@integrity-labs/agt-cli 0.28.343 → 0.28.345

package/dist/lib/manager-worker.js

@@ -46,7 +46,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-GAYSFNTX.js";
+} from "../chunk-GJ5TGARW.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -66,6 +66,7 @@ import {
   SCHEDULED_TURN_MARKER_FILENAME,
   SUPPRESS_SENTINEL,
   StreamEncoder,
+  USAGE_LIMIT_MARKER_FILENAME,
   appendDmFooter,
   attributeTranscriptUsageByRun,
   buildEgressAllowlist,
@@ -125,6 +126,7 @@ import {
   restartEgressSidecar,
   rotateSessionForWedge,
   sendToAgent,
+  serializeUsageLimitMarker,
   sessionTranscriptDir,
   startPersistentSession,
   stopAllSessionsAndWait,
@@ -135,17 +137,17 @@ import {
   takeZombieDetection,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-7OBFGSQS.js";
+} from "../chunk-O5IINJDB.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
 
 // src/lib/manager-worker.ts
-import { createHash as createHash13 } from "crypto";
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync9, mkdirSync as mkdirSync8, existsSync as existsSync12, rmSync as rmSync4, readdirSync as readdirSync5, statSync as statSync4, copyFileSync } from "fs";
+import { createHash as createHash14 } from "crypto";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync11, mkdirSync as mkdirSync10, existsSync as existsSync13, rmSync as rmSync5, readdirSync as readdirSync5, statSync as statSync4, copyFileSync } from "fs";
 import { execFileSync as syncExecFile } from "child_process";
-import { join as join21, dirname as dirname6 } from "path";
-import { homedir as homedir11 } from "os";
+import { join as join23, dirname as dirname6 } from "path";
+import { homedir as homedir12 } from "os";
 import { fileURLToPath } from "url";
 
 // src/lib/claude-code-upgrade-throttle.ts
@@ -1860,6 +1862,22 @@ var nodeArtifactFs = {
 };
 
 // src/lib/usage-banner-monitor.ts
+import { mkdirSync as mkdirSync4, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join5 } from "path";
+function syncUsageLimitMarker(args) {
+  const path = join5(homedir3(), ".augmented", args.codeName, USAGE_LIMIT_MARKER_FILENAME);
+  try {
+    if (args.pct >= 100) {
+      mkdirSync4(join5(homedir3(), ".augmented", args.codeName), { recursive: true });
+      writeFileSync4(path, serializeUsageLimitMarker(args.weekResetsAt), "utf-8");
+    } else {
+      rmSync2(path, { force: true });
+    }
+  } catch (err) {
+    args.log(`[usage-banner] usage-limit marker sync failed for '${args.codeName}': ${err.message}`);
+  }
+}
 var MIN_CHECK_INTERVAL_MS = 6e4;
 var PANE_TAIL_LINES_FOR_BANNER = 5e3;
 var state = /* @__PURE__ */ new Map();
@@ -1892,6 +1910,12 @@ async function maybeReportUsageBanner(args) {
     state.set(codeName, next);
     return;
   }
+  syncUsageLimitMarker({
+    codeName,
+    pct: observation.pct,
+    weekResetsAt: observation.weekResetsAt,
+    log: log2
+  });
   const observedAtIso = next.lastWeekResetsAt;
   const weekResetsAtIso = observation.weekResetsAt.toISOString();
   if (existing && existing.lastPct === observation.pct && observedAtIso === weekResetsAtIso) {
@@ -1916,7 +1940,7 @@ async function maybeReportUsageBanner(args) {
 
 // src/lib/token-usage-monitor.ts
 import { readdirSync, readFileSync as readFileSync6, statSync } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var MIN_CHECK_INTERVAL_MS2 = 6e4;
 var TRANSCRIPT_MTIME_WINDOW_MS = 2 * 24 * 60 * 60 * 1e3;
 var MAX_ENTRIES_PER_POST = 200;
@@ -1945,7 +1969,7 @@ async function maybeReportTokenUsage(args) {
     if (!name.endsWith(".jsonl")) continue;
     const sessionId = name.slice(0, -".jsonl".length);
     if (!sessionId) continue;
-    const path = join5(dir, name);
+    const path = join6(dir, name);
     let st;
     try {
       st = statSync(path);
@@ -2043,7 +2067,7 @@ async function maybeReportTokenUsage(args) {
 
 // src/lib/workflow-run-reconciler.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var MIN_CHECK_INTERVAL_MS3 = 5 * 6e4;
 var SETTLE_MS = 3e4;
 var TRANSCRIPT_MTIME_WINDOW_MS2 = 2 * 24 * 60 * 60 * 1e3;
@@ -2062,7 +2086,7 @@ function collectJsonlRecursive(dir, minMtimeMs, out, depth) {
     return;
   }
   for (const name of entries) {
-    const p = join6(dir, name);
+    const p = join7(dir, name);
     let st;
     try {
       st = statSync2(p);
@@ -2085,7 +2109,7 @@ function enumerateTranscriptFiles(transcriptDir, nowMs, minMtimeMs = nowMs - TRA
     return out;
   }
   for (const name of entries) {
-    const path = join6(transcriptDir, name);
+    const path = join7(transcriptDir, name);
     let st;
     try {
       st = statSync2(path);
@@ -2097,7 +2121,7 @@ function enumerateTranscriptFiles(transcriptDir, nowMs, minMtimeMs = nowMs - TRA
       continue;
     }
     if (st.isDirectory()) {
-      collectJsonlRecursive(join6(path, "subagents"), minMtimeMs, out, 0);
+      collectJsonlRecursive(join7(path, "subagents"), minMtimeMs, out, 0);
     }
   }
   return out;
@@ -2188,7 +2212,7 @@ async function maybeReconcileWorkflowRunTokens(args) {
 
 // src/lib/conversation-evaluator.ts
 import { readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync3 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var MIN_CHECK_INTERVAL_MS4 = 5 * 6e4;
 var TRANSCRIPT_MTIME_WINDOW_MS3 = 7 * 24 * 60 * 60 * 1e3;
 var WINDOW_PAD_MS = 5 * 6e4;
@@ -2624,7 +2648,7 @@ function readRecentTurns(dir, nowMs) {
       return;
     }
     for (const ent of entries) {
-      const full = join7(d, ent.name);
+      const full = join8(d, ent.name);
       if (ent.isDirectory()) {
         visit(full);
         continue;
@@ -2930,10 +2954,10 @@ async function reportSkip2(api2, agentId, conversationId, log2, codeName) {
 
 // src/lib/activity-cache-monitor.ts
 import { existsSync as existsSync2, readFileSync as readFileSync9 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join9 } from "path";
 var MIN_CHECK_INTERVAL_MS6 = 6e4;
-var STATS_CACHE_PATH = join8(homedir3(), ".claude", "stats-cache.json");
+var STATS_CACHE_PATH = join9(homedir4(), ".claude", "stats-cache.json");
 var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 var state5 = { lastObservedDate: null, lastCheckedAt: 0 };
 function selectNewDailyRows(raw, lastObservedDate) {
@@ -3167,8 +3191,8 @@ function bundleFingerprint(files) {
 
 // src/lib/claude-auth-detect.ts
 import { readFile as readFile2, readdir as readdir2 } from "fs/promises";
-import { homedir as homedir4, platform } from "os";
-import { join as join9 } from "path";
+import { homedir as homedir5, platform } from "os";
+import { join as join10 } from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
@@ -3183,8 +3207,8 @@ async function detectClaudeAuth() {
 }
 async function findClaudeCredentialsPaths() {
   const candidates = [
-    join9(homedir4(), ".claude", ".credentials.json"),
-    join9(homedir4(), ".claude", "credentials.json")
+    join10(homedir5(), ".claude", ".credentials.json"),
+    join10(homedir5(), ".claude", "credentials.json")
   ];
   const isLinuxRoot = platform() === "linux" && typeof process.getuid === "function" && process.getuid() === 0;
   if (isLinuxRoot) {
@@ -3192,8 +3216,8 @@ async function findClaudeCredentialsPaths() {
       const entries = await readdir2("/home", { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        candidates.push(join9("/home", entry.name, ".claude", ".credentials.json"));
-        candidates.push(join9("/home", entry.name, ".claude", "credentials.json"));
+        candidates.push(join10("/home", entry.name, ".claude", ".credentials.json"));
+        candidates.push(join10("/home", entry.name, ".claude", "credentials.json"));
       }
     } catch {
     }
@@ -3289,11 +3313,11 @@ function computeChannelConfigHash(input) {
 }
 
 // src/lib/channel-hash-cache.ts
-import { existsSync as existsSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { join as join11 } from "path";
 var CACHE_FILENAME = "channel-hash-cache.json";
 function getChannelHashCacheFile(configDir) {
-  return join10(configDir, CACHE_FILENAME);
+  return join11(configDir, CACHE_FILENAME);
 }
 function loadChannelHashCache(target, configDir) {
   const path = getChannelHashCacheFile(configDir);
@@ -3314,14 +3338,14 @@ function saveChannelHashCache(source, configDir) {
   const obj = {};
   for (const [key, value] of source) obj[key] = value;
   try {
-    writeFileSync4(path, JSON.stringify(obj, null, 2));
+    writeFileSync5(path, JSON.stringify(obj, null, 2));
   } catch {
   }
 }
 
 // src/lib/sender-policy-baseline.ts
 import { existsSync as existsSync4, readFileSync as readFileSync11 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 var BASELINE_FILENAME = "sender-policy-baseline.json";
 var SENDER_POLICY_BASELINE_VERSION = 1;
 var BASELINE_CONCERNS = ["senderPolicy", "slackBehaviour", "msteamsBehaviour"];
@@ -3333,7 +3357,7 @@ function createDeliveryBaselineMaps() {
   };
 }
 function getSenderPolicyBaselineFile(configDir) {
-  return join11(configDir, BASELINE_FILENAME);
+  return join12(configDir, BASELINE_FILENAME);
 }
 function loadSenderPolicyBaseline(target, configDir, log2) {
   const path = getSenderPolicyBaselineFile(configDir);
@@ -3827,11 +3851,11 @@ function planGlobalSkillSync(globalSkills, prevIds, hashOf, knownHash, options)
 }
 
 // src/lib/manager/managed-skill-manifest.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join12 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname4, join as join13 } from "path";
 var MANIFEST_VERSION = 1;
 function managedSkillManifestPath(agentRootDir) {
-  return join12(agentRootDir, "managed-skills.json");
+  return join13(agentRootDir, "managed-skills.json");
 }
 function readManagedSkillManifest(path) {
   try {
@@ -3845,21 +3869,21 @@ function readManagedSkillManifest(path) {
 }
 function writeManagedSkillManifest(path, ids) {
   try {
-    mkdirSync4(dirname4(path), { recursive: true });
+    mkdirSync5(dirname4(path), { recursive: true });
     const body = {
       version: MANIFEST_VERSION,
       globalSkillIds: [...ids].sort()
     };
-    writeFileSync5(path, JSON.stringify(body, null, 2));
+    writeFileSync6(path, JSON.stringify(body, null, 2));
   } catch {
   }
 }
 
 // src/lib/manager/runtime.ts
 import { createHash as createHash6 } from "crypto";
-import { readFileSync as readFileSync13, appendFileSync, mkdirSync as mkdirSync5, chmodSync, existsSync as existsSync6 } from "fs";
-import { join as join13, dirname as dirname5 } from "path";
-import { homedir as homedir5 } from "os";
+import { readFileSync as readFileSync13, appendFileSync, mkdirSync as mkdirSync6, chmodSync, existsSync as existsSync6 } from "fs";
+import { join as join14, dirname as dirname5 } from "path";
+import { homedir as homedir6 } from "os";
 function redactForDiskLog(value) {
   try {
     return value.replace(/\b(Bearer\s+)[A-Za-z0-9._-]+\b/gi, "$1[REDACTED]").replace(/\bxox[baprs]-[A-Za-z0-9-]+\b/g, "[REDACTED-SLACK]").replace(/\btlk_[A-Za-z0-9._-]+\b/g, "[REDACTED-HOST]").replace(/\bsk-ant-[A-Za-z0-9_-]+\b/g, "[REDACTED-ANTHROPIC]").replace(/\b\d{8,12}:[A-Za-z0-9_-]{30,}\b/g, "[REDACTED-TELEGRAM]").replace(
@@ -3879,8 +3903,8 @@ function log(msg) {
 `;
   if (!managerLogPath) {
     try {
-      managerLogPath = join13(homedir5(), ".augmented", "manager.log");
-      mkdirSync5(dirname5(managerLogPath), { recursive: true });
+      managerLogPath = join14(homedir6(), ".augmented", "manager.log");
+      mkdirSync6(dirname5(managerLogPath), { recursive: true });
       if (existsSync6(managerLogPath)) {
         chmodSync(managerLogPath, 384);
       }
@@ -4067,9 +4091,9 @@ function resolveModelChain(refreshData) {
 }
 
 // src/lib/manager/claude-auth.ts
-import { existsSync as existsSync7, rmSync as rmSync2 } from "fs";
-import { join as join14 } from "path";
-import { homedir as homedir6 } from "os";
+import { existsSync as existsSync7, rmSync as rmSync3 } from "fs";
+import { join as join15 } from "path";
+import { homedir as homedir7 } from "os";
 async function applyClaudeAuthToEnv(childEnv, label) {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -4081,12 +4105,12 @@ async function applyClaudeAuthToEnv(childEnv, label) {
       throw new Error("claude_auth_mode=api_key but /host/exchange returned no decrypted key");
     }
     childEnv.ANTHROPIC_API_KEY = exchange.anthropicApiKey;
-    const claudeDir = join14(homedir6(), ".claude");
+    const claudeDir = join15(homedir7(), ".claude");
     for (const filename of [".credentials.json", "credentials.json"]) {
-      const p = join14(claudeDir, filename);
+      const p = join15(claudeDir, filename);
       if (existsSync7(p)) {
         try {
-          rmSync2(p, { force: true });
+          rmSync3(p, { force: true });
           log(`[${label}] Removed ${p} (api_key mode \u2014 preventing OAuth fallback)`);
         } catch {
         }
@@ -4099,7 +4123,7 @@ async function applyClaudeAuthToEnv(childEnv, label) {
 
 // src/lib/manager/kanban/parsers.ts
 import { existsSync as existsSync8, readFileSync as readFileSync14 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var STANDUP_TEMPLATES = /* @__PURE__ */ new Set(["daily-standup", "end-of-day-summary"]);
 var TASK_UPDATE_TEMPLATES = /* @__PURE__ */ new Set(["hourly-status", "task-update"]);
 var PLAN_TEMPLATES = /* @__PURE__ */ new Set(["morning-plan"]);
@@ -4235,8 +4259,8 @@ function getBuiltInSkillContent(skillId) {
   if (builtInSkillCache.has(skillId)) return builtInSkillCache.get(skillId);
   try {
     const candidates = [
-      join15(process.cwd(), "skills", skillId, "SKILL.md"),
-      join15(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "..", "..", "skills", skillId, "SKILL.md")
+      join16(process.cwd(), "skills", skillId, "SKILL.md"),
+      join16(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "..", "..", "skills", skillId, "SKILL.md")
     ];
     for (const candidate of candidates) {
       if (existsSync8(candidate)) {
@@ -4381,12 +4405,12 @@ function formatBoardForPrompt(items, template) {
 }
 
 // src/lib/manager/kanban/nudge-state-cache.ts
-import { existsSync as existsSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync6 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
+import { join as join17 } from "path";
 var CACHE_FILENAME2 = "kanban-nudge-state.json";
 var KANBAN_NUDGE_STATE_VERSION = 1;
 function getKanbanNudgeStateFile(configDir) {
-  return join16(configDir, CACHE_FILENAME2);
+  return join17(configDir, CACHE_FILENAME2);
 }
 function loadKanbanNudgeState(target, configDir) {
   const path = getKanbanNudgeStateFile(configDir);
@@ -4418,7 +4442,7 @@ function saveKanbanNudgeState(source, configDir) {
   const agents = {};
   for (const [codeName, state7] of source) agents[codeName] = state7;
   try {
-    writeFileSync6(path, JSON.stringify({ version: KANBAN_NUDGE_STATE_VERSION, agents }, null, 2));
+    writeFileSync7(path, JSON.stringify({ version: KANBAN_NUDGE_STATE_VERSION, agents }, null, 2));
   } catch {
   }
 }
@@ -4959,9 +4983,9 @@ function closeScheduledRunsForCode(codeName, outcome, reason) {
 
 // src/lib/manager/scheduler/kanban-route.ts
 import { createHash as createHash9 } from "crypto";
-import { writeFileSync as writeFileSync7, renameSync } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join17 } from "path";
+import { writeFileSync as writeFileSync8, renameSync } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join18 } from "path";
 
 // src/lib/manager/delivery/scheduled-output.ts
 async function deliverScheduledTaskOutput(agentCodeName, agentId, rawTarget, body, taskId) {
@@ -5265,10 +5289,10 @@ function resolveScheduledSlackTarget(task) {
 }
 function stampScheduledTurnMarker(codeName, taskId, target) {
   try {
-    const file = join17(homedir7(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
+    const file = join18(homedir8(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
     const marker = { ts: Date.now(), task_id: taskId, ...target ? { target } : {} };
     const tmp = `${file}.tmp`;
-    writeFileSync7(tmp, JSON.stringify(marker), "utf8");
+    writeFileSync8(tmp, JSON.stringify(marker), "utf8");
     renameSync(tmp, file);
   } catch (err) {
     log(`[scheduled-kanban] scheduled-turn marker write failed for '${codeName}': ${err.message}`);
@@ -5451,10 +5475,10 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
 
 // src/lib/manager/scheduler/execution.ts
 import { createHash as createHash10 } from "crypto";
-import { homedir as homedir8 } from "os";
-import { join as join18 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join19 } from "path";
 function claudePidFilePath() {
-  return join18(homedir8(), ".augmented", "manager-claude-pids.json");
+  return join19(homedir9(), ".augmented", "manager-claude-pids.json");
 }
 var inFlightClaudePids = /* @__PURE__ */ new Map();
 function registerClaudeSpawn(record) {
@@ -5518,9 +5542,9 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
 import { spawn, execSync } from "child_process";
 import { createServer } from "net";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync16 } from "fs";
-import { homedir as homedir9, userInfo } from "os";
-import { join as join19 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync16 } from "fs";
+import { homedir as homedir10, userInfo } from "os";
+import { join as join20 } from "path";
 var OPENCODE_BIN = process.env["AGT_OPENCODE_BIN"]?.trim() || "opencode";
 var sessions = /* @__PURE__ */ new Map();
 var bridges = /* @__PURE__ */ new Map();
@@ -5528,7 +5552,7 @@ function opencodeTmuxSession(codeName) {
   return `agt-oc-${codeName}`;
 }
 function opencodePaneLogPath(codeName) {
-  return join19(homedir9(), ".augmented", codeName, "opencode-serve.log");
+  return join20(homedir10(), ".augmented", codeName, "opencode-serve.log");
 }
 function baseUrlFor(port) {
   return `http://127.0.0.1:${port}`;
@@ -5595,7 +5619,7 @@ async function startOpencodeSession(config2) {
 }
 async function spawnServe(config2, session) {
   const { codeName, projectDir, log: log2 } = config2;
-  if (!existsSync10(join19(projectDir, "opencode.json"))) {
+  if (!existsSync10(join20(projectDir, "opencode.json"))) {
     log2(`[opencode-session] warning: no opencode.json in ${projectDir} for '${codeName}' (provisioning may not have run)`);
   }
   const tmuxSession = opencodeTmuxSession(codeName);
@@ -5605,12 +5629,13 @@ async function spawnServe(config2, session) {
     execSync(`tmux kill-session -t ${tmuxSession} 2>/dev/null`, { stdio: "ignore" });
   } catch {
   }
-  mkdirSync6(join19(homedir9(), ".augmented", codeName), { recursive: true });
+  mkdirSync7(join20(homedir10(), ".augmented", codeName), { recursive: true });
   const serveEnv = {
     ...process.env,
+    ...readAgentProviderEnv(codeName),
     ...stripUndefined(config2.serveEnv ?? {}),
     OPENCODE_SERVER_PASSWORD: password,
-    HOME: process.env.HOME?.trim() || homedir9(),
+    HOME: process.env.HOME?.trim() || homedir10(),
     USER: process.env.USER?.trim() || userInfo().username
   };
   if (config2.runId) serveEnv["AGT_RUN_ID"] = config2.runId;
@@ -5694,6 +5719,29 @@ function stripUndefined(env) {
   for (const [k, v] of Object.entries(env)) if (v !== void 0) out[k] = v;
   return out;
 }
+var PROVIDER_KEY_RE = /^[A-Z][A-Z0-9_]*_API_KEY$/;
+function readAgentProviderEnv(codeName, dir) {
+  const file = join20(dir ?? join20(homedir10(), ".augmented", codeName), ".env");
+  const out = {};
+  try {
+    if (!existsSync10(file)) return out;
+    for (const raw of readFileSync16(file, "utf-8").split("\n")) {
+      const line = raw.trim();
+      if (!line || line.startsWith("#")) continue;
+      const eq = line.indexOf("=");
+      if (eq <= 0) continue;
+      const key = line.slice(0, eq).trim();
+      if (!PROVIDER_KEY_RE.test(key)) continue;
+      let val = line.slice(eq + 1).trim();
+      if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+        val = val.slice(1, -1);
+      }
+      out[key] = val;
+    }
+  } catch {
+  }
+  return out;
+}
 
 // src/lib/opencode-slack-ingest.ts
 import { createHash as createHash11 } from "crypto";
@@ -6804,6 +6852,677 @@ async function fireOpencodeScheduledTask(agent, task) {
   }
 }
 
+// src/lib/opencode-telegram-ingest.ts
+import { createHash as createHash13 } from "crypto";
+import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync17, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync9 } from "fs";
+import { randomUUID } from "crypto";
+import { join as join21 } from "path";
+
+// src/lib/telegram-ingest.ts
+import https2 from "https";
+
+// ../../packages/core/dist/channels/governance/telegram-peer-classifier.js
+function classifyPeerMessage2(msg, cfg, self) {
+  if (!msg.from?.is_bot)
+    return { kind: "human" };
+  if (self.bot_id !== null && msg.from.id === self.bot_id) {
+    return { kind: "self" };
+  }
+  if (cfg.peer_disabled_mode === "all") {
+    return { kind: "drop", reason: "peer_disabled_all" };
+  }
+  if (cfg.peer_agent_mode === "off") {
+    return { kind: "drop", reason: "mode_off" };
+  }
+  const chatId = String(msg.chat.id);
+  if (cfg.peer_group_ids.length === 0) {
+    if (msg.chat.type !== "private") {
+      return { kind: "drop", reason: "chat_not_allowed" };
+    }
+  } else if (!cfg.peer_group_ids.includes(chatId)) {
+    return { kind: "drop", reason: "chat_not_allowed" };
+  }
+  const peer = cfg.peers.find((p) => p.bot_id === msg.from.id);
+  if (!peer) {
+    return { kind: "drop", reason: "unknown_peer" };
+  }
+  if (peer.gate_path === null) {
+    return { kind: "drop", reason: "cross_team_grant_missing" };
+  }
+  if (cfg.peer_disabled_mode === "cross_team_only" && peer.gate_path !== void 0 && peer.gate_path !== "same_team") {
+    return { kind: "drop", reason: "peer_disabled_cross_team" };
+  }
+  if (self.bot_id === null || self.bot_username === null) {
+    return { kind: "drop", reason: "self_resolution_pending" };
+  }
+  const addressing = classifyAddressing2(msg, self.bot_id, self.bot_username);
+  if (!addressing.addressed) {
+    return { kind: "drop", reason: "not_addressed" };
+  }
+  if (addressing.viaReplyOnly) {
+    const inAllowedGroup = cfg.peer_group_ids.length > 0 && cfg.peer_group_ids.includes(chatId);
+    const respondMode = cfg.peer_agent_mode === "respond";
+    if (!(inAllowedGroup && respondMode)) {
+      return { kind: "drop", reason: "not_addressed" };
+    }
+  }
+  return { kind: "peer-ingress", peer };
+}
+function classifyAddressing2(msg, ourBotId, ourBotUsername) {
+  let viaMentionOrCommand = false;
+  const text = msg.text ?? msg.caption ?? "";
+  const entities = msg.entities ?? msg.caption_entities ?? [];
+  const usAt = "@" + ourBotUsername;
+  for (const entity of entities) {
+    const slice = text.slice(entity.offset, entity.offset + entity.length).toLowerCase();
+    if (entity.type === "bot_command") {
+      const at = slice.indexOf("@");
+      if (at < 0 || slice.slice(at + 1) === ourBotUsername) {
+        viaMentionOrCommand = true;
+        break;
+      }
+    } else if (entity.type === "mention" && slice === usAt) {
+      viaMentionOrCommand = true;
+      break;
+    }
+  }
+  const viaReply = msg.reply_to_message?.from?.id === ourBotId;
+  if (viaMentionOrCommand)
+    return { addressed: true, viaReplyOnly: false };
+  if (viaReply)
+    return { addressed: true, viaReplyOnly: true };
+  return { addressed: false, viaReplyOnly: false };
+}
+var CODE_NAME_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function parsePeersEnv2(raw, gateRaw) {
+  if (!raw || raw.trim().length === 0)
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed))
+    return [];
+  const gateMap = /* @__PURE__ */ new Map();
+  let gateConfigInvalid = false;
+  const gatePresent = !!(gateRaw && gateRaw.trim().length > 0);
+  if (gatePresent) {
+    try {
+      const gateParsed = JSON.parse(gateRaw);
+      if (!gateParsed || typeof gateParsed !== "object" || Array.isArray(gateParsed)) {
+        gateConfigInvalid = true;
+      } else {
+        for (const [k, v] of Object.entries(gateParsed)) {
+          if (v === null) {
+            gateMap.set(k, null);
+          } else if (typeof v === "string") {
+            const isGrantPath = v.startsWith("grant:") && v.slice("grant:".length).trim().length > 0;
+            if (v === "same_team" || v === "intra_org_unrestricted" || isGrantPath) {
+              gateMap.set(k, v);
+            } else {
+              gateConfigInvalid = true;
+              break;
+            }
+          } else {
+            gateConfigInvalid = true;
+            break;
+          }
+        }
+      }
+    } catch {
+      gateConfigInvalid = true;
+    }
+    if (gateConfigInvalid) {
+      console.error("[telegram-peer-classifier] TELEGRAM_PEERS_GATE is present but malformed; failing closed (every peer drops as cross_team_grant_missing)");
+    }
+  }
+  const out = [];
+  for (const entry of parsed) {
+    if (entry && typeof entry === "object" && typeof entry.code_name === "string" && CODE_NAME_RE2.test(entry.code_name) && typeof entry.agent_id === "string" && typeof entry.bot_id === "number" && Number.isInteger(entry.bot_id) && entry.bot_id > 0) {
+      const e = entry;
+      const peer = { code_name: e.code_name, bot_id: e.bot_id, agent_id: e.agent_id };
+      if (gateConfigInvalid) {
+        peer.gate_path = null;
+      } else {
+        const key = String(e.bot_id);
+        if (gateMap.has(key)) {
+          peer.gate_path = gateMap.get(key) ?? null;
+        } else if (gatePresent) {
+          peer.gate_path = null;
+        }
+      }
+      out.push(peer);
+    }
+  }
+  return out;
+}
+function parsePeerGroupIdsEnv2(raw) {
+  if (!raw)
+    return [];
+  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function parsePeerAgentModeEnv2(raw) {
+  if (raw === "listen" || raw === "respond")
+    return raw;
+  return "off";
+}
+
+// ../../packages/core/dist/channels/governance/telegram-sender-gate.js
+function evaluateTelegramInboundGate(evt, deps) {
+  const isBot = Boolean(evt.from?.is_bot);
+  const text = (evt.text ?? evt.caption ?? "").trim();
+  const chatId = String(evt.chat.id);
+  const content = text.length > 0 ? { forward: true } : { forward: false, reason: "empty" };
+  let peerLeaf;
+  let isSelf = false;
+  if (isBot) {
+    const classifierMsg = {
+      message_id: evt.message_id,
+      text: evt.text,
+      caption: evt.caption,
+      from: evt.from ? { id: evt.from.id, username: evt.from.username, is_bot: evt.from.is_bot } : void 0,
+      chat: { id: evt.chat.id, type: evt.chat.type },
+      reply_to_message: evt.reply_to_message ? {
+        message_id: evt.reply_to_message.message_id,
+        from: evt.reply_to_message.from ? { id: evt.reply_to_message.from.id, is_bot: evt.reply_to_message.from.is_bot } : void 0
+      } : void 0,
+      entities: evt.entities,
+      caption_entities: evt.caption_entities
+    };
+    const c = classifyPeerMessage2(classifierMsg, deps.peerConfig, deps.self);
+    isSelf = c.kind === "self";
+    peerLeaf = { kind: c.kind, reason: c.kind === "drop" ? c.reason : void 0 };
+  }
+  const decision = decideInboundAccess({
+    content,
+    // Telegram's only self signal is the peer classifier (Slack catches self at
+    // evt.user===botUserId; Teams inside its activity filter).
+    isSelf,
+    isBot,
+    peer: peerLeaf,
+    // TELEGRAM_ALLOWED_CHATS is Telegram's org-boundary axis. An unlisted chat is
+    // external ⇒ silent drop.
+    orgBoundary: deps.allowedChats.size > 0 && !deps.allowedChats.has(chatId) ? { forward: false } : { forward: true },
+    // No sender-policy mode system and no command dispatch on the injection gate.
+    sameOrg: false
+  });
+  if (decision.kind === "drop")
+    return { admit: false, reason: decision.reason };
+  return { admit: true };
+}
+
+// ../../packages/core/dist/channels/governance/telegram-inbound-config.js
+function parseTelegramAllowedChatsEnv(env) {
+  return new Set((env["TELEGRAM_ALLOWED_CHATS"] ?? "").split(",").map((s) => s.trim()).filter(Boolean));
+}
+function parseTelegramPeerDisabledModeEnv(env, onWarn) {
+  const next = (env["PEER_DISABLED"] ?? "").trim().toLowerCase();
+  if (next === "off" || next === "cross_team_only" || next === "all")
+    return next;
+  if (next.length > 0) {
+    onWarn?.(`invalid PEER_DISABLED=${JSON.stringify(env["PEER_DISABLED"])} - defaulting to 'all' (fail-closed)`);
+    return "all";
+  }
+  const legacy = (env["TELEGRAM_PEER_DISABLED"] ?? "").trim().toLowerCase();
+  return legacy === "1" || legacy === "true" || legacy === "yes" ? "all" : "off";
+}
+function buildTelegramPeerClassifierConfigFromEnv(env, opts) {
+  return {
+    peer_agent_mode: parsePeerAgentModeEnv2(env["TELEGRAM_PEER_AGENT_MODE"]),
+    peer_group_ids: parsePeerGroupIdsEnv2(env["TELEGRAM_PEER_GROUP_IDS"]),
+    peers: parsePeersEnv2(env["TELEGRAM_PEERS"], env["TELEGRAM_PEERS_GATE"]),
+    peer_disabled_mode: parseTelegramPeerDisabledModeEnv(env, opts?.onWarn)
+  };
+}
+
+// src/lib/telegram-ingest.ts
+var nodeHttpsTelegramFetch = (url, init) => new Promise((resolve, reject) => {
+  const u = new URL(url);
+  const body = init?.body;
+  const headers = { ...init?.headers ?? {} };
+  if (body !== void 0 && headers["Content-Length"] === void 0) {
+    headers["Content-Length"] = String(Buffer.byteLength(body));
+  }
+  const req = https2.request(
+    {
+      hostname: u.hostname,
+      port: 443,
+      path: u.pathname + u.search,
+      method: init?.method ?? "GET",
+      family: 4,
+      // Backstop above the long-poll hold (getUpdates parks up to
+      // LONG_POLL_SECONDS); short calls carry their own AbortSignal.timeout.
+      timeout: POLL_HTTP_TIMEOUT_MS + 5e3,
+      headers
+    },
+    (res) => {
+      let data = "";
+      res.on("data", (d) => {
+        data += d;
+      });
+      res.on("end", () => {
+        const status = res.statusCode ?? 0;
+        resolve({
+          ok: status >= 200 && status < 300,
+          status,
+          json: async () => JSON.parse(data.length > 0 ? data : "{}")
+        });
+      });
+    }
+  );
+  req.on("error", reject);
+  req.on("timeout", () => {
+    req.destroy(new Error("Telegram API socket timeout"));
+  });
+  const signal = init?.signal;
+  if (signal) {
+    if (signal.aborted) req.destroy(new Error("aborted"));
+    else signal.addEventListener("abort", () => req.destroy(new Error("aborted")), { once: true });
+  }
+  if (body !== void 0) req.write(body);
+  req.end();
+});
+var TELEGRAM_API = "https://api.telegram.org";
+var LONG_POLL_SECONDS = 50;
+var POLL_HTTP_TIMEOUT_MS = (LONG_POLL_SECONDS + 10) * 1e3;
+var POLL_ERROR_BACKOFF_MS = 5e3;
+function memoryOffsetStore(initial = 0) {
+  let value = initial;
+  return { load: () => value, save: (o) => {
+    value = o;
+  } };
+}
+function resolveTelegramIngestParamsFromEnv(env) {
+  const botToken = env["TELEGRAM_BOT_TOKEN"];
+  if (!botToken) return null;
+  const ackReaction = (env["TELEGRAM_ACK_REACTION"] ?? "").trim() || "\u{1F440}";
+  const skipReaction = (env["TELEGRAM_SKIP_REACTION"] ?? "").trim() || void 0;
+  return {
+    botToken,
+    allowedChats: parseTelegramAllowedChatsEnv(env),
+    peerConfig: buildTelegramPeerClassifierConfigFromEnv(env),
+    ackReaction,
+    ...skipReaction ? { skipReaction } : {}
+  };
+}
+function isTelegramAuthFailure(status, description) {
+  return status === 401 || (description ?? "").toLowerCase().includes("unauthorized");
+}
+async function resolveTelegramBotIdentity(botToken, fetchImpl) {
+  const doFetch = fetchImpl ?? nodeHttpsTelegramFetch;
+  const unresolved = { bot_id: null, bot_username: null };
+  try {
+    const res = await doFetch(`${TELEGRAM_API}/bot${botToken}/getMe`, {
+      method: "POST",
+      signal: AbortSignal.timeout(1e4)
+    });
+    const data = await res.json();
+    if (data.ok && data.result) {
+      return {
+        self: {
+          bot_id: data.result.id,
+          // Lowercased to match resolveBotUsername()'s cache convention.
+          bot_username: data.result.username ? data.result.username.toLowerCase() : null
+        },
+        authFailed: false
+      };
+    }
+    return { self: unresolved, authFailed: isTelegramAuthFailure(res.status, data.description) };
+  } catch {
+    return { self: unresolved, authFailed: false };
+  }
+}
+var BoundedSet2 = class {
+  max;
+  set = /* @__PURE__ */ new Set();
+  constructor(max = 500) {
+    this.max = max;
+  }
+  has(k) {
+    return this.set.has(k);
+  }
+  add(k) {
+    this.set.add(k);
+    if (this.set.size > this.max) {
+      const oldest = this.set.values().next().value;
+      if (oldest !== void 0) this.set.delete(oldest);
+    }
+  }
+};
+async function dispatchTelegramInbound(update, ctx) {
+  const msg = update.message;
+  const chatId = String(msg.chat.id);
+  const dedupKey = String(update.update_id);
+  if (ctx.seen.has(dedupKey)) return "dropped_duplicate";
+  ctx.seen.add(dedupKey);
+  const decision = evaluateTelegramInboundGate(msg, {
+    allowedChats: ctx.allowedChats,
+    peerConfig: ctx.peerConfig,
+    self: ctx.self
+  });
+  if (!decision.admit) {
+    ctx.log(`[telegram-ingest:${ctx.codeName}] dropped chat=${redactId(chatId)} reason=${decision.reason}`);
+    return "dropped_gate";
+  }
+  if (ctx.ackReaction) {
+    void ctx.addReaction({ chatId, messageId: msg.message_id, emoji: ctx.ackReaction });
+  }
+  const conversationKey = msg.message_thread_id ? `${chatId}:${msg.message_thread_id}` : chatId;
+  const meta = {
+    source: "telegram",
+    lane: "conversational",
+    requires_reply: "true",
+    chat_id: chatId
+  };
+  if (msg.message_thread_id) meta["message_thread_id"] = String(msg.message_thread_id);
+  const result = await ctx.inject({
+    channelId: "telegram",
+    conversationKey,
+    senderId: msg.from ? String(msg.from.id) : "unknown",
+    text: msg.text ?? msg.caption ?? "",
+    meta
+  });
+  if (result.status === "declined") {
+    ctx.log(`[telegram-ingest:${ctx.codeName}] inject declined reason=${result.reason}`);
+    return "declined";
+  }
+  if (result.status === "replied" && result.reply) {
+    await ctx.sendReply({
+      chatId,
+      text: result.reply,
+      ...msg.message_thread_id ? { messageThreadId: msg.message_thread_id } : {}
+    });
+    ctx.log(`[telegram-ingest:${ctx.codeName}] outcome=replied chat=${redactId(chatId)} len=${result.reply.length}`);
+    return "admitted_replied";
+  }
+  ctx.log(
+    `[telegram-ingest:${ctx.codeName}] outcome=no_reply chat=${redactId(chatId)} inject_status=${result.status}`
+  );
+  if (ctx.skipReaction) {
+    void ctx.addReaction({ chatId, messageId: msg.message_id, emoji: ctx.skipReaction });
+  }
+  return "admitted_no_reply";
+}
+function redactId(id) {
+  if (!id) return "?";
+  return `${id.slice(0, 2)}***`;
+}
+function defaultSendReply2(botToken, fetchImpl, log2) {
+  return async ({ chatId, text, messageThreadId }) => {
+    try {
+      const res = await fetchImpl(`${TELEGRAM_API}/bot${botToken}/sendMessage`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          chat_id: chatId,
+          text,
+          ...messageThreadId ? { message_thread_id: messageThreadId } : {}
+        }),
+        // Dedicated short timeout so an outbound reply can't inherit the ~50s
+        // long-poll getUpdates timeout and hang a turn on a slow Telegram edge.
+        signal: AbortSignal.timeout(1e4)
+      });
+      const data = await res.json();
+      if (!data.ok) log2(`[telegram-ingest] sendMessage failed: ${data.description}`);
+    } catch (err) {
+      log2(`[telegram-ingest] sendMessage threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  };
+}
+function defaultAddReaction2(botToken, fetchImpl, log2) {
+  return async ({ chatId, messageId, emoji }) => {
+    try {
+      const res = await fetchImpl(`${TELEGRAM_API}/bot${botToken}/setMessageReaction`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          chat_id: chatId,
+          message_id: messageId,
+          reaction: [{ type: "emoji", emoji }]
+        }),
+        // Dedicated short timeout — the ack must not inherit the long-poll window.
+        signal: AbortSignal.timeout(1e4)
+      });
+      const data = await res.json();
+      if (!data.ok) log2(`[telegram-ingest] setMessageReaction failed: ${data.description}`);
+    } catch (err) {
+      log2(`[telegram-ingest] setMessageReaction threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  };
+}
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms).unref?.();
+  });
+}
+function startTelegramIngest(config2) {
+  const fetchImpl = config2.fetchImpl ?? nodeHttpsTelegramFetch;
+  const sendReply = config2.sendReply ?? defaultSendReply2(config2.botToken, fetchImpl, config2.log);
+  const addReaction = config2.addReaction ?? defaultAddReaction2(config2.botToken, fetchImpl, config2.log);
+  const offsetStore = config2.offsetStore ?? memoryOffsetStore();
+  const seen = new BoundedSet2();
+  const ctx = {
+    codeName: config2.codeName,
+    allowedChats: config2.allowedChats,
+    peerConfig: config2.peerConfig,
+    self: config2.self,
+    inject: config2.inject,
+    sendReply,
+    addReaction,
+    ...config2.ackReaction ? { ackReaction: config2.ackReaction } : {},
+    ...config2.skipReaction ? { skipReaction: config2.skipReaction } : {},
+    log: config2.log,
+    seen
+  };
+  let stopped = false;
+  let controller = null;
+  let nextOffset = offsetStore.load();
+  const pollLoop = async () => {
+    while (!stopped) {
+      try {
+        controller = new AbortController();
+        const timeout = AbortSignal.timeout(POLL_HTTP_TIMEOUT_MS);
+        const signal = anySignal([controller.signal, timeout]);
+        const res = await fetchImpl(`${TELEGRAM_API}/bot${config2.botToken}/getUpdates`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            offset: nextOffset,
+            timeout: LONG_POLL_SECONDS,
+            allowed_updates: ["message"]
+          }),
+          signal
+        });
+        if (stopped) return;
+        const data = await res.json();
+        if (!data.ok) {
+          config2.log(`[telegram-ingest:${config2.codeName}] getUpdates failed: ${data.description ?? "unknown"}`);
+          await sleep(POLL_ERROR_BACKOFF_MS);
+          continue;
+        }
+        const updates = data.result ?? [];
+        for (const update of updates) {
+          nextOffset = Math.max(nextOffset, update.update_id + 1);
+          const msg = update.message;
+          if (!msg) continue;
+          try {
+            await dispatchTelegramInbound({ update_id: update.update_id, message: msg }, ctx);
+          } catch (err) {
+            config2.log(
+              `[telegram-ingest:${config2.codeName}] dispatch threw: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        }
+        if (updates.length > 0) offsetStore.save(nextOffset);
+      } catch (err) {
+        if (stopped) return;
+        config2.log(`[telegram-ingest:${config2.codeName}] poll threw: ${err instanceof Error ? err.message : String(err)}`);
+        await sleep(POLL_ERROR_BACKOFF_MS);
+      }
+    }
+  };
+  void pollLoop();
+  return {
+    stop() {
+      stopped = true;
+      try {
+        controller?.abort();
+      } catch {
+      }
+    }
+  };
+}
+function anySignal(signals) {
+  const controller = new AbortController();
+  for (const s of signals) {
+    if (s.aborted) {
+      controller.abort();
+      break;
+    }
+    s.addEventListener("abort", () => controller.abort(), { once: true });
+  }
+  return controller.signal;
+}
+
+// src/lib/opencode-telegram-ingest.ts
+var ingests2 = /* @__PURE__ */ new Map();
+function fingerprint2(params) {
+  return createHash13("sha256").update(
+    JSON.stringify({
+      botToken: params.botToken,
+      allowedChats: [...params.allowedChats].sort(),
+      peerConfig: params.peerConfig,
+      ackReaction: params.ackReaction ?? null,
+      skipReaction: params.skipReaction ?? null
+    })
+  ).digest("hex");
+}
+function createFileOffsetStore(codeName, log2, currentBotId) {
+  let dir;
+  let filePath;
+  try {
+    dir = getFramework("opencode").getAgentDir(codeName);
+    filePath = join21(dir, "telegram-getupdates-offset-opencode.json");
+  } catch {
+    dir = null;
+    filePath = null;
+  }
+  return {
+    load() {
+      if (!filePath) return 0;
+      try {
+        const parsed = JSON.parse(readFileSync17(filePath, "utf-8"));
+        if (currentBotId != null && typeof parsed?.bot_id === "number" && parsed.bot_id !== currentBotId) {
+          log2(`[telegram-ingest:${codeName}] offset cursor belongs to a different bot; ignoring (bot swap)`);
+          return 0;
+        }
+        const offset = parsed?.offset;
+        if (typeof offset === "number" && Number.isFinite(offset) && offset > 0) {
+          const normalized = Math.floor(offset);
+          if (Number.isSafeInteger(normalized) && normalized > 0) return normalized;
+        }
+      } catch {
+      }
+      return 0;
+    },
+    save(offset) {
+      if (!filePath || !dir) return;
+      const tmpPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+      try {
+        mkdirSync8(dir, { recursive: true, mode: 448 });
+        writeFileSync9(
+          tmpPath,
+          JSON.stringify({
+            offset,
+            // Stamp the owning bot so a later token swap invalidates this cursor.
+            ...currentBotId != null ? { bot_id: currentBotId } : {},
+            updated_at: (/* @__PURE__ */ new Date()).toISOString()
+          }),
+          { mode: 384 }
+        );
+        renameSync2(tmpPath, filePath);
+      } catch (err) {
+        log2(`[telegram-ingest:${codeName}] offset persist failed: ${err instanceof Error ? err.message : String(err)}`);
+        try {
+          if (existsSync11(tmpPath)) unlinkSync(tmpPath);
+        } catch {
+        }
+      }
+    }
+  };
+}
+async function ensureOpencodeTelegramIngest(opts) {
+  const { codeName, agentId, log: log2 } = opts;
+  const readEnv = opts.readEnv ?? readChannelServerEnv;
+  let params;
+  try {
+    const env = readEnv(codeName, "telegram");
+    if (!env) {
+      stopOpencodeTelegramIngest(codeName, log2);
+      return;
+    }
+    params = resolveTelegramIngestParamsFromEnv(env);
+  } catch (err) {
+    stopOpencodeTelegramIngest(codeName, log2);
+    log2(`[telegram-ingest:${codeName}] not started: ${err instanceof Error ? err.message : String(err)}`);
+    return;
+  }
+  if (!params) {
+    stopOpencodeTelegramIngest(codeName, log2);
+    return;
+  }
+  const key = fingerprint2(params);
+  const existing = ingests2.get(codeName);
+  if (existing?.key === key && !existing.selfUnresolved) return;
+  const { self, authFailed } = await resolveTelegramBotIdentity(params.botToken, opts.fetchImpl);
+  if (authFailed) {
+    stopOpencodeTelegramIngest(codeName, log2);
+    log2(`[telegram-ingest:${codeName}] not started: Telegram bot token rejected (needs reconnect)`);
+    return;
+  }
+  if (existing?.key === key && self.bot_id === null) return;
+  if (self.bot_id === null) {
+    log2(`[telegram-ingest:${codeName}] bot identity unresolved; peer classification degraded`);
+  }
+  if (existing) {
+    existing.handle.stop();
+    ingests2.delete(codeName);
+    log2(
+      existing.key === key ? `[telegram-ingest:${codeName}] bot identity resolved; restarting ingest` : `[telegram-ingest:${codeName}] config changed; restarting ingest`
+    );
+  }
+  const handle = startTelegramIngest({
+    codeName,
+    agentId,
+    botToken: params.botToken,
+    allowedChats: params.allowedChats,
+    peerConfig: params.peerConfig,
+    self,
+    inject: (msg) => injectOpencodeMessage(codeName, msg, { awaitReply: true }),
+    log: log2,
+    offsetStore: opts.offsetStore ?? createFileOffsetStore(codeName, log2, self.bot_id),
+    ...params.ackReaction ? { ackReaction: params.ackReaction } : {},
+    ...params.skipReaction ? { skipReaction: params.skipReaction } : {},
+    ...opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}
+  });
+  ingests2.set(codeName, { key, handle, selfUnresolved: self.bot_id === null });
+  log2(
+    `[telegram-ingest:${codeName}] ingest started (peer_mode=${params.peerConfig.peer_agent_mode}, allowlist=${params.allowedChats.size})`
+  );
+}
+function stopOpencodeTelegramIngest(codeName, log2) {
+  const entry = ingests2.get(codeName);
+  if (!entry) return;
+  entry.handle.stop();
+  ingests2.delete(codeName);
+  log2?.(`[telegram-ingest:${codeName}] ingest stopped`);
+}
+function stopAllOpencodeTelegramIngests(log2) {
+  for (const codeName of [...ingests2.keys()]) stopOpencodeTelegramIngest(codeName, log2);
+}
+
 // src/lib/wedge-detection.ts
 var DEFAULTS = {
   inboundWaitSeconds: 120,
@@ -6944,24 +7663,24 @@ function partitionActionableByPoison(actionable, states, config2) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync7, readdirSync as readdirSync4, readFileSync as readFileSync17, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join20 } from "path";
-import { randomUUID } from "crypto";
+import { existsSync as existsSync12, mkdirSync as mkdirSync9, readdirSync as readdirSync4, readFileSync as readFileSync18, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "fs";
+import { homedir as homedir11 } from "os";
+import { join as join22 } from "path";
+import { randomUUID as randomUUID2 } from "crypto";
 function restartFlagsDir() {
-  return join20(homedir10(), ".augmented", "restart-flags");
+  return join22(homedir11(), ".augmented", "restart-flags");
 }
 function flagPath(codeName) {
-  return join20(restartFlagsDir(), `${codeName}.flag`);
+  return join22(restartFlagsDir(), `${codeName}.flag`);
 }
 function readRestartFlags() {
   const dir = restartFlagsDir();
-  if (!existsSync11(dir)) return [];
+  if (!existsSync12(dir)) return [];
   const out = [];
   for (const entry of readdirSync4(dir)) {
     if (!entry.endsWith(".flag")) continue;
     try {
-      const raw = readFileSync17(join20(dir, entry), "utf8");
+      const raw = readFileSync18(join22(dir, entry), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.codeName !== "string" || parsed.codeName.length === 0) {
         parsed.codeName = entry.replace(/\.flag$/, "");
@@ -6979,8 +7698,8 @@ function readRestartFlags() {
 }
 function deleteRestartFlag(codeName) {
   const path = flagPath(codeName);
-  if (existsSync11(path)) {
-    rmSync3(path, { force: true });
+  if (existsSync12(path)) {
+    rmSync4(path, { force: true });
   }
 }
 
@@ -7325,10 +8044,10 @@ function startRealtimeConfig(config2) {
     filter: filterStr
   }, (payload) => {
     const agent = payload.new;
-    const fingerprint2 = `${agent.status}|${agent.framework}|${agent.session_mode}|${agent.primary_model}`;
+    const fingerprint3 = `${agent.status}|${agent.framework}|${agent.session_mode}|${agent.primary_model}`;
     const prev = lastKnown.get(agent.agent_id);
-    if (prev === fingerprint2) return;
-    lastKnown.set(agent.agent_id, fingerprint2);
+    if (prev === fingerprint3) return;
+    lastKnown.set(agent.agent_id, fingerprint3);
     log2(`[realtime] Agent config changed: ${agent.code_name} (status=${agent.status})`);
     onConfigChange(agent);
   }).subscribe((status) => {
@@ -8213,15 +8932,15 @@ var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 var sessionLaunchManagedStructure = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
-    const raw = readFileSync18(join21(projectDir, ".mcp.json"), "utf-8");
-    return createHash13("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
+    const raw = readFileSync19(join23(projectDir, ".mcp.json"), "utf-8");
+    return createHash14("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
   }
 }
 function projectMcpKeys(_codeName, projectDir) {
   try {
-    const raw = readFileSync18(join21(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync19(join23(projectDir, ".mcp.json"), "utf-8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers;
     if (!servers || typeof servers !== "object") return /* @__PURE__ */ new Set();
@@ -8239,7 +8958,7 @@ function seedSessionLaunchBaselines(codeName, projectDir) {
   else runningMcpServerKeys.delete(codeName);
   let launchStructure = null;
   try {
-    const raw = readFileSync18(join21(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync19(join23(projectDir, ".mcp.json"), "utf-8");
     launchStructure = managedMcpStructureHashFromFile(
       JSON.parse(raw),
       isManagedMcpServerKey
@@ -8339,7 +9058,7 @@ async function runAgentSessionToolBindProbes(agent, integrations, projectDir, op
   if (result && result.rebindCandidates.length > 0 && hostFlagStore().getBoolean("session-tool-rebind")) {
     let mcpJsonForRebind = null;
     try {
-      mcpJsonForRebind = JSON.parse(readFileSync18(join21(projectDir, ".mcp.json"), "utf-8"));
+      mcpJsonForRebind = JSON.parse(readFileSync19(join23(projectDir, ".mcp.json"), "utf-8"));
     } catch {
       mcpJsonForRebind = null;
     }
@@ -8468,7 +9187,7 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
 function projectChannelSecretHash(projectDir) {
   try {
     const entries = parseEnvIntegrations(
-      readFileSync18(join21(projectDir, ".env.integrations"), "utf-8")
+      readFileSync19(join23(projectDir, ".env.integrations"), "utf-8")
     );
     return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
   } catch {
@@ -8531,6 +9250,7 @@ function clearAgentCaches(agentId, codeName) {
   const channelCacheMutated = clearAgentState(agentId, codeName);
   agentChannelTokens.delete(codeName);
   stopOpencodeSlackIngest(codeName, log);
+  stopOpencodeTelegramIngest(codeName, log);
   agentFrameworkCache.delete(codeName);
   kanbanBoardCache.delete(codeName);
   clearKanbanNudgeState(codeName);
@@ -8560,7 +9280,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.343" : "dev";
+var agtCliVersion = true ? "0.28.345" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -8573,7 +9293,7 @@ function resolveBrewPath(execFileSync2) {
     "/usr/local/bin/brew"
   ];
   for (const path of fallbacks) {
-    if (existsSync12(path)) return path;
+    if (existsSync13(path)) return path;
   }
   return null;
 }
@@ -8583,7 +9303,7 @@ function claudeBinaryInstalled(execFileSync2) {
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude"
   ];
-  if (canonical.some((path) => existsSync12(path))) return true;
+  if (canonical.some((path) => existsSync13(path))) return true;
   try {
     execFileSync2("which", ["claude"], { timeout: 5e3 });
     return true;
@@ -8738,8 +9458,8 @@ function claudeManagedSettingsPath() {
 function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
   try {
     let settings = {};
-    if (existsSync12(path)) {
-      const raw = readFileSync18(path, "utf-8").trim();
+    if (existsSync13(path)) {
+      const raw = readFileSync19(path, "utf-8").trim();
       if (raw) {
         let parsed;
         try {
@@ -8755,8 +9475,8 @@ function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
     }
     if (settings.channelsEnabled === true) return "ok";
     settings.channelsEnabled = true;
-    mkdirSync8(dirname6(path), { recursive: true });
-    writeFileSync9(path, `${JSON.stringify(settings, null, 2)}
+    mkdirSync10(dirname6(path), { recursive: true });
+    writeFileSync11(path, `${JSON.stringify(settings, null, 2)}
 `);
     log(`[managed-settings] set channelsEnabled:true in ${path} (ENG-5786 \u2014 unblocks Claude Code channels)`);
     return "ok";
@@ -8801,7 +9521,7 @@ async function ensureFrameworkBinary(frameworkId) {
     if (!process.env.PATH?.split(":").includes(brewBinDir)) {
       process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
     }
-    if (existsSync12("/home/linuxbrew/.linuxbrew/bin/claude")) {
+    if (existsSync13("/home/linuxbrew/.linuxbrew/bin/claude")) {
       log("Claude Code installed successfully");
     } else {
       log("Claude Code install completed but binary not found at expected path \u2014 check brew logs");
@@ -8857,7 +9577,7 @@ ${r.stderr}`;
 }
 var UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function selfUpdateAppliedMarkerPath() {
-  return join21(homedir11(), ".augmented", ".last-self-update-applied");
+  return join23(homedir12(), ".augmented", ".last-self-update-applied");
 }
 var selfUpdateUpToDateLogged = false;
 var selfUpdatePinnedLogged = false;
@@ -8883,7 +9603,7 @@ async function checkAndUpdateCli(opts) {
     const isNpmGlobal = !isBrewFormula && resolvedPath.includes("node_modules");
     if (!isBrewFormula && !isNpmGlobal) return "noop";
     const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
-    const markerPath = join21(homedir11(), ".augmented", ".last-update-check");
+    const markerPath = join23(homedir12(), ".augmented", ".last-update-check");
     if (!force) {
       try {
         const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
@@ -9228,14 +9948,14 @@ async function checkClaudeAuth() {
 }
 var evalEmptyMcpConfigPath = null;
 function ensureEvalEmptyMcpConfig() {
-  if (evalEmptyMcpConfigPath && existsSync12(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
-  const dir = join21(homedir11(), ".augmented");
+  if (evalEmptyMcpConfigPath && existsSync13(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
+  const dir = join23(homedir12(), ".augmented");
   try {
-    mkdirSync8(dir, { recursive: true });
+    mkdirSync10(dir, { recursive: true });
   } catch {
   }
-  const p = join21(dir, ".eval-empty-mcp.json");
-  writeFileSync9(p, JSON.stringify({ mcpServers: {} }));
+  const p = join23(dir, ".eval-empty-mcp.json");
+  writeFileSync11(p, JSON.stringify({ mcpServers: {} }));
   evalEmptyMcpConfigPath = p;
   return p;
 }
@@ -9260,7 +9980,7 @@ async function runEvalClaude(prompt, model) {
     ""
   ];
   const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-    cwd: homedir11(),
+    cwd: homedir12(),
     timeout: 12e4,
     stdin: "ignore",
     env: childEnv,
@@ -9326,10 +10046,10 @@ function resolveConversationEvalBackend() {
   return conversationEvalBackend;
 }
 function getStateFile() {
-  return join21(config?.configDir ?? join21(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
+  return join23(config?.configDir ?? join23(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
 }
 function channelHashCacheDir() {
-  return config?.configDir ?? join21(process.env["HOME"] ?? "/tmp", ".augmented");
+  return config?.configDir ?? join23(process.env["HOME"] ?? "/tmp", ".augmented");
 }
 function loadChannelHashCache2() {
   loadChannelHashCache(agentState.knownChannelConfigHashes, channelHashCacheDir());
@@ -9381,7 +10101,7 @@ function removeDeliveryBaselineEntries(agentId) {
 var _channelQuarantineStore = null;
 function channelQuarantineStore() {
   if (!_channelQuarantineStore) {
-    const dir = config?.configDir ?? join21(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join23(process.env["HOME"] ?? "/tmp", ".augmented");
     _channelQuarantineStore = new ChannelQuarantineStore(defaultQuarantinePath(dir));
   }
   return _channelQuarantineStore;
@@ -9389,7 +10109,7 @@ function channelQuarantineStore() {
 var _hostFlagStore = null;
 function hostFlagStore() {
   if (!_hostFlagStore) {
-    const dir = config?.configDir ?? join21(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join23(process.env["HOME"] ?? "/tmp", ".augmented");
     _hostFlagStore = new HostFlagStore({ cachePath: defaultFlagsCachePath(dir), log });
   }
   return _hostFlagStore;
@@ -9456,13 +10176,13 @@ function parseSkillFrontmatter(content) {
   return out;
 }
 async function refreshSkillsIndexInClaudeMd(configDir, codeName, log2) {
-  const { readdirSync: readdirSync6, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync10 } = await import("fs");
-  const skillsDir = join21(configDir, codeName, "project", ".claude", "skills");
-  const claudeMdPath = join21(configDir, codeName, "project", "CLAUDE.md");
+  const { readdirSync: readdirSync6, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync12 } = await import("fs");
+  const skillsDir = join23(configDir, codeName, "project", ".claude", "skills");
+  const claudeMdPath = join23(configDir, codeName, "project", "CLAUDE.md");
   if (!ex(skillsDir) || !ex(claudeMdPath)) return;
   const entries = [];
   for (const dir of readdirSync6(skillsDir).sort()) {
-    const skillFile = join21(skillsDir, dir, "SKILL.md");
+    const skillFile = join23(skillsDir, dir, "SKILL.md");
     if (!ex(skillFile)) continue;
     try {
       const { name, description } = parseSkillFrontmatter(rfs(skillFile, "utf-8"));
@@ -9504,7 +10224,7 @@ ${SKILLS_INDEX_END}`;
     next = current.trimEnd() + "\n\n" + section + "\n";
   }
   if (next !== current) {
-    writeFileSync10(claudeMdPath, next, "utf-8");
+    writeFileSync12(claudeMdPath, next, "utf-8");
     log2(`Refreshed skills index in CLAUDE.md for '${codeName}' (${entries.length} skills)`);
   }
 }
@@ -9525,7 +10245,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-XWJSAZB4.js");
+      const { collectDiagnostics } = await import("../persistent-session-6ADHOTEG.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames)
@@ -9624,7 +10344,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-XWJSAZB4.js");
+      const { collectDiagnostics } = await import("../persistent-session-6ADHOTEG.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -9654,7 +10374,7 @@ async function pollCycle() {
         claudeAuth = await detectClaudeAuth();
       } catch (err) {
         const errText = err instanceof Error ? err.message : String(err);
-        const errId = createHash13("sha256").update(errText).digest("hex").slice(0, 12);
+        const errId = createHash14("sha256").update(errText).digest("hex").slice(0, 12);
         log(`Claude auth detection failed (error_id=${errId})`);
       }
       const hostHasClaudeCode = state6.agents.some(
@@ -9779,7 +10499,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-XLS2FXIX.js");
+      } = await import("../responsiveness-probe-UYVXWW5D.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -9811,7 +10531,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-XLS2FXIX.js");
+        } = await import("../responsiveness-probe-UYVXWW5D.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-HYOOQV4A.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -9900,13 +10620,13 @@ async function pollCycle() {
             );
             if (hostFlagStore().getBoolean("wedge-transient-notice")) {
               try {
-                const paneTail = readFileSync18(paneLogPath(codeName), "utf8").slice(-65536);
+                const paneTail = readFileSync19(paneLogPath(codeName), "utf8").slice(-65536);
                 const transient = detectTransientApiErrorInLog(paneTail);
                 if (transient) {
-                  const wedgeHome = join21(homedir11(), ".augmented", codeName);
-                  if (existsSync12(wedgeHome)) {
+                  const wedgeHome = join23(homedir12(), ".augmented", codeName);
+                  if (existsSync13(wedgeHome)) {
                     atomicWriteFileSync(
-                      join21(wedgeHome, "watchdog-give-up.json"),
+                      join23(wedgeHome, "watchdog-give-up.json"),
                       JSON.stringify({
                         gave_up_at: wedgeNow.toISOString(),
                         reason: "transient_overload"
@@ -10155,7 +10875,7 @@ async function pollCycle() {
         } catch {
         }
         killAgentChannelProcesses(prev.codeName, { log });
-        const agentDir = join21(adapter.getAgentDir(prev.codeName), "provision");
+        const agentDir = join23(adapter.getAgentDir(prev.codeName), "provision");
         await cleanupAgentFiles(prev.codeName, agentDir);
         clearAgentCaches(prev.agentId, prev.codeName);
       }
@@ -10242,10 +10962,10 @@ async function pollCycle() {
         // pending-inbound marker. Best-effort: a write failure is logged by
         // the watchdog, never fails the poll cycle.
         signalGiveUp: (codeName) => {
-          const dir = join21(homedir11(), ".augmented", codeName);
-          if (!existsSync12(dir)) return;
+          const dir = join23(homedir12(), ".augmented", codeName);
+          if (!existsSync13(dir)) return;
           atomicWriteFileSync(
-            join21(dir, "watchdog-give-up.json"),
+            join23(dir, "watchdog-give-up.json"),
             JSON.stringify({ gave_up_at: (/* @__PURE__ */ new Date()).toISOString() })
           );
         }
@@ -10384,7 +11104,7 @@ async function processAgent(agent, agentStates) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const adapter = resolveAgentFramework(agent.code_name);
-  let agentDir = join21(adapter.getAgentDir(agent.code_name), "provision");
+  let agentDir = join23(adapter.getAgentDir(agent.code_name), "provision");
   if (agent.status === "draft" || agent.status === "paused") {
     if (previousKnownStatus !== agent.status) {
       log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
@@ -10430,7 +11150,7 @@ async function processAgent(agent, agentStates) {
       const residuals = {
         gatewayRunning: false,
         portAllocated: false,
-        provisionDirExists: existsSync12(agentDir)
+        provisionDirExists: existsSync13(agentDir)
       };
       if (!hasRevokedResiduals(residuals)) {
         agentStates.push({
@@ -10568,7 +11288,7 @@ async function processAgent(agent, agentStates) {
   const frameworkId = refreshData.agent.framework ?? DEFAULT_FRAMEWORK;
   agentFrameworkCache.set(agent.code_name, frameworkId);
   const frameworkAdapter = getFramework(frameworkId);
-  agentDir = join21(frameworkAdapter.getAgentDir(agent.code_name), "provision");
+  agentDir = join23(frameworkAdapter.getAgentDir(agent.code_name), "provision");
   cacheAgentDeliveryMetadata(agent.code_name, refreshData);
   agentRestartTimezoneInputs.set(agent.code_name, {
     agentTimezone: typeof refreshData.agent.timezone === "string" ? refreshData.agent.timezone : null,
@@ -10613,9 +11333,9 @@ async function processAgent(agent, agentStates) {
   try {
     const artifacts = generateArtifacts(agent, refreshData, frameworkAdapter);
     const changedFiles = [];
-    mkdirSync8(agentDir, { recursive: true });
+    mkdirSync10(agentDir, { recursive: true });
     for (const artifact of artifacts) {
-      const filePath = join21(agentDir, artifact.relativePath);
+      const filePath = join23(agentDir, artifact.relativePath);
       let existingHash;
       let newHash;
       let writeContent = artifact.content;
@@ -10634,8 +11354,8 @@ async function processAgent(agent, agentStates) {
         };
         newHash = sha256(stripDynamicSections(artifact.content));
         try {
-          const projectClaudeMd = join21(config.configDir, agent.code_name, "project", "CLAUDE.md");
-          const existing = readFileSync18(projectClaudeMd, "utf-8");
+          const projectClaudeMd = join23(config.configDir, agent.code_name, "project", "CLAUDE.md");
+          const existing = readFileSync19(projectClaudeMd, "utf-8");
           existingHash = sha256(stripDynamicSections(existing));
         } catch {
           existingHash = null;
@@ -10653,7 +11373,7 @@ async function processAgent(agent, agentStates) {
         const generatorKeys = Object.keys(generatorServers);
         let existingRaw = "";
         try {
-          existingRaw = readFileSync18(filePath, "utf-8");
+          existingRaw = readFileSync19(filePath, "utf-8");
         } catch {
         }
         const existingServers = parseMcp(existingRaw);
@@ -10675,26 +11395,26 @@ async function processAgent(agent, agentStates) {
       }
     }
     if (changedFiles.length > 0) {
-      const isFirst = !existsSync12(join21(agentDir, "CHARTER.md"));
+      const isFirst = !existsSync13(join23(agentDir, "CHARTER.md"));
       const verb = isFirst ? "Provisioning" : "Updating";
       const fileNames = changedFiles.map((f) => f.relativePath).join(", ");
       log(`${verb} '${agent.code_name}': ${fileNames}`);
       for (const file of changedFiles) {
-        const filePath = join21(agentDir, file.relativePath);
-        mkdirSync8(dirname6(filePath), { recursive: true });
+        const filePath = join23(agentDir, file.relativePath);
+        mkdirSync10(dirname6(filePath), { recursive: true });
         if (file.relativePath === ".mcp.json") {
           safeWriteJsonAtomic(filePath, file.content, { mode: 384 });
         } else {
-          writeFileSync9(filePath, file.content);
+          writeFileSync11(filePath, file.content);
         }
       }
       try {
-        const provSkillsDir = join21(agentDir, ".claude", "skills");
-        if (existsSync12(provSkillsDir)) {
+        const provSkillsDir = join23(agentDir, ".claude", "skills");
+        if (existsSync13(provSkillsDir)) {
           for (const folder of readdirSync5(provSkillsDir)) {
             if (folder.startsWith("knowledge-")) {
               try {
-                rmSync4(join21(provSkillsDir, folder), { recursive: true });
+                rmSync5(join23(provSkillsDir, folder), { recursive: true });
               } catch {
               }
             }
@@ -10707,7 +11427,7 @@ async function processAgent(agent, agentStates) {
       const trackedFiles2 = frameworkAdapter.driftTrackedFiles();
       const hashes = /* @__PURE__ */ new Map();
       for (const file of trackedFiles2) {
-        const h = hashFile(join21(agentDir, file));
+        const h = hashFile(join23(agentDir, file));
         if (h) hashes.set(file, h);
       }
       agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -10725,14 +11445,14 @@ async function processAgent(agent, agentStates) {
     }
     if (Array.isArray(refreshData.workflows)) {
       try {
-        const provWorkflowsDir = join21(agentDir, ".claude", "workflows");
-        if (existsSync12(provWorkflowsDir)) {
+        const provWorkflowsDir = join23(agentDir, ".claude", "workflows");
+        if (existsSync13(provWorkflowsDir)) {
           const expected = new Set(refreshData.workflows.map((w) => `${w.name}.js`));
           for (const file of readdirSync5(provWorkflowsDir)) {
             if (!file.endsWith(".js")) continue;
             if (expected.has(file)) continue;
             try {
-              rmSync4(join21(provWorkflowsDir, file));
+              rmSync5(join23(provWorkflowsDir, file));
             } catch {
             }
           }
@@ -10789,10 +11509,10 @@ async function processAgent(agent, agentStates) {
   }
   let lastDriftCheckAt = now;
   const written = agentState.writtenHashes.get(agent.agent_id);
-  if (written && existsSync12(agentDir)) {
+  if (written && existsSync13(agentDir)) {
     const driftedFiles = [];
     for (const [file, expectedHash] of written) {
-      const localHash = hashFile(join21(agentDir, file));
+      const localHash = hashFile(join23(agentDir, file));
       if (localHash && localHash !== expectedHash) {
         driftedFiles.push(file);
       }
@@ -10803,7 +11523,7 @@ async function processAgent(agent, agentStates) {
       try {
         const localHashes = {};
         for (const file of driftedFiles) {
-          localHashes[file] = hashFile(join21(agentDir, file));
+          localHashes[file] = hashFile(join23(agentDir, file));
         }
         await api.post("/host/drift", {
           agent_id: agent.agent_id,
@@ -10990,15 +11710,15 @@ async function processAgent(agent, agentStates) {
     const addedChannels = [...restartDecision.added];
     const writeDmNoticeMarkers = isChannelAddRestart ? () => {
       try {
-        const agentAugmentedDir = join21(homedir11(), ".augmented", agent.code_name);
-        mkdirSync8(agentAugmentedDir, { recursive: true });
+        const agentAugmentedDir = join23(homedir12(), ".augmented", agent.code_name);
+        mkdirSync10(agentAugmentedDir, { recursive: true });
         const markerJson = JSON.stringify({
           version: 1,
           at: (/* @__PURE__ */ new Date()).toISOString(),
           added: addedChannels
         });
         for (const file of ["slack-channel-add-restart.json", "telegram-channel-add-restart.json"]) {
-          atomicWriteFileSync(join21(agentAugmentedDir, file), markerJson);
+          atomicWriteFileSync(join23(agentAugmentedDir, file), markerJson);
         }
       } catch (err) {
         log(`[hot-reload] channel-add DM-notice marker write failed for '${agent.code_name}' (non-fatal): ${err.message}`);
@@ -11074,7 +11794,7 @@ async function processAgent(agent, agentStates) {
       const behaviourSubset = extractMsTeamsBehaviourSubset(
         msteamsEntry?.config
       );
-      const behaviourHash = createHash13("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
+      const behaviourHash = createHash14("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
       const prevBehaviourHash = agentState.knownMsTeamsBehaviourHashes.get(agent.agent_id);
       const msteamsBehaviourRestrictive = isMsTeamsBehaviourRestrictive(behaviourSubset);
       const behaviourDecision = decideSenderPolicyRestart({
@@ -11130,7 +11850,7 @@ async function processAgent(agent, agentStates) {
       const slackBehaviourSubset = extractSlackBehaviourSubset(
         slackEntry?.config
       );
-      const slackBehaviourHash = createHash13("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
+      const slackBehaviourHash = createHash14("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
       const prevSlackBehaviourHash = agentState.knownSlackBehaviourHashes.get(agent.agent_id);
       const slackBehaviourRestrictive = isSlackBehaviourRestrictive(slackBehaviourSubset);
       const slackBehaviourDecision = decideSenderPolicyRestart({
@@ -11187,24 +11907,24 @@ async function processAgent(agent, agentStates) {
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? DEFAULT_FRAMEWORK) === "claude-code") {
     try {
       const agentProvisionDir = agentDir;
-      const projectDir = join21(homedir11(), ".augmented", agent.code_name, "project");
-      mkdirSync8(agentProvisionDir, { recursive: true });
-      mkdirSync8(projectDir, { recursive: true });
-      const provisionMcpPath = join21(agentProvisionDir, ".mcp.json");
-      const projectMcpPath = join21(projectDir, ".mcp.json");
+      const projectDir = join23(homedir12(), ".augmented", agent.code_name, "project");
+      mkdirSync10(agentProvisionDir, { recursive: true });
+      mkdirSync10(projectDir, { recursive: true });
+      const provisionMcpPath = join23(agentProvisionDir, ".mcp.json");
+      const projectMcpPath = join23(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
       try {
-        mcpConfig = JSON.parse(readFileSync18(provisionMcpPath, "utf-8"));
+        mcpConfig = JSON.parse(readFileSync19(provisionMcpPath, "utf-8"));
         if (!mcpConfig.mcpServers) mcpConfig.mcpServers = {};
       } catch {
       }
-      const localDirectChatChannel = join21(homedir11(), ".augmented", "_mcp", "direct-chat-channel.js");
+      const localDirectChatChannel = join23(homedir12(), ".augmented", "_mcp", "direct-chat-channel.js");
       const directChatTeamSettings = refreshData.team?.settings;
       const directChatTz = (() => {
         const tz = directChatTeamSettings?.["timezone"];
         return typeof tz === "string" && tz.trim() !== "" ? tz.trim() : void 0;
       })();
-      if (existsSync12(localDirectChatChannel)) {
+      if (existsSync13(localDirectChatChannel)) {
         const directChatEnv = {
           AGT_HOST: requireHost(),
           // ENG-5901 Track D: templated — the manager exports the real
@@ -11224,7 +11944,7 @@ async function processAgent(agent, agentStates) {
           // ~/.augmented/<codeName>/.current-turn-initiator.json. Note getAgentDir
           // returns the agent root (NOT the /provision subdir `agentDir` points at),
           // so it byte-matches the broker readers' path.
-          AGT_TURN_INITIATOR_FILE: join21(
+          AGT_TURN_INITIATOR_FILE: join23(
             frameworkAdapter.getAgentDir(agent.code_name),
             ".current-turn-initiator.json"
           )
@@ -11244,10 +11964,10 @@ async function processAgent(agent, agentStates) {
           log(`Channel credentials written for '${agent.code_name}/direct-chat'`);
         }
       }
-      const staleChannelsPath = join21(projectDir, ".mcp-channels.json");
-      if (existsSync12(staleChannelsPath)) {
+      const staleChannelsPath = join23(projectDir, ".mcp-channels.json");
+      if (existsSync13(staleChannelsPath)) {
         try {
-          rmSync4(staleChannelsPath, { force: true });
+          rmSync5(staleChannelsPath, { force: true });
         } catch {
         }
       }
@@ -11334,7 +12054,7 @@ async function processAgent(agent, agentStates) {
     }
     if (hostFlagStore().getBoolean("connectivity-probe")) {
       try {
-        const probeProjectDir = join21(homedir11(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join23(homedir12(), ".augmented", agent.code_name, "project");
         await runAgentConnectivityProbes(agent, integrations, probeProjectDir);
       } catch (err) {
         log(`Connectivity probe failed for '${agent.code_name}': ${err.message}`);
@@ -11345,7 +12065,7 @@ async function processAgent(agent, agentStates) {
       const forceDue = attemptsLeft > 0;
       let probeRan = false;
       try {
-        const probeProjectDir = join21(homedir11(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join23(homedir12(), ".augmented", agent.code_name, "project");
         probeRan = await runAgentSessionToolBindProbes(agent, integrations, probeProjectDir, { forceDue });
       } catch (err) {
         log(`Session-tool-bind probe failed for '${agent.code_name}': ${err.message}`);
@@ -11358,9 +12078,9 @@ async function processAgent(agent, agentStates) {
     }
     if (frameworkAdapter.removeMcpServer && frameworkAdapter.getMcpPath) {
       const mcpPath = frameworkAdapter.getMcpPath(agent.code_name);
-      if (mcpPath && existsSync12(mcpPath)) {
+      if (mcpPath && existsSync13(mcpPath)) {
         try {
-          const cfg = JSON.parse(readFileSync18(mcpPath, "utf-8"));
+          const cfg = JSON.parse(readFileSync19(mcpPath, "utf-8"));
           const expectedRemoteKeys = new Set(
             integrations.map((i) => i.definition_id)
           );
@@ -11385,11 +12105,11 @@ async function processAgent(agent, agentStates) {
         recordConfigChurnEvent(agent.agent_id, agent.code_name, FLAP_CHANNEL_INTEGRATIONS, intMembership);
       }
       if (intHash !== prevIntHash) {
-        const projectDir = join21(homedir11(), ".augmented", agent.code_name, "project");
-        const envIntPath = join21(projectDir, ".env.integrations");
+        const projectDir = join23(homedir12(), ".augmented", agent.code_name, "project");
+        const envIntPath = join23(projectDir, ".env.integrations");
         let preWriteEnv;
         try {
-          preWriteEnv = readFileSync18(envIntPath, "utf-8");
+          preWriteEnv = readFileSync19(envIntPath, "utf-8");
         } catch {
           preWriteEnv = void 0;
         }
@@ -11401,9 +12121,9 @@ async function processAgent(agent, agentStates) {
         let rotationHandled = true;
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
-            const projectMcpPath = join21(projectDir, ".mcp.json");
-            const postWriteEnv = readFileSync18(envIntPath, "utf-8");
-            const mcpContent = readFileSync18(projectMcpPath, "utf-8");
+            const projectMcpPath = join23(projectDir, ".mcp.json");
+            const postWriteEnv = readFileSync19(envIntPath, "utf-8");
+            const mcpContent = readFileSync19(projectMcpPath, "utf-8");
             const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
             const mcpJsonForReap = JSON.parse(mcpContent);
             const affectedServerKeys = findMcpServersUsingVars(mcpJsonForReap, changedVars);
@@ -11480,10 +12200,10 @@ async function processAgent(agent, agentStates) {
           desiredEntries.push({ serverId, url, headers: mcpHeaders, name: tk.toolkit_name });
         }
         const hashBasis = desiredEntries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => {
-          const headersHash = createHash13("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
+          const headersHash = createHash14("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
           return `${e.serverId}|${e.url}|${headersHash}`;
         }).join("\n");
-        const mcpHash = createHash13("sha256").update(hashBasis).digest("hex").slice(0, 16);
+        const mcpHash = createHash14("sha256").update(hashBasis).digest("hex").slice(0, 16);
         const prevMcpHash = agentState.knownManagedMcpHashes.get(agent.agent_id);
         const structureHash = managedMcpStructureHash(desiredEntries);
         const prevStructureHash = agentState.knownManagedMcpStructure.get(agent.agent_id);
@@ -11498,15 +12218,15 @@ async function processAgent(agent, agentStates) {
         if (mcpHash !== prevMcpHash) {
           for (const e of desiredEntries) {
             frameworkAdapter.writeMcpServer(agent.code_name, e.serverId, { url: e.url, headers: e.headers });
-            const urlHash = createHash13("sha256").update(e.url).digest("hex").slice(0, 12);
+            const urlHash = createHash14("sha256").update(e.url).digest("hex").slice(0, 12);
             log(`[managed-toolkit] ${agent.code_name}: wrote '${e.name}' (serverId=${e.serverId}, url_hash=${urlHash})`);
           }
           if (frameworkAdapter.removeMcpServer && frameworkAdapter.getMcpPath) {
             const mcpPath = frameworkAdapter.getMcpPath(agent.code_name);
             if (mcpPath) {
               try {
-                const { readFileSync: readFileSync19 } = await import("fs");
-                const mcpConfig = JSON.parse(readFileSync19(mcpPath, "utf-8"));
+                const { readFileSync: readFileSync20 } = await import("fs");
+                const mcpConfig = JSON.parse(readFileSync20(mcpPath, "utf-8"));
                 if (mcpConfig.mcpServers) {
                   for (const key of Object.keys(mcpConfig.mcpServers)) {
                     if (isManagedMcpServerKey(key) && !expectedServerIds.has(key)) {
@@ -11607,7 +12327,7 @@ async function processAgent(agent, agentStates) {
     if (frameworkAdapter.installSkillFiles) {
       const currentIntegrationSkillIds = /* @__PURE__ */ new Set();
       const installedIntegrationSkills = [];
-      const { createHash: createHash14 } = await import("crypto");
+      const { createHash: createHash15 } = await import("crypto");
       const refreshAny = refreshData;
       const contexts = refreshAny.integration_contexts ?? refreshAny.plugin_contexts ?? [];
       const contextBySlug = /* @__PURE__ */ new Map();
@@ -11636,7 +12356,7 @@ async function processAgent(agent, agentStates) {
             )
           }));
           const bundle = buildIntegrationBundle(renderedScopes);
-          const contentHash = createHash14("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
+          const contentHash = createHash15("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
           const hashKey = `plugin-skill:${agent.agent_id}:${integrationSkillId}`;
           if (agentState.knownSkillHashes.get(hashKey) === contentHash) continue;
           frameworkAdapter.installSkillFiles(agent.code_name, integrationSkillId, bundle.files);
@@ -11648,19 +12368,19 @@ async function processAgent(agent, agentStates) {
         }
       }
       try {
-        const { readdirSync: readdirSync6, rmSync: rmSync5 } = await import("fs");
-        const { homedir: homedir12 } = await import("os");
+        const { readdirSync: readdirSync6, rmSync: rmSync6 } = await import("fs");
+        const { homedir: homedir13 } = await import("os");
         const frameworkId2 = frameworkAdapter.id;
         const candidateSkillDirs = [
           // Claude Code — framework runtime tree
-          join21(homedir12(), ".augmented", agent.code_name, "skills"),
+          join23(homedir13(), ".augmented", agent.code_name, "skills"),
           // Claude Code — project tree
-          join21(homedir12(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+          join23(homedir13(), ".augmented", agent.code_name, "project", ".claude", "skills"),
           // Defensive: legacy provision-side path, not currently an
           // install target but cheap to sweep.
-          join21(agentDir, ".claude", "skills")
+          join23(agentDir, ".claude", "skills")
         ];
-        const existingDirs = candidateSkillDirs.filter((d) => existsSync12(d));
+        const existingDirs = candidateSkillDirs.filter((d) => existsSync13(d));
         const discoveredEntries = /* @__PURE__ */ new Set();
         for (const dir of existingDirs) {
           try {
@@ -11674,9 +12394,9 @@ async function processAgent(agent, agentStates) {
         }
         const removeSkillFolder = (entry, reason) => {
           for (const dir of existingDirs) {
-            const p = join21(dir, entry);
-            if (existsSync12(p)) {
-              rmSync5(p, { recursive: true, force: true });
+            const p = join23(dir, entry);
+            if (existsSync13(p)) {
+              rmSync6(p, { recursive: true, force: true });
             }
           }
           log(`Removed ${reason} '${entry}' for '${agent.code_name}' (framework=${frameworkId2})`);
@@ -11694,7 +12414,7 @@ async function processAgent(agent, agentStates) {
         const sharedSkillsPayload = refreshAny.shared_skills;
         const desiredResolved = globalSkillsPayload !== void 0 || sharedSkillsPayload !== void 0;
         const manifestPath = managedSkillManifestPath(
-          join21(homedir11(), ".augmented", agent.code_name)
+          join23(homedir12(), ".augmented", agent.code_name)
         );
         const prevIds = /* @__PURE__ */ new Set([
           ...agentState.knownGlobalSkillIds.get(agent.agent_id) ?? /* @__PURE__ */ new Set(),
@@ -11703,7 +12423,7 @@ async function processAgent(agent, agentStates) {
         const plan = planGlobalSkillSync(
           [...globalSkillsPayload ?? [], ...sharedSkillsPayload ?? []],
           prevIds,
-          (content) => createHash14("sha256").update(content).digest("hex").slice(0, 12),
+          (content) => createHash15("sha256").update(content).digest("hex").slice(0, 12),
           (skillId) => agentState.knownSkillHashes.get(`global-skill:${agent.agent_id}:${skillId}`),
           { desiredResolved }
         );
@@ -11714,16 +12434,16 @@ async function processAgent(agent, agentStates) {
         }
         if (plan.removes.length) {
           const globalSkillDirs = [
-            join21(homedir11(), ".augmented", agent.code_name, "skills"),
-            join21(homedir11(), ".augmented", agent.code_name, "project", ".claude", "skills"),
-            join21(agentDir, ".claude", "skills")
+            join23(homedir12(), ".augmented", agent.code_name, "skills"),
+            join23(homedir12(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+            join23(agentDir, ".claude", "skills")
           ];
           for (const id of plan.removes) {
             let prunedAny = false;
             for (const dir of globalSkillDirs) {
-              const p = join21(dir, id);
-              if (existsSync12(p) && existsSync12(join21(p, "SKILL.md"))) {
-                rmSync4(p, { recursive: true, force: true });
+              const p = join23(dir, id);
+              if (existsSync13(p) && existsSync13(join23(p, "SKILL.md"))) {
+                rmSync5(p, { recursive: true, force: true });
                 prunedAny = true;
               }
             }
@@ -11754,7 +12474,7 @@ async function processAgent(agent, agentStates) {
           const slug = hook.integration_slug ?? hook.plugin_slug;
           if (!slug) continue;
           try {
-            const scriptHash = createHash14("sha256").update(hook.script).digest("hex").slice(0, 12);
+            const scriptHash = createHash15("sha256").update(hook.script).digest("hex").slice(0, 12);
             const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${slug}:on_install`;
             if (agentState.knownSkillHashes.get(hookKey) === scriptHash) continue;
             const result = await frameworkAdapter.executePluginHook({
@@ -11769,9 +12489,9 @@ async function processAgent(agent, agentStates) {
             } else if (result.timedOut) {
               log(`Integration hook on_install '${slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
             } else {
-              const stderrHash = createHash14("sha256").update(result.stderr).digest("hex").slice(0, 12);
+              const stderrHash = createHash15("sha256").update(result.stderr).digest("hex").slice(0, 12);
               const missingCmd = result.exitCode === 127 ? extractCommandNotFound(result.stderr) : null;
-              const missingCmdHash = missingCmd ? createHash14("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
+              const missingCmdHash = missingCmd ? createHash15("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
               log(
                 `Integration hook on_install '${slug}' exited ${result.exitCode} for '${agent.code_name}' ` + (missingCmdHash ? `[missing_command_hash=${missingCmdHash}] ` : "") + `[stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
               );
@@ -11928,8 +12648,8 @@ async function processAgent(agent, agentStates) {
         const sess = getSessionState(agent.code_name);
         let mcpJsonParsed = null;
         try {
-          const mcpPath = join21(getProjectDir(agent.code_name), ".mcp.json");
-          mcpJsonParsed = JSON.parse(readFileSync18(mcpPath, "utf-8"));
+          const mcpPath = join23(getProjectDir(agent.code_name), ".mcp.json");
+          mcpJsonParsed = JSON.parse(readFileSync19(mcpPath, "utf-8"));
         } catch {
         }
         reapMissingMcpSessions({
@@ -12258,10 +12978,10 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
     }
   }
   const trackedFiles = frameworkAdapter.driftTrackedFiles();
-  if (trackedFiles.length > 0 && existsSync12(agentDir)) {
+  if (trackedFiles.length > 0 && existsSync13(agentDir)) {
     const hashes = /* @__PURE__ */ new Map();
     for (const file of trackedFiles) {
-      const h = hashFile(join21(agentDir, file));
+      const h = hashFile(join23(agentDir, file));
       if (h) hashes.set(file, h);
     }
     agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -12276,7 +12996,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
         refreshData.agent.onboarding_state
       );
       const obStep = obState.step;
-      const markerPath = join21(homedir11(), ".augmented", agent.code_name, "onboarding-drive.json");
+      const markerPath = join23(homedir12(), ".augmented", agent.code_name, "onboarding-drive.json");
       const marker = readOnboardingDriveMarker(markerPath);
       const decision = decideOnboardingDrive(obStep, marker, Date.now(), obState.generation ?? 0);
       if (decision.clearMarker) {
@@ -12341,10 +13061,12 @@ async function ensureOpencodeRuntime(agent, refreshData, agentTimezone) {
   const codeName = agent.code_name;
   if (isOpencodeSessionHealthy(codeName)) {
     await ensureOpencodeSlackIngest({ codeName, agentId: agent.agent_id, log });
+    await ensureOpencodeTelegramIngest({ codeName, agentId: agent.agent_id, log });
     return { decision: "healthy", spawnAttempted: false, sessionHealthyAfter: true };
   }
   stopOpencodeSlackIngest(codeName, log);
-  const opencodeProjectDir = join21(getFramework("opencode").getAgentDir(codeName), "provision");
+  stopOpencodeTelegramIngest(codeName, log);
+  const opencodeProjectDir = join23(getFramework("opencode").getAgentDir(codeName), "provision");
   const openRouterRaw = refreshData.openrouter ?? null;
   const serveEnv = {
     AGT_HOST: requireHost(),
@@ -12384,8 +13106,8 @@ async function ensureOpencodeRuntime(agent, refreshData, agentTimezone) {
 async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
   const projectDir = getProjectDir(codeName);
-  const mcpConfigPath = join21(projectDir, ".mcp.json");
-  const claudeMdPath = join21(projectDir, "CLAUDE.md");
+  const mcpConfigPath = join23(projectDir, ".mcp.json");
+  const claudeMdPath = join23(projectDir, "CLAUDE.md");
   if (restartBreaker.isTripped(codeName)) {
     const trip = restartBreaker.getTrip(codeName);
     return {
@@ -12543,7 +13265,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       const ctx = getLastFailureContext(codeName);
       const recovery = prepareForRespawn(codeName);
       const tailSummary = !ctx.tail ? "" : KNOWN_SAFE_TAIL_SIGNATURES.has(ctx.signature) ? `; last pane output (${PANE_TAIL_PREVIEW_LINES} of ~20 lines):
-${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash13("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
+${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash14("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
       const sigSummary = ctx.signature !== "unknown" ? `; signature=${ctx.signature}` : "";
       const recoverySummary = recovery ? `; recovery=${recovery}` : "";
       log(
@@ -12557,7 +13279,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash13("sha256")
       );
       getHostId().then((hostId) => {
         if (!hostId) return;
-        const paneTailHash = zombie.paneTail ? `sha256:${createHash13("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
+        const paneTailHash = zombie.paneTail ? `sha256:${createHash14("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
         return api.post("/host/events", {
           host_id: hostId,
           agent_code_name: codeName,
@@ -12706,7 +13428,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash13("sha256")
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
   }
-  const stableTasksHash = createHash13("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const stableTasksHash = createHash14("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (stableTasksHash !== prevHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
@@ -12923,7 +13645,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-XWJSAZB4.js");
+        const { collectDiagnostics } = await import("../persistent-session-6ADHOTEG.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName])
@@ -12973,7 +13695,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-XWJSAZB4.js");
+      const { collectDiagnostics } = await import("../persistent-session-6ADHOTEG.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName])
@@ -13258,9 +13980,9 @@ async function processDirectChatMessage(agent, msg) {
     const useDoorbell = hostFlagStore().getBoolean("direct-chat-doorbell") || isolationMode(agent.codeName) === "docker";
     if (useDoorbell) {
       try {
-        const doorbell = directChatDoorbellPath(agent.agentId, homedir11());
-        mkdirSync8(dirname6(doorbell), { recursive: true });
-        writeFileSync9(doorbell, String(Date.now()));
+        const doorbell = directChatDoorbellPath(agent.agentId, homedir12());
+        mkdirSync10(dirname6(doorbell), { recursive: true });
+        writeFileSync11(doorbell, String(Date.now()));
         log(`[direct-chat] Doorbell rung for '${agent.codeName}' (msg=${msg.id}) \u2014 in-session MCP will pull via the cursor`);
         return;
       } catch (err) {
@@ -13368,9 +14090,9 @@ ${formatRunMarker(run_id)}` : KANBAN_CHECK_COMMAND;
   }
   if (run_id) openInjectedRunByCode.set(codeName, run_id);
   try {
-    const doorbell = directChatDoorbellPath(agentId, homedir11());
-    mkdirSync8(dirname6(doorbell), { recursive: true });
-    writeFileSync9(doorbell, String(Date.now()));
+    const doorbell = directChatDoorbellPath(agentId, homedir12());
+    mkdirSync10(dirname6(doorbell), { recursive: true });
+    writeFileSync11(doorbell, String(Date.now()));
   } catch (err) {
     log(`[kanban] doorbell ring failed for '${codeName}': ${err.message} (notice still queued)`);
   }
@@ -13471,7 +14193,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-NUZWSILK.js");
+  } = await import("../claude-pair-runtime-2ZQZVFKF.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -13721,8 +14443,8 @@ function parseMemoryFile(raw, fallbackName) {
   };
 }
 async function syncMemories(agent, configDir, log2) {
-  const projectDir = join21(configDir, agent.code_name, "project");
-  const memoryDir = join21(projectDir, "memory");
+  const projectDir = join23(configDir, agent.code_name, "project");
+  const memoryDir = join23(projectDir, "memory");
   const isFreshSync = pendingFreshMemorySync.has(agent.agent_id);
   if (isFreshSync) {
     log2(`[memory-sync] Fresh-sync requested for '${agent.code_name}' \u2014 pulling DB first`);
@@ -13733,15 +14455,15 @@ async function syncMemories(agent, configDir, log2) {
     }
     pendingFreshMemorySync.delete(agent.agent_id);
   }
-  if (existsSync12(memoryDir)) {
+  if (existsSync13(memoryDir)) {
     const prevHashes = memoryFileHashes.get(agent.agent_id) ?? /* @__PURE__ */ new Map();
     const currentHashes = /* @__PURE__ */ new Map();
     const changedMemories = [];
     for (const file of readdirSync5(memoryDir)) {
       if (!file.endsWith(".md")) continue;
       try {
-        const raw = readFileSync18(join21(memoryDir, file), "utf-8");
-        const fileHash = createHash13("sha256").update(raw).digest("hex").slice(0, 16);
+        const raw = readFileSync19(join23(memoryDir, file), "utf-8");
+        const fileHash = createHash14("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
         const parsed = parseMemoryFile(raw, file.replace(/\.md$/, ""));
@@ -13765,7 +14487,7 @@ async function syncMemories(agent, configDir, log2) {
       } catch (err) {
         for (const mem of changedMemories) {
           for (const [file] of currentHashes) {
-            const parsed = parseMemoryFile(readFileSync18(join21(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
+            const parsed = parseMemoryFile(readFileSync19(join23(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
             if (parsed?.name === mem.name) currentHashes.delete(file);
           }
         }
@@ -13778,29 +14500,29 @@ async function syncMemories(agent, configDir, log2) {
   }
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
-  const localFiles = existsSync12(memoryDir) ? readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
-  const localListHash = createHash13("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
+  const localFiles = existsSync13(memoryDir) ? readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
+  const localListHash = createHash14("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
   try {
     const dbMemories = await api.post("/host/memories", {
       agent_id: agent.agent_id
     });
-    const responseHash = createHash13("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
+    const responseHash = createHash14("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
     if (!force && prevDownload && prevLocalHash === localListHash && lastDownloadHash.get(agent.agent_id) === responseHash) {
       return true;
     }
     lastDownloadHash.set(agent.agent_id, responseHash);
     lastLocalFileHash.set(agent.agent_id, localListHash);
     if (dbMemories.memories?.length) {
-      mkdirSync8(memoryDir, { recursive: true });
+      mkdirSync10(memoryDir, { recursive: true });
       let written = 0;
       let overwritten = 0;
       for (let i = 0; i < dbMemories.memories.length; i++) {
         const mem = dbMemories.memories[i];
         const rawSlug = mem.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "").slice(0, 60);
         const slug = rawSlug || `memory-${i}`;
-        const filePath = join21(memoryDir, `${slug}.md`);
+        const filePath = join23(memoryDir, `${slug}.md`);
         const desired = `---
 name: ${JSON.stringify(mem.name)}
 type: ${mem.type}
@@ -13809,23 +14531,23 @@ description: ${JSON.stringify(mem.content.slice(0, 200))}
 
 ${mem.content}
 `;
-        if (existsSync12(filePath)) {
+        if (existsSync13(filePath)) {
           let existing = "";
           try {
-            existing = readFileSync18(filePath, "utf-8");
+            existing = readFileSync19(filePath, "utf-8");
           } catch {
           }
           if (existing === desired) continue;
-          writeFileSync9(filePath, desired);
+          writeFileSync11(filePath, desired);
           overwritten++;
         } else {
-          writeFileSync9(filePath, desired);
+          writeFileSync11(filePath, desired);
           written++;
         }
       }
       if (written > 0 || overwritten > 0) {
         const updatedFiles = readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort();
-        lastLocalFileHash.set(agent.agent_id, createHash13("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
+        lastLocalFileHash.set(agent.agent_id, createHash14("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
         log2(`Memory download for '${agent.code_name}': wrote ${written} new, overwrote ${overwritten} stale`);
       }
     }
@@ -13836,9 +14558,9 @@ ${mem.content}
   }
 }
 async function cleanupAgentFiles(codeName, agentDir) {
-  if (existsSync12(agentDir)) {
+  if (existsSync13(agentDir)) {
     try {
-      rmSync4(agentDir, { recursive: true, force: true });
+      rmSync5(agentDir, { recursive: true, force: true });
       log(`Removed provision directory for '${codeName}'`);
     } catch (err) {
       log(`Failed to remove provision dir for '${codeName}': ${err.message}`);
@@ -14058,6 +14780,7 @@ async function stopPolling(opts = {}) {
   stopCaffeinate();
   stopRealtimeChat();
   stopAllOpencodeSlackIngests(log);
+  stopAllOpencodeTelegramIngests(log);
   log(formatDrainShutdownLine({ step: "stop-subsystems", elapsedMs: Date.now() - subsysStartedAt }));
   for (const codeName of [...scheduledRunsByCode.keys()]) {
     closeScheduledRunsForCode(codeName, "cancelled", "manager shutdown");
@@ -14072,8 +14795,8 @@ function startManager(opts) {
   config = opts;
   try {
     const stateFile = getStateFile();
-    if (existsSync12(stateFile)) {
-      const raw = readFileSync18(stateFile, "utf-8");
+    if (existsSync13(stateFile)) {
+      const raw = readFileSync19(stateFile, "utf-8");
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.agents)) {
         state6.agents = parsed.agents;
@@ -14100,7 +14823,7 @@ function startManager(opts) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);
   }
   log(
-    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join21(homedir11(), ".augmented", "manager.log")}`
+    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join23(homedir12(), ".augmented", "manager.log")}`
   );
   deployMcpAssets();
   reapOrphanChannelMcps({ log });
@@ -14121,7 +14844,7 @@ async function reapOrphanedClaudePids() {
   const looksLikeClaude = (pid) => {
     if (process.platform !== "linux") return true;
     try {
-      const comm = readFileSync18(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
+      const comm = readFileSync19(`/proc/${pid}/comm`, "utf-8").trim().toLowerCase();
       return comm.includes("claude");
     } catch {
       return false;
@@ -14218,14 +14941,14 @@ function restartRunningChannelMcps(basenames) {
   }
 }
 function deployMcpAssets() {
-  const targetDir = join21(homedir11(), ".augmented", "_mcp");
-  mkdirSync8(targetDir, { recursive: true });
+  const targetDir = join23(homedir12(), ".augmented", "_mcp");
+  mkdirSync10(targetDir, { recursive: true });
   const moduleDir = dirname6(fileURLToPath(import.meta.url));
   let mcpSourceDir = "";
   let dir = moduleDir;
   for (let i = 0; i < 6; i++) {
-    const candidate = join21(dir, "dist", "mcp");
-    if (existsSync12(join21(candidate, "index.js"))) {
+    const candidate = join23(dir, "dist", "mcp");
+    if (existsSync13(join23(candidate, "index.js"))) {
       mcpSourceDir = candidate;
       break;
     }
@@ -14240,8 +14963,8 @@ function deployMcpAssets() {
   const changedBasenames = [];
   const fileHash = (p) => {
     try {
-      if (!existsSync12(p)) return null;
-      return createHash13("sha256").update(readFileSync18(p)).digest("hex");
+      if (!existsSync13(p)) return null;
+      return createHash14("sha256").update(readFileSync19(p)).digest("hex");
     } catch {
       return null;
     }
@@ -14305,9 +15028,9 @@ function deployMcpAssets() {
     // needs restarting to pick up a token rotation.
     "xero.js"
   ]) {
-    const src = join21(mcpSourceDir, file);
-    const dst = join21(targetDir, file);
-    if (!existsSync12(src)) continue;
+    const src = join23(mcpSourceDir, file);
+    const dst = join23(targetDir, file);
+    if (!existsSync13(src)) continue;
     const before = fileHash(dst);
     try {
       copyFileSync(src, dst);
@@ -14324,23 +15047,23 @@ function deployMcpAssets() {
     log(`[manager] Bundle(s) updated: ${changedBasenames.join(", ")} \u2014 signalling running instances to restart`);
     restartRunningChannelMcps(changedBasenames);
   }
-  const localMcpPath = join21(targetDir, "index.js");
+  const localMcpPath = join23(targetDir, "index.js");
   try {
-    const agentsDir = join21(homedir11(), ".augmented", "agents");
-    if (existsSync12(agentsDir)) {
+    const agentsDir = join23(homedir12(), ".augmented", "agents");
+    if (existsSync13(agentsDir)) {
       for (const entry of readdirSync5(agentsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         for (const subdir of ["provision", "project"]) {
-          const mcpJsonPath = join21(agentsDir, entry.name, subdir, ".mcp.json");
+          const mcpJsonPath = join23(agentsDir, entry.name, subdir, ".mcp.json");
           try {
-            const raw = readFileSync18(mcpJsonPath, "utf-8");
+            const raw = readFileSync19(mcpJsonPath, "utf-8");
             if (!raw.includes("@integrity-labs/augmented-mcp")) continue;
             const mcpConfig = JSON.parse(raw);
             const augServer = mcpConfig.mcpServers?.["augmented"];
             if (!augServer) continue;
             augServer.command = "node";
             augServer.args = [localMcpPath];
-            writeFileSync9(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
+            writeFileSync11(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
             log(`[manager] Patched ${entry.name}/${subdir}/.mcp.json: npx \u2192 node`);
           } catch {
           }