.kill(spawn.pid, "SIGKILL");
+      process.kill(spawn2.pid, "SIGKILL");
     } catch (err) {
-      log(`[drain] reaper SIGKILL pid=${spawn.pid} failed: ${err.message}`);
+      log(`[drain] reaper SIGKILL pid=${spawn2.pid} failed: ${err.message}`);
     }
   }
-  for (const spawn of decision.pidReusedSkipped) {
+  for (const spawn2 of decision.pidReusedSkipped) {
     log(
-      `[drain] reaper skipped pid=${spawn.pid} \u2014 PID reuse suspected (identity probe rejected)`
+      `[drain] reaper skipped pid=${spawn2.pid} \u2014 PID reuse suspected (identity probe rejected)`
     );
   }
   log(formatReaperBootLine({
@@ -12469,14 +13774,14 @@ function restartRunningChannelMcps(basenames) {
   }
 }
 function deployMcpAssets() {
-  const targetDir = join19(homedir10(), ".augmented", "_mcp");
-  mkdirSync7(targetDir, { recursive: true });
+  const targetDir = join20(homedir11(), ".augmented", "_mcp");
+  mkdirSync8(targetDir, { recursive: true });
   const moduleDir = dirname6(fileURLToPath(import.meta.url));
   let mcpSourceDir = "";
   let dir = moduleDir;
   for (let i = 0; i < 6; i++) {
-    const candidate = join19(dir, "dist", "mcp");
-    if (existsSync10(join19(candidate, "index.js"))) {
+    const candidate = join20(dir, "dist", "mcp");
+    if (existsSync11(join20(candidate, "index.js"))) {
       mcpSourceDir = candidate;
       break;
     }
@@ -12491,8 +13796,8 @@ function deployMcpAssets() {
   const changedBasenames = [];
   const fileHash = (p) => {
     try {
-      if (!existsSync10(p)) return null;
-      return createHash11("sha256").update(readFileSync16(p)).digest("hex");
+      if (!existsSync11(p)) return null;
+      return createHash12("sha256").update(readFileSync17(p)).digest("hex");
     } catch {
       return null;
     }
@@ -12556,9 +13861,9 @@ function deployMcpAssets() {
     // needs restarting to pick up a token rotation.
     "xero.js"
   ]) {
-    const src = join19(mcpSourceDir, file);
-    const dst = join19(targetDir, file);
-    if (!existsSync10(src)) continue;
+    const src = join20(mcpSourceDir, file);
+    const dst = join20(targetDir, file);
+    if (!existsSync11(src)) continue;
     const before = fileHash(dst);
     try {
       copyFileSync(src, dst);
@@ -12575,16 +13880,16 @@ function deployMcpAssets() {
     log(`[manager] Bundle(s) updated: ${changedBasenames.join(", ")} \u2014 signalling running instances to restart`);
     restartRunningChannelMcps(changedBasenames);
   }
-  const localMcpPath = join19(targetDir, "index.js");
+  const localMcpPath = join20(targetDir, "index.js");
   try {
-    const agentsDir = join19(homedir10(), ".augmented", "agents");
-    if (existsSync10(agentsDir)) {
+    const agentsDir = join20(homedir11(), ".augmented", "agents");
+    if (existsSync11(agentsDir)) {
       for (const entry of readdirSync5(agentsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         for (const subdir of ["provision", "project"]) {
-          const mcpJsonPath = join19(agentsDir, entry.name, subdir, ".mcp.json");
+          const mcpJsonPath = join20(agentsDir, entry.name, subdir, ".mcp.json");
           try {
-            const raw = readFileSync16(mcpJsonPath, "utf-8");
+            const raw = readFileSync17(mcpJsonPath, "utf-8");
             if (!raw.includes("@integrity-labs/augmented-mcp")) continue;
             const mcpConfig = JSON.parse(raw);
             const augServer = mcpConfig.mcpServers?.["augmented"];