@integrity-labs/agt-cli 0.28.431 → 0.28.433

package/dist/lib/manager-worker.js

@@ -42,7 +42,7 @@ import {
   resolveEffectivePinRaw,
   safeWriteJsonAtomic,
   setConfigHash
-} from "../chunk-SV67CNIX.js";
+} from "../chunk-RUVNJO63.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -51,6 +51,7 @@ import {
   syncTasksToScheduler
 } from "../chunk-3HLECXMI.js";
 import {
+  ACCOUNT_ENFORCEMENT_MARKER_FILENAME,
   AnchorSessionClient,
   CLAUDE_MD_MAX_CHARS,
   CONVERSATION_FAILURE_CATEGORIES,
@@ -137,6 +138,7 @@ import {
   resolveDmTarget,
   restartEgressSidecar,
   rotateSessionForWedge,
+  serializeAccountEnforcementMarker,
   serializeUsageLimitMarker,
   sessionTranscriptDir,
   sha256,
@@ -153,17 +155,17 @@ import {
   toOpencodeModel,
   transcriptActivityAgeSeconds,
   writeEgressAllowlist
-} from "../chunk-EREBH2LV.js";
+} from "../chunk-NUKNLJNJ.js";
 import {
   reapOrphanChannelMcps
 } from "../chunk-XWVM4KPK.js";
 
 // src/lib/manager-worker.ts
 import { createHash as createHash15 } from "crypto";
-import { readFileSync as readFileSync20, writeFileSync as writeFileSync12, mkdirSync as mkdirSync10, existsSync as existsSync11, rmSync as rmSync5, readdirSync as readdirSync6, statSync as statSync5, copyFileSync } from "fs";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync13, mkdirSync as mkdirSync11, existsSync as existsSync11, rmSync as rmSync6, readdirSync as readdirSync6, statSync as statSync5, copyFileSync } from "fs";
 import { execFileSync as syncExecFile } from "child_process";
-import { join as join23, dirname as dirname7, delimiter as pathDelimiter } from "path";
-import { homedir as homedir10 } from "os";
+import { join as join24, dirname as dirname7, delimiter as pathDelimiter } from "path";
+import { homedir as homedir11 } from "os";
 import { fileURLToPath } from "url";
 
 // src/lib/claude-code-upgrade-throttle.ts
@@ -2149,9 +2151,47 @@ async function maybeReportUsageBanner(args) {
   }
 }
 
+// src/lib/account-enforcement-marker.ts
+import { mkdirSync as mkdirSync5, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join7 } from "path";
+function accountEnforcementMarkerPath(codeName) {
+  return join7(homedir4(), ".augmented", codeName, ACCOUNT_ENFORCEMENT_MARKER_FILENAME);
+}
+function syncAccountEnforcementMarker(codeName, level, log2 = (m) => process.stderr.write(`${m}
+`)) {
+  if (level !== "warn" && level !== "mute") {
+    clearAccountEnforcementMarker(codeName, log2);
+    return;
+  }
+  const dir = join7(homedir4(), ".augmented", codeName);
+  const path = join7(dir, ACCOUNT_ENFORCEMENT_MARKER_FILENAME);
+  const tempPath = `${path}.${process.pid}.tmp`;
+  try {
+    mkdirSync5(dir, { recursive: true });
+    writeFileSync5(tempPath, serializeAccountEnforcementMarker(level), "utf-8");
+    renameSync(tempPath, path);
+  } catch (err) {
+    try {
+      rmSync3(tempPath, { force: true });
+    } catch {
+    }
+    log2(`[account-enforcement] marker sync failed for '${codeName}': ${err.message}`);
+  }
+}
+function clearAccountEnforcementMarker(codeName, log2 = (m) => process.stderr.write(`${m}
+`)) {
+  const path = accountEnforcementMarkerPath(codeName);
+  try {
+    rmSync3(path, { force: true });
+  } catch (err) {
+    log2(`[account-enforcement] marker clear failed for '${codeName}': ${err.message}`);
+  }
+}
+
 // src/lib/token-usage-monitor.ts
 import { readdirSync, readFileSync as readFileSync7, statSync } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var MIN_CHECK_INTERVAL_MS2 = 6e4;
 var TRANSCRIPT_MTIME_WINDOW_MS = 2 * 24 * 60 * 60 * 1e3;
 var MAX_ENTRIES_PER_POST = 200;
@@ -2180,7 +2220,7 @@ async function maybeReportTokenUsage(args) {
     if (!name.endsWith(".jsonl")) continue;
     const sessionId = name.slice(0, -".jsonl".length);
     if (!sessionId) continue;
-    const path = join7(dir, name);
+    const path = join8(dir, name);
     let st;
     try {
       st = statSync(path);
@@ -2278,7 +2318,7 @@ async function maybeReportTokenUsage(args) {
 
 // src/lib/workflow-run-reconciler.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var MIN_CHECK_INTERVAL_MS3 = 5 * 6e4;
 var SETTLE_MS = 3e4;
 var TRANSCRIPT_MTIME_WINDOW_MS2 = 2 * 24 * 60 * 60 * 1e3;
@@ -2297,7 +2337,7 @@ function collectJsonlRecursive(dir, minMtimeMs, out, depth) {
     return;
   }
   for (const name of entries) {
-    const p = join8(dir, name);
+    const p = join9(dir, name);
     let st;
     try {
       st = statSync2(p);
@@ -2320,7 +2360,7 @@ function enumerateTranscriptFiles(transcriptDir, nowMs, minMtimeMs = nowMs - TRA
     return out;
   }
   for (const name of entries) {
-    const path = join8(transcriptDir, name);
+    const path = join9(transcriptDir, name);
     let st;
     try {
       st = statSync2(path);
@@ -2332,7 +2372,7 @@ function enumerateTranscriptFiles(transcriptDir, nowMs, minMtimeMs = nowMs - TRA
       continue;
     }
     if (st.isDirectory()) {
-      collectJsonlRecursive(join8(path, "subagents"), minMtimeMs, out, 0);
+      collectJsonlRecursive(join9(path, "subagents"), minMtimeMs, out, 0);
     }
   }
   return out;
@@ -2423,7 +2463,7 @@ async function maybeReconcileWorkflowRunTokens(args) {
 
 // src/lib/conversation-evaluator.ts
 import { readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var MIN_CHECK_INTERVAL_MS4 = 5 * 6e4;
 var TRANSCRIPT_MTIME_WINDOW_MS3 = 7 * 24 * 60 * 60 * 1e3;
 var WINDOW_PAD_MS = 5 * 6e4;
@@ -2859,7 +2899,7 @@ function readRecentTurns(dir, nowMs) {
       return;
     }
     for (const ent of entries) {
-      const full = join9(d, ent.name);
+      const full = join10(d, ent.name);
       if (ent.isDirectory()) {
         visit(full);
         continue;
@@ -3165,10 +3205,10 @@ async function reportSkip2(api2, agentId, conversationId, log2, codeName) {
 
 // src/lib/activity-cache-monitor.ts
 import { existsSync as existsSync2, readFileSync as readFileSync10 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join10 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join11 } from "path";
 var MIN_CHECK_INTERVAL_MS6 = 6e4;
-var STATS_CACHE_PATH = join10(homedir4(), ".claude", "stats-cache.json");
+var STATS_CACHE_PATH = join11(homedir5(), ".claude", "stats-cache.json");
 var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 var state5 = { lastObservedDate: null, lastCheckedAt: 0 };
 function selectNewDailyRows(raw, lastObservedDate) {
@@ -3402,8 +3442,8 @@ function bundleFingerprint(files) {
 
 // src/lib/claude-auth-detect.ts
 import { readFile as readFile2, readdir as readdir2 } from "fs/promises";
-import { homedir as homedir5, platform } from "os";
-import { join as join11 } from "path";
+import { homedir as homedir6, platform } from "os";
+import { join as join12 } from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
@@ -3418,8 +3458,8 @@ async function detectClaudeAuth() {
 }
 async function findClaudeCredentialsPaths() {
   const candidates = [
-    join11(homedir5(), ".claude", ".credentials.json"),
-    join11(homedir5(), ".claude", "credentials.json")
+    join12(homedir6(), ".claude", ".credentials.json"),
+    join12(homedir6(), ".claude", "credentials.json")
   ];
   const isLinuxRoot = platform() === "linux" && typeof process.getuid === "function" && process.getuid() === 0;
   if (isLinuxRoot) {
@@ -3427,8 +3467,8 @@ async function findClaudeCredentialsPaths() {
       const entries = await readdir2("/home", { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        candidates.push(join11("/home", entry.name, ".claude", ".credentials.json"));
-        candidates.push(join11("/home", entry.name, ".claude", "credentials.json"));
+        candidates.push(join12("/home", entry.name, ".claude", ".credentials.json"));
+        candidates.push(join12("/home", entry.name, ".claude", "credentials.json"));
       }
     } catch {
     }
@@ -3524,11 +3564,11 @@ function computeChannelConfigHash(input) {
 }
 
 // src/lib/channel-hash-cache.ts
-import { existsSync as existsSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { join as join13 } from "path";
 var CACHE_FILENAME = "channel-hash-cache.json";
 function getChannelHashCacheFile(configDir) {
-  return join12(configDir, CACHE_FILENAME);
+  return join13(configDir, CACHE_FILENAME);
 }
 function loadChannelHashCache(target, configDir) {
   const path = getChannelHashCacheFile(configDir);
@@ -3549,14 +3589,14 @@ function saveChannelHashCache(source, configDir) {
   const obj = {};
   for (const [key, value] of source) obj[key] = value;
   try {
-    writeFileSync5(path, JSON.stringify(obj, null, 2));
+    writeFileSync6(path, JSON.stringify(obj, null, 2));
   } catch {
   }
 }
 
 // src/lib/sender-policy-baseline.ts
 import { existsSync as existsSync4, readFileSync as readFileSync12 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var BASELINE_FILENAME = "sender-policy-baseline.json";
 var SENDER_POLICY_BASELINE_VERSION = 1;
 var BASELINE_CONCERNS = ["senderPolicy", "slackBehaviour", "msteamsBehaviour"];
@@ -3568,7 +3608,7 @@ function createDeliveryBaselineMaps() {
   };
 }
 function getSenderPolicyBaselineFile(configDir) {
-  return join13(configDir, BASELINE_FILENAME);
+  return join14(configDir, BASELINE_FILENAME);
 }
 function loadSenderPolicyBaseline(target, configDir, log2) {
   const path = getSenderPolicyBaselineFile(configDir);
@@ -4098,11 +4138,11 @@ function planGlobalSkillSync(globalSkills, prevIds, hashOf, knownHash, options)
 }
 
 // src/lib/manager/managed-skill-manifest.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname4, join as join14 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname4, join as join15 } from "path";
 var MANIFEST_VERSION = 1;
 function managedSkillManifestPath(agentRootDir) {
-  return join14(agentRootDir, "managed-skills.json");
+  return join15(agentRootDir, "managed-skills.json");
 }
 function readManagedSkillManifest(path) {
   try {
@@ -4116,12 +4156,12 @@ function readManagedSkillManifest(path) {
 }
 function writeManagedSkillManifest(path, ids) {
   try {
-    mkdirSync5(dirname4(path), { recursive: true });
+    mkdirSync6(dirname4(path), { recursive: true });
     const body = {
       version: MANIFEST_VERSION,
       globalSkillIds: [...ids].sort()
     };
-    writeFileSync6(path, JSON.stringify(body, null, 2));
+    writeFileSync7(path, JSON.stringify(body, null, 2));
   } catch {
   }
 }
@@ -4219,9 +4259,9 @@ function resolveModelChain(refreshData) {
 }
 
 // src/lib/manager/claude-auth.ts
-import { existsSync as existsSync6, rmSync as rmSync3 } from "fs";
-import { join as join15 } from "path";
-import { homedir as homedir6 } from "os";
+import { existsSync as existsSync6, rmSync as rmSync4 } from "fs";
+import { join as join16 } from "path";
+import { homedir as homedir7 } from "os";
 async function applyClaudeAuthToEnv(childEnv, label) {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -4233,12 +4273,12 @@ async function applyClaudeAuthToEnv(childEnv, label) {
       throw new Error("claude_auth_mode=api_key but /host/exchange returned no decrypted key");
     }
     childEnv.ANTHROPIC_API_KEY = exchange.anthropicApiKey;
-    const claudeDir = join15(homedir6(), ".claude");
+    const claudeDir = join16(homedir7(), ".claude");
     for (const filename of [".credentials.json", "credentials.json"]) {
-      const p = join15(claudeDir, filename);
+      const p = join16(claudeDir, filename);
       if (existsSync6(p)) {
         try {
-          rmSync3(p, { force: true });
+          rmSync4(p, { force: true });
           log(`[${label}] Removed ${p} (api_key mode \u2014 preventing OAuth fallback)`);
         } catch {
         }
@@ -4251,7 +4291,7 @@ async function applyClaudeAuthToEnv(childEnv, label) {
 
 // src/lib/manager/kanban/parsers.ts
 import { existsSync as existsSync7, readFileSync as readFileSync14 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 var STANDUP_TEMPLATES = /* @__PURE__ */ new Set(["daily-standup", "end-of-day-summary"]);
 var TASK_UPDATE_TEMPLATES = /* @__PURE__ */ new Set(["hourly-status", "task-update"]);
 var PLAN_TEMPLATES = /* @__PURE__ */ new Set(["morning-plan"]);
@@ -4390,8 +4430,8 @@ function getBuiltInSkillContent(skillId) {
   if (builtInSkillCache.has(skillId)) return builtInSkillCache.get(skillId);
   try {
     const candidates = [
-      join16(process.cwd(), "skills", skillId, "SKILL.md"),
-      join16(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "..", "..", "skills", skillId, "SKILL.md")
+      join17(process.cwd(), "skills", skillId, "SKILL.md"),
+      join17(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "..", "..", "skills", skillId, "SKILL.md")
     ];
     for (const candidate of candidates) {
       if (existsSync7(candidate)) {
@@ -4536,12 +4576,12 @@ function formatBoardForPrompt(items, template) {
 }
 
 // src/lib/manager/kanban/nudge-state-cache.ts
-import { existsSync as existsSync8, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
+import { join as join18 } from "path";
 var CACHE_FILENAME2 = "kanban-nudge-state.json";
 var KANBAN_NUDGE_STATE_VERSION = 1;
 function getKanbanNudgeStateFile(configDir) {
-  return join17(configDir, CACHE_FILENAME2);
+  return join18(configDir, CACHE_FILENAME2);
 }
 function loadKanbanNudgeState(target, configDir) {
   const path = getKanbanNudgeStateFile(configDir);
@@ -4573,7 +4613,7 @@ function saveKanbanNudgeState(source, configDir) {
   const agents = {};
   for (const [codeName, state7] of source) agents[codeName] = state7;
   try {
-    writeFileSync7(path, JSON.stringify({ version: KANBAN_NUDGE_STATE_VERSION, agents }, null, 2));
+    writeFileSync8(path, JSON.stringify({ version: KANBAN_NUDGE_STATE_VERSION, agents }, null, 2));
   } catch {
   }
 }
@@ -5114,9 +5154,9 @@ function closeScheduledRunsForCode(codeName, outcome, reason) {
 
 // src/lib/manager/scheduler/kanban-route.ts
 import { createHash as createHash10 } from "crypto";
-import { writeFileSync as writeFileSync8, renameSync, mkdirSync as mkdirSync6, readFileSync as readFileSync16, unlinkSync } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join18, dirname as dirname5 } from "path";
+import { writeFileSync as writeFileSync9, renameSync as renameSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync16, unlinkSync } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join19, dirname as dirname5 } from "path";
 
 // src/lib/manager/scheduler/notify.ts
 import { createHash as createHash9 } from "crypto";
@@ -5456,17 +5496,17 @@ function resolveScheduledSlackTarget(task) {
 }
 function stampScheduledTurnMarker(codeName, taskId, target) {
   try {
-    const file = join18(homedir7(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
+    const file = join19(homedir8(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
     const marker = { ts: Date.now(), task_id: taskId, ...target ? { target } : {} };
     const tmp = `${file}.tmp`;
-    writeFileSync8(tmp, JSON.stringify(marker), "utf8");
-    renameSync(tmp, file);
+    writeFileSync9(tmp, JSON.stringify(marker), "utf8");
+    renameSync2(tmp, file);
   } catch (err) {
     log(`[scheduled-kanban] scheduled-turn marker write failed for '${codeName}': ${err.message}`);
   }
 }
 function clearScheduledTurnMarkerForTask(codeName, taskId) {
-  const file = join18(homedir7(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
+  const file = join19(homedir8(), ".augmented", codeName, SCHEDULED_TURN_MARKER_FILENAME);
   try {
     const raw = JSON.parse(readFileSync16(file, "utf8"));
     if (typeof raw?.task_id !== "string" || raw.task_id !== taskId) return;
@@ -5522,9 +5562,9 @@ async function routeScheduledTaskViaKanban(codeName, agentId, task, prompt, dura
       return false;
     }
     try {
-      const doorbell = directChatDoorbellPath(agentId, homedir7());
-      mkdirSync6(dirname5(doorbell), { recursive: true });
-      writeFileSync8(doorbell, String(Date.now()));
+      const doorbell = directChatDoorbellPath(agentId, homedir8());
+      mkdirSync7(dirname5(doorbell), { recursive: true });
+      writeFileSync9(doorbell, String(Date.now()));
     } catch (err) {
       log(`[scheduled-kanban] doorbell ring failed for '${codeName}': ${err.message} (notice still queued)`);
     }
@@ -5674,10 +5714,10 @@ async function processClaudeTaskResult(codeName, agentId, templateId, rawOutput,
 
 // src/lib/manager/scheduler/execution.ts
 import { createHash as createHash11 } from "crypto";
-import { homedir as homedir8 } from "os";
-import { join as join19 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join20 } from "path";
 function claudePidFilePath() {
-  return join19(homedir8(), ".augmented", "manager-claude-pids.json");
+  return join20(homedir9(), ".augmented", "manager-claude-pids.json");
 }
 var inFlightClaudePids = /* @__PURE__ */ new Map();
 function registerClaudeSpawn(record) {
@@ -6901,9 +6941,9 @@ async function fireOpencodeScheduledTask(agent, task) {
 
 // src/lib/opencode-telegram-ingest.ts
 import { createHash as createHash14 } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync17, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync17, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync10 } from "fs";
 import { randomUUID } from "crypto";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 
 // src/lib/telegram-ingest.ts
 import https2 from "https";
@@ -7451,7 +7491,7 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
   let filePath;
   try {
     dir = getFramework("opencode").getAgentDir(codeName);
-    filePath = join20(dir, "telegram-getupdates-offset-opencode.json");
+    filePath = join21(dir, "telegram-getupdates-offset-opencode.json");
   } catch {
     dir = null;
     filePath = null;
@@ -7478,8 +7518,8 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
       if (!filePath || !dir) return;
       const tmpPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
       try {
-        mkdirSync7(dir, { recursive: true, mode: 448 });
-        writeFileSync9(
+        mkdirSync8(dir, { recursive: true, mode: 448 });
+        writeFileSync10(
           tmpPath,
           JSON.stringify({
             offset,
@@ -7489,7 +7529,7 @@ function createFileOffsetStore(codeName, log2, currentBotId) {
           }),
           { mode: 384 }
         );
-        renameSync2(tmpPath, filePath);
+        renameSync3(tmpPath, filePath);
       } catch (err) {
         log2(`[telegram-ingest:${codeName}] offset persist failed: ${err instanceof Error ? err.message : String(err)}`);
         try {
@@ -7710,15 +7750,15 @@ function partitionActionableByPoison(actionable, states, config2) {
 }
 
 // src/lib/restart-flags.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync8, readdirSync as readdirSync4, readFileSync as readFileSync18, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join21 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync9, readdirSync as readdirSync4, readFileSync as readFileSync18, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join22 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 function restartFlagsDir() {
-  return join21(homedir9(), ".augmented", "restart-flags");
+  return join22(homedir10(), ".augmented", "restart-flags");
 }
 function flagPath(codeName) {
-  return join21(restartFlagsDir(), `${codeName}.flag`);
+  return join22(restartFlagsDir(), `${codeName}.flag`);
 }
 function readRestartFlags() {
   const dir = restartFlagsDir();
@@ -7727,7 +7767,7 @@ function readRestartFlags() {
   for (const entry of readdirSync4(dir)) {
     if (!entry.endsWith(".flag")) continue;
     try {
-      const raw = readFileSync18(join21(dir, entry), "utf8");
+      const raw = readFileSync18(join22(dir, entry), "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.codeName !== "string" || parsed.codeName.length === 0) {
         parsed.codeName = entry.replace(/\.flag$/, "");
@@ -7746,7 +7786,7 @@ function readRestartFlags() {
 function deleteRestartFlag(codeName) {
   const path = flagPath(codeName);
   if (existsSync10(path)) {
-    rmSync4(path, { force: true });
+    rmSync5(path, { force: true });
   }
 }
 
@@ -7845,8 +7885,8 @@ async function sendError(flag, opts, text) {
 }
 
 // src/lib/restart-context.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync19, writeFileSync as writeFileSync11, mkdirSync as mkdirSync9, unlinkSync as unlinkSync3 } from "fs";
-import { dirname as dirname6, join as join22 } from "path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync19, writeFileSync as writeFileSync12, mkdirSync as mkdirSync10, unlinkSync as unlinkSync3 } from "fs";
+import { dirname as dirname6, join as join23 } from "path";
 var SLACK_PENDING_INBOUND_DIRNAME = "slack-pending-inbound";
 var SLACK_RESTART_CONTEXT_DIRNAME = "slack-restart-context";
 var MAX_TOPIC_CHARS = 140;
@@ -7858,10 +7898,10 @@ function augmentedAgentDir(codeName) {
   return dirname6(getProjectDir(codeName));
 }
 function slackPendingInboundDir(codeName) {
-  return join22(augmentedAgentDir(codeName), SLACK_PENDING_INBOUND_DIRNAME);
+  return join23(augmentedAgentDir(codeName), SLACK_PENDING_INBOUND_DIRNAME);
 }
 function slackRestartContextDir(codeName) {
-  return join22(augmentedAgentDir(codeName), SLACK_RESTART_CONTEXT_DIRNAME);
+  return join23(augmentedAgentDir(codeName), SLACK_RESTART_CONTEXT_DIRNAME);
 }
 function sanitizeTopic(raw) {
   const cleaned = raw.replace(/\s+/g, " ").trim().replace(/[<>]/g, " ").replace(/\s+/g, " ").trim();
@@ -7912,8 +7952,8 @@ function readStrandedMarker(path) {
   return null;
 }
 function writeHintFile(path, dir, hint) {
-  mkdirSync9(dir, { recursive: true, mode: 448 });
-  writeFileSync11(path, JSON.stringify(hint), { mode: 384 });
+  mkdirSync10(dir, { recursive: true, mode: 448 });
+  writeFileSync12(path, JSON.stringify(hint), { mode: 384 });
 }
 function pruneHintsExcept(codeName, freshFilenames) {
   const ctxDir = slackRestartContextDir(codeName);
@@ -7921,7 +7961,7 @@ function pruneHintsExcept(codeName, freshFilenames) {
     if (!filename.endsWith(".json")) continue;
     if (freshFilenames.has(filename)) continue;
     try {
-      unlinkSync3(join22(ctxDir, filename));
+      unlinkSync3(join23(ctxDir, filename));
     } catch {
     }
   }
@@ -7942,7 +7982,7 @@ function refreshSlackRestartContextHints(codeNames, opts = {}) {
       }
       const markers = [];
       for (const filename of markerFilenames.slice(0, cap)) {
-        const parsed = readStrandedMarker(join22(markerDir, filename));
+        const parsed = readStrandedMarker(join23(markerDir, filename));
         if (parsed) markers.push({ filename, channel: parsed.channel, thread_ts: parsed.thread_ts });
       }
       if (markers.length === 0) {
@@ -7956,7 +7996,7 @@ function refreshSlackRestartContextHints(codeNames, opts = {}) {
       const freshFilenames = /* @__PURE__ */ new Set();
       for (const { filename, hint } of hints) {
         try {
-          writeHintFile(join22(ctxDir, filename), ctxDir, hint);
+          writeHintFile(join23(ctxDir, filename), ctxDir, hint);
           freshFilenames.add(filename);
         } catch (err) {
           log2(`[restart-context] ${codeName}: hint write failed for ${filename}: ${err.message}`);
@@ -9187,7 +9227,7 @@ var runningChannelSecretHashes = /* @__PURE__ */ new Map();
 var sessionLaunchManagedStructure = /* @__PURE__ */ new Map();
 function projectMcpHash(_codeName, projectDir) {
   try {
-    const raw = readFileSync20(join23(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync20(join24(projectDir, ".mcp.json"), "utf-8");
     return createHash15("sha256").update(canonicalJson(JSON.parse(raw))).digest("hex");
   } catch {
     return null;
@@ -9195,7 +9235,7 @@ function projectMcpHash(_codeName, projectDir) {
 }
 function projectMcpKeys(_codeName, projectDir) {
   try {
-    const raw = readFileSync20(join23(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync20(join24(projectDir, ".mcp.json"), "utf-8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers;
     if (!servers || typeof servers !== "object") return /* @__PURE__ */ new Set();
@@ -9213,7 +9253,7 @@ function seedSessionLaunchBaselines(codeName, projectDir) {
   else runningMcpServerKeys.delete(codeName);
   let launchStructure = null;
   try {
-    const raw = readFileSync20(join23(projectDir, ".mcp.json"), "utf-8");
+    const raw = readFileSync20(join24(projectDir, ".mcp.json"), "utf-8");
     launchStructure = managedMcpStructureHashFromFile(
       JSON.parse(raw),
       isManagedMcpServerKey
@@ -9317,7 +9357,7 @@ async function runAgentSessionToolBindProbes(agent, integrations, projectDir, op
   if (result && result.rebindCandidates.length > 0 && hostFlagStore().getBoolean("session-tool-rebind")) {
     let mcpJsonForRebind = null;
     try {
-      mcpJsonForRebind = JSON.parse(readFileSync20(join23(projectDir, ".mcp.json"), "utf-8"));
+      mcpJsonForRebind = JSON.parse(readFileSync20(join24(projectDir, ".mcp.json"), "utf-8"));
     } catch {
       mcpJsonForRebind = null;
     }
@@ -9468,7 +9508,7 @@ function checkMcpConfigDriftAndScheduleRestart(codeName, projectDir) {
 function projectChannelSecretHash(projectDir) {
   try {
     const entries = parseEnvIntegrations(
-      readFileSync20(join23(projectDir, ".env.integrations"), "utf-8")
+      readFileSync20(join24(projectDir, ".env.integrations"), "utf-8")
     );
     return channelSecretValueHash(entries, CHANNEL_SECRET_ENV_KEYS);
   } catch {
@@ -9564,7 +9604,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.431" : "dev";
+var agtCliVersion = true ? "0.28.433" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -9869,8 +9909,8 @@ function ensureClaudeManagedSettings(path = claudeManagedSettingsPath()) {
     }
     if (settings.channelsEnabled === true) return "ok";
     settings.channelsEnabled = true;
-    mkdirSync10(dirname7(path), { recursive: true });
-    writeFileSync12(path, `${JSON.stringify(settings, null, 2)}
+    mkdirSync11(dirname7(path), { recursive: true });
+    writeFileSync13(path, `${JSON.stringify(settings, null, 2)}
 `);
     log(`[managed-settings] set channelsEnabled:true in ${path} (ENG-5786 \u2014 unblocks Claude Code channels)`);
     return "ok";
@@ -9908,7 +9948,7 @@ async function ensureOpencodeBinary() {
   try {
     const prefix = execFileSync2("npm", ["prefix", "-g"], { encoding: "utf-8", timeout: 1e4 }).trim();
     if (prefix) {
-      const npmBin = join23(prefix, "bin");
+      const npmBin = join24(prefix, "bin");
       const current = (process.env.PATH ?? "").split(pathDelimiter);
       if (!current.includes(npmBin)) {
         process.env.PATH = [npmBin, ...current.filter(Boolean)].join(pathDelimiter);
@@ -10025,7 +10065,7 @@ ${r.stderr}`;
 }
 var UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function selfUpdateAppliedMarkerPath() {
-  return join23(homedir10(), ".augmented", ".last-self-update-applied");
+  return join24(homedir11(), ".augmented", ".last-self-update-applied");
 }
 var selfUpdateUpToDateLogged = false;
 var selfUpdatePinnedLogged = false;
@@ -10053,7 +10093,7 @@ async function checkAndUpdateCli(opts) {
     const isNpmGlobal = !isBrewFormula && resolvedPath.includes("node_modules");
     if (!isBrewFormula && !isNpmGlobal) return "noop";
     const { readFileSync: readF, writeFileSync: writeF } = await import("fs");
-    const markerPath = join23(homedir10(), ".augmented", ".last-update-check");
+    const markerPath = join24(homedir11(), ".augmented", ".last-update-check");
     if (!force) {
       try {
         const lastCheck = parseInt(readF(markerPath, "utf-8").trim(), 10);
@@ -10413,13 +10453,13 @@ async function checkClaudeAuth() {
 var evalEmptyMcpConfigPath = null;
 function ensureEvalEmptyMcpConfig() {
   if (evalEmptyMcpConfigPath && existsSync11(evalEmptyMcpConfigPath)) return evalEmptyMcpConfigPath;
-  const dir = join23(homedir10(), ".augmented");
+  const dir = join24(homedir11(), ".augmented");
   try {
-    mkdirSync10(dir, { recursive: true });
+    mkdirSync11(dir, { recursive: true });
   } catch {
   }
-  const p = join23(dir, ".eval-empty-mcp.json");
-  writeFileSync12(p, JSON.stringify({ mcpServers: {} }));
+  const p = join24(dir, ".eval-empty-mcp.json");
+  writeFileSync13(p, JSON.stringify({ mcpServers: {} }));
   evalEmptyMcpConfigPath = p;
   return p;
 }
@@ -10444,7 +10484,7 @@ async function runEvalClaude(prompt, model) {
     ""
   ];
   const { stdout } = await execFilePromiseLong(resolveClaudeBinary(), args, {
-    cwd: homedir10(),
+    cwd: homedir11(),
     timeout: 12e4,
     stdin: "ignore",
     env: childEnv,
@@ -10510,10 +10550,10 @@ function resolveConversationEvalBackend() {
   return conversationEvalBackend;
 }
 function getStateFile() {
-  return join23(config?.configDir ?? join23(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
+  return join24(config?.configDir ?? join24(process.env["HOME"] ?? "/tmp", ".augmented"), "manager-state.json");
 }
 function channelHashCacheDir() {
-  return config?.configDir ?? join23(process.env["HOME"] ?? "/tmp", ".augmented");
+  return config?.configDir ?? join24(process.env["HOME"] ?? "/tmp", ".augmented");
 }
 function loadChannelHashCache2() {
   loadChannelHashCache(agentState.knownChannelConfigHashes, channelHashCacheDir());
@@ -10565,7 +10605,7 @@ function removeDeliveryBaselineEntries(agentId) {
 var _channelQuarantineStore = null;
 function channelQuarantineStore() {
   if (!_channelQuarantineStore) {
-    const dir = config?.configDir ?? join23(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join24(process.env["HOME"] ?? "/tmp", ".augmented");
     _channelQuarantineStore = new ChannelQuarantineStore(defaultQuarantinePath(dir));
   }
   return _channelQuarantineStore;
@@ -10582,7 +10622,7 @@ function claudeMdSizeFor(codeName) {
 var _hostFlagStore = null;
 function hostFlagStore() {
   if (!_hostFlagStore) {
-    const dir = config?.configDir ?? join23(process.env["HOME"] ?? "/tmp", ".augmented");
+    const dir = config?.configDir ?? join24(process.env["HOME"] ?? "/tmp", ".augmented");
     _hostFlagStore = new HostFlagStore({ cachePath: defaultFlagsCachePath(dir), log });
   }
   return _hostFlagStore;
@@ -10649,13 +10689,13 @@ function parseSkillFrontmatter(content) {
   return out;
 }
 async function refreshSkillsIndexInClaudeMd(configDir, codeName, log2) {
-  const { readdirSync: readdirSync7, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync13 } = await import("fs");
-  const skillsDir = join23(configDir, codeName, "project", ".claude", "skills");
-  const claudeMdPath = join23(configDir, codeName, "project", "CLAUDE.md");
+  const { readdirSync: readdirSync7, readFileSync: rfs, existsSync: ex, writeFileSync: writeFileSync14 } = await import("fs");
+  const skillsDir = join24(configDir, codeName, "project", ".claude", "skills");
+  const claudeMdPath = join24(configDir, codeName, "project", "CLAUDE.md");
   if (!ex(skillsDir) || !ex(claudeMdPath)) return;
   const entries = [];
   for (const dir of readdirSync7(skillsDir).sort()) {
-    const skillFile = join23(skillsDir, dir, "SKILL.md");
+    const skillFile = join24(skillsDir, dir, "SKILL.md");
     if (!ex(skillFile)) continue;
     try {
       const { name, description } = parseSkillFrontmatter(rfs(skillFile, "utf-8"));
@@ -10699,7 +10739,7 @@ ${SKILLS_INDEX_END}`;
     next = current.trimEnd() + "\n\n" + section + "\n";
   }
   if (next !== current) {
-    writeFileSync13(claudeMdPath, next, "utf-8");
+    writeFileSync14(claudeMdPath, next, "utf-8");
     log2(
       injectSkillList ? `Refreshed skills index in CLAUDE.md for '${codeName}' (${entries.length} skills)` : `Refreshed CLAUDE.md managed block for '${codeName}' (skill list suppressed by claude-md-skills-index=false; ${entries.length} skills on disk)`
     );
@@ -10722,7 +10762,7 @@ function flushRestartedAgentDiagnostics(hostId, codeNames) {
   if (codeNames.length === 0) return;
   void (async () => {
     try {
-      const { collectDiagnostics } = await import("../persistent-session-A4VUV3UI.js");
+      const { collectDiagnostics } = await import("../persistent-session-ISBR3BBX.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics(codeNames, quarantineEntriesFor, claudeMdSizeFor)
@@ -10829,7 +10869,7 @@ async function pollCycle() {
     }
     try {
       const { detectHostSecurity } = await import("../host-security-6PDFG7F5.js");
-      const { collectDiagnostics } = await import("../persistent-session-A4VUV3UI.js");
+      const { collectDiagnostics } = await import("../persistent-session-ISBR3BBX.js");
       const diagCodeNames = [...agentState.persistentSessionAgents];
       const agentDiagnostics = diagCodeNames.length > 0 ? collectDiagnostics(diagCodeNames, quarantineEntriesFor, claudeMdSizeFor) : void 0;
       let tailscaleHostname;
@@ -10943,7 +10983,7 @@ async function pollCycle() {
         collectResponsivenessProbes,
         collectPanelessActivityProbes,
         getResponsivenessIntervalMs
-      } = await import("../responsiveness-probe-QRVMR22C.js");
+      } = await import("../responsiveness-probe-OT6JVP43.js");
       const probeIntervalMs = getResponsivenessIntervalMs();
       if (now - lastResponsivenessProbeAt > probeIntervalMs) {
         const probeCodeNames = [...agentState.persistentSessionAgents];
@@ -11007,7 +11047,7 @@ async function pollCycle() {
           collectResponsivenessProbes,
           livePendingInboundOldestAgeSeconds,
           parkPendingInbound
-        } = await import("../responsiveness-probe-QRVMR22C.js");
+        } = await import("../responsiveness-probe-OT6JVP43.js");
         const { getProjectDir: wedgeProjectDir } = await import("../scheduler-engine-NDP36U7O.js");
         const wedgeNow = /* @__PURE__ */ new Date();
         const liveAgents = agentState.persistentSessionAgents;
@@ -11099,10 +11139,10 @@ async function pollCycle() {
                 const paneTail = readFileSync20(paneLogPath(codeName), "utf8").slice(-65536);
                 const transient = detectTransientApiErrorInLog(paneTail);
                 if (transient) {
-                  const wedgeHome = join23(homedir10(), ".augmented", codeName);
+                  const wedgeHome = join24(homedir11(), ".augmented", codeName);
                   if (existsSync11(wedgeHome)) {
                     atomicWriteFileSync(
-                      join23(wedgeHome, "watchdog-give-up.json"),
+                      join24(wedgeHome, "watchdog-give-up.json"),
                       JSON.stringify({
                         gave_up_at: wedgeNow.toISOString(),
                         reason: "transient_overload"
@@ -11373,7 +11413,7 @@ async function pollCycle() {
         const adapter = resolveAgentFramework(prev.codeName);
         stopAgentRuntime2(prev.codeName, "removed-from-host");
         killAgentChannelProcesses(prev.codeName, { log });
-        const agentDir = join23(adapter.getAgentDir(prev.codeName), "provision");
+        const agentDir = join24(adapter.getAgentDir(prev.codeName), "provision");
         await cleanupAgentFiles(prev.codeName, agentDir);
         clearAgentCaches(prev.agentId, prev.codeName);
       }
@@ -11460,10 +11500,10 @@ async function pollCycle() {
         // pending-inbound marker. Best-effort: a write failure is logged by
         // the watchdog, never fails the poll cycle.
         signalGiveUp: (codeName) => {
-          const dir = join23(homedir10(), ".augmented", codeName);
+          const dir = join24(homedir11(), ".augmented", codeName);
           if (!existsSync11(dir)) return;
           atomicWriteFileSync(
-            join23(dir, "watchdog-give-up.json"),
+            join24(dir, "watchdog-give-up.json"),
             JSON.stringify({ gave_up_at: (/* @__PURE__ */ new Date()).toISOString() })
           );
         }
@@ -11547,6 +11587,7 @@ async function getOrCacheRegisteredAgents(adapter, profile) {
 }
 async function processAgent(agent, agentStates) {
   if (!config) return;
+  syncAccountEnforcementMarker(agent.code_name, agent.enforcement ?? null, log);
   const previousKnownStatus = agentState.knownStatuses.get(agent.agent_id);
   agentState.agentDisplayNames.set(agent.code_name, agent.display_name);
   agentState.codeNameToAgentId.set(agent.code_name, agent.agent_id);
@@ -11602,7 +11643,7 @@ async function processAgent(agent, agentStates) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const adapter = resolveAgentFramework(agent.code_name);
-  let agentDir = join23(adapter.getAgentDir(agent.code_name), "provision");
+  let agentDir = join24(adapter.getAgentDir(agent.code_name), "provision");
   if (agent.status === "draft" || agent.status === "paused") {
     if (previousKnownStatus !== agent.status) {
       log(`Agent '${agent.code_name}' is ${agent.status}, skipping provisioning`);
@@ -11775,7 +11816,7 @@ async function processAgent(agent, agentStates) {
   const frameworkId = refreshData.agent.framework ?? DEFAULT_FRAMEWORK;
   agentFrameworkCache.set(agent.code_name, frameworkId);
   const frameworkAdapter = getFramework(frameworkId);
-  agentDir = join23(frameworkAdapter.getAgentDir(agent.code_name), "provision");
+  agentDir = join24(frameworkAdapter.getAgentDir(agent.code_name), "provision");
   cacheAgentDeliveryMetadata(agent.code_name, refreshData);
   agentRestartTimezoneInputs.set(agent.code_name, {
     agentTimezone: typeof refreshData.agent.timezone === "string" ? refreshData.agent.timezone : null,
@@ -11822,9 +11863,9 @@ async function processAgent(agent, agentStates) {
   try {
     const artifacts = generateArtifacts(agent, refreshData, frameworkAdapter);
     const changedFiles = [];
-    mkdirSync10(agentDir, { recursive: true });
+    mkdirSync11(agentDir, { recursive: true });
     for (const artifact of artifacts) {
-      const filePath = join23(agentDir, artifact.relativePath);
+      const filePath = join24(agentDir, artifact.relativePath);
       let existingHash;
       let newHash;
       let writeContent = artifact.content;
@@ -11843,7 +11884,7 @@ async function processAgent(agent, agentStates) {
         };
         newHash = sha256(stripDynamicSections(artifact.content));
         try {
-          const projectClaudeMd = join23(config.configDir, agent.code_name, "project", "CLAUDE.md");
+          const projectClaudeMd = join24(config.configDir, agent.code_name, "project", "CLAUDE.md");
           const existing = readFileSync20(projectClaudeMd, "utf-8");
           existingHash = sha256(stripDynamicSections(existing));
         } catch {
@@ -11894,26 +11935,26 @@ async function processAgent(agent, agentStates) {
       }
     }
     if (changedFiles.length > 0) {
-      const isFirst = !existsSync11(join23(agentDir, "CHARTER.md"));
+      const isFirst = !existsSync11(join24(agentDir, "CHARTER.md"));
       const verb = isFirst ? "Provisioning" : "Updating";
       const fileNames = changedFiles.map((f) => f.relativePath).join(", ");
       log(`${verb} '${agent.code_name}': ${fileNames}`);
       for (const file of changedFiles) {
-        const filePath = join23(agentDir, file.relativePath);
-        mkdirSync10(dirname7(filePath), { recursive: true });
+        const filePath = join24(agentDir, file.relativePath);
+        mkdirSync11(dirname7(filePath), { recursive: true });
         if (file.relativePath === ".mcp.json") {
           safeWriteJsonAtomic(filePath, file.content, { mode: 384 });
         } else {
-          writeFileSync12(filePath, file.content);
+          writeFileSync13(filePath, file.content);
         }
       }
       try {
-        const provSkillsDir = join23(agentDir, ".claude", "skills");
+        const provSkillsDir = join24(agentDir, ".claude", "skills");
         if (existsSync11(provSkillsDir)) {
           for (const folder of readdirSync6(provSkillsDir)) {
             if (folder.startsWith("knowledge-")) {
               try {
-                rmSync5(join23(provSkillsDir, folder), { recursive: true });
+                rmSync6(join24(provSkillsDir, folder), { recursive: true });
               } catch {
               }
             }
@@ -11926,7 +11967,7 @@ async function processAgent(agent, agentStates) {
       const trackedFiles2 = frameworkAdapter.driftTrackedFiles();
       const hashes = /* @__PURE__ */ new Map();
       for (const file of trackedFiles2) {
-        const h = hashFile(join23(agentDir, file));
+        const h = hashFile(join24(agentDir, file));
         if (h) hashes.set(file, h);
       }
       agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -11944,14 +11985,14 @@ async function processAgent(agent, agentStates) {
     }
     if (Array.isArray(refreshData.workflows)) {
       try {
-        const provWorkflowsDir = join23(agentDir, ".claude", "workflows");
+        const provWorkflowsDir = join24(agentDir, ".claude", "workflows");
         if (existsSync11(provWorkflowsDir)) {
           const expected = new Set(refreshData.workflows.map((w) => `${w.name}.js`));
           for (const file of readdirSync6(provWorkflowsDir)) {
             if (!file.endsWith(".js")) continue;
             if (expected.has(file)) continue;
             try {
-              rmSync5(join23(provWorkflowsDir, file));
+              rmSync6(join24(provWorkflowsDir, file));
             } catch {
             }
           }
@@ -12033,7 +12074,7 @@ async function processAgent(agent, agentStates) {
   if (written && existsSync11(agentDir)) {
     const driftedFiles = [];
     for (const [file, expectedHash] of written) {
-      const localHash = hashFile(join23(agentDir, file));
+      const localHash = hashFile(join24(agentDir, file));
       if (localHash && localHash !== expectedHash) {
         driftedFiles.push(file);
       }
@@ -12044,7 +12085,7 @@ async function processAgent(agent, agentStates) {
       try {
         const localHashes = {};
         for (const file of driftedFiles) {
-          localHashes[file] = hashFile(join23(agentDir, file));
+          localHashes[file] = hashFile(join24(agentDir, file));
         }
         await api.post("/host/drift", {
           agent_id: agent.agent_id,
@@ -12231,15 +12272,15 @@ async function processAgent(agent, agentStates) {
     const addedChannels = [...restartDecision.added];
     const writeDmNoticeMarkers = isChannelAddRestart ? () => {
       try {
-        const agentAugmentedDir = join23(homedir10(), ".augmented", agent.code_name);
-        mkdirSync10(agentAugmentedDir, { recursive: true });
+        const agentAugmentedDir = join24(homedir11(), ".augmented", agent.code_name);
+        mkdirSync11(agentAugmentedDir, { recursive: true });
         const markerJson = JSON.stringify({
           version: 1,
           at: (/* @__PURE__ */ new Date()).toISOString(),
           added: addedChannels
         });
         for (const file of ["slack-channel-add-restart.json", "telegram-channel-add-restart.json"]) {
-          atomicWriteFileSync(join23(agentAugmentedDir, file), markerJson);
+          atomicWriteFileSync(join24(agentAugmentedDir, file), markerJson);
         }
       } catch (err) {
         log(`[hot-reload] channel-add DM-notice marker write failed for '${agent.code_name}' (non-fatal): ${err.message}`);
@@ -12428,18 +12469,18 @@ async function processAgent(agent, agentStates) {
   if (agentSessionMode === "persistent" && (agentFrameworkCache.get(agent.code_name) ?? DEFAULT_FRAMEWORK) === "claude-code") {
     try {
       const agentProvisionDir = agentDir;
-      const projectDir = join23(homedir10(), ".augmented", agent.code_name, "project");
-      mkdirSync10(agentProvisionDir, { recursive: true });
-      mkdirSync10(projectDir, { recursive: true });
-      const provisionMcpPath = join23(agentProvisionDir, ".mcp.json");
-      const projectMcpPath = join23(projectDir, ".mcp.json");
+      const projectDir = join24(homedir11(), ".augmented", agent.code_name, "project");
+      mkdirSync11(agentProvisionDir, { recursive: true });
+      mkdirSync11(projectDir, { recursive: true });
+      const provisionMcpPath = join24(agentProvisionDir, ".mcp.json");
+      const projectMcpPath = join24(projectDir, ".mcp.json");
       let mcpConfig = { mcpServers: {} };
       try {
         mcpConfig = JSON.parse(readFileSync20(provisionMcpPath, "utf-8"));
         if (!mcpConfig.mcpServers) mcpConfig.mcpServers = {};
       } catch {
       }
-      const localDirectChatChannel = join23(homedir10(), ".augmented", "_mcp", "direct-chat-channel.js");
+      const localDirectChatChannel = join24(homedir11(), ".augmented", "_mcp", "direct-chat-channel.js");
       const directChatTeamSettings = refreshData.team?.settings;
       const directChatTz = (() => {
         const tz = directChatTeamSettings?.["timezone"];
@@ -12465,7 +12506,7 @@ async function processAgent(agent, agentStates) {
           // ~/.augmented/<codeName>/.current-turn-initiator.json. Note getAgentDir
           // returns the agent root (NOT the /provision subdir `agentDir` points at),
           // so it byte-matches the broker readers' path.
-          AGT_TURN_INITIATOR_FILE: join23(
+          AGT_TURN_INITIATOR_FILE: join24(
             frameworkAdapter.getAgentDir(agent.code_name),
             ".current-turn-initiator.json"
           )
@@ -12485,10 +12526,10 @@ async function processAgent(agent, agentStates) {
           log(`Channel credentials written for '${agent.code_name}/direct-chat'`);
         }
       }
-      const staleChannelsPath = join23(projectDir, ".mcp-channels.json");
+      const staleChannelsPath = join24(projectDir, ".mcp-channels.json");
       if (existsSync11(staleChannelsPath)) {
         try {
-          rmSync5(staleChannelsPath, { force: true });
+          rmSync6(staleChannelsPath, { force: true });
         } catch {
         }
       }
@@ -12575,7 +12616,7 @@ async function processAgent(agent, agentStates) {
     }
     if (hostFlagStore().getBoolean("connectivity-probe")) {
       try {
-        const probeProjectDir = join23(homedir10(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join24(homedir11(), ".augmented", agent.code_name, "project");
         let probeSet = integrations;
         try {
           const quarantined = await api.post("/host/agent-integrations/quarantined", { agent_id: agent.agent_id });
@@ -12621,7 +12662,7 @@ async function processAgent(agent, agentStates) {
       const forceDue = attemptsLeft > 0;
       let probeRan = false;
       try {
-        const probeProjectDir = join23(homedir10(), ".augmented", agent.code_name, "project");
+        const probeProjectDir = join24(homedir11(), ".augmented", agent.code_name, "project");
         probeRan = await runAgentSessionToolBindProbes(agent, integrations, probeProjectDir, { forceDue });
       } catch (err) {
         log(`Session-tool-bind probe failed for '${agent.code_name}': ${err.message}`);
@@ -12696,8 +12737,8 @@ async function processAgent(agent, agentStates) {
       const intHash = computeIntegrationsHash(integrations);
       const prevIntHash = agentState.knownIntegrationHashes.get(agent.agent_id);
       if (intHash !== prevIntHash) {
-        const projectDir = join23(homedir10(), ".augmented", agent.code_name, "project");
-        const envIntPath = join23(projectDir, ".env.integrations");
+        const projectDir = join24(homedir11(), ".augmented", agent.code_name, "project");
+        const envIntPath = join24(projectDir, ".env.integrations");
         let preWriteEnv;
         try {
           preWriteEnv = readFileSync20(envIntPath, "utf-8");
@@ -12717,7 +12758,7 @@ async function processAgent(agent, agentStates) {
         }
         if (fw === "claude-code" && isSessionHealthy(agent.code_name)) {
           try {
-            const projectMcpPath = join23(projectDir, ".mcp.json");
+            const projectMcpPath = join24(projectDir, ".mcp.json");
             const postWriteEnv = readFileSync20(envIntPath, "utf-8");
             const mcpContent = readFileSync20(projectMcpPath, "utf-8");
             const changedVars = diffEnvIntegrations(preWriteEnv, postWriteEnv);
@@ -12965,17 +13006,17 @@ async function processAgent(agent, agentStates) {
         }
       }
       try {
-        const { readdirSync: readdirSync7, rmSync: rmSync6 } = await import("fs");
-        const { homedir: homedir11 } = await import("os");
+        const { readdirSync: readdirSync7, rmSync: rmSync7 } = await import("fs");
+        const { homedir: homedir12 } = await import("os");
         const frameworkId2 = frameworkAdapter.id;
         const candidateSkillDirs = [
           // Claude Code — framework runtime tree
-          join23(homedir11(), ".augmented", agent.code_name, "skills"),
+          join24(homedir12(), ".augmented", agent.code_name, "skills"),
           // Claude Code — project tree
-          join23(homedir11(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+          join24(homedir12(), ".augmented", agent.code_name, "project", ".claude", "skills"),
           // Defensive: legacy provision-side path, not currently an
           // install target but cheap to sweep.
-          join23(agentDir, ".claude", "skills")
+          join24(agentDir, ".claude", "skills")
         ];
         const existingDirs = candidateSkillDirs.filter((d) => existsSync11(d));
         const discoveredEntries = /* @__PURE__ */ new Set();
@@ -12991,9 +13032,9 @@ async function processAgent(agent, agentStates) {
         }
         const removeSkillFolder = (entry, reason) => {
           for (const dir of existingDirs) {
-            const p = join23(dir, entry);
+            const p = join24(dir, entry);
             if (existsSync11(p)) {
-              rmSync6(p, { recursive: true, force: true });
+              rmSync7(p, { recursive: true, force: true });
             }
           }
           log(`Removed ${reason} '${entry}' for '${agent.code_name}' (framework=${frameworkId2})`);
@@ -13011,7 +13052,7 @@ async function processAgent(agent, agentStates) {
         const sharedSkillsPayload = refreshAny.shared_skills;
         const desiredResolved = globalSkillsPayload !== void 0 || sharedSkillsPayload !== void 0;
         const manifestPath = managedSkillManifestPath(
-          join23(homedir10(), ".augmented", agent.code_name)
+          join24(homedir11(), ".augmented", agent.code_name)
         );
         const prevIds = /* @__PURE__ */ new Set([
           ...agentState.knownGlobalSkillIds.get(agent.agent_id) ?? /* @__PURE__ */ new Set(),
@@ -13031,16 +13072,16 @@ async function processAgent(agent, agentStates) {
         }
         if (plan.removes.length) {
           const globalSkillDirs = [
-            join23(homedir10(), ".augmented", agent.code_name, "skills"),
-            join23(homedir10(), ".augmented", agent.code_name, "project", ".claude", "skills"),
-            join23(agentDir, ".claude", "skills")
+            join24(homedir11(), ".augmented", agent.code_name, "skills"),
+            join24(homedir11(), ".augmented", agent.code_name, "project", ".claude", "skills"),
+            join24(agentDir, ".claude", "skills")
           ];
           for (const id of plan.removes) {
             let prunedAny = false;
             for (const dir of globalSkillDirs) {
-              const p = join23(dir, id);
-              if (existsSync11(p) && existsSync11(join23(p, "SKILL.md"))) {
-                rmSync5(p, { recursive: true, force: true });
+              const p = join24(dir, id);
+              if (existsSync11(p) && existsSync11(join24(p, "SKILL.md"))) {
+                rmSync6(p, { recursive: true, force: true });
                 prunedAny = true;
               }
             }
@@ -13258,7 +13299,7 @@ async function processAgent(agent, agentStates) {
         const sess = getSessionState(agent.code_name);
         let mcpJsonParsed = null;
         try {
-          const mcpPath = join23(getProjectDir(agent.code_name), ".mcp.json");
+          const mcpPath = join24(getProjectDir(agent.code_name), ".mcp.json");
           mcpJsonParsed = JSON.parse(readFileSync20(mcpPath, "utf-8"));
         } catch {
         }
@@ -13624,7 +13665,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
   if (trackedFiles.length > 0 && existsSync11(agentDir)) {
     const hashes = /* @__PURE__ */ new Map();
     for (const file of trackedFiles) {
-      const h = hashFile(join23(agentDir, file));
+      const h = hashFile(join24(agentDir, file));
       if (h) hashes.set(file, h);
     }
     agentState.writtenHashes.set(agent.agent_id, hashes);
@@ -13639,7 +13680,7 @@ Retried to the limit after repeated stalls \u2014 needs a look.`).catch(() => {
         refreshData.agent.onboarding_state
       );
       const obStep = obState.step;
-      const markerPath = join23(homedir10(), ".augmented", agent.code_name, "onboarding-drive.json");
+      const markerPath = join24(homedir11(), ".augmented", agent.code_name, "onboarding-drive.json");
       const marker = readOnboardingDriveMarker(markerPath);
       const decision = decideOnboardingDrive(obStep, marker, Date.now(), obState.generation ?? 0);
       if (decision.clearMarker) {
@@ -13727,7 +13768,7 @@ async function ensureOpencodeRuntime(agent, refreshData, agentTimezone) {
   }
   stopOpencodeSlackIngest(codeName, log);
   stopOpencodeTelegramIngest(codeName, log);
-  const opencodeProjectDir = join23(getFramework("opencode").getAgentDir(codeName), "provision");
+  const opencodeProjectDir = join24(getFramework("opencode").getAgentDir(codeName), "provision");
   const serveEnv = {
     AGT_HOST: requireHost(),
     AGT_API_KEY: getApiKey() ?? void 0,
@@ -13770,8 +13811,8 @@ async function ensureOpencodeRuntime(agent, refreshData, agentTimezone) {
 async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   const codeName = agent.code_name;
   const projectDir = getProjectDir(codeName);
-  const mcpConfigPath = join23(projectDir, ".mcp.json");
-  const claudeMdPath = join23(projectDir, "CLAUDE.md");
+  const mcpConfigPath = join24(projectDir, ".mcp.json");
+  const claudeMdPath = join24(projectDir, "CLAUDE.md");
   if (restartBreaker.isTripped(codeName)) {
     const trip = restartBreaker.getTrip(codeName);
     return {
@@ -14323,7 +14364,7 @@ async function handleRestartDoorbell(agentId, requestedAt, restartReason) {
     void api.post("/host/restart-ack", { host_id: hostId, agent_id: agentId, restart_requested_at: requestedAt }).catch((err) => log(`[restart-lane] ack failed for '${codeName}': ${err.message}`));
     void (async () => {
       try {
-        const { collectDiagnostics } = await import("../persistent-session-A4VUV3UI.js");
+        const { collectDiagnostics } = await import("../persistent-session-ISBR3BBX.js");
         await api.post("/host/heartbeat", {
           host_id: hostId,
           agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -14373,7 +14414,7 @@ async function respawnAgentAfterMcpStop(codeName, reason) {
     }
     try {
       const hostId = await getHostId();
-      const { collectDiagnostics } = await import("../persistent-session-A4VUV3UI.js");
+      const { collectDiagnostics } = await import("../persistent-session-ISBR3BBX.js");
       await api.post("/host/heartbeat", {
         host_id: hostId,
         agent_diagnostics: collectDiagnostics([codeName], quarantineEntriesFor, claudeMdSizeFor)
@@ -14658,9 +14699,9 @@ async function processDirectChatMessage(agent, msg) {
     const useDoorbell = hostFlagStore().getBoolean("direct-chat-doorbell") || isolationMode(agent.codeName) === "docker";
     if (useDoorbell) {
       try {
-        const doorbell = directChatDoorbellPath(agent.agentId, homedir10());
-        mkdirSync10(dirname7(doorbell), { recursive: true });
-        writeFileSync12(doorbell, String(Date.now()));
+        const doorbell = directChatDoorbellPath(agent.agentId, homedir11());
+        mkdirSync11(dirname7(doorbell), { recursive: true });
+        writeFileSync13(doorbell, String(Date.now()));
         log(`[direct-chat] Doorbell rung for '${agent.codeName}' (msg=${msg.id}) \u2014 in-session MCP will pull via the cursor`);
         return;
       } catch (err) {
@@ -14768,9 +14809,9 @@ ${formatRunMarker(run_id)}` : KANBAN_CHECK_COMMAND;
   }
   if (run_id) openInjectedRunByCode.set(codeName, run_id);
   try {
-    const doorbell = directChatDoorbellPath(agentId, homedir10());
-    mkdirSync10(dirname7(doorbell), { recursive: true });
-    writeFileSync12(doorbell, String(Date.now()));
+    const doorbell = directChatDoorbellPath(agentId, homedir11());
+    mkdirSync11(dirname7(doorbell), { recursive: true });
+    writeFileSync13(doorbell, String(Date.now()));
   } catch (err) {
     log(`[kanban] doorbell ring failed for '${codeName}': ${err.message} (notice still queued)`);
   }
@@ -14826,7 +14867,7 @@ async function processClaudePairSessions(agents) {
     killPairSession,
     pairTmuxSession,
     finalizeClaudePairOnboarding
-  } = await import("../claude-pair-runtime-44RPFRIE.js");
+  } = await import("../claude-pair-runtime-YAHBPFYL.js");
   for (const pairId of pendingResp.cancelled_pair_ids ?? []) {
     log(`[claude-pair] sweeping orphan tmux session for pair ${pairId.slice(0, 8)}`);
     const killed = await killPairSession(pairTmuxSession(pairId));
@@ -15076,8 +15117,8 @@ function parseMemoryFile(raw, fallbackName) {
   };
 }
 async function syncMemories(agent, configDir, log2) {
-  const projectDir = join23(configDir, agent.code_name, "project");
-  const memoryDir = join23(projectDir, "memory");
+  const projectDir = join24(configDir, agent.code_name, "project");
+  const memoryDir = join24(projectDir, "memory");
   const isFreshSync = pendingFreshMemorySync.has(agent.agent_id);
   if (isFreshSync) {
     log2(`[memory-sync] Fresh-sync requested for '${agent.code_name}' \u2014 pulling DB first`);
@@ -15095,7 +15136,7 @@ async function syncMemories(agent, configDir, log2) {
     for (const file of readdirSync6(memoryDir)) {
       if (!file.endsWith(".md")) continue;
       try {
-        const raw = readFileSync20(join23(memoryDir, file), "utf-8");
+        const raw = readFileSync20(join24(memoryDir, file), "utf-8");
         const fileHash = createHash15("sha256").update(raw).digest("hex").slice(0, 16);
         currentHashes.set(file, fileHash);
         if (prevHashes.get(file) === fileHash) continue;
@@ -15120,7 +15161,7 @@ async function syncMemories(agent, configDir, log2) {
       } catch (err) {
         for (const mem of changedMemories) {
           for (const [file] of currentHashes) {
-            const parsed = parseMemoryFile(readFileSync20(join23(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
+            const parsed = parseMemoryFile(readFileSync20(join24(memoryDir, file), "utf-8"), file.replace(/\.md$/, ""));
             if (parsed?.name === mem.name) currentHashes.delete(file);
           }
         }
@@ -15148,14 +15189,14 @@ async function downloadMemories(agent, memoryDir, log2, { force }) {
     lastDownloadHash.set(agent.agent_id, responseHash);
     lastLocalFileHash.set(agent.agent_id, localListHash);
     if (dbMemories.memories?.length) {
-      mkdirSync10(memoryDir, { recursive: true });
+      mkdirSync11(memoryDir, { recursive: true });
       let written = 0;
       let overwritten = 0;
       for (let i = 0; i < dbMemories.memories.length; i++) {
         const mem = dbMemories.memories[i];
         const rawSlug = mem.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "").slice(0, 60);
         const slug = rawSlug || `memory-${i}`;
-        const filePath = join23(memoryDir, `${slug}.md`);
+        const filePath = join24(memoryDir, `${slug}.md`);
         const desired = `---
 name: ${JSON.stringify(mem.name)}
 type: ${mem.type}
@@ -15171,10 +15212,10 @@ ${mem.content}
           } catch {
           }
           if (existing === desired) continue;
-          writeFileSync12(filePath, desired);
+          writeFileSync13(filePath, desired);
           overwritten++;
         } else {
-          writeFileSync12(filePath, desired);
+          writeFileSync13(filePath, desired);
           written++;
         }
       }
@@ -15193,7 +15234,7 @@ ${mem.content}
 async function cleanupAgentFiles(codeName, agentDir) {
   if (existsSync11(agentDir)) {
     try {
-      rmSync5(agentDir, { recursive: true, force: true });
+      rmSync6(agentDir, { recursive: true, force: true });
       log(`Removed provision directory for '${codeName}'`);
     } catch (err) {
       log(`Failed to remove provision dir for '${codeName}': ${err.message}`);
@@ -15458,7 +15499,7 @@ function startManager(opts) {
     log(`[startup] state rehydration failed (continuing with empty state): ${err.message}`);
   }
   log(
-    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join23(homedir10(), ".augmented", "manager.log")}`
+    `[startup] worker pid=${process.pid} ppid=${process.ppid} node=${process.version} log=${join24(homedir11(), ".augmented", "manager.log")}`
   );
   deployMcpAssets();
   reapOrphanChannelMcps({ log });
@@ -15584,14 +15625,14 @@ function restartRunningChannelMcps(basenames) {
   }
 }
 function deployMcpAssets() {
-  const targetDir = join23(homedir10(), ".augmented", "_mcp");
-  mkdirSync10(targetDir, { recursive: true });
+  const targetDir = join24(homedir11(), ".augmented", "_mcp");
+  mkdirSync11(targetDir, { recursive: true });
   const moduleDir = dirname7(fileURLToPath(import.meta.url));
   let mcpSourceDir = "";
   let dir = moduleDir;
   for (let i = 0; i < 6; i++) {
-    const candidate = join23(dir, "dist", "mcp");
-    if (existsSync11(join23(candidate, "index.js"))) {
+    const candidate = join24(dir, "dist", "mcp");
+    if (existsSync11(join24(candidate, "index.js"))) {
       mcpSourceDir = candidate;
       break;
     }
@@ -15671,8 +15712,8 @@ function deployMcpAssets() {
     // needs restarting to pick up a token rotation.
     "xero.js"
   ]) {
-    const src = join23(mcpSourceDir, file);
-    const dst = join23(targetDir, file);
+    const src = join24(mcpSourceDir, file);
+    const dst = join24(targetDir, file);
     if (!existsSync11(src)) continue;
     const before = fileHash(dst);
     try {
@@ -15690,14 +15731,14 @@ function deployMcpAssets() {
     log(`[manager] Bundle(s) updated: ${changedBasenames.join(", ")} \u2014 signalling running instances to restart`);
     restartRunningChannelMcps(changedBasenames);
   }
-  const localMcpPath = join23(targetDir, "index.js");
+  const localMcpPath = join24(targetDir, "index.js");
   try {
-    const agentsDir = join23(homedir10(), ".augmented", "agents");
+    const agentsDir = join24(homedir11(), ".augmented", "agents");
     if (existsSync11(agentsDir)) {
       for (const entry of readdirSync6(agentsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         for (const subdir of ["provision", "project"]) {
-          const mcpJsonPath = join23(agentsDir, entry.name, subdir, ".mcp.json");
+          const mcpJsonPath = join24(agentsDir, entry.name, subdir, ".mcp.json");
           try {
             const raw = readFileSync20(mcpJsonPath, "utf-8");
             if (!raw.includes("@integrity-labs/augmented-mcp")) continue;
@@ -15706,7 +15747,7 @@ function deployMcpAssets() {
             if (!augServer) continue;
             augServer.command = "node";
             augServer.args = [localMcpPath];
-            writeFileSync12(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
+            writeFileSync13(mcpJsonPath, JSON.stringify(mcpConfig, null, 2));
             log(`[manager] Patched ${entry.name}/${subdir}/.mcp.json: npx \u2192 node`);
           } catch {
           }