@integrity-labs/agt-cli 0.28.383 → 0.28.385

package/dist/{claude-pair-runtime-PERAQ2PL.js → claude-pair-runtime-OIK6HKPS.js}

@@ -100,7 +100,7 @@ async function spawnPairSession(session) {
     return { ok: true };
   } catch {
   }
-  const { resolveClaudeBinary } = await import("./persistent-session-4LAOXUQD.js");
+  const { resolveClaudeBinary } = await import("./persistent-session-MDQVHXKX.js");
   const claudeBin = resolveClaudeBinary();
   const pairEnv = {
     ...process.env,
@@ -373,4 +373,4 @@ export {
   startClaudePair,
   submitClaudePairCode
 };
-//# sourceMappingURL=claude-pair-runtime-PERAQ2PL.js.map
+//# sourceMappingURL=claude-pair-runtime-OIK6HKPS.js.map

package/dist/lib/manager-worker.js

@@ -43,7 +43,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-RBXCFAWL.js";
+} from "../chunk-P3SY6KTF.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -145,16 +145,16 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-Q433LFRY.js";
+} from "../chunk-MQHDPJZD.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
 
 // src/lib/manager-worker.ts
-import { createHash as createHash14 } from "crypto";
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync11, mkdirSync as mkdirSync9, existsSync as existsSync11, rmSync as rmSync5, readdirSync as readdirSync5, statSync as statSync4, copyFileSync } from "fs";
+import { createHash as createHash13 } from "crypto";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync11, mkdirSync as mkdirSync8, existsSync as existsSync11, rmSync as rmSync5, readdirSync as readdirSync5, statSync as statSync4, copyFileSync } from "fs";
 import { execFileSync as syncExecFile } from "child_process";
-import { join as join21, dirname as dirname6, delimiter as pathDelimiter } from "path";
+import { join as join21, dirname as dirname5, delimiter as pathDelimiter } from "path";
 import { homedir as homedir10 } from "os";
 import { fileURLToPath } from "url";
 
@@ -4987,35 +4987,10 @@ function closeScheduledRunsForCode(codeName, outcome, reason) {
 }
 
 // src/lib/manager/scheduler/kanban-route.ts
-import { createHash as createHash9 } from "crypto";
-import { writeFileSync as writeFileSync8, renameSync, mkdirSync as mkdirSync6 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join17, dirname as dirname5 } from "path";
-
-// src/lib/manager/scheduler/notify.ts
 import { createHash as createHash8 } from "crypto";
-async function enqueueScheduledTaskNotice(opts) {
-  try {
-    const res = await api.post(
-      "/host/scheduled-task/notify",
-      {
-        agent_id: opts.agentId,
-        task_id: opts.taskId,
-        card_id: opts.cardId,
-        content: opts.content,
-        run_id: opts.runId ?? void 0
-      }
-    );
-    return res.ok === true;
-  } catch (err) {
-    const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash8("sha256").update(errText).digest("hex").slice(0, 12);
-    log(
-      `[scheduled-kanban] notice enqueue failed for agent_id=${opts.agentId} task_id=${opts.taskId} error_id=${errId}`
-    );
-    return false;
-  }
-}
+import { writeFileSync as writeFileSync8, renameSync } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join17 } from "path";
 
 // src/lib/manager/delivery/scheduled-output.ts
 async function deliverScheduledTaskOutput(agentCodeName, agentId, rawTarget, body, taskId) {
@@ -5361,24 +5336,22 @@ async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt) {
 ` + formatRunMarker(run_id) : `A scheduled task just fired and it is now a card on YOUR board that YOU work. The schedule only controls WHEN this card arrives, not who executes it: nothing else runs it for you, so do the work yourself now. Card: id=${kanban_item_id} title=${JSON.stringify(task.name)}. Call kanban_move("${kanban_item_id}", "in_progress"), do the work described on the card, then write the finished result onto the card and mark it done. Do NOT send, post, or message the result to anyone yourself \u2014 the result you write on the card IS the message that will be delivered to the user; delivery happens automatically from the card.
 ` + suppressionTeaching + formatRunMarker(run_id);
   stampScheduledTurnMarker(codeName, task.taskId, resolveScheduledSlackTarget(task));
-  const enqueued = await enqueueScheduledTaskNotice({
-    agentId,
-    taskId: task.taskId,
-    cardId: kanban_item_id,
-    content: nudge,
-    runId: run_id
-  });
-  if (!enqueued) {
-    log(`[scheduled-kanban] durable nudge enqueue failed for task '${task.name}' on '${codeName}' - closing card + run`);
-    void finishRun(run_id, "failed", { outcomeMessage: "scheduled-task durable nudge enqueue failed", completeKanbanItemId: kanban_item_id });
-    return false;
-  }
+  let injectStatus;
   try {
-    const doorbell = directChatDoorbellPath(agentId, homedir7());
-    mkdirSync6(dirname5(doorbell), { recursive: true });
-    writeFileSync8(doorbell, String(Date.now()));
+    injectStatus = await injectMessageWithStatus(codeName, "task", nudge, { task_name: "scheduled-task-do-now" }, log);
   } catch (err) {
-    log(`[scheduled-kanban] doorbell ring failed for '${codeName}': ${err.message} (notice still queued)`);
+    log(`[scheduled-kanban] nudge injection threw for task '${task.name}' on '${codeName}': ${err.message} \u2014 closing card + falling back to claude -p`);
+    void finishRun(run_id, "failed", { outcomeMessage: "scheduled-task nudge delivery threw", completeKanbanItemId: kanban_item_id });
+    return false;
+  }
+  const { delivered, fallbackUsed } = injectStatus;
+  if (!delivered && !fallbackUsed) {
+    log(`[scheduled-kanban] nudge delivery failed for task '${task.name}' on '${codeName}' \u2014 closing card + falling back to claude -p`);
+    void finishRun(run_id, "failed", { outcomeMessage: "scheduled-task nudge delivery failed", completeKanbanItemId: kanban_item_id });
+    return false;
+  }
+  if (!delivered && fallbackUsed) {
+    log(`[scheduled-kanban] nudge sent via send-keys (unverified) for task '${task.name}' on '${codeName}' \u2014 proceeding without oneshot fallback`);
   }
   trackScheduledRun(codeName, kanban_item_id, run_id);
   log(`[scheduled-kanban] Routed task '${task.name}' for '${codeName}' via todo card ${kanban_item_id} run_id=${run_id}`);
@@ -5423,24 +5396,24 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
       const assertion = parseDeliverAssertion(rawOutput);
       if (!assertion.deliver) {
         const trimmed = (rawOutput ?? "").trim();
-        const outputHash = trimmed.length === 0 ? "empty" : createHash9("sha256").update(trimmed).digest("hex").slice(0, 12);
+        const outputHash = trimmed.length === 0 ? "empty" : createHash8("sha256").update(trimmed).digest("hex").slice(0, 12);
         log(`[claude-scheduler] Suppressed by delivery_policy=conditional for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 ${assertion.vacuous ? "deliver marker had a vacuous reason" : "no deliver marker"}; output_len=${trimmed.length} output_hash=${outputHash}`);
         if (delivery?.mode === "announce" && delivery.to) {
           await reportDeliveryStatus(agentId, delivery.taskId, { status: "skipped", error_code: "SUPPRESSED_BY_POLICY" });
         }
         return { ok: true };
       }
-      const reasonHash = createHash9("sha256").update(assertion.reason ?? "").digest("hex").slice(0, 12);
+      const reasonHash = createHash8("sha256").update(assertion.reason ?? "").digest("hex").slice(0, 12);
       log(`[claude-scheduler] Delivering conditional run for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 agent asserted a concrete trigger (reason_len=${(assertion.reason ?? "").length} reason_hash=${reasonHash})`);
       rawOutput = assertion.deliverable;
     }
     const classification = classifyOutput(rawOutput);
     if (classification.action === "suppress") {
       const trimmed = (rawOutput ?? "").trim();
-      const outputHash = trimmed.length === 0 ? "empty" : createHash9("sha256").update(trimmed).digest("hex").slice(0, 12);
+      const outputHash = trimmed.length === 0 ? "empty" : createHash8("sha256").update(trimmed).digest("hex").slice(0, 12);
       log(`[claude-scheduler] Suppressing delivery for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 output_len=${trimmed.length} output_hash=${outputHash}`);
       if (classification.suppressedNotes) {
-        const notesHash = createHash9("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
+        const notesHash = createHash8("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
         log(`[claude-scheduler] Suppressed notes for '${codeName}' (task=${delivery?.taskId ?? "n/a"}) \u2014 notes_len=${classification.suppressedNotes.length} notes_hash=${notesHash}`);
       }
       if (delivery?.mode === "announce" && delivery.to) {
@@ -5506,7 +5479,7 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
 }
 
 // src/lib/manager/scheduler/execution.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { homedir as homedir8 } from "os";
 import { join as join18 } from "path";
 function claudePidFilePath() {
@@ -5530,10 +5503,10 @@ function unregisterClaudeSpawn(pid) {
 }
 async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
-  const stableTasksHash = createHash10("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
-  const boardHash = boardItems.length > 0 ? createHash10("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
+  const stableTasksHash = createHash9("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const boardHash = boardItems.length > 0 ? createHash9("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
   const resolvedModels = resolveModelChain(refreshData);
-  const modelsHash = createHash10("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
+  const modelsHash = createHash9("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
   const combinedHash = `${stableTasksHash}:${boardHash}:${modelsHash}`;
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (combinedHash !== prevHash) {
@@ -5571,7 +5544,7 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
 }
 
 // src/lib/opencode-slack-ingest.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 
 // ../../packages/core/dist/channels/slack-rich-text.js
 var MAX_DEPTH = 12;
@@ -6507,7 +6480,7 @@ function startSlackIngest(config2) {
 // src/lib/opencode-slack-ingest.ts
 var ingests = /* @__PURE__ */ new Map();
 function fingerprint(params) {
-  return createHash11("sha256").update(
+  return createHash10("sha256").update(
     JSON.stringify({
       appToken: params.appToken,
       botToken: params.botToken,
@@ -6588,7 +6561,7 @@ function stopAllOpencodeSlackIngests(log2) {
 }
 
 // src/lib/manager/opencode-scheduler.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 var MAX_OPENCODE_SCHED_CONCURRENCY = 2;
 var opencodeSchedulerStates = /* @__PURE__ */ new Map();
 var inFlightOpencodeTasks = /* @__PURE__ */ new Set();
@@ -6602,7 +6575,7 @@ function shouldDeliver(task, reply) {
 }
 async function syncAndCheckOpencodeScheduler(agent, tasks, refreshData) {
   const codeName = agent.code_name;
-  const tasksHash = createHash12("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const tasksHash = createHash11("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   if (knownOpencodeTaskHashes.get(agent.agent_id) !== tasksHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
     const state8 = syncTasksToScheduler(codeName, agent.agent_id, taskInputs);
@@ -6680,8 +6653,8 @@ async function fireOpencodeScheduledTask(agent, task) {
 }
 
 // src/lib/opencode-telegram-ingest.ts
-import { createHash as createHash13 } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync15, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync9 } from "fs";
+import { createHash as createHash12 } from "crypto";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync15, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync9 } from "fs";
 import { randomUUID } from "crypto";
 import { join as join19 } from "path";
 
@@ -7216,7 +7189,7 @@ function anySignal(signals) {
 // src/lib/opencode-telegram-ingest.ts
 var ingests2 = /* @__PURE__ */ new Map();
 function fingerprint2(params) {
-  return createHash13("sha256").update(
+  return createHash12("sha256").update(
     JSON.stringify({
       botToken: params.botToken,
       allowedChats: [...params.allowedChats].sort(),
@@ -7258,7 +7231,7 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
       if (!filePath || !dir) return;
       const tmpPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
       try {
-        mkdirSync7(dir, { recursive: true, mode: 448 });
+        mkdirSync6(dir, { recursive: true, mode: 448 });
         writeFileSync9(
           tmpPath,
           JSON.stringify({
@@ -7490,7 +7463,7 @@ function partitionActionableByPoison(actionable, states, config2) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync8, readdirSync as readdirSync4, readFileSync as readFileSync16, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readdirSync as readdirSync4, readFileSync as readFileSync16, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "fs";
 import { homedir as homedir9 } from "os";
 import { join as join20 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
@@ -8234,6 +8207,7 @@ function hasRevokedResiduals(state7) {
   return state7.gatewayRunning || state7.portAllocated || state7.provisionDirExists;
 }
 var pendingSessionRestarts = /* @__PURE__ */ new Map();
+var lastRestartWasExternal = /* @__PURE__ */ new Map();
 var pendingRestartVerifications = /* @__PURE__ */ new Map();
 var restartBreaker = new RestartBreaker();
 var reportedTrips = /* @__PURE__ */ new Map();
@@ -8772,7 +8746,7 @@ var sessionLaunchManagedStructure = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
     const raw = readFileSync17(join21(projectDir, ".mcp.json"), "utf-8");
-    return createHash14("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
+    return createHash13("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
   }
@@ -8934,6 +8908,7 @@ function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason, gate
   }
   cancelPendingSessionRestart(codeName);
   stopPersistentSession(codeName, log);
+  lastRestartWasExternal.set(codeName, gateReason !== "mcp-presence-reaper");
   runningMcpHashes.delete(codeName);
   runningMcpServerKeys.delete(codeName);
   runningChannelSecretHashes.delete(codeName);
@@ -9120,7 +9095,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.383" : "dev";
+var agtCliVersion = true ? "0.28.385" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -9215,7 +9190,7 @@ async function ensureToolkitCli(toolkitSlug) {
         toolkitCliEnsured.add(toolkitSlug);
         return;
       }
-      brewBinDir = dirname6(brewPath);
+      brewBinDir = dirname5(brewPath);
       const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
       log(`[toolkit-install] ${toolkitSlug}: installing via brew (${pkg})\u2026`);
       if (isRoot) {
@@ -9425,7 +9400,7 @@ function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
     }
     if (settings.channelsEnabled === true) return "ok";
     settings.channelsEnabled = true;
-    mkdirSync9(dirname6(path), { recursive: true });
+    mkdirSync8(dirname5(path), { recursive: true });
     writeFileSync11(path, `${JSON.stringify(settings, null, 2)}
 `);
     log(`[managed-settings] set channelsEnabled:true in ${path} (ENG-5786 \u2014 unblocks Claude Code channels)`);
@@ -9521,7 +9496,7 @@ async function ensureFrameworkBinary(frameworkId) {
       log(`Claude Code install failed: ${err.message}`);
       return;
     }
-    const brewBinDir = dirname6(brewPath);
+    const brewBinDir = dirname5(brewPath);
     if (!process.env.PATH?.split(":").includes(brewBinDir)) {
       process.env.PATH = `${brewBinDir}:${process.env.PATH ?? ""}`;
     }
@@ -9955,7 +9930,7 @@ function ensureEvalEmptyMcpConfig() {
   if (evalEmptyMcpConfigPath && existsSync11(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
   const dir = join21(homedir10(), ".augmented");
   try {
-    mkdirSync9(dir, { recursive: true });
+    mkdirSync8(dir, { recursive: true });
   } catch {
   }
   const p = join21(dir, ".eval-empty-mcp.json");
@@ -10249,7 +10224,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-4LAOXUQD.js");
+      const { collectDiagnostics } = await import("../persistent-session-MDQVHXKX.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames)
@@ -10348,7 +10323,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-4LAOXUQD.js");
+      const { collectDiagnostics } = await import("../persistent-session-MDQVHXKX.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames) : void 0;
       let tailscaleHostname;
@@ -10378,7 +10353,7 @@ async function pollCycle() {
         claudeAuth = await detectClaudeAuth();
       } catch (err) {
         const errText = err instanceof Error ? err.message : String(err);
-        const errId = createHash14("sha256").update(errText).digest("hex").slice(0, 12);
+        const errId = createHash13("sha256").update(errText).digest("hex").slice(0, 12);
         log(`Claude auth detection failed (error_id=${errId})`);
       }
       const hostHasClaudeCode = state6.agents.some(
@@ -10503,7 +10478,7 @@ async function pollCycle() {
       const {
         collectResponsivenessProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-XLANB346.js");
+      } = await import("../responsiveness-probe-CG7XM7GL.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -10535,7 +10510,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-XLANB346.js");
+        } = await import("../responsiveness-probe-CG7XM7GL.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-HYOOQV4A.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -11337,7 +11312,7 @@ async function processAgent(agent, agentStates) {
   try {
     const artifacts = generateArtifacts(agent, refreshData, frameworkAdapter);
     const changedFiles = [];
-    mkdirSync9(agentDir, { recursive: true });
+    mkdirSync8(agentDir, { recursive: true });
     for (const artifact of artifacts) {
       const filePath = join21(agentDir, artifact.relativePath);
       let existingHash;
@@ -11415,7 +11390,7 @@ async function processAgent(agent, agentStates) {
       log(`${verb} '${agent.code_name}': ${fileNames}`);
       for (const file of changedFiles) {
         const filePath = join21(agentDir, file.relativePath);
-        mkdirSync9(dirname6(filePath), { recursive: true });
+        mkdirSync8(dirname5(filePath), { recursive: true });
         if (file.relativePath === ".mcp.json") {
           safeWriteJsonAtomic(filePath, file.content, { mode: 384 });
         } else {
@@ -11747,7 +11722,7 @@ async function processAgent(agent, agentStates) {
     const writeDmNoticeMarkers = isChannelAddRestart ? () => {
       try {
         const agentAugmentedDir = join21(homedir10(), ".augmented", agent.code_name);
-        mkdirSync9(agentAugmentedDir, { recursive: true });
+        mkdirSync8(agentAugmentedDir, { recursive: true });
         const markerJson = JSON.stringify({
           version: 1,
           at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -11830,7 +11805,7 @@ async function processAgent(agent, agentStates) {
       const behaviourSubset = extractMsTeamsBehaviourSubset(
         msteamsEntry?.config
       );
-      const behaviourHash = createHash14("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
+      const behaviourHash = createHash13("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
       const prevBehaviourHash = agentState.knownMsTeamsBehaviourHashes.get(agent.agent_id);
       const msteamsBehaviourRestrictive = isMsTeamsBehaviourRestrictive(behaviourSubset);
       const behaviourDecision = decideSenderPolicyRestart({
@@ -11886,7 +11861,7 @@ async function processAgent(agent, agentStates) {
       const slackBehaviourSubset = extractSlackBehaviourSubset(
         slackEntry?.config
       );
-      const slackBehaviourHash = createHash14("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
+      const slackBehaviourHash = createHash13("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
       const prevSlackBehaviourHash = agentState.knownSlackBehaviourHashes.get(agent.agent_id);
       const slackBehaviourRestrictive = isSlackBehaviourRestrictive(slackBehaviourSubset);
       const slackBehaviourDecision = decideSenderPolicyRestart({
@@ -11944,8 +11919,8 @@ async function processAgent(agent, agentStates) {
     try {
       const agentProvisionDir = agentDir;
       const projectDir = join21(homedir10(), ".augmented", agent.code_name, "project");
-      mkdirSync9(agentProvisionDir, { recursive: true });
-      mkdirSync9(projectDir, { recursive: true });
+      mkdirSync8(agentProvisionDir, { recursive: true });
+      mkdirSync8(projectDir, { recursive: true });
       const provisionMcpPath = join21(agentProvisionDir, ".mcp.json");
       const projectMcpPath = join21(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
@@ -12270,10 +12245,10 @@ async function processAgent(agent, agentStates) {
           desiredEntries.push({ serverId, url, headers: mcpHeaders, name: tk.toolkit_name });
         }
         const hashBasis = desiredEntries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => {
-          const headersHash = createHash14("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
+          const headersHash = createHash13("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
           return `${e.serverId}|${e.url}|${headersHash}`;
         }).join("\n");
-        const mcpHash = createHash14("sha256").update(hashBasis).digest("hex").slice(0, 16);
+        const mcpHash = createHash13("sha256").update(hashBasis).digest("hex").slice(0, 16);
         const prevMcpHash = agentState.knownManagedMcpHashes.get(agent.agent_id);
         const structureHash = managedMcpStructureHash(desiredEntries);
         const prevStructureHash = agentState.knownManagedMcpStructure.get(agent.agent_id);
@@ -12288,7 +12263,7 @@ async function processAgent(agent, agentStates) {
         if (mcpHash !== prevMcpHash) {
           for (const e of desiredEntries) {
             frameworkAdapter.writeMcpServer(agent.code_name, e.serverId, { url: e.url, headers: e.headers });
-            const urlHash = createHash14("sha256").update(e.url).digest("hex").slice(0, 12);
+            const urlHash = createHash13("sha256").update(e.url).digest("hex").slice(0, 12);
             log(`[managed-toolkit] ${agent.code_name}: wrote '${e.name}' (serverId=${e.serverId}, url_hash=${urlHash})`);
           }
           if (frameworkAdapter.removeMcpServer && frameworkAdapter.getMcpPath) {
@@ -12397,7 +12372,7 @@ async function processAgent(agent, agentStates) {
     if (frameworkAdapter.installSkillFiles) {
       const currentIntegrationSkillIds = /* @__PURE__ */ new Set();
       const installedIntegrationSkills = [];
-      const { createHash: createHash15 } = await import("crypto");
+      const { createHash: createHash14 } = await import("crypto");
       const refreshAny = refreshData;
       const contexts = refreshAny.integration_contexts ?? refreshAny.plugin_contexts ?? [];
       const contextBySlug = /* @__PURE__ */ new Map();
@@ -12426,7 +12401,7 @@ async function processAgent(agent, agentStates) {
             )
           }));
           const bundle = buildIntegrationBundle(renderedScopes);
-          const contentHash = createHash15("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
+          const contentHash = createHash14("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
           const hashKey = `plugin-skill:${agent.agent_id}:${integrationSkillId}`;
           if (agentState.knownSkillHashes.get(hashKey) === contentHash) continue;
           frameworkAdapter.installSkillFiles(agent.code_name, integrationSkillId, bundle.files);
@@ -12493,7 +12468,7 @@ async function processAgent(agent, agentStates) {
         const plan = planGlobalSkillSync(
           [...globalSkillsPayload ?? [], ...sharedSkillsPayload ?? []],
           prevIds,
-          (content) => createHash15("sha256").update(content).digest("hex").slice(0, 12),
+          (content) => createHash14("sha256").update(content).digest("hex").slice(0, 12),
           (skillId) => agentState.knownSkillHashes.get(`global-skill:${agent.agent_id}:${skillId}`),
           { desiredResolved }
         );
@@ -12544,7 +12519,7 @@ async function processAgent(agent, agentStates) {
           const slug = hook.integration_slug ?? hook.plugin_slug;
           if (!slug) continue;
           try {
-            const scriptHash = createHash15("sha256").update(hook.script).digest("hex").slice(0, 12);
+            const scriptHash = createHash14("sha256").update(hook.script).digest("hex").slice(0, 12);
             const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${slug}:on_install`;
             if (agentState.knownSkillHashes.get(hookKey) === scriptHash) continue;
             const result = await frameworkAdapter.executePluginHook({
@@ -12559,9 +12534,9 @@ async function processAgent(agent, agentStates) {
             } else if (result.timedOut) {
               log(`Integration hook on_install '${slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
             } else {
-              const stderrHash = createHash15("sha256").update(result.stderr).digest("hex").slice(0, 12);
+              const stderrHash = createHash14("sha256").update(result.stderr).digest("hex").slice(0, 12);
               const missingCmd = result.exitCode === 127 ? extractCommandNotFound(result.stderr) : null;
-              const missingCmdHash = missingCmd ? createHash15("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
+              const missingCmdHash = missingCmd ? createHash14("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
               log(
                 `Integration hook on_install '${slug}' exited ${result.exitCode} for '${agent.code_name}' ` + (missingCmdHash ? `[missing_command_hash=${missingCmdHash}] ` : "") + `[stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
               );
@@ -12750,6 +12725,14 @@ async function processAgent(agent, agentStates) {
           // but-not-yet-live MCP, so don't let the reaper re-fire + inflate the
           // McpReaperRestartsHourly metric into a false flapping alarm.
           restartPending: pendingSessionRestarts.has(agent.code_name),
+          // ENG-8013 (storm-awareness): tell the reaper whether THIS session
+          // generation was born from an external respawn (integration-change /
+          // channel-set-change / day-rollover / wedge / operator restart, or a
+          // storm) vs the reaper's own recovery restart. When external, a missing
+          // channel MCP is churn collateral and must not accrue quarantine budget,
+          // the durable fix for the ENG-8003 storm-quarantine incident. Absent map
+          // entry (first boot) → false → count normally.
+          currentGenerationExternallyStarted: lastRestartWasExternal.get(agent.code_name) ?? false,
           // ENG-5441 / ENG-5547: a mcp-presence-reaper restart counts against
           // the agent-wide breaker ONLY when several distinct MCP servers are
           // missing at once — a thrashing collection that rotates restarts of
@@ -13350,7 +13333,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       const ctx = getLastFailureContext(codeName);
       const recovery = prepareForRespawn(codeName);
       const tailSummary = !ctx.tail ? "" : KNOWN_SAFE_TAIL_SIGNATURES.has(ctx.signature) ? `; last pane output (${PANE_TAIL_PREVIEW_LINES} of ~20 lines):
-${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash14("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
+${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash13("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
       const sigSummary = ctx.signature !== "unknown" ? `; signature=${ctx.signature}` : "";
       const recoverySummary = recovery ? `; recovery=${recovery}` : "";
       log(
@@ -13364,7 +13347,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash14("sha256")
       );
       getHostId().then((hostId) => {
         if (!hostId) return;
-        const paneTailHash = zombie.paneTail ? `sha256:${createHash14("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
+        const paneTailHash = zombie.paneTail ? `sha256:${createHash13("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
         return api.post("/host/events", {
           host_id: hostId,
           agent_code_name: codeName,
@@ -13513,7 +13496,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash14("sha256")
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
   }
-  const stableTasksHash = createHash14("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const stableTasksHash = createHash13("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (stableTasksHash !== prevHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
@@ -13730,7 +13713,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-4LAOXUQD.js");
+        const { collectDiagnostics } = await import("../persistent-session-MDQVHXKX.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName])
@@ -13780,7 +13763,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-4LAOXUQD.js");
+      const { collectDiagnostics } = await import("../persistent-session-MDQVHXKX.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName])
@@ -14066,7 +14049,7 @@ async function processDirectChatMessage(agent, msg) {
     if (useDoorbell) {
       try {
         const doorbell = directChatDoorbellPath(agent.agentId, homedir10());
-        mkdirSync9(dirname6(doorbell), { recursive: true });
+        mkdirSync8(dirname5(doorbell), { recursive: true });
         writeFileSync11(doorbell, String(Date.now()));
         log(`[direct-chat] Doorbell rung for '${agent.codeName}' (msg=${msg.id}) \u2014 in-session MCP will pull via the cursor`);
         return;
@@ -14176,7 +14159,7 @@ ${formatRunMarker(run_id)}` : KANBAN_CHECK_COMMAND;
   if (run_id) openInjectedRunByCode.set(codeName, run_id);
   try {
     const doorbell = directChatDoorbellPath(agentId, homedir10());
-    mkdirSync9(dirname6(doorbell), { recursive: true });
+    mkdirSync8(dirname5(doorbell), { recursive: true });
     writeFileSync11(doorbell, String(Date.now()));
   } catch (err) {
     log(`[kanban] doorbell ring failed for '${codeName}': ${err.message} (notice still queued)`);
@@ -14233,7 +14216,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-PERAQ2PL.js");
+  } = await import("../claude-pair-runtime-OIK6HKPS.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -14503,7 +14486,7 @@ async function syncMemories(agent, configDir, log2) {
       if (!file.endsWith(".md")) continue;
       try {
         const raw = readFileSync17(join21(memoryDir, file), "utf-8");
-        const fileHash = createHash14("sha256").update(raw).digest("hex").slice(0, 16);
+        const fileHash = createHash13("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
         const parsed = parseMemoryFile(raw, file.replace(/\.md$/, ""));
@@ -14541,21 +14524,21 @@ async function syncMemories(agent, configDir, log2) {
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
   const localFiles = existsSync11(memoryDir) ? readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
-  const localListHash = createHash14("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
+  const localListHash = createHash13("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
   try {
     const dbMemories = await api.post("/host/memories", {
       agent_id: agent.agent_id
     });
-    const responseHash = createHash14("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
+    const responseHash = createHash13("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
     if (!force && prevDownload && prevLocalHash === localListHash && lastDownloadHash.get(agent.agent_id) === responseHash) {
       return true;
     }
     lastDownloadHash.set(agent.agent_id, responseHash);
     lastLocalFileHash.set(agent.agent_id, localListHash);
     if (dbMemories.memories?.length) {
-      mkdirSync9(memoryDir, { recursive: true });
+      mkdirSync8(memoryDir, { recursive: true });
       let written = 0;
       let overwritten = 0;
       for (let i = 0; i < dbMemories.memories.length; i++) {
@@ -14587,7 +14570,7 @@ ${mem.content}
       }
       if (written > 0 || overwritten > 0) {
         const updatedFiles = readdirSync5(memoryDir).filter((f) => f.endsWith(".md")).sort();
-        lastLocalFileHash.set(agent.agent_id, createHash14("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
+        lastLocalFileHash.set(agent.agent_id, createHash13("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
         log2(`Memory download for '${agent.code_name}': wrote ${written} new, overwrote ${overwritten} stale`);
       }
     }
@@ -14982,8 +14965,8 @@ function restartRunningChannelMcps(basenames) {
 }
 function deployMcpAssets() {
   const targetDir = join21(homedir10(), ".augmented", "_mcp");
-  mkdirSync9(targetDir, { recursive: true });
-  const moduleDir = dirname6(fileURLToPath(import.meta.url));
+  mkdirSync8(targetDir, { recursive: true });
+  const moduleDir = dirname5(fileURLToPath(import.meta.url));
   let mcpSourceDir = "";
   let dir = moduleDir;
   for (let i = 0; i < 6; i++) {
@@ -14992,7 +14975,7 @@ function deployMcpAssets() {
       mcpSourceDir = candidate;
       break;
     }
-    const parent = dirname6(dir);
+    const parent = dirname5(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -15004,7 +14987,7 @@ function deployMcpAssets() {
   const fileHash = (p) => {
     try {
       if (!existsSync11(p)) return null;
-      return createHash14("sha256").update(readFileSync17(p)).digest("hex");
+      return createHash13("sha256").update(readFileSync17(p)).digest("hex");
     } catch {
       return null;
     }