@integrity-labs/agt-cli 0.28.412 → 0.28.414

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-5ES25OE6.js";
+} from "../chunk-UI5WQACL.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -4829,7 +4829,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.412" : "dev";
+var cliVersion = true ? "0.28.414" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6001,7 +6001,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.412" : "dev";
+var cliVersion2 = true ? "0.28.414" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-5ES25OE6.js → chunk-UI5WQACL.js}

@@ -6247,7 +6247,7 @@ function requireHost() {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.412" : "dev";
+var agtCliVersion = true ? "0.28.414" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -8751,4 +8751,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-5ES25OE6.js.map
+//# sourceMappingURL=chunk-UI5WQACL.js.map

package/dist/lib/manager-worker.js

@@ -45,7 +45,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-5ES25OE6.js";
+} from "../chunk-UI5WQACL.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -154,7 +154,7 @@ import {
 } from "../chunk-XWVM4KPK.js";
 
 // src/lib/manager-worker.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import { readFileSync as readFileSync18, writeFileSync as writeFileSync12, mkdirSync as mkdirSync10, existsSync as existsSync11, rmSync as rmSync5, readdirSync as readdirSync6, statSync as statSync4, copyFileSync } from "fs";
 import { execFileSync as syncExecFile } from "child_process";
 import { join as join22, dirname as dirname7, delimiter as pathDelimiter } from "path";
@@ -1348,6 +1348,62 @@ function restartTargetsOpencodeServe(framework) {
   return framework === "opencode";
 }
 
+// src/lib/agent-runtime-teardown.ts
+function claudeTmuxSession(codeName) {
+  return `agt-${codeName}`;
+}
+function stopAgentRuntime(codeName, reason, log2, deps) {
+  const step = (label, run) => {
+    try {
+      run();
+    } catch (err) {
+      log2(`[teardown] ${label} failed for '${codeName}' (${reason}): ${err.message}`);
+    }
+  };
+  step("channel-ingest", () => deps.stopManagerHeldChannelIngest(codeName, log2));
+  step("opencode-serve", () => deps.stopOpencodeServe(codeName, log2));
+  step("claude-session", () => deps.stopClaudePersistentSession(codeName));
+  step("claude-pane", () => {
+    if (deps.killTmuxSession(claudeTmuxSession(codeName))) {
+      log2(`[teardown] killed claude pane '${claudeTmuxSession(codeName)}' for '${codeName}' (${reason})`);
+    }
+  });
+}
+
+// src/lib/opencode-credential-fingerprint.ts
+import { createHash as createHash4 } from "crypto";
+var FINGERPRINT_LENGTH = 16;
+var ABSENT = "none";
+function fingerprintOf(secret) {
+  if (!secret) return ABSENT;
+  return createHash4("sha256").update(secret, "utf8").digest("hex").slice(0, FINGERPRINT_LENGTH);
+}
+function opencodeCredentialFingerprint(inputs) {
+  const openRouter = inputs.openRouterToken ? inputs.openRouterFingerprint || fingerprintOf(inputs.openRouterToken) : ABSENT;
+  return `or:${openRouter}|an:${fingerprintOf(inputs.anthropicKey)}`;
+}
+function slots(fingerprint3) {
+  const out = {};
+  for (const part of fingerprint3.split("|")) {
+    const idx = part.indexOf(":");
+    if (idx > 0) out[part.slice(0, idx)] = part.slice(idx + 1);
+  }
+  return out;
+}
+function shouldRestartForCredentialChange(recorded, current) {
+  if (recorded === current) return false;
+  const before = slots(recorded);
+  const after = slots(current);
+  for (const key of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) {
+    const was = before[key] ?? ABSENT;
+    const now = after[key] ?? ABSENT;
+    if (was === now) continue;
+    if (now === ABSENT) continue;
+    return true;
+  }
+  return false;
+}
+
 // src/lib/connectivity-probe-runner.ts
 var DEFAULT_INTERVAL_MS = 60 * 60 * 1e3;
 var DEFAULT_MAX_PER_RUN = 25;
@@ -1799,7 +1855,7 @@ function isDirectChatMessageExpired(createdAt, nowMs, maxAgeMs) {
 }
 
 // ../../packages/core/dist/host-config/capture.js
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var NON_SECRET_ENV_GATES = [
   "AGT_MEMORY_EXTRACTION_ENABLED",
   "AGT_CHANNEL_REPLAY_ENABLED",
@@ -3417,10 +3473,10 @@ function parseExpiresAt(raw) {
 }
 
 // src/lib/channel-config-hash.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var CHANNEL_WRITE_VERSION = 9;
 function computeChannelConfigHash(input) {
-  return createHash5("sha256").update(
+  return createHash6("sha256").update(
     canonicalJson({
       writeVersion: CHANNEL_WRITE_VERSION,
       cliVersion: input.cliVersion,
@@ -4491,7 +4547,7 @@ function saveKanbanNudgeState(source, configDir) {
 }
 
 // src/lib/manager/kanban/notify.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 async function enqueueKanbanNotice(opts) {
   try {
     const res = await api.post(
@@ -4506,7 +4562,7 @@ async function enqueueKanbanNotice(opts) {
     return res.ok === true;
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash6("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash7("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[kanban] notice enqueue failed for agent_id=${opts.agentId} error_id=${errId}`);
     return false;
   }
@@ -4521,7 +4577,7 @@ async function cancelKanbanNotice(agentId) {
     return typeof res.cancelled === "number" ? res.cancelled : 0;
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash6("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash7("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[kanban] notice cancel failed for agent_id=${agentId} error_id=${errId}`);
     return null;
   }
@@ -4927,7 +4983,7 @@ function deriveScheduledTaskNotify(task) {
 }
 
 // src/lib/manager/scheduler/runs.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 async function startRun(opts) {
   try {
     const res = await api.post(
@@ -4942,7 +4998,7 @@ async function startRun(opts) {
     };
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash7("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash8("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] start failed for agent_id=${opts.agent_id} source_type=${opts.source_type} error_id=${errId}`);
     return { run_id: null, kanban_item_id: null };
   }
@@ -4959,7 +5015,7 @@ async function finishRun(runId, outcome, options = {}) {
     });
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash7("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash8("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] finish failed for run_id=${runId} outcome=${outcome} error_id=${errId}`);
   }
 }
@@ -4976,7 +5032,7 @@ async function fetchPriorScheduledRuns(agentId, taskId) {
     return rows.filter((r) => typeof r.output_text === "string" && r.output_text.length > 0).map((r) => ({ startedAt: r.started_at, output: r.output_text }));
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash7("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash8("sha256").update(errText).digest("hex").slice(0, 12);
     log(`[runs] prior-runs lookup failed for task_id=${taskId} error_id=${errId}`);
     return [];
   }
@@ -5025,13 +5081,13 @@ function closeScheduledRunsForCode(codeName, outcome, reason) {
 }
 
 // src/lib/manager/scheduler/kanban-route.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import { writeFileSync as writeFileSync8, renameSync, mkdirSync as mkdirSync6 } from "fs";
 import { homedir as homedir7 } from "os";
 import { join as join17, dirname as dirname5 } from "path";
 
 // src/lib/manager/scheduler/notify.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 async function enqueueScheduledTaskNotice(opts) {
   try {
     const res = await api.post(
@@ -5047,7 +5103,7 @@ async function enqueueScheduledTaskNotice(opts) {
     return res.ok === true;
   } catch (err) {
     const errText = err instanceof Error ? err.message : String(err);
-    const errId = createHash8("sha256").update(errText).digest("hex").slice(0, 12);
+    const errId = createHash9("sha256").update(errText).digest("hex").slice(0, 12);
     log(
       `[scheduled-kanban] notice enqueue failed for agent_id=${opts.agentId} task_id=${opts.taskId} error_id=${errId}`
     );
@@ -5481,24 +5537,24 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
       const assertion = parseDeliverAssertion(rawOutput);
       if (!assertion.deliver) {
         const trimmed = (rawOutput ?? "").trim();
-        const outputHash = trimmed.length === 0 ? "empty" : createHash9("sha256").update(trimmed).digest("hex").slice(0, 12);
+        const outputHash = trimmed.length === 0 ? "empty" : createHash10("sha256").update(trimmed).digest("hex").slice(0, 12);
         log(`[claude-scheduler] Suppressed by delivery_policy=conditional for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 ${assertion.vacuous ? "deliver marker had a vacuous reason" : "no deliver marker"}; output_len=${trimmed.length} output_hash=${outputHash}`);
         if (delivery?.mode === "announce" && delivery.to) {
           await reportDeliveryStatus(agentId, delivery.taskId, { status: "skipped", error_code: "SUPPRESSED_BY_POLICY" });
         }
         return { ok: true };
       }
-      const reasonHash = createHash9("sha256").update(assertion.reason ?? "").digest("hex").slice(0, 12);
+      const reasonHash = createHash10("sha256").update(assertion.reason ?? "").digest("hex").slice(0, 12);
       log(`[claude-scheduler] Delivering conditional run for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 agent asserted a concrete trigger (reason_len=${(assertion.reason ?? "").length} reason_hash=${reasonHash})`);
       rawOutput = assertion.deliverable;
     }
     const classification = classifyOutput(rawOutput);
     if (classification.action === "suppress") {
       const trimmed = (rawOutput ?? "").trim();
-      const outputHash = trimmed.length === 0 ? "empty" : createHash9("sha256").update(trimmed).digest("hex").slice(0, 12);
+      const outputHash = trimmed.length === 0 ? "empty" : createHash10("sha256").update(trimmed).digest("hex").slice(0, 12);
       log(`[claude-scheduler] Suppressing delivery for '${codeName}' (template=${templateId}, task=${delivery?.taskId ?? "n/a"}) \u2014 output_len=${trimmed.length} output_hash=${outputHash}`);
       if (classification.suppressedNotes) {
-        const notesHash = createHash9("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
+        const notesHash = createHash10("sha256").update(classification.suppressedNotes).digest("hex").slice(0, 12);
         log(`[claude-scheduler] Suppressed notes for '${codeName}' (task=${delivery?.taskId ?? "n/a"}) \u2014 notes_len=${classification.suppressedNotes.length} notes_hash=${notesHash}`);
       }
       if (delivery?.mode === "announce" && delivery.to) {
@@ -5564,7 +5620,7 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
 }
 
 // src/lib/manager/scheduler/execution.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { homedir as homedir8 } from "os";
 import { join as join18 } from "path";
 function claudePidFilePath() {
@@ -5588,10 +5644,10 @@ function unregisterClaudeSpawn(pid) {
 }
 async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
-  const stableTasksHash = createHash10("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
-  const boardHash = boardItems.length > 0 ? createHash10("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
+  const stableTasksHash = createHash11("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const boardHash = boardItems.length > 0 ? createHash11("sha256").update(JSON.stringify(boardItems.map((b) => ({ id: b.id, title: b.title, status: b.status, priority: b.priority, deliverable: b.deliverable })))).digest("hex").slice(0, 16) : "empty";
   const resolvedModels = resolveModelChain(refreshData);
-  const modelsHash = createHash10("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
+  const modelsHash = createHash11("sha256").update(JSON.stringify(resolvedModels)).digest("hex").slice(0, 16);
   const combinedHash = `${stableTasksHash}:${boardHash}:${modelsHash}`;
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (combinedHash !== prevHash) {
@@ -5629,7 +5685,7 @@ async function syncAndCheckClaudeScheduler(agent, tasks, boardItems, refreshData
 }
 
 // src/lib/opencode-slack-ingest.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 
 // ../../packages/core/dist/channels/slack-rich-text.js
 var MAX_DEPTH = 12;
@@ -6565,7 +6621,7 @@ function startSlackIngest(config2) {
 // src/lib/opencode-slack-ingest.ts
 var ingests = /* @__PURE__ */ new Map();
 function fingerprint(params) {
-  return createHash11("sha256").update(
+  return createHash12("sha256").update(
     JSON.stringify({
       appToken: params.appToken,
       botToken: params.botToken,
@@ -6646,7 +6702,7 @@ function stopAllOpencodeSlackIngests(log2) {
 }
 
 // src/lib/manager/opencode-scheduler.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 var MAX_OPENCODE_SCHED_CONCURRENCY = 2;
 var opencodeSchedulerStates = /* @__PURE__ */ new Map();
 var inFlightOpencodeTasks = /* @__PURE__ */ new Set();
@@ -6660,7 +6716,7 @@ function shouldDeliver(task, reply) {
 }
 async function syncAndCheckOpencodeScheduler(agent, tasks, refreshData) {
   const codeName = agent.code_name;
-  const tasksHash = createHash12("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const tasksHash = createHash13("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   if (knownOpencodeTaskHashes.get(agent.agent_id) !== tasksHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
     const state8 = syncTasksToScheduler(codeName, agent.agent_id, taskInputs);
@@ -6738,7 +6794,7 @@ async function fireOpencodeScheduledTask(agent, task) {
 }
 
 // src/lib/opencode-telegram-ingest.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync15, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync9 } from "fs";
 import { randomUUID } from "crypto";
 import { join as join19 } from "path";
@@ -7274,7 +7330,7 @@ function anySignal(signals) {
 // src/lib/opencode-telegram-ingest.ts
 var ingests2 = /* @__PURE__ */ new Map();
 function fingerprint2(params) {
-  return createHash13("sha256").update(
+  return createHash14("sha256").update(
     JSON.stringify({
       botToken: params.botToken,
       allowedChats: [...params.allowedChats].sort(),
@@ -9025,7 +9081,7 @@ var sessionLaunchManagedStructure = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
     const raw = readFileSync18(join22(projectDir, ".mcp.json"), "utf-8");
-    return createHash14("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
+    return createHash15("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
   }
@@ -9212,6 +9268,27 @@ function stopPersistentSessionAndForgetMcpBaseline(codeName, breakerReason, gate
     }
   }
 }
+var agentRuntimeTeardownDeps = {
+  stopOpencodeServe: (codeName, teardownLog) => stopOpencodeSession(codeName, teardownLog),
+  stopManagerHeldChannelIngest: (codeName, teardownLog) => {
+    stopOpencodeSlackIngest(codeName, teardownLog);
+    stopOpencodeTelegramIngest(codeName, teardownLog);
+  },
+  // No breaker reason: a deprovision is intentional and must not count against
+  // the restart circuit breaker (see stopPersistentSessionAndForgetMcpBaseline).
+  stopClaudePersistentSession: (codeName) => stopPersistentSessionAndForgetMcpBaseline(codeName),
+  killTmuxSession: (sessionName) => {
+    try {
+      syncExecFile("tmux", ["kill-session", "-t", sessionName], { stdio: "ignore" });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+function stopAgentRuntime2(codeName, reason) {
+  stopAgentRuntime(codeName, reason, log, agentRuntimeTeardownDeps);
+}
 function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
   const currentHash = projectMcpHash(codeName, projectDir);
   const action = decideMcpDriftAction(currentHash, runningMcpHashes.get(codeName));
@@ -9350,6 +9427,7 @@ function clearAgentCaches(agentId, codeName) {
   stopOpencodeSlackIngest(codeName, log);
   stopOpencodeTelegramIngest(codeName, log);
   agentFrameworkCache.delete(codeName);
+  opencodeCredentialFingerprintBySession.delete(codeName);
   kanbanBoardCache.delete(codeName);
   clearKanbanNudgeState(codeName);
   notifyBoardCache.delete(codeName);
@@ -9378,7 +9456,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.412" : "dev";
+var agtCliVersion = true ? "0.28.414" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -10663,7 +10741,7 @@ async function pollCycle() {
         claudeAuth = await detectClaudeAuth();
       } catch (err) {
         const errText = err instanceof Error ? err.message : String(err);
-        const errId = createHash14("sha256").update(errText).digest("hex").slice(0, 12);
+        const errId = createHash15("sha256").update(errText).digest("hex").slice(0, 12);
         log(`Claude auth detection failed (error_id=${errId})`);
       }
       const hostHasClaudeCode = state6.agents.some(
@@ -11142,12 +11220,7 @@ async function pollCycle() {
       if (!currentIds.has(prev.agentId)) {
         log(`Agent '${prev.codeName}' removed from host (deleted or unassigned)`);
         const adapter = resolveAgentFramework(prev.codeName);
-        stopPersistentSessionAndForgetMcpBaseline(prev.codeName);
-        try {
-          const { execSync: es } = await import("child_process");
-          es(`tmux kill-session -t agt-${prev.codeName} 2>/dev/null`, { stdio: "ignore" });
-        } catch {
-        }
+        stopAgentRuntime2(prev.codeName, "removed-from-host");
         killAgentChannelProcesses(prev.codeName, { log });
         const agentDir = join22(adapter.getAgentDir(prev.codeName), "provision");
         await cleanupAgentFiles(prev.codeName, agentDir);
@@ -11393,13 +11466,7 @@ async function processAgent(agent, agentStates) {
     } else if (killPausedCodeNames.delete(agent.code_name)) {
       log(`[kill-switch] '${agent.code_name}' kill switch cleared while still ${agent.status} (no resume \u2014 paused for another reason)`);
     }
-    stopPersistentSessionAndForgetMcpBaseline(agent.code_name);
-    try {
-      const { execSync: es } = await import("child_process");
-      es(`tmux kill-session -t agt-${agent.code_name} 2>/dev/null`, { stdio: "ignore" });
-      log(`Killed tmux session for paused agent '${agent.code_name}'`);
-    } catch {
-    }
+    stopAgentRuntime2(agent.code_name, agent.status);
     if (agent.status === "paused" && !agent.kill_switch) {
       maybeAutoResume(agent);
     }
@@ -11447,12 +11514,7 @@ async function processAgent(agent, agentStates) {
       );
     }
     log(`Agent '${agent.code_name}' is revoked, cleaning up`);
-    stopPersistentSessionAndForgetMcpBaseline(agent.code_name);
-    try {
-      const { execSync: es } = await import("child_process");
-      es(`tmux kill-session -t agt-${agent.code_name} 2>/dev/null`, { stdio: "ignore" });
-    } catch {
-    }
+    stopAgentRuntime2(agent.code_name, "revoked");
     killAgentChannelProcesses(agent.code_name, { log });
     await cleanupAgentFiles(agent.code_name, agentDir);
     clearAgentCaches(agent.agent_id, agent.code_name);
@@ -12100,7 +12162,7 @@ async function processAgent(agent, agentStates) {
       const behaviourSubset = extractMsTeamsBehaviourSubset(
         msteamsEntry?.config
       );
-      const behaviourHash = createHash14("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
+      const behaviourHash = createHash15("sha256").update(canonicalJson(behaviourSubset)).digest("hex");
       const prevBehaviourHash = agentState.knownMsTeamsBehaviourHashes.get(agent.agent_id);
       const msteamsBehaviourRestrictive = isMsTeamsBehaviourRestrictive(behaviourSubset);
       const behaviourDecision = decideSenderPolicyRestart({
@@ -12156,7 +12218,7 @@ async function processAgent(agent, agentStates) {
       const slackBehaviourSubset = extractSlackBehaviourSubset(
         slackEntry?.config
       );
-      const slackBehaviourHash = createHash14("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
+      const slackBehaviourHash = createHash15("sha256").update(canonicalJson(slackBehaviourSubset)).digest("hex");
       const prevSlackBehaviourHash = agentState.knownSlackBehaviourHashes.get(agent.agent_id);
       const slackBehaviourRestrictive = isSlackBehaviourRestrictive(slackBehaviourSubset);
       const slackBehaviourDecision = decideSenderPolicyRestart({
@@ -12589,10 +12651,10 @@ async function processAgent(agent, agentStates) {
           desiredEntries.push({ serverId, url, headers: mcpHeaders, name: tk.toolkit_name });
         }
         const hashBasis = desiredEntries.slice().sort((a, b) => a.serverId.localeCompare(b.serverId)).map((e) => {
-          const headersHash = createHash14("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
+          const headersHash = createHash15("sha256").update(canonicalJson(e.headers ?? {})).digest("hex").slice(0, 16);
           return `${e.serverId}|${e.url}|${headersHash}`;
         }).join("\n");
-        const mcpHash = createHash14("sha256").update(hashBasis).digest("hex").slice(0, 16);
+        const mcpHash = createHash15("sha256").update(hashBasis).digest("hex").slice(0, 16);
         const prevMcpHash = agentState.knownManagedMcpHashes.get(agent.agent_id);
         const structureHash = managedMcpStructureHash(desiredEntries);
         const prevStructureHash = agentState.knownManagedMcpStructure.get(agent.agent_id);
@@ -12607,7 +12669,7 @@ async function processAgent(agent, agentStates) {
         if (mcpHash !== prevMcpHash) {
           for (const e of desiredEntries) {
             frameworkAdapter.writeMcpServer(agent.code_name, e.serverId, { url: e.url, headers: e.headers });
-            const urlHash = createHash14("sha256").update(e.url).digest("hex").slice(0, 12);
+            const urlHash = createHash15("sha256").update(e.url).digest("hex").slice(0, 12);
             log(`[managed-toolkit] ${agent.code_name}: wrote '${e.name}' (serverId=${e.serverId}, url_hash=${urlHash})`);
           }
           if (frameworkAdapter.removeMcpServer && frameworkAdapter.readMcpServers) {
@@ -12709,7 +12771,7 @@ async function processAgent(agent, agentStates) {
     if (frameworkAdapter.installSkillFiles) {
       const currentIntegrationSkillIds = /* @__PURE__ */ new Set();
       const installedIntegrationSkills = [];
-      const { createHash: createHash15 } = await import("crypto");
+      const { createHash: createHash16 } = await import("crypto");
       const refreshAny = refreshData;
       const contexts = refreshAny.integration_contexts ?? refreshAny.plugin_contexts ?? [];
       const contextBySlug = /* @__PURE__ */ new Map();
@@ -12738,7 +12800,7 @@ async function processAgent(agent, agentStates) {
             )
           }));
           const bundle = buildIntegrationBundle(renderedScopes);
-          const contentHash = createHash15("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
+          const contentHash = createHash16("sha256").update(bundleFingerprint(bundle.files)).digest("hex").slice(0, 12);
           const hashKey = `plugin-skill:${agent.agent_id}:${integrationSkillId}`;
           if (agentState.knownSkillHashes.get(hashKey) === contentHash) continue;
           frameworkAdapter.installSkillFiles(agent.code_name, integrationSkillId, bundle.files);
@@ -12805,7 +12867,7 @@ async function processAgent(agent, agentStates) {
         const plan = planGlobalSkillSync(
           [...globalSkillsPayload ?? [], ...sharedSkillsPayload ?? []],
           prevIds,
-          (content) => createHash15("sha256").update(content).digest("hex").slice(0, 12),
+          (content) => createHash16("sha256").update(content).digest("hex").slice(0, 12),
           (skillId) => agentState.knownSkillHashes.get(`global-skill:${agent.agent_id}:${skillId}`),
           { desiredResolved }
         );
@@ -12856,7 +12918,7 @@ async function processAgent(agent, agentStates) {
           const slug = hook.integration_slug ?? hook.plugin_slug;
           if (!slug) continue;
           try {
-            const scriptHash = createHash15("sha256").update(hook.script).digest("hex").slice(0, 12);
+            const scriptHash = createHash16("sha256").update(hook.script).digest("hex").slice(0, 12);
             const hookKey = `${agent.agent_id}:${frameworkAdapter.id}:plugin-hook:${slug}:on_install`;
             if (agentState.knownSkillHashes.get(hookKey) === scriptHash) continue;
             const result = await frameworkAdapter.executePluginHook({
@@ -12871,9 +12933,9 @@ async function processAgent(agent, agentStates) {
             } else if (result.timedOut) {
               log(`Integration hook on_install '${slug}' TIMED OUT for '${agent.code_name}' after ${result.durationMs}ms`);
             } else {
-              const stderrHash = createHash15("sha256").update(result.stderr).digest("hex").slice(0, 12);
+              const stderrHash = createHash16("sha256").update(result.stderr).digest("hex").slice(0, 12);
               const missingCmd = result.exitCode === 127 ? extractCommandNotFound(result.stderr) : null;
-              const missingCmdHash = missingCmd ? createHash15("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
+              const missingCmdHash = missingCmd ? createHash16("sha256").update(missingCmd).digest("hex").slice(0, 8) : null;
               log(
                 `Integration hook on_install '${slug}' exited ${result.exitCode} for '${agent.code_name}' ` + (missingCmdHash ? `[missing_command_hash=${missingCmdHash}] ` : "") + `[stderr_hash=${stderrHash} stderr_len=${result.stderr.length}]`
               );
@@ -13472,6 +13534,7 @@ var lastModelApiErrorSig = /* @__PURE__ */ new Map();
 var DAY_ROLLOVER_FORCE_GRACE_MIN = 30;
 var persistentSessionStuckTracker = new PersistentSessionStuckTracker();
 var claudeAuthTupleBySession = /* @__PURE__ */ new Map();
+var opencodeCredentialFingerprintBySession = /* @__PURE__ */ new Map();
 var egressAllowlistBySession = /* @__PURE__ */ new Map();
 function deriveEgressAllowlist(toolsRaw) {
   return buildEgressAllowlist(
@@ -13481,16 +13544,31 @@ function deriveEgressAllowlist(toolsRaw) {
 var egressAllowlistEqual = (a, b) => a.length === b.length && a.every((d, i) => d === b[i]);
 async function ensureOpencodeRuntime(agent, refreshData, agentTimezone) {
   const codeName = agent.code_name;
+  const openRouterRaw = refreshData.openrouter ?? null;
+  const anthropicRaw = refreshData.anthropic ?? null;
+  const credentialFingerprint = opencodeCredentialFingerprint({
+    openRouterToken: openRouterRaw?.auth_token,
+    openRouterFingerprint: openRouterRaw?.fingerprint,
+    anthropicKey: anthropicRaw?.api_key
+  });
   if (isOpencodeSessionHealthy(codeName)) {
-    await ensureOpencodeSlackIngest({ codeName, agentId: agent.agent_id, log });
-    await ensureOpencodeTelegramIngest({ codeName, agentId: agent.agent_id, log });
-    return { decision: "healthy", spawnAttempted: false, sessionHealthyAfter: true };
+    const recorded = opencodeCredentialFingerprintBySession.get(codeName);
+    if (recorded && shouldRestartForCredentialChange(recorded, credentialFingerprint)) {
+      log(
+        `[opencode-session] Provider credential rotated for '${codeName}' (${recorded} \u2192 ${credentialFingerprint}) \u2014 restarting serve`
+      );
+      stopOpencodeSession(codeName, log);
+      opencodeCredentialFingerprintBySession.delete(codeName);
+    } else {
+      await ensureOpencodeSlackIngest({ codeName, agentId: agent.agent_id, log });
+      await ensureOpencodeTelegramIngest({ codeName, agentId: agent.agent_id, log });
+      if (!recorded) opencodeCredentialFingerprintBySession.set(codeName, credentialFingerprint);
+      return { decision: "healthy", spawnAttempted: false, sessionHealthyAfter: true };
+    }
   }
   stopOpencodeSlackIngest(codeName, log);
   stopOpencodeTelegramIngest(codeName, log);
   const opencodeProjectDir = join22(getFramework("opencode").getAgentDir(codeName), "provision");
-  const openRouterRaw = refreshData.openrouter ?? null;
-  const anthropicRaw = refreshData.anthropic ?? null;
   const serveEnv = {
     AGT_HOST: requireHost(),
     AGT_API_KEY: getApiKey() ?? void 0,
@@ -13522,6 +13600,7 @@ async function ensureOpencodeRuntime(agent, refreshData, agentTimezone) {
       detail: tail ? `opencode spawn failed: ${tail.slice(0, 200)}` : "opencode spawn failed"
     };
   }
+  opencodeCredentialFingerprintBySession.set(codeName, credentialFingerprint);
   return {
     decision: "spawn",
     spawnAttempted,
@@ -13691,7 +13770,7 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
       const ctx = getLastFailureContext(codeName);
       const recovery = prepareForRespawn(codeName);
       const tailSummary = !ctx.tail ? "" : KNOWN_SAFE_TAIL_SIGNATURES.has(ctx.signature) ? `; last pane output (${PANE_TAIL_PREVIEW_LINES} of ~20 lines):
-${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash14("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
+${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash15("sha256").update(ctx.tail).digest("hex").slice(0, 12)} (raw at ~/.augmented/${codeName}/pane.log)`;
       const sigSummary = ctx.signature !== "unknown" ? `; signature=${ctx.signature}` : "";
       const recoverySummary = recovery ? `; recovery=${recovery}` : "";
       log(
@@ -13705,7 +13784,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash14("sha256")
       );
       getHostId().then((hostId) => {
         if (!hostId) return;
-        const paneTailHash = zombie.paneTail ? `sha256:${createHash14("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
+        const paneTailHash = zombie.paneTail ? `sha256:${createHash15("sha256").update(zombie.paneTail).digest("hex").slice(0, 12)}` : null;
         return api.post("/host/events", {
           host_id: hostId,
           agent_code_name: codeName,
@@ -13854,7 +13933,7 @@ ${truncateForLog(ctx.tail)}` : `; pane_tail_hash=sha256:${createHash14("sha256")
   if (!claudeAuthTupleBySession.has(codeName)) {
     claudeAuthTupleBySession.set(codeName, currentAuthTuple);
   }
-  const stableTasksHash = createHash14("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
+  const stableTasksHash = createHash15("sha256").update(JSON.stringify(tasks)).digest("hex").slice(0, 16);
   const prevHash = agentState.knownTasksHashes.get(agent.agent_id);
   if (stableTasksHash !== prevHash) {
     const taskInputs = tasks.map((t) => buildSchedulerTaskInput(t));
@@ -14855,7 +14934,7 @@ async function syncMemories(agent, configDir, log2) {
       if (!file.endsWith(".md")) continue;
       try {
         const raw = readFileSync18(join22(memoryDir, file), "utf-8");
-        const fileHash = createHash14("sha256").update(raw).digest("hex").slice(0, 16);
+        const fileHash = createHash15("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
         const parsed = parseMemoryFile(raw, file.replace(/\.md$/, ""));
@@ -14893,14 +14972,14 @@ async function syncMemories(agent, configDir, log2) {
 }
 async function downloadMemories(agent, memoryDir, log2, { force }) {
   const localFiles = existsSync11(memoryDir) ? readdirSync6(memoryDir).filter((f) => f.endsWith(".md")).sort() : [];
-  const localListHash = createHash14("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
+  const localListHash = createHash15("sha256").update(localFiles.join(",")).digest("hex").slice(0, 16);
   const prevLocalHash = lastLocalFileHash.get(agent.agent_id);
   const prevDownload = lastDownloadHash.get(agent.agent_id);
   try {
     const dbMemories = await api.post("/host/memories", {
       agent_id: agent.agent_id
     });
-    const responseHash = createHash14("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
+    const responseHash = createHash15("sha256").update(JSON.stringify(dbMemories.memories ?? [])).digest("hex").slice(0, 16);
     if (!force && prevDownload && prevLocalHash === localListHash && lastDownloadHash.get(agent.agent_id) === responseHash) {
       return true;
     }
@@ -14939,7 +15018,7 @@ ${mem.content}
       }
       if (written > 0 || overwritten > 0) {
         const updatedFiles = readdirSync6(memoryDir).filter((f) => f.endsWith(".md")).sort();
-        lastLocalFileHash.set(agent.agent_id, createHash14("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
+        lastLocalFileHash.set(agent.agent_id, createHash15("sha256").update(updatedFiles.join(",")).digest("hex").slice(0, 16));
         log2(`Memory download for '${agent.code_name}': wrote ${written} new, overwrote ${overwritten} stale`);
       }
     }
@@ -15364,7 +15443,7 @@ function deployMcpAssets() {
   const fileHash = (p) => {
     try {
       if (!existsSync11(p)) return null;
-      return createHash14("sha256").update(readFileSync18(p)).digest("hex");
+      return createHash15("sha256").update(readFileSync18(p)).digest("hex");
     } catch {
       return null;
     }